PAGENO="0001"
NUCLEAR POWERPLANT SAFETY SYSTEMS
HEARINGS
BEFORE THE
SUBCOMMITTEE ON
ENERGY RESEARCH AND PRODUCTION
OF THE
COMMITTEE ON
SCIENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
NINETY-SIXTH CONGRESS
FIRST SESSION
MAY 22, 23, 24, 1979
[No. 32]
Printed for the use of the
Committee on Science and Technology
U.S. GOVERNMENT PRINTING OFFICE
48-721 0 WASHINGTON: 1979
For sale by the Superintendent of Documents, U.S. Government Printing Office
Washington, D.C., 20402
PAGENO="0002"
COMMITTEE ON SCIENCE AND TECHNOLOGY
DON FUQUA, Florida, Chairman
ROBERT A. ROE, New Jersey
MIKE McCORMACK, Washington
GEORGE E. BROWN, JR., California
JAMES H. SCHEUER, New York
RICHARD L. OITINGER, New York
TOM HARKIN, Iowa
JIM LLOYD, California
JEROME A. AMBRO, New York
MARILYN LLOYD BOUQUARD, Tennessee
JAMES J. BLANCHARD, Michigan
DOUG WALGREN, Pennsylvania
RONNIE G. FLIPPO, Alabama
DAN GLICKMAN, Kansas
ALBERT GORE, JR., Tennessee
WES WATKINS, Oklahoma
ROBERTA. YOUNG, Missouri
RICHARD C. WHITE, Texas
HAROLD L. VOLKMER, Missouri
DONALD J. PEASE, Ohio
HOWARD WOLPE, Michigan
NICHOLAS MAVROULES, Massachusetts
BILL NELSON, Florida
BERYL ANTHONY, JR., Arkansas
STANLEY N. LUNDINE, New York
ALLEN E. ERTEL, Pennsylvania
KENT HANCE, Texas
HAIIoU) A. Gouu, Executive Director
PHILIP B. YEAGER, General Counsel
REGINA A. DAVIS, Chief Clerk
PAUL A. VANDER MYDE, Minority Staff Director
SUBCOMMITrEE ON ENERGY RESEARCH AND PRODUCTION
MIKE McCORMACK, Washington, Chairman
MARILYN LLOYD BOUQUARD, Tennessee JOHN W. WYDLER, New York
ROBERT A. ROE, New Jersey EDWIN B. FORSYTHE, New Jersey
STANLEY N. LUNDINE, New York TOBY ROTH, Wisconsin
ROBERT A. YOUNG, Missouri BARRY M. GOLDWATER, JR., California
RICHARD C. WHITE, Texas MANUEL LUJAN, JR., New Mexico
HOWARD WOLPE, Michigan HAROLD C. HOLLENBECK, New Jersey
RNNIE G. FLIPPO Alabama
NICHOLAS MAVROULES, Massachusetts
RICHARD L. O~ETINGER, New York
BERYL ANTHONY, JR., Arkansas
JOHN W. WYDLER, New York
LARRY WINN, JR., Kansas
BARRY M. GOLDWATER, JR., California
HAMILTON FISH, JR., New York
MANUEL LUJAN, JR., New Mexico
HAROLD C. HOLLENBECK, New Jersey
ROBERT K. DORNAN, California
ROBERT S. WALKER, Pennsylvania
EDWIN B. FORSYTHE, New Jersey
KEN KRAMER, Colorado
WILLIAM CARNEY, New York
ROBERT W. DAVIS, Michigan
TOBY ROTH, Wisconsin
DONALD LAWRENCE RY[TER,
Pennsylvania
BILL ROYER, California
(II)
PAGENO="0003"
CONTENTS
WITNESSES
May 22, 1979: Page
Dr. Joseph Dietrich, chief scientist, Nuclear Power Systems, Combustion
Engineering 6
Milton Levenson, director, Nuclear Power Division, Electric Power Re-
search Institute 16
William Kennedy, vice president and director of engineering, Stone &
Webster Engineering Corp 26
Dr. Chauncey Kepford, director, Environmental Coalition on Nuclear
Power 30
Saul Levine, director, Office of Nuclear Regulatory Research, Nuclear
Regulatory Commission 92
Dr. Harold W. Lewis, professor of physics, University of California 117
Appendix I:
Questions and answers for the record 136
Appendix II:
Additional material for the record 247
May 23, 1979:
Glen J. Schoessow, professor of nuclear engineering, University of Florida,
accompanied by Dr. John G. Stampelos and Fred Domerow 332
Hon. John W. Wydler, U.S. Representative from the State of New York ... 342
John Macmillan, vice president, Nuclear Power Generation Division, Bab-
cock & Wilcox Co., accompanied by Donald Roy, Manager, Engineering,
Nuclear Power Generation Division 343
Herman Dieckamp, president, General Public Utilities Corp 411
Hon. William W. Scranton III, lieutenant governor, Commonwealth of
Pennsylvania 425
Harold Denton, director, Office of Nuclear Reactor Regulation, Nuclear
Regulatory Commission, accompanied by Roger Mattson, director, Divi-
sion of System Safety, Nuclear Regulatory Commission, and Frank
Congel, acting branch chief, Radiological Assessment Branch, Nuclear
Regulatory Commission 453
Appendix I:
Questions and answers for the record 496
May 24, 1979:
Dr. Lars Larsson, technical and scientific attaché, The Swedish Embassy,
accompanied by Ingmar Tiren, Manager, Nuclear Safety and Licensing
(ASEA-ATOM), Vasteran, Sweden 857
George M. Low, president, Rensselaer Polytechnic Institute 880
Adm. H. G. Rickover, USN, director, Naval Nuclear Propulsion Program.. 917
Appendix I:
Additional material for the record 1178
(III)
PAGENO="0004"
PAGENO="0005"
NUCLEAR POWERPLANT SAFETY SYSTEMS
TUESDAY, MAY 22, 1979
HOUSE OF REPRESENTATIVES,
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION,
COMMITTEE ON SCIENCE AND TECHNOLOGY,
Washington, D.C.
The subcommittee met, pursuant to notice, at 9:45 a.m., in room
2318, Rayburn House Office Building, Hon. Mike McCormack
(chairman of the subcommittee) presiding.
Mr. MCCORMACK. The meeting will come to order, please.
Good morning, ladies and gentlemen.
Today the Subcommittee on Energy Research and Production
starts 3 days of hearings on the issue of nuclear powerplant safety.
As we are all aware, this subject has been in the public's mind
since the Three Mile Island accident on March 28. However, it is
important to note that nuclear safety is not a new issue with this
committee or with its predecessor, the Joint~Committee on Atomic
Energy. It is not a new issue with the Nuclear Regulatory Commis-
sion or is predecessor, the Atomic Energy Commission. Indeed, it is
not a new issue with the nuclear industry.
The need for strict safety precautions has been recognized since
the inception of nuclear power development, and this is borne out,
of course, by the excellent safety record of our nuclear power-
plants. Not a single person has ever been harmed by any nuclear
accident in any nuclear powerplant anywhere in the free world.
However, it is clear that if nuclear energy is to move forward as
a major contributing factor in the energy mix of the free world, the
questions concerning nuclear safety that are in the public's mind
and that have been exaggerated by the Three Mile Island accident
must be understood, must be answered, and must be rationalized.
The hearings beginning today are the second in a series of three
sets of hearings on nuclear issues which this subcommittee is ad-
dressing.
Last week the subcommittee held three hearings on nuclear
waste management, and on June 13, 14, and 15 they will hold 3
days of hearings on low-level radiation.
The Three Mile Island accident, focusing our attention on the
question of nuclear safety, was clearly a serious accident. There
were a number of mechanical failures, possible design weaknesses,
and possible operator errors. All these mechanical failure, design
weaknesses, and human errors occurring together in a very short
time made the accident as serious as it was. However, it was not a
catastrophe, and the maximum radiation exposure received by any
citizen was at most equivalent to an X-ray.
(1)
PAGENO="0006"
2
Similarly, we must remember that this Nation has accumulated
about 460 reactor years of experience with licensed commercial
nuclear powerplants, and a much larger amount of experience with
our naval nuclear reactor program. There are more than 100 li-
censed nuclear powerplants operating outside the United States in
the free world, also contributing to that pooi of knowledge and
experience.
In all that time, as I say, there has never been a single person
harmed, let alone killed, by any nuclear accident in any nuclear
powerplant.
I want to emphasize that these hearings today will be broad in
scope. We are starting with the basic concepts of nuclear power-
plant construction, philosophy, safety, and operation.
The main objective of holding these hearings is to help the
committee, and the Congress, and members of the public to under-
stand the questions associated with nuclear powerplant safety.
Also, to help the committee and the Congress to take what steps it
feels necessary in assuring that our nuclear powerplants will be
even safer in the future than they are today.
Learning the lessons from Three Mile Island, asking the tough
questions, and providing responsible answers to them will be part
of the functioning of this committee.
This committee, by the way, has the responsibility for energy
research, development, and demonstration associated with our nu-
clear powerplant research, development, and demonstration pro-
grams which ultimately will lead to commercialization.
In conducting these hearings, the subcommittee intends to ex-
plore every aspect of safety technology and to conduct a thorough
review of the status of the technology. We want to develop a
detailed understanding of nuclear safety and operating philosophy
as well as the implications of the Three Mile Island accident and
any other accident.
In so doing, we will seek unique perspectives from outside the
nuclear energy community itself and, among others, we will hear
from Admiral Rickover, to learn his perspectives on providing ade-
quate safety standards for a nuclear system. But today the hear-
ings will concentrate on the philosophy and the status of technol-
ogy of safety systems and procedures.
Today's hearings will include testimony from the nuclear indus-
try, the Nuclear Regulatory Commission, and a nuclear critic. The
Rasmussen report on reactory safety will also be discussed, togeth-
er with recent criticism of it by the Lewis panel. Tomorrow, wit-
nesses will concentrate on the Three Mile Island accident itself and
its technological implications. That testimony will cover industry,
utility, regulatory, and State government views of the accident.
We are particularly interested in the system failures and the
extent to which human error played a role in the accident.
The final hearings on Thursday will provide additional perspec-
tives on nuclear safety. Representatives of the Swedish nuclear
industry will testify about this program, and Admiral Rickover, as
I have said, head of the naval nuclear reactor program, and Dr.
George Low, former Deputy Administrator of the National Aero-
nautics and Space Administration, will provide their unique views
PAGENO="0007"
3
on safety systems and methods for improving the interface between
men and machines;
Before we move into our testimony this morning, I would like to
introduce some distinguished guests that we are honored to have
visiting us today. We have with us four Members of the French
Parliament, the equivalent of our Congress, and they are seated
here to my left, in the front row.
Since I am not very good at speaking French or pronouncing
French names, I would like to ask Dr. Pierre Zaleski, the nuclear
attaché of the French Embassy, to introduce our guests from the
French Parliament.
Dr. Zaleski.
Dr. ZALESKI. Thank you, Mr. McCormack.
We have here a delegation of French Parliament, the head of the
delegation on my left is Mr. M. Xavier Hamelin, President, Depute
du Rhone, l2eme circonscription-Groupe du Rasemblement pour
la Republique; Vice President de la Commission de la Production et
des Echanges; Conseiller municipal de la Mulatiere; Ne le 4 fevrier
1922. au Lardin-Dordogne; Ingenieur chimiste; Elu a l'Assemblee
Nationale le 11 mars 1973; Reelu le 19 mars 1978.
Membres: M. Roger Couhier, Depute de la Seine-Saint-Denis,
5eme circonscription-Groupe communiste; Marie de Noisy-le-Sec;
Ne le 26 janvier 1928 a Vitrai-sous-Laigle-Orne; Employe a la
S.N.C.F.; Elu a l'Assemblee Nationale le 12 mars 1967; Reelu les 11
mars 1973 et 19 ars 1978.
M. Paul Pernin, Depute de Paris, ileme circonscription-Appar-
ente au groupe de l'Union pour la Democratie fracaise; Marie-
adjoint de Paris; Ne le 30 octobre 1914 a Oran-Algerie; Conseil
d'entreprise; Elu a l'Assemblee Nationale le 19 mars 1978.
M. Allain Chernard, Depute de Loire-Atlantique, 2eme circon-
scription-Groupe socialiste; Conseiller general, Marie de Nantes;
Ne le 20 fevrier 1937 a Nantes-Loire-Atlantique; Ingenieur; Elu a
l'Assemblee Nationale le 19 mars 1978.
Mr. MCCORMACK. Thank you very much.
I think we ought to give our French guests a hand. [Applause.]
May I say for the benefit of the audience that the blonde lady in
the middle, who was not introduced, is an interpreter, and since I
can't speak French names, I am going to have trouble with that
one too. I want to welcome all of you, and say that the representa-
tives introduced represent four different French political parties.
France has a unified program which provides nuclear leadership
throughout the world. Not only are they moving forward agressive-
ly with their light-water reactor program, their pressurized-water
reactors, but they are also moving forward with the breeder
program.
The French Phenix has been on line since 1973 and it is perform-
ing beautifully. The Super Phenix is under construction near Lyon.
The French are glassifying waste and they are way ahead of the
rest of the free world in that. They now have a major uranium
enrichment program, and of course a reprocessing program. They
are providing leadership for all the free world, and we congratulate
them on that, and I want to thank you gentlemen.
PAGENO="0008"
4
Members who left after they were introduced are going to an-
other committee meeting, but they are going as a team, to come
here and look at our nuclear program.
Before we begin our testimony I would like to welcome Congress-
man Goldwater this morning, and I want -to ask Mr. Goldwater if
he would like to make an opening statement.
Mr. GOLDWATER. Thank you very much, Mr. Chairman.
I join you in welcoming our friends from France. France is a
great country, and they are a great people, who I think provide our
world with leadership and who have made a significant contribu-
tion to mankind, and I think it is a wonderful gesture when Mem-
bers of the French Parliament come over to exchange ideas and to
learn some of the things that we are doing, and hopefully we can
learn from them.
I think, Mr. Chairman, these hearings are timely. I think this
committee must look carefully at the status of safety technology
and related procedures and practices for operating nuclear plants.
These hearings should indicate where technology improvements
are warranted so that the committee can identify areas for specific
program initiatives.
This is a time for frankness. No one can afford to overlook any
aspects of safety which can reasonably be enhanced. Although the
nuclear safety record has been very impressive, neither the indus-
try nor the utiljties can afford to approach nuclear safety with a
business as usual view. A serious accident did occur, and we must
learn from it.
Today we will learn where the technology is so we can identify
specific elements which must be enhanced. Public perception of
these issues demands fresh scrutiny I of how to plan for likely
events. We should not succumb to any temptation to preoccupy
ourselves with a series of improbable accidents. The combination of
human error and absence of adequate instrumentation played a
role in this incident, and we must look carefully at aspects of the
man-machine interface.
I believe that our witnesses on the third day will provide unique
perspectives from outside of the U.S. civilian nuclear community.
From tl~e aerospace aspect, I intend to see that the Three Mile
Island becomes the Apollo fire for the nuclear industry. I also
believe that we should learn from the naval nuclear propulsion
program, which utilizes a most thorough system of training, and
checks and balances, to insure that their excellent people are given
top quality training.
This is a time for soul searching, Mr. Chairman, for without the
nuclear option, this country's energy supply problem will be great-
ly aggravated.
Thank you, Mr. Chairman.
Mr. MCCORMACK. Thank you, Mr. Goldwater.
Before we proceed with our hearings, I am going to make an
announcement for the record.
During our hearings last week on high-level nuclear waste man-
agement, it became obvious that we are taking too much time with
questions and discussions, thus depriving ourselves of the balanced
presentation available if all witnesses were to be heard. This is also
PAGENO="0009"
o
unfair to the witnesses, several of whom have come long distances
to testify.
I expect that this problem of not having enough time for every-
one to ask questions, and to say everything he or she wishes, will
become apparent this week as we conduct our hearings on nuclear
powerplant safety.
It will be obvious that we have attempted to schedule a large
number of expert witnesses to provide the members of the commit-
tee with the benefit of testimony from a number of different view-
points.
In order to make it possible for us to complete our hearings on
schedule, it will be necessary for the Chair to sharply restrict the
amount of time allowed for questions. Accordingly, the 5-minute
rule will be strictly enforced.
In addition, it will not be possible for every member to question
every witness. Accordingly, questions of each witness will be struc-
tured as follows: After questions by the chairman and the ranking
minority member, two members from the majority and one from
the minority may question the witness. We will then proceed to the
next witness. Then two other members from the majority and one
other member from the minority may question that witness. This
procedure will be followed until all witnesses have testified and
been questioned.
If there is additional time after all witnesses have testified and
been questioned, additional questions may be asked of any witness
who is still present in the room by any member of the committee.
In such a situation the 5-minute rule will still apply, and no
member may ask more than one question while another member is
requesting an opportunity to question a witness.
I regret the necessity of establishing such a procedure, but with-
out doing so, it will not be possible to obtain the information these
witnesses will provide during the time we have available.
I know the members of the committee will agree that this system
is as fair and practical as any.
Our first witness today is Dr. Joseph Dietrich, chief scientist of
the Advanced Nuclear Systems Department of the Combustion En-
gineering Co. He will participate in a panel which also includes
Mr. Milton Levenson, director of the Nuclear Power Division of the
Electric Power Research Institute; Mr. William Kennedy, vice
president and director of engineering for the Stone & Webster
Engineering Corp.; together with Dr. Chauncey Kepford, director of
the Environmental Coalition on Nuclear Power.
We will ask these four gentlemen to each present his testimony,
and then we will have questions following the testimony of the four
witnesses.
Gentlemen, welcome.
We have your written testimony before us, and without objec-
tion, all the written testimony that each of you has submitted will
be included in the record at this point, and you will be free to
proceed to make your presentation and summarize your remarks
as you wish.
Dr. Dietrich, do you wish to proceed?
PAGENO="0010"
6
STATEMENT OF DR. JOSEPH DIETRICH, CHIEF SCIENTIST,
NUCLEAR POWER SYSTEMS, COMBUSTION ENGINEERING
Dr. DIETRICH. Thank you, Mr. Chairman.
It is a pleasure to testify before this committee on the subject of
nuclear plant safety.
I believe that what I say with respect to safety principles and
areas in which safety can be improved is representative of industry
thinking, but of course when I speak of what is being done within
the industry, I will have to confine my remarks to the activities of
my company, Combustion Engineering.
I am afraid that when I prepared my written testimony, I did not
have an entirely correct concept, had a little bit the wrong impres-
sion of the objective of this day's hearings. I thought that its thrust
was directly toward the implications of Three Mile Island, but I
understand now that the Three Mile Island subject will be ad-
dressed directly tomorrow.
Mr. MCCORMACK. Dr. Dietrich, we don't want to deprive you of
making any point you want to make, and we don't want to deprive
this committee of the benefit of your testimony, so I will not try to
restrict you to any degree that reduces your effectiveness and
makes you uncomfortable.
Dr. DIETRICH. Thank you.
Today we consider the philosophy and technology of nuclear
safety. Nevertheless I think my prepared testimony is pertinent,
for we have no reason to question our basic safety approach, that
is, the defense in-depth principle which provides not only in-depth
safety systems designed to cope with postulated accident sequences,
but also safeguards of a more general nature with capabilities for
countering the effects of unforeseen sequences.
The general safeguards saved the day at Three Mile Island, and
provided the means to protect the public. I believe that the only
fruitful reexamination of our safety philosphy and technology must
be one based on the Three Mile Island experience, which I think
did not invalidate the basic principles or the effectiveness of our
technology, but did indicate the need for a certain shift of
emphasis.
I am appending to my testimony a list of potential research and
development projects which are consistent with the lessons of
Three Mile Island, and which we at Combustion Engineering feel
are worth assessment for possible Government support.
Each of the projects listed is directed toward a rather specific
safety function. Most of these functions are applicable generally to
pressurized-water nuclear plants, but their effectiveness, the need
for them, and the ease or difficulty of implementing them depend
upon overall plant design. We, therefore, believe that, for maxi-
mum effectiveness, the examination of specific possibilities such as
these should be supplemented by an integrated approach which
would not only consider existing and proposed individual safety
features but would also reexamine the design approaches used for
the plant itself.
Here I am not speaking of the possibility of major changes in
plant design concepts but of approaches to detailed design which
might have safety benefits.
PAGENO="0011"
7
The objective would be to implement design principles which best
serve a threefold purpose:
First, to make less difficult demands on the operator, and to be
more forgiving of operator errors through minimization of the fre-
quency of occurrence and speed of development of operational per-
turbations with potential for hazard;
Second, to increase the effectiveness of safety systems and engi-
neered safeguards, and, to the extent possible, to decrease the
complexity of integrating those safety features into the overall
plant design; and
Third, without compromising the protection of the public from
the most severe postulated accidents, to improve defenses against
lesser accidents which may result in substantial financial loss and
which erode public confidence even if they produce no substantial
public hazard.
We recommend a project with these approaches and objectives
which would draw expertise from all appropriate segments of the
industry and which would be conducted under the aegis of some
organization with the capability of sponsoring intraindustry efforts,
such as the American National Standards Institute.
I will now consider directly the specific and generic consider-
ations that have resulted from the Three Mile Island experience.
The first lesson to be learned is that we must continue to improve
the communication between machine and man, and of course I
mean this to apply to the operating phase.
Communication from machine to man comes by way of instru-
mentation. We know that the Three Mile Island experience sug-
gested certain specific hardware improvements that might be made
in the instrumentation area. Although the Combustion Engineer-
ing plants are rather different in design from the Three Mile
Island plant and would have responded differently to the initiating
events, we are currently examining these suggested improvements
for feasibility, method, and value. They include:
Positive position indication-that is, open or shut-for critical
valves;
Instrumentation for indicating water level in the reactor vessel;
and
Improved instruments for detecting significant leakage from the
primary system.
Generically, the Three Mile Island experience has suggested the
degree of safety could be improved by simplyfing the interpretation
of instrument readings. With this in mind we are initiating an
instrumentation review of the Combustion Engineering plants
which addresses the generic problem as well as the specific instru-
mentation needs suggested by the incident. The review has the
following objectives:
Find the most direct and positive ways of indicating those condi-
tions that are crucial to the safety of the plant;
Search out any abnormal conditions under which each particular
type of instrument could give readings having a significant differ-
ence from the normal one, and correct that; and
Finally, whenever possible, assist the operator in recognizing
abnormal conditions quickly by combining information from differ-
ent instruments automatically-for example, via a computer-in
PAGENO="0012"
8
cases where such information processing would give direct indica-
tion of an abnormality.
Let me emphasize that we are proceeding out of a sense of
prudence, not of doubt about the safety of our systems instrumen-
tation. Our customers, the public, expect no less of us in light of
the Three Mile Island incident. On a related, important subject,
additional members of the operating crews must be given greater
understanding of the entire plant's behavior and of the physical
principles that govern that behavior.
Let me now address the second generic lesson to be learned from
Three Mile Island: the need for more attention to generalized
safeguards as well as those that deal with prepostulated accident
scenarios.
The containment building is such a generalized safeguard, and it
certainly proved its value at Three Mile Island. We do not visualize
another generalized safeguard of the scope and magnitude of the
containment building, but we do see the need to continue to search
out the possibilities of hazardous conditions, regardless of how
those conditions might come into being, and provide means to cope
with them.
The Three Mile Island experience, for example, demonstrated the
need for a means of remotely controlled venting of noncondensible
gases from the dome of the reactor vessel.
We are undertaking a generic investigation of the need for addi-
tional general safeguards equipment.
In conclusion, let me say that the engineering of new safety
equipment must proceed on an integrated systems basis to assure
that equipment added to improve safety under one set of circum-
stances does not degrade it under other circumstances.
Finally, let me repeat something our company president, Mr.
Arthur Santry, said recently at our annual meeting of sharehold-
ers. He said that it is essential that we all heed President Carter's
urging to proceed with "care and reason" in considering the effects
of the Three Mile Island incident.
Nuclear power is far too important to be written off in an atmos-
phere of fear, doubt, and incomplete information. I know that you,
Mr. Chairman, and the members of your committee are sincerely
engaged in a search for truth about nuclear plant safety, and I
pledge my full support and that of my colleagues in the Nuclear
Power Systems Division of Combustion Engineering to help toward
that end.
I thank you very much.
[The prepared statement and biographical sketch of Dr. Dietrich
follow:]
PAGENO="0013"
9
Testimony for the Subcommittee on Energy Research and Production
of the U. S. House of Representatives, 5/22/79
I am Joseph R. Dietrich, Chief Scientist for Nuclear Power Systems at
Combustion Engineering, Inc., and for many years Chairman of the Nuclear Safety
Committee for my company.
It is a pleasure to testify before the Subcommittee on Energy Research and
Production, on the subject of nuclear plant safety. I believe that what I say with
respect to safety principles and areas in which safety can be improved is representa-
tive of industry thinking, but when I speak of what is being done within the industry
I am confining my remarks to the activities of Combustion Engineering.
I am sure that a primary concern of this Committee is the implications of the
recent incident at Three. Mile Island, so I will concentrate on those implications.
The Three Mile Island experience is regrettable and very costly, and an experience
which we are studying intensively so that our knowledge of safety technology and
operating practices may continue to improve.
A nuclear power plant is a complex system of machinery. That is why its
designers have adopted the defense-in-depth principle for its safety design That
principle provides not only in-depth safety systems and carefully engineering safe-
guards designed to cope with postulated accident sequences, but also safeguards of
a more general nature with capabilities for countering the effects of unforeseen
sequences.
I believe the public is protected by the generalized safeguards. The Three Mile
Island incident did not prove otherwise. While the specific accident sequence was
unforeseen, the engineered safeguards used were successful in protecting the public.
One generic lesson to be learned from Three Mile Island is that we must continue
to improve the communication between machine and man. Another is that we must
give increased attention to generalized safeguards, as distinguished from those that
deal with pre-postulated accident scenarios. In discussing these points I will cite
specific improvements suggested by the Three Mile Island experience, and place them
in the context of more generalized classes of possible safety improvements which
merit further investigation.
I am also appending to this testimony a list of potential research and development
projects which are consistent with the approaches suggested here, and which we at
Combustion Engineering feel are worth assessment for possible government support.
Some of these have already been discussed with appropriate staff of the Department
of Energy.
PAGENO="0014"
10
Each of the projects listed is directed toward a rather specific safety function.
Most of these functions are applicable generally to pressurized water nuclear
plants, but their effectiveness, the need for them, and the ease or difficulty of
implementing them depend upon over-all plant design. We therefore believe that,
for maximum effectiveness, the examination of specific possibilities such as these
should be supplemented by an integrated approach which would not only consider
existing and proposed individual safety features, but would also re-examine the
design approaches used for the plant itself. Here I am not speaking of the possi-
bility of major changes in plant design concepts, but of approaches to detailed
design which might have safety benefits. The objective would be to implement
design principles which best serve a three-fold purpose:
- to make less difficult demands on the operator, and to be more
forgiving of operator errors through minimization of the fre-
quency of occurrence and speed of development of operational
perturbations with potential for hazard;
- to increase the effectiveness of safety systems and engineered
safeguards, and, to the extent possible, to decrease the com-
plexity of integrating those safety features into the over-all plant
design;
- without compromising the protection of the public from the most
severe postulated accidents, to improve defenses against lesser
accidents which may result in substantial financial loss and which
erode public confidence even if they produce no substantial public
hazard.
We recommend a project with these approaches and objectives which would
draw expertise from all appropriate segments of the industry, and which would be
conducted under the aegis of some organization with the capability of sponsoying
intra-industry efforts, such as the American National Standards Institute. V
PAGENO="0015"
11
Let me now return to the subject of the specific and generic considerations
that have resulted from the Three Mile Island experience. I have said earlier
that the first lesson is that we must continue to improve the communication be-
tween machine and man, and I mean this to apply to the operating phase.
Communication from machine to man comes by way of instrumentation.
We know that the Three Mile Island experience suggested certain specific hard-
ware improvements that might be made in the instrumentation area. Although the
Combustion Engineering plants are rather different in design from the Three Mile
Island plant, and would have responded differently to the initiating events, we are
currently examining these suggested improvements for feasibility, method, and
value. They include:
- Positive position indication (i. e. open or shut) for critical
valves.
- Instrumentation for indicating water level in the reactor
vessel.
- Improved instruments for detecting significant leakage from
the primary system.
(~ffl~'5i~ The Three Mile Island experience has suggested the degree of safety could be
improved by simplifying the interpretation of instrument readings. With this in
mind we are initiating an instrumentation review of the Combustion Engineering
plants which addresses the generic problem as well as the specific instrumentation
needs suggested by the incident. The review has the following objectives:
- Find the most direct and positive ways of indicating those
conditions that are crucial to the safety of the plant.
- Search out any abnormal conditions under which each particular
type of instrument could give r~adings having a significance
different from the normal one./ When such conditions are found,
provide other instruments or adequate operator instructions for
recognizing the abnormality.
- JWhenever possible, assist the operator in recognizing abnormal
conditions quickly by combining information from different instru-
ments automatically (e. g. via a computer) in cases where such
information processing would give direct indication of an
abnormality.
Let rue emphasize that we are proceeding out of a sense of prudence, not of
doubt about the safety of our systems' instrumentation. Our customers, the
public, expect no less of us in light of the Three Mile Island incident. On a related,
important, subject, additional members of the operating crews must be given
greater understanding of the entire plant's behavior and of the physical principles
that govern that behavior.
PAGENO="0016"
12
Let me now address the second generic lesson to be learned from Three
Mile Island: the need for more attention to generalized safeguards as well as
those that deal with pre-postulated accident scenarios. The containment building
is such a generalized safeguard, and it certainly proved its value at Three Mile
Island. We do not visualize another generalized safeguard of the scope and magni-
tude of the containment building, but we do see the need to continue to search out
the possibilities of hazardous conditions, regardless of how those conditions might
come into being, and provide means to cope with them. The Three Mile Island
experience, for example, demonstrated the need for a means of remotely con_I
trolled venting of non- condensible gases from the dome of the reactor vesselY
While we do not believe that there was ever a danger from the explosion of the
so-called hydrogen bubble, the presence of that non-condensible gas was a major
impediment to coolant circulation and pressure reduction during the process of
recovery from the incident. A generic investigation of the need for additional
general safeguard equipment is being initiated at Combustion Engineering.
J In conclusion let me say that the engineering of new safety equipment must
proceed on an integrated systems basis to assure that equipment added to improve
safety under one set of circumstances does not degrade it undef other circumstances.
Finally, let me repeat something our Company presiden4aid recently at our
annual meeting of shareholders. He said that it is essential that we all heed
President Carter's urging to proceed with/care and reason' in considering the
effects of the Three Mile Island incident. iAdding to that, let me say, there is no
justification, in my opinion, to denigrate the bard work of many talented, dedicated
engineers and scientists who literally have devoted their lives to trying to make
nuclear power work for the nation's energy needs-with the utmost concern for the
safety of our citizens and workers. There also is no justification to automatically
condemn as hazardous the nuclear plants that have been operating efficiently and
safely for many years before the ThU incident.
I believe you, Congressman McCormack, and the members of your subcom-
mittee are sincerely engaged in a search for truth about nuclear plant safety and
I pledge my full support and that of my colleagues in the Nuclear Power Systems
Division of Combustion Engineering to help in that end.
Again, as Arthur J. Santry, Jr., Combustion Engineering's president has
said, "Nuclear power is far too important to be written off in an atmosphere of
fear, doubt and incomplete information'.
Thank you for your attention.
PAGENO="0017"
13
List of Suggested R&D Pro~~
The following is a suggested list of projects for consideration in a
government_sponsored safety R&D program. The list contains some that
have not yet been thoroughly assessed for their potential value or effective-
ness. There is no intent to imply that the developmental products of all of
the projects listed are needed for safety improvement: some of the projects
represent alternate routes to the same result, and some would simply result
in alternate, and possibly better, ways of implementing safety functions
already provided on operating plants.
- Improvement of Analytical Methods and Computer Codes
1. Development of a Best Estimate* NSSS (Nuclear Steam Supply
System) Simulation Code for Non-LOCA Design Basis Events
2. Development and Test of a Best Estimate* Small Break LOCA
Model
3. Development of an Improved Set of Event Scenarios for Consider-
ation During Safety Evaluations
4. Verification of Methodology of Best Estimate* NSSS Models
5. Extension of NSSS Simulation Codes to Include the Power
Conversion System
- Analytical Investigations
1. Best Estimate* NSSS and Containment Transient Analysis for
Operator Guidance and Training
2. Evaluations of Changes in Plant Design Features
3. Natural Circulation Separate Effects Studies and Best Estimate
Analysis*
* Analyses and computer codes used for licensing calculations have built-in
conservatisms which yield conservative results, but distort the calculated
* course of events relative to reality. Alternate best estimate codes are
needed to give designers and operators the true picture of the physical
situation to be addressed.
48~~721 0 - 79 2
PAGENO="0018"
14
4. Analysis of Post-Accident Operation of Reactor Coolant Pump
Auxiliaries and Recommendations for Post-Accident Handling
of Pumps
5. Development of Fuel Behavior Analysis System, and Analysis of
Methods of Operation for Minimizing Probability of Fuel Damage
6. Analytical Prediction of Behavior of Reactor Core When
Under-Cooled
- Fluid System Improvements
1. Design Development of a High Pressure Shutdown Cooling System
2. Design Development of a Passive Residual Heat Removal System
3. Design Development of a Post-Accident Sampling and Chemical
Control System
4. Design Development of a Post-Accident Reactor Coolant System
Venting and Degassing System
5. Evaluation of Radioactive Waste Processing Systems under Post-
Accident Conditions
6. Equipment Certification for Radioactive Waste Treatment Systems
under Post-Accident Conditions
- Instrumentation, Control, and Monitoring
1. Development of a Reliable System for Giving Positive Indication
of Relief Valve Position
2. Feasibility Evaluation of Measurement of Reactor Vessel Water
Level
3. Development of a Plant Status Monitoring System
4. Development of a Display System to Indicate Proximity to Operating
Limitations During Off-Normal Conditions
5. Development of a Display System to Indicate and Predict Trends
of Safety-Related Plant Variables
6. Development of a Post-Accident Plant Monitoring System
PAGENO="0019"
15
- Operating Procedures and Man-Machine Interface
1. Develop and Assess Symptom/Function Oriented Operating
Procedures for Abnormal Conditions, as an Alternative to Event
Oriented Procedures
2. Improve and Expand Procedures for Initiating and Maintaining
Natural Circulation
3. Improve Information Displays through the Application of Human
Engineering Principles
4. Development of an Advanced Monitoring System to Provide
Diagnostic Information, Recommend Corrective Actions, and
Pre-Calculate Effects of Specific Operator Actions under
Prevailing Conditions
PAGENO="0020"
16
RESUME
JOSEPH R. DIETRICH
Chief Scientist, Nuclear Power Systems, Combustion Engineering,
Inc., Ph. D., Physics, University of Virginia, 1939. During the years
of World War U worked as a physicist with National Advisory Committee
for Aeronautics. Has been in nuclear power development since 1946,
joining the first "Power Pile" group at Oak Ridge. Later, at Argonne
National Laboratory, was in charge of reactor physics for the prototype
power plant for first nuclear submarine. At Argonne was in charge of
planning, theory and experimental instrumentation for BORAX experi-
ments, and during 1953 and 1954 was one of team which carried out the
experiments at National Reactor Testing Station. These were the first
large-scale reactor safety experiments; they demonstrated the inherent
safety of the light water moderated nuclear reactor against reactivity
accidents, and proved the feasibility of the boiling water reactor.
Later became Associate Director of the Reactor Engineering Division
at Argonne. 1956-1964, a Vice President of General Nuclear Engineering
Corporation, Dunedin, Florida, which, during the latter part of that
period, was a subsidiary of Combustion Engineering. In 1964 became
Chief Scientist, Nuclear Power Systems, for Combustion Engineering at
Windsor, Connecticut.
His current duties cover line responsibility for advanced systems,
including the fast breeder, as well as participation in such over-all tech-
nical management activities as R&D direction, coordination of international
technical cooperation, and planning and policy decisions.
Compiled and edited (with Dr. Walter H. Zinn) the United States
Presentation volume Solid Fuel Reactors for Second International Con-
ference on Peaceful Uses of Atomic Energy in 1958. Was Editor of AEC-
published quarterly technical review, Power Reactor Technolo_gy from
1961 to 1965. Fellow, and was President of American Nuclear Society
for the 1977-l978terrn; Member, National Academy of Engineering.
Mr. MCCORMACK. Thank you, Dr. Dietrich. We appreciate yc:lv
statement, and I have some questions for you when the times
comes.
I would like to move now to Mr. Milton Levenson.
Mr. Levenson is director of the Nuclear Power Division of the
Electric Power Research Institute. EPRI is doing a great deal of
research on its own, and it has been doing so for a long time.
We are very pleased to have you here, Milt, and we would like to
ask you to proceed with your testimony as you wish.
STATEMENT OF MILTON LEVENSON, DIRECTOR, NUCLEAR
POWER DIVISION, ELECTRIC POWER RESEARCH INSTITUTE
Mr. LEVENSON. Thank you.
Mr. Chairman, members of the committee and distinguished
guests, my name is Milton Levenson. I am director of the Nuclear
Power Division of the Electric Power Research Institute.
I recently served as chairman of the Three Mile Island Ad Hoc
Industry Advisory Group, a group of 100 experts from all sectors of
the technical community, including reactor manufacturers, archi-
tect/engineers, utilities, national laboratories, universities, consult-
PAGENO="0021"
17
ants, NASA, and EPRI. This group responded to the call for help
issued by GPU, and provided an independent onsite review of all
major actions undertaken during the month following the TMI
accident. The basis of my remarks is this recent experience super-
imposed on a background of 35 years in nuclear R. & D.
The aspect of today's hearing theme of "Nuclear Reactor Safety
Systems-Philosophy and Technology" that I would like to com-
ment on is the man-machine interface.
Dr. Dietrich has mentioned that phrase. One member, Mr. Gold~
water, also mentioned that phrase. It is clearly an important part
of the issue, but I think it is not just the classical question of what
should be done by a man or what should be done by the machine,
but I think we must address the much broader issues of man's
relation to the machine, not only the man in the control room, but
during design, construction, management, all aspects of operation,
including maintenance, and regulation.
The TMI accident was very serious from a plant damage stand-
point, and involved a very complex chain of events whose succes-
sion after the originating event was triggered by both men and
machines. Because of the complex nature of both the systems and
the accident, it will be some time before all the lessons that can be
learned are learned. In fact, a significant number of the lessons-
my personal opinion is the majority of the lessons-will have noth-
ing to do with the accident itself but will be learned because the
system is being subjected to a scrutiny considerably more intense
and somewhat different in direction than has been the case in the
recent past.
During the weeks spent at Harrisburg and in the weeks since, I
have been attempting to categorize, both the initiating events and
the secondary events-not only from the overall safety aspects
concerning what should we do about running plants, but also from
the viewpoint of on the nuclear R. & D. program for which EPRI is
responsible.
I have been unable to identify any new phenomena uncovered by
the accident, nor have there really been any major surprises to the
technical or scientific community with the exception, and it is
perhaps a very large exception, of the realization of how preoccu-
pied everyone had become with an unlikely public catastrophe-
TMJ was not such a catastrophe.
I am sure that the current scrutiny nuclear plants are undergo-*
ing will lead to some changes in the nuclear steam supply system
hardware, some changes in the balance of plant, some revision in
the roles and emphasis of supervision and management, some revi-
sions in operations including information display and analysis. It
will probably also lead to revisions in the emphasis of training
programs and procedures and to changes in regulation.
These changes will not require extensive new developments nor
research into entirely new areas nor require new technology, but
rather will require that we go back into more mundane areas we
once explored more thoroughly, but in recent years have skimmed
over in our search for larger and more serious pseudo-hazards with
which to terrify ourselves. Designing and building powerplants so
that they have a minimum probability of failing under improbable
events does not guarantee maximum safety and does not guarantee
PAGENO="0022"
18
that the risk to the public is at the practically achievable mini-
mum. It is much more important to design and protect against
events which are more likely to occur.
Training operators to respond to accidents initiated by double
ended, guillotine, large pipe breaks, coincident with either a large
earthquake or a large commercial airliner crashing into the plant
does not necessarily train that operator to properly cope with a
stuck valve or an ambiguous water level indication, and more
intense training is no answer if the training is for the wrong
contingency.
Risk assessments have been done by many groups in this country
and several are underway abroad. I don't intend to get into the
argument of the merits of any particular study nor defend the
absolute values of any of the conclusions, but I think there is one
thing that is consistent in all of the studies and I think is defensi-
ble, and that is the maximum risk arises not from the maximum
events, but rather from the aggregate of the lesser events.
The message of Three Mile Island is that we must go back and
assure ourselves that we are doing everything that is practical to
reduce the risk to the public and to the plant, instead of attempt-
ing to assure ourselves that we are doing everything possible about
the largest conceivable accidents.
To do this, we must review our plant designs. We must ask
ourselves how we operate our plants and how we manage them and
how we regulate them when lesser accidents occur so that another
TMI sump pump out doesn't occur.
We must refocus the thinking of the designers, the builders, the
owners, the operators, and the regulators toward this objective of
minimizing the real risks. It is essential that this be a common
objective because if it is not also the objective of the reviewers and
regulators, it becomes an unachievable goal.
The theme of today's session is "Safety Systems," and we all
recognize that both men and machines are essential parts of that
system. I believe that safety enhancement will be maximized by
remembering that it isn't only the operator and the switch he
throws, but also the designer and the lines he draws, the electri-
cian and the wires he pulls, and the regulator and the changes he
permits or induces or in some cases demands. Each of these actions
can be done correctly and each can be done incorrectly, and there-
fore, reviews of checks and balances must exist for all.
It should be noted that while TMI was a very serious accident
from the property damage standpoint and from its financial
impact, and we should recognize that the financial impact is due
primarily to the high price of the replacement electricity produced
from oil compared to the cheaper cost of nuclear power, and it may
have been a disaster from the communications standpoint, it was
not a disaster from the public safety standpoint.
Because many of the lessons learned have already been imple-
mented, those nuclear plants now operating are even safer than
they were before the accident.
PAGENO="0023"
19
In closing, I would like to say that I think it would be unfortu-
nate indeed if TMI resulted in massive new programs to explore
extremely unlikely events, or at the other extreme, people attempt
to gloss it over by saying, it is just better operator training is all we
need, or better management. It was a system problem. I think we
must review all aspects of this system and improve each and every
piece of the total system.
Thank you, Mr. Chairman.
[The prepared statement and biographical sketch of Mr. Levenson
follow:]
PAGENO="0024"
- 20
MILTON LEVENSON
Milton Levenson is Director. of the Nuclear Power Division, Electric
Power Research Institute (EPRI), Palo Alto, California.
Prior to joining EPRI, Levenson was Associate Laboratory Director
for Energy and Environment at the Argonne National Laboratory in
Argonne, Illinois.
At Argonne he at various times held the positions of project manager
of the Argonne Advanced Research Reactor, Project Director of the Experimental
Breeder Reactor, and Deputy Director of the Chemical Engineering Division.
Prior to joining Argonne, Mr. Levenson worked at what is now the Oak
Ridge National Laboratory from 1944 to 1948.
Levenson was chairman of Argonne's Reactor Safety Review Committee
from 1954 to 1968 and was technical advisor at the Geneva Conferences on
the Peaceful Uses of Atomic Energy in 1958, 1964, and 1971.
Levenson is a member of the National Academy of Engineering, a
Fellow of the American Nuclear Society, and~a member of the American
Institute of Chemical Engineers as well as the recipient of its Robert
E. Wilson Award for 1975.
PAGENO="0025"
21
TESTIMONY FOR THE HOUSE SUBCOMMITTEE ON
ENERGY RESEARCH AND PRODUCTION
BY
MILTON LEVENSON
MAY 22, 1979
Electric Power Research Institute
P. 0. Box 1O4~2
Palo Alto, CA 94303
415/855-2030
PAGENO="0026"
22
Testimony for the House Subcommittee on
Energy Research and Production
by
Hilton Levenson
May22, 1979
Mr. Chairman, members of the committee, my name is Milton Levenson. I am
Director of the Nuclear Power Division of the Electric Power Research Institute.*
I recently served as Chairman of the Three Mile Island Ad Hoc Industry Advisory
Group, a group of 100 experts from all sectors of the technical community
including reactor vendors, architect/engineers, utilities, National Laboratories,
universities, consultants, NASA and EPRI. This group responded to the call
for help and provided an independent on-site review of all major actions
undertaken during the month following the TNT accident. The basis of these
remarks is this most recent experience superimposed on a background of 35 years
in nuclear R & D.
The aspect of todays hearing theme of Nuclear Reactor Safety Systems - Philosophy
and Technology that I would like to comment on is the man-machine interface -
not just the classical question of what should be done by a man and what should
be automated, but rather the much broader issues of man's relation to the machine
during design, construction, management, operation, and regulation. The THI
accident was very serious from a plant damage standpoint, and involved a very
complex chain of events whose succession was triggered by both men and machines.
Because of the complex nature of both the systems and the accident, it will be
sometime before all the lessons that can be learned are learned and, in fact,
* EPRI is a not-for-profit research institute established by the electric
utility industry to manage research leading toward low cost, yet reliable
electric power. The membership consists of government, municipal , rural
cooperative and investor-owned utilities. Approximately one-quarter of
the budget is related to research in the nuclear power area, about 30 is
devoted to fossil fuel research, and there are ongoing programs in all
relevent areas of electric power research.
PAGENO="0027"
23
a significant number of the lessons will have nothing to do with the accident,
but will be learned because the system is being subjected to a scrutiny
considerably more intense than has been the case in the recent past.
During the weeks spent at Harrisburg and in the weeks since, we have been
attempting to categorize both the initiating events and the secondary events -
not only from the overall safety aspects, but also from the viewpoint of
impact on the Nuclear R & D Program that EPRI is responsible for. We have
been unable to identify any new phenomena uncovered by the accident, nor
have there really been any major surprises to the technical or scientific
community except for the realization of how preoccupied everyone had become
with the unlikely public catastrophe.
I am sure that the current scrutiny will eventually lead to some changes in
the Nuclear Steam Supply System Hardware, to some changes in the Balance of
Plant Hardware, to some revision in the roles and emphasis of supervision
and management, to some revisions in operations including information display
and analysis and revisions in the emphasis of training programs and procedures
and also to changes in regulation. These changes will not require extensive
new developments nor research into entirely new areas nor require new
technology, but rather will require that we go back into more mundane areas
we once exploed more thoroughly, but in recent years have skimmed over in
our search for larger and more serious hazards with which to terrify ourselves.
Designing and building power plants so that they have a minimum probability
of failing under improbable events does not guarantee maximum safety and
does not guarantee that the risk to the public is at the practically achievable
minimum. It is more important to design and protect against the more likely.
-2-
PAGENO="0028"
24
Training operators to respond to accidents initiated by double ended guillotine
large ~pipe breaks coincident witheitirer a large earthquake or a large
commercial airliner crashing into the plant does not necessarily train that
operator to properly cope with a stuck valve or an ambiguous water level
indication. Risk assessments have been done by many groups in this country
and several are underway abroad. I dont intend to argue the merits of any
particular study nor defend the absolute values of any of the conclusions,
but one thing the studies all point out is that the maximum risk arises not
from the maximum events, but rather from the aggregate of the lessor events.
The confirmatory message of Three Mile Island is that we must go back and
assure ourselves that we are doing everything that is practical to reduce
the risk to the public and to the plant, instead of attempting to assure
ourselves that we are doing everything possible about the largest conceivable
accidents. To do this, we must review our designs and plants for lessor
events - for example, to make sure that containment buildings isolate on
lessor accidents so that another TWI sump pump-out doesn't occur automatically.
We must refocus the thinking of the designers, the builders, the owners, the
operators and the regulators toward this objective of minimizing real risks.
It is essential that this be a common objective, because if it is not also
the objective of the reviewers and regulators, it becomes an unachievable
goal.
The theme of today's session is Safety Systems, and we all recognize that both
men and machines are essential parts of that system. I believe that safety
enhancement will be maximized by remembering that it isn't only the operator
and the switch he throws, but rather also the designer and the lines he draws,
the electrician and the wires he pulls, and the regulator and the changes
-3-
PAGENO="0029"
25
he permits or induces or demands. Each of these actions can be done correctly
and each can be done incorrectly and, therefore, reviews of checks and balances
must exist for all.
It should be noted that while It'll was a very serious accident from the property
damage standpoint and from its financial impact - due primarily to the high
price of the replacement electricity produced from oil compared to nuclear -
and it may have been a disaster from the communication standpoint, it was not
a disaster from the public health standpoint.
Because many of the lhssons learned have already been implemented; those nuclear
plants now operating are even safer than they were before the accident.
In closing, I would like to say that I think it would be unfortunate indeed
if It'll resulted in massive new programs to explore the unlikely or, at the
other extreme, resulted in people oversimplifying the cause and saying we
just need different management or better operators or more training will
solve it all. It was a system problem, and we must address it as such.
MILTON LEVENSON
Milton Levenson is Director of the Nuclear Power Division, Electric Power Re-
search Institute (EPRI), Palo Alto, California.
Prior to joining EPRI, Levenson was Associate Laboratory Director for Energy
and Environment at the Argonne National Laboratory in Argonne, Illinois.
At Argonne he at various times held the positions of project manager of the
Argonne Advanced Research Reactor, Project Director of the Experimental Breeder
Reactor, and Deputy Director of the Chemical Engineering Division.
Prior to joining Argonne, Mr. Levenson worked at what is now the Oak Ridge
National Laboratory from 1944 to 1948.
Levenson was chairman of Argonne's Reactor Safety Review Committee from
1954 to 1968 and was technical advisor at the Geneva Conferences on the Peaceful
Uses of Atomic Energy in 1958, 1964, and 1971.
Levenson is a member of the National Academy of Engineering, a Fellow of the
American Nuclear Society, and a member of the American Institute of Chemical
Engineers as well as the recipient of its Robert E. Wilson Award for 1975.
Mr. MCCORMACK. Thank you, Mr. Levenson.
We also have some questions for you when the time comes.
Our next witness is Mr. William Kennedy, vice president and
director of engineering, Stone & Webster Engineering Corp.
Mr. Kennedy, you are welcome. We have your testimony in its
entirety, and it will be included in the record, and we should like
to have you proceed as you wish.
PAGENO="0030"
26
STATEMENT OF WILLIAM KENNEDY, VICE PRESIDENT AND DI-
RECTOR OF ENGINEERING, STONE & WEBSTER ENGINEERING
CORP.
Mr. KENNEDY. Thank you very much, Mr. Chairman.
I will summarize my testimony, and probably throw in a few
more thoughts.
My name is Bill Kennedy, vice president and director of engi-
neering of Stone & Webster.
Not only am I responsible for our nuclear work, but I do a great
deal in fusion, solar, and all kinds of other things.
Mr. MCCORMACK. I am going to have to ask you to speak a little
harder into that mike. You have to drive these mikes pretty hard.
Mr. KENNEDY. I am glad to appear before the committee today to
offer some general thoughts on a part of the engineering profession
in the nuclear industry.
Safety, it is fundamental to an engineer's philosophy. We have in
nuclear industry probably misled the public in that we have al-
lowed ourselves to concentrate on major accidents with extremely
low probability, and in that way we have allowed the public to
believe that we thought and told them we could design foolproof
systems. We cannot nor do we need to.
All of the accidents with which I am familiar in some detail, and
I will not comment on Three Mile Island greatly because I have
had tremendous difficulty in trying to sort out the facts from
fiction, but from Fermi 1 on, in no case was this the kind of an
accident on which we had spent the majority of our time. They
were much smaller accidents. Certainly they had tremendous eco-
nomic impact, but none of these accidents represented a clear
danger to the public.
The public, however, is left with the impression that we have
said that it couldn't happen. Well, what we said couldn't happen
didn't in fact happen. We have spent far too much time worrying
about these major accidents, a double ended rupture of 3½ inch
thick wall pipe, and we have not spent enough time looking at the
reliability of lesser important systems.
As engineers, we assume that there will be failures of equipment,
operators, and designs, and our designs take this into consideration
by the use of redundancy and diversity in these, and as a matter of
fact, the nuclear reactor is a pretty important giving device. The
plant itself at Three Mile Island and at Fermi before it, the reactor
portion of the plant performed very well.
Good engineering then does not assume nothing can go wrong. In
fact it assumes precisely the oposite and tries to take account of
that.
I have brought along with me a scale model over there which the
committee may find of some interest in looking at some of the
details regarding safety systems and defense in depth, and I will
not dwell on that.
Mr. GOLDWATER. Mr. Kennedy, I am having a difficult time
hearing you.
Mr. KENNEDY. I will have to try speaking louder then.
The next two points that I would like to address are quality
assurance and standardization, and I can't help note our French
friends here. Some of my associates had the privilege of visiting
PAGENO="0031"
27
Gravelines not so long ago. Plants are built in 5 years and on a
continuous basis. One of the major difficulties with our quality
control requirements in the United States is the fact that the
industry is starting and stopping. Our construction workers can
and will do a good job. They are interested in quality, particularly
they understand the importance of it. Yet all of the changes and
all of the time delays that we put into our designs are very debili-
tating. There is nothing that hurts a workman worse than to see
his work removed because somebody decided it needed to be a little
bit different. It is a terrible thing on workmen, and pretty quickly
they lose interest.
Also, when jobs are started and stopped, it is very hard for them
to believe that it is really necessary.
As far as standardization is concerned, I am personally convinced
that once again we have referred in large measure to the major
accident, whereas it is the detailed engineering that will make this
industry go. It is attention to detail.
Just to give you some indication, I worked and was project engi-
neer on the Connecticut Yankee plant, of which I am extremely
proud. We spend right now in the design portion for great earth-
quakes more than the entire engineering that we put in the Con-
necticut Yankee plant. I personally think that is a complete and
total waste. We should be looking at the system design and not
wasting our time looking at these very unusual accidents in the
depth that we are.
Now I believe the standardization can particularly allow us to
get ahead with designs that will in fact withstand major earth-
quakes, and I note in passing that there is no instance of a modern
powerplant being damaged by an earthquake anywhere in the
world, and we spend unbelievable amounts of engineering time in
doing seismic analysis. But standardization, allows engineers to
look at the things we need to, the regulators to look at the things
that they need to, and the operators not to have a diversity of
plants in which to operate, and when an accident does occur, that
there will be many more people much more familiar with the
plant.
Certainly the recent accident at Three Mile Island is of great
interest to all of us. It is certainly a laboratory waiting to be
analyzed. We fairly recently, in Stone & Webster, have taken up
using Bell Telephone System PhonoVision for meetings and confer-
ences. My own personal opinion is that one of the things that is
missing from our nuclear plants is a much more improved commu-
nications system, the use of television, the use of small micro-
phones within containment.
Just think of how nice it would have been to have had two or
three TV cameras within the Three Mile Island containment, or
even a couple of microphones. I think that this kind of thing can be
done. I think our public relations is a problem we didn't think
about, that there is absolutely no reason why full information from
a faulted powerplant cannot be put into load dispatch centers,
almost anything that is necessary so that the operator can virtual-
ly instantaneously have at his services the help of some very
experienced people.
PAGENO="0032"
28
In short, I believe that the engineering profession has done an
outstanding job in designing nuclear powerplants. We have never
said they will be foolproof. We will probably have problems again.
We believe that with the proper emphasis on the detailed design,
rather than on major accidents, on standardization, and on careful
attention to quality control, we will continue to have an excellent
and outstanding industry.
Thank you, sir.
[The prepared statement of Mr. Kennedy follows:]
STATEMENT OF WILLIAM J. L. KENNEDY, VICE PRESIDENT AND DIRECTOR TO
ENGINEERING, STONE & WEBSTER ENGINEERING CORP.
Mr. Chairman and members of the subcommittee, My name is William J. L.
Kennedy and I am a Vice President and Director of Engineering of Stone & Webster
Engineering Corporation.
I am pleased to appear before your subcommittee to discuss nuclear power plant
safety philosophy and technology. Stone & Webster has been involved in the design
and construction of nuclear energy facilities since the outset of the commercial
nuclear power industry, having engineered and built the first demonstration plant,
Shippingport.
Needless to say, safety considerations are fundamental to engineering philosophy.
Indeed, by definition an engineer's job is to employ technology for the benefit of
man in a safe and economical manner. This underlying principle is even more
emphasized in the nuclear power field, given the origin of this energy source.
Unfortunately, this background has led the public to fear any accident or failure of
equipment in a nuclear plant and to assume that any accident in a nuclear plant
will have catastrophic effects. Perhaps by way of excessive response to this situa-
tion, industry and government alike, through efforts to allay public anxiety, relied
so heavily on probability data showing the low likelihood of an accident with severe
public consequences that we led the public to believe the nuclear plants are fool-
proof. Thus, the assertions since TMI that the public was lied to-that "they said it
couldn't happen, but it did."
What was said in engineering language was that a major loss-of-coolant accident
with a total core melt-down was an event Of very low probability; and it did not
happen at TMI.
From the outset, an architect-engineer incorporates the philosophy of safety into
the basic plant engineering and, in addition, provides specific protection by incorpo-
rating redundant safety systems to accommodate possible accident conditions, by
separating physically three systems, by adding diverse systems to perform similiar
functions and by separating safety systems from non-safety systems. The concept is
then carried to the extreme of assuming the failure of such systems and providing
means to mitigate the results which could be expected. Thus, we add the contain-
ment with attendent filtering systems, etc.
We have available a scale model of our reference nuclear plant depicting the
various special safety systems employed. I have attached as an appendix to my
testimony a listing of the safety features displayed and I'd be pleased to explain
them using them the model, as time permits.
This model illustrates the overall "defense-in-depth" reactor safety philosophy
used in the design of nuclear facilities. These facilities are designed to provide (1) a
large margin of safety for defects in materials and equipment, acts of nature, and
possible human error; (2) backup systems that will compensate automatically for
failure of essential equipment and (3) equipment and systems (such as the emergecy
core cooling systems and containment) to limit the public consequences of even
highly unlikely accidents.
Application of the "defense-in-depth" philosophy results in the provision of multi-
ple physical barriers between the reactor fuel and the environment outside its
plant. The fuel is contained in a sealed metal claddinger the clad fuel is contained
in a heavy steel primary contain system; and the primary coolant system is enclosed
in a massive concrete and steel containment building.
A Quality Assurance program is employed from the outset of the design phase
through component manufacture and containment to ensure a finished product of
high quality. This program also features multiple, redundant efforts to review
calculations, designs, and specifications by independent reviewers. Manufacturers
inspect their products and these are verified by both the utilities and AEC. The
federal government, through AEC, audits and inspects to ensure program validity.
PAGENO="0033"
29
Obviously however quality must be designed and built in at the outset no amount
of inspection will add quality.
QA organizations are independent of production and are answerable directly to
top management. This ensures against diminution of QA efforts due to production
demands and pressures and enhances objectivity where these interests may conflict.
In the construction of a plant, we have* learned that standardization pays hand-
some dividends. Detailed work processes involving parallel paths and repetitive
operations yield a higher degree of skills and therefore improved quality. Our
construction innovations program is aimed at using the best and most efficient
methods and needs, reducing peak manpower requirements and permitting firmer
quality control.
Our basic plant designs are evaluated for safe constructurability, operability, and
maintainability. For each phase of a project, we have standardized our construction
methods and procedures, such as material controls, handling and storage, steel
erection, concrete placement, etc., including independent inspection of each. Special
training is provided to responsible personnel on these procedures.
We also have developed a standardized system for reviewing significant engineer-
ing, design, construction and QA issue that arise in order to ensure incorporation of
lessons learned from each into other project efforts. These efforts, while not un-
known to other large industrial programs, are unprecedented in the degree to which
they are employed on nuclear facilities. Obviously, the unmatched safety record of
the nuclear industry bears witness to the wisdom of this approach.
We believe standardization can contribute positively in a number of ways. Repeat-
ed designs and construction and manufacturing techniques and procedures permit
increased efficiency resulting in higher quality; and that translates to greater
safety. Another significant advantage of standardization in the reduction in the
number of plant design variations with which plant operators and emergency teams
would have to be familiar. This would concern increased operator capability. Stand-
ardization will permit greater concentration of specialized talents on more detailed
safety considerations. Standardization will lead to increased efficiency and thus
improved safety and, because of favorable cost impact, the additional benefit of
lower power costs to the public.
The recent accident at Three Mile Island Unit 2 provides a here-to-fore unavail-
able perspective from which to view this approach to safety. The defense-in-depth
concept appears to be valid. Safety systems did work. The physical integrity of the
reactor coolant system was maintained. When initiated, containment was main-
tained. While we have not had the opportunity to evalute the data in detail, it
appears that this was true despite some failures of equipment and some yet to be
explained operator actions. This, I think, demonstrates the remarkable resiliency of
the plant to withstand adverse conditions, and that is exactly what is is designed to
do.
We have much to learn from this event as the detailed information becomes
available. The plant has been characterized as a laboratory awaiting analysis and I
agree. There are some lessons which are already apparent. Perhaps the most obvi-
ous is that in both licensing and design, the industry and the regulators may have
been concentrating too hard on the hypothetical catastrophic event involving total
instantaneous loss of coolant with the necessity of response in fractions of a second
to the exclusion of more likely incidents of lesser severity. I would point out,
contrary to what one might believe from reading the papers or watching television
accounts, that TMI was far short of such a hypothetical event.
It appears that there is considerable room for improvement in the manner in
which information for plant status is made available to the operators and the
public. The ability to verify what is actually occurring is vitally important to ensure
confident decision making. In this regard, I personally favor extensive use of video
and audio relay systems so the plant operators can actually see and hear what is
happening. Had the TMI operators seen the water running out of the pressurizer
and accumulating on the containment building floor, they obviously would have had
a better basis upon which to assess conditions and determine the required responses.
Recent experiments at the LOFT facility in Idaho have confirmed the efficacy of
current designs to protect the core against the catastrophic loss-of-coolant accident.
The real life experience of TMI indicates the need to expend further effort to ensure
that lesser events are not permitted to propagate to endanger the public or plant
performance. There are obviously several facets to this including equipment design,
control design, and operator training. The safety record of nuclear plants is un-
matched by any other industrial sector, and I inc1ude~ recent events in that assess-
ment. We are proud of this record and will strive to improve on it. Of course, the
broader aspects of governmental response to emergency conditions and all that
involves has been shown to be amenable to improvements as well.
48-721 0 - 79 - 3
PAGENO="0034"
30
I shall be pleased to respond to your questions.
- APPENDIX-SAFETY FEATURES, STONE & WEBSTER MODEL
Reactor Vessel-Contains core, control rods, and reactor coolant.
Reactor Core-Generates heat by nuclear fission.
Reactor Coolant Pumps and Piping System-Circulate reactor coolant.
Pressurizer-Pressurizes reactor coolent to 2250 psi.
Pressurizer Relief Tank-Receives pressurizer discharges.
Steam Generators-Generate non-radioactive steam.
Reactor Containment and Liner-Contain radioactive vapors.
Accumulators-Automatically inject emergency core cooling (ECC) water.
Safety Injection Pumps-Automatically pump ECC water.
Charging Pumps-Automatically pump ECC water.
Boron Injection Tank-Boron prevents nuclear chain reaction.
Residual Heat Removal Pumps-Automatically pump ECC water.
Residual Heat Removal Heat Exchangers-Remove heat from core.
Containment Spray Pumps and Spray Headers-Spray reduces pressure and ad-
sorbs radioactive iodine. /
Refueling Water Storage Tank-Stores ECC and spray water.
Chemical Addition Tank-Adds iodine absorbent to spray.
Containment Atmosphere Recirculation Coolers-Remove heat.
Supplementary Leak Collection and Release System Fans and Charcoal Filters-
Filter air.
Hydrogen Recombiner-Removes hydrogen from containment.
Turbine and Motor Driven Auxiliary Feedwater Pumps-Provide water to steam
generators to cool core.
Auxiliary Feedwater Storage Tank.
Main Feedwater Piping-From main feedwater pumps.
Main Steam Piping-To turbine-generator.
Atmospheric Dump Valves-Release non-radioactive steam to remove heat.
Containment Isolation Valves-Automatically close when required.
Cable Trays-Separate red, white, blue, and yellow electrical safety circuits and
black non-safety circuits.
Cable Spreading Areas-Separate cables for protection.
Control Room.
Main Control Boards-Used during normal operation.
Engineered Safety Features (ESF) Control Boards-Control and monitor safety
systems.
ESF Relay, Logic and Actuation Panels-Redundant Safety control equipment.
Electrical Circuit Breakers-Control and power safety electrical equipment.
Auxiliary Shutdown Panels-Alternate shutdown controls.
Batteries-Power safety electrical circuits if off-site power is lost.
Diesel Generators-Provide standby power if off-site power is lost.
Fire Protection-Red piping and hose stations.
Fuel Transfer Mechanism.
Spent Fuel Racks-Provide underwater storage.
Spent Fuel Shipping Cask.
Mr. MCCORMACK. Thank you, sir. We will come back to the
questions presently.
We will now hear from Dr. Chauncey Kepford, director of the
Environmental Coalition on Nuclear Power.
Dr. Kepford, welcome. Your testimony will be included in the
record. You may proceed
STATEMENT OF DR. CHAUNCEY KEPFORD, DIRECTOR,
ENVIRONMENTAL COALITION ON NUCLEAR POWER
Dr. KEPFORD. Thank you, Mr. Chairman.
First off, I am not the director of the Environmental Coalition on
Nuclear Power. One of the codirectors is here with me today, Dr.
Judith Johnsrud. By default, I am the legal and technical director
of the coalition, because nobody wants to be.
Mr. MCCORMACK. We welcome you with whatever title.
Dr. KEPFORD. Thank you.
PAGENO="0035"
31
I wasn't inside at Three Mile Island. I was on the outside. Our
house was used and our facilities were used by the refugees from
Three Mile Island, people who had to flee their own homes because
of this accident, because they were not being told the truth by
Metropolitan Edison Co., or the Nuclear Regulatory Commission,
about what was going on.
There were thousands of people in this very kind of a position,
that they had to leave their homes. It really bothers me to hear
this put down as a nasty accident that really didn't hurt anybody,
that nobody is going to die from it.
I think such talk is utter bunk and should be described as such. I
might add that I am not speaking now from ignorance. I have
reviewed quite thoroughly the data contained in the population
dose and health impact of the accident at the Three Mile Island
nuclear station from the Ad Hoc Population Dose Assessment
Group.
I think the review of that data and the monitoring efforts that
took place around that accident border on the criminally negligent.
It just happens to turn out that there were no radiation monitors
between the plant and the largest concentrations of people. Nor did
they go out anywhere near far enough.
The NRC's monitors went out only 13.8 miles. On the basis of a
very poor set of data, these gentlemen then dragged out of the sky,
out of a hat, a distance-dose model to calculate doses out to 50
miles.
But that model is not supported by the data close in. Why should
it be supported farther out? If you would like more details on this,
I can give them to you.
With regard to the research philosophy, which is the subject of
these hearings, it has been my impression throughout the nuclear
power program that the primary emphasis has been based on
theoretical impressions of safety rather than experimentally deter-
mining safety.
I have characterized this in my testimony as the law of the
universe according to Walt Disney: Wishing will make it so.
Let's look at the situation realistically.
Experiments tell us where we are. They give us information that
can tell us yes or no, we can go ahead, we should not go ahead.
Theoretical calculations, no matter how well founded or what kind
of a data base we have, normally have to be treated with suspicion.
For instance, we have 20 years or so of tracking satellites from
the satellite program. There are thousands of chunks of metal up
there that are monitored more or less on a daily basis.
Yet, now we are facing the fact that Skylab is going to come
slipping down on us sometime, perhaps this fall. We cannot predict
when. We might have a 20-minute warning. But not to worry
because it will happen in somebody else's backyard.
I have been lulled into this false sense of security about nuclear
reactors, until Three Mile Island happened in my backyard. I think
it is time we stopped delving into this world of theoretical safety,
imaginary safety, or speculative safety, or whatever you want to
call it, and started going back to the basics, and started asking the
question are we at the point where we can prevent the worst
imaginable accident; not the design basis accidents that we have
PAGENO="0036"
32
heard about this morning, or maximum credible accident, or hypo-
thetical accident, or postulated accident, whatever?
Do we know that we can prevent a severe power excursion at a
nuclear powerplant? I suggest the answer is no.
Do we know that the emergency core cooling system will work as
it is designed to? I suggest the answer is no.
Do we know whether or not the ECCS system will work on a hot
core? I suggest the answer is no.
Do we even know what happened at Three Mile Island inside
that pressure vessel between 4 a.m. Wednesday morning, March 28
and, say, 8 or 10 p.m. March 28? I suggest the answer is no, and it
really bothers me that the NRC is rushing forth and slapping a
bunch of band-aids on the other operating B and W reactors, and
hoping that those band-aids will prevent TMI-2 from happening all
over again.
What we don't know, of course, is whether or not those band-aids
that the NRC is slapping on will make matters worse. That we
don't know.
An interesting question to ask throughout all this is what would
have happened if that reactor had failed to scram. One problem
that has been nagging the regulatory bodies and the industry for
years has been this problem of an anticipated transient without
scram; that is, without the reactor shutting down.
The feed water pumps quit at 4 a.m. Wednesday morning.
Within 1 minute and 45 seconds after they quit, the reactor had
been shut down for virtually all of that time, but in that time, the
steam generators boiled dry, and then things started getting sticky.
Of course, they were complicated by the fact that the emergency
feed water pumps were turned off. But suppose the reactor hadn't
scrammed. Would there be anybody living in eastern Pennsylvania
today?
I suggest things might have turned out quite a bit differently.
But we don't know, do we? Most of our safety estimations are based
on unverified computer calculations. We have an enormous theo-
retical basis for safety. I suggest our experimental basis for safety
is much, much shallower; in fact, dangerously shallow.
I would like to point out some ideas that were communicated to
the Joint Committee on Atomic Energy years ago by Dr. Clifford
Beck as a result of the results of the' steering committee that was
working toward revising the original WASH-740. It is just half a
dozen lines.
He stated, and this is a letter dated May 18, 1965:
There is no objective, quantitative means of assurance that all possible paths
leading to catastrophe have been recognized and safeguarded or that the safeguard
will in every case function as intended when needed.
Here is encountered the most baffling and insoluble enigma existing in our
technology. It is in principle easy and straightforward to calculate potential dam-
ages that might be realized under such postulated accident conditions. There is not
even' in principle an objective and quantitative method of calculating probability or
improbability of accidents or the likelihood that potential hazards will or will not be
realized.
I suggest nothing that came out of the reactor safety study
contradicts a word that Dr. Beck said. He was talking, after all,
about objective and quantitative means of calculating probabilities.
PAGENO="0037"
33
Last, if the theoretical aspects of safety are so good, I suggest
that a good method of verifying our predictive abilities will be for
elections for Congress, for instance, to be determined on the basis
of predicted popularities and so on, say the day before the election,
and that all parties agree to the results and postpone the election
because the election is, of course, expensive.
That would simplify things. But I don't really think that most
Members of Congress would really buy that. They would rather go
through the experiment and have it verified.
As one of those who is under the gun, I, too, would like to have
the reactor safety experiments verified. Most haven't been. Most
are still waiting to be done.
I suggest that those of you who are very dedicated to the further-
ing of this industry, which has the potential for doing so much
damage, and causing such an overwhelming level of human misery,
volunteer your districts for the next nuclear success story; that is,
an accident which wasn't an accident.
Thank you.
[The prepared statement of Dr. Kepford follows:]
PAGENO="0038"
34
Testimony
of
Dr. Chauncey Kepford
Environmental Coalition on. Nuclear Power
before the
Subcommittee on Energy Research and Production
ofthe
Committee on Science and Technology
May 22, 1979
Mr. Chairman, members of this Subcommittee, it is an honor to appear
before this body to discuss the most important subject of nuclear reactor
safety today. The near catastrophe at Three Mile Island, Unit 2 has shocked
many people on both sides of the ongoing debate about nuclear power. For
my own part, I was one of those who had been lulled into believing the.
soothing chorus of assurances of the promoters of nuclear power, from
the Nuclear Regulatory Commission (NRC) on down to the public relations
persons for our own local nuclear utilities. This false sense of security
fell in face of the recent partial renunciation of the widely and justifiably
criticized, (but yet much relied upon) Reactor Safety Study, WASH-l400, or
the Rasmussen Report, ~r Whitewash-l400, asit has been referred to. On top
of this, there was the additional, and somewhat sick, rationalization of
"safety,' and that is that when a serious accident finally does happen, it
will be in someone else's backyard.
But things don't always go according to plan. When this "worst yet"
nuclear reactor accident did happen, it was in my backyard. It occurred at
the very reactor that I had fought throughout its still uncompleted licensing
proceeding. In this proceeding, with the most able assistance of Dr. Judith
Johnsrud, who is Co-Director of the Environmental Coalition on Nuclear
Power, we became aware through our own totally unschooled efforts at cross-
examination, that the emergency plans of Dauphin County, where TMI-2 is located,
PAGENO="0039"
35
the Commonwealth of Pennsylvania, and the NRC itself, had no basis in fact
at all. Assurances of preparedness were rhetorical only. We did not have
the resources to rebut this concept of paper, or even imaginary, preparedness.
Subsequent events have thoroughly confirmed our belief that all talk of
emergency preparedness at these licensing hearings was a hoax. Needless to
say, the Licensing Board predictably and dutifully licensed the plant.
It was also the ThI-2 proceeding where, for the first time ever in a
licensing proceeding, it was shown that the largest source of radioactive
emissions in the entire nuclear fuel cycle had been doggedly and resolutely
ignored by the NRC. This source of emissions was, of course, the abandoned
mill tailings piles. It was my testimony on July 5, 1977, that caused the
NRC to act on a long forgotten rule-making petition filed in late 1975 by
the New England Coalition on Nuclear Pollution on February 28, 1978. On
that day the Commissioners voted to void the 74.5 curie number for radon-222
emissions in the infamous Table S-3 for the special case of TMI-2. On
April 14, 1978, this number was struck for all licensed facilities. Yet even
with this radon-222 issue unresolved by the Licensing Board, the plant was
licensed to operate.
In spite of the seeming irrelevance of the preceeding discussion about
the TMI-2 licensing process, there is at least one lesson to be learned from
this exercise, and that is, there is no problem that any intervenor can raise
which will prevent the licensing of any nuclear facility.
The relevance to today's subject is clear. Had I gone before the
Licensing Board to address an accident sequence at TMI-2 that included a
simultaneous tripping of both feedwater pumps, a pressurizer relief valve
that would not close when ordered to do so, both emergency feedwater valves
being closed, and so on, it is my considered opinIon that I would have been
laughed and scolded out of the hearing room. Such an accident, I would have
PAGENO="0040"
36
been told, when the snickering finally subsided, would be hypothetical,
speculative, and beyond the scope of the hearing. I must confess, the logic
of the Board would have been hard to refute.
Then it all happened, and it happened at TMI-2, in my backyard. All
of a sudden, the probability of a serious accident went from be.ing said to
be infinitesimally small to unity. And to make matters worse yet, the weather
condi tions for the first few days after that accident were among the worst
imaginable. Situated over the Eastern U.S. was a stagnant air mass. As a
result, most of the radioactive materials released in those early days did
not dissipate and blow off toward the Atlantic Ocean, instead, they sloshed
around like water in a bathtub. This is just one item that the NRC has missed
in its cumulative dose estimates. It is not the only one. I am convinced
that the 3550 person-rem exposure reported by the NRC between March 28, 1979,
and April 7, 1979, is a face-saving, even imaginary value, since it is not
supported or supportable by the NRC's own monitoring data.
But in getting back to the subject of reactor safety, I would like to
point out that my background is in experimental science. From my own attempts
at theoretical calculations, using computer models, and from many years of
general observations of theoretical predictions, I have acquired a fairly deep
seated mistrust of computer calculations which are not firmly rooted in experi-
mental terra firma.
It is, of course, only through experimentation that we pass judgement on
theoretical predictions, conjectures, projections, speculations, and so on.
Even some of Einstein'~ theor~s have been checked experimentally, and this
is as it should be. Yet even in areas where there is an enormous data base
for predicting future events, failures of computational predictive techniques
still occur. As an example, the U.S. has over 20 years experience at tracking
satellites and observing orbital alterations and variations. Even with this
backlog of observation and experience, we are still faced with the seeming
PAGENO="0041"
37
certainty that Skylab will reenter that atmosphere, and we will have, at.
best, just 20 minutes warning. That's not much of a warning. But, we are
assured, there is still nothing to worry about, because the overwhelming
odds are that it will fall in someone else's backyard.
It does not take much time to discover that in the strange world of a
nuclear power industry that was created by Congress and has been both promoted
and regulated by one agency, explorations into the basics of reactor engineering,
physics, and chemistry have taken a course other than knowledge through experi-
mentation.
If there were a rational regulatory and licensing scheme, the burden
of proof in the area of reactor safety would be placed firmly upon the shoulders
of the nuclear industry. But the passage of the Price-Anderson Act in 1957
absolved the then infant nuclear industry of its responsibility to the public
before the damage was done. This Act established the principle tha-t the
promotion into existence of an industry where corporate survival was given
preeminence above any rights of the members of the potentially affected public.
One result of this principle was that it became clear to the infant industry
that reactor safety was someone els~s responsibility. With the nipple of
Price-Anderson firmly in its teeth, a grip which time has only tightened, the
nuclear industry assured all who would listen that nuclear reactors were safe
enough that even utility executives themselves would have no fear living next
to one.
The Atomic Energy Coninission (AEC) did not fail to protect and encourage
its creation at every step of the way. The Licensing Boards, long before the
affected public became aware of what was being perpetrated, developed a genuinely
Pavlovian response to any construction permit or operating license submitted.
PAGENO="0042"
38
These Boards success rates greatly exceed the successful graduation rate
from the Oak Ridge reactor operators school.
The contemporary approach is one of safety by edict, procrastination,
speculation, economics, double-talk, and ignorance with just an occasional
digression into an enormous and largely unplowed field of fundmental reactor
research. This is a rather sweeping statement, but it is one that is well
supported in history.
As an example, the Loss of Fluid Test facility (LOFT) serves as an
excellent case study. This facility was designed to verify the computer
programs, or codes, which had been developed to predict the rate of core
flooding in a Loss of Coolant Accident (LOCA). Attachment 1 is ~a copy of
two pages from the 1965 report to Congress by the AEC entitled "Major Activities
iii the Atomic Energy Programs." I repeat, this is from a 1965 report, and
from page 186 and 187 of this report it is seen that these very important tests
were to have begun in the spring of 1969. Procrastination set in, the comple-
tion date slipped, but reactor licensing went on, unhindered by the knowledge
that safety systems, upon which tens or hundreds of thousands of lives might
depend, had never been tested under realistic operating conditions. Ignorance
prevailed and the design effectiveness and functional capability of the ECCS
were accepted on the basis of computer calculations, calculated information,
and computer speculations, not on the basis of experimental knowledge.
More details on the LOFT facility are presented in Attachment 2, which
is pages 851 through 864 of the AEC Authorizing Legislation, Fiscal Year 1972,
before the Joint Coninitteeon Atomic Energy, March 4, 1971, Part 2. I call
your attention to page 854 where the foremost objective of this program is
shown to be experiments to test "analytical methods" pertaining to a LOCA.
PAGENO="0043"
39
Unfortunately, as is seen on page 855, the completion date had slipped from
the spring of 1969 to late 1973. Needless to say, the licensing and operation
of reactors proceeded.
In Washington, D.C., the Emergency Core Cooling System (ECCS) hearings
came and went, and countless flaws in the system were highlighted. But down
came the edict that, based on computer calculations, or those `analytical
methods' that the LOFT facility was supposed to have verified, everything
was al~(ight. Licensing proceeded, unabated.
In the fall of 1978, almost ten years late, the initial experiments
at LOFT were conducted, with an electrically heated core. With great fanfare,
the NRC announced the success of the test.
Mr. Chairman, when I saw the results of that test a few weeks ago I
was stunned. The test had failed. Phenomena were observed in the experiment
which were completely unpredicted by the computer code being tested. The
results were distributed to numerous Licensing Boards and the parties to
each proceeding. Attachment 3 is the notice that was circulated, only after
TMI-2. I must emphasize just what the purpose of the test was, and that was
to experimentally check the predictive ability of the computer program. A quick
reading of this brief notice vividly demonstrated that this goal was not
realized; the computer code, called RELAP-4, failed to predict the course the
experiment took. And that failure is cloaked in double-talk.
The double-talk comes from the lame explanation put forth by the NRC
officials to coverup this obvious failure. That explanation is to characterize
the experiment as "atypical." Here the meaning is crystal clear: the computer
speculation is being accepted as more valid than experimental results. And
licensing goes on.
PAGENO="0044"
40
Over fourteen years of procrastination, edict, speculation and ignorance
are now topped with double-talk. Are these characteristics of a research
program or a regulatory program that the public should trust or have confidence
in? I suggest the answer is no.
It would have been much more difficult for me to appear here today if the
LOFT-ECCS fiasco were unique in the nuclear reactor safety research program.
However, it is not unique, though the subject of the ECCS has been widely
publicized. The fact is, much of the basic research still remains to be
carried out. Attachment 4 speaks to this issue. This attachment contains
the conclusions from a report released by Oak Ridge National. Labs in 1968
entitled Emergency Core-Cooling Systems for Light-Water-Cooled Power Reactors,'
by C.G.Lawson. I have taken the liberty to underline a phrase or twø, the
many conditional verbs, and a couple of sentences. While it is not clear how
many of the problems mentioned in this conclusion have been resolved experi-
mentally, I have little reason to believe many have.
Part of the justification for this belief comes from Attachment 2,
mentioned earlier. Here I turn your attention to the general testimony of
Mr. Milton Shaw, former Director of the Division of Reactor Development and
Technology, of the AEC. Mr. Shaw speaks of budget cuts, slowed and curtailed
experimental programs, and even questionable information coming out of existing
experiments. At one point he states on page 860.
There is also arremendous controversy as to how beneficial such
small-scale experiments can be, but our position, is `that we can't
afford to build them much bigger.
So here is one place where economics plays a key role. Here it should also be
noted that in these Hearings, a list of general unsolved problems and areas for
research pertaining to reactors was presented on page 852.
PAGENO="0045"
41
These were listed before we became aware, as we have in more recent
years, of fuel densificatjon, steam generator tube denting, stress-corrosiao
cracking and the torus jump problem in BWRs, and so on. And to this short
list we must list those generic unresolved safety problems that the NRC
annually sends to Congress. No, I don't think we have made much progress in
the last 20 years. But this lack of progress has never slowed the relentless
licensing of new and larger nuclear power plants.
Let's go back to that recent LOFT experiment. LOFT is a 50 Megawatt
Thermal (~4t) test reactor. Many operating PWRs have thermal outputs between
about 2800 MWt, like 1111-2, to over 3400 MWt,like Trojan 1. It is evident that
the computer code whose accuracy to predict events was being tested, RELAP-4,
did not succeed in predicting the course of events. There is an all i~portant
question that remains unanswered, and certainly seems to be avoided in silent
desperation by the NRC. That question is: what does that experiment at the
LOFT facility tell us that is applicable to operating PWRs? Or, do the results
of the LOFT facility experiment instill any confidence in RELAP-4 to predict
to
the ability of the ECCS in a large reactor~carry out its intended function in
the event of a LOCA? I can come to no other answer than another negative one.
In northern Pennsylvania, near Berwick, a pair of BWR reactors, Susquehanna
1 and 2, are soon coming up for operating license hearings. The ECNP is an
Intervenor in that proceeding and already troubling aspects are arising.
For example, on the subject of power excursions, it appears that great
reliance is placed on a computer program dating back to 1956, which, when
subjected to preliminary verification experiments, failed in an~unsafe direction.
(See, for a fuller discussion, "The Accident Hazards of Nuclear Plants," by
Dr. Richard E. Webb, University of Mass. Press, 1976, Chapters 3 and 4).
PAGENO="0046"
42
Now, over twenty years have gone by and the question of the susceptibility of
large reactors to destructive power excursion accidents does not appear to be
resolved, except through speculation, rhetoric, and Licensing Board approvals.
Just last week, we received a communication from the NRC stat$ng that some
reports from one of the Susquehanna 1 and 2 subcontractors, Kraftwerk Union
Akliengesellschaft (KWU) are granted an exemption from public disclosure by
the NRC. The letter, dated May 11, 1979, is sufficiently vague that it is
impossible to determine even the general subject of the now `confidential'
KWU reports. The letter contains the following statement
We have also found at this time that the right of the
public to be fully apprised as to the basis for and effects of
the proposed action does not outweigh the demonstrated concern
for protection of your competitive position.
It is certainly not encouraging to learn that the "competitive position" of
a subcontractor is more important to the NRC than the right of those affected
by some nebu'ous design feature to know to what kind of risk they are being
subjected.
If anything, the ThI-2 accident showed that gaping holes exist in not
only our understanding of reactor accidents, but also the ability of not only
the NRC to review, inspect, and license reactors, but also of utilities to
safely operate them when deviations from anticipated behaviour occur. From
the materials I have seen concerning the course and results of this accident,
I am exceedingly disappointed in the extremely shallow and unsophisticated
nature of the analyses. For example, in a report entitled "Core Damage Assess-
ment for TMI-2," memo from R.O. Meyer to Roger Mattson, April 13, 1979, the
heat-up rate of the uncovered core of 1141-2 is discussed, along with the
quantity of zirconium fuel cladding estimated to have been consumed by reaction
with steam. However, the contribution of heat from the zirconium-steam
reaction was neglected in assuming the c~5re heat-uy~ate. The deficiency here
PAGENO="0047"
43
is because thischemical energy may have been of comparable magnitude to that
of the fission product decay heat over the hour or so that the heatup is assumed
to have occurred.
Equally unsettling is the rush made by the NRC to apply a series of
bandaids to the other operating Babcock and Wilcox (B&W) reactors to get them
back to operation as soon as possible. This crash course seems to have
precedded an appreciation or even understanding of what the real course of the
TMI-2 accident was. To be more precise, it does not appear to be known pre-
cisely when thezirconium-steam reaction occurred, or the effect of the elec-
tromatic relief valve which stuck open in the early stage of the accident. It
has obviously been assumed that had this valve properly closed, damage would
have been less severe to the reactor. The validity of this assumption has
not been established, in my opinion. During most of the initial few minutes of
the accident, after the steam generators had boiled dry (at about 1 mm. 45 sec.
into the accident), water steam flashing through this valve was the major heat
release mechanism for the hot core. Had this valve closed properly and stayed
closed, the primary coolant system may well have become greatly overpressurized.
The rush action by the NRC seems to suggest that the avoidance of the exact
sequence of events at TMI-2 is desireable, but it does not appear grounded in
a firm understanding of whether or not the recommended solutions might cause
worse conditions, should this sequence ever repeat itself.
There is another equally troubling aspect to this whole accident, and
that is that ThI-2. was a new reactor with a core that had less than 90 full
power days in its operational history. From this fact, it seems necessary to
ask whether or not, had this accident happened at a B&W reactor with a higher
fission product inventory, like TMI-l, or Rancho Seco, would the results have
PAGENO="0048"
44
been the same? Another seemingly unanswered question is whether or not the
quick fix solutions required by the NRC for older operating B&W reactors will
work where fission product inventories are higher. It should be pointed out
here that higher fission product inventories mean, in general, a higher core
heat-uprate. Furthermore, it should be pointed out that the ECCS is designed
to function for a relatively cool core, that is, one right after blowdown. It
is entirely possible that the actuation of the ECCS onto a hot core, one where
the fuel cladding is very hot or melting, may do more harm than good.
The promoters of nuclear power, from the NRC on down, have repeatedly
pointed to the supposed `accident_free! or "mortality-free" past history of the
commercial nuclear power program. These comments however appealing they might
sound, are deserving of a closer scrutiny.
As far as the accident-free part goes, it suffices to say that at least
three (3) of the 80 or so nuclear power plants licensed by the AECZNRC have
had very serious accidents early in their respective li.ves. These were
Enrico Fermi I, Browns Ferry 2, and, now, TMI-2. Fermi was down four years
for repair. Browns Ferry l&2 suffered a fire in electrical cables and, for
Unit 2, many safety systems were disabled. The third was TMI-2, where half-a
million people faced a core meltdown for 4 or 5 days. This is a less than
enviable safety record, and it does not include the many other near-misses.
While the validity of the population dose estimates released by the NRC
and HEW are not the subject of these hearings, they deserve a few short comments
made from my reviewing of the data in report of the Ad Hoc Population Dose
Assessment Group. My conclusion is that the members of this group chose to
seriously understate the population dose due to the TMI-2 accident. This
dubious result was achieved by ignoring completely the character of the data
PAGENO="0049"
45
they had to work with. For most directions around TMI-2, between March 31 and
April 7, 1979, the exposures measured by the NRC do not decrease rapidly with
increasing distance from the reactor. Quite the contrary, most doses were
approximately constant, and some even increased with increasing distance.
Unfortunately, the NRC chose not to monitor beyond about 14 miles from the
plant, or in the directions in which most of the population was located.
However, the Ad Hoc group used these deficiencies to their own seeming
advantage, ignored the trends of the monitoring data theydid have, and
assumed a standard atmospheric dispersion model to calculate exposures beyond
10 miles from the plant. This model requires that doses decrease according
to a minus 1 .5 power law,contrary to the existing data out to distances of
about 14 miles. As a result, the public exposure widely reported by the press
are nothing more than fabrications designed to conceal both the real magnitude
of the exposure dose ~`~the accident, but also the incredible incompetence of
the NRC in its monitoring efforts.
Many people will die as a direct result of the TMI-2 accident. I cannot
qu.antify the number exactly, but I have reason to believe it will number in
the hundreds, maybe in the thousands. Efforts by the NRC to conceal this
carnage will not solve the problem. Honesty and candor would help, but there
appears to be little chance for either in assessing pronouncements from this~
organization. So licensing must go on, on until we apparently must learn the
accident probabilities at nuclear power plants by trial and error. Just what
the ult~rnate* toll in human life and misery will be is not predictable, but if
Fermi, Brown's Ferry, and TMI-2 are any indication, that toll will be high, both
in lives lost and in misery. Tragically, the TMI-2 accident is not over, nor
are thereleases of radioactive materials.
When all is said and done, the safety philosophy of the nuclear power
program, when stripped of the endless self-serving words of praise, and reduced
48-721 0 - 79 -
PAGENO="0050"
46
to how it really works in practice, has been accurately characterized as the
Law of the Universe according to Walt Disney, which is
Wishing will make it so
To this fundamental NRC and industry philosophy, I have added twocorollaries
1. Wishing that problems were solved is as good as solving
them; and
2. Programs can only succeed; failures are simply relabeled
as successes.
Evidence of the validity of the first corollary comes from the fact that so
many unresolved safety problems remain unresolved after so many years, and so
much basic safety research has been postponed and terminated. In addition, the
radioactive waste problem and the still nagging problem of low-level radiation
persist, even though they have been solved many times through agency and industry
press releases.
Failures.always become successes in the strange world of nuclear power.
The Enrico Fermi accident was one such success. It cost between 60 and 300
million dollars to build, depending on whose figures you believe. It operated
for the equivalent of a full month or so before it was mercifully mothballed (but
not decommissioned,. dismantled, and removed). A lot was learned at the Fermi
reactor.
The Browns Ferry fire was also a success because a lot was learned there,
like how a core meltdown was averted. Yet today, most reactors are just as
vulnerable to fires as Browns Ferry was. So while the $150 million or so that
fire cost taught someone a lot, the lessons yet remain to be applied to many
other reactors, but it was a success.
So, of course, was 1111-2 a roaring success. It may be out of service for
from 2 or 3 years to forever, it may cost $300 million to clean it up, or it may
be a total loss of over $700 million, But it was a success. The safety systems
worked, and according to the fudged data nc~bne was killed.
These accidents are all part of a strange definition of ~success, but then,
"wishing will make it so."
Gentlemen, who among you would volunteer the constiuents of your District
or your backyard for the next nuclear "success" story?
PAGENO="0051"
47
Attachment I /`~~-~
Tcrrestricd .9y8tem.s. Del ailed design of- i.he Loss of Fluid Test
(LOFT) facilit.y was essentially completed in 1)ecéinber by Kaiser
Engineers, Oakland, Calif. A contract to fabricate the cotitttiiiinent
vessel for the LOFT facility, which will be located at N.I~TS, was
awarded in January to Pittsburgll?Des Moines Co., Pittsburgh, Pa.,
by M. `W. Kellogg, prime contr:~ctor for the construction of the LOFT
facility. The reactor vessel fabrication contract w'as awarded in
October to the P. F. Avery Corp.. Billerica, Mass. Construction of
the facility, expected to be complete in . late 1967, had passed the
10 percent completion mark by December. `Within this reusable test
facility, the flatcar-mounted LOFT reactor system will be used to
conduct a loss-of-coolant test on a ~0-tliermal megawatt pressurized
water reactor. Following an extensive nonnuclear test program, the
i/f (*7
~- ~
I ~ ~
It. ~. ~
en
I.OJ-"J' J'aeili(i~. C()IiStructjon i'(a4'1)e(l groniid lt~vcl during -it)6~ 011 liii' IMSS of
Fluid Test (LOFT) Facility, (lepicted here by an artist's conceptual drawing.
Beluw-grontid.lev~l construct ion started in October 1961, and LOFV1~ is expected
to be opera t ional in lot e 1067. A cuta way sect ion of the c nt a in iiwiit shell shows
the reactor safety experiment mounted on a double-width Ilatcar or dolly which
can be pulled by shielded locomotive over qtUtdrlll)le rails to a nearby "hot shop"
for post-test analysis. One of the principal reasons for building LOFT is to
demonstrate the safety of water-cooleti power reactors by deliherately triggering
a runaway power burst caused by major coolant pipe rupture, a highly improbable
but the worst conceivable acci(Ient for such r~'actois. LOFT lS part of the safety
test engineering program conducted for the AEC by PhillipS Petroleum Co.
q
I
- ~ ~
4~PUM~' t'--(~':~ `~
p
PAGENO="0052"
48
first nuclear test will be conducted iii the spring of 1969. Supporting
research and development programs were established at national
laboratories :111(1 AEC field installations to test equipment and special
instrunientat ion, and to perlorni analytical studies for predicting the
sequence and magnitude of events expected to occur in the LOFT
tests.
Aerospace systems. Transient experiments on uranium-zirconium
hydride reactors for space nuclear power al)plications continued dur-
ing the year at the National Reactor Testing Station. These experi-
ments, conducted by the Phillips Petroleum Co. with the support of
Atomics International and Edgerton, Germesliansen, and Grier, Inc..
are investigating the kinetic behavior of SNAP reactors when sub-
jected to large and rapid reactivity insertions. The SNAPTRAN-i
series of experiments to investigate the behavior of a reactor in the
nondestructive region was completed in September 1965. SNAP-
TRAN-2, to follow, will project the investigations into the destruc-
tive range.
A series of full-scale re-entry flight tests, supported by applied
research, have been pumsmmecl to determine the effectiveness of using tin
heat generated by the atmosphere during re-entry to burn up nucleai
systems. This burnup, with the subsequent wide dispersal of the
debris in time atmosphere, would thus serve as a safe means fot
radioactive fuel disposal.
During 1965, further analysis was made of time data acquired from
re-entry flight tests conducted on a simulated SNAP-bA reactor ii
May 1903 and October 1964. This flight analysis has provided prool
that the specific systenis tested would disassemble as designed, and ha~
substantially increased confidence in the ability to predict re-ent.r~
heating effects from theoretical analysis.
Effluent Control Research and Developni eat
The programs in effluent control research an(l (levelol)ment are di-
rected toward the safe nianagenieiit and disposal of vatious types of
ra(lioact.iVe wastes resulting from nuclear i'eiictot' oI)el~iltiOnS, the
quati t it at i ye det eiminii t lOll of t he behavior of I liesc residual ra(l io-
active effluents in the environment, and the development of engineer-
ing criteria associated with the. environment :il aspects of nuclear tech-
nology oI)erat lOliS. This work proVi(leS a basis f~r defining and
controlling time ultimate fate and possible effects of radioactivity in
time enviroimmnent.
PAGENO="0053"
49
Attachment~2 &~
AEC AUTHORIZING LEGISLATION
FISCAL YEAR 1972
HEARINGS
BEFORE THE
JOINT COMMITTEE ON ATOMIC ENERGY
CONGRESS OF THE UNITED STATES
NINETY-SECOND CONGRESS
FIRST SESSION
ON
CIVILIArc NUCLEAR POWER PROGRAM
MARCH 4, 1971
PART 2
Printed for the use of the Joint Committee on Atomic Energy
0
U.S. GOVERNMENT PRINTING OFFICE
6~258 0 WASHINGTON: 1971
PAGENO="0054"
50
sect ions that we may be obtaining from the machines-arc more
relate(l to a narrow spectrum of interest, because we just don't have
the money to (10 the. 1)ronder areas.
t~ Vf'iy real sense, we have had about a 40-percent red uctionin this
~)TO~fl)~ when oiio h)Oks at cost of living here 5111 CO 1969. Certainly the
number of people funded by the program has been rc(luce(l by about
40 1)Prcent in this period SOIflO 1,300 1)001)10, 1 T1Cl(I(liflg many good
scientific people, that we just are tiiiable to fund . The number of con-
tractors will have been cut from 54 to 18 by the end of fiscal year
1972. We have had to phase out a number of programs that I prorn
dict ~vil1 affect adversely our long-termoutl ook and caJ)abihty in
the nuclear power business. Perhaps, if we were doing the work it
w0UI(1 prevent us from getting into a lot of trouble, compared to having
to bale ourselves out later by leaning back on the people an(l the tech-
nology as a ~esu1t of present confinements of this program.
I don't know what the solution is, but it is characteristic of the
general problem we face.
Representative H0sMER. You mentioned a research and develop-
ment tax earlier today.
Mr. SHAW. I doubt that the typo of tax we talked about will be
(levoted to this longer term work, which is mostly performed in the
laboratories and in the universities, as much as it will be used to build
demonstration hardware.
Senator BAKER. I am sort of open on it. We will talk about it some
time.
Mr. S1-iAw. Yes, sir.
NUCLEAR SAFETY
The next area is nuclear safety (fig.-.97). here we are requesting
REACTOR SAFElY PROGRAM
PROGRAM. ELEMENTS
RESEARCH AND OEVEI.OPMENT _____________
SUBASSEM8LY TRANSIENT TESTING
FUEL FAILURE PROPAGATION
COOLANT DYNAMiCS
FUEL COOLANT INTERACTIONS
FISSION PRODUCT AEROSOLS
ANALYSIS AND EVALUATION
PROGRAM PLANNING
INFORMATION HANDLING
TECH. ASSISTANCE TO PEG.
PRESSURE VESSEL STUDIES
RELATED MAJOR FACIUT1ES
LOFT - LOSS OF F)~UIt) TEST
PBF - PCTNER BURST FACILITY
CDC - CAPSULE DRIVER CORE
WSEP - WASTE SOLIDIFICATION ENGR. PROTO.
TREAT - TRANSIENT REACTOR TEST
* `FUNDED UNDER CIVILIAN POMR
* PROGRAMS.
EFFLUENT CONTROL
ENVIRONMENTAL INVESTIGATIONS
THERMAL EFFECTS STUDIES
WASTE TREATMENT & DISPOSAL
ENGIMIRING FIELD TESTS
LOSS OF COOLANT TESTS AND
EMERGENCY CORE COOLING
INVESTIGATIONS
ENGIFtERED SAFETY SYSTEMS
CONTAINMENT TECHNOLOGY
PLANT APPLICATIONS & ENG. TEST
PROGRAM
STANDARDS, CODES, SPECIFICATIONS
GEOLOGIC SEISMIC FACTORS
BASIC CEO-SEISMIC DATA
ENVIRONMENTAL MAPPING
LIAISON WITH OTHER CEO-SEISMIC
PROGRAMS
DEVEEOP ASEISMIC DESIGNS & DATA
SPECIFIC SITE INVESIIGATIONS
D(MONSTRATION OF ASEISMIC DESiGNS
PAGENO="0055"
51
$35.9 million for fiscal year 1972, ~vhich is the same as the 1971
est iiiiate. `the major incr(nsc iS ~Ii fast r~actor saf(~ty, whih has been
iIi('rPflS((l ill OUr projections from $7.4 million to $10.6 million. Of
(OIlFSe, Wit Ii the level budget this increase 11115 had to be offset by
olecreases iii several other vit at or im port ant safety areas. These
(le(rea~es ilIclli(lP lit) fiirt her fuel procurement lU (cii flu of the test
rea(t(rs, purti('ulnrly (lie J)OW(~F burst facility and cutback of other
light water safety work.
}or exam pie, we have had to terminate programs related to failure
modes of zirconium-cl ad fuel F nis which are useol iii light water
reactors. This work was being p~rformed at Oak Ridge. Again we
would like to (Wit flute that work, whirli is out-of-pile work, hut we
feel We must go iti-l)ile with Sonic of this ZIFCOII111II1 \VO1'k to build on
the out-of-pile work alrea(ly accomplished.
`flie waste sOli(lihda t ion experimental program (WSE P) underway
at Hanford is being l)hiIse(1 (lown anol ~siIl be Cli)se(l out in 1972. Much
of the work on l)il)e ruptures and reactor acci(lent analysis that was
going on in a number of organizations will be l)haSNl oiiit. Sonic of
these activities are alrea(ly phased out iii order to Coflsoli(late ~vork
in a small number of orgalnzrLt ions.
Of course, we are investigating work on siting and safety problems
which are of general applicability not only to the commercial reactors,
or potentially commercial reactors, but also for reactors of our own.
This includes our test reactors and other facilities, for which we must
(10 safety ~voi~k iii oroler to assure the .cOntiiluNl s~~k operation of these
fn(ilitjes Examples of the type of requirements plnee(1 Ott the nuclear
safety program are those showir on figi.ire 98, and those that arise
from a (letluled analysis of the accioleuut. sequence diagram, figure 99.
REACTOR SAFETY PROGRAM
ACRS `ASTER IS KED" ITEMS
1. THERMAL SHOCK TO PRESSURE VESSEL FROM ECCS OPERATION.
2. SEISMIC INSTRUMENTATION FOR STRONG-MOTION RECORDING.
3. IMPROVED PRESSURE VESSEL FABRICATION AND IN-SERVICE INSFECTION
TECHNIQUES.
4. CALCULATIONAL MODELS FOR REACTOR B1(YNDOWN.
5. FUEL FAILURE MODE IN LOSS-OF-COOlANT-ACCIDENT AND EFFECT ON ECCS
CAPABILITY TO PREVENT CLAD MELTING.
6. FUEL FAiLURE - LOSS-OF-COOLANT-ACCIDENT ANALYS IS AT CURRENT HIGH
POWER DENSITIES AND BURNUPS.
7. EFFECT OF SUBASSEMBLY FLOW BLOCKAGE.
8. EFFECT OF (ND-OF-LIFE TRANSiENTS ON FUEl. FAILURE.
9. DETECTION OF GROSS FUEL ELEMENT FAILURES.
10. SEPARATION OF CONTROL AND PROTECTION INSTRUMENTATION (DESIGN).
11. HYDROGEN EVOLUTION
12. VITAL EQUIPMENT SURVIVAL lN A LOSS-OF-COOLANT ACCIDENT.
FIGURE 93
PAGENO="0056"
52
ACCIDENT SEQUENCE DIAGRAM W1Th ENGINEERED SAFE IV FEATURES
FIGURE 99
LOFT PROGRAM
Principal areas for hardware and fuel commitments in this budget
category currently are in the LOFT program, which is the loss of
fluid test facility being built at Idaho, as ~vell as in the 1)o\~(r 1'
facility I)ro~'am at Idaho. llu' LOFI bU(lget Ft'J)fl~WIitS $9.9 miLL
~vhith is nit increase over fiscal year 1971 of $1 .S million. This in'r
is principally due to the fabrication and assembly of large corn ~`
for this unique facility. It is the only facility iii the world in ~
WC ~vill he able to obtain large-scale reactions to a loss of coolant
accident and st tidy the i'dat ed phenomena front act tially using emer-
gen(y core cooling systems in an operating reactor.
Of course, this is one of the prin('ipal areas that hmis beeii discussed
1111(1 (lel)Ilte(I heavily in the safety circuit ; thu t. is, this tremendous
concern over a loss of coolnat . For example, if a pipe ru pt tires, do -
loss of coolant occur rather (ttIuklv? IS one ;il)le to inject water tpttrki
into the Ft'aCtoI~? \\lmat ~vill be the t~1rt~ct of doing this? This, of cou1r~-,
is one of the principal areas of interest in the licensing of light ~voter
reactors. W'e are quite J)l('ase(l with the regroitpitig at Idaho in the
14011 project. The project. design is moving nitenul quite will now,
and we believe that the facility, if fLinding remains eoInl)nt ihle wit Ii
\VIIILt we have Schedule(l, Cull be l)rought into use within the neXt 3
years.
Representative hANSEN. May I ask a question here, Mr. Chairman?
Representative PRIcE. Mr. 1 lansen.
Represetitative hANSEN. T what extent will LOFT yield some of
the answers that may be needed in the area of safety for the fast
breeder reactor, gas cooled reactor or other COflt~el)t5?
[~~E1
PAGENO="0057"
53
Mr. SILAW. Very little, sir. LOFT is principally related to safety
cviii eat ions for the pressurize(l \VH ter reartor. It. has sothe value to
ti1I(lPNt aniiiiig some of the parts of the i)oiiing Wit t er reactor, but is
J)I iliCi J)ii liv (liFer tC(l ilrOUn(l t he l)ressurize(l \ViLteF reactot safety
consi(iera t ions.
Its (OiltFibtitiOIis to the other reactors ~viil be J)riflciJ)aily along the
Ii ni's of being able to relate nit a ivt ira I work to eX )erimentai results,
and iiI(iiVi(l titti srJ)arat e (`ff(('tS (ISIS itS t hey relate to t he whole. rfhat
is, it. will give the confidence to the analytical people and relate anal-
ysis to the experimental results to permit carry-over into other
concel)ts.
That is about the limit of it, sir.
(Testimony continues on p. 855)
(Additional in formation provided for the recor(I follows:)
LOFT
Significant. progrc~s has been made in the design and construction of the 55 MWt
Loss of Fluid Test Facility (LOFT). LOFT is the only nuclear facility in the world
planned to conduct major loss-of-coolant accident experinient.s (see chart below
for LOFT experimental objectives.)
- LOFT
EXPERIMENTAL OBJECTIVES
1. lEST THE ADEQUACY OF ANALYTICAL METHODS USED TO PREDICT:
a, THE WSS-OF-COOLANT PHENOMENA AFFECTING CORE THERMAL RESPONSE;
b. THE CAPABILITY OF THE EMERGENCY CORE COOLING SYSTEM (ECCS) TO
FULFILL THE INTENDED FUNCTION;
C. THE MARGINS OF SAFETY INHERENT IN THE CAPABILITY OF THE ECCS;
d. THE THERMAL AND MECHANICAL RESPONSE OF THE CORE AND PRIMARY
SYSTEM COMPONENTS;
e. TIE PRESSUREJEMP(RATURE RESPONSE OF TIE CONTAINMENT ATME)SPHERE; AND
f. THE MAGNITUDE, COMPOSITION, AND DISTRIBUTION WiTH RESPECT TO TIME
OF THE FISSION PRODUCTS iN THE CONTAINMENT BUILDING.
2. VERIFY THE DESIGN REQUIREMENTS WHICH DETERMINE TIlE CAPABILITY OF THE ECCS
AND THE PRESSURE REDUCTION SYSTEM TO FULFILL THEIR INTENDED FUNCTION.
3. REVEAL THRESHOLDS OR UNEXPECTED PHENOMENA WHICH AFFECT THE VALIDITY OF
THE ANALYTICAL METHODS USED TO PREDICT THE EFFECTS OF A WSS-OF-COOLANT
ACCIDENT AS LISTED ABOVE.
The importance of an actual power reactor plant to conducting these experi-
ments cannot be eieith'restimated. As noted in previous hearings, the overall LOFT
effort has beret successful iii (I) providing a focal point and a fundamental sense of
direction to the water reactor safety program, (2) forcing investigators to face the
reality of an actual power reactor in the accident. mode, an(l (3) prOvi(ling a central
vehicle to build and hold a competent safety oriented technical stalT in a vital
national program. The fundamental soundness of the LOFT objectives have been
reinforced by continued engineering and analysis of 1A)l~T which has further
established the relationship of the LOFT program to the current industry light
water reactors. This has also been reconlirmed by reviews conducted by industry
consultanLs, the AEC Regulatory I)ivisions, and the ACRS.
PAGENO="0058"
~54
LOFT DESIGN AND CONSTRUCTION
The project design ha.s progressed to the point that procurement of all the major
reactor plant components is underway. S stem (l(Ysign descriptions of almost all
major plant systems have been COmj)ltted by INC. in addition, 10 water reactor
major component standards and associated LOFT specifications have been ap-
proved by INC and AEC.- As a result of this engineering progress, procurement
act ion is underway on the reactor fr~stl~~ vessel nlo(lilications, steam generator,
l)resslrizer, primary reactor piping, and reactor support frame. \Vork has been
initiated on reactor vessel nlodilicat ions. The design of the reactor core and vessel
internals and associated in-core instrumentation is well underway. This is a large
effort since the core will be heavily instrumented in order to derive the experi-
mental information. In addition to those lfl)T water reactor standards that have
been approved there is work underway on 2~i standards which are being prepared
with the hell) of ORNL.
l)esign and cOnstruction of LOFT construction funded facilities continues with
the status at about 90% of design and 60% of construction completed. 1)uring the
past year the basic containment structure including the large railroad door and
frame have been completed and considerable outside concrete was poured. 1)esign
and procurement work is underway on the reactor auxiliary systems with addi-
tional concrete pours and final containment tests planned for later this year. In
order to efficiently complete the 1)r~j~ct certain experimental equipment of low
priority such as an extensive fis.~ioii product sampling system has been deferred.
As reported last year, the overall plant continues to be scheduled for late 1973
initial operation. However, difficulties are still being encountered due to the short
supply of experienced water reactor design and manufacturing personnel and the
problem of obtaining small one-of-a-kind high quality components, instruments
and equipment from industrial sources that are heavily committed to the large
scale manufacture of equipment for the large commercial water reactors.
* EMERGENCY CORE COOLING AND RELATED RESEARCH
As part of the LOFT R & I) support effort, various emergency core cooling
V analytical studies and .scparateV effects tests are in progress as indicated below.
The results of these efforts form the basisforplanning LOFT experiments and the
basis for direct technical assistance to the AEC I)ivision of Iteactor Licensing.
V Analytical studies and code development at BMI-Columnhus will be terminated
at the end of FY 1971. Analytical studies, cOde development and assistance to
AEC regulatory divisions will continue on through FY 1972 in support of LOFT.
Blowdown experiments on the sea!ed reactor system (semniscale system at
.INC) will continue on through FY 1972 in support of LOFT. The intent of these
tests is summarized in the following chart:
REACTOR SAFETY PROGRAM
EMERGENCY CORE COOLING SYSTEM (ECCS) TESTS
V THE OVERALL INTENT OF THE SEPARATE EFFECTS TESTS IS TO PROVIDE:
V ~ EARLY SCOPING INFORMATION TO ASSIST IN THE DEVELOPMENT AND
V V EVALUATION OF ANALYTICAL TECHNIQUES OVER A WIDE RANGE OF
VARIABLES. V
~. INFORMATION ON THE CONTROLLING VARIABLES WHICH ULTIMATELY
DETERMINE THE PERFORMANCE REQUIREMENTS OR CRITERIA FOR THE
EMERGENCY CORE COOLING SYSTEM.
, INFORMATION TO ESTABLISH INITIAL TEST CONDITIONS FOR THE LOFT
INTEGRAL TEST SERIES AT THE MOST SEVERE DEMAND CONDITIONS FOR
THE EMERGENCY CORE COOLING: SYSTEM.
I. PARAMETRIC INFORMATION FOR USE IN THE ANALYSIS TO PROViDE FOR
VE)crR~nEs OF ELU1D ENVELOPE GEOMETRIES AND BREAK CONDITIONS
CHARACTERiZING THE CURRENT AND NEAR FUTURE PRESSURIZED WATER
REACTORS.
PAGENO="0059"
55
The semiseale system shown below was modified as reported last year for
simulated core heat and again this year for emergency core cooling injection.
Future plans call for scaled IflhlltilOOJ) systeni modifications.
SEMISCALE S~TEM DOUBLE ENDED
BREAK CONFIGURATION
Rupture
-Initiation
Device
-Rupture Disc
Assembly
Au~iliary Nozzle
Main Nozzle
A series of tests have been run in the serniscale apparatus using simulated core
heat (electric h~tters) and ztNumfliulat or injection of enItIg((ncy r'ore cooling (ECC)
water. The coudition~ of the tests are as tvjnral of large PVs lt:~ as the sealed model
~vill puini it. Iht' results ar I)eing uied to (lock analvt ieal models, (Valuate EGG
sVst(Ifl~ afl(I I rovid (Iota for I.( ) VT. ~1he results are also being provided to indus-
try as rapidly as obt ainud u mid its sum~ upoit is I ei ng solicited. ~ix tests to date have
exp(ricne(cl (lithculty in injecting EGG accumulator water ilit() the core region
under P\\ R b-of-coolant -acci(IemLt conditions because of ai )I)ar(Iit bypass of
the F.CC ~vater. ihe aluparatus will he nuo(lifi((l liv early FY 1972 to moore realis-
ticallv study this proihun u~ing LOFT geomnetry and system conditions more
closely rel)restnt ~tive of those of commercial reactors.
Testing of enierginCy cooling c:q)ahulitv was completed using full size (12 ft.
long) pin assemblies in the Full Length l~mergeiicy Cooling heat Tran$er Pro-
Coolant Circ~otuon
Butterfly Flow Control Valve
Rupture Disc Assembly
PAGENO="0060"
56
gram (FLECIIT) at GE and Westinghouse under subcontract to Idaho Nuclear
Corporation (INC), a~ shown below.
REACTOR SAFEtY PROCRAM~
FUU. LENGTH~MER~E'COOLING_H~T TRANSFER (RECHT)
CLI\D HEATE~]
Ternp.>1800 F
CCC Flcw . ECC FIc~v
Design Design
Degraded Dog rad3d
These tests, in which electrically heated flsselllI)lieS simulated decay heat
geziciat ion in full size reactor fuel pins cooled by sprays and flooding, were needlr!
to 055(55 (Tuergency co)liIlg svt ~il) perfurnlanc( Itfl(ler (lesign aini ofT-design con-
di tions. The tests perfornud indicate that under most emergency conditie::
post i ilat ed I he tmere' iicv cool i rig svst eros will perform their jut ended fi
over :t w id range of cooling and tenilarat ore condit ion~. 11 Ow(ver, thk e11
lvi I )e(olols reduced it ndir cirt ~iii tOilti)illat ions of dad 1 eniperat ore and
or delayed low coridit iOnS as might 1)1 reasonably post tilat ed for higher o~
power densities characteristic of fut nrc nuclear l)lants. Under sonic of th~-
ext r~rne coudit iOfl~ tested in the FLPX: I IT projects, 49 pin bundles were
daittaced ~s the zircalov passed the timue_at-tetnperatur( threho1d~ a--
wit Ii chenitical reactions between clad and water or steam. Iniforni~i t ion of I hi~
tv ~ was conidered valuable in (lemnon~tr:tt ing and bracket lag are:ts of concern
in the design of fut tire tntergency cooling svstents. ~1he limit at linus of these
tests, such a~ lack of complete system simulation and the it~e if elect rical heaters
which failed when ext rcnne cui~i~t ions were iulJ)ose(t, were recognized and taken
into 1tcCOUflt ill mt erpret ing tie dat a.
As a result of the FLI:CIIT project, a better understanding is available on the
mit tiract momis between (niergency coolant t (assumed capal de of (lelivery to the core
within 1 a-3D seconds from a nIajor coolant pipe break) and Ito zircztloy cladel lug
(~s-oinnie(l to heat liJ) front a - comnihimiat loll of stored fuel energy at t hi time of the
pipe break, pints the loss of coolant Pius decay heat gemmerat ion). it owever informmta-
loll g:t~ s rermia in in tile t bite regime following the as~tiiiteii ~ui~,t 111(8k, bitt `nor
to EUC inject ion. I )uning this regime, stored fuel iiimi heat is tramu~f rriil to tin;
cladding, to th~ renlOirlilIg coolant, and to steam formed ditnitig svtt dl
sunizat ion. the rate and amount of heat transferred during I his t univ perHI, u
he l3low down II eat Fran~-fer (111)1! T) reginu, ~5 mliii ort :intt in est ti 1; -hint g
ciaddi mtg t enipera tin re at the I mint. of emergency core cool mug inj ci mont. The in
portance of obtaining BI ) iii' information, for 1)0th I)resstttizi(l arid boiling re-
actors, is recognized by the industry, as well as the AEC 1)evdopment and
Regulatory l)nvnsions.
SS CLAD HEATER~]
Temp. ~ 1800 F
PAGENO="0061"
57
In recognition of this common flOPE!, the I)ivisiofl of Reactor Development and
Technology has held discussions with PW It ruin 11W It vendors to encourage co-
operat i~e efforts between indtist ry and t hi A EC to stud the B 1)1 IT regime with
experiments scaled t.o flpr(S(il t. the lilajor (`OrniponeIl Is of operating power plants.
General Elect ne has proposed a shared cost Coop(rat ye program on l3I)IIT for
B \V It's, and It 1 )T has agreed in pni nciple, assitit i rig that mutual agreement on
work scope and contract conditions can be obtained.
POWER BURST FACILITY (PBF)
Mr. SHAW. The power burst facility is a reactor for testing effects
of fuel failures resulting from a burst mode or steady state operation
(fig. 100). We put. fuel samples that have an operating history-
that is, have previously been irradiate(l-and give them a nuclear
J)1LISO ot' give them au oveupressure (`I 1)o\V0I to flow imbalance, in
1)1(1(1' 1(1 500 the types (if failures that WO mriv ifl(ltlCC ttfl(l the COHSC-
(Il10II(es of t hose fri ilutes.
Of course, to (10 this, WO have tt Sj)e(iiLI closet! 1001) Ill the power
burst facility, such 1 lutE whieui tIle failure Occurs it tiocs uiot affect the
[`(`St of the syst euul.
(Additional iuiforunatjou provided for the r('cor(l follows:)
`I'he Power BurstS Facility (P1111, (shown in chart, below) being completed at
N RI~, is an oxide-fueled, (Jut hermal, water moderated react or capable of steady-
state and transient opera I ion iticlirding tIre l)(rfOrfllanee of Iuo~~tr bursts having
rut ml periods a ~ujuroachiiig I nisec. Fuel loading is scheduled for C Y 1971 and
~hc start of t he exp(nirir(nlal program is scheduled for early C Y 1972. On Octo-
ber 29, 1970, responsibility for the PBF was transferred from the construction
FIGURE 100
PAGENO="0062"
58
contractor, howard S. Wright and Associates, to the operating contractor,
Idaho Nuclear Corporation. On l)ecember Il, 1970, the efforts of the architect-
engineer, hbasco Services Inc., were terminated.
:~ H
V __________
t
-
~J~1.: ~
4~
PG~VER BURST FACILITY. View looking northeast showing cooling tower on left,
emergency generator in center, and PBF reactor building on right.
The overall objectives of the Power Burst Facility is to provide a safety test
facility for conducting research on accidental melting of reactor fuel samples and
assemblies (See chart below) Such information is vitally needed to Supl)lelfleflt the
out-of-pile work on fuel assembly mock-ups which have been undertaken to study
fuel failure modes and emergency cooling effectiveness using electrical heaters
(e.g., FLECHT program). By performing fuel assembly tests in PBF it will he
possil)le to more realistically l)redict full scale reactor core behavior under equiva-
lent accident conditions. Analyses presently conducted on full scale systems are
deemed to be conservative in the determination of accident consequences-but
significant experimental proof is lacking.
REACTOR SMtIY PROGRAM
P(WiER BURST FACILITY (PBF)
OBJECTIVES : 1. TO STUDY NUCLEAR RJEL. AND CLADDING BEHAVIOR OF RJEL PIN
CLUSTERS UNDR.ABNOR?ML OPERATING AND POSTULATED ACCIDENT
SITUATIONS TO DETERMINE SAFETY t~RcsNs:
2. TO IDENTIFY ANY UNEXPECTED EVENTS OR THRESHOLDS NOT PRESENTLY
ACCOIJNTED FOR IN THE ANALYSiS OF RJEL. AND CLADDING RESFVNSE.
3. TO EVALUATE T}t ADEQUACY OF ANALYTICAL MODElS TO PREDICT TI(
CONSEQUENCES OF POSTULATED ACCIDENTS IN NUCLEAR REACTORS.
DESCRIPTION : SAFETY TEST REACTOR, CONTAINING A DRIVER CORE WITH A CENTRAL
PRESSURiZED WATER LOOP DESIGNEE) TO TEST THREE-FOOT LENGTH
PNR OR BWR FUEL ASSEMBLIES, CAPABLE OF STEADY-STATE AND
TRANSIENT OPERATION.
EXPERIMENTS : LOSSOFCOOIANI, POWERCOOLINGMISPMTCH, AND REACTIVITY
iNITIATED TESTS WITH SINGLE PIN AND MULTIROD CLUSTERS USING
UN)RR.ADIATED AND IRRADIATED PWR AND BWR RJEI. FOR CONDUCTING
RESEARCH ON MELTING OF REACTOR FUEL SAMPLES AND ASSEMBUES.
STATUS FACILITY COMPLETION AND Rift LOADING DURING CY 1971 AND START
- OF THE EXPERIMENTAl. PROGRAM IN EARLY CY 1972.
PAGENO="0063"
59
The basic document which will focus on the (`xperinwnt.al program in relation
to the crirrrrit safety issues and jiriorit irs is the PBF Progr:uii Plan, an outline of
which was circulat rd to t he AC US ann the A iC regulatory staff in May 1969 and to
indust rv in November 1 ¶Hi9. Ba~r'(1 on AC ItS, regrilat ory staff, inultist rv and it t)T
review a rid corn rnrn t , I N C is in t hr process of (st a l)lishi ng a Ii rio test program for
the initial trst,i ng series and or it lining t hr long t erni t (st i rig series. Present program
plans ~t i~ divot rd to water coolerl reactor fuels and (`1111 ili~siz~ the si mulat ion of
those accident conditions considrre(l roost. representative of (he route by which
reactor fuel macit might he achieved. Exploratory work will continue on the
POsSibility of testing ot her fuel types. Snow facility modifications are being con-
si(Lrred which, if incorporated, %%ouII(l Provide the PB l~' with increased capability
to model the potential accident conditions of advanced high power density reactors.
The Citpsuilc Driver (`ore (C I )C) program, which l)rovided failure data on
individual pins under static coolant conditions as a prelude to more complex tests
of fuel clusters in the Power Burst Facility, was terminated (luring F Y 1971.
Mr. SHAW. The unfortunate l)tUt about every one of these facilities
is that they lire (1tlite eX~)CIlSi\.e to build ltn(l (1tlite eXJ~enSiVe to operate.
But we know of no other way to get the kind of (LaIn we need. There
is t1lS() Ii tremendous amount of controversy as to lioiv benelicinti such
small-scale eXl)erilfleilts (lIfl he, ~ our position is that we can't
afford to bllil(l I hem nuicli bigger.
Ihese data become very signilieant in terms of insuring analytical
and experiment mtl results. We believe we have to keep this kind of
effoit going to provide the best. l)o5511)1e iiiiS\VCFS to the (OUCCFUS (bitt
Can be expressed l)V those looking at. what happens if many things
go wrong and if systems put in to take care of these accidents don't
work.
FUNDING OF SAFETY PROGRAM
Representative T-TANSEX. My concern, if I can express it., is that
really we may not l)C moving irlie~ul fast enough ill terms of the funding,
of 11w kind of safety research that will helJ) produce time aitswers to the
growing cont~iiis t lint are 1)eing VOiCe(l, p~Ut icularly by environment al
groups; safety being such an un port ant 1)itlt of react or technology its
11w unit ~ gio~ iii terms of size, it seemims to inc that \V(.' are goulig to
have to keep price in the level of effort that we are mounting for
reactor safety.
~. ly conce~n is what a ppears to be a tapering off in the area of
safety research just at the time that we probably ought to be stepping
it. ill).
\ I r. StrAw. \ I r. II ~fls~ii, it is lit) seci't. tim at. t hemi' ml rt' sI rung feelings
811(1 1(1)! (`sent at in ills lb at say ( xnet ly what. you liii ye sai(l . \\o certainly
ii rn not get t ing iVita t we ii mm Vt asked for in m (`net or smtf~t v funding.
`Ike ~(0~i( (1 )ti((IflO(l mi mt ren gliize t Ii at wit in am t tim (` (1 itt 8, 1 lieie
has to Ill SoflW (OIl1~flitS;ltiIlg 8(tioIl takeim, such as iii tnrmmls of being
Illume commserv ittive nut! thor carefuni 1 lout mu iglit ol hmerwise be neces-
sat~. & (nummot exl)k it tile react ors or push time react ui's IlS hum d ui,
we believe they could 1)1 t'luit~mtt~'d.
\\e feel we tin ye t I) (I tveh p on list' fronts ; th at. is, st rung quril i ty
assutrum lice pn `grim imis htmt still exti rninumlg to our l)est )( )ssil)le abut ity
whmmtt lluLl)lRIms if timings go wrong 1111(1 get tin' signs of !)rubiemlms early
(notigli timid (`X(I'(lSt' t lU tVl)( of (oil t tul nee(i(d.
it is t I tie I lint 1)1111 inllv its ti restmlt of limo Ilet.(l to increase the
lt(lVrtllced I (tl(tUN safety prugi tints, we have hir~d to back off on the
light water srtftt~ pm.i~m ants. We hut ye had a imumber of meet illgs with
the industrial gioups 111 oider to try to get them to pick up these
light water safety activities. There is a good agreement that something
PAGENO="0064"
60
hkt this w ill I1R\ e to b( dOIl( , but ~ e haven't moV( d aht ad as qui kly
as sh,uld havo been dour.
We feel we have excellent facilities in house. We have excellent
iwople ; but we feel that the iiidu~ try should i eally be SU~)j)Ortit1g more
of these activities before we terminate theni completely. We nerd to
get mnatiy of the answems that must. be available if we are to continue
to live with the analyses ammo1 ttsSUIfll)tionS niado on such matters as
failure modes an(I responso of safety systems with increased P0\Ve1
density and cci tairi materials and operating pt~ttems.
1 want to note, however, that the worth of the safety program
relates not only to the timing of initial start UI) of these 1)lants, but.
also throughout the 01)0.1 ating history.
Many of the safety concemns you hear about right now relate to the
consideration of long-term operation, which we think tue vei~y kgiti-
mate. \Ve feel that this concern over safety is. the kind of thing we
must keep in front of us afl(l talk about openly. -
The safety program suffers tho disadvantage of open discussiom;
although we feel it is the right way to do it. We have discus~od suf~;.
l)lans we have ideutifie(l all the pioblenis and many of these may
miot be meal. Unfortunately, our critics and intervellors are using
much of this information against nuclear power in many cases. We
feel we have no option hut to conduct. the safety irlated ptograflis
this way and accept the criticism and the. consequences.
Rej)r(sentative H.&N5EN. What is the request for safety?
Mr. ABBADESSA. ~1h (liVisioll request. was for $49 million. `lhi'
agency request was $42 million, and the budget that you are looking
at, Mr. hansen, has $35.0 million, which is the prior year's level.
(Testimony continues on P. 864.)
(Additional information provided for the record follows:)
NUCLEAR SAFETY PROGRAM
The Nuclear Safety Program is divided into five budget categories-Ne :.t.
Safety Research and I)evelopment, Effluent Control. Research and l.)eveli'lc: nt.,
Engineering Field Fests, Reactor Safety Analysis and Evaluation, and Etigi-
ricering Safety Features.
The Fl 1972 funding request for NuclearSafety Research and l)evelopment
is $14.4 million, an increase of $1.4 million above the current Fl 1971 estitii~tC.
This represents an increase of ~3.2 million for LMFBIt safety R& I), part of which
is offset by reductions in AEC funding for the Power Burst Facility program
and by completion of a study of failure modes in light. ~vat ci reactor fuel cladding.
The increased LM FB It safety l~& 1) funding is for expanding j~rograris in the
areas of fuel (l(lnen t failure m ropagat ion, fuel-coolant interact ions and post-
accident hint removal, and for t st irradiat ions.
`I'he F V 1972 funding request for Eliluent Control Research and Development
i~ $4.1) niillion, a decrease of $1.5 million below the current F V 1971 i~-t itnate.
`1'hi~ act ivitv is direct eij tow:trd developing .~f practical nietliods for long
tern! inanagenwnt of the radioactive wastes resulting froiti ii~iclear facility opcr-
at ions; determining and ~sses~.ing t lie fate and behavior of these rsi(l iial radiO-
active ~vast es in I he envirouhil'.iit and wit Ii the geophysical and environtilerit il
aspicts of siting. de~igii and con~t rite! ion of react ors and iclated titulear facilit it.~.
The decrease in re 1uest ed fiiiidiiig is titade possilk b~ t he aehivii;iint 1)1 Sin) d,
tested tnit hods of ~vast e saudi heat ion atil pirinaron t st am g in salt iiiities, by a
reduced ziced fur addi t ional work in radioactive residue ~ devilopnietit, and
br the cozniilet ion of met ,orologieal st inlis at t lie N at ioiial React or Testing
St at ill!. Increases . ttCCoiIiliio(.htt ed wit hin t his budgt elemii'iit provide for the
concept ual design and enviroutnetital evalizat ion of the Nat mimi Radioactive
Waste Repository planned to he constructed at Lyons, Kansas.
The fiscal year 1972 funding request for Engineering Field Tests (LOFT) is
$9.9 million, an increase of $i.S million over the current. liscal year 1971 estimate.
LOFT fuel fahricatiozm will be initiated in fiscal year 1072. LOFT analytical systems
PAGENO="0065"
61
dr~ign has br~r'n rP(Inced but incrPasp~ are necessary in test a'*emhly fabrication
fiul fabricat iøii at~(1 op'rat i()t1Z planning.
Th~ fiscal yar I ¶)72 funding rqiu~t for l~'actor Safety Ana1v~i~ and Evaluation
is $1. I ittillion, a (1(crea-e of $0. I ni illion below the current fiscal year 1971 (sti-
mat e. A siiiall comnputer art ivit y for the han(llin g of (lat a on safet y-reiat rd r(aCtor
charact erist i r- is .1 iii ng t rrniinat ed, as is tin lii gh Tenij erat tire ( as Reactor Pro-
graiti Office. A small iner(ase in funding is requested for the Nuclear Safety In-
formation Cent er.
The fiscal year 1072 request for Engineering Safety Feat tires is $6.5 million, a
decrease of $1 .~ million lalow the cnrrent~ fiscal year 1971 est iniat e. This activity
provi(les a jmrograiui for ifiV(St igat lOft an(l d(v(lopm(nt of (ff(ct ive engineered
safety feat tires to prevent major accidents and to control t heir consequences in
the unlikely event they should ocrur. i nder this 1)udget category, efforts in ``sepa-
rate effects'' testing to ~t tidy experiment ally the individual I)ll(noniena contri-
hi it in g to react or behavi or under accicl (fit cond it ions have been considerably
red iiced front ti-cal year 1971 levels. Analvt cal study of loss-of-coolant accidents
amid the standards program have al~o been reduced. The Containment Systems
experiment (CSE) has been t ermninat(d. Significant increases over fiscal year 1971
levels are planned in the st tidy of reactor system and containment structural
dynamic response to accident condit ions and in hO FT integral experiment Work
and radiological studies. \Vork is being completed and closed omit in experiments
on initiation of ductile pipe ruipt ire, in evaluation of existing data to describe
reactor accidents, and in spray and j)ool absorption technology. A new program t.o
st tidy blowdown heat transfer, cooperatively funded with indiust ry, is being mi-
tiated in fiscal year 1971 and will be coat mmd in `fiscal year 1972.
While the Nuclear Safety Program budget is organized on the basis of the five
categories previously described, the descript ion included in the record of this
hearing of the program is Provided with reference to l)artictilar applications, and
emphasis is placed on specific accomplishments during the past. year. The break-
down of the nuclear safety budget for F V 1972 according to these applications is
as follows:
DollarR in
rim illioni
Fast breeder reactor safety 11. 1
Light water reactor safety - 16. 4
Environmental effects 4. 0
high temp(ratmmre gas reactor safety 0. 5
Standards and codes 2. 6
Other 1.3
Total 359
(Subsequent. to these hearings, the committee submitted the follow-
ing (lu(~slions to the Commission for reply:)
Question: ll7ia( type of additional work Would be conducted in (he safety program
if (hi' funding 1mel wcre at the (llrision request znst('ad of the requesle(l S35.9' milliont
Reply: The nuclear safety ~)rograni, to stay within the ceiling of S35.9 million
has undergone serious project redmict ions. Since certain l)roject s req tuire increased
support, others must he reduced. If increased fuindiuig. were available, ((Torts
would be supplemented in hot h fast and t heriii:il reactor safety. Additional fast
reactor safety ((Tort would be undertaken as follows:
1. Acceleration of TREAT modifications to improve testing capability;
e.g., converter region.
2. Alternate shutdown system studies and experiments for LM FB R's.
.3. St mdv (if l)lault size effects on tM lB It potential safety issues.
4. Accelerated effort on Post accident heat removal studies and experiments.
Thermal iltactor Safety programs ~voimld be coiuiplemiteitted as follows:
I utiplenieuit at ion of additional l3lowdown I lent `l'raiisftr, euigineering
scale (xI)(rimnents' for loss of coolant accident studies applieal)le to P %% lt
SV$t(flis.
2. Increase of effort tfl(l acceleration of J3lowdo~vn I feat Transfer, engi-
neering seah~ experiuuients for loss of. coolant accident stu(lus ap~)lical)le to
lt\~lt Syst(fuis.
3. 1 )evelopmeuit of nit r'grated multidimensional couiiputer codes for analysis
of loss of coolant accidents.
4. Acceliration of the PBF program for early initiation of power coolant
mismatch and loss of coolant, experiments of irradiated fuel assemblies.
48-721 0 - 79 - 5
PAGENO="0066"
62
5. Acceleration of PWIt Sc1niscale testing of loss of coolant behavior and
emergency core coolant injction systems including experiment modifications
to re~olvc potential deuiciericics in 1CC coolant delivery.
6. Initiation of containment studies applicable to BWR pressure suppression
systems.
7. Exp(rim~ntal inve~tigation of fuel failure modes under simulated reactor
coolant hiowdown conditions. -
S. Performance of low flooding rate, atmospheric pressure tests in FLECILT
PW It geometry.
9. Increase the level of effort related to primary system integrity, specifically,
implementation of tasks on stress corrosion, pipe rupture studies, ll('ZtVy
Section Steel Technology program and stress indices for piping, pumps and
valves.
Question: Would you please provide a narrative explanation of the steadily increas-
ing operating cost.~ indicated in your 5-year projections from J!Y 1972 through FY 1977
for the nuclear sufty program?
Reply: These projections have the following basis:
1. Water reactors built, in the future will incorporate essentially present
day major design and engineering features.
2. Although base technology requirements are decreasi ii g, requirements
for engineering safety systems offset this to provide a near-terra overall
funding peak for water reactor safety. The water system safety program will
then phase down to a base level to keep pace with- evolving new technology.
3. The orderly reduction of wator reactor safety efforts will be paralleled
by an increasing emphasis of support on advanced reactors.
4. There will be a continuing ernj)hasis on support activities, including
work related to small radioactive spill problems, efforts on standards and
environmental R&l) in such areas as radioactive waste management and
thermal effects.
Part of the near-term water reactor safety funding peak can be attributed to
the current effort required to resolve uncertainties facing both reactor suppliers
and those charged with safety assessment for the ~urge of commercial reactor
business which occurred between 1965 and lOGS. It can be l)rediCte(1 that the
majority of the reactor safety qirestions will he answered for this reactor type
by the time most of these reactors have been granted operating licenses, which
i~ l)roiected to occur by 1975, if funding and other resources are made available.
In the near term, LOFT and PB F require extensive support from the operating
budget in the form of research and development to provide a basis for their
design, construction and operation, and to pay for expendable items such as
reactor cores and experimental components. Continued funding will be necessary
also for the development of safety technology associated with larger-sized water
reactors, new applications, higher power densities, reduced design margins, and
siting closer to high concentrations of population. It will also he necessary to
continue to l)rOvide a technological safety basis for the design, construction,
operation and nmaintenance of advanced light water reactor plants, and for their
safety assessment for regulatory purposes. -
Funding requirements for breeder reactor safety Lt&1) are expected to increase
significantly over the period of the next decade. Consistent with the establislimtiit
of the L~l 1'Blt as the highest priority program for achieving the breeder objective,
mo'~t of the projected funding is directly related to this advanced concept. It
should he noted, however, that the safety program will also benefit ot her advanced
reactor concepts. For example, some of the test facilities to be l)tLilt. for the
L M FB It program could be used for It& I) on of her advanced reactor concepts.
These projections in general are based on the ~vi(l(~l)rea(l use of the uranium-
1)1 it oni urn fuel cycle, and could be significant lv altered if in the future it ueeoi,ws
necessary from the standpoint of national interest to undertake an increased
pro~raIn for use of the t horium-uranium fuel cvtle.
`1 he funding ~)roject ion also provides for the continuation of modest R& I)
support on the effects of nuclear power on the environment. This work is even
more essential now in light of the national concern regarding t he environment.
Additional lt& I) on waste management techniques will be required. It is also
planned to increase efforts, in concert with other Federal agencies tird industry,
on t he control of the discharge of heated till tents from it ticlear po~~'(r plants and
the effect- of these discharges on t he tnvironmn(nt. This planned increase is con-
sistent with the recormimendation by the JCAE for an increased effort to provide
inforinat ion- to answer the questions related to environmental effect~s of nuclear
po~~er plant-s.
PAGENO="0067"
63
Question: C'ou!d you OlRo di.~cnss the rea.son.~ for the projected cOfl8trUCtiOfl cost
increa.se~ in the nuthezr .snfe(y program for FY 1973 through FY 1977?
lt(1)lv: `!`he l)rinlary reason for the increase relates to the safety test facility
and loops a~ shown below:
Safety test facility and loops: Millions
Fiscal year 1973 $12
Fiscal year 1974 55
Fiscal year 1975 20
This projection provides for design and construction of new facilities for the
conduct of LM FBIt safety experiments, should studies presently underway
indicate the need for such facilities. The most. important types of tests will be
those in which the experiment (one or more LMFBR-type fuel subassemblies)
is first. brought to full power, steady-state conditions and then exposed to an
overpower, transient, flow coastdown, flow blockage, or a comparatively slow
change in reactivity. Fast insertioas, either from low power or full power condi-
tions, also are to he considered and will place different, demands on the facilities.
Mr. JOHNSON. Mi. hansen, there is SOlile philosophy ~vithin various
quarters that HS reactors get developed and l)ecome CSttlbliSllC(1 and
useful, in(Iustry should 1)ick up more of the tal) for keeping on to the
safety program. It is a difficult thing t.o do act ually because, as
Mr. Shaw 51)1(1, it is not quite the same as testing an airplane. The
cost of the. airplane is hahl(lh'd by the manufacturing company and
FAA just goes out and (hecks it. and tests it.
In this case, we have to build special facilities. I think we are doing
about tl)e best we can to get tts much niOne3T as we can to keep the
program going. it is difli(Illt to get. more support. than that.
Dr. I\AVANAGII. We have been trying very har(I to get more funds
lot this juogmam. I think what you have stud in your question is
correct. r1lwr(~ ShoUld be more in it. We. are working to get. better
coopera (10!) in II~t)CtOI safety piogm ams.
This does not menu that out reactors ate not, safe. It. means that
we should be speH(ling niece to assure that th(W are safe, to gain added
assurance that they are safe and, as Mr. Shaw says, find it possible
to extend the operating limits and still maintain safety.
(Additional material from Mr. Shaw's prepared statement follows:)
FAST REACTOR SAFETY
VJ he main an as Of in~ stigition mu tlii fast iea tot `~if( tv program
are following the priol it los established in the national LMFBR pro-
gram plan, basically developed by detailed analysis of time LMFBR
accident sequence diagram, figure 101.
PAGENO="0068"
64
Attachment 3
UNITED STATES
NUCLEAR REGULATORY COMM$SSION
WASHINGTON. D. C. 20555
April 5, 1979
BOARD NOTIFICATION
Re: Cherokee 1-3 Docket No. 50-491-2-3
Diablo Canyon 1-2 Docket No. 50-275-323
FNP Docket No. 50-437
Greene County Docket No. 50-549
Jamesport 1-2 Docket No. 50-516-7
Marble Hill 1-2 Docket No. 50-546-7
McGuire 1-2 Docket No. 50-369-70
North Anna 1 Docket No. 50-338-9
Pebble Sorings 1-2 Docket No. 50-514-5
Perkins 1-3 uocket rio. 50-488-89-90
Pilgrim 2 Docket No. 50-471
Seabrook Docket No. 50-443-4
Shearon Harris 1-4 Docket No. 50-400-1-2-3
Sterling Docket No. 50-485
St. Lucie 2 Docket No. 50-389
Three Mile Island 2 Docket No. 50-320
Tyrone Docket No. 50-484
Wolf Creek Docket No. 50-482
WPPSS 4 Docket No. 50-513
Distribution:
Copies of a Board Notification dated April 5, 1979, have been served
on the following persons. Those whose addresses are at the U.S. Nuclear
Regulatory Commission have been served by the NRC internal mail system
and others have been served by deposit in the U.S. Mail. One copy has
been served on each person even though his or her name appears on more
than one service list. In addition to copies served on Atomic Safety
and Licensing Board and Atomic Safety and Licensing Appeal Board members
identified on the service list, 19 copies of the attachment have been
provided to the Atomic Safety and Licensing Board Panel, and 1 copy
of the attachment has been provided to the Atomic Safety and Licensing
Appeal Board Panel.
PAGENO="0069"
65
,~c7 WflTEO STATES
`~ NUCLEAR REGULATORY COMMISSION
~ ~ ~ WASHINGTON. D. C. 20555
SEP 2 5 t978
MEMORANDUM FOR: Milton J. Grossman, Hearing Division Director and
Chief Counsel, OELD
FROM: D. B. Vassallo, Assistant Director for Light Water
Reactors, Division of Project Management, NRR
SUBJECT: BOARD NOTIFICATION - SEMISCALE EXPERIMENT S-A7-6
(BN-78-17)
The enclosed staff memorandum discusses unanticipated results during
recent semiscale tests and I think is self-explanatory in terms of in-
formation available to date.
Although the memorandum recommends notifying Boards following the avail-
ability of additional information and a more detailed staff assessment,
I feel that the memorandum, as written, should be provided to appropriate
PWR Boards at this time. We will provide the additional information and
assessments as soon as they are available, but the enclosed memorandum
will serve the purpose of alerting Boards of a potential problem.
Our list of PWR cases before Boards in the service list time frame is as
follows:
Enclosure:
Memo, D. Ross-to D. Vassallo
dtd. 9/22/78 w/enclosures
cc w/enclosure:
See page 2
Cherokee 1-3
Diablo Canyon 1-2
FNP
Greene County
Jamesport 1-2
Marble Hill 1-2
McGuire 1-2
North Anna 1 St. Lucie 2
Pebble Springs 1-2 Three Mile Island 2
Perkins 1-3 Tyrone
Pilgrim 2 Wolf Creek
Seabrook WPPSS 4
Shearon Harris 1-4 Yellow Creek
Sterling
D~ B. Vassallo, Assistant Director
for Light Water Reactors
Division of Project Management
PAGENO="0070"
66
Milton J. Grossman SEP 2 5 ~
cc w/enclosure:
H. Denton
E. Case
J. Davis
R. Boyd
R. DeYoung
0. Eisenhut
1. Engelhardt
L. Nichols
B. Grimes
J. Stolz
R. Baer
0. Parr
S. Varga
IE (7)
0. Ross
R. Mattson
V. Stello
P. Check
T. Novak
Z. Rosztoczy
1. Murley
J. Scinto
~S. Hanauer
PAGENO="0071"
67
UNITED STATES
NUCLEAR REGULATORY COMMISSION
`~. ~~J) ~ WASHINGTON, D.C. 20555.
SEP 2.2 1978
MEMORANDUM FOR: D. B. Vassallo, Assistant Director for LWRs, DPM
FROM: 0. F. Ross, Jr., Assistant Director for Reactor Safety, DSS
SUBJECT: BOARD NOTIFICATION - RECENT SEMISCALE EXPERIMENT S-A7-6
Semiscale experiment Mod-3, S-A7-6 was run on September 12, 1978. It
was intended to model an Integral blowdown-refill-reflood scenario for a
double-ended cold-leg break. On September 21, 1978 INEL staff provided
for NRC a briefing of the results of the test.
Some of the results were unanticipated. For example, the heated core
simulator was projected (by Semiscale) to quench at 110 seconds. Instead,
it dried out again and went through several cycles of dryout and rewet
(see enclosed Figure 1). Other portions of the cladding temperature
showed similar discrepancies wherein test temperature4 were somewhat
below predicted (see Figure 2, 3). During the test the downcomer voided
several times in the time span 100-400 seconds. This was not predicted
(Figure 4 shows one such void).
During the periods of downcomer voiding there was also negative (downward)
flow from the heater to the lower plenum.
A quick-look report on this experiment will be published about Or.tober 1,
1978.
The significance to safety, in the sense of NRR Office Letter No. 19 is in
the phrase `whether this information could reasonably be regarded as putting
a new or different light upon an issue before Boards or as raising a new
issue. The information from the experiment is that nearly complete
downcomer voiding occurred after downcomer fill. This is not predicted
during EM-Appendix K applications. Also, typical Appendix K calculations
do not show successive dryout and rewets over the extended reflood cycle.
The present judgment by INEL is that'experimental atypicalities, in
particular in the stored heat in the downcomer pipe and in the 1-0
arrangement of the downcomer, have produced an atypical and unanticipated
result. In the coming weeks we and INEL intend to further study the issue
and find out ans~ers for the questioned experimental atypicality as w,~e1l
as the questioned failure of RELAP to have anticipated the result.
PAGENO="0072"
68
In my judgment, based on the INEL presentation, this experiment does not
put in a new or different light the concept of PWR bottom - flooding
FCCS- Neverth&Iess, it does require us to get more information from a
source external to the staff.. It is of sufficient importance to seek
further information, first from NRC contractors, and perhaps licensees
and vendors in due course.. In this event I conclude that it meets the
notification test. In NRR Office Letter 19, Enclosure 1, page 6-7,
I am supposed to provide you the following:
1. the item for notification;
2. considerations regarding relevancy and materiality;
3. statement on perceived significance; and,
4. relation to. projects.
1. The item
This memo and the figures show that an integral experiment intended
to simulate many of the PWR LOCA phenomena displayed several
unanticipated expulsions of water from the downcomer during what was
expected to be a tranquil reflood process.
2. Relevancy and Materiality
The experiment is relevant to all bottom-flooding PWRs. I
presently doubt that it is material due to perceived atypicality.
3. Significance
Current staff positions on this subject are through approval of
Appendix K models.
If we thought a new phenomenon was discovered, we would alter our
staff positions on those models. Until the atypicality issue and the
code predictability issue is better documented, we do not propose to
reopen PWR vendor model approvals. This position is interim, and
based on the expectation that the experiment is atypical and that
proof will be available in the order of weeks.
* 4. Relation ~t(Projects .
This relates to PWRs In general.
As far as documentation is concerned, I believe it is preferable to
distribute notification of theOctober 1 Quick-Look Report along with
a more detailed staff assessment of relevancy, materiality, and significance.
PAGENO="0073"
69
We could have this by October 15. If, however, more prompt notification
is needed, this memo should suffice.
D. F. Ross, Jr., Assistant Director
for Reactor Safety
Division of Systems Safety
Enclosures:
As stated
cc: R. Mattson
V. Stello
R. Boyd
0. Eisenhut
B. Grimes
P. Check
T. Novak
Z. Rosztoczy
T. Murley
J. Scinto
S. Hanauer
PAGENO="0074"
Figure I
"4
U
S
L
L
S
E
*
L
* S
4
S
I
COMPARISON OF ROD CLADDING TEMPERATURES AT CORE HIGH
POWER ZONE WITH RELAP4 FOR TEST S-A7-6
I 200
1 C100
600
S
(I
400
-100 0 100
200 300 400
500
Tim. A~4.r Rup4ur'. C...)
PAGENO="0075"
COMPARISON OF MEASURED AND CALCULATED CLADDING TEMPERATURE
IN UPPER PART OF CORE FOR TEST S-A7-6
La
L
0
L
S
S
E
S
I-
S
S
*
L
a
U)
-50 0 50 100 150 200 250 300 350 400 450 500
Time After Rupture Ce)
PAGENO="0076"
Fi9ure 2
I'
U
0
I.
~ :3Cu)
E.
I-
a
0
0
L
(a
COMPARISON OF MEASURED AND CALCULATED CLADDING TEMPERAUTRE
IN LOWER PART OF CORE FOR TEST S-A7-6
400
-50~ 8
50 1'30 150 .200. 250 300 350 400 450 500
~1 l~0
ieoo
900
700
500
Tim. Altar Rup~uv~. C.)
PAGENO="0077"
I'
F
U
C
0
d
)
S
`U
B
CALCULATED COLLAPSED DOWNCOMER LIQUID LEVEL FOR TEST S-A7-6
b
5
4
1
50 60 70 80 90 108 110 120 130 140 158 160 170 180 198 200
Tim. A14.r Rup~ur. C.~
PAGENO="0078"
74
Attachment 4
0R~L-NSIC-24
Contract No. W-74O5-eng-26
Nuclear Safety Information Center
E~RGENCY CORE-COOLING SYSTE~ FOR LIGHT-WATER-
COOLED POWER REkCTORS
C. G. Lawson
OCTOBER ~968
r7~
OAK RIDGE NATIONAL LABORATORY
Oak Ridge, Tennessee
operated by
UNION CARBIDE CORPORATION
for the
U.S. ATOMIC ENERGY CO~1ISSION
PAGENO="0079"
75
5. CONCLUSION AND RECO~NDATIONS
The emergency core-cooling systems of several boiling- and pressur-
ized-water reactors, were reviewed, the design basis and backup data were
examined, arid the reed for certain additional data was established. Gen-
erally, the design approach used by the manufacturers is conservative
~ihen evaluating the energy released or the cladding temperature. Occa-
sionally there is an absence of experimental data that is inconsistent
with the apparent sophistication of the calculational procedures.
The following conclusions and recommendations are made as a result
of this review.
5.1 Removal of Energy Sources
The emergency core-cooling system is an engineered safety feature
designed to prevent a core thermal runaway by removing fission decay and
stored energies and by preventing the release of potential energy in the
Zircaloy-steam reaction. Lack of control and removal of these energy
sources night lead to failure of the outer containment structure.
5.2 Damage to Core During Blowdown
The LOFT and the CSE programs are studying the blowdown of pressur-
ized- and boiling-water reactors in detail. The questions relating to
the mechanical integrity of the core and the piping have been defined and
many can be resolved by the designers. The effect of pipe rupture propa-
gation time and shock waves on the pressure loadings axially across the
core and radially across the core barrel should be determined for short
rupture times. The time to reach saturation pressure in the blowdown is
about 0.05 sec for a large pipe rupture. Therefore even a propagation
time of 0.01 sec is not considered an instantaneous break. Damage to
the core internals during the depressurization may adversely~ affect the
coolant distribution and core cooling during the blowdown and core re-
flooding process.
PAGENO="0080"
76
The transient heat transfer from the fuel to the cladding to the
coolant should be measured and understood for both pressurized- and boil-
ing-water reactors during the quasi-steady-state blowdown. The fuel cool-
ing rates during blowdowri can influence by at least 1 mm34 the minimum
time required for water addition to prevent fuel cladding melting and/or
excessive metal-water reaction. Core damage that wou.ld influence cooling
rates should be prevented.
The LOFT and CSE programs are studying the amount of water remaining
in the pressure vessel and high-pressure system after blowdown, since the
water left in the reactor vessel affects both the tine to reflood the
core and the potential extent of the Zircaloy-steam reaction. Tests of
the amount of water left in the vessel after blowdown have been extended
to include determinations of the effect of core internals and the external
piping on the amount of water left, since they may act as entrainment
separators.
There are many computer programs and physical models available for
calculating blowdowrx-pressure transients and water inventory. These com-
putational methods are being tested by the LOFT and CSE programs. This
effort should continue, since all these computer programs need normaliza-
tion to data. Much time would be saved if the competence of the individu-
als from diverse organizations working on this effort was grouped to form
a common source of information. Battelle Memorial Institute has recently
initiated such a program at the suggestion of ORNL.
5.3 Spray Cooling of Core
_Additional work is required to assure the reliability and effective-
ness of spray cooling systems for the high specific power cores currently
being designed, particularly for temperatures in the range 2000 to 2500°F.
Extensive work by Phillips Petroleum Company is planned on Zircaloy rod
bundles.
The data published by General Electric Company on the effectiveness
of spraying 6 x 6 and 7 x 7 arrays of full-size stainless steel-clad fuel
assemblies were obtained under conditIons where the hottest fuel rod was
assumed initially to be at 1800°F (representing some time after blowdown).
PAGENO="0081"
77
However, in their Browns Ferry reactor, for example, the calculated ther-
mal condition of the core fuel rods 30 sec after the break when spraying
was initiated would be as follows:
Temperature
°F
Hot spot 1177 2150
l0~ of cladding >948 >1740
25% of cladding >816 >1500
50% of cladding >635 >1175
Some of the core would be at temperatures in the region where the metal-
water reaction* rate between Zircaloy and steam becomes significant. The
experimental data clearly need to be extended to the temperatures of the
accident.
Temperature distributions representing the consequences of moderate
delays in initiation of emergency cooling should be simulated in some
spray tests. Forced- and natural-convection heat transfer between steam
and high-temperature Zircaloy should be measured and analyzed.
The gas pressure inside the fuel rods should be controlled at levels
representative of reactor fuel to get a proper measure of the nature of
the cladding failure as the blowdown occurs. The possibility that swell-
ing of the cladding may cause blockage of the flow channel should be
eliminated if gross swelling occurs. The relationship between the amount
of steam-Zircaloy reaction and gas embrittlement should be determined.
The condition leading to rod fragmentation upon quenching from high tem-
peratures should be determined so that it can be avoided.
The possibilities of water-hammer formation by rapid addition of
water to hot Zircaloy should be eliminated. The spray system relies on
wetting the inside and outside of the fuel channel shroud and thereby pre-
senting a radiation sink for the heat from the fuel rods. The Japanese
and British data on the sputtering phenomenon, as well as the American
work by General Nuclear Engineering Corporation on flooding of hot metal
surfaces, show clearly that'the time required for cooling and wetting a
hot surface increases rapidly with increases in surface-to-steam tempera-
ture differences and decreases with system pressure. This influences the
48-721 0 - 79 - 6
PAGENO="0082"
78
lag time for rewetting the wall and fuel rods and* requires that the rods
be cooled by both thermal radiation to steam and steam convection until
the walls are wetted. Tests should be~r~m with hot fuel assemblies cooled
by water -at the temperature and pressure of the containment and pressure
vessel environments following the accident and at heat fluxes correspond-
ing to the newer BWR fuel designs.
5.4 Flooding or Immersion Cooliflg
The pressurized- and boiling-water reactors are cooled by a rising
flood of water as an emergency coolant. The. flooding systems are useful
because they provide a uniform distribution of coolant. Current work at
Phillips Petroleum Company at Idaho Falls in the FLECHT and SECHT programs
is investigating the cooling characteristics of such systems. This work
should be extended to parallel channels at different temperatures to as-
sure that hot-channel starvation of coolant does not occur in shrouded
channels.
The effects of boiling in open channels should be determine~4 at
cladding temperatures above 2200°F, since this may alter the required
liquid level in the pressure vessel for adequate cooling in the postblow-
down situation.
The use of the pressurized-water tanks on pressurized-water reactors
is a practical solution to adding a large quantity of water to the core
rapidly. The accumulators relieve the need of emergency core-cooling
systems for almost-immediate pump power. These tanks should be desi~~
so that the pressurized gas~ from the accumulator does not drive the water
from the core after the initial injection.
Design efforts should cont~p~e on both FaRT s and BWR' a to decrease
the response time of emergency core-cooling systems, since this may one
day be the limiting factor on fuel specific power or on power density.
5.5 Structural Integrity of Core During He~~p
Some reactors still use stainless steel cladding on control plates
and followers inside the hot region of the core. Since stainless steel
PAGENO="0083"
79
and Zircaloy react at temperatures below the melting point of stainless
steel, this reaction should be ecolored to make certain it does not inter-
fere with core cooling.
5.6 Structural Integrity of Vessel
The time required1'2 in a large-rupture loss-of-coolant accident for
fuel that is unquenched to melt through the reactor vessel and possibly
breach the outer containment vessel has been estimated at 1/2 to 1 hr.
Therefore, a design and experimental effort should be initiated to arrive
at a method of containing or stopping a vessel melt-through before the
containment is breached in the event of the worst case of an inoperative
emergency cooling system.
5.7 General Performance and Standards
The current reactor emergency core-cooling systems that reflood part
of the core within 30 sec after a major break or which start adding cool-
ant by spray distribution before the blowdown is complete appear capable
of quenching the core and preventing a thermal runaway accident in which
the core night melt down and penetrate the reactor vessel and containment
shell. The emergency cooling system is an engineered safety feature of
prime importance under some accident conditions in protecting the contain-
nent shell and controlling the radioactivity release from the fuel. Suf-
ficient data should be obtained with heated Zircaloy-clad uranium dioxide
fuel rods and water-steam mixtures to establish the physical phenomena
that occur at temperature levels between 2000°F and the melting point of
Zircaloy. Si~ificant cladding swelling and cracking occur at tempera-
tures from 1200 and 1SOO°F in all water-cooled reactors. The effect of
these failures, if any, on flow channel blockage or flow distribution is
not known.
Rapid activation of the emergency cooling system and long-term opera-
tion are the most urgent requirements in the event of a large-~cale pri-
nary cooling system break. Therefore a continuing effort should be made
to develop more rapidly acting systems with even better reliability than
PAGENO="0084"
80
systems currently being designed. To this end, systens tests that deter-
mine the effectiveness of the hardware acting in concert should be p~
formed in environments designed to simulate an accident situation. There
is no other certain demonstration of adequacy. These tests should be
performed on a prototype of large scale. The revised LOFT programs21
~y satis~ this need. The ability to predict system performance analy~
cally could demonstrate an adequate level of understanding~ Consideration
of the improbable accidents (sabotage, earthquakes, falling airplanes,
etc.) and the potential plant damage requires complete redundancy and pro-
tection of cooling systems in order to assure a working coolant-injection
system in all circumstances.
Finally, the emergency provisions for a loss-of-coolant accident
should be examined to determine that the provisions themselves do not
create hazards. Specifically, the BWR automatic-relief system and the
gas in the F~R water storage tanks could both wors~ the situation by
ejecting coolant from the core needlessly under certain circumstances.
5.~ ~ystem Tests
The accidents discussed in this report all lead to temperature, pres-
sure, and humidity environments far different than those normally prevail-
ing. Tests on the emergency cooling equipment for each reactor should
be perforrre~~ed to supply assurance that hardware meets appropriate specifi-
cations and can survive and perform in accident situations and the result-
ing environments. Separate tests to (1) demonstratq hardware reliability
and (2) system effectiveness may be sufficient. These are different from
the prototype tests.
Maintenance and retesting of the emergency cooling system hardware,
including power supplies,~__uld~~r0ut].fle and sufficiently frequent to
assure availability on demand.57 Results of tests of emergency cooling
systems for operating reactors show that emergency power supply avail-
ability can be irrrprovedby more thorough preventive naintenance~18
Frequent and routine tests of the availability of emergency equip-
ment, such as are proposed in the preliminary design reports, shou3~4~
carried out. The results of ;these tests should supply data that~~~
PAGENO="0085"
81
demonstrate the availability of equipment and the reliability to perform
as designed by comparison with data obtained from the protot~e tests
proposed in Section 5.7.
5.9 Design Irriorovements
Efforts to improve the emergency cooling systems should be continued
by design studies for reactors with higher specific power and flatter
power distribution. Emergency cooling systems are designed to control
the thermal and radioactive energy release from the fuel, limit the damage
to the reactor complex, including the containment shells, and thereby
help protect the public from gross exposure to radioactivity in the event
of a primary coolant rupture and loss of power. The reactor operating
variables of fuel specific power, plant thermal output, and to a lesser
extent fuel burnup strongly influence economics as well as the emergency
coolir.g system design requirements. The factors that improve economics
also increase the demand on the cooling system pumps and power supply
through increased demands on the time-to-startup margin and flow rates.
The design studies would clari~ specific future needs for the nuclear
industry and the AEC.
The trend toward power flattening within the core of the next gen-
eration of water-cooled reactors requires more detailed knowledge of the
water-steam-Zircaloy interaction to assess the details of the loss-of-
coolant accident. An effort should be started soon to estimate the re-
lationship between the power distribution within a large core, the maxi-
mum design cladding temperature in the postaccident situation, and the
emergency cooling system design requirements in order to assess accurately
the adequacy of the no-cladding-melting criteria or other criteria that
may be suggested.
5.10 Priorities
All the items dicussed above are of prime importance in assessing
the safety of a reactor plant. In establishing priorities among the ite~
for effort it is clear that those items that relate to future-generation
plants or to plant maintenance may be given a lower priority than cther
items. Hoyever, all the questions should be answered before the newer
~ have oDerated any appreciable time. No actu~ priorities may
therefore be stated.
PAGENO="0086"
82
Mr. MCCORMACK. Thank you, Dr. Kepford.
I want to remind the members that we are going to observe the
5-minute rule. I shall try to observe it as well as anyone, and ask
all other members to do so, too.
I would like to direct my first question to Dr. Levenson, and to
ask him-you said we have been unable to identify any new phe-
nomena uncovered by the accident. Would that include the produc-
tion of hydrogen in the reactor vessel itself?
Dr. LEVENSON. Yes; I think that is correct. The matter of the
temperatures at which zironium or its alloys, such as zircoloy,
react with water to produce hydrogen is a well-established phenom-
enon.
The rates of reaction and the actual temperatures have been
measured in the laboratories many times. The basic design of emer-
gency core cooling systems is to keep zironium metal below the
temperature at which such a metal-water reaction occurs.
If you exceed that temperature, the reaction will occur. It is not
a new phenomenon.
Mr. MCCORMACK. Dr. Dietrich, I believe it was you who men-
tioned the necessity to be able to remove inert gases from the
reactor. Would this be easily accomplished with existing power-
plants? When they go down, could this be handled, to provide some
method for venting reactors?
Dr. DIETRICH. I think it would be a fairly straightforward engi-
neering job to do this, if one were interested only in the venting.
But as I mentioned in my testimony, one has to give careful consid-
eration to such changes. For example, it is another path for radio-
activity to come from the primary system into the containment
building. It is also another potential leakage path.
Mr. MCCORMACK. What you are saying is it could be done?
Dr. DIETRICH. Absolutely, and it will be done, but I am only
saying that we should not go out and say, OK, we are going to do it
today, without giving it careful consideration and looking at the
design--
Mr. MCCORMACK. Any exhaust system would have to provide for
the removal of fission product gases, traps, and scrubbers and so
on.
Dr. DIETRICH. Right.
Mr. MCCORMACK. You also mentioned on page 2:
To make less difficult demands on the operator and to be more forgiving of
operator errors through minimization of the frequency of occurrence and speed of
development of operation of pertUrbations with potential for hazard.
Are you sUggesting that we should be building C-47's instead of
P-51's here? In other words, are you saying that the plants are too
hot to handle; that is, in the sense of being too hypersensitive to
transients, and too fast for the operators to respond?
Dr. DIETRICH. No. But I think there are things that can be done.
For example, I think the fact that the pressurizer appeared to be
going solid, as they say, had a great deal to do with the Three Mile
Island accident.
Maybe we need a somewhat larger pressurizer, so its volume is
larger relative to the capacity of the primary system, so that it is
not quite so sensitive. Or maybe we need a bigger inventory of
PAGENO="0087"
83
water in the secondary system, so that if the feed pumps go off, one
is not immediately faced with the steam generators going dry.
Mr. MCCORMACK. OK. Very quickly--
Dr. DIETRICH. It is engineering I am talking about.
Mr. MCCORMACK. Let me ask you a couple of quick questions..
It would be relatively simple, wouldn't it, to install valve indica-
tors on critical valves to tell what the valve is doing, as well as
what it should be doing?
Dr. DIETRICH. I believe it would be relatively simple in principle.
To actually go into the plant and do it would certainly take some
time.
Mr. MCCORMACK~ Would it be your belief that we should go back
and look at the design of some of the valves we have been taking
from the shelf, and been using, such as pressure release valves, and
explore their design, so that they could be made much more reli-
able?
Dr. DIETRICH. It is possible. I don't consider myself an expert on
valves, but some of the things that we do in the name of safety
perhaps haven't been as well thought through as they might be.
For example, now, the valve that stuck was the relief valve,
whose purpose is really to keep the safety valve from opening.
Since the safety valves are put on there, it is always a possibility
that--
Mr. MCCORMACK. But the release valve didn't close when it
should.
Dr. DIETRICH. That is right. What I am saying is if the safety
valve sticks open, there is no way to turn it off. There is no block
valve. You are not allowed to put a block valve in because of the
pressure codes.
Mr. MCCORMACK. Wouldn't design and procedures allow you to
have a control on the control panel that said open the valve, the
valve is open, close the valve, the valve is closed?
Dr. DIETRICH. Oh, yes.
Mr. MCCORMACK. OK. I don't have any more time. I have some
more questions later on.
Mr. Goldwater?
Mr. GOLDWATER. Mr. Dietrich, I wonder if you could elaborate on
a statement you made in your testimony, and I would be interested
in Dr. Kepford's analysis of that elaboration. It is on the first page.
You say, "While the specific accident sequence was unforeseen,
the engineered safeguards used were successful in protecting the
public."
Dr. DIETRICH. Yes.
Mr. GOLDWATER. What do you mean by that?
Dr. DIETRICH. Well, very little radiation got out. One of the
safeguards is the containment building. If you hadn't had that
building there, you would really have been in bad shape. Eventual-
ly they did use the safety injection pumps to put water into the
reactor. They are part of the engineered safeguards, also.
If they had not been there, or if they had failed to operate, you
couldn't have recovered from the accident. These are the sorts of
things I mean. The equipment was there. When it was turned on it
worked.
PAGENO="0088"
84
Mr. GOLDWATER. Dr. Kepford, your allegation is that nothing
worked.
Dr. KEPFORD. No; I didn't say that at all. I think probably much
of the equipment worked as well as could be expected considering
the designs and layout of the control room, and so on.
With regard to radioactive releases, from what I have been told
by officials in State government, dozens of curies of radioactive
iodine-131 were released, and millions of curies of noble gases.
This was a very major release of radioactivity. It was, I am sad to
say, largely unmonitored. The largest releases of radiation went
unnoticed.
At 7:30 Wednesday morning-the director of the Bureau of Radi-
ological Health for the Commonwealth of Pennsylvania, Mr.
Thomas Gerusky, told a public meeting in Newberrytown, Pa., a
couple of weeks ago-the projected dose rate in Goldsboro was 10
roentgens per hour.
Now, the wind was heading right toward Goldsboro, from the
plant. It is a very small town, a few hundred people, due west of
Three Mile Island. Whether or not that dose ever got there, I don't
know, but it certainly doesn't show up in any of the calculations or
estimations of doses which have been released.
There was the release of gases March 30, Friday morning,
headed off in the direction of Hershey, Pa. The dose rates were on
the order of 100 millirems per hour projected.
But again, the .monitoring was so bad that nobody was available
to find out. When you look, for instance, between Three Mile
Island unit 2 and that compass sector which includes Lancaster,
Pa., one of the nearest large population centers, there wasn't a
single radiation monitor, and so on.
So when people come by and say nobody was hurt from this
accident and nobody was injured and the population exposures
were very low, I think they are doing one of two things. They are
either being very dishonest or they are relying on hopelessly in-
competent monitoring. I don't think there is much of an excuse for
either.
Mr. GOLDWATER. Dr. Levenson, as chairman of the Ad Hoc Indus-
try Advisory Group that looked at this accident, do you have any
comments?
Dr. LEVENSON. Our role did not include the health and safety
monitoring, but I would comment in the context of Dr. Kepford's
original statement that what is calculated is perhaps less reliable
than what is experimental.
There were a lot of calculations made on projected doses, assum-~
ing both a level of release and a level of catastrophe that never
occurred. We were directly involved only to the extent of monitor-
ing at the site and close in to the plant as it affected the recovery
operations.
Since nothing within orders of magnitude of this level was pres-
ent at the plantsite, it is difficult to see how it could have been
present miles away.
Regarding the question of what is adequate monitoring, with
hindsight, like with most things, you never have enough data. But
I think that in the data that exists, which came from multiple
groups-there was not just one group doing monitoring-there is
PAGENO="0089"
85
indeed a very large discrepancy between what has been measured
and what some people projected there might be. But this is not my
field.
Mr. MCCORMACK. Mr. Goldwater's time is up. It is Mr. Lujan's
turn.
Mr. DORNAN. I wanted to ask a question out of sequence. I have
some gasoline shortage experts in my office. We have two crises on
each coast. But this is much more serious. I wanted to ask a
followup question of Dr. Levenson, with a slight prolog.
Those of us who believe in nuclear energy, if we ever underesti-
mate the impact on the public of the statements of Mr. Tom
Hayden, his wife Jane Fonda, or the Dick Cavetts of the world, the
Ralph Naders, we are making a big, big mistake to underestimate
the impact they are having on the people.
Last night on television, on the Cavett show, Ralph Nader said
he was just a little shocked about the timing of the Three Mile
Island, that it was inevitable, that he expected a major accident to
come closer to the year 2000.
But that given the inevitability of the growth of nuclear plants
and the numbers involved, that it is just a matter of time and that
he thinks the Three Mile Island incident is just that, an incident,
and the major castastrophe is just to come.
The compelling part of his argument to the average American is
there has not been a technological development anywhere where
there has not been a catastrophe. For instance, the British Cunard
lines built the unsinkable Titanic, and it goes down on its maiden
voyage.
As a pilot, when I first saw the 747's, DC-10's, and lOll's take to
the air, I thought, I wonder if we really have safety systems built
in in such a way that there will never be an accident. But a
Lockheed 1011 flies into the ground outside of Miami-pilot error.
A DC-b loses a door off the rear over France, with a loss of life
of over 340 people. Finally, a 747-I am not talking about terror-
ists, deliberate destruction-but a 747 crashes in Africa, killing a
massive amount of people.
Now, Dr. Levenson, in the area of probability, if we weather this
storm and nuclear plants continue to grow-and I am supporting
them at this point-is Ralph Nader predicting, within the realm of
probability, correctly when he says there eventually will be, just by
the law of averages, a serious meltdown and a great loss of life?
This is disregarding the gentleman's figures on page 12, Dr.
Kepford, that he believes hundreds, maybe thousands, will die
already because of Three Mile Island.
Could you please project your thinking into the future, on the
law of probability?
Dr. LEVENSON. Well, I am not an expert on the law of probabil-
ity, and even less of an expert on public opinion, and how it is
influenced. Fairly clearly it is not influenced by technical facts
very much.
The matter of the type of accident and its consequences is basi-
cally about what we are talking. Incidentally, I disagree with Mr.
Nader. Three Mile Island was not merely an incident, it was an
accident. Anybody trying to say it wasn't an accident is playing
games with words.
PAGENO="0090"
86
It was an accident, and it was a pretty serious accident. It was
not catastrophic to public health. Most of the catastrophic acci-
dents are invented by computers. They are not the result of any
experimental or factual evidence.
As early as 1953, back in the early days of the AEC, reactors
were pushed to destruction in Idaho; in the so-called Borax experi-
ments, where reactors were actually destroyed to get evidence
about what happens.
We have a very large amount of evidence from, reactor melt-
downs. The first breeder reactor in this country, EBR-1, had a
meltdown that destroyed two-thirds of its core. The SL-1, the first
military so-called hotrod type of reactor, that resulted in the death
of three men represented a destruction by meltdown and vaporiza-
tion of a significant fraction of the core.
There was also the Fermi reactor. A large number of military
accidents have occurred, including bombers, which were carrying
plutonium warheads which crashed, where the plane went up in
fire and everything else with it.
There have been many classified experiments in Nevada in the
weapons program. A very large discrepancy exists between the
theoretical projections of catastrophe and what the experimental
evidence indicates.
The probability is such that eventually there will be more acci-
dents and that some will be more serious than Three Mile Island.
You must compare, from the total public risk standpoint, the
number of people killed by various sources of generating electric-
ity. It must be on this basis-you cannot say if nuclear power kills
100 people once every 5 years, we don't want it, if the alternatives
kill 10 times that many people.
It is comparative risk analysis that is conspicuously absent in the
statements that you have quoted.
There probably will never be an accident absolutely identical to
Three Mile Island. Probably there will be some similar accidents,
and there probably will be some even more severe. I just don't
think there will be any that we could truly call a major
catastrophe.
If you want to use your analogy of aircraft, we have yet to worry
about either a DC-10 or a 747 reaching escape velocity and taking
its passengers out into deep space. Equally improbable questions
are being asked about nuclear power.
Mr. MCCORMACK. Will the gentleman yield?
I think there is one portion of the question and answer that
needs just one additional bit of clarification. I would like to ask Mr.
Levenson to answer it; that is, it is not necessary that anyone be
harmed in the event of a meltdown.
One could have a meltdown without harming anybody, even
inside a plant. You can have a complete meltdown and no one will
be harmed inside a plant, is that correct?
Dr. LEVENSON. That is correct. We have already had a number of
experimental and accidental meltdowns. The function of the con-
tainment building and all of the auxiliary systems that are in it is
to handle such meltdowns-the recombiners dispose of hydrogen if
it is generated, et cetera.
PAGENO="0091"
87
There isn't any indication from factual experience that even a
meltdown automatically leads to the catastrophic consequences
that is talked about.
Mr. MCCORMACK. Thank you.
Now, did the gentleman from New Mexico wish to yield any
more time to the gentleman from California?
Mr. GOLDWATER. I will yield the full 5 minutes to the gentleman
from New Mexico.
Mr. LUJAN. I thank the gentleman. I don't think I need 5 min-
utes. Looking over all of the testimony, it seems to indicate, except
for Dr. Kepford's, that we ought to concentrate on stopping the
small accidents, and that if we do that, that the big accidents will
take care of themselves.
Maybe not quite as simple as that, but that the priority ought to
be on those small accidents.
Would you care to enlarge on that? Have I gathered at least the
feeling of what the testimony was about? Any of you?
Mr. KENNEDY. The answer to your question is yes. The large
accident has been pretty thoroughly studied. I personally believe
that if one builds a reliable powerplant, it will also be a safe
powerplant. That doesn't mean the thing should be ignored, but we
spend a tremendous amount of time on the very large accident and
not enough on the reliability.
Mr. LUJAN. The sequence of events at Three Mile Island shows
that within 3 hours, at a time somewhere about 2¾ hours, some-
thing like that, there were some 50 or. 60 people running around
inside the control room.
It leads one to believe that there was just utter confusion in that
control room. Maybe my interpretation of it is a little exaggerated,
but if that were the case-I have been in that control room-there
were just about a dozen of us there at the time, and it certainly
was crowded.
Because accidents happen with some frequency, is there any
group, like a SWAT team of some kind, some group that is put
together from laboratories, from industry, from wherever it may
be, that can come in, a~d take control of a dangerous situation, and
bring it under control?
Is there anything like that? If there isn't, should there be some-
thing like police SWAT teams to respond to those situations?
Dr. DIETRICH. I can say that as far. as my company is concerned
we have set up teams of this sort since Three Mile Island. So we
have taken action on something we learned. But of course there is
no way that we can set it up to use people other than our own.
But they are very knowledgeable people. These teams include
people who have been our representatives during startup of plants
and that sort of thing.
So that they are not by any means just theoretical people. They
are people who know how to press the buttons and work the valves.
Mr. LUJAN. These are trained only in your type of reactors. In
other words, they would have no knowledge about reactors de-
signed and built by somebody else.
Dr. DIETRICH. I think they would be helpful, but of course it
would probably be more effective if each manufacturer--
PAGENO="0092"
88
Mr. LUJAN. How would each company feel separately about
standardization? It just seems to me-I am not an engineer-that if
we had standardized design and construction of plants, that it
would make it so much easier.
Now, would you submit to a group type of design and construc-
tion, or do you think yours is that much better, that maybe you
wouldn't want to be dropped into a standardized group?
Dr. DIETRICH. Well, I am not really sure how one might imple-
ment such a thing.
Mr. LUJAN. You design a powerplant, you say this is really the
way a powerplant ought to be, this is the standard model, it will
have all of the things that you have been talking about, it is
earthquake resistant, the valves are good, the pumps are good, all
of the different components are good.
Therefore, this is the plant that we would build. All we have to
do is the foundations, build them up.
Dr. DIETRICH. I think that is essentially what I was speaking of
in the program that we were recommending. But I did not say to
come up with a single design.
Mr. LUJAN. Why not?
Dr. DIETRICH. Because I just don't know how to do it. I mean, I
don't know how to implement it. Now, I am not saying there is not
a way of doing it. It is just not my field. It would get pretty
complicated on things like antitrust.
Mr. LUJAN. On the contrary, it seems to me-even though my
time is up-that on the contrary, it would make it so much easier.
Here is my powerplant, you go to the NRC, they say, yes, we know
all about this plant, and they give you a license.
Dr. DIETRICH. I cannot really speak for my company. I would
guess my company would certainly participate in such a thing, if
there were such a thing.
Mr. MCCORMACK. I thank the gentleman from New Mexico.
The gentleman from Pennsylvania, Mr. Walker.
Mr. WALKER. Thank you, Mr. Chairman.
I have questions of a couple of people. So I hope maybe they can
be as brief as possible with their answers.
Mr. Levenson, in your testimony, I kind of read between the
lines that you are saying that perhaps the regulators and the
regulated have gotten a little too cozy on this business of watchful-
ness over plant design and public safety.
Is that a fair assumption that I have drawn from what you had
to say?
Dr. LEVENSON. No; I don't think there is a coziness at all. What ~I
am saying is that the people applying for licenses are reacting to
the pressures from the regulators, and that if everybody is preoccu-
pied with the wrong thing, it doesn't matter how cozy or how
antagonistic they are, you don't address the really significant
questions.
Mr. WALKER. When you took a look at the situation at Three
Mile Island, did it occur to you that perhaps there was kind of cozy
relationship, in the initial licensing procedure, the initial proce-
dure that brought it on line, to come in under the December 31
date for licensing?
PAGENO="0093"
89
Dr. LEVENSON. I have reviewed none of the records and none of
the proceedings or testimony for the licensing, so I cannot com-
ment on that.
Mr. WALKER. OK.
You make a statement here in your remarks that the confirma-
tory message of Three Mile Island is that we must go back and
assure ourselves that we are doing everything that is practicable to
reduce the risk to the public and to the plant.
I am particularly interested in the public. What is the nuclear
industry doing now that Met Ed wants to dump that radioactive
waste water into the Susquehanna River? Wouldn't it be wise for
the industry to be coming down on the side of doing their very best
to protect the public in this aftermath of Three Mile Island?
Dr. LEVENSON. I am not aware of any proposal to dump radioac-
tive water into the river. I think there is a proposal that after the
water has been decontaminated, that the cleaned up water be
dumped into the river.
That is quite different than dumping the radioactive water.
Mr. WALKER. It will still have low levels of radioactivity in it,
wouldn't it?
Dr. LEVENSON. Everything in the world is radioactive. I have
been involved in many cases where the problems were that radioac-
tivity in river water that we pumped out for cooling water was
greater than the allowable standards to put it back into the river.
One has to ask how radioactive, what are the standards.
I don't know of any request for an exemption from what are
considered acceptable standards.
Mr. WALKER. I say to you that the public up there is extremely
concerned about dumping that water, and whether or not it meets
specific tests and so on. I think the industry, if they are really
concerned about the risk to the public over the long term, ought to
look into that.
Dr. Kepford, I would like to follow up on a couple of statements
you made as well. You made the statement that you felt that the
NRC lied along the way on this. Do you include Dr. Denton's
statements in the fact that NRC was lying to the people of the
area?
Dr. KEPFORD. I don't know which particular statements you are
referring to.
Mr. WALKER. Well, in general I think the public accepted much
of what Dr. Denton had to say. Was he lying along the way?
Dr. KEPFORD. I don't believe so.
Mr. WALKER. OK. Fine.
You are making the point that the monitoring of the radiatiOn
was not very good.
Dr. KEPFORD. It was abominable.
Mr. WALKER. I think you said radiation monitors only went out
13 miles.
Dr. KEPF0RD. The NRC's only went out 13.8 miles, that is correct.
Mr. WALKER. I am a little bit confused, then. The studies on
which all the calculations have been made on sites that go out as
far as Reading, which is considerably further out than 13 miles.
PAGENO="0094"
90
Now, all of the studies, all the health effects are out at least that
far, Reading, Carlisle, all of the areas had dosimetry monitoring in
them.
Are you saying that--
Dr. KEPFORD. They are not mentioned in the reports that I have
seen.
Mr. WALKER. They are part of the health effects study. That is
the NRC study-which says that only one or two people will die as
a result-of TMI. Those were the dosimetry sites that they used.
That is in direct contrast to your statement here that hundreds
and thousands are going to die.
I mean, these are my neighbors we are talking about.
Dr. KEPF0RD. I am aware~ of that.~ This is the report that I am
talking about. You can have it if you. want. But measured radiation
readings, elevated readings in Reading are not mentioned.
Mr. WALKER. I am talking about the Population Dose and Health
Impact of the Accident at Three Mile Island nuclear station.
Dr. KEPFORD. May 10?
Mr. WALKER. Yes. The dosimetry sites in there include Lebanon,
Reading, Lancaster, Harrisburg, Carlisle, York, and so on, most of
which are further out than 13 miles.
Dr. KEPFORD. Where are you reading this?
Mr. WALKER. I am back on page 20, where I have the location of
the dosimetry sites. It is my understanding that all of those sites
were used as a part of the data base.
Dr. KEPF0RD. On that map, the only sites that have dosimeters
on, for instance, near Harrisburg, 15-G-1, is a dosimeter site.
There is one south toward Lancaster, but only about 14 miles from
the plant. That is 7-G--1. Closer in is 7-F--i. South of York is 9-G-
1. I think those are the only dosimeter sites there.
Mr. WALKER. I was under the impression that the sites also
marked at Reading, Lancaster, and so on are also dosimeter sites.
Dr. KEPFORD. I am sorry. I was unaware of that.
Mr. WALKER. That is my impression. I will have to go back and
check it. That was my impression of the data.
Dr. KEPFORD. The data in here that I have looked at has only
been the NRC data. The Met Ed data has been too scattered for me
to do anything with.
But in a lot of directions, as you go away from that plant, the
dose does not fall off with distance. In fact, in some cases it in-
creases with distance. This, in my mind, tells me that neither NRC
nor Met Ed had the slightest understanding of what the weather
conditions were like, first off, in the lower Susquehanna River
valley and secondly in that first week of the accident; that is, there
was a relatively static air mass over that area, and the radioactive
materials that were released simply did not normally form a plume
and dissipate and blow over to somewhere else like they normally
do.
They were held down by a temperature inversion and slid up and
down the Susquehanna River, and off into the surrounding commu-
nities.
Mr. WALKER. I was out and did a little bit of the monitoring with
them when I was on the site. I know they went down river with
portable monitors a good deal further than what would be indicat-
PAGENO="0095"
91
ed as close in monitoring because I was along when they were
doing some of that.
I assume some of that data got in. If I could, Mr. Chairman, just
one last question.
The thing that disturbs me is that you use the figure hundreds
and maybe thousands, that you believe are going to die. Those are
the kinds of things that make good print in newspaper articles and
so on, those kinds of figures.
Yet you are, it seems to me, a little bit guilty of the same thing
you are accusing the industry of being. You say you can't quantify
the number. Yet you come back and say the main problem with
the industry is the fact that the industry doesn't have exact experi-
ments to show what is going to happen.
When you use figures, it seems to me you are using them for
political kinds of purposes.
Dr. KEPFORD. This again, Congressman Walker, was another ex-
periment that was carried out on human beings, where nobody was
around to collect the data. It is not my responsibility to collect the
data. The NRC and Met Ed and those responsible are supposed to
be doing that.
What I was saying was that their treatment of the data in my
opinion, the NRC data, is dishonest. That is what I am saying. I did
a very quick estimation. It could be high, it could be low by a factor
of two on the person rem exposure.
In here they quote 3,500. I came up with 57,000. That is quite a
difference. That suggests to me that the data was simply handled
wrong.
I would be very glad to go over this with you in person, or go
over it here, what I did with the data.
Mr. WALKER. But the fact remains that your testimony says, "I
cannot quantify the number exactly, but I have reason to believe
that the number may be in the hundreds or in the thousands."
What I am saying to you is that is exactly the same thing
that--
Dr. KEPFORD. Can I go on. This is based partly on the statement
of others, including none other than Karl Z. Morgan, who is well
known, I am sure, to members of this committee, who stated at the
Village Voice teach-in a week ago Saturday that he believed some-
where between 60 and 120 people, I believe, would die from this
accident.
Mr. MCCORMACK. I think we are going to have to terminate this
part of the testimony here, Dr. Kepford. Our time is up on it. We
are going to have to get on to the next panel because we have to
adjourn by 12:00.
I am sure that the witnesses will be willing to answer further
questions in writing for many of the members of the committee. I
want to thank them.
I do think there is one thing to be pointed out here; that is-
Congressman Walker would be particularly interested in this, and I
don't know whether you have done this calculation-based on the
cancer deaths in this country, the normal cancer rates, of the
800,000 cancer deaths in this area around Pennsylvania from
normal causes; that is, there are 400,000 cancer deaths in this
PAGENO="0096"
92
country per year today, and over the next 20 years there will be 8
million cancer deaths in this country.
Of that-I beg your pardon. There will be 80,000 cancer deaths in
that same population, in the next 20 years. If the NRC report is
correct, if it is correct that the average individual dose they quote
is 1.5 millirems, then from background it would be 100 times that
much. From normal background, and whatever cancer deaths are
suggested from the accident, if the NRC figure is correct, then the
deaths from background would be 100 times, during this same
period, for any one year.
Mr. WALKER. I thank the chairman for that. I think one of the
worries of the community up there is how much we are beginning
to build up when we start dumping the waste water into the
Susquehanna, and how much you build on top of that. It is one of
the real concerns.
Mr. MCCORMACK. I think the concern the gentleman has is very
well taken. I think it is a question that we should address to the
NRC tomorrow, whether the radiation level of the water released,
proposed to be released at Three Mile Island is above or below
background, and if so, how much, so we can get some feel for that.
That would help you and your constituents.
I want to thank the gentleman of the panel very much for
appearing today. You are very kind.
We have one more panel at this time. The next witnesses are Mr.
Saul Levine, Director of the Office of Nuclear Regulatory Reserch
for the Nuclear Regulatory Commission, and Dr. Harold Lewis,
professor of physics for the University of California.
These witnesses can provide us with exceptionally valuable testi-
mony.
Dr. Lewis, do you want to come up and join us at this time. We
welcome you.
STATEMENT OF SAUL LEVINE, DIRECTOR, OFFICE OF NUCLE-
AR REGULATORY RESEARCH, NUCLEAR REGULATORY COM-
MISSION
Mr. MCCORMACK. By way of background, and for a better under-
standing by the members of the committee, Dr. Levine was very
active in the preparation of what is known as the Rasmussen
report, WASH-1400, in which an attempt was made to quantify the
potential for nuclear accidents involving deaths of indviduals.
Dr. Harold Lewis headed up a group that provided some ex-
tremely responsible, constructive criticism, at a later date, of the
Rasmussen report.
Unfortunately, the press seriously distorted the intent of the
Lewis review of the Rasmussen report and took advantage of what
was perhaps some unfortunate language in the statement of the
Nuclear Regulatory Commission in evaluating and accepting the
Lewis report. In the press, it appeared that NRC was rejecting the
Rasmussen report and as if the Lewis study constituted total rejec-
tion of the Rasmussen report.
All those involved know this was not the case, but it is important
today for the general background of the Members of Congress to
help bring this point out, and to help give us some perspective with
respect to the safety design philosophy of nuclear powerplants, and
PAGENO="0097"
93
the implications of the Three Mile Island accident with respect to
nuclear safety in general.
Then in addition to that, Dr. Lewis will be testifying on the
general safety and statistical analysis of the hazards associated
with nuclear powerplants and his report that he made previously.
So we are looking forward to this testimony. First of all, the
statements of both you gentlemen will without objection be insert-
ed in the record in their entirety and you gentlemen may proceed
as you wish.
Mr. Levine, would you care to go first?
Mr. LEVINE. Thank you, sir.
I have a brief, oral statement to make, Mr. Chairman, which I
hope will be adequate for your purposes. I will cover three subjects,
sir-the safety design philosophy for nuclear powerplants, the rela-
tionship between the Three Mile Island accident and the reactor
safety study and the lessons we have learned from Three Mile
Island about additional research needed on the safety of nuclear
powerplants.
First, nuclear powerplant safety design philosophy.
In approaching the safety design for nuclear powerplants, the
NRC recognizes that these plants present some potential for acci-
dents that can have large consequences.
Because of this, we also recognize the need for a comprehensive
regulatory process to help insure that no undue risk to the health
and safety of the public will arise from their operation.
This process involves a well-developed safety design approach,
the specification of safety design requirements to implement that
approach, and an extensive safety review and licensing process to
ensure that plants meet established safety requirements.
A key element behind these requirements and procedures is a
recognition of the need for redundancy not only in the elements of
plant design but also in the review process.
The need for redundancy derives from the understanding that in
spite of man's best efforts to achieve high quality in design, con-
struction, and operation of nuclear powerplants, these goals cannot
be achieved; that is to say, no body of knowledge can ever be
complete enough to reduce uncertainties and risks to zero.
The safety design~ approach used by the NRC emphasizes defense
in depth. In nuclear powerplants, a series of physical barriers is
constructed between the large amounts of radioactivity contained
in the nuclear fuel and the environment.
Since it is known that some types of failures in one of these
barriers can also cause failure of the other barriers, there are two
other important factors involved in the implementation of the
defense-in-depth approach.
These are, first, the specification of requirements to achieve high
quality in the design, construction, and operation of nuclear power-
plants to reduce the likelihood of failures that could potentially
cause accidents; and second, the use of engineered safety systems,
with redundancy when needed, to prevent failures from progress-
ing into accidents.
These requirements are outlined in NRC regulations, standards
and safety guides which are based on sound engineering practices
established over the past 20 years, and which are undergoing con-
48-721 0 - 79 - 7
PAGENO="0098"
94
tinuing improvement~ The NRC also sponsors a comprehensive re-
search program to provide the technical bases for the confirmation
of NRC's safety decisions and for. needed improvements.
In summary, 1 believe that while nuclear powerplants, or any
other of man's technological endeavors, cannot achieve risk free
operation, the current system has provided a sound basis to ensure
that nuclear powerplants present no undue risk to the health and
safety of the public.
Of course, we have learned lessons from Three Mile Island, and
have to do some work, which 1 will come to later in my testimony.
I would like to say a few words about the Three Mile Island
accident and its relationship to the reactor safety study, WASH-
1400. The comments I will make here should be regarded as pre-
liminary because although we understand the basic elements of the
TMI event, there are many details yet to be filled in.
From the viewpont of nuclear powerplant safety design, two
principal technical elements are involved in TMI. The most impor-
tant is that the plant was configured so that the pressure relief
valve on the primary coolant system opened very often due to
events such as a failure of normal feedwater flow to the reactor.
An important matter in TMI and similar plants is to reduce the
frequency of opening relief valves since, if the valves do not open,
they cannot stick open and cause a small loss-of-coolant accident
(LOCA), as apparently happened at TMI. This has been addressed
in the bulletins issued by the NRC which require such actions as
the installation of anticipatory signals that would result in earlier
plant shutdown, raising the pressure setting at which the relief
valve would open, and reducing the pressure at which the reactor
is signaled to shutdown. These changes should, in principle, signifi-
cantly reduce the likelihood of the valve opening.
The second area relates to the reliability of the auxiliary feed-
water system. The question of interest is whether the RSS correctly
predicted the chance of failure of the auxiliary feedwater system to
operate when needed. Certainly the RSS identified that the system
could be failed because the output valves of the system would be
incorrectly left closed after maintenance, as was done at TMI.
The incident at TMI does not give us data as a failure point,
because the system did perform its intended function although only
after 8 minutes into the accident. However, it was a precursor to
possible failure and this suggests that we will have to go back and
reexamine the RSS predicted failure likelihood for this system to
see if changes are needed.
The TMI accident has also indicated areas requiring additional
safety research information.
While some of these requirements can be accommodated by re-
programing and reorientation of ongoing efforts, we believe there
will be a significant amount of new work that will require re-
sources over and above those contained in our fiscal year 1980
budget request to the Congress.
Therefore, we are currently preparing a proposed fiscal year 1980
supplemental budget request for review by our Commission. While
I can indicate now the areas in which I believe research will be
needed, I cannot go into great detail because we are still developing
this information. However, I can indicate that our research needs
PAGENO="0099"
95
are generally greater in the study of accidents which can lead to
extreme core damage, but which would fall short of actual melting
of the core.
So far my examination of the TMI accident suggests that re-
search is needed both to reduce the likelihood of events of this type
and to obtain a better physical understanding of them. As I said
earlier, additional resources will be needed to accomplish this
work. The following topics need urgent attention:
A. TRANSIENT AND SMALL LOCA EVENTS
Ongoing research efforts must be accelerated to obtain engineer-
ing data on behavior of the fuel, the release of fission products
from the fuel, and the thermal hydraulic behavior of the core and
primary coolant system during transient and small LOCA events.
These data are required to accelerate develoment and testing of
analytical models and computer codes needed to give more precise
predictions of actual system performance.
B. ENHANCED OPERATOR CAPABILITY
The accident at Three Mile Island has also demonstrated the
urgent need for system improvements to enhance in-plant accident
responses. This area of research need was given high priority and
addressed in some detail in the NRC's "Plan for Research to Im-
prove the Safety of Light-Water Nuclear Power Plants" (NUREG-
0438), submitted to the Congress in April 1978. This work, which
needs to be accelerated, includes improved data display and diag-
nostic systems to assist the plant operator under accident condi-
tions, additional in-vessel and plant instrumentation which will
operate reliably under such conditions, enhanced data transmission
capabilities to obtain outside assistance during emergencies, system
interlocks to preclude plant operation unless all safety systems are
in an operable condition, and development of improved require-
ments for operator training simulators.
C. PLANT RESPONSE UNDER ACCIDENT CONDITIONS
Research is required to explore more fully the response of plant
safety systems and components during accident conditions in order
to understand better the physical processes that can occur so as to
help preclude further system failures. Efforts in this area include a
detailed understanding of the primary coolant chemistry following
fuel failure, hydrogen evolution and behavior in the primary
system and containment, and behavior of safety components of the
plant, that is, reactor vessel pumps, valves, et cetera, under pro-
longed accident environments.
D. POSTMORTEM EXAMINATION AND PLANT RECOVERY
It is apparent that significant postmortem examination of the
TMI core, plant components and the containment will be very
useful in obtaining necessary information on fuel behavior, fission
product transport and plateout and component operability under
prolonged accident environments. These examinations will also be
necessary to help define plant recovery requirements and risks.
PAGENO="0100"
96
The TMI core must be removed from the reactor vessel in a
manner such that important configuration information is not lost.
The core should then be shipped to appropriate hot cell facilities
where it can be examined and analyzed extensively. These studies
will provide significant data on coolability of damaged cores, fuel!
clad/coolant interactions, and fuel chemistry under severe heatup
conditions.
I hope that the views I have expressed here today regarding the
safety design philosophy for nuclear power plants and the Three
Mile Island accident, including the lessons to be learned from TMI
as they relate to our research needs, will be of value to the commit-
tee in its considerations of these important issues. I believe signifi-
cant regulatory actions are already underway to reduce the likeli-
hood of such incidents significantly. For the longer term, I am sure
that further improvements will also be effected. The research areas
I have mentioned above should be started soon to provide the
needed information.
Thank you, Mr. Chairman.
[The prepared statement of Saul Levine follows:]
PAGENO="0101"
97
STATEMENT OF SAUL LEVINE, DIRECTOR
OFFICE OF NUCLEAR REGULATORY RESEARCH, NRC
BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
May 22, 1979
Introduction
Mr. Chairman,
I am pleased to be here today to give you my views on the safety design
philosophy for nuclear power plants, relationship between the Three Mile
Island (TMI) accident and the Reactor Safety Study (RSS), and the lessons
we have learned from the Three Mile Island event about additional
research needed on the safety of nuclear power plants. While the Three Mile
Island accident was indeed a highly regrettable event, it does give us an
opportunity to learn some lessons needed to prevent instances of this type
in the future and thus enhance the safety of nuclear power plants.
Nuclear Power Plant Safety Design Philosophy
In approaching the safety design for nuclear power plants, the NRC
recognizes that these plants present some potential for accidents that
can have large public consequences. Because of this, it also recognizes
the need for a comprehensive regulatory process to help ensure that no
undue risk to the health and safety of the public will arise from their
operation.
This process involves a well developed safety design approach, the
specification of safety design requirements to implement that approach,
and an extensive safety review and licensing process to ensure that
plants meet established safety requirements. A key element behi~nd these
requirements and procedures is a recognition of the need for redundancy
PAGENO="0102"
98
not only in the elements of plant design but also in the review process.
The need for redundancy derives from the understanding that, in spite of
mans best efforts to achieve high quality in design, construction and
operation of nuclear power plants, these goal,s cannot be completely
achieved; that is to say, no body of knowledge can ever be complete
enough to reduce uncertainties and risks to zero.
NRC's regulatory process has relied and, will continue to rely on the
judgment of highly skilled engineers and scientists as the principal
basis for its safety decisions. While extensive strides have been made
in the development of quantitative risk assessment techniques, and the
careful use of such techniques can provide added engineering insights
about the safety of nuclear power plants, they have so far been developed
only to the point where they can provide a valuable supplement to the
other methods and procedures now used by the NRC to form its safety
judgments.
The safety design approach used by the NRC emphasizes defense in depth.
In nuclear power plants, a series of physical barriers is constructed
between the large amounts of radioactivity contained in the nuclear fuel
and the environment. The fuel is contained in a sealed metal cladding;
the clad fuel is contained in a sealed, steel primary coolant system;
and the primary coolant system is enclosed in a sealable containment
building. Since it is known that some types of failures in one of these
PAGENO="0103"
99.
barriers can also cause failure of the other barriers, there are two
other important factors involved in the `implementation of the defense in
depth approach. These are, first, the specification of requirements to
achieve high quality in the design, construction and operation of nuclear
power plants to reduce the likelihood of failures that could potentially
cause accidents; and, second, the use of engineered safety systems, with
redundancy when needed, to prevent failures from progressing into accidents.
These requirements are outlined in NRC regulations, standards and safety
guides which are based on sound engi.neering practices established over
the past'20 years, and which are undergoing continuing improvement. The
NRC also sponsors a comprehensive research program to provide the technical
bases for the confirmation of NRCs safety decisions and for needed
improvements.
The NRC's regulatory process for nuclear power plants consists of safety
reviews by the staff of the Office of Nuclear Reactor Regulation and by
the statutorily independent Advisory Committee on Reactor Safeguards.
Public hearings of the results of the staff and ACRS reviews are held by
an NRC Atomic Safety and Licensing Board. The results of these hearings
can be appealled to an NRC Appeals Board and the Commission. Beyond
this, appeals can also be made to the courts. These reviews are conducted
twice--once before the construction of a plant is allowed to commence
and again before operation of the plant is permitted. The reviews also
include environmental as well as health and safety considerations.
PAGENO="0104"
100
The NRC's Office of Inspection and Enforcement conducts inspections
during construction of the plant to help ensure that the plant is being
built in accordance with the safety design and quality requirements.
Inspections are continued during the operating life of the plant to help
ensure that the requirements of NRC's licenses are adequately enforced,
that problems arising in operation are well handled, and valuable feedback
from operating experiences is incorporated into the safety reviews of
additional plants. Furthermore, NRC licenses require utilities to test
important safety systems periodically and to report failures of all
safety related equipment to the NRC. The results of NRC inspections and
reports of equipment failures are routinely made public.
In summary, I believe that, while nuclear power plants (or any other of
man's technological endeavors) cannot achieve risk free operation, the
current system has provided a sound basis to ensure that nuclear power
plants present no undue risk to the health and safety of the public.
THREE MILE ISLAND AND THE REACTOR SAFETY STUDY
I would like to say a few words about the Three Mile Island (TMI) accident
and its relationship to the Reactor Safety Study (WASH-l400) which is
more commonly called the Rasmussen Report after Professor Norman C.
Rasmussen of the Massachusetts Institute of Technology, who directed the
PAGENO="0105"
101
work. The comments I will make here should be regarded as preliminary,
because although we understand the basic elements of the TMI event,
there are many details yet to be filled in.
From the viewpoint of nuclear power plant safety design, two principal
technical elements are involved in TMI. The most important is that the
plant was configured so that the pressure relief valve on the primary
coolant system opened very often due to events such as a failure of
normal feedwater flow to the reactor. The second relates to the reliability
of the auxiliary feedwater system which is needed to remove the heat from
the reactor after it has been shut down.
For the PWR studies in the Reactor Safety Study (RSS) as well as for
most other PWRs, the primary coolant system pressure relief valve would
not be expected to open in the event of failure of the normal feedwater
system. The difference between those plants and TMI would be that they
would automatically be shut down quickly when normal feedwater flow
stopped, thus rapidly reducing the amount of heat that had to be dissipated
and causing only a small rise in reactor system pressure. In the TMI
accident the loss of normal feedwater, in and of itself, caused the
relief valve to open very quickly (in 3 seconds). If this valve were to
stick open, and valves of this type have about one chance in fifty of
doing so, the plant would experience the equivalent of a small Loss of
Coolant Accident (LOCA)*. This is what happened at the Three Mile
Island plant.
*Attachment 1 hereto contains a description of a Loss of Coolant Accident
PAGENO="0106"
102'
Thus, an important matter in TMI and similar plants is to reduce the
frequency of opening relief valves since, if the valves do not open,
they cannot stick open and cause a small LOCA. This has been addressed
in the bulletins issued by the NRC which require such actions as the
installation of anticipatory signals that would result in earlier plant
shutdown, raising the pressure setting for opening of the relief valve
and reducing the pressure at which the reactor is signalled to shutdown.
These changes should, in principle, significantly reduce the likelihood
of the valve opening.
The second area relates to the reliability of the auxiliary feedwater
system. As pointed out in the RSS, the lack of availability of both
normal and auxiliary feedwater systems can lead to serious overheating
and melting of the nuclear fuel. Although this type of sequence was one
that contributed significantly to the accident risks predicted in the
RSS, the auxiliary feedwater system analyzed in the RSS was found to be
a highly reliable system. At TMI, the auxiliary feedwater did not fail
permanently; it was out of operation for only the first 8 minutes of the
accident, after which it functioned properly. Plant temperature data
indicate that this did not affect the course of the accident significantly;
and, although it may have served as a source of distraction to the plant
operator, thesystem basically performed its design function.
PAGENO="0107"
103
The question of interest is whether the RSS correctly predicted the
chance of failure of the auxiliary feedwater system to operate when
needed. Certainly the RSS identified that the system could be failed
because the output valves of the system would be incorrectly left closed
after maintenance, as was done at TMI. In most reactors, even if this
were to happen, there would be 30 to 60 minutes available for the operator
to correct the situation before any fuel damage would be expected to
occur. The incident at TMI does not give us data as a failure point,
because the system did perform its intended function. However, it was
a precursor to possible failure and this suggests that we will have to
go back and reexamine the RSS predicted failure likelihood for this
system to see if changes are needed.
I should also note here that we are now using the RSS techniques to
review the auxiliary feedwater systems of all PWR reactors to determine
if any upgrading will be needed. It is my belief that the safety engineering
insights and techniques developed in the RSS can be used effectively to
study the TMI accident to help determine improvements that may be needed
in the safety of nuclear power plants. Such an approach is consistent
with the recommendations of the Risk Assessment Review Group Report* and
with the policies enunciated by our Commission.
* "Risk Assessment Review Group Report" to the U.S. Nuclear Regulatory
Commission (NUREG/CR-0400), commonly called the "Lewis Report" after
its Chairman, Professor Harold W. Lewis, University of California,
Santa Barbara;
PAGENO="0108"
104
RESEARCH NEEDS
The TMI accident has also indicated areas requiring additional safety
research information. While some of these requirements can be acconinodated
by reprogramming and reorientation of ongoing efforts, we believe there
will be a significant amount of new work that will require resources over
and above those contained in our FY 1980 budget request to the Congress.
Therefore, we are currently preparing a proposed FY 1980 supplemental
budget request for review by the Commission. While I can indicate now
the areas in which I believe research will be needed, I cannot go into
great detail because we are still developing this information.
In general, the recent accident at the Three Mile Island Nuclear Plant
can be thought of as emphasizing the need for additional safety research
information in the area portrayed schematically in the figure below:
Design Basis Accidents*
i__I / / / / / / / / / /_j_
Accidents Leading to
Extensive Core Damage
Increasing
Consequences
/////i///////
Core Melt Accidents
*Design basis accidents are defined in the first paragraph of Attachment 1.
PAGENO="0109"
105
Design basis accidents (DBA's) have been studied extensively in NRC's
licensing process. A prime example of a DBA is the large Loss-of-.
Coolant Accident (LOCA). These analyses and supporting research are
performed to ensure that plant safety equipment (emergency core cooling
systems, etc.) have adequately defined safety margins to prevent significant
fuel damage in the event of a DBA. While we have known for some time
that more attention is required for small LOCA and transient events, the
TMI accident clearly calls for much more urgent action than has so far
been taken.
Core melt accidents have been studied extensively in the RSS and ongoing
research programs are continuing to better define the physical processes
involved in molten fuel and plant materials, the release and transport
of radionuclides from the reactor fuel and consequences to the public.
Such investigations assign failure probabilities to various safety
systems whose lack of operation would lead to core melting. Accidents
involving extensi.ve core damage without significant fuel melting were
not examined extensively in the RSS because they were not thought to
have large public health consequences. The primary application of research
about fuel melting to date has been in risk assessment studies which
address both the probability and consequence of such accidents.
The area which lies in between these two types of accidents has received
less emphasis in both our research program and the licensing process.
Such accidents, similar to TNT, can occur as a result of partial failure
PAGENO="0110"
106
of various systems and may lead to extensive core damage, even without
fuel melting. I use the term partial failure here to describe two
situations at TMI. The first is the fact that a small LOCA occurred
when the relief valve opened and failed to reseat. This was followed by
the repeated closing and reopening of the block valve to the relief
valve, thus, causing a series of intermittent small LOCA's. Also, I
refer to the repeated turning on and off of the emergency core cooling
system, as opposed to its either complete operability or complete failure.
So far my examination of the TMI accident suggests that research is needed
both to reduce the likelihood of events of this type and to obtain a better
physical understanding of them. As I said earlier, additional resources
will be needed to accomplish this work. The following topics need urgent
attention:
A. Transient and Small LOCA Events
Ongoing research efforts must be accelerated to obtain engineering data of
behavior of the fuel~, the release of fission products from the fuel,
and the thermal hydraulic behavior of the core and primary coolant
system during transient and small LOCA events. These data are required
to accelerate development and testing of analytical models and computer
codes needed to give more precise predictions of actual system performance.
PAGENO="0111"
107
More specifically, current nonnuclear test facilities should be modified
to obtain engineering data on the heat transfer and coolant flow
conditions in the core and reactor primary system for both PWR and
BWR transients and small LOCA's. Investigation of the cooling and
behavior of fuel under natural circulation and transient conditions
where the core may be uncovered would-also be performed. Small LOCA
tests in the Loss-of-Fluid Test (LOFT) reactor should be accelerated
to obtain data with a nuclear core and at larger scale than most of the
nonnuclear tests.
Investigations of the behavior of severely damaged fuel which may
result from certain transient and small LOCA events should also be
conducted. Flow tests of fuel assemblies which h-aye been allowed
to boil dry should be performed to study coolability of damaged
cores. Tests should also be conducted to determine the rate and
nature of radioactive fission product release from damaged fuel, as
well as the transport of these fission products in the reactor
primary system and subsequent release to the reactor containment.
The development of advanced computer codes to predict mor~ precisely
the thermal hydraulic behavior of the core and primary coolant -
system under transient conditions should be accelerated. These analytical
codes, known as "best estimate" codes, are designed to predict with
greater precision actual system performance under various transient
and accident conditions, as contrasted to the "evaluation model" codes
used in the licensing process which contain significant conserva-
tive assumptions in order to put an upper bound on predictions of
PAGENO="0112"
108
accident response. The data obtained from the system engineering
tests and fuel behavior experiments will be used to upgrade the
analytical models and test the prediction capability of the codes.
These analytical codes can then be used to analyze a variety of transient
and small LOCA events under various failure conditions in order to
investigate aspects of plant system design and safety system operation
which may require further regulatory attention.
B. Enhanced Operator Capability
The accident at Three Mile Island has also demonstrated the urgent
need for system improvements to enhance in-plant accident responses.
This area of research need was given high priority and addressed in
some detail in the NRC's "Plan for Research to Improve the Safety
of Light-Water Nuclear Power Plants" (NUREG-0438), submitted to the
Congress in April 1978. This work, which needs to be accelerated, includes
improved data display and diagnostic systems to assist the plant
operator under accident conditions, additional in-vessel and plant
instrumentation which will operate reliably under such conditions,
enhanced data transmission capabilities to obtain outside assistance
during emergencies, system interlocks to preclude plant operation unless
all safety systems are in an operable condition, and development of
improved requirements for operator training simulators.
Research should be performed to define requirements for data display
and diagnostic systems to better assist the operator under accident
PAGENO="0113"
109
conditions. These display and diagnostic systems should also
include the capability for outside organizations to provide assistance
and advice to the plant under accident conditions. Studies should be
performed to define the necessary data transmission and comunication
requirements for this purpose.
Improvements are needed in instrumentation to measure plant conditions
such as valve position indicators and reactor vessel water level.
Studies should be performed to define all instruments needed to
assist plant operators in the diagnosis of accident conditions,
and tests should be conducted to evaluate and improve reliability
of such instrumentation under long term accident environments.
Requirements should also be developed to improve the use of simulators
in studying operator response to accident situations and for
related training. Control room and plant protection system design
requirements should also be studied to define improvements which
will enhance accident response and reduce the likelihood that a plant
can be operated when safety systems are not all operational.
System interlocks which would preclude plant operation under
certain conditions should be further defined; such as, unavailability
of the auxiliary feedwater system.
C. Plant Response Under Accident Conditions
Research is required to explore more fully the response of plant
safety systems and components during accident conditions in order
48-721 0 - 79 - 8
PAGENO="0114"
110
to understand better the physical processes that can occur so as to
help preclude ~further system failures. Efforts in this area include
a detailed understanding ofthe primary coolant chemistry following
fuel failure, hydrogen evolution and behavior in the primary system
and containment, and behavior of~safety components of the plant,
i.e., reactor vessel pumps, valves, etc, under prolonged accident
environments.
Experiments should be performed to develop data and analytical methods
to characterize the complex chemical nature of the primary coolant
after a transient in which some fuel has failed. This work would
lead to development of computer codes to describe the coolant chemistry
following various accidents, and to the development of improved sampling
methods to determine the amount of failed fuel from primary coolant
analysis.
Experimental and analytical research should be conducted to describe
the formation and behavior of hydrogen in the primary system in
accidents which involve significant fuel failure. Research should
also be performed to study and predict reliably the mixing of such
gases with the containment atmosphere. Methods for reducing the
hydrogen gas in the primary system and in containment after an
accident should be investigated to reduce the probability of explosion
or fire.
PAGENO="0115"
111
Testing should be performed to investigate the integrity of the
reactor vessel under thermal shock conditions (cold water on hot
vessel) at higher pressures representative of transient and small
LOCA events to determine potential for vessel failure. Previous
tests of this nature were performed at lower pressures more representative
of large LOCA events. Requirements should also be developed for
testing of critical plant equipment, pumps, valves, etc., to determine
reliability of operation under severe accident environments.
D. Post Mortem Examination and Plant Recove~y
It is apparent that significant post mortem examination of the TMI
core, plant components and the containment will be very useful in obtaining
necessary information on fuel behavior, fission product transport and
plateout and component operability under prolonged accident environments.
These examinations will also be necessary to help define plant recovery
requirements and risks.
The TMI core must be removed from the reactor vessel in a manner such
that important configuration information is not lost. The core should
then be shipped to appropriate hot cell facilities where it can be
examined and analyzed extensively. These studies will provide significant
data on coolability of damaged cores, fuel/clad/coolant interactions, and
fuel chemistry under severe heat-up conditions.
Examination of the status of the containment building and plant
safety components will yield important data on radioactive fission
product transport and plateout and provide information on the operability
PAGENO="0116"
112
of safety equipment under prolonged accident conditions. This
information will be required to establish improved environmental
requirements and criteria for requalification of safety equipment
necessary for plant recovery. It is expected that these investigations
will also lead to development of improved equipment qualification
methodology spanning a range of postulated accidents.
Concl us ion
I hope that the views I have expressed here today regarding the safety
design philosophy for nuclear power plants and the Three Mile Island
accident, including the lessons to be learned from TMI as they relate
to our research needs, will be of value to the Comittee in its con-
siderations of these important issues. I believe significant regulatory
actions are already underway to reduce the likelihood of such incidents
significantly. For the longer term, I am sure that further improvements
will also be effected. The research areas I have mentioned above should
be started soon to provide the needed information.
PAGENO="0117"
113
ATTACHMENT 1
Loss of Coolant Accident (LOCA)
In evaluating the safety of nuclear power plants in NRC's licensing
process, a series of design basis accidents have been selected. A
design basis accident is used to specify sets of conditions which engineered
safety systems are designed to mitigate in the interest of protecting
the health and safety of the public. The most intricate design basis
accident is the loss of coolant accident, called a LOCA which is described
in the following discussion.
A LOCA is postulated to occur as a result of a break in one of the pipes
that comprise the primary coolant system of a reactor.* As a result of
the break, loss of cooling capability for the nuclear core would occur
and a rise in temperature of the fuel and its cladding could result.
Since cooling the fuel and its cladding would be necessary to prevent
the release of radioactive fission products, reactors are provided with
emergency core cooling systems to keep the fuel covered with water and
cooled. A major part of our research effort is devoted to defining the
safety margin of emergency core cooling systems with greater precision
than is now available.
Figures 1, 2, and 3 illustrate a pressurized water reactor and-its
associated emergency core cooling system. Figure 1 is a very simplified
view of the primary coolant system and the associated steam generating
equipment. This shows the reactor core, in its vessel, and the circulation
*More generally, any essentially permanent opening in the primary coolant
system that can result in significant loss of water inventory can
be termed a LOCA.
PAGENO="0118"
114
of primary coolant system water through the core, out to the steam
generator, and back through the pump to the reactor vessel. The very
hot water pumped into the steam generator heats other water in a secondary
circuit to make steam, which then drives a turbine and a generator to
produce electricity. Figure 2 shows how the single reactor core and
vessel can be used with up to four cooling loops, each with a pump and a
steam generator.
Figure 3 shows how the emergency core cooling system connects to the
primary coolant system. The ECCS consists of accumulators, which are
large vessels containing water under pressure, and low pressure and high
pressure injection pumps shown schematically by the pumps in the figure.
If a pipe were to break, as is indicated in the figure, the primary
system water would be expelled as a result of its high pressure and
temperature. Signals resulting from the loss of pressure in the primary
coolant system would initiate operation of the ECC systems. The efficacy
of emergency core cooling performance is predicted by calculating the
temperature of the hottest part of the fuel cladding in the reactor core
to ensure that it does not exceed NRC's safety requirements. -
PAGENO="0119"
REACTOR
UIANIUM
4 WATEI
INTAKE
-S
(55
REACTOR
HEAT EXCHANGER
TO
TURBINE
C,'
PAGENO="0120"
-El
to.
C
~1
ED
8 ~
0)
PAGENO="0121"
117
Mr. MCCORMACK. Thank you, Mr. Levine.
I have a number of questions which I shall save until after Dr.
Lewis. By the way, I should mention, Dr. Lewis is a physicist
from-where is your home base, Dr. Lewis?
Dr. LEwIS. Santa Barbara.
Mr. MCCORMACK. You are very welcome.
Please proceed with your testimony as you wish, Dr. Lewis.
Dr. LEWIS. Very good; thank you, Mr. Chairman. I am of course
pleased to be here. You have my written testimony.
Mr. MCCORMACK. Yes.
Without objection, your written testimony will be inserted in the
record at this point, and you may proceed as you wish, Dr. Lewis.
STATEMENT OF DR. HAROLD W. LEWIS, PROFESSOR OF
PHYSICS, UNIVERSITY OF CALIFORNIA
Dr. LEWIS. Very good. I will forego then reading it to you, be-
cause that would waste all our time.
What I do want to say though is that I have to make my position
clear. I did chair the American Physical Society Light-Water Reac-
tor Safety Study Group, which resulted in a unanimous report-
and therefore I can speak for that group-and the Risk Assessment
Review Group which reviewed WASH-1400, which on these mat-
ters resulted in a unanimous report, so I think I can speak for that
group.
I am also, as of 2 weeks ago, a member obviously of the Advisory
Committee on Reactor Safeguards, and I can obviously not speak
for that group. So I will try to make clear when I am speaking for
myself and when I am trying to speak for one or the other of the
groups I have been involved with. I have to put that on the record.
I would like to go through a few of the things you asked me to
discuss, rather specifically the problems that our review group
found with WASH-1400, the Rasmussen report, and how they are
relevant to the question of reactor safety and what they indicate
for us. I think I would, especially in view of your introductory
comments, like to go through a few of these things, and reinforce
some of the things that you have said.
The Rasmussen report, as we all know, was a serious effort to
quantify rationally the probability and consequences of a nuclear
accident. As soon as it was reported out, it received a great deal of
criticism, which was a fairly intimate mixture of rational criticism
and irrational criticism, with the result that the entire system
became very defensive about the report, and ended up in my per-
sonal view defending things that were indefensible along with
those that were defensible, and it may be-and we said this in our
report-asking too much of people to distinguish among the slings
and arrows those which have poison on them and those which are
good, clean sharp points. But the group involved did find a certain
amount of difficulty doing that.
We studied the report on commission from the NRC for about a
year, heard testimony extensively, and ended up saying essentially
the following: That the report is very hard to read. I think that is
not a great discovery for most people. Everyone knows it is a very
hard report to read and to follow in some detail.
PAGENO="0122"
118
On the other hand, it was a major forward step in making the
study of the safety of nuclear powerplants rational. It was a seri-
ous, responsible, and honest effort-and we said this-to quantify
the probability and the consequences of an accident. Where it fell
short, and there were plenty of places that it fell short, these were
a consequence of the fact that it was a very difficult job that was
undertaken.
More specifically, the report used a kind of methodology for the
study of nuclear safety, the so-called fault-tree event-tree method-
ology, which had come under attack from some critics as being
wanting in itself. We found that criticism to be without merit, that
is to say, we found that the fault-tree event-tree methodology,
which is essentially the application of logical procedures to the
analysis of nuclear accidents, is a completely solid procedure.
Solid procedures can sometimes be implemented imperfectly, but
it is important to distinguish between the quality of the screw-
driver and the effectiveness of the carpenter, and we tried to do
this.
I am making this point fairly carefully, because one of the impor-
tant, in my view, recommendations that we made was that this
kind of methodology be much more extensively used within the
NRC for the orientation of the safety research program, which is
under Mr. Levine, and in the regulatory process. That is to say, we
said that it is much better to base the things that you do on what
knowledge you have than it is to base it on judgment or knowledge
derived other than by careful and responsible analysis.
It is an important point, and I would like to keep coming back to
it. On the specific implementation in WASH-1400, we went
through it, and we did find a very large number of things which
were not done as well as we would have liked them to be done. One
always asks, in this highly charged and passionate subject, whether
errors are made-first, one always asks whether they are made on
purpose, and we answered that by saying no.
Then one asks whether such errors as are made have the conse-
quence of :exaggerating or minimizing the likelihood of a reactor
accident, that is, in the jargon of the trade, are they conservative
or nonconservative? We found that there were a fair number of
conservative things, overly conservative things, and I can name a
few of them. I will come back to one important one. And there
were a fair number of nonconservative ones, that is, things in
which the, probability of an accident was understated.
There were so many things on both sides of the fence that our
group ended up saying that we do not believe that the probabilities
stated in WASH-1400 are as credible as they are alleged to be, that
is to say, that the error bounds are greater than was stated in the
report. But we also were not able to say, and did not say, that the
probabilities calculated in the report are either high or low, that is,
we did not say the group came out with either an understated or
an overstated estimate of the probability of a reactor accident.
However, we said that the estimates weren't as good as plus or
minus~ a factor of five, which is what was stated in the report,
weren't that good, because we found many `things with which we
found fault.
PAGENO="0123"
119
Thus, we essentially commended the methodology. We said it is a
good way to do things. It is better to analyze safety through analy-
sis where you can, but that perhaps it was too big a bite that was
taken at the time of the Rasmussen report.
We urged the NRC to move in the direction of using this kind of
analysis on systems which were sufficiently small so that the data
base was available, the statistical techniques were available, the
ability to describe the system under consideration was there, so
that you could do the job in a credible and effective way, that they
should be doing that much more than they had been doing so in
the past.
One example, for example, of that sort of thing is that the
Rasmussen report-let me make one other comment. This is a
personal comment. When the NRC received our report, there fol-
lowed 4 months of Commission meetings about what to do with it.
It was too late to reverse time, so they couldn't just throw it away,
and after 4 months the NRC essentially accepted all the recom-
mendations of our report and directed the staff to move in the
direction of using this kind of methodology much more than they
had in the past. This was of course accompanied by a press release
which was misunderstood.
Well, many things were misunderstood. It is in the nature of
man that things are misunderstood. But they also asked the staff
to report back to the commission whether in fact the Rasmussen
report had played a role in any of the licensing and regulatory
decisions that had been made in the few years it had been around,
and the staff reported back that, with the exception of a few rather
minor instances, no, it had not been used, and everyone was very
pleased by that, and I have always felt that that was the wrong
answer, that in fact in the years between the time the Rasmussen
report was given to the NRC and the time in which we found some
substantial problems in it, it was the best thing available, and
should have been used much more extensively than it was. That is
to say, risk assessment methodology is a solid discipline and should
be used as much as possible to guide the regulation and licensing of
reactors.
One specific, which I have pulled out of our report from last
September, and I must read this one paragraph to you from the
record, was that we noticed that in WASH-1400, whatever you
think of it, there was a listing of many of the credible accidents in
a plant, and an ordering, that is to say, one could identify in
WASH-1400 with less credibility than had been thought before, but
still with some credibility, what the most likely accidents were, and
we found a problem with the fact that NRC had not been moving
in the direction of studying and emphasizing those things which
WASH-1400 showed to be most threatening to a nuclear power-
plant.
We have a paragraph:
The achievements of WASH-1400 in identifying the relative importance of var-
ious accident classes have been inadequately reflected in NRC's policies. For exam-
ple, WASH-1400 concluded that transients, small LOCA, and human errors are
important contributors to overall risk, yet their study is not adequately reflected in
the priorities of either research or regulatory groups.
Now those are the three things that were relevant to Three Mile
Island, so there is an obvious lesson which I needn't belabor. In any
PAGENO="0124"
120
case, we did recommend using the methodology, pushing it much
harder. We found specific fault with WASH-1400, and I think that
is really all I need to say. Our detailed conclusions are in our
report, and I am happy to answer any questions you may have.
[The prepared statement of H. W. Lewis follows:]
PAGENO="0125"
121
TESTIMONY OF H. W. LEWIS
BEFORE THE SUBCOMMITTEE ON ENERGY RESEARCH
AND PRODUCTION OF THE COMMITTEE ON SCIENCE AND TECHNOLOGY
OF THE U. S. HOUSE OF REPRESENTATIVES
MAY 22, 19T9
I appreciate the opportunity to appear before you today to discuss a
number of issues of risk assessment, and of technology developments to en-
hance the safety of nuclear operating systems.. As you know, I was Chairman
of the American Physical.Society Light-Water Reactor Safety study group, and
also of the Nuclear Regulatory Commission's Risk Assessment Review Group,
and have only two weeks ago become a member of the Advisory Committee on Re-
actor Safeguards. The two former studies resulted in unanimous reports on
all the issues to be discussed here, so that I will do my best to speak for
the Groups where it is appropriate. In addition, I would like to express a
number of my personal views, and will try to distingui~h the two roles as
carefully as I can. Clearly, I do not speak for the Advisory Committee on
Reactor Safeguards. . .
You have asked, in your letter of May 11 that loutline which elements
of the Rasmussen report our Review Group judged invalid, and the degree to
which the report is still useful as a basis for. decisions by NRC. I would
like to somewhat broaden the issue, since the charter of the Review Group
was to study not only the Rasmussen report itself, but also the general sub-
ject of risk assessment methodology, and many of our recommendations dealt
with the distinction between the two. I will try to make all that clear.
Probabilistic risk assessment, as epitomized by WASH-l1~OO, the Rasmussen.
report, is an effort to make quantitative the risk of an accident (not just
in reactors) and the consequences thereof. To do so it is necessary, at
the very outset, to construct a detailed model of the operating system, which
PAGENO="0126"
122 *
must be complete and accurate. Accident probabilities may differ vastly ac-
cording to the precise alignment of valves and switches, and generalizations
are rarely sufficient for credible accident analysis. Having modeled the
plant, there are then a number of techniques for tracing accident paths through
the system, all of which are essentially equivalent to the particular form of
fault tree/event tree analysis used in .WASH_lI~OO.* If one has sufficient data
to determine, for example, the probability that a given valve will be open
when it should be closed, one can then compute the probability of any partic-
ular accident sequence, leading to an estimate that it will lead to failure
of the entire system. Then, similarly, one can compute the consequences of
such an accident, and this is the method used in WASH-l~OO.
The Review Group asked first whether this was a logically sound technique,
and answered in the affirmative. It is extremely difficult, and fraught with
complexities I will mention later, but we solidly supported both the nethodoolgy
and the objective of making the study of reactor risk as quantitative and ra-
tional as possible. Nonetheless, we found faults In* the implementation of
the methodology in WASH-l~4OO, which are discussed In some detail in our report.
among them are the fundamental difficulties Involved in quantifying conmom
cause failures - failures in which presumably independent systems are compro-
niised by an event which affects them all, (e.g. an earthquake), a quite in-
adequate data base for a number of the things which needed to be calculated,
inadequate, and sometimes wrong, statistical techniques in a number of in-
portant places, the basic difficulty in quantifying human behavior, etc.
PAGENO="0127"
123
Therefore, though supporting the methodolo~r, we found a sufficient number
of problems with the implementation of the methodolo~r in that particular
study to feel that the error bOunds on the accident probabilities given in
WASII-lbOO were substantially understated. It is important to say that this
does not mean that we believe that the accident probabilities are either high
or low, but only that they are substantially less certain than was stated in
that report.
This is such an important point that it is worth spelling it out in some
detail. We found a number of items in WASII-l1400 which tended to exaggerate
the probability of an accident (i.e., were conservative), and a number which
tended to understate the probability of an accident (i.e., were non-conserva-
tive). Among the latter were the treatment of common cause failures, mentioned
above, the treatment of ATWS (anticipated transients without scram) and the
handling of human accident initiation. Among the conservative treatments were
the pervasive regulatory bias in the group, drawn as it was from the regulatory
community, which caused them to always err on the side of conservatism when
in doubt, complete omission of constructive and adaptive human response dur-
ing the course of an accident, etc. It is because there were so many things
on both sides that we were unable to judge whether the probabilities in
WASH-l1~OO were high or low, but able to agree unanimously that they were sub-
stantially less precise than had been stated in the report.
On the other hand, the effort to quantify risk through the detailed
analysis of the failure modes of a plant is far more likely to provide rational
guidance to safety enhancement than is guesswork. For that reason, we strongly
PAGENO="0128"
124
supported the application of this kind of risk assessment nethodolo~ in
the regulation and enfor~ement areas, under conditions in which the data
base and statistical techniques are up to the job, that is, on subsystems and
generic issues sufficiently limited to allow one to. do the job well. In-
deed, we said that these techniques should be among the principal methods
used to resolve the generic safety issues which afflict the nuclear enter-
prise.
I an emphasizing these distinctions because our Review Group strongly
supported the enhanced use of the nethodolo~ in the regulatory process,
while at the same time coming down rather hard on the specific implementation
in WASH-lbOO. It seems to me obvious that, where one has* an opportunity to
understand the relative importance of different accident modes in the plant,
and even, to some extent, the absolute probabilities, it is far better to
distribute one's resources accordingly than to rely upon engineering judgment,
however competent. Though .the latter is extremely~ important, and represents
in some sense the distillation of accumulated experience,it cannot prevail
in reliability over competent analysis. We therefore urged, as others have
been urging for years, that the RRC move expeditiously into a mode in which
probabilistic risk assessment plays an important role in determining the
priorities of its regulatory and research efforts. I would like to quote
verbatim one of the findings from our report, whose relevance this month
should be obvious.
PAGENO="0129"
125
"The achievements of WASH-l1~OO in identifying the relative
importance of various accident classes have been inadequately
reflected in NRC's policies. For example, W~SH~l~4OO concluded
that transients, small LOCA, and human errors are important
contributors to overall risk, yet their study is not adequately
reflected in the priorities of either research or regulatory
groups." -
This paragraph speaks for itself in the aftermath of Three Mile Island.
I believe that the effective use of risk assessment- methodolo~r In character-
izing and dealing with the risks in reactors can go a long way toward making
them safer, as well as .in helping to assess. their safety for public policy
purposes. For this tohappen, the NRC research program must be more respon-
sive to the risks as determined by sober analysis, and less responsive to
the risks as conceived in other ways. Even the progress already-made in
rationally characterizing and understanding risk -has -been very slow to pene-
trate the regulatory structure at NRC, and our report recommended~ that "NRC
should encourage closer coordination among the research and probabilistic
analysis staff and. the licensing and regulatory staff, in order to promote
the effective use of these techniques." Despite the statement of the Nuclear
Regulatory Commission last January that - it was accepting all our recomraenda-
tions, and its instructions to the staff to. move in this direction, I have
yet to see much progress. This is not to demean in any way the technical
quality of the NRC operation, - but only to say that the conservatism which
48-721 0 - 79 - 9
PAGENO="0130"
126
is entirely appropriate in the regulatory body does not lend itself easily
to the absorption of new guidance.
Finally, I sin both pleased and sorry that you have not asked me to
tell you what lessons I believe Three Mile Island has taught us about all
these natters. I am pleased because you have saved me some work, and sorry
because I believe that there is so much that we can learn fron experience
in general, and from this experience in particular.. Perhaps someone will
rise to the bait and ask me a question.
Mr. MCCORMACK. Thank you, Dr. Lewis. I want to take this
opportunity to congratulate you and~ all the members of the panel
that worked on the review. I do not purport to be the wisest person
nor the most knowledgeable person on this subject, but I think that
your review was an excellent one, and I want to congratulate you
on it. I regret that it was misinterpreted by the press. I regret that
NRC's press release regarding its action on it was so ineptly writ-
ten, I think that your work made a very considerable contribution.
I recall previous meetings, public hearings where you and Dr.
Rasmussen appeared together, he agreed with that statement, and
in the true character of a professional scientist, accepted the criti-
cisms, at least a substantial portion of the criticism that you made
of his report, and agreed with them. I want to congratulate you
also on the professional manner with which you evaluated the
report.
I think that in the days to come, the Rasmussen report and your
analysis of it will both contribute significantly to the better under-
standing and better management of our nuclear safety programs.
Dr. LEWIS. Thank you, Mr. Chairman. You will make me blush,
but it is true that Norm Rasmussen has accepted essentially all the
recommendations of our report also, and I give him a great deal of
credit for behaving like a gentleman and scholar through this
whole thing.
Mr. MCCORMACK. Especially a scholar, and without detracting
from the gentleman, but especially a scholar.
Dr. LEWIS. Yes.
Mr. MCCORMACK. I would like to ask you a question now in that
context. You said the factor of plus or minus 5 which they used in
their error bounds was too narrow.
Dr. LEwIS. Right.
Mr. MCCORMACK. Do you feel there is a number that you could
put on the error bounds that would be realistic?
Dr. LEWIS. No, I do not, and we were very careful not to do that.
We said substantially understated or greatly understated, and
people have tried to pin us down, and particularly Norm Rasmus-
sen I think is willing to go another factor of 2 or 3, and we have
had conversations that were almost like bartering sessions. If I
would go for a factor of 5 perhaps we could compromise on a factor
of 4 extra over the 5.
The reason we cannot do that is that, in other words, to provide
a credible error bound, we would have to do the report over again.
PAGENO="0131"
127
We would have to do it responsibly and even better than the
Rasmussen group did. In a sense the reason they could not set an
error bound that stood the test of time was that they were biting
off a very, very difficult job. There are intangibles. There are
things we do not know.
We really did not know how to quantify human errors. My view
of the great conservatism in the report is that we do not know how
to quantify constructive human intervention after an accident
begins. These are very difficult, and in order to set a credible
bound, one would have to do all those things better than the
Rasmussen group did. We did not do that.
Mr. MCCORMACK. Do you have any feeling for the general im-
pression that the casual nonscientific, nonanalytical observer
would receive from reading in the Rasmussen report that the po-
tential for an individual public citizen being killed from a nuclear
accident is extremely small, whether or not we try to quantify it
numerically?
Dr. LEWIS. Is your question whether I agree that the probability
of being killed is small?
Mr. MCCORMACK. I do not want to put you in the position of
saying "agree," but do you believe, based on your study, that the
potential threat of death from a nuclear accident to public citizens
is extremely small?
Dr. LEWIS. Yes. I am speaking for myself now, just me. Yes, I do,
and in fact I have said many times that if I were to be asked
personally, not as chairman of the review group, whether I think
that the probability of an accident stated in the Rasmussen report
is high or low, the thing I carefully avoided saying before, I feel
that the probability of an accident stated in that is high, that is to
say, that the plants are actually safer than is stated in the Rasmus-
sen report. I said that before Three Mile Island and I continue to
say it.
The reason I say it is that as the people who listen to me know,
to their misery, I always make aviation analogies in these things.
And the Rasmussen report, in effect, if it were translated into the
aviation case, would be like studying the safety of airplanes while
leaving out the fact that there is a pilot there who does not want to
get killed either, and the fact that constructive human intervention
during the course of an accident was omitted is to me a very
important conservatism in the report.
It is very difficult to quantify, but reactor accidents lend them-
selves more easily to constructive intervention than do aircraft
accidents, because they happen more slowly. Most of them happen
more slowly, the ones that are most threatening happen more
slowly, so I do believe that it exaggerates the probability of an
accident.
Mr. MCCORMACK. One final question. Do you feel that the Three
Mile Island accident and the subsequent sequence of events, fit
reasonably well into the Rasmussen evaluation of the fault-tree
risk analysis?
Dr. LEWIS. Yes; they fit into it to some extent-that is, everyone
has noticed, that the probability of leaving the two block valves on
the emergency feed water system inadvertently closed was con-
tained in the report. It was calculated, I believe, in an inexcusably
PAGENO="0132"
128
poor way, but it was still in the report, so that up to the point at
which the hydrogen bubble formed in the pressure vessel, it was
not an unusual sequence of events.
By then one was in the position to do a diagnosis and work
through what finally happened. I believe it was done reasonably
well in the report.
Mr. MCCORMACK. Thank you.
Mr. Levine, I have one question which I hope will not be miscon-
strued. One looks at the Three Mile Island accident in its entirety,
the fact that it was a serious accident, that it was extremely
unfortunate, and yet one looks at all that we have learned from it.
We have learned, for instance, that under the nearly noncredible
conditions that existed with respect to the exposure of the fuel, the
uncovering of the fuel, we had no cesium release to the coolant
water. In short, what we had was a massive LOCA experiment,
unintentional experiment. Do you feel that this qualifies as a test
for a fuel core that has been lacking because we obviously did not
want to do it? Does it respond to the criticism of the LOFT test
that they are not big enough? Can we draw experience from this
accident and draw knowledge from this accident that will give us a
better understanding and essentially say, well, this is for all practi-
cal purposes an unintentional LOCA experiment?
Mr. LEVINE. I think the answer is partly yes and partly no, and
certainly not yet. First of all we are going to have to get the core
out of there to understand more precisely than we can now esti-
mate, what happened to it, how extensively it was damaged, and
then try to better predict what the temperature-time history of
that fuel was.
Second, I think the idea of trying to analyze an accident in which
the auxiliary feed water was turned off and then later turned on,
and the emergency core cooling system was turned off and on at
random, and the relief valve block valve was opened and closed,
giving it sort of an intermittent LOCA, is a kind of sequence that is
very difficult to analyze.
For myself, at this point I can say that I think, considering what
happened at that plant, I am surprised that there was not more
damage than we have seen, and I think in that sense, one can say
we will have learned a great deal about the ability of these cores to
withstand severe conditions.
On the other hand, we are learning a great deal from our LOFT
program. We have now conducted two nuclear tests, one from two-
thirds of the power density of a commercial reactor, and just a few
weeks ago, one from the full power density of a commercial reac-
tor. We find the peak clad temperatures quite low, and we find our
ability to predict what happens to be quite good. Some more refine-
ments are needed, but I think we are making great strides in this
area.
Furthermore, I think we are going to have to modify our LOFT
experiments to more urgently look, at small LOCA, as I mentioned
in my testimony, as well as transients, too.
Mr. MCCORMACK. One final question. You may not have an
answer at all to this. I have been continually disturbed by the
calculations on the amount of zirconium that was presumably con-
sumed. It seems to me utterly inconsistent to talk about as much
PAGENO="0133"
129
as one-third of the zirconium consumed, based on the amount of
hydrogen that was presumed to be present, and to assume that this
came from the top half of the fuel, to assume that there would be a
hot spot, shall we say halfway between the surface of the water
and the top of the fuel, where more of the zirconium would be
reacting. All this happens, and we have one-sixth of the total
zirconium consumed, and yet no cesium is released to the cooling
water. That strikes me as being very strange, and I wonder if you
care to comment on it.
Mr. LEVINE. I can only comment on the basis of generalizations
at the moment. We think that there was almost no fuel melting in
the core, and that you really will not get very much cesium re-
leased unless you melt the fuel.
On the other hand, the core did reach high enough temperatures
to bake out iodine and the noble gases, and there may have been
an eutectic formed between the oxide and the cladding, which
would in fact have released more than you would get just through
the temperature alone.
Mr. MCCORMACK. More what?
Mr. LEVINE. More of the iodine.
Mr. MCCORMACK. And gases?
Mr. LEVINE. Yes.
Mr. MCCORMACK. Are you suggesting-well, I guess my question
is when I see no cesium at all, no significant measurable cesium in
the cooling water, I am assuming that there was no contact be-
tween the cooling water and the fuel itself.
Mr. LEVINE. That may be, but there surely was a large metal
water reaction in some parts of that core.
Mr. MCCORMACK. Yes.
Mr. LEVINE. And it is easy to speculate that there was cladding
damage to the point where some fuel should have been exposed.
Mr. MCC0RMACK. Should have been, but that is the inconsistency
that shows up, and I am raising that point now.
Mr. LEVINE. I think in my mind that is still, an open area. We
have some differences of view among our experts who have been
studying this very carefully, and by the way, the metal water
reaction amount was not based just on the hydrogen present. It
was based on attempts to reconstruct the time-temperature history
of the core.
Mr. MCC0RMACK. I see. Thank you.
Mr. Goldwater.
Mr. GOLDWATER. Dr. Lewis, discussing the WASH-1400 report
with Mr. McCormack, you implied that an update should be made
on that report. Is that an accurate interpretation?
Dr. LEWIS. No; I do not think so. On the specific question of
whether WASH-1400 should be updated or redone, I do not think it
would be a good idea. There are several reasons. Of course we could
do a little bit better with the hindsight we have had, but I am not
so sure that we could do enough better to justify doing it. The sense
of our review group report was that one should break out the
methodology and use it on subsystems for which you can do the job
well, rather than on the whole system, for which it may not be
possible to do the job well.
PAGENO="0134"
130
Mr. GOLDWATER. You implied that there was not enough risk
assessment based on transients, small LOCA and human error,
incorporated in this study.
Dr. LEwIs. Oh, no, no, quite the opposite. It was in fact in
WASH-1400. One of the consequences of WASH-1400 was that
transients, small LOCA, and human error do play an important
role in the generation of nuclear accidents. The place where it is
inadequately represented is in the NRC programs which ought to
have been more responsive to WASH-1400 in my view, well, in our
group's view, than in fact they were. NRC is a slow-moving organi-
zation. Perhaps it is proper for a regulatory organization to be
slow-moving, but it would be nice to have some of the wisdom
which was produced by WASH-1400 including the importance of
small LOCA transients, and human error find its way into the
NRC research and regulatory structure. It is in WASH-1400.
Mr. GOLDWATER. So you feel that the two reports, your review
and the WASH-1400, have sufficient standing separately and they
don't need to be incorporated?
Mr. LEWIS. Our report was a fairly strong critique of WASH-
1400. I have emphasized the positive things we said today, but in
fact, we were fairly hard on the report in terms of statistics, data
base, scrutability, and such matters. So that we found a great deal
wrong with it.
When I say that I don't believe it would be worthwhile to do it
again, It is just I am thinking of the millions of dollars, man-years,
expertise, and effort involved. I think if that same amount of effort
and resources were to go into applying the methodology where you
can do it well-that is, on subsystems-that would be a better
expenditure of our time.
Mr. GOLDWATER. What do you believe are the basic lessons that
we should or will be learning from the Three Mile Island accident?
Mr. LEWIS. Well, I have views on that. Basically, I think I can do
this very quickly. I think many people have noticed that there are
a wide variety of accidents and that in this particular event there
was a surprise-the formation of the gas bubble in the pressure
vessel was a surprise.
The thing that concerns me about the lessons people are drawing
from Three Mile Island is that they tend to be rather specific to
the particular sequence that occurred at Three Mile Island; that is
to say, the familiar analogy, a horse has escaped from this barn
and we are double bolting that particular door.
We tend to be fairly narrow in responding to the specific thing
that has happened. .1 think any future accidents-and there will be
accidents-will also contain surprises. The main lesson I learn,
again drawn in part from the aviation analogy, from both Three
Mile Island and from Browns Ferry, which was the worst thing up
to now, is that in the end it takes constructive human intervention
to modify the course of an accident. That happened in both cases,
and it will happen again.
So I would like the main lesson to be that you provide to the
operators the kind of information, training, awareness, and what
have you, pay, perhaps, prestige, stewardesses, I don't know, that
makes it possible for them to function like airplane pilots, during
the course of an accident.
PAGENO="0135"
131
There is plenty of time. I think flexible response is the key to
keeping an accident from going far enough down the track to
threaten the public health and safety. For me, that is the central
lesson.
Mr. GOLDWATER. You are talking about the quality of the person.
Mr. LEWIS. No, the person and the stuff he has available; that is
to say, many people have commented on the fact that some of the
instrumentation was deficient, the parameter range wasn't large
enough to encompass accident conditions, there are no valve indica-
tors on specific things.
Many of my physicist friends have reacted to the accident by
saying that there should be an interlock on the two block valves
that were inadvertently left closed so they could not both be left
closed, there should be indicators on all the valves in the plant.
I don't think that makes any sense, but there should be an
analysis of the critical systems in such a way that one provides to
the operator the necessary indications to know what to do in the
event of an accident.
For example, I don't like to second-guess what the operators at
Three Mile Island did because I am aware that it is very, very easy
to do things well in retrospect and not so easy to do them in real
time.
But there were some deficiencies in correlating readings and
correlating indications which would have told them more about
what was happening in the plant than they seemed to have ab-
sorbed very quickly.
I would like to enhance the capability one way or another by
providing the instrumentation and training to make it possible to
do that. But I do believe that in the end, people are fairly intelli-
gent creatures and you have time in a reactor accident, and if you
make the information available you have a great weapon we
should use. It is hard toanalyze.
Mr. GOLDWATER. Maybe a parallel toward an automatic pilot on
an aircraft is a good analogy. An automatic pilot will fly that
airline, and does most of the time. But there is adequate instru-
mentation to provide the pilot and the engineer with knowledge of
what is happening to the aircraft.
Mr. LEWIS. That is correct. A good pilot---
Mr. GOLDWATER. However, when there is a problem with an
aircraft, say for instance the plane starts to wiggle its wings or
something, the pilot tends to kick the thing off and assume manual
control.
That appears to be what happened at Three Mile Island. I have
heard people say if they just let the emergency core cooling system
alone, that it would have shut down, taken care of itself. But in
fact, a human being intervened, much like the pilot on an aircraft
overriding or cutting out an automatic pilot.
Now, I am not so sure that is what you are saying, is it?
Mr. LEWIS. I am saying that; that is to say, the other thing that
the pilot of an airplane learns is to believe his instruments because
it is normal human response when an instrument indicates a mal-
function to not believe that it is happening to you.
He learns to believe his instruments. He also learns to correlate
his instruments; that is to say, he doesn't fix his attention on a
PAGENO="0136"
132
single instrument. You are right. A good pilot turns off the autopi-
lot when he is in trouble. But he correlates all his instruments, he
reads them, and he~ infers what is happening and does his best to
get out of it. It seems to me that that works pretty well.
There is a fairly deep-seated analogy between aviation and nucle-
ar power in my view from which a lot of lessons can be learned-
because aviation is an inherently risky thing which has become
acceptably safe.
Mr. MCCORMACK. Mr. Walker?
Mr. WALKER. Thank you, Mr. Chairman.
Dr. Lewis, you had mentioned in reaction to some questions of
the chairman that it was your personal opinion that the chance of
death in the general population resulting from a nuclear accident
was extremely small.
Can I ask you also what your personal opinion would be of the
chances of off-site property damage resulting from a nuclear acci-
dent? Would that be significantly higher? Is it also relatively small
in terms of some sort of calculated risk?
Mr. LEwIs. You know, to say that something is small or large is
not to say anything meaningful, because smallness and largeness
are in the eye of the beholder.
What I said in response to the chairman's question I hope is that
it is my personal view that the probability of an accident, of a
genuine major reactor accident, is lower than is contained in the
Rasmussen report. That would carry with it the consequences that
the probability of property damage is also lower.
But I base that almost entirely on the experience we have had
with the two major accidents, plus a fair amount of carryover from
aviation, that one will intervene in an accident and keep it from
getting too bad.
Mr. WALKER. That goes to the point I was going to raise. From
your standpoint, then, the Rasmussen study exaggerates the prob-
ability of an accident?
Mr. LEwIS. That is my personal view.
Mr. WALKER. OK. Now, given that background, we had a group
of Nobel Prize winners before the committee here a week or so
ago-not before this subcommittee, but before the full committee-
they were essentially nuclear advocates.
One of the things that they mentioned, that might be a good
idea, from the standpoint of the nuclear industry would be to
repeal the Price-Anderson Act. I bring this up to you because it
seems to me the kind of research that the Rasmussen study repre-
sents, to some extent your study represents, is also something
which applies not only to the nuclear industry, but also to public
policy decisionmaking.
In large part Price-Anderson and some of these things are built
upon that kind of research. So my question to you would be, if we
are exaggerating in those studies the foundation on which some of
these decisions have been built, would it be reasonable to consider
the repeal of Price-Anderson and have the industry assume liabili-
ty for any accidents that would involve the public?
Mr. LEWIS. I do not claim to be an insurance expert.
PAGENO="0137"
133
Mr. WALKER. I am asking you from the research standpoint.
Research is the foundation on which the insurance people are
basing their calculations.
Mr. LEwIs. Of course, I know all your Nobel Prize winners were
here. I also remember that Edward Teller at one stage in the
proposition 15 debates in California used to complain that if he
were immortal he could not get life insurance because there would
be no data base for determining the premium, and that was his
way of putting it. I am not an expert on that.
I would like to see the research directed at the places where
there are problems. I would like to see somebody go through all the
accident sequences in WASH-1400 and for each one-there are
really a finite number-say if this were to happen, do we have the
training and instrumentation to know how to keep it from going
all the way down to a core melt.
Perhaps if one did that, one might be able to put something
quantitative on my admittedly visceral feeling that one has exag-
gerated the probability of an accident.
Mr. MCCORMACK. Will the gentleman yield for one point.
I would like to make one point; that is, as a matter of history,
the Price-Anderson Act was enacted long before the Rasmussen
report was made.
It was enacted in the 1950's to protect small contractors, not the
big vendors, but the small contractors, so that they would not get
caught in second party lawsuits, or third party lawsuits.
What it did was require that the utility buy the maximum insur-
ance available in a pool. The later modification of the law, of
course, specifies that the industry provide contributions up to a
total of $560 million.
When the Rasmussen report was being done, those persons who
were trying to repeal the Price-Anderson law said just wait until
Rasmussen comes out, then we will use that to repeal Price-Ander-
son.
When it came out, reporting as it did, that the possibility of
death from a nuclear power accident was very low, then they
turned against the Rasmussen report.
I just want to get that little point in so we keep in perspective
the fact that in reality the Price-Anderson Act precedes by at least
a decade any of these studies, and it was there for a totally differ-
ent reason than the results brought out.
Mr. WALKER. I thank the gentleman for that clarification. What
I was simply trying to get at was the fact that the public policy
decisions that we are going to be asked to make in upcoming
months are very much based upon the kind of research that Dr.
Lewis has provided here and that has been provided earlier by the
Rasmussen studies.
I think it is extremely important that some of the people who
have had some experience with the research, and have knowledge
of it, give us their perspectives. This would let us make those
public policy decisions, maybe, exclusive of what is going on within
the technological elements of the nuclear industry.
I thank the gentleman.
Mr. MCCORMACK. I think the gentleman's point is very well
taken and I congratulate him for it.
PAGENO="0138"
134
Mr. WALKER. That is all I have, Mr~ Chairman.
Mr. MCCORMACK. Mr. Goldwater, do you have anymore ques-
tions?
Mr. GOLDWATER. I have one more.
I didn't quite follow, Dr. Lewis, your. analogy about the probabil-
ity of' risk or the risk of nuclear accident versus the risk of an
aircraft accident. You were making a point to the chairman..
Is there a higher degree of risk of a major aircraft accident than
there is, say, for a nuclear powerplant accident? Is that what you
were saying?
Mr. LEwIs. I don't remember which specific comment you are
referring to. The analogy, as I see it, is that in both cases you have
a complex system which. is very hard to analyze from the begin-
ning; that is, it is extremely difficult to analyze all possible aircraft
accidents from the beginning, too.
So that what we have in the case of aircraft that has made the
industry acceptably safe, although there is still some residual risk,
is a system by which we have a pilot up front who is well trained
in upset conditions, with redundant instrumentation devoted to
those conditions and with enough training on good aircraft and
simulators so that he can cope constructively with the course .of an
accident.
We also have a bureaucratic procedure in the best sense of the
word, not the worst, by which those few things that do continue to
happen are then analyzed to death and the learning from them put
back into the system.
Over the years, that has made aviation acceptably safe. I have in
other forums been recommending for years that something like an
NTSB structure be applied to the nuclear industry.
I might just comment that when this suggestion went over to
NRC about 6 months ago, one of their answers was, these people
wouldn't have anything to do because there aren't any accidents.
Perhaps it wouldn't be the same now.'
Mr. MCCORMACK. Thank you.
First of all, I want to thank these witnesses, and again thank the
witnesses from the earlier panel. The contributions that you have
made today, and the specific points that you have made, Mr.
Levine, about the need for future research, will be the basis for
future legislative action by this committee. We appreciate it.
We appreciate what you have contributed and we appreciate
again your contribution, and your perspective, Dr. Lewis.
I want to also thank the members of the French Parliament who
sat in today. We offered them a chance to ask questions, but since
none of the members themselves actually speak English, we decid-
ed to forego the pleasure, especially since it is getting late.
We want to thank them. We know that they will have questions
later On. In that regard, I am sure the witnesses will be glad to
answer questions in writing, either from us or from the French
Embassy.
Tomorrow, starting at 9:30, this committee will meet again, and
we will concentrate specifically on what happened at the Three
Mile Island accident.
We are going to see, first of all, a demonstration of a nuclear
powerplant, which will be here. It has been manufactured by the
PAGENO="0139"
135
University of Florida, and it has a high intensity heater system
with cooling systems built in. It is all made of Lucite, so we can
actually see standard operating conditions, the way it would be
with a partial meltdown, with the emergency core cooling systems
functioning and so on. We will actually be able to see it in oper-
ation.
We will also hear witnesses from Babcock & Wilcox, the vendors
for the Three Mile Island plant, from Mr. Herman Dieckamp,
president of General Public Utilities Corp., Mr. Harold Denton,
Director of the Office of Nuclear Regulation of NRC, Mr. John
Conway, president of the American Nuclear Energy Council, and
Hon. William W. Scranton, the Lieutenant Governor of the Com-
monwealth of Pennsylvania.
We will convene tomorrow at 9:30. We thank you all for your
attendance today. We stand adjourned.
[Whereupon, at 12:15 p.m. the subcommittee adjourned, to recon-
vene at 9:30 a.m., Wednesday, May 23, 1979.]
PAGENO="0140"
136
APPENDIX I
QuEsTIoNS AND ANSWERS FOR THE RECORD
C-E Power Systems Tel. 2031688-1911
Combustion Engineering, Inc. Telex: 9-9297
1000 Prospect Hill Road
Windsor, Connecticut 06095
~ .II~ POWER
SYSTEMS
June 22, 1979
Hon. Mike McCormack
Chairman, Subcommittee on
Energy Research and Production
U. S. House of Representatives
Suite 2321 Rayburn House Office Bldg.
Washington, B. C. 20515
Dear Congressman McCormack:
It is a pleasure to submit further information to the
Subcommittee on Energy Research and Production in the form
of answers to the questions you asked in your recent letter.
The answers are appended. I hope you will find them useful.
Sincerely yours,
)
~JJ. R. Dietrich
Chief Scientist
Nuclear Power Systems
JRD:jd
Enc.
PAGENO="0141"
137
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
Answers to questions from the May 22, 1979 Hearings on
Nuclear Power Plant Safety, by Joseph R. Dietrich
In answering questions 1 through 5, I must make it clear that in my testimony
on May 22 I was speaking of design reviews and studies, some of which are under
way and some of which were merely recommended. The substantive answers to
questions 1 through 5 must come from such reviews and studies. My recommenda-
tions are, therefore, as to what should be studied. Here I can only give examples
of changes that have a potential for enhancing safety. Moreover, as I pointed out in
my testimony, any proposed design change of substantial magnitude must be given a
very thorough engineering review on a systems basis before it is made, to assure
that it does not, while improving safety under one set of circumstances, degrade
safety under other circumstances.
Ouestion 1
Discuss the design changes or modifications and the procedural changes
that you would recommend to minimize the frequency of occurrence and
the speed of development of the operational perturbations mentioned in
your testimony.
Answer
This class of improvement would be accomplished primarily by design changes.
Some possibilities to be considered might be additional pressurizer volume to sim-
plify the maintenance of primary system water inventory; anticipatory reactor trips
(e.g. trip upon loss of normal feedwater flow as well as on low steam generator
water level); generous water inventory in the steam generators to increase the time
available to restore feedwater flow in the event it is lost; and, possibly, multiple
relief valves of smaller size, with graduated pressure settings, to minimize the flow
out of the primary system if the transient causing a relief valve to open is a minor
one. In the latter case the relief valves would of course have block valves in series
to be used in the event that a relief valve failed to close at the proper time.
I am sure that there are many more possibilities, but they must be sought out
by examining each transient that might occur and looking for design changes that
would decrease its probability or its severity. Most design changes that would fall
into this class would be impractical to implement on existing plants: consequently
an investigation of these possibilities would have its major application to new, rather
than existing, plants.
PAGENO="0142"
138
Answers to Questions - J. R. Dietrich
Question 2
What design changes or procedure changes would you recommend to
improve the defense against lesser accidents that you referred to in
your testimony?
Answer
This again is a question that can be answered only by extensive study and
analysis. For the immediate future my only suggestion is that we give more atten-
tion to the lesser accidents in our safety analyses of nuclear plants, and more
attention to the possible interactions between the operator and the plant. The initi-
ating events at Three Mile Island would have been classified as constituting a small'
accident in safety studies in the past, yet they were escalated into a major accident.
Greater attention to the possible consequences of "small" initiating events should
lead to improvements in design and operator education which will greatly reduce the
probability of such escalation in the future.
Questions 3, 4, and 5
3) Provide details of the improvements in communications and the man-machine
interface that you suggested in your testimony.
4) Provide details of the means of simplifying the interpretation of instrument
readings, together with your recommendations for displaying abnormal
readings.
5) Discuss and provide recommendations for means of using computers or
microprocessors to enhance the power plant operator's ability to recognize
abnormalities.
Answer
Questions 3, 4, and 5 apply to closely related subjects, and can best be dis-
cussed together. I could respond at great length to these questions because they
cover a specific field in which Combustion Engineering has been carrying out de-
velopment for several years. I cannot do that, however, without producing a dis-
cussion which sounds like an advertisement for the Combustion Engineering advanced
control system, and I believe that to be inappropriate in a document which may appear
in the public record of your committee's deliberations. I will therefore answer
briefly, and attach, for your further information, a document describing the Com-
bustion Engineering development, which was prepared by Mr. John E. Myers,
Director of Systems Engineering, Nuclear Power Systems.
The operators' performance can be improved by two design techniques:
- Human engineering of the operator's interface with the power
plant to optimize his comprehension of the status of the plant
processes.
PAGENO="0143"
139
Answers to Questions - 3. R. Dietrich
- Optimization of some of the routine tasks to give the operator
more time for concentration on the more important aspects of
his job.
Human engineering encompasses the reduction in complexity of the informa-
tion presented to the operator and optimization of the method of data presentation.
Complexity can be reduced by combining several instrument outputs to yield the
information which is of direct concern to the operator. For example, reactor
power level and power distribution measurements can be combined to present to
the operator the maximum linear power density in the reactor fuel, one of the
quantities upon which operating limits are imposed. Or reactor power, power
distribution, coolant flow, coolant temperature, and reactor pressure data can be
combined to determine the margin available to the limit on departure from nucleate
boiling. A major step toward optimization of data presentation can be made by the
effective use of cathode ray tubes. These displays can take the form of printed
statements, numerical data, graphs, or simplified system diagrams. In arriving
at the optimum display one must take into account such things as the use of colors,
the symbolic format, the physical orientation of the display, the information density,
and the techniques for updating the information and displaying trends.
A number of routine tasks of the operator can be automated, but perhaps the
most important area of automation is in the surveillance of the operability of the
plant safety systems. A system can be designed, for example, to monitor the
alignment of pumps and valves to assure that a given safety system is always ready
to perform its function if needed. Misalignment can be enunciated for the operator
and the misaligned components identified. Computer based systems can also be
designed to assist the operator in the alignment of pumps and valves for periodic
actuation testing, and to assist in the realignment into the "ready" condition after
the test has been completed.
Question 6
Discuss the need for a "Swat Team" composed of people from industry,
the utilities, NRC, etc.
Answer
I believe that a team of general nuclear experts, available to respond quickly
in an emergency, would be very helpful. It should be composed of people chosen
for the depth and breadth of their knowledge in the pertinent areas of nuclear plant
design and operation, and should serve in an advisory capacity. I do not think it is
advisable to have an outside team, whatever its composition, "take over" the oper-
ation of a plant that is in trouble.
The formation of teams, however, is only part of the necessary preparation
for emergencies. Attention must be given to defining the roles of the teams, and
to providing those things necessary for the team to do its job: working space;
effective means of communication, both with theplant that is in trouble and with
the home offices of the members of the team; adequate drawings and other design
PAGENO="0144"
140
Answers to Questions - J. R. Dietrich
data on the plant in question; reference books, related library facilities; etc.
These and other aspects of emergency response are receiving concentrated
attention from the Emergency Response Subcommittee of the Atomic Industrial
Forum Policy Committee on Follow-Up to Three Mile Island.
Question 7
What are the advantages and disadvantages of standardizing the design
of nuclear power plants? What would be the attitude of equipment
manufacturers and plant constructors to standardization?
Answer
I believe there are great advantages, with respect to safety, reliability and
economy, to standardizing the design of a nuclear system produced by a given
manufacturer or constructor. Complete standardization of this kind proves diffi-
cult in practice, however, because of changing licensing requirements and because
of the problem of interfacing the NSSS design with the balance of plant design,
which varies from one constructor to another. Nevertheless, I believe the degree
of standardization that has been achieved has proved its value.
Standardization in the sense of a common design for all manufacturers and
constructors is quite a different matter. With regard to acceptance of the idea by
system suppliers and constructors, I can only guess. If the concept had been pro-
posed in the very early stages of nuclear power development it might very well
have been accepted, but I can see great complications in implementing it today.
Each NSSS vendor has spent many millions of dollars developing his designs, and
each, no doubt, considers his the best. I believe there would be great reluctance
to eliminate competition from the design process. Moreover, in a standard design,
some design features would no doubt be selected from one supplier and some from
another. How would one ever settle the question of who pays royalties to whom,
and how much?
My own opinion is that a standard design of this kind would not be a good idea,
for the following reasons.
- Presumably decisions as to the standard design characteristics
would be made by some government agency. The government
would, in effect, be designing the plant. I do not believe this is
the way to arrive at either an economic plant or the safest plant.
- The addition of and improvements within safety systems has been
and will continue to be an evolutionary process as designs change
and knowledge grows. I am afraid this process would stagnate under
the standard design concept.
- If all suppliers and constructors worked to a common standard design
there would be no incentive to maintain the large, highly skilled design
teams that exist today. We would lose our most valuable resource for
safe deign and for recovery from accident conditions.
PAGENO="0145"
141
Answers to Questions - J. R. Dietrich
- The design depends not only on how the components are put together,
but on the components themselves: we would have to have standardized
component designs as well as standardized system designs. I would
expect that the number of sub-suppliers of items like pumps, valves,
and motors would decrease if all had to manufacture to a common design.
The nuclear business is not large enough for such sub-suppliers to
justify re-tooling to a new design. Thus competition would decrease
and along with it the pressure to supply reliable equipment.
Question 8
Should there be a standard design for control rooms and for the layout
of control panels?
Answer
As is often the case, standardization of control room design and layout would
likely be a mixed blessing. However, a certain level of standardization could
probably be adopted which would yield most of the desirable effects, while mini-
mizing the undesirable ones.
It seems reasonable that if the monitoring, control, and protective needs of
power plants are similar, then the general layout of instrumentation and controls
within the control room should also be similar. The arguments for this conclusion
include:
If there is a truly optimum design approach it should be used
generally.
- Given standardizationof general control room layout, more of
the various design efforts being pursued would couple synergisti-
cally rather than being incompatible.
- Operations and other essen.tial workers could more quickly per-
ceive the nature of operations within a control room with which
they were unfamiliar.
- Operator training would be simplified.
However, the case for standardization deteriorates quickly when specific
design features of the panels and consoles are considered. We are faced simul-
taneously with rapid development of electronics-oriented technology, and an
information processing task within the power plant which makes use of this tech-
nology seem virtually mandatory. One of the clearest lessons from TMI, the need
to inform the operator better, is best pursued by the use of advanced electronics
technology. Standardization of detailed design features would be extremely diffi-
cult to achieve at any point in time, and even if achieved, could be expected to
inhibit design improvements.
48-721 0 - 79 - 10
PAGENO="0146"
142
Answers to Questions - J. R. Dietrich
In summary some level of standardization of control rooms for similar
power plants appears to be a desirable objective. The first step, however,
should concern itself with the issue of drawing the line between general layout
issues (where gains can be achieved), and specific design issues (where
standardization could prevent or delay needed improvements).
Question 9
How should the design of the control room be improved?
Answer
Given the development of generalized control room layout standards as
discussed above, the potential for remaining improvement lies principally in
two areas:
- Presentation of measured data to the operator, and
- Correlation and analysis of measured data for the operator.
A common objective underlies both areas; i. e., facilitation of an accurate
perception of plant status by the operator.
Considerable effort over a number of years has been directed toward im-
provement in these areas. The promising approaches are those cited in the
answers to questions 3, 4, and 5.
Question 10
Do you believe that additional water in the steam loop of a PWR would
enhance reactor safety, and if so, how much additional volume?
Answer
Additional water inventory in the secondary loop of the steam generator in-
creases the time available to restore feedwater flow once it has been lost. Clearly
one will reach a point of diminishing return with respect to safety once the water
inventory has been made large enough to forestall the need to restore feedwater
flow for several minutes. I believe many of the plants now operating with recircu-
lating steam generators have water inventories large enough that further increases
would not provide a worthwhile increase in safety. However, I have not yet seen
a formal analysis of this question. Once such an analysis is made judgements can
be made with respect to individual plant designs.
Question 11
Do you believe two steam generators are adequate for a 1000 MWe plant?
If not, how many generators would be appropriate to enhance safety?
Answer
I believe that two steam generators, if properly designed ano constructed,
are adequate for plants of capacity up to the maximum licensable under current
PAGENO="0147"
143
Answers to Questions - J. R. Dietrich
NRC rules (3800 MWt, corresponding to about 1300 MWe). From the point of
view of redundancy of shutdown heat removal capability two steam generators
are as acceptable on a 1300 MWe plant as on a 600 MWe plant. In absolute terms
I believe that this redundancy is adequate, since operation is not permitted if
there is substantial degradation of steam generator integrity. The only postulated
transient I know of whose amplitude is larger in the case of two steam generators
than in the case of a greater number is the steam line break accident. The effect
to be countered is an increase in reactivity due to the cooling of the primary system
water: this is accomplished by dropping the control rods. The somewhat greater
reactivity swing which characterizes the two-steam-generator case is not impor-
tant if adequate control-rod reactivity worth is provided, as it is. Again, the power
capacity of the plant is not an important factor-a large plant with two steam gen-
erators behaves much the same as a small one under steam-line break conditions.
Question 12
Although it has nothing to do with TMI, what is your professional opinion
regarding the potential for a reactor to run "out of control" if the fluctu-
ation in nuclear fission activity should begin to oscillate in sympathy with
mechanical vibrations or temperature deformations in reactor components?
Answer
I believe there is essentially no potential for a reactor to run "out of control"
through sympathetic oscillation. The only coupling between reactivity and mechan-
ical vibrations or deformations of components outside the core would be by way of
the moderator temperature coefficient of reactivity. That coefficient is not large
enough to produce large reactivity swings under any circumstances of mechanical
vibration or deformation that I can imagine. Moreover, the negative Doppler co-
efficient of reactivity provides a very strong damping factor against reactivity os-
cillations. Finally, the period of any sympathetic reactivity oscillation would be
several seconds long because of the thermal time constant of the reactor fuel and
because of the transit time of water around the primary circuit. Consequently the
control rods would have ample time to shut the reactor down following a reactor
trip on high power level, even if a large amplitude oscillation could occur, and I
believe a large amplitude oscillation is impossible except as a result of xenon
fluctuations which are extremely slow, with periods of several hours.
Question 13
What is your opinion of a reactor control system that could be interrupted
with a simulated accident problem without the operators knowledge? (During
this period, the reactor would be operated by a computer and if during that
time a real problem arose, the simulated problem would be automatically
dismissed.)
Answer
The use of such a reactor control system would lead to undesirable conse-
quences. The only benefit would seem to be that new data would be collected on
the performance of individual operators under stressful conditions. There are
two strongly negative factors: first, operator response to an actual accident might
PAGENO="0148"
144
Answers to Questions - J. R. Dietrich
be degraded; and second, some degradation in reactor control system reliability
would be expected due to the substantial increase in system complexity and equip-
ment sophistication.
Moreover, operational experience during transient conditions has shown
operators to be relatively calm under stress. Errors seem to most often result
from either the inability to properly interpret the data presented, or from an im-
perfect understanding of the consequences of specific actions. We would expect
the error probability to be particularly high during the course of a real accident,
if it were to interrupt a `simulated accident' of a different nature-the sequence
of simulated and real behavior would be highly confusing to the operator.
Question 14
Regarding the man/machine relationship, what are the pros and cons in
operating a reactor from a small control console where status and trend
data can be read on a terminal on command.
Answer
Operation of the reactor from a relatively small console is both achievable
and desirable. Console size would necessarily be larger than a single terminal
to avoid completely unacceptable information density. For example, the master
control consoles in some recent C-E plants are U-shaped and sized to mount ten
cathode ray tubes. This results in approximately a 14-foot span between
wings. Controls for plant operation from hot standby to full power operation are
located on this console. During accident situations, total plant status information
is available from the console, but auxiliary panels within the control room may
house the necessary controls for actuation of appropriate plant equipment.
PAGENO="0149"
145
J. E. Myers
SYS-A-0l3
June 19, 1979
Page 1 of4
* INFORMATION PERTINENT TO QUESTIONS 3, 4, AND 5
Operation of a commercial nuclear power generating station requires the
surveillance of several thousand pieces of instrumented data. The station
operators are responsible for providing this surveillance and for making
control decisions based upon this data in a safe, economic manner.
Technological tools are available within the "state of the art" to reduce
the complexity of the operators surveillance tasks and to enhance the
operator's comprehension of the data. Technology is not available to
replace the operator in the overall plant control/decision making role.
The human brain, with its unique abilities to learn and to extrapolate,
is required to effectively monitor and control the complex, interrelated
processes of a nuclear power plant.
There are two key areas where current technology can improve the operators
performance:
Human engineering of the operator's interface to the power plant
to optimize the operator's comprehension of the status of the
plant processes.
Automation of certain elements of the routine daily tasks to free
up the operators time to concentrate on the more important aspects
of his job.
HUMAN ENGINEERING
C-E has performed research on the human-engineering aspects of the oper-
ator- process interface. In its studies C-E concentrated on two basic
areas: the reduction in the complexity of the information presented to the
operator, and in optimization of the method of data presentation to the
operator.
Reduction in Information Complexi~y~
The goal of reducing information complexity is one of reli~y "condensing
several instrumented data points into a single index that provides all of
the pertinent information on the actual plant parameter of interest. This
goal is achieved in a two-step process. The first step is to systematically
analyze the various processes of the plant to determine candidates for
condensation. The second step is to impl~ment a scheme to reliably automate
the "condensation" process.
PAGENO="0150"
146
J. E. Myers
SYS-A-0l3
June 19, 1979
Page 2 of4
An example of this condensation process is the Core Operating Limit
Supervisory System (COLSS) that is implemented on recent C-E plants.
COLSS is an integrated reactor core supervision system that is
implemented in a digital computer. COLSS monitors several hundred
measured process parameters and condenses these measurements into
three easily understood performance indices that are displayed and
alarmed to the operator on-line, in real time.
AnOther example is the hierarchical display and alarm system that is
the major operator interface in C-E's most recent control room
designs. In this hierarchical arrangement, all plant systems are
categorized in a hierarchy that parallels the operators s hierarchy
of tasks. This system is impiemented with multi-color cathode ray
tudes (CRTs) and digital computers.
The three tier hierarchy has at its top level a monitor display.
This monitor display provides a condensation of the status of all
subsystems and components in a major plant process. Alarms and
anomalies on a lower tier trigger alarm behavior on the monitor
level that highlights the affected system, and cues the operator
automatically to the next lower tier display that provides greater
detail on the alarm situation.
On the next tier below the monitor display are the control displays.
Each of these displays contain the information required to effect
control of a major plant process or component. Data related to the
control evolution are also displayed for operator convenience. The
control displays also provide a level of information condensation.
Component symbols provide alarm behavior based upon the status of
a number of measured data points represented at the lowest level of
the hierarchy. The operator will receive an automatic alarm cue to
the next lowest level if pertinent alarm information is contained
there.
The diagnostic displays reside at the lowest level of the hierarchy.
These displays contain all the information that is monitored on any
particular component or subsystem.
The operator can maneuver vertically through the display hierarchy,
"zooming in on a problem; orlaterall~/ through the hierarchy,
scanning related systems and processes. The operator can also jump
directly to any display in the hierarchy without traversing the
intermediate displays. The operator interface device for display
selection is a simple keypad, similar to a pushbutton telephone from
PAGENO="0151"
147
J. E. Myers
SYS-A-0l3
June 19, 1979
Page 3 of 4
which he can easily traverse the hierarchy, assisted by the automatic
computer cueing.
Optimization of Data Presentation
C-E's research has indicated that a critical element in improving
operator performance is in tailoring the presentation of displayed
data to human characteristics. Computer technology has provided
flexibility in information encoding techniques that allow the
presentation of data to be optimized to both the operator and the
specific task he is expected to perform.
In C-Es studies, color, blink, symbolic format,
physical orientation on the display, and information density and
update technique are all used to encode display information to in-
crease the operators comprehension and performance. The system is
designed to highlight color abnormalities and anomalous readings by
changing the shape and format of the data when the reading reaches
a preset limit. C-E studies have shown that a great amount of
information can be condensed into a single display. However, these
studies indicate that reduction of all necessary information into one
display is not practical with current methodology or technology. A
great reduction of necessary display area is possible, and is the
cornerstone of our most recent control room arrangements.
These state-of-the-art control room arrangements address many human
engineering factors in addition to those related to CRT displays.
The design methodology includes consideration of criteria on such
variables as maximum distance between any two control functions,
minimum distance between separate control devices, viewing angles,
number of operators ~required (normal operation, startup, shutdown,
and accident conditions), and access by non-operator personnel.
Panel layout concerns such as functional groupings, symbols, left to
right organization (heat source to heat sink in current designs),
and color representation have been addressed and standardized where
practical. In most of these areas, human engineering factors are
adequately defined and may be implemented in a straight-forward
fashion. Another area that has received additional attention is that
of `seldom used controls". These are the controls the operator might
be required to use in an accident or other abnormal operating con-
dition. Methods to better guide the operator in these situations are
incorporated in the design of the panel layouts and the related data
presentation.
PAGENO="0152"
148
J. E. Myers
SYS-A-Ol 3
June19, 1979
Page 4 of 4
All of these factors must be integrated into the control room design
process in order to obtain the maximum advantage from computerized
information processing and display systems.
AUTONATION
The second key area of potential improvement in operator performance is
the automation of selected tasks to remove some of the surveillance
burden that the operator is required to perform.
The most pertinent area of automation is that required for surveillance
of the operability of the plant safety systems.
,-E is implementing a system to monitor the alignment of pumps and
valves in response to NRC Regulatory Guide #1.147. This system will
provide annunciation to the operator if misalignment of an instrumented
pump or valve occurs. We are also developing a computer based system
to assist the operator in alignment of pumps and valves for periodic
actuation testing. This systemprovides positive indication of-correct
system alignment for test and positive indication when post test
realignment is achieved. Hard copy test documentation is then produced
of test results and correct system alignment.
C-E has implemented systems that automatically monitor the status and
operability of the Reactor Protection System. When problems are
detected, annunciation is provided to alert the plant operations staff.
However, restrictions placed on the implementation of these systems by
interpretations of existing regulations has had the effect of stifling
industry impetus to develop these automated monitoring systems. A
more realistic approach in the NRC evaluation of the safety significance
of.these systems is required.
PAGENO="0153"
149
(RI Displays for Power PlanEs
M. M. DANCHAK
Combustion Engineering, Inc.
DISPLAYING POWER PLANT data on multi-
colored, computer driven CRTs provides the poten-
tial for raising operator-machine interfaces in
these plants to new heights. The amount of detail
and flexibility inherent in color CRT displays
promises better and more timely information.
However, the mere existence of such promises
adds little to a power plant control room. The
critical task is the exploitation of this potential in
an intelligent manner. Technology has removed
many constraints from the machine portion of the
interface. Equal effort must now be placed on the
human aspects.
Although the eye can sense all the information on
a CRT face, the brain cannot begin to act on that
amount of detail. Some mental processing must
take place before any information can be entered
into human memory. This usually involves some
form of feature extraction and/or pattern recogni-
tion on the operator's part to encode correctly the
information for internal storage in short-term
memory. Such storage is the initial step in display
comprehension.
To aid this mental process, a determined effort
must be made to keep each display as clean and
unobstrusive as possible. This effectively reduces
Color CATs with graphic capabilities certainly
have complicated the task of display design. De-
signers now have to worry about color assign-
ments, contrasting, symbols, blinking and a host
of other variables. The author offers guidelines
for effective color CRT display design, concen-
trating on the human factors aspects of various
techniques.
the noise level of the display and consequently de-
creases the human search and processing time re-
quired for information detection and comprehen-
sion. An effective display should not require any
conscious effort for analysis on the part of the oper-
ator. He must be able to immediately grasp the
situation and take appropriate action.
A designer of CRT displays that satisfy these
criteria must have a thorough understanding of
the power production process, display techniques
and, most importantly, the operator. Such total
understanding is seldom found in a single indi-
vidual. This article offers guidelines that permit
users, who are familiar with power plant operation
but not specifically knowledgable in display tech-
niques, to create effective CRT displays.
Performance parameters
Optimization of operator performance entails an
appreciation of the variables that influence an op.
erator and variables that can be influenced by a
display designer. Operator performance has been
defined (Ref. 1) as a function of several variables:
* complexity of information
* operator tasks
* operator characteristics
* environmental factors
PAGENO="0154"
* type of information displayed
* density of information
* method of presentation.
150
Although all of these may impact operator perform-
ance equally, the degree of influence a display de-
signer has on each variable is very subjective.
Figure 1 illustrates the grouping of these variables
in power plant applications. Typically, the opera-
tor is required to monitor large numbers of dis-
crete parameters. The complexity of information
and operator tasks are predetermined and there-
fore not under the control of the display designer.
Likewise, he has little or no input in determining
operator characteristics or environmental factors.
The designer does, however, have a large and often
sole impact on the remainder. He must decide
what to display, how much of it to display, and the
most effective format in which to present it so as to
maximize operator performance.
Operator tasks
Analysis has shown that the operator is involved in
three major tasks: monitoring, control and diagnos-
tic. Unfortunately, these areas are too broad to
base guidelines upon, since each entails many sub-
tasks. Five tasks, however, have been identified
(Ref. 2) that appear basic to CRT display reading
and may be appropriated to serve as generic sub-
functions. These five tasks are: identify, search,
count, compare and verify. Table I illustrates
their meaning in the context of the power produc-
tion process and lists them in descending order of
frequency.
The search task is performed at all times, since an
operator is never concentrating solely on the CRT.
He must find the target before processing the infor-
mation according to one or more of the other tasks.
Identify, the simple act of recognizing the target,
also is required in all instances. It is often difficult
to separate search and recognition tasks, since
both are involved in bringing the operator's atten-
tion to the correct target. Only after successfully
completing these functions can he begin to process
the information. Processing then involves the tasks
of comparison, verification and counting.
This implies that a designer should optimize the
display for search and recognition and then satisfy
criteria for the remaining tasks. This is a restate-
ment of requirements for a "clean" display men-
Not under control of display designer
htrumented L_
Poramete~~f
~~oity of kerator~~~I ,/
information j ~ /
/
[~operator I /
Icharacteristi~I /
I /
Ennironmentall
factnrs I
/ [i~hodof I
/ PmentatIOfsj
/
/
/
/_______ ________
/ ~Type of* I Eó~nsity
Information I of
/ disptaye~j information
J Operator
1 performanc~j
Figure 1. Of the seven variables
than affect operator performance.
only three are under the direct
control of the display designer.
To generate an effective display,
however, the designer must take
into account those variables over
which he has no control.
Under control of display designer
PAGENO="0155"
151
tioned previously. Regardless of how important a
parameter is, it becomes noise when the operator is
looking for something else. Anticipating operator
needs is an extremely difficult assignment. One is
more inclined to use the saturation approach-dis.
play everything. But this is self-defeating in the
long run. The primary maxim of effective display
design is to give the operator what he needs, only
when he needs it.
Informative coding
Information displayed on a CRT is often coded ac-
cording to various schemes. The English alphabet
represents a coding scheme in that an entire con-
cept may be represented by one or more letters.
Numerics is another example of coding in which
quantities are depicted by a string of digits. Sym-
bology is a third example, where unique arrange.
ments of lines and curves depict pumps, valves,
transistors and other components. The question
here is how to best code information to accomplish
a given task. Since the definition of information is
"knowledge that was not previously known," many
items such as labels do not necessarily qualify at
all times.
Human factors literature abounds with treatises
on abstract coding methods (Ref. 3) that use single
letters, digits, shapes or colors to depict complex
ideas. While much of this data is directly appli.
cable, a large majority must be treated cautiously.
A random string of alphabetic characters such as
"uppm" may be used abstractly to represent the
concept of a device that transfers fluids by suction
or pressure. One may use this coding scheme to ob.
thin search and identify task response times. A
rearrangement of these letters to form the string
"pump" would result in quite different times due
to operator familiarity. The point is that each area
of application has its own convention and coding
biases that are not abstract. Human factors re-
search provides excellent data that must be judi-
ciously extrapolated to individual areas of concern.
Such an extrapolation yielded five applicable cod.
ing methods: numeric, textual, shape, color and
blink. Although these agree in philosophy with
basic human factors definitions, some modifica-
tions were made. Numerics refers to digital strings
representing some measurable value of a parameter
such as temperature or pressure. Textual coding
connotes alphanumeric strings arranged to form a
meaningful word or words common to the power
production process. Logical abbreviations of words
also qualify under this scheme. Shape encompasses
standard power process symbols (pumps, valves)
as well as geometric objects (bars, columns). Color
and blink have been shown to be most effective
when used as redundant codes (Ref. 4-6). This
means that color and blink should be used to rein-
force information coded by other means, such as
blinking a pump symbol in an alarm color.
Figure 2 is a summary of recommended coding
schemes for power production CRT displays. Each
task has associated recommended coding methods
indicated by a checkmark. Compare, verify and
count tasks are further subdivided into "check"
and "read." A check subtask is one that has a dis- -.
crete number of status states (on/off, open!
closed), whereas the read subtask has variable
states, such as the value of a fluid temperature.
Reading involves more mental processing since
Figure 2. A variety of coding methods are available,
but some methods are more suitable for certain oper-
ator tasks than others. Recommended coding meth-
ods are indkated by an "x", while the asterisk indi-
cates redundancy.
Table I: Operator Generic Subtasks
Subtask Question type Example
Search Wherein? Where is the
flashing symbol?
Identify What is? What does the flash-
ing symbol represent?
Compare Yes/No Istheflowequal in
both coolant loops?
Verify True/False The oil lift pump
has been actuated
Count How many? How many valves are
open in the letdown
PAGENO="0156"
152
people have a tendency to "vocalize" what they
read. Perceiving a status does not require this
translation.
Test and shape coding should be used for the
search and identify tasks. Successful completion of
these tasks results in focusing the operator's atten-
tion on a specific portion of the CRT-they do not
involve processing the information located there.
A pump symbol, perhaps with amplifying text,
easily allows the operator to find the correct pump
on the display. Likewise, the name of a parameter
will accomplish these tasks provided the operator
knows what he is looking for, as in an operator
initiated search. Computer initiated searches
occur under alarm conditions, when a parameter
has exceeded its accepted value and the operator
must be informed. In situations such as this, color
and blink are at their best since attention-getting
is required.
The status checking subtask is similar in compar-
ing, verifying or counting tasks. Since only a small
number of possible states exist, status checking is
quick and requires simple coding methods. A sym-
bol that has few possible configurations is ideal in
this case, particularly when color is used to rein-
force the status message. For example, a circle with
the circumference colored may be used to indicate
one state while the same circle with both the cir-
cumference and interior colored indicates another.
A unique color for each state further enhances the
concept.
Reading subtasks require the acquisition of very
specific information from a large number of possi-
bilities, such as one temperature out of a possible
range of hundreds. Within the context of informa-
tion theory, this represents more information than
a status check. Hence, one must pay the price of
Table II: Recommended color codes
more lengthy processing. The only feasible means
of coding this information is numerics. Once the
information is assimilated, the operator performs
his comparison, verification or counting. It should
be emphasized that color is not used as a code in
relation to these tasks. The color of the numerics
may change to indicate an alarm, but this is done
to aid the search task. Legibility and contrast are
the only color considerations and do not constitute
coding in the real sense.
Colorful conventions
As mentioned earlier, the display designer must
conform to conventions in the application area to
make coding easier. Numerics, text and shapes
should be familiar to the operator. What may seem
unnatural in one application may be perfectly
logical in another. This is particularly true for
color coding.
Red and green are often used in the power industry
to indicate on and off respectively. This poses a
problem for the display designer because he may
think of red as a danger color. Does he use red to
indicate both conditions, does he select a different
color for danger, or does he try to change the con-
vention? How does he reconcile this in light of
proven human factors data? This problem may be
alleviated if he remembers that he too has been
biased. Everyday life has programmed him to re-
spond to red as danger just as the operator's job
has trained him to respond to this color as "on."
The operator may function under a double stand-
ard, red meaning "on" while operating the plant
and meaning danger while driving his car. Chang-
ing the convention or using the same color for both
conditions will surely introduce confusion. The
criteria for alarm colors is that they be unique,
logical and fit within existing standards.
Color CRTs further compound the problem in that
any item drawn on the screen must be in some
color to be perceived. Table U represents onesolu-
tion for a color CRT that accounts for prior con-
ventions, search criteria and legibility require-
ments. Black is the unactivated screen color and
serves as a logical background. Dark blue lies far
below the eye's spectral sensitivity peak and may
be difficult to perceive when the eye is stimulated
by other colors on the CRT. This is used to advan-
tage for labels and other purely advisory status
items. If the operator wishes to read the label asso-
ciated with a variable, it becomes information.
Otherwise it is noise. The poor contrast of blue on
black reduces the noise impact but still allows the
label to serve as information when the operator
focuses on it. Cyan (light blue) has a contrast ratio
close to white but avoids the greater stimulus from
the longer wavelength components of white. The
PAGENO="0157"
153
corresponding legibility of cyan makes it applicable
for numerics and alphanumeric text that always
contain information.
Red and green retain their conventional on/off
definitions while white is used as an intermediary
between the two. Thus a variable speed pump sym.
bol would be colored green when off, red when fully
on, and white when partially on. Yellow and ma-
genta provide logical alarm colors as well as excel-
lent contrast with black for portrayal of necessary
alarm information. Also, their uniqueness aids the
search task.
Blinking should be used only for attention-getting
in the search task. A single blink rate between 2
and 5 Hz should be used in all instances and the
number of items blinked at a given time must be
held to a minimum. The attention-getting value is
greatly diminished when more than one display
area is blinking. Also, blinking degrades legibility,
making value reading difficult (Ref. 7). If the
parameter value is blinked for attention-getting,
some means must exist to stop the blink prior to
processing that value. An acknowledge function
satisfies this criterion nicely by allowing the oper-
ator to respond prior to evaluating the information.
Otherwise, blink the area near the parameter, but
not the value itself.
Overloading the screen
Information density involves determining how
much data can be placed on the screen before the
amount begins to adversely affect the operator's
ability to perform his basic tasks. Ideally, one ex-
pects a single information/unit area figure based
on a detailed information theory analysis. In the
practical world, there are too many variables to
make such a figure useful and one must settle for
intuitive results tempered by psychophysical data.
Advice given in this section assumes a 19-in. (48.26
cm) diagonal CRT located 28 in. (71.12 cm) from
the operator. The span between the operator and
the CRT is the optimum viewing distance for a
CRT of this size (Ref. 8) and within the operator's
reach (Ref. 9).
The cleanliness of a display determines the opera-
tor's ability to successfully perform his search and
identify tasks. When he scans the display for a
specific parameter or target, all other information
on the screen is noise. It is intuitively obvious that
an upper limit exists on the amount of active
screen area. Quantifying this is another matter.
Experience shows that display loading (the per-
centage of active screen area) should not exceed 25
percent. This may seem extremely low until one
considers that a well-designed page of printed
material has a loading of only 40 percent (based on
the author's analysis of the journal cited in Ref. 1).
An analysis of existing CRT displays that were
qualitatively judged "good" revealed a loading on
the order of 15 percent. The remaining area consti-
tutes "white space" that is essential for clarity in
any display. Furthermore, the amount of variable
data on these displays never exceeded 75 percent
of the total active area. The product of these limits
dictates that no more than 18.75 percent of the
Figure 3. Textually coded infor-
mation should never exceed 12
60 - characters, because it is difficult
for an operator to comprehend
that much information at a glance.
5C I I Important information, such as
0 2 4 6 8 0 12 4 6 numeric values, should not cx-
Number of choroclers ceed four characters.
t 80
~O 70
PAGENO="0158"
154
screen should contain information of continued
interest to the operator.
Density within the display is also an important
coneideration~ One would like to know the maxi-
mum number of characters, the appropriate sym-
bol size, and proximity to other information areas.
The average visual angle for central foveal vision is
quoted at 5 deg (Ref. 10). Stated more clearly,
when one fixates on a point, one sees information
within a 5-deg solid cone to 50 percent accuracy.
This 5-deg angle is also called the "span of atten-
tion" and is an important parameter that has
great impact on display design.
Figure 3 illustrates the practical application of
this psychophysical fact. The operator's attention
span translates to 2.44 in. (6.21 cm) measured on
the screen face. A survey of various display vendor
data indicates that the average character width,
including allowance for character spacing, is ap-
proximately 0.2 in. (0.5 cm). When arranged hori-
zontally, 12 characters can fit within the 5-deg
cone. Hence an operator can see a maximum of 12
characters at a glance. To improve accuracy, tex-
tually coded information should not exceed 6
characters, although labels can be up to 12.
Numerics usually require more accuracy since
they are heavily laden with information. Therefore,
numerically coded information should never exceed
4 digits without good cause. This produces an aver-
age reading accuracy of 90 percent without being
overly restrictive. In all cases, the horizontal ar-
rangement of characters is preferred to the vertical
(Ref. 11).
Since the span of attention defines discrete areas
of the CRT, it is advisable to have each area con-
tain only one piece of information. One would want
to separate fixation points of different parameter
values (i.e., pressure and temperature) by 2.44 in.
(6.21 cm) so the operator sees one idea with each
glance. Likewise, two parameters that are consis-
tently compared should both fall within the same
span. This explains why the best arrangement for
comparison is the columnar form.
To minimize the number of characters in a word,
abbreviations can be used when necessary. If an
accepted abbreviation does not exist, one can be
fabricated using the concept of masking and/or
vowel deletion. The first and last few letters of a
familiar word are seen more clearly than interior
characters. This is predominantly due to the
proximity of white space on either side of these
letters while the interior is effectively masked by
other letters. Within the context of the power
production process, TEMP is an accepted abbre-
viation of "temperature" while masking can be
applied to "boiler" to yield BOLR and still retain
the meaning. Another technique of abbreviation is
to delete vowels, as in "condenser" and CNDNSR.
(Caution: Such abbreviations should be tested
prior to their use.)
A final point deals with the placement of informa-
tion on the screen. When the operator turns his
attention to a specific CRT, his initial fixation
point naturally falls at the center. Does he search
the screen from this point in any predetermined
manner? It has been shown that search times are
significantly faster than the average for targets
in the upper right quadrant and slower for those in
the lower right (Ref. 12). No difference exists for
the left two quadrants. These findings can be used
to advantage by placing the most important infor-
mation in the upper right quadrant and the least
important in the lower right.
Recommendations for information density are
summarized in Table ifi. Obviously, these are
general in nature and should not be used blindly.
The display designer must balance them against
his experience for each and every display.
Selecting a method
Method presentation, which deals with organiza-
tion of the overall display, is the final variable
Table Ill: Recommended Density Values
25%
18.75%
12 characters
characters or tess
12 characters
4 characters or less
2 in. (5.08 cm)
I in.(2.54cm)
Horizontal
2 in. (5.08 cm)
Upper right
Upper sf1. tower left
Lower right
Total display loading
Maximum:
Dynamic display loading
Maximum:
Text word size
Maximum:
Recommended:
Numeric word size
Maximum:
Recommended:
Symbol size
Maximum:
Recommended:
Word Orientation
Word spacing
Preferred quadrant
(is order of preference)
PAGENO="0159"
under designer control. All displays can be categor-
ized into three major groups: alphanumeric,
graphic and representational. Alphanumeric dis-
plays use strictly textual and numeric coding and
are necessarily dense. Graphic displays contain
line or bar charts to indicate trending, history, etc.
Some alphanumeric data are required in support.
The representational category uses symbols to a
great extent and includes mimics and one-line dia-
grams. The display designer must decide which
general category best serves his purpose and pro.
ceed with the design from there.
Major operator tasks-monitoring, controlling and
diagnostics-can now be used to aid in this decis.
ion. Figure 4 shows the recommended category for
each area. Monitoring tasks reqUire a broad view of
large systems or subsystems. Key parameters that
affect overall system operations are displayed and
used to evaluate performance. Such displays must
be clean and easily grasped, Figure 5. The repre-
sentational category satisfies these requirements
nicely. Symbols denoting major system compo-
nents indicate status and overall functioning.
Graphic displays may be used to support this over-
view in selected instances.
The controlling task involves activation and man-
ipulation of specific items of equipment. Informa-
tion concerning this equipment must be displayed
to allow the operator to perform his controlling
task, Figure 6. One expects the level of detail to
be greater than that required for monitoring, but
not needing every measured parameter. Here
again, the representational display functions best
while a secondary means is available with the al-
phanumeric category.
Diagnostics necessitates the greatest amount of
detail, but treats a very small portion of the entire
system. At this level, symbols are of little value.
Alphanumeric displays for diagnostics may con-
tain every conceivable parameter related to the
problem at hand, Figure 7. Search times will be
longer due to the amount of detail, but tins can be
tolerated in light of the benefits received. How-
ever, there is no requirement for these displays to
be arranged in purely columnar form. Groupings
of related parameters may be distributed on the
screen in a logical manner to enhance search and!
or may be interconnected in order to emphasize
interrelationships.
The display designer decides which category is
applicable and then considers the format, coding,
density and rates of change. The format deals with
the layout of individual pieces of information and
how they are related. Coding involves deciding how
the individual pieces are best represented, while
density requires the application of recommenda-
155
Figure 4. Major operator tasks are best ssr~ed by
certain display types, as shown here. After determin-
ing the display type, the designer still must decide on
the best coding method to employ and the proper
level of detail.
Figure 5. This representational display of a nuclear
steam supply system presents information necessary
for monitoring overall operation of the plant. If more
detailed subsystem information is necessary, the op-
erator may request it.
PAGENO="0160"
-~ iii ~ ~
A? 2 ~ ~
~ 555 2.0$ ~ ~
555 2.5*
I
is
555 -~
5.
Figure 7. If the motor section of pump 2A has a prob-
em, the operator can request a diagnostic disptay
which provides all pertinent information in alpha-
numeric form. Information on this display is grouped
functionatly and interrelationships are shown with
connecting lines.
tions in Table ifi. Since CRT displays are used to
indicate plant operation, dynamic data are of ut-
most importance. The designer must now evaluate
his display in terms of rates of change and how
well these changes can be detected. This procedure
is part of a design methodology.
Designing displays
Determining the purpose of a particular display is
the first step in display design. Each variable that
will appear on the display should be justified, in
writing, on a display form. Display design forms
should ask both philosophical questions of the de.
signer (purpose, special considerations) and speci-
fic questions regarding particular parameters that
need to be displayed.
Since the determination of specific display param.
eters is the end result, it should be specified first.
Then, and only then, should the proposed display
be analyzed to determine if sufficient data exist to
yield the desired result. The input must never de-
fine the output. This ensures a fresh look at the
system by the user with current technology in
mind. Historical reasoning (we always did it that
way), while valuable for confirmation, is a poor
base on which to build a new design.
Filling out design forms defines what is to be done,
not how. Detaiis on how the output accomplishes
its objective is determined next. Given a defined
output, the designer then decides which display
category is most applicable. Here the guidelines
come into play, as shown by the recommendations
of Figure 4. After deciding on a display method,
156
the designer has a number of detailed items to
consider: arrangement, size of active display area,
color assignments, abbreviations, character size
and spacing, level of detail, type of coding, param-
eter placement and rates of change, to name a few.
Designing effective CRT displays is both a formid.
able and confusing task, requiring the designer to
gain expertise in unrelated areas of technology.
Guidelines are of little use, however, unless the
person applying them is intimately familiar with
his particular application process. Guidelines pre-
sented in this article are intended to provide an
experienced user with advice in areas that are out-
side his specialty.
The level of sophistication of both instrumenta-
tion and display techniques has risen rapidly in the
recent past and will continue to do so. Man, how-
ever, has changed little and is not likely to do so.
Therefore, electronic display devices must be
tailored to man rather than have him tolerate fancy
but ineffectual equipment.
References
1. Bitt, W. fl et al "Development of Design Criteria
for Inteiligence Display Formats," Human Factors, Vol.
3, 1961, p. 86
2. Hitt, W. D., "An Evaluation of Five Different Ab-
stract Coding Methods-Experiment N,,' Human Fac-
tors, Vol. 3, 1961, p. 120.
3. McCormick, E. J., Human Factors Engineering,
McGraw-Hill, New York, 1970.,
4. Anderson, N. S. and Fitts, P. M, "Amount of infor-
mation Gained During Brief Exposures of Numerals
and Colors," Journal of Experimental Psychology, Vol.
56, 1952, p. 362.
5. Jones, M. R., "Color Coding," Human Factors, Vol.
4, 1962, p. 355.
6. Smith, S. L. and Goodwin, N. C., "Blink Coding for
Information Display," Human Factors, Vol. 13, 1971, p.
238.
7. Smith, S. L. and Goodwin, N. C., "Another Look at
Blinking Displays," Human Factors, Vol. 14, 1972, p.
345.
8. Dreyfuss, H., The Measure of Man: Human Factors
in Design, Watson-Guptill Publishers, New York, 1967.
9. Morgan, C. T., et al, Human Engineering Guide to
Equipment Design, McGraw-Hill, New York, 1963.
10. Woodworth, R. S. and Schlosberg, H., Experimental
Psychology, Bolt, Rinehart & Winston, New York, 1954.
11. Woodward, R. M., "Proximity and Direction of
Arrangement in Numeric Display," Human Factors, Vol.
14, 1972, p. 337.
12. Baker, C. A., et al, "Target Recognition on Complex
Displays," Human Factors, Vol. 2, 1960, p. 51.
MICHAEL M. DANCHAK is a Principal Engineer for
the Instrumentation & Controis Engineering Div. of
Combustion Engineering, Inc., Windsor, CT. Article is
based on a paper presented at the ISA Power Industry
Division Symposium, San Francisco, 1976.
PAGENO="0161"
157
THE MAN-PROCESS INTERFACE USING
COMPUTER GENERATED CRT DISPLAYS
Michael M. Danchak,
Supervisor, Display Systems
Instrumentation and Controls Engineering
Nuclear Power Systems
C-E Power Systems
Combustion Engineering, Inc.
Windsor, Connecticut
INTRODUCTION
The past few years have seen exponentially
increasing interest in the area of human
factors by the process control field in
general, and the power generation industry
in particular. The seventh decade of the
20th century started with a smattering of
papers on the subject, as related to con-
trol rooms, and expanded to a formal review
by the Electric Power Research Institute(l)
completed last year. All the literature
criticizes the fact that existing power
plant control rooms were designed based on
the "leftover" policy. This attitude allo-
cates functions to the operator only when
it cannot be accomplished by hardware.
Furthermore, these "leftover" functions
received little or no attention by the de-
signers, assuming the operator would soon
learn to cope with the given system. Al-
though this evaluation may be a bit unsym-
pathetic towards the previous generations
of control room designers, the fact remains
that existing systems do not adequately
account for the human in that system.
Fortunately, most of the publications do
not dwell on the deficiencies of the past,
but expound the virtues of the systems of
the future - - the so-called "advanced con-
trol centers." These are radical depar-
tures from their predecessors, using recent
technological advances to acquire and dis-
play information about the power generation
process. Computers, multiplexing equipment
and Cathode Ray Tube (CRT) displays are
becoming the norm rather than the exception.
Attendant with these hardware advances are
concerns for the operator and his ability
to function in this environment. More than
words, however, must be expended to exploit
the potential of this new technology. Con-
trol room designers are currently presented
with a rare opportunity in which they may
"atone for the sins of the past." This is
possible by intelligently accounting for
the attributes, both good and bad, of the
human operator. Design of the control and
display systems must be done with the
operator primariT~Tn mind.
While the new developments in technology
are invaluable, one must proceed with cau-
tion. The application of interactive com-
puter graphics to problem solving tasks has
made great advances in areas such as com-
puter aided design. One is immediately
tempted to apply similar techniques to
power plant control rooms. Systems have
been devised that require all interactions
between the process and the operator to
occur through the CRT display itself(2).
Other systems are much more cautious and
merely use the CRT to duplicate the func-
tions of the many dials and meters pre-
viously used for information display,
Both extremes have shortcomings due to poor
display design. Insufficient experience
with display design and knowledge of the
functioning of the human operator precludes
direct interaction with the screen at this
time. Duplication of previous display me-
thods does little to aid the operator in di-
gesting the voluminous data. This technique
also maintains discreteness of parameters
rather than integrating them into the over-
all process. Controls and displays should
remain separated until effective CRT display
systems have been developed and proven suc-
cessful. The display system design is the
quantum jump in the operator interface.
Direct operator interaction may easily
follow, if deemed desirable, once the dis-
play system has been made effective.
The major problem associated with displays
is two-fold; the display set organization
must take an integrated approach to the
power generation process and each display
page in the set must be based on sound human
factors principles. The latter has been
touched on(3) and work is continuing on the
details of effective display page design.
This paper will concentrate on the problem
of organization by analyzing the purpose of
the CRT display system and posing a solution
in the form of a display design methodology.
The efficacy of this approach will then be
demonstrated using a simple Nuclear Steam
Supply System (NSSS) example.
48-721 0 - 79 - 11
PAGENO="0162"
158
MAN-PROCESS INTERFACE
The CRT display system is the operators
primary means of determining the status of
the process he is trying to control. While
the popular term `man-machine interface"
may be applied to such interactions, the
semantics are somewhat misleading. When
one enters and receives information in an
interactive graphics application, the in-
terface is truly between man and machine
(computer). However, in the process con-
trol field the operator is more interested
in interacting with the process than with
the computer. The intermediate machine as-
pects should be transparent to the operator
to establish a man-process interface. One
may consider this a trivial difference, but
the designer and the user are certainly
affected by that difference.
Displays must optimize the interface be- -~
tween the operator and the process, rather
than the operator and the computer. The
computer is merely an information pathway
between the two. The display system is the
operator's window to the procesi. As the
analogy implies, information in this inter-
face travels in one direction only. The
operator views the process through the CRT
screen and uses his separate controls to
accomplish changes. In computer terms, the
CRT is an output device, as opposed to pro-
viding both input and output. The man-
process interface must be designed accor-
dingly.
Establishing the terminology also estab-
lished the purpose of the display system:
to provide a decision making tool for the
operator in relation to the process. The
next question to be asked is, How is this
done with the displayed information? How
does the operator use the window for con-
trol? Models of human perfornance(4) indi-
cate that the operator maintains his own
internal concept of the process and makes
adjustments according to this replica.
When the operator looks at the screen, he
expects to find certain information that
matches his model. -
According to current theories of the human
perceptual cycle,(5) this model is called
a schema. It determines the operator's
predisposition to finding relevant data
under various conditions. The anticipatory
schema directs his exploration of the
screen, from which he samples data and sub-
sequently modifies his mental model. This
cycle explains why we often overlook cer-
tain aspects - - they are totally unexpected.
Another interesting point is that the data
itself does not govern the subsequent beha-
vior of the operator. It is the schema,
or his hypothesis on the source or cause of
this data, that determines what he does
next.(6~ The exploration of information
continues through repeated observations
until the operatoris convinced his hypo-
thesis is correct,
The task of the display designer is to aid
the formulation and modification of this
schema with relevant data. Displays must
emphasize the unexpected and provide a
means by which the operator can establish
his hypothesis and either confirm or reject
it based on related events. This model of
the man-process interface verifies the
problem areas stated previously. The indi-
vidual display pages must be effectively
designed to complement the operator's
concept of the process and make the unex-
pécted obvious. Furthermore the interrela-
tionships between the displays must be
logically established to allow the operator
to make the requisite observations quickly
and intelligently. Display hierarchy is
more than a convenient means of organization
- - it is a vital tool in determining the
operator's ability to react successfully.
DESCRIPTION OF THE METHODOLOGY
The emphasis of the proposed display design
methodology is on integration of displays.
When assigned to such a task, the designer
typically asks the number of display pages
to be created and proceeds from there on an
individual basis. A better question is,
How many displays does the operator need
and how can they be logically related to
satisfy these needs? Only then should the
details of the individual pages be addressed.
The methodology is devised to account for
the model discussed in the previous section.
The progression in detail also provides an
inherent documentation package for each dis-
play page in the system.
Figure 1 illustrates the steps in the pro-
cedure. A display hierarchy is established
by defining the purpose and function of the
display set and each individual display.
This should be done on a systems level that
deals with major portions of the plant, such
as the NSSS, main steam, feedwater, etc.
The next step identifies the display param-
eters necessary to accomplish the purpose
just specified. Note the heavy reliance on
operating experience. This is done to
ensure that the display system meets the
operator's requirements. Once the output is
determined, the displayed data is related to
the input available to complete the input-
output sequence. With this information in
hand, the actual design of the individual
display page is done according to human fac-
tors guidelines. The final step specifies
the processing required to update the dis-
played data. Appropriate forms should be
devised for each step on the procedure to
formalize the process and ensure complete-
ness and continuity. Each of these steps
will be discussed in more detail in the
following paragraphs.
PAGENO="0163"
159
~qplay Hierarchy
Coincident with specifying the purpose and
function of each individual display page,
one must establish a concept of how the
pages are related according to the opera-
tor's schema of the process. A list of
display page names must be drawn up and the
interrelationships determined. This con-
cept, or hierarchy, ensures an integrated
approach and also determines the maneuvera-
bility between pages, as will be shown
shortly. Such a unifying mechanism tests
the effectiveness of the display strategy
before time and effort is expended on de-
tailed page design. Using the hierarchy,
operations oriented personnel may postulate
actions of the operator and determine where
the required information can be found.
Such a paper study improves the efficiency
of the procedure without sacrificing flex-
ibility or wasting engineering hours.
The relatively ew field of hierarchical
system theory(7) offers a valuable guide in
establishing the system structure. One
must decompose the system into subsystems,
and those subsystems into sub-subsystems
and so on, until a convenient amount of
detail is reached. Decomposition may be
done according to level, time, mode or
other means applicable to the system of
interest. The information structure is
then defined by specifying the amount and
type of information available to each com-
ponent. Finally, the degree of coordina-
tion and data flow between the components
must be determined. The basic techniques
of hierarchical system theory will be used
without resorting to mathematics or com-
plex details.
A convenient and applicable level decompo-
sition has been establiq~çd during the ana-
lysis of operator tasksl ). There is a
direct correspondence between the monito-
ring, controlling and diagnostic tasks, the
methods of presentation and the logical
maneuvering between displays. Displays
will henceforth be categorized as monitor,
control or diagnostic. The hierarchy of
this categorization is shown in Figure 2.
The highest level display treats the moni-
toring task that provides an overall view
of the system involved. Beneath this are
multiple control displays that show major
components of the monitor and provide infor-
mation necessary to control that component.
The diagnostic display contains all instru-
mented parameters related to that component,
thereby allowing detailed diagnosis of any
problem. The amount of detail inherently
involved with the last level may require
multiple pages of displays.
It should be emphasized that detection of
anomalies is not restricted to diagnostic
displays, only the level of detail is
limited. Alarm indications are available
at all levels, as described later, Essen-
tially the hierarchy defines levels of
zoom' for alarms where the operator moves
to the level of detail necessary to deter-
mine the anomaly.
Given a set of displays, one needs a means
of retrieving one particular page of the
set for viewing. This establishes the
maneuvering mentioned in previous paragraphs.
An obvious method is to assign page numbers
to designate each display and use the desig-
nator for retrieval. Assuming a non-trivial
number, a directory is necessary to relate
these number designators to the actual con-
tents. The operator must scan the directory
for the desired information, enter the
assigned number and view the information on
the CRT screen. Using thistechnique, an
operator can randomly access any single
page of the set rather easily, provded ho
knows the designator.
Another technique is to move sequentially
through the set from some predetermined
beginning. A wrap-around feature would dis-
play the first page after the last page in
the sequence has been viewed. For added
flexibility, movement ~through the sot can
be in either the forward or backward djrec-
tion. Two simple function buttons are all
that are required for retrieval. While this
does not require a priori knowledge of page
numbers, it requires retrieving an average
of N/2 pages before finding the desired
information, where N is the number of dis-
plays in the set,
A combination of the two methods is prefer-
able. One can randomly access the desired
page with the aid of a directory and then
move sequentially through the set, as de-
sired, This combined approach will b~ re-
ferred to as "paging." It retains flexi-
bility, while decreasing retrieval times for
displays in the vicinity of the page cur-
rently being viewed. This represents hori-
zontal movement along the levels shpwn in
Figure 2. Although one must put the pages
in some soquence, the paging concept does
not exploit the interrelationships of dis-
plays as defined by the hierarchical struc-
To take advantage of the inherent logical
progression between levels, one should in-
corporate a second moans of retrieval called
"sectoring." This technique allows the
operator to move vertically through the
hierarchy with a minimum of effort. Simple
operator actions allow him to move from the
monitor level to a related display on the
control level and still further to the diag-
nostic level, following one branch of the
tree structure. Equally simple actions
allow progression up the structure as well.
While sectoring constrains the maneuverabil-
ity to a limited number of displays, the
allowable pages are logically related to the
PAGENO="0164"
160
current display. Furthermore, no directory
or memorization is required by the operator
if sector indicators are made an integral
part of the display.
Maneuverability can be incorporated into
the hierarchy by drawing boxes to represent
each display page and assigning page num-
bers to each box, as shown in Figure 3.
This number (204) would be listed in a
directory with its associated name, and
used to randomly access that display. Hori-
zontal maneuverability is indicated by the
"Page Back To" and "Page Forward To" en-
tries, 203 and 201 respectively. These
pages are on the same hierarchical level as
the current page and are accessed using
some forward/back selection mechanism. The
sector numbers attached to the interconnec-
ting lines represent the indicators that
would appear on the display and that would
be entered to move vertically in the hier-
archy. Selection of Sector 1 or 2 in this
example would result in a movement down-
ward to a diagnostic display. Selection of
Sector 0 would cause movement upward in all
The sample hierarchy of Figure 4 will be
used in the example of the next section and
is introduced here to illustrate the form
of a typical organization. The actual con-
tents of each display are not necessary in
establishing this structure; only the page
names, numbers and a general idea of the
purpose and function is required. The pur-
pose and function of each display should be
documented separately. A wealth of infor-
mation is available in this figure, since
paging and sectoring is already specified
via the notations. The results of this
first step may be likened to a functional
description of the display system. The
tree structure and philosophical descrip-
tions of each page tell the user (operator)
what the system will accomplish as he will
see it. The details of each page are then
provided in subsequent steps.
Output Description
Returning to Figure 1, the second step of
the procedure identifies the display param-
eters necessary to accomplish the stated
purpose of each page. This is a natural
progression in detail from the philosoph-
ical description of step 1. Information at
this point should specify the output varia-
bin name, the form in which the parameter
is to be displayed (numerically, symboli-
cally, etc.) and remarks concerning limits,
alarm functioning and so forth. No infor-
mation should be specified concerning dis-
play layout, since operations oriented
personnel provide this input. The data
should be gathered on a page-by-page basis
to ensure continuity of display page docu-
mentation. This nay require duplication of
information if the same parameter appears
on a number of pages.
Input Identification
Once the output is defined, one must deter-
mine the source of this information. The
plant instrument lists are the most logical
reference for performing this task. How-
ever, this step does more than identify the
parameter source. The data processing re-
quired to change the input to output is
immediately implied and the methodology
begins to involve computer oriented design-
ers. Conversion to appropriate engineering
units, off-set corrections and other needed
manipulations become immediately obvious
and must be accounted for in the computer
pathway. Decisions may also be made at this
tine on the need for composed points where
multiple instrument channels exist for the
same parameter. A further, but important,
advantage afforded by this step of the
methodology is a cross check on the com-
pleteness of the instrument list.
~4ppiay Layout
The time has come to finally lay out each
display as it will appear on the CRT screen.
While a vague conception of the layout may
have been necessary for guidance in the pre-
vious steps, it is best to start anew. Up
to this point insufficient information
existed to design the page intelligently.
Display creation should be approached method-
ically, with sound human factors principles
as a base. Too often the original concept
used for guidance becomes cast in concrete
without considering the details of the lay-
out. The guidelines necessary for effective
CRT display creation are discussed in
Reference 3. Although a manual or semi-
manual layout (such as a paper grid) may
seen crude, it is really the only way to
account for design details. Interchanger
spacing, display density and loading, as
well as other human factors, are difficult
to account for without such a tool. Fur-
thermore, the effort involved in laying out
the display on paper provides more tine to
consider the details.
Processing Specification
The final step in the methodology is done by
those intimately familiar with the display
system, rather than the process being con-
trolled. Decisions and specifications must
be made concerning the real-time updating
of the displayed data by the computer.
Operations such as limit checking and alarm-
ing must be included to make the display
useful. This step adds dynamics to an other-
wise static picture and requires the appro-
priate expertise to make it come alive.
The end result of the procedure just de-
scribed is a set of interrelated display
pages designed to optimize the man-process
PAGENO="0165"
161
interface. A complete package of documen-
tation is also a consequence of these steps.
The package provides the necessary infor-
mation on the overall organization of the
display set and details on each page as it
progressed through the design. An example
that illustrates the establishment of a
sample hierarchy and the effectiveness of
the methodology follows.
ILLUSTRATIVE EXAMPLE
Consider a simplified NSSS as the system to
be controlled. Major components of the pri-
mary ioop include the pressurizer, two
steam generators, four reactor coolant
pumps, a chemical and volume control system
(CVCS) and all interconnecting pipes. The
task is to design a display set that meets
the needs of the operator during normal and
abnormal power operations. The logic in-
volved in establishing the hierarchy for
such a system will be discussed and the end
results of the methodology demonstrated
using sample displays. Since this dis-
cussion is only for illustration, there is
no attempt to completely describe the dis-
play set. Additional pages are required
for a realistic system which increases the
number and complexity of the set.
The design starts by determining the needed
displays and specifying their interrela-
tionships. The most obvious display is one
that presents an overall summary of the
NSSS, showing major components. Each com-
ponent or subsystem on this summary usually
requires operator interaction, hence a dis-
play page will be allocated to the pres-
surizer, each coolant pump and CVCS. Al-
though the steam generators are an integral
part of the system, no operator interaction
is provided on the primary side. Therefore,
the displays for interaction with the gene-
rators would be included in the set for the
secondary (BOP) side. It is apparent that
many parameters are measured that are only
of infrequent interest to the operator.
This does not imply that they are not impor-
tant. They certainly are under certain
conditions, but not continually. Such
parameters will be relegated to detailed
displays that treat only a portion of each
component. Restricting the discussion to
only the coolant pumps, each pump may be
conveniently divided into a motor section
and a pump section. Displays are assigned
to treat each of these sections for each
pump. To randomly access these displays,
a directory is needed to relate page numbers
and names. A summary of alarm messages is
also desirable to consolidate alarms for
easy access and action.
Figure 4 shows the organization of such a
display set. The overall summary of the
system is found on page 101, the NSSS
Monitor, the directory (100) and alarm
summary (102) are also placed at the moni-
tor level. The controlling displays for
each subsystem are beneath the NSSS monitor.
The control displays for the pressurizer
and the CVCS are excluded from this figure
for simplicity. Detailed information on
each coolant pump is found on the diagnostic
level. This structure treats progressively
greater details as one goes from the monitor
level, down through the control to the diag-
nostic level. It satisfies the requirement
for logical organization and emphasizes the
interrelatedness of the displays in all
directions,
One can also see how paging and sectoring
are implemented early in the design process.
The numbers at the top of each display box
represent the page numbers and indicate the
displays obtainable using the forward/back
functions. Paging forward from 202 will
display page 203, while paging back displays
201. A circular list for sequential re-
trieval is also included in this scheme,
allowing the operator to move horizontally
along each level rapidly. Paging forward
from 204 yields page 201, the start of the
control level displays. Additionally, the
vertical maneuverability is demonstrated by
the sector numbers adjacent to the tie lines
between sectorable displays. In all in-
stances, choosing sector 0 will cause an
upward movement to the next higher level.
Following the establishment of this hierarchy
and the philossphical definition of the pur-
pose and function of each display page,
specific parameters must be identified.
Each page has a data sheet that lists this
information and is used to relate the output
to the input. The display designer uses
this data to create a detailed layout of
each display and then passes it on for pro-
cessing specification and implementation.
Results of this implementation will now be
presented to show the maneuverability af-
forded by the hierarchy. Actual COT dis-
plays have been created for the shaded boxes
of Figure 4 and will be used in the example.
Maneuvering through the hierarchy is accom-
plished using the Page Control Module (PCM)
shown in Figure 5. To randomly access a
display (paging), the operator presses the
PAGE button, enters the three-digit page
number and then presses EXECUTE. The se-
lected display immediately appears on the
CRT. Paging forward and back along a given
level is done using the FORWARD and BACK
buttons in the figure. Only one keystroke
is required to accomplish this function.
Sectoring is performed similar to paging.
When the SECTOR button is depressed, the
sector numbers appear next to the component
on the display. The operator enters the
one-digit sector number and presses EXECUTE
to obtain the desired display from the next
level.
Monitor displays typically contain informa-
PAGENO="0166"
162
nation necessary to assess operation and
status of a systen or subsysten. Param-
eters used in these displays oust be care-
fully selected to reflect the operation of
the entire system being addressed. The
recommendations of Reference 3 state that
representational and graphical methods of
presentation are best suited for monitor
displays. However, there are exceptions.
A directory listing the available displays
is functionally a monitor level display,
but requires alphanumeric methods of pre-
sentation, as in Figure 6. The operator
can select the desired page from this dis-
play and access it using the paging tech-
nique. The arrow in the lower right corner
indicates that more information or overflow
is continued on a back page and can be
accessed using the FORWARD button. The
back page, in this instance, would contain
the list of available diagnostic displays.
Back pages are not included in the hierar-
chy because their need is not apparent un-
til the display layout phase. The contin-
uation symbol is used only when a back page
is required for overflow.
A more typical monitor level display using
the representational method of presentation
is shown in Figure 7. All parameters on
this display have a great impact in the
operation of the NSSS and concisely depict
the functioning of this system. If sec-
toring is desired from this display, the
operator presses the SECTOR button and the
sector numbers (Figure 8) immediately
appear next to the sectorable components.
If one of these sectors is not selected
within 30 seconds, the numbers are removed
to maintain display cleanliness. Pressing
SECTOR again will reinstate the numbers and
allow sector selection as described.
Assume the operator selected sector 4, the
controlling display for Reactor Coolant
Pump 2A (RCP2A). He would then obtain the
control display of Figure 9. Control dis-
plays aid the operator in his controlling
task and should contain all the information
needed for control. Parameters that must
be observed during the controlling task
should all appear on the same display, even
though they may be parts of other systens.
Operator procedures and guides for control-
ling the component are excellent sources
for determining which parameters to dis-
play. This display is also sectorable to
obtain either the motor or pump section of
RCP2A.
Diagnostic displays contain all the instru-
mented parameters related to a portion of
the component dealt with in the control
display. Figure 10 shows the diagnostic
display for the motor section of RCP2A.
One expects a great amount of detail at
this level and must use the alphanumeric
method of presentation. Mimic diagrams
are of little use when dealing with a large
amount of information on one display. If
that amount is too great for one page, back-
pages may be used to contain the overflow,
as discussed earlier.
Alarm indicators should be available at all
display levels to help the operator find
the offending parameter quickly and with no
a priori knowledge of page numbers. These
indicators complement the dedicated alarm
list that specifies the problem parameter
and where to find more information. If the
operator is currently viewing a display
that includes the offending parameter, that
parameter is alarmed on the display and the
operator can act directly. An alarm condi-
tion for pressurizer pressure is illustrated
in Figure 11. An alarm message would also
appear on the Alarm Summary display. If
the offending parameter is contained on a
page further down in the hierarchy, the
operator must be so advised. This can be
done by alarming an appropriate symbol on
the display being viewed and turning on the
sector number which would guide him to the
display containing the alarmed parameter.
At this point the operator may go directly
to the desired page, as indicated by the
alarm summary message, or negotiate the
hierarchy to see if the alarm is causing
disturbances in other portions of his
system.
Assume the operator is currently viewing
the NSSS monitor display, Figure 7, and
excessive vibration occurs in the motor
section of Reactor Coolant Pump 2A. Con-
sidering the hierarchy structure of Figure
4, he is currently viewing page 101 while
the offending parameter is contained on
page 300. The pump symbol for RCP2A on the
monitor display of Figure 7 would flash in
the appropriate alarm color and the number
4, the sector number, would appear next to
it. The results of these additions are
shown in Figure 12. If the operator chooses
to follow the sectors rather than going
directly, he presses SECTOR, 4 and EXECUTE
on the Page Co~itrol Module to obtain the
control display for that pump, page 203
(Figure 13). The motor section of this
pump would also be flashing in the alarm
color and have the sector number 1 adjacent.
Once again he sectors and obtains the diag-
nostic display, page 305 (Figure 14), which
has the offending parameter in alarm.
Thus, two simple actions by the operator
bring him to the level he needs to diagnose
the problem. Obviously, if the offending
parameter is also contained on the control
display, he need not perform the second
step. This technique aids the operator in
finding the source of a problem, but does
not interfere with a different strategy he
may feel is more appropriate. It does not
force him to act in any way, but only
advises him of a logical action.
PAGENO="0167"
163
Although this example is somewhat straight-
forward, a similar hierarchy must be estab-
lished for each and every set of displays
in the system. Furthermore, the sets must
be tied together at the monitor level to
ensure proper integration. The designer
may often be faced with situations where
control and diagnostic displays exist, but
there is no associated monitor. This is
certainly allowable and merely implies that
the operator must page to the controlling
display before using the sectoring method.
Some monitor displays, such as directories
and alarm lists, may not be sectorable.
This is precisely the reason for performing
this work early in the design process. The
establishment of the hierarchy graphically
portrays the display system and its inter-
relationships and permits easier design of
the individual display pages.
CONCLUSION
The key element in designing successful ad-
vanced control systems is designing suc-
cessful CRT displays to optimize the man-
process interface. The operator maintains
a mental model of the process he is control-
ling and uses the displayed information to
modify his model for the given circum-
stances. The display system must be orga-
nized to complement the operators schema
and allow him to make the necessary obser-
vations quickly. The display design metho-
dology just presented places great emphasis
on the hierarchy and provides a means of
creating the display pages within the hier-
archy. A documentation package results
that traces the design from conception to
implementation in a concise and consistent
ACKNOWLEDGMENT
REFERENCES
(1) Human Factors Review of Nuclear Power
Plant Control Room Design, EPRI NP-
309-SY, Project 501, Nov. (1976).
(2) Netland, K. and Lunde, J. E., `Experi-
mental Operation of the Halden Reactor,
Utilizing a Computer - and Colour
Display-Based Control Room," Proc. of
Specialist Meeting on Control Room
IEEE 7SCH1O6S-2, 12, July
(3) Danchak, M, M., "CRT Displays for Power
Plants ," Instrumentation Technology,
29, OctobNi~(f976).
(4) Baum, A. S. and Drury, C. G., "Model-
ling the Human Process Controller,"
International Journal of Man-Machine
Studies, 8, 1 (1976).
(5) Neisser, U. , Co nition and Reality,
W. H. Freeman an ompany (1976).
(6) Sheridan, T. B, and Ferrell, N. R.,
Man-Machine Systems: Information,
Control and Decision Models of Human
Performance, MIT Press (1974).
(7) Schweppe, F. C. and Mitter, S. K.,
"Hierarchical System Theory and Elec-
tric Power Systems," Real-Time Control
of Electric Power Systems, B. Handschin
(ed), Elsevier Publishing Company
(1972).
Acknowledgment is made to J.G. Brooks,
Combustion Engineering, for initial
work in establishing the hierarchical
levels.
PAGENO="0168"
DEFINE THE PURPOSE AND FUNCTION OF THE
DISPLAY SET AND EACH INDIVIDUAL DISPLAY
IDENTIFY THE DISPLAY PARAMETERS NECESSARY
TO ACCOMPLISH THE PURPOSE
RELATE DISPLAYED DATA WITH THE INPUT
AVAILABLE
DESIGN THE DISPLAY ACCORDING TO THE
HUMAN FACTORS GUIDELINES
SPECIFY THE PROCESSING REQUIRED TO
UPDATE THE DISPLAYED DATA
FIGURE 1, DISPLAY DESIGN METHODOLOGY
PAGENO="0169"
S
S
S
FIGURE 2. OPERATOR FUNCTION/DISPLAY HIERARCHY
PAGENO="0170"
166
PAGE BACK TO
PAGE NUMBER
PAGE
~F::wAR 0 TO
REACTOR COOLANT
PUMP CONTROLLING LEVEL
2B
V 12
DISPLAY SECTOR
NAME NUMBERS
FIGURE 3. DISPLAY PAGE MANEUVERING INDICATORS
PAGENO="0171"
I too tot ~
[ _______
~Ib02I1~
NSSS
L ALARM SUMMARY
..I...~ I. 204
REACTOR COOLANT
PUMP
2A
3ó~]
MOTOR SECTION
I REACTOR COOLANT
L ~
FIGURE 14* SAMPLE DISPLAY HIERARCHY
PAGENO="0172"
168
L EXECUTEI
1
2
3
4
5.
6
7
8
9
BACK
0
FORWARD
FIGURE 5~ PAGE CONTROL MODULE
PAGENO="0173"
1813
100 - P4555 DISPLAY DIRECTORY
101 - MONITOR DISPLAY
102 - ALARM SUMMARY
I p~ P
ui~tr~ 1~Ut~i1UR ~
201 - RCPIR CONTROL DISPLAY
202 - RCPIB
203 - RCP2A
284 - RCP2P
C UThER CUNTRUL I'I5PLA~'5 1
3
FIGURE 6. SAMPLE DIRECTORY DISPLAY
PAGENO="0174"
NEUT.
POWER
7(H)
7(C)
TWO PUMPS, OPP. LOOP PWR LIMIT 58 ~
101
1813:10
jP 2250
g AL 0
L 75
850. FLOL~
585
lB
IRVE 569
LTDN 48
CHG 44
FIGURE 7 SAMPLE MONITOR DISPLAY
PAGENO="0175"
TWO PUMPS, OPP. LOOP PWR LIMIT 5! ~
101
1813:1~
SECTOR
NUMBER S
(BLINKING)
I
FL O)~
T (C)
NEUT LTDN 6
POWER ~ IAi/( 569 CHG 44
FIGURE 8. SAMPLE MONITOR DISPLAY WITH SECTOR NUMBERS
PAGENO="0176"
TEMP
235
85
125
115
95
FLOW TEMP FLOW
90 200
203.
1~13:1~
PRES
120
F LOW
3ØØ+l
2.00
1.08
2.01
* STATOR
I AIR
~ED
LP
~HP
I 5531(C)
IAYE 569
FLOW 559+6
POWER 50 PRESS 2250
FIGURE 9. SAMPLE CONTROLLING DISPLAY
PAGENO="0177"
305
1813:20
MRIU OIL LINE
TEMP 105 . COOLERS STPRI~ER ~
FLOW ~ TEMP FLOW ~P 2
~ ~ ~85 2 00 812
PRE5 18 B85 2.00 TEMP
II BKSTOP OIL 138
UP RAD BRG 135
PAIP4 OIL TANK AXIAL BRG 148
LEVEL 70 STRTOR 228
PRE5 110 LW RAD BRG 147
I TEMP PRES
UP JRN BRG 145
OIL LIFT ~ THRUST BRG 149 5
rUMr LW JRN BRG 151
FLOk 5.08 ___________________________
PRES 50
FIGURE 10. SAMPLE DIAGNOSTIC DISPLAY
PAGENO="0178"
JE IN ALARM
101
1813:10
NEUT. LTDN 48
POWER CR6 44
TWO PUMPS, OPP LOOP PWR LIMIT ~ 58 t~
851
FLOL~
1(H)
585
*7
858
58 "AYE 569
FIGURE 11 SAMPLE MONITOR DISPLAY WITH OFFENDING
PARAMETER IN ALARM
PAGENO="0179"
181
1813:10
13 SYMBOL
~//(BLINKING IN YELLOW
SECTOR NUMBER FOR
W"CONTROL DISPLAY
+6 £553 (BLINKING IN
559 YELLOW)
P1(1)1.. LTDN 40
POWER . CHG 44
TWO PUMPS, OPP. LOOP PWR LIMIT 59 z
850 FLOW TIC)
50 `TAYE 569
FIGURE 12 SAMPLE MONITOR DISPLAY WITH INDICATION OF
AN ALARM FURTHER DOWN IN ThE HIERARCHY
PAGENO="0180"
SYMBOL
AIR
BLEED
______ LP
~ HP
~ 5531(C)
FLOW TEMP FLOW
98 2.11
202
i8i3~ j5
FLOW PRES
SECTOR NUMBER
(BLINKING IN YELLOW)
TE!4P
235
85
125
115 1.88
95 2.88
3.88~
2.88
12S
1(H) 585
`[AYE
FL OW
5'9~
5,59+6
POWER 50 PRESS 2258
FIGURE 13. SAMPLE CONTROLLING DISPLAY WITH INDICATION OF
AN ALARM FURTHER DOWN IN THE HIERARCHY
PAGENO="0181"
MAIN OIL LINE
TEPIP 1,5
FLOw ?.og
FLOW 7.00
PRES 10
I
MAIN OIL TANK
LEVEL 70
PRES 110
.1
OIL LIFT PUMP
FLOW 5.00
PRES 50
VALUE IN ALARM 395
1813:20
PIOTOR SPEED 64.
VIBRATION 1.8351
TEMP
130
135
140
220
BRG 14?
TEMP PRES
BRG 145
BRG 149 5
BRG 151
OIL
- COOLERS
TEMP FLOW
A85 2.00
385 2.00
STRAINER ~ -u
2
I.
BKSTOP OIL
UP RAD BRG
AXIAL BRG
S TAT OR
LW RAD
UP JRM
THRUST
LW JRN
FIGURE 114. SAMPLE DIAGNOSTIC DISPLAY WITH OFFENDING
PARAMETER IN ALARM
PAGENO="0182"
178
ALPHANUMERIC DISPLAYS FOR THE MAN-PROCESS INTERFACE
MICHAEL N. DANCHAK, Supervisor, Display Systems
Instrumentation and Controls Engineering
Nuclear Power Systems
Combustion Engineering, Inc.
Windsor, Connecticut
INTRODUCTION
As early as 1949, people working with computers recognized the shortcomings
of printing devices for computer output and the potential of cathode ray tubes
(CRT's) (1). The speed, bandwidth and flexibility of such a device is ideally
suited for dynamic display of computer-generated information. Today the CRT is
commonplace in computer terminals, vital to interactive graphics. systems and
is being used extensively for display of process control information. In the
latter case, the CRT functions as the operators window to the process being
controlled (2). This device is rapidly replacing the myriad dials and meters
to enhance operator comprehension and make his task more manageable.
Alphanumeric displays use alphabetic letters and numeric digits exclusive-
ly. They are a major subset of display systems that may include graphic and
representational (mimic) ages (3). Color is also implemented in more sophis-
ticated systems to add another dimension to improve operator awareness. Regard-
less of the level of sophistication, alphanumeric representation is the simplest
and most common method of information display.
Unfortunately the display techniques used for printers are often carried
over to CRTs, with little regard for the drastic change in display medium.
This paper attempts to recognize that change and offers suggestions for the
intelligent design of such computer output. The basic characteristics of CRT's
are surveyed and the attributes of alphanumeric characters discussed from the
human standpoint. The characters are then integrated to form display pages that
satisfy the operators need for information. Recommendations are made for
creating the more traditional lists of alphanumeric information as well as the
unusual layouts necessary for process control. All the recommendations are then
summarized for easy reference and implementation.
CHARACTERISTICS OF CRT DISPLAYS
For the uninitiated, the technicalities of the transition from simple
printed output to CRT displays is bewildering and frustrating. Terminology has
been retained from the television industry, with some major exceptions. The
rapid development of the computer-generated CRT display medium without accepted
standard definitions and concepts, has resulted in display system vendors using
the same terms to mean different things. A short primer on the characteristics
of CRT displays is necessary to achieve some level of commonality for sub-
sequent discussions.
A logical starting point for understanding is the cathode ray tube itself.
At the risk of being trivial, basic conoepts must be presented to appreciate
the problems. Writing viewable information on the screen face is achieved by
accelerating an electron beam and then deflecting it to impact that screen at
the appropriate location. Here the electrons kinetic energy is converted to
visible light by interaction with the phosphor coating. Deflection of the beam
is related to an "address generated by the display system. Since the emission
of light from the phosphor decays with time, some mechanism is required to
maintain the information on the screen. Storage tubes trace the data only once
and depend on another source of electrons to preserve the data. In order to
delete information, the entire screen must be cleared and the remainder
TIS- 5301
PAGENO="0183"
179
written again. Scanned tubes refresh the data by continually repeating. th'e~tra~e,
using one of various scanning patterns. This requires the data to be held in
some form of memory for refreshment, but erasing is done simply by deleting the'
un~!anted information from this memory.
The size of the display area is a parameter that immediately causes confu-
sion. As with the home TV, tube sizes are usually quoted in inches of diagonal;
17-inch, 19-inch and so on. English units of measurement will be used for illus-
tration, since they are used by tube vendors and are more meaningful in this
case. The CRT has evolved with a 3:4 ratio between the dimensions of the ver-
tical and horizontal sides. Assuming a rectangle, this yields a nice 3:4:5
relationship between the vertical, horizontal and diagonal measurements, respec-
tively. W-ith a 19-inch screen, the sides should measure 11.4 and 15.2 inches.
Unfortunately not all this area is avaialable for display, since the tube is
not truly rectangular. The parameter of concern, then, is the size of the larg-
est complete rectangle that can be drawn on the tube. The nomogram in Figure 1
DISPLAY SIZE
SPECIFIED USABLE HORIZONTAL VERTICAL
DIAGONAL DIAGONAL 14
25-~--- 23
-1- 18
24± 22 13
23..J1._. 21 17
22-L
4. 20 16 12
21-4---
4. 19 15
20 11
19 18 19 INCH 14 __________
17 EXAMPLE
18 10
13
17 16
15 12 9
16
15 14
14 13 8
10
13 12 7
12 11
11 10 8 6
10
5
Fig. 1: CRT Display Dimension Nomogram
PAGENO="0184"
180
was devised to alleviate this problem, based on empirical data. One merely
selects a specified diagonal and moves horizontally to obtain the dimensions
of usable area. For a 19-inch monitor, the usable diagonal is 17.5 inches and
the largest rectangle that can be drawn measures 10.5 inches vertically and
14 inches horizontally. These dimensions are extremely important in determining
character size, as will be shown shortly.
Since various size CRTs can be used with the same display equipment,
manufacturers work in resolution units related to the "address mentioned pre-
viously. The screen is divided into addressable rectangles called pixels or
picture elements, as shown in Figure 2. All patterns on the screen are built
Fig. 2: CRT Addressability Levels
PICTURE
ELEMENT
up using one or more of these pixels, whose measured size varies with screen
size. Resolution of 256 x 256 (elements x lines) means there are 256 lines on
the screen and each line is divided into 256 elements. A pixel may be placed
at any one of 65,536 addresses resulting from the combination of 256 locations
CHARACTER
MATRIX
PAGENO="0185"
181
along both the horizontal and vertical axes. For a 19-inch diagonal screen,
each pivel would measure 0.055 x 0.0410 (width x height), or 0.050 x 0.037'
for a 17-inch diagonal screen. Likewise, resolution of 320 elements x 240
lines (320 x 240) would yield pixels measuring 0.044" x 0.044" and 0.039" x
0.039" for 19-inch and 17-inch screens, respectively. The pixel size, and ul-
timately the character size, is predicated on screen size and resolution.
Figure 2 also illustrates another variable of character size: the charac-
ter matrix. Alphanumeric characters are formed by a suitable arrangement of
pixels. It would be extremely tedious to have to build each character every
time one wanted to display that character. Therefore, character generators are
included in display systems that function as character drawing subroutines.
One speci fies a starting location and a code to identify the individual charac-
ter. The system then automatically forms the- desired pattern according to a
predefined matrix. In this instance, the matrix is composed of 63 pixels (7 x
9), but the actual character uses only 35 pixels (5 x 7). This is often written
as a 5 x 7 character embedded in a 7 x 9 matrix; the excess pixels are used
for spacing. This involves a critical distinction when computing character
size. Using the 19-inch screen and 256 x 256 resolution, the character would
measure 0.275" x 0.287".
A final characteristic of CRT displays is that of user addressability---
the degree of positioning afforded the user through theTh~it computer. Al-
though the display system can address an individual pixel internally,, such
precision may not be available to the user. The terms "graphics systems" and
"character oriented systems" will be used to distinguish the differences in
addressability. Although "graphics systems" implies much more than addressa-
bility, its inherent capabilities allow the user to position the start of the
character matrix at any pixel location. Thus, the user can vary the spacing
and orientation between characters almost at will, as shown in Figure 2.
"Character oriented systems" constrain the user to a much coarser grid called
a screen matrix, Figure 3. Each element of the screen matrix coincides with a
character matrix to form a number of character rows and columns. A "character
oriented system" whose resolution is 420 x 405 and uses a 7 x 9 character
matrix could display 45 lines of 60 characters each. The user may specify one
of 60 locations in the horizontal direction and 45 locations in the vertical
direction rather than the full 420 and 405. With this system, all spacing must
be embedded in the character matrix unless blank characters are used.
With this brief survey one is better prepared to evaluate various systems
and weigh the advantages and disadvantages of each. The discussions to follow
do not account for such differences and rely on the reader to factor in this
information when performing his own analysis. What can and cannot be done
with a particular display system is a function of the tradeoffs made by the
individual vendor and the market he is addressing.
ALPHANUMERIC CHARACTERS
In any discussion of alphanumeric (A/N) characters, one must be aware of
the impact of charactef4yisibilitY~ legibility and read~bility. Using the defi-
nitions of McCormick visibility is the quality of a character that makes it
separately visible from its surroundings and treats the pixel level of detail.
Legibility is the attribute of A/N characters that makes it possible for each
character tq,, be identifiable from others. Readability is the quality that makes
possible the recognition of the information content of material when repre-
sented by A/N characters in meaningful groupings. Restating the definitions as
a series of questions: Can you see it? What is it? and What *does it mean?
Since the pixel has been defined to satisfy visibility, this section will deal
only with legibility by discussing the ideal character. The proper grouping of
characters to form words and sentences is the ultimate goal and is treated in
the next section.
Assuming adequate contrast and luminance, factors primarily dependent on
hardware, one would like to specify an ideal character with which to compare
available systems. The form of the character that allows the viewer to distin-
guish one from another is determined by character ratio, stroke width, matrix
size, font, case and visual angle. Figure 4 illustrates these character attri-
butes, their recommended values and representative variations. Character ratio
refers to the relationship between the ~dth and height arid infers the square-
ness of the character. While the NAMEL( character set specifies a 1:1 ratio
(square), reduction to 2:3 may be made without any appreciable attenuation in
PAGENO="0186"
182
CHARACTER
MATRIX
Fig. 3: Character Oriented Display System Addressability
legibility (4,6)~ The optimum ratio of the width of each stroke used to form
a character to its overall height is given as 1:8 to 1:10(6,7). For self-
luminous characters, as found on ç~Ts, the thinner stroke is preferable due
to the phenomenon of irradiance (`+J* This accounts for the apparent increase
in thickness of a line due to its brightness or contrast.
A minimum of 7 vertical matrix locations, or pixels, is required to re-
present most letters at a 90 percent recognition rate (6,7). A lesser number
results in a significant decrease in legibility, while an increase to more
than 10 achieves a corresponding increase in recognition to 95 percent. Given
a 5 x 7 pixel matrix as a minimum, it has been found that fewer errors in
character recognitj~~ result when a maximum number of pixels is used for the
character outline ). Such considerations are very important, since most
vendors offer a user definable character set option that could be used to
rectify deficiencies in the standard set.
Character case has an effect on both performance and preference. Studies
indicate that upper ca9~,letters are more legible than lower case and are also
favored by the viewer ). Finally, to ensure legibility, the character height
must subtend a minimum visual angle of 15-16 minutes of arc (6). The degree of
SCREEN
MATRIX
PAGENO="0187"
183
CHARACTER
WIDTH ________
CHARACTER CHARACTER ~ ________ ________
RATIO HEIGHT I I t ________
(W:H2:3T0 1:1) L ~ _______
-~_~-STROKE WIDTH
STROKE CHARACTER f________
WIDTH TO HEIGHT _______ _______
HEIGHT I ________ ________
(1:810 1:10) ________
DOT 5X7 ~j~+~j_J 5X5[-~J
IX _ _
CHARACTER MAX.NO. ______ MIN. ______
FONT OF DOTS NO. OF ______
(MAXIMUM _______ DOTS _______
NUMBER OF DOTS) ________
CHARACTER UPPER ________ LOWER
CASE (UPPER) CASE ________ CASE ________
VISUAL
ANGLE
(15-16 MINUTES
OF ARC)
Fig. 4: Alphanumeric Character Attributes
subtension must be used as a unit of measure, since the viewing distance may
vary for different applications. Conversion to actual character height will
be discussed later.
One can immediately see that the pixel size has a great influence on the
legibility of the individual character. The stacking and arrangement of pixels
relative to one another determines all of the character attributes mentioned.
While actual character forms will vary with system manufacturer, the ideal
character described in Figure 4 will be assumed for the remainder of the dis-
cussion. Characters having these attributes will now be integrated into mean-
ingful groups to produce readable alphanumeric displays.
PAGENO="0188"
184
ALPHANUMERIC DISPLAYS
Alphanumeric displays, by virtue of their purpose, tend to contain large
quantities of information. It is the designers task to simplify the display
by giving the operator what he needs when he wants it. The designer must keep
in mind that the operator learns an~ rgmembers, therefore, information about
the steady state is often redundant~'°). While a certain degree of redundancy
is necessary, the display must be optimized for change detection by the
operator. Only by careful consideration of such human factors can the man-
process interface be successful. The discussion of this category of displays
will follow a list of questions formulated during prior workt3). As shown in
Table I, four major areas of concern must be addressed: format, coding, density
and rate of change. Each area treats the alphanumeric display in progressively
greater detail to produce a readable presentation.
Format
The format of alphanumeric displays deals with the overall organization
of the presentation. Three questions must be answered before considering the
individual elements that comprise the display: printed versus flow chart form,
arrangement of information, and size of the display area. The majority of
alphanumeric displays are lists of messages and/or parameters. However, a sig-
gnificant number may involve procedures or guidelines for the operator to
follow in specific process control circumstances, such as startup or refueling.
Generally it has been found that people misunderstand printed instructions
one third of the time (the two-thirds comprehension rule). Under appropriate
conditions, significant improvement in comprehension can be achieved using a
flow chart scheme. By representing each step or decision in. the instruction
sequence\as a separate process in the flow chart arrRngpment, operator compre-
hension can be increased to greater than 80 percent ~ ). Therefore, if the
A/N display~is used for guidelines or procedures, one should seriously consider
organizing the steps in such a form.
TABLE I
GUIDING QUESTIONS FOR ALPHANUMERIC DISPLAYS
FORMAT 1. PRINTED VERSUS FLOWCHART FORM
2. ARRANGEMENT OF INFORMATION CATEGORIES
3. SIZE OF ACTIVE DISPLAY AREA
CODING 1. INDIVIDUAL VERSUS GENERIC LABELS
2. ESSENTIAL VERSUS NON-ESSENTIAL DATA
3. MULTIDIMENSIONAL CODING COLOR, BLINK
DENSITY 1. NUMBER OF DISTINCT INFORMATION CATEGORIES, PLACEMENT
2. NUMBER OF LETTERS AND DIGITS
3. CHARACTER SIZE AND SPACING
4. WORD AND SENTENCE SIZE
RATE OF CHANGE 1. CHANGE OF DATA WITHIN CATEGORIES
2. CHANGE OF CATEGORIES
PAGENO="0189"
185
This point is illustrated by Figures 5 and 6. The example deals with a
representative procedure the nuclear power plant operator must adhere to fol-
lowing a reactor trip. Figure 5 uses conventional printed instruction format
to guide the operator through the critical steps. While this traditional re-
presentation is adequate, given a sufficient amount of time, there is serious
potential for misunderstanding. Figure 6 may improve the comprehensibility of
these procedures by using the flow chart concept. The boxes to the right of
each branch signify the desirable condition, while the boxes to the left are
abnormal and require operator intervention. Although multiple pages are
necessary to present the same procedure, search and comprehension times for
the entire procedure can be reduced.
If the content of the display is such that the flow chart technique is
not applicable, one is still not constrained to using a purely columnar orga-
nization. The neat lineup of each row of alphanumeric data found in standard
lists is valuable for comparison tasks, but adds to the confusion when informa-
tion is not related. An implicit line is fpj~qied on the screen by eye motion
as the operator scans a row of characters'~ I. If additional but dissimilar
data is placed on the same row, there is natural inclination to connect the
two groupings. Intelligent rearrangement can avoid such implications and
improve comprehension~(Figure 7). While still labeledan alphanumeric display,
the information categories are arranged functionally. Information categories
are defined as one or more related parameters grouped together. The path from
the Oil Lift Pump information category (comprising the related flow and pres-
sure) to the Main Oil Tank category (level and pressure) implies a functional
relationship between categories but not between the constituent parameters.
Spacing and offset tends to interrupt eye movement to negate any implication
of interconnection across the screen.
* ALL ~CEA'S FULLY INSERTED? (MAN TRIP IF NOT)
* REACTOR POWER DECREASING?°
* IURB TRIPPED t liEN BKR OPEN? (MAN TRIP IF NOT)
$ STM liEN PRES AT 988 PSIA?
* FDWTR FLOW REDUCED TO. 5~ FULL LOAD FLOW?.
* (HI PRES TRIP ONLY) PZR PWR OPERATED RELIEF YLY OPEN?
* (LU STM GEN PRES ONLY) MS ISO YLY SHUT?
* (HI CNTMNT PRES/LO PZR PR~S ONLY) SAF INJ INITIATED?
* (51R5'4161Y PUS UND y) EMER DIESEL GEN STARTED?
$ TWO RCP OPERATING?
* PROPER PZR LYL BEING MAINTAINED? (MAN CTRL IF NOT)
$ UNIT LOADS XF'RD TO RESERVE SIR SYC XFMR?
Fig. 5: Procedures in Traditional ListFormat
PAGENO="0190"
-~
~1
0
P~P') mr CD
~1
..I~
0
r --i ~ r vi ~ ~ -C ~ I
~ ~-4DcCD~c -~ U
~- vi W-4 I
~ ~ ~ -4 ~ ~ -4 ~C *1
vi ~ r- ~
~ ~ -4
-n
~ w ~ ~ -v 0
~ - ~ ~1
~ m f-- CD
4+
UI -~ ~ ~ P~) ~ Cs) Cs)
~o UI ~4 ~ UI
UI ~
~- -4-J-~
~-4 -~ ~ uir-
(a
CD
CD
-f
0
CO
-n
4+
CD
-c
PAGENO="0191"
187
When explicit lines on the screen are required, such as alarm lists and
directories, each line forms its own information category as illustrated in
Figure 5. In this case interconnection is not only desirable, but~necessary to
form the message string or sentence. Horizontal eye movement must be encouraged
by using appropriate spacing between constituent words. Vertical movement must
be discouraged by making the sentence a complete thought. More will lie said on
this when placement within information categories is discussed.
The third point involving alphanumeric displays is that of active display
area. The usable display area has been defined in Figure 1. The question now
arises as to how much of this area should be covered with information. Margins,
forming white space, have long been used in printed matter. But what con-
stitutes a margin on a CRT? If one extrapolates from accepted charting tech-
niques, an 11 percent margin should be allotted for the longer dimension and
a 20 percent margin for the shorter side (13)~ Esthetics is another important,
but often overlooked, consideration. Since the operator must view the same set
of displays for an extended period of time, a pleasing display would also
enhance comprehension. Although it is difficult to quantify esthetics, initial
guidance may be obtained from the concept of the Golden Rectangle, which
specified a ratio of 0.618034 between active display area borders. This rela-
tionship is a naturally occurring phenomenon and appears to be preferred by
the majority of viewers(14).
Thus the active display area should be a Golden Rectangle that allows
sufficient margin without violating the usable display area. A few simple
Computations yield a suitable rectangle that meets all of these criteria. As
summarized in Table II, the specified diagonal was used to compute the tube
size. The horizontal dimension was then reduced by 11 percent and the vertical
dimension computed using the golden ratio. The results were rounded to the
nearest half inch to define the active display area for representative
systems. As seen in Table II, an active display area of 13.5 x 8.5 pro-
vides sufficient margin for a lg-jnch screen, approximates a golden rectangle
and still fits within the usable screen area. Naturally this is only a
starting point and may be violated if layout circumstances dictate.
TABLE II
REPRESENTATIVE ACTIVE DISPLAY AREA SIZES
SPECIFIED COMPUTED SCREEN USABLE SCREEN ACTIVE DISPLAY AREA
DIAGONAL SIZE' (Xm xYm) SIZE2 (XA X
1IY' 8.17' x 6.0' 7.36" x 5.05" 7.0" x 4.5"
13" 1O.4"~ x 7.8" 9.57" x 7.18" 9.0" x 5.5"
15" 12.0" x 9.0" 11.03" x 8.28" 10.5" x 6.5"
17" 13.6" x 10.2' 12.54" x 9.39" 12.0" x 7.5"
19' 15.2" x 11.4" 14.00" x 10.50" 13.5" x 8.5"
1. X~ + Y~ = (DIAGONAU2
Xm : Ym = 4 : 3
2. FROM FIGURE 1
3. XA OB9Xm ? ROUNDEDTOTHE
YA = O.618XA ~ NEAREST HALF INCH
PAGENO="0192"
188
Coding deals with the representation of information categories on the
screen. For alphanumeric displays, the coding schemes are limited to characters
and perhaps color, blink and intensity, if available. The designer's main
concern is the effective portrayal of information using a minimum number of
characters to increase comprehension and decrease density. Various techniques
will be suggested that attempt to increase comprehension using the available
coding schemes. These techniques will have a direct impact on display density.
One effective coding technique is the use of generic labels, whenever
possible. This is particularly applicable within the context of information
categories, as illustrated in Figure 7. The text string MAIN OIL TANK qualifies
as a generic label for that category and has two sublabels, level and pressure.
While the same information could be listed as MAIN OIL TANK LEVEL and MAIN OIL
TANK PRESSURE, the increased density does not add information and therefore
represents noise. Furthermore, the generic information category label tends to
link the sublabels together, since the sublabels themselves are not sufficient
for parameter definition. However, one must ensure that the generic label is
readily distinguishable and that the sublabel relationship is obvious; e.g.,
through proximity.
Once the information categories have been defined, the display must be
analyzed to place emphasis on the information, rather than the background. It
is apparent that labels and sublabels are non-information bearing if they do
not change their content during the life of the display. This criterion dic-
tates that items such as dimensional units are also non-information bearing.
Alphanumeric displays are the easiest to analyze for classification as to in-
formation content, provided one keeps the change criterion in mind. Parameter
values that may vary qualify as information bearing; items that cannot change
are background. This will be slightly modified in subsequent paragraphs to ac-
count for alarm conditions when color is available.
Color coding is another technque that can be very beneficial when used
as a redundant code( 3). Given a seven-col or plus black capability, each col or
must be assigned a specific purpose and used judiciously. Reference 3 details
the considerations used in making this assignment and Table III lists the
TABLE III
RECOMMENDED COLOR CODES FOR ALPHANUMERIC DISPLAYS
COLOR USE
BLACK ~-BACKGROUND
BLUE ~-LABELS, UNITS
CYAN-~- -PARAMETER VALUES
OPERATOR MESS AGES
GREEN- ~~~~___STATUSW?RDS
WHITE -~---------STATUS WORDS -
INTERMEDIATE
(ON, OPEN)
RED~- - ---------STATUS WORDS
(ON, OPEN)
YELLOW ~-CAUTIONARY ALARM
MAGENTA -~--ALARM - IMMEDIATE
ATTENTION REQUIRED
PAGENO="0193"
189
standard colors and their associated conditions for alphanumeric displays.
As stated above, items ssch as units and labels are non-information bearing
and therefore are coded in blue, whereas parameter valses use cyan. Since
operator messages such as guidelines and directories are accessed for their
content, they too should be coded in cyan. Black is used as the background
color in all instances.
When the parameter value is a state rather than a numeric, the status
word should be coded in either green or red to match the state. An alternative
is to code the label in one of these colors and delete the status word entirely.
However, this negates the redundancy desired for color and also puts unneces-
sary emphasis on certain components due to its label length. A valve whose
label happens to be longer than others would attract more attention by virtue
of length, which may not relate to its importance. The effects of such varia-
tions is minimized by using blue labels. Standard status words such as CLSD,
OPEN, ON and OF ensure equal treatment and redundancy with a minor increase
in density. When the state is intermediate to fully off and fully on (or closed
and open), the status words ON or OPEN should be used with the white color.
Additional information may be presented by using a lower intensity white to
indicate that the component is currently being maneuvered within the inter-
mediate state. A high intensity white would indicate that the component is
currently fixed at some point between the state extremes. Adding another coding
dimension, such as intensity, increases the information content without an
attendant increase in density.
Ihen a parameter on an alphanumeric display goes into the alarm state,
one should change the color of both the parameter value and label to either
yellow or magenta. This applies only to alphanumeric displays because of its
density. Such a technique will greatly improve search and comprehension times.
For a motor vibration alarm in Figure 7, the label VIBRATION and its value
would be colored yellow so the operator can quickly differentiate which para-
meter is in alarm and its value. Labels at this time are information bearing.
Another coding dimension can be added here by enclosing the alarmed value in a
rectangle to reinforce the message. If the system also has a blink capability,
it is best to blink only a small portion of the message, such as the rectangle
or the value itself. Keep in mind, however, that it is difficult to read
characters that blink between full intensity and off. rdeally one should remove
the blink as soon as the search task is complete and before the operator ac-
tually processes the information.
An additional coding recommendation involves indication to the operator
of continuation pages. Figure 6 rearranges the data of Figure 5 into flow chart
format, but requires more than one display page to complete the presentation.
The arrow in the lower right corner of Figure 6 indicates that more information
on this subject is found on "the next page." A number is used to maintain opera-
tor orientation within a series of such pages(l5). Thus the operator should be
made aware of the continuation series and how far into the series he has gone
with the current display.
Density
The neat level of detail to be addressed in Table I is the density of in-
dividual in ornation categories. Reference 3 determined that no more than 25
percent of the screen should be covered with data.. The arrangement of con-
stituent parameters and the number of characters used are important aspects in
designing low density alphanumeric displays. The designer must determine the
intended use of the parameter for each category. If a comparison task is in-
tended for like parameters, the tabular arrangement is preferred. The operator
can quickly compare digits without having to realize the actual values. The
temperature and flow values for the two oil cooler loops of Figure 7 illustrate
this point. The close proximity and columnar alignment of the two "85" numeric
character strings tell the operator that both temperatures are equal. With a
little more human processing, he may then realize that "85" is an acceptable
value. Tabular arrangement also allows patterns to be detected between like
parameters, as seen by the decreasing temperature sequence of the Upper Journal,
Thrust, and Lower Journal Bearing entries of Figure 7. In all cases, parameter
labels (or sublabels) should be left justified and parameter values right
justi fi ed.
Since the columnar alignment is so applicable for comparison, one is
immediately tempted to deliberately avoid such alignment for dissimilar
48-721 0 - 79 - 13
PAGENO="0194"
190
parameters within the information category. Returning again to Figure 7, why
not stagger the constituent parameters to emphasize non-comparison of unlike
parameters, such as the level and pressure for the main oil tank. Although
this technique seems logical, it also destroys the orderliness of the display
and makes it difficult to relate parameters to their information categories.
In summary then, while it may be effective to avoid the tabular arrangement
between information categories, it is best to use this arrangement for all
constituent parameters within the category, regardless of their similarity.
Arrangement of the constituents within information categories of tradi-
tionalalphanumeric displays is equally as important. While the format of
Figure 5 may be improved using a flow chart format, the display as shown is a
good exan~le of a traditional representation and illustrates some interesting
points. In this case, each line forms the individual information category,
and the words that comprise each line are the constituents. As a minimum, one
expects---perhaps erroneously---good sentence construction to dictate the
placement of words. It is interesting to note that while syntax is precisely
defined for computer input, little is said about the structure of computer
output. Significant improvement in such output can be made by merely adhering
to accepted grammatical principles and accounting for what is known as the
serial position effect (16). This effect states that words at the beginning
and end of message strings are more easily remembered (recalled) than the
words between the extremes. Comprehension and retention of a message can be
measurably increased by placing the most important words at these extremes.
The lines i~n Figure 5 are concise and descriptive, containing little more than
a subject and verb. Lines 6-~ state a particular condition and then an action.
If the current situation does not match the stated condition the operator
need not read further. Similar techniques can be used to advantage on alarm
lists, directories and other alphanumeric displays.
The next problem to be addressed in Table I is the number of letters and~
digits used within the information category. The numeric parameter value is
read with best accuracy when there are four characters or less (3, 15). Since
the status words have already been defined (ON, OF, OPEN, CLSD) to meet this
criterion, the designer need only be concerned with numerics and labels. Values
that contain only integers pose little problem in that the maximum (gggg) is
sufficiently large to account for most situations. Values having fractional
portions do cause some concern and can be displayed in modified scientific no-
tation. As illustrated by the oil lift pump flow value in Figure 7 (5.00+1),
the number of characters can be reduced without losing information by deleting
the 10 multiplier of standard scientific notation. Although 6 characters are
required, the representation is sufficiently compact so as not to cause un-
necessary confusion. When the exponent of this notation is zero (i.e., the
value is between 0.00 and g.gg), both the sign and the zero digit should be re-
moved to aid the cleanliness of the display. Consideration should also be given
to blanking values which read zero and leading zeros should always be suppress-
ed.
Determining the number of characters for labels is not quite as simple
due to the wide range of possibilities. Constituent parameter labels should
always contain fewer characters, preferably 5 or less, than their associated
information category label. Consistent and accepted abbreviations, such as
PRES arid TEMP, should also be used throughout, with all punctuation deleted (i.
e., PRES versus PRES.) (15). The number of characters used for the category
label should not exceed 12, but still must convey the information to the opera-
tor. Accepted abbreviations, mnemonics and acronyms consistent with the data
base identifiers can be used to advantage in this case. If more than 12 charac-
ters are necessary, it is advisable to divide the string into smaller segments
or chunks' (17) using space characters, providing the label is amenable to such
division. Punctuation should also be minimized in the message string (15).
Character size is another consideration in this display category. Figure 8
illustrates the relationship between character height and maximum recommended
reading distance. The criterion for legibility is taken from Figure 4, which
specifies a minimum visual angle of 16 minutes of arc. Since the character size
in linear units is dependent on the display generator used and its associated
pixel dimensions, the designer must perform a simple computation. Figure 8 then
gives him the related reading distance. If the operator is expected to read a
CRT message at. a specified distance from the screen, the designer must use these
relations to ensure such reading is possible.
PAGENO="0195"
220
200
180
~ 160
Vi 140
~ 120
~ 100
~ 080
~ 060
40
20
0
191
0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1.0
CHARACTER SIZE, INCHES
Fig. 8: Maximum reading distance for characters of various size
Spacing is an important element that has a large impact on the readability
of alphanumeric message strings. The optimum intercharacter spacing is 75 per-
cent of the character width(1H). This results in a round off value of 4 pixels
in the horizontal direction for the standard 5 x 7 character matrix. Care must
be exercised in using this value, since the addressability constraints of a
particular display system may not allow such spacing. Interline spacing is a
function of the information category. Within the category, the lines should be
more closely spaced to keep the data within the operator's span of attention.
Quoted values of 30-50 percent of character height(6) for printed text are
probably minimal for CRTs, due to the irradiance mentioned before. A value of
75 percent character height was chosen as the recommended interline spacing
within information categories. For the 5 x 7-dot matrix, this translates to 5
pixels or 71 percent of character height achievable. Various intercharacter
and interline spacings are shown in Figure g* Blocks A, B and C have inter-
character spacings of 20 percent, 60 percent and 100 percent respectively
while blocks 0, E and F have respective interline spacings of 100 percent, 71
percent and 28 percent. Blocks B and E are identical, each having intercharac-
ter spacings of 60 percent and interline spacings of 71 percent. These are the
best approximations achievable with the display system used.
Sufficient space should be allotted between categories to avoid encroach-
ment of one category on the span of attention of another. At 28 inches from a
19-inch CRT, the ideal distance between centers of adjacent information cute-
gee.4ea4.a~Z~.j~sches, representating a visual angle of 4 degrees. Here again,
one must use this value as an initial guide for the display in question. If the
display is a simple alphanumeric list such as a directory, vertical movement
is constrained by having explicit lines. Hence, the interline spacing may adhere
d
d"-0.0003 D
ASSUME f3 = 16'
d 0.0048 D
D = ~= 208.33d
PAGENO="0196"
192
A B C
TEMP TEMP
IP~TOP OIL 1~ PKSTOP OIL 131 PKSTOP OIL 131
`~`~ 1~ UP RAD PRG 135 UP RAP IRG 135
~ 148 AXIAL PRG 148 AXIAL PRG 14.
STATOR 228 STATOR 228 STATOR 228
LU~iRG 147 LW RAP PRG 147 LW RAD PRG 147
TEMP TEMP TEMP
PKSTOP OIL 138 PKSTOP OIL 130
UP RAP PRG 135 Up RAP PRG 135 PKSTOP OIL 138
AXIAL PRG 148 AXIAL PRG 14S
STATOR 221 STATOR 221
LW RAP PRG 14? LW RAP .PRG 147
LW RAP PRG 147
E F
Fig. 9: Variations in intercharacter and interline spacing
to the 75 percent rule unless a greater distance is desired for emphasis. At
no time should the spacing be less than this amount.
Rate of ~
Rate of change determines how often the information on the *CRT should be
updated. In many instances the data base is modified at a very rapid rate.
While the operator needs the most recent information, computer processing speeds
are orders of magnitude greater than that of human processors. What does
`most recent" mean to a human? The human "now" or psychological present is a
time interval between 2.3 to 3.5 seconds(19). Hence, there is a point at which
one can saturate the human capacity by presenting data more quickly than it
can be comprehended.
On alphanumeric displays, saturation for a single parameter is reached
when the digits appear to `wheel," i.e., change faster than the human can ad-
equately comprehend each discrete reading. This is an increasingly familiar
event, considering the proliferation of digital readouts in modern display sys-
tems. Another factor to consider is the potential conflict with blink rates as
the values change. The display of rapidly changing values could cause the dis-
play to appear to blink if the update and blink rates are similar. To prevent
both these events, a.e-_iudis~Ldu&L~pLae~ta.r~-upd.ate.ta.te.of 1. Hz or less is
tac.oauu~exi.cted. This allows sufficient human processing time between changes and
still provides recent information, within the response time of the operator.
While this 1-Hz rate is applicable for single parameters, one must be con-
cerned with the entire screen update as well. Each parameter update rate may
meet the stated criterion, but appear on the screen at slightly different times
to cause a twinkling effect which adds confusion. Assume the update rates of
PAGENO="0197"
193
parameters A, B, C and D are maintained at 1-Hz each, but sent from the com-
puter with time separations of 250 msec. The operators' attention would be
diverted from A to B to C to 0, without allowing `im to process each para-
meter. This twinkling can be alleviated by undating all the required para-
meters at the same time, no faster than once/second. This gives the operator
a static picture of the process within the last second, much like the blink of
an eye.
SUMMARY
Although alphanumeric CRT displays have been used to present computer-
generated information for many years, the design of such displays has been
left to the discretion of computer personnel with little guidance. It is the
operator who must use this information. His attributes, rather than the com-
puter's, must dictate the design. For the convenience of the display designer,
the recommendations concerning alphanumeric displays are summarized as follows:
- determine pixel size and evaluate character attributes according to
Figure 4
- consider the use of flow charts for procedures and guidelines
- avoid explicit or implicit lines when information is not related
- keep display density to less than 25 percent
- start with the Golden Rectangle
- use generic information category labels
- labels and units are non-information bearing; values are information
bean ng
- apply the color code of Table III
- number continuation pages
- avoid columnar arrangements between information categories unless
comparison is desired; retain the columnar arrangement within cate-
gories regardless of the task
- left justify labels, right justify values
- account for the serial position effect
- use 4 digits or less to represent numeri cal values; use the modi fied
scientific notation if fractions are necessary; suppress leading zeros
- information category labels should be limited to 12 characters; con-
stituent labels should not exceed 5 and be less than the associated
category label
- character size should be chosen to subtend 16 minutes of arc at the
specified reading distance, Figure 8
- intercharacter spacing of 75 percent character width and interline
spacing of 75 percent character height should be used within informa-
tion categories
- 4 degrees viewing angle spacing should be maintained between adjacent
information category centers
- update individual parameters no faster than once/second
- perform all required updates at the same time, within the one-second
rate.
PAGENO="0198"
194
REFERENCES
1. Davis, S., Computer Data Displays, Prentice-Hall, Inc., Engle-
wood Cliffs, New Jersey, 1969.
2. Danchak, M. M. , `The Man-Process Interface Using Computer Generated
CR1 Displays," Instrumentation in the Power Industry, Volume 20 (New Orleans,
1977), Instrument Society of America, Pittsburg, Pennsylvania, 1977.
3. Danchak, H. H., "CR1 Displays for Power Plants," Instrumentation
Technology, Vol. 23 (10), 1976, pp. 29-36.
4. McCormick, E. I., Human Factors Engineering, McGraw-Hill Book
Company, New York, 1970.
5. United States Military Specification No. MIL-M-18012B (July 20,
1964).
6. Gould, J. D. , "Visual Factors in the Design of Computer-
Controlled CR1 Displays," Human Factors, Vol. 10, 1968, pp. 359-376.
7. Sherr, S., Fundamentals of Display System Design, McGraw-Hill
Book Company, New York, 1963.
B. Maddox, H. E. , Burnette, J. 1., and Gutmann, J. C., "Font Compa-
risons for 5 x 7 Dot Matrix Characters," Human Factors, Vol. 19, 1977, pp.
89-93.
9. Vartabedian, A. G. , "The Effects of Letter Size, Case and Genera-
tion Method on CR1 Display Search Time," Human Factors, Vol. 13, 1971, pp.
363-368.
10. Cornsweet, 1. N., Visual Perception, Academic Press, New York,
1974.
11. Kammann, R., "The Comprehensibility of Printed Instructions and
the Flow Chart Alternative," Human Factors, Vol. 17, 1975, pp. 183-191.
12. Green, E. E. , "Message Design - Graphic Display Strategies for
Instruction," Proceedings of the Annual Conference, ACM `76, 1976, pp. 144-148.
13. Enrick, N. L., Effective Graphic Communication, Auerback
Publishers, Princeton, 1972.
14. Hoffer, W., "A Magic Ratio Recurs throughout Art and Nature,
Smithsonian, Dec. 1975, p. 110.
15. Engel, S. E. and Granada, R. E. , Guidelines for Man/Display
Interfaces, Technical Report TR 00.2720, IBM Poughkeepsie Laboratory, Dec.
1975.
16. Murdock, B. B., Jr., "The Serial Position Effect of Free Recall,"
Journal of Experimental Psychology, Vol. 64, 1962, pp. 482-488.
17. Miller, G. A., "The Magic Number Seven, Plus or Minus Two: Some
Limits on our Capacity for Processing Information," The Psychological Review,
Vol. 63, 1965, pp. 81-97.
18. Hodge, D. C., "Legibility of Uniform-Strokewidth Alphabet;
Relative Legibility of Upper and Lower Case Letters, Journal of Experimental
Psychpjpgy, Vol. 1, 1962, pp. 34-46.
19. Miller, R. B., "Response Time in Man-Computer Conversational
Transactions," Proc. of the Fall Joint Computer Conference, 1968, pp. 267-277.
PAGENO="0199"
195
COMMITTEE ON SCiENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
SUITE2S2T'RAYBIJRN HO5SEOFFICEBUILDING
WASHINGTON, D.C. 20515
dr. lilton Levenson
Director, :luclear Poller )ivision
Electric Poller Research Institute
3412 Hillvie, Avenue
p.O. 3ox lqll2
Palo Alto, CA 9~3~3
Dear ~r. Levonson:
Inank you for nroviding testinony at our subcormittee hearings on
lucloar Power Plant Safety on lay 22, 1979. Dunce these hearings you
indicated that you would erovide the subcommittee iith responses to a
canter of oJestions, tocether with other additional information. Enclosed
is list of questions, we oul! aperociate recsivinc your resnonse by
June 25, 1E7.
Th~nt `iou for your coo'nnratio.
Sincerely,
~~El1c~l!ACK
Chairman, Subcommittee on
Enemy `essarch and Production
Enclosure
PAGENO="0200"
196
SUBCOM~IIUEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
ADDITIONAL QUESTIONS FOR MR. M. LEVENSON
1. Is there a need for a Swat Team composed of people from industry, the
utilities, the NRC, etc.?
2. What are the advantages and disadvantages of standardizing the design of
nuclear power plants?
3. What would be the attitude of equipment manufacturers and plant constructors
to standardization?
4. Should there be a standard design for control rooms and for the layout of con-
trol room instrument and control panels?
5. Discuss and provide recommendations for means of using computers or micropro-
cessors to enhance the power plant operators ability to recognize
abnormalities.
6. What design changes or procedural changes would you recommend to improve the
defense against lesser accidents that you mentioned in your testimony?
7. What are your recommendations for improving the safety of nuclear power
plants?
8. What role should your institution play in improviflg nuclear power plant
safety?
9. List the research and development programs which you would recommend to im-
prove nuclear power plant safety.
10. Should the training of nuclear power plant operators be improved? List your
recommendations.
11. Should the control room operators be employed by the utility or should they
be employed by some other agency?
12. How can the performance of the NRC be improved?
PAGENO="0201"
197
ELECTRIC POWER RESEARCH INSTITUTE
July 23, 1979 EPRI
The Honorable Mike McCormack
U. S. House of Representatives
Washington, D. C. 20515
Dear Mike:
Your recent letter requested additional information on twelve questions
as a follow-on to the Hearings on Nuclear Power Plant Safety. I must
apologize for this delayed response which is largely due to my extremely
heavy travel schedule. Several of the questions that you pose raise
broad issues still under study, but I will attempt to provide you some
indication of what my current thinking is:
Qi) Is there a need for a `Swat Team" composed of people from
industry, the utilities, the NRC, etc.?
Al) It is not clear what is meant by a "Swat Team". If the question
refers to a group to come in, take control, and operate the plant,
it might well be both unsound and unsafe. Each plant is somewhat
different, and it is essential that only people familiar with a
specific plant in great detail be allowed to operate it. On the
other hand, support groups - both technical and non-technical - to
provide backup for the plant staff can be very useful. Whether
such backup support comes from the utility itself or from a
broader group depends upon the size and resources of the utility.
Alternative ways of providing such support are under study as part
of the current industry overall review and assessment.
Q2) What are the advantages and disadvantages of standardizing the
design of nuclear power plants? and
Q3) What would be the attitude of equipment manufacturers and plant
constructors to standardization?
A2 & The question of standardization of power plants is extremely complex.
A3) When one considers the barriers of the present licensing process,
the difference in site requirements (seismic, etc.), the difference
in location - (no-frost areas like Florida versus cold areas like
Minnesota or Michigan) - and technical differences arising from
things like sea water versus fresh water cooling, true standardiza-
tion to a single design is probably not possible or even desirable.
On the other hand, standardized systems or subsystems are probably
quite possible and might be very valuable if the licensing system
were revised to make their use practical. If a system design could
be licensed so that it could be manufactured in a controlled manner
and purchased with an assurance that it was usable in a licensed
plant, it might be quite practical. On the other hand, if it
Headquarters 3412 Hillview Avenue, Post Office Boy 104t2, Palo Alto, CA 94303 (415) 855-2000
Washington Office: 1750 New York Avenue NW Suite 835. WashingtOn. DC 20006 (202) 872-9222
PAGENO="0202"
198
The Honorable Mike McCormack July 23, 1979
U. S. House of Representatives Page 2
cannot be licensed in advance of purchase, there is little chance
that any move toward standardization will occur. A major advantage
of standardization is that very extensive analysis and study
combined with the learning curve that comes from repetition tends
to produce more reliable and cheaper plants. On the other hand,
if standardization is carried too far (winter insulation in southern
plants, etc. ), the non-optimum feature may override the good - thus
the idea of standard building blocks rather than a standard plant.
Q4) Should there be a standard design for control rooms and for the
layout of control room instrument and controlpanels?
A4) If the plants are not identical, the control rooms probably cannot
be identical. (The panel of a DC-lU is not identical to that of
a 747, etc.) However, better use of Human Factors Design can
probably be made in most cases. More important than a standard
control room may be a control room designed for off normal as well
as normal operations. This might include methods of prioritizing
alarm signals, etc. This area is also currently under study.
Q5) Discuss and provide recommendations for means of using computers
or microprocessors to enhance the power plant operator's ability
to recognize abnormalities.
A5) The question of data display is extremely complex and currently
under study. It isn't yet clear whether more computerization or
less computerization is the right answer. For example, in many -
cases, old fashioned" strip chart recorders give a clearer picture
of what is happening than a computer printout with alarms does.~
The overall system optimization of man-machine interface remains
to be done.
Q6) What design changes or procedural changes would you recommend to
improve the defense against lesser accidents that you mentioned in
your testimony?
A6) To protect against lesser accidents requires a detailed plant
specific review. A review of set points such as building isolation
systems, when safety and emergency systems are activated or
initiated, are the plant staff trained for lesser events or only
"big breaks", do the emergency procedures cover small accidents,
is the emergency power supply correct for small accidents, etc.
Specific design and procedural changes (if any) will follow from
such a plant specific review and are generally not generic.
Q8) What role should your institution playin improving nuclear power
plant safety?
A8) EPRI has underway substantial R & 0 programs whose objectives are
improved understanding of safety related issues of nuclear power.
Some of these programs will be refocused such as from big LUCAs
to smaller LUCAs, etc. However, many of the questions are
PAGENO="0203"
199
The Honorable Mike McCormack July 23, 1979
U. S. House of Representatives Page 3
institutional, legal or engineering applications rather than R & D
and currently EPRI has a role only in such matters as pertain to
R & 0.
Q9) List the research and development programs which you would recommend
to improve nuclear power plant safety.
A9) The TMI accident has not really identified new areas of research,
but only indicated some changes of priority. Although I am in the
"research business", I would advocate serious review before any
extensive new programs are launched in the name of improved nuclear
safety. There are a few obvious cases such as improved Human Factor
Studies, etc., but a much more urgent need is probably support for
basic and applied work in chemistry and materials - support that has
largely disappeared since the transition of the AEC into ERDA and
then DOE. Problems like pipe cracking and turbine cracking not
only affect nuclear plants, but are important in all power plants.
Similar problems will arise in pipe lines, synthetic fuel plants,
thermal solar plants, geothermal plants, etc. Substantial long-term
programs are needed in materials properties, materials aging, stress
corrosion, basic corrosion phenomena, fracture mechanics, crack
arrest, crack propagation, fabrication effects, non-destructive
testing, and all the related aspects of the life expectancy and
causes of deterioration of metal components.
QlO) Should the training of nuclear power plant operators be improved?
List your recommendations.
A1O) Operator training should probably be revised. It isn't yet clear
what "improved" means. The operator is one part of the system, and
more assessment and study is required before it is clear what the
optimum training should consist of. The plan being prepared for
the industries' new Institute of Nuclear Power Operation (INPO)
will be addressing this as a major issue.
Qll) Should the control room operators be employed by the utility or
should they be employed by some other agency?
All) Control room pperators should be employed by the entity responsible
for the plant. The idea of non-line organization employees has
really never been very successful, especially when serious questions
of responsibility are concerned.
Q12) How can the performance of the NRC be improved?
Al2) Any organization can be improved - few things are perfect. The
purpose of improvements is to do a better job or to come closer
to achieving an objective. I believe that before changes are made
in the NRC, it is necessary to clarify its' objective. At the
moment, its' charter seems quite diffuse and possibly so broad
PAGENO="0204"
200
The Honorable Mike McCormack July 23, 1979
U. S. House of Representatives Page 4
as to interfere with its primary mission. I believe the function
of the NRC should be strictly limited to assuring public health and
safety. Questions of need for power are already the domain of
state PUC's or similar authorities; a `better site" syndrome can
lead to nothing other than administrative paralysis - the question
should be only "is the proposed site safe enough?; the review of
export hardware can certainly not be significant in the absence of
either details or control over the entire system in which the
hardware will be used (the NSSS is approximately 10% of the total
plant). This does not mean there should not be export licensing -
butpolitical objectives and controls should be separated from the
NRC role in public health and safety. After the objectives are
clarified, then changes can be recommended to improve the probability
of achieving those objectives. My personal conclusions are that
this should result in a smaller, more streamlined organization
rather than an even larger more diffuse organization.
Again, let me apologize for the late response.
Sincerely,
ELECTRIC POWER RESEARCH INSTITUTE
y~~(r ;~
Milton Levenson
Director
Nuclear Power Division
ML:pb
PAGENO="0205"
-~ -103)---1
~< ~-~(<
(< 0~ 33 -~
o ~3-(~<-~.
o ~j ~
(3o~33. 0
0-3
(3
p
3 3 P
0-U. ~-( (-( 3
(0
(3
(0(3
(3 _ç~~
~< -_j 0(0~
(0 ~+~<
(-5
0
çn~
x;;i
Orn
Co
Co
Sn>
(I)Z
1rn
C.,
<2
mo
0
C)
U
~ ~ ~
PAGENO="0206"
202
SUBCOi~lITTEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER REACTOR SAFETY
ADDITIONAL QUESTIONS FOR HR. KENNEDY
1. What is your professional opinion of the performance of design engineers in
general (not related to Stone and Webster)? What are their attitudes regarding
dttention to detail, personal responsibility, outside study to maintain techni-
cal competence, thirst for perfection, etc.?
2. What is your opinion of design supervisors? Do they check the work of their
engineers and designers? How carefully? Are they timid, or do they criticize?
Do they develop their personnel into better engineers?
3. If these questions seem out of place, why was there no way of verifying that a
major valve was open or seated on the primary loop of Plant 110. 2 at Till when
an open valve could, in itself, constitute a LOCA?
4. What is your opinion of the effectiveness of the NRC during the design phase?
Do they do complete detailed design reviews? Do they have adequate personnel
for this? Are they sincere? Do they interact constructively with the utilities,
the equipment manufacturers and design engineers? Are they procedure oriented
or plant oriented?
5. What is your opinion of the construction workers? Specifically, do they want
to work? For power plant construction, what is the productivity of labor
today vs 1969 in such measureable items as inches of weld per hour, number of
feet of pipe placed per day, feet of wire pulled, feet of reinforcing placed,
yards of concrete poured, and similarly measureable parameters.
6. How stable is the labor force, that is, once employed on a particular project,
what is the percentage that leave on their own before completion of their
work tasks?
7. In general, how skilled is the labor force and what on-the-job tr~iding is re-
quired for welders and others to render a creditable performance?
8. Do construction workers appreciate the difference between working on a power
plant and building a warehouse? Are they motivated? Do they care about quality?
g. How adequate is construction supervision and management? How many years of
supervisory experience does the average foreman, superintendent, project manager
have? Do they feel it is enough? What training programs are available to
supervisory personnel and how many avail themselves of such training opportunities?
10. How do you find the quality of components, such as valves, instruments, pipe,
compressors, etc.? How many rejections are made in the field -- many or few?
PAGENO="0207"
203
Add~tjonal Questions
Mr. Kennedy
Page Two
11. How should the design of the control room be improved?
12. Should there be a standard design for control rooms and for the layout of
control panels?
13. What are the advantages and disadvantages of standardizing the design of
nuclear power plants? What would be the attitude of equipment manufacturers
and plant constructors to standardization?
14. What design changes or procedural changes would you suggest to improve the
defense against the lesser accidents that were referred to in the testimony?
15. Discuss the design changes or modifications and the procedural changes that
you would recommend to minimize the frequency of occurance and the speed of
development of the operational pertubations that were mentioned in the testimony.
16. List your recommendations for research and development activities that would
improve the safety of nuclear power plants.
17. What are the present deficiencies in nuclear power plant safety systems?
18. Provide details of the means of simplifying the interpretation of instrument
readings, together with your recommendations for displaying abnormal readings.
19. Discuss and provide recommendations for means of using computers or micro-
processors to enhance the power plant operators ability to recognize
abnormalities.
20. Discuss the need for a Swat Team composed of people from industry, the
utilities, NRC, etc.
21. Provide details of the improvements in communications and the man-machine
interface that were suggested in the testimony.
PAGENO="0208"
204
STONE & WEBSTER ENGINEERING CORPORATION
7315 WISCONSIN AVENUE. SUITE 332 WEST
Mr. Stephen Lanes 13 August 1979
Staff Director
Subcommittee on Energy Research and Production
Committee on Science and Technology
Room B-374
Rayburn House Office Building
Washington, D. C. 20515
Dear Steve:
Enclosed are the responses to the supplemental questions submitted
to Bill Kennedy following your hearings on nuclear power plant safety.
I apologize for the delay in our response, but I am sure you are aware
how busy our people have been this summer.
Gerald Fain
Assis t Manager -
Washi gton Operations
Enclosure
PAGENO="0209"
205
:~ugu.~t ),
ANHWEHS TO ADDITIONAL QUESTIONS FROM
SUBCOMMITTE. ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER REACTOR SAFETY
N. J. L. Kennedy
1. Question:
What is your professional opinion of the performance of design engineers in
general (not related to Stone and Webster)? What are their attitudes regarding
attention to detail, personal responsibility, outside study to maintain techrii-
cal competence, thirst for perfection, etc.?
Answer:
Referring to `design engineers" as professional engineers I consider them as
a class with the highest professional standards of competency. Non-achievers
are weeded out of demanding disciplines, such as nuclear, early and easily.
By their very nature, engineers concentrate on details, are proud of their
personal design contributions and are always searching for better ways of
doing things -- perfecting their work. Many have advanced degrees in
engineering and in related fields; many obtained by attending college nights.
2. Qup~tion:
What is your opinion of design supervisors? Do they check the w~rk of their
engineers and designers? How carefully? Are they timid, or do they criticize?
Do they develop their persondel into better engineers?
Answer:
By "design supervisor," I will refer to lead engineers on projects and
engineering supervisors in technical engineering support groups; first line
engineering supervision. At Stone & Webster these individuals are responsible
for supervising and checking the work of their engineers or designers. Where
calculations are long or complicated, they can delegate that responsibility.
In any event, the checks made of safety systems are documented and audited.
A formal design control program is required by Criterion III, to Appendix B,
10 CFR 20 which establishes the requiremeni~s for company Quality Assurance
Programs. Our Engineering Assurance Division documents company procedures
and provides periodic and independent audits of the checking and other design
control procedures. These audit findings are reported to me directly, and
assure us of the supervisory adequacy of first line supervision. In any
event, checks are careful and most engineers take pride in finding possible
errors or omiesions, and having them corrected. Few engineers are timid or
fail to criticize their peers. This intimate working relationship leads to
a rapid transfer of knowledge and mutual professional development is a
by-product.
3. Quection:
If these questions seem out of place, why was there no way of verifying that
a major valve was open or seated on the primary loop of Plant No.. 2 at TMI
when an open valve cou1a,in itself, constitute a LOCA?
Answer:
There is no incompatibility between my response to Questions 1 and 2 and the
question of pilot operated relief valve (P0Rv) at TNI-2. The engineers
48-721 0 - 79 - 14
PAGENO="0210"
206
recognized that relief valves hav~ a history of sticking open on occasions or
leaking. Design improvement has minimized but not eliminated
such occurences. Therefore, an indirect valve position indication was
provided to let the operators know if power was being applied to the valve -
operator (solenoid); furthermore, a remotely operated block valve was provided
upstream of the PORV so that the valve could be isolated should it leak or
fail to close; last but not least, temperature and pressure measuring devices
were placed downstream of the PORV to establish whether the valve was leaking
or was in fact open. How the operator used this information and the actions -
taken are a matter of training and operational/maintenance quality assurance
procedures. Admittedly, we are considering improvements to the quality of our
PORV leakage detection devices so that they can give the operator unequivocal
information.
4. ~estion:
What is your opinion of the effectiveness of the NRC during the design phase?
Do they do complete detailed design reviews? Do they have adequate personnel
for this? Are they sincere? Do they interact constructively with the utilities,
the equipment manufacturers and design engineers? Are they procedure oriented
or plant oriented?
Answer:
The NRC is quite effective during the design phase. However, their reviews
are pretty mach confined to assuring conformance with several hundred
regulatory guides and regulatory branch positions. TMI-2 demonstrates that
the NRC has probably been overconcerned with the maximum credible accident
which might never occur, rat1~er than smaller and more likely accidents.
Considering that the major initiating actions of the TMI-2 accident stemmed
primarily from operations and maintenance shortcomings, this in itself speaks
well of NRC involvement during the design phase. Even though the NRC has
inadequate personnel to be completely responsive to the schedular requirements
of design review, their personnel are qualified and sincere, and they try to
act constructively with the utilities, equipment manufacturers, and design
engineers. There is a need that NRC design reviewers be more familiar with
nuclear plant operation and consider their reviews within that context.
PAGENO="0211"
207
5. Question:
What is your opinion of the construction wàrkers? Specifically, do they
want to work? For power plant construction, what is the productivity of
labor today vs 1969 in such rneasureable items as inches of weld per hour, -
number of feet of pipe placed per day, feet of wire pulled, feet of
reinforcing placed, yards of concrete poured, and similarly measureable
parameters.
Answer:
A cross-section of the construction'workforce engaged on nuclear plant
construction would not vary significantly from a cross-section of the
work force in general. There are many highly qualified workers who take
a great deal of pride in their work; a large portion of the work force are
qualified craftsmen who are primarily interested in performing good work
for a good wage and a smaller portion of the work force whose performance
is less than desired. Unfortunately, the influences outside the construc-
tion workers' control such as holding for an inspection, rejection of what
the worker considers good work because of `paper work" problems, and changes
to installed work, all of which are prevalent in nuclear construction today,
have an adverse effect on the best workers.
To compare the man-hours per unit of work today vs the man-hours per unit
of work in 1969 and call it differences in labor productivity would be
unfair to today's work force. The man-hours per unit of work today would
be much higher. Some of the major contributors to the increase in today's
man-hour rates are:
o Increases in inspection activity, including inspection hold
points where work cannot continue until released by the in-
spector. In construction a work task is normally performed
* completely by the sane workers so all inspections disrupt
the work process vs manufacturing where frequently the in-
spections can be performed between activities in the man-
ufacturing process.
o Increases in the complexity of installation. For example,
reinforcing steel installation to satisfy increased loadings
has increased the installation difficulty due to the density
of rebar per unit volume of concrete.
o Time expended to satisfy requirements for items like weld rod
control and random metal products identification Increases the
ratio of waiting time to direct work time.
o Installation of equipment later than the optimum time because
of late delivery affects the difficulty of installation.
o Late installation or rework to satisfy regulatory guides and
changing codes. For example, pipe whip restraints, jet im-
pingement and cable separation.
o The addition of systems and expanding existing systems in
structures already constructed reduces efficiency because
of tight working conditions.
PAGENO="0212"
208
Items like the above have increased the man-hours per unit of work by as
much as 5 to 10 times, but do not indicate a decrease in labor productivity
per se. The increase in scope of work today due to additional systems and
expanded existing systems has naturally added many man-hoursto the total
craft man-hours and this is often misinterpreted~as reduced productivity.
6. ~~on:
How stable is the labor force, that is, once employed on a particular
project, what is the percentage that leave on their own before completion
of their work tasks?
Answer:
The stability that does exist in the construction labor force is between
the individuals and their union, not between individuals and contractors
or individuals and projects. The stability on a given project is very
much dependent on the construction marketplace in the project area and
to a lesser degree on the rest of the country. -
If the work in the area is slow, then obviously the project work force
will be very stable. Frequently there is other work available so the
workers will switch projects because of such things as extended work week,
shorter commute or to get away from the impositions of nuclear work. Due
to the length of nuclear projects an individual nay leave and return
several times during the life of the project. The percentage of workers
that stay through a project would be influenced by the above but 20% would
be a realistic number. The turnover of the remaining 8o% can vary from
300% to 900%.
Often a nuclear project requires a larger work force than is available
in the area. This is especially true in the mechanical and electrical
crafts with qualified welders having the greatest shortfall. This short-
fall requires the use of travelers from other areas. The turnover in
travelers is usually quite great because when work picks up in their home
area they return home. This turnover is especially detrimental to overall
man-hours when welders are involved because of qualification requirements,
that is, time each welder spends in the test booths. There is a small
percentage of travelers that move from overtime job to overtime job and
will only work a normal work week project waiting for another overtime
project to commence.
The climatic conditions in the project. area influence the stability of
the work force. The more adverse the weather is for construction activities
the more stable the work force will be in the latter stages of a project.
The structures are normally closed in at this stage and the workers are
rarely sent home with just show-up time during bad weather.
The Nuclear Power Construction Stabilization Agreement should help to
reduce the number of travelers on a project and, therefore, the turnover
because of provisions to use nonjourneymen such as apprentices, trainees,
helpers or probationary employees. It is expected that these workers
will come from the project area and will perform many of the support craft
activities relieving the available journeyman to perform the activities
requiring the greatest skills.
PAGENO="0213"
209
7. Question:
In general, how skilled is the labor force and what on-the-job training
is required for welders and others to render a creditable performance?
Answer:
The skill of the work force that comes from the labor organizations is
generally very good. The apprentice programs produce competent journey-
men. However, the unique requirements of nuclear projects do require
special training or orientation for the work force. This training varies
from formal classroom type training to informal gang box instructions. An
effort is made to ensure that employees attend an orientation program on
quality requirements as well as the details on documentation, hold points,
etc., in order to obtain support for the programs. Specific training is
given in specification requirements to ensure conformance to requirements.
The amount of training required will vary with the complexity of tasks to
be performed.
The shortage of welders experienced on many projects has precipitated
various training programs. This varies from on site training to upgrade
welders already employed to offsite welding schools to train welders for
the project. This is in addition to the programs above which would explain
such tasks as inspection interface, weld rod control, and transfer of heat
batch numbers.
S._
Do construction workers appreciate the difference between working on a
power plant and building a warehouse? Are they motivated? Do they care
about quality?
Answer:
Construction workers definitely appreciate the differences between working
on a power plant and building a warehouse; - To them, the biggest difference
is in inspection and documentation. A weld is still a weld, reinforcing
steel 6" on centers is still reinforcing steel 6" on centers, and termin-
ating a cable is still terminating a cable. The majority intend to do
quality work.
They may, however, have developed practices over the years that they felt
were acceptable and were not in violation of the specifications to which
they were working. The specifications on nuclear work are more detailed
and are being interpreted more stringently by the quality control and
quality assurance groups. These controls and requirements often result
in what the craftsman believes to be quality work being rejected.
Using welders as an example, the tendency on nuclear work in the inter-
pretation of a radiograph is to reject a weld if there is the slightest
question of acceptability. This is understandable on the interpreter's
part because the radiograph is subject to interpretation later by others;
however, it is very difficult for the welder, who normally performs his
own repair, to understand when he believes the weld was good. The negative
result of this is that the workers consider that people that do not know
their business as well as themselves, namely inspectors and contractor
management, are telling them how to do their work. The solution to this of
course is the training and orientation programs discussed in Question 7.
PAGENO="0214"
210
Again it inunt be remembered that the worker's primary allegiance is to his
labor organization and not to a contractor or project. Seniority and
cecurity have no special meaning on a construction project. When there is
plenty of work in an area, being terminated or resigning from a given
project holds no special meaning to a worker who recognizes he can be
working on some other project the next morning for the sane wages and
conditions. This makes motivation of the worker ~very difficult except by
appealing to his personal pride and pride in his workmanship.
9. ~~stion:
How adequate is construction supervision and management? How many years
of supervisory experience does the average foreman, superintendent, project
manager have? Do they feel it is enough? What training programs are
available to supervisory personnel and how many avail themselves of such
training opportunities?
Answer:
As the case of the construction work force in general, there is frequently
an insufficient number of experienced foremen and general foremen in an
area to satisfy requirements on a nuclear project. This is complicated
by using travelers as foremen and general foremen causing problems with
the local work force and the probability of higher turnover in travelers
makes them less desirable in supervisory roles.
Contractual agreements frequently do not allow paying more to foremen
and general foremen than agreed in the local bargaining agreements. The
difference in pay in many cases has not been increased in proportion to
the journeymen rate and there is no monetary incentive to take on the
added responsibilities. This has been recognized in the industry and is
being corrected. Under the Nuclear Power Construction Stabilization
Agreement this can be taken care of in the Project Labor Plan.
This first level of supervision, foremen and general foremen, has direct
contact with the crafts and, therefore, the greatest influence on such
items as productivity and compliance with the special nuclear construction
requirements. Recognizing the potential shortage of this key element to
a successful construction operation, the development of foremen and general
foremen must start with the beginning of crafts activities. Even though
this may result in a higher than normal ratio of supervision to work force
it will allow on-the-job training for foremen and general foremen~ The
training coupled with a larger pay differential incentive can be a. positive
influence toward a motivated work force.
The first level of management supervision historically cane from the crafts.
Many now are engineers. The tremendous amount of paper work and document
ation required of management supervision is discouraging craft personnel
to switch into management. Fringe benefits once considered an incentive
to take management positions now being equal to or better in the, labor
organizations, will further discourage craft personnel from supervisory
positions. Ideally, a mix of former craft and engineers should continue
to exist so that hands on experience from the crafts will complement the
technical background of the engineers.
PAGENO="0215"
211
Site management personnel are often younger than might be expected for
projects the magnitude of nuclear projects. These younger site managers
entered the nuclear construction era at mid level supervisory positions
and have developed through the levels of supervision parallel with the
increase complexity and regulatory climate of nuclear construction.
Therefore, they are usually well qualified to manage projects.
10. _______
How do you find the quality of components, such as valves, instruments,
pipe, compressors, etc.? How many rejections are made in the field --
many or few?
Answer:
Overall, the quality of nuclear grade components purchasedbyStorie &
Webater have been and continue to be good to excellent. The rejects
we experience arise for the moat part for the lack of quality assurance
records and, in some instances, shipping damage. Very few components
are rejected for reasons of non-compliance with codes or requirements
of the design specifications.
11. ~~tion:
How should the design of the control room be improved?
Answer: -
The design of many controirooms could be improved by recognizing that
most control functions fall into three (3) categories. The day-to-day
operations, the seldom operated non-safety controls, and the engineered
safety features or emergency controls.
The control room layout should be designed along these lines and the
control panels separated accordingly.
Traditional designs group controls by equipment or fluid systems and as
a result the main control boards are often crowded with instruments and
devices that are used only under special limited conditions.
12. ~~stion:
Should there be a standard design for control rooms and for the layout
of control panels?
Answer:
A completely standardized design is impractical because of differences in
reactor types, site specific systems, and equipment details.
However, well considered and standardized principles of layout and dasign
should be established, so that operators (or observers from regulatory
bodies) can quickly feel at home in any plant and reactor plant simulator
training can be facilitated.
PAGENO="0216"
212
13. ~çstion
What are the advantages and disadvantages of standardizing the design
of nuclear power plants? What would be the attitude of equipment manu-
facturers and plant constructors to standardization?
Answer:
It is impractical to fl~fl~ standardize the design of nuclear power
plants. Each plant site has different requirements that must be met,
e.g. size, soil conditions, ambient air and cooling water temperatures
exclusion distance requirements, etc.
We believe, however, that the current NRCconceptsof plant standardiza-
tion are good and Stone & Webster led the engineer-constructor industry
by having the first such standard design approved for the balance of plant.
Almost all aspects of standardization are advantageous and the advantages
include the following
o Standard designs provide more time for thought to determine best
arrangement and symtem design than is usually available in a custom
design.
o The design is pre-licensed. Because el the limited number of such
designs the NRC review can be more comprehensive, thorough, and
timely.
o Universal siting. The designs can be suitable for founding on rack
or soil in a wide variation of site locations, including seismic and
long-term meteorological conditions that envelope most potential U.S.
sites.
o Shorter project schedule -- this is an economic advantage.
o More efficient manpower use by owner and engineer_constructor. Again,
the design reviews can be more comprehensive, thorough, and timely.
More time can be spent reviewing feedback information impacts from
operating plants.
o Increased schedule confidence -- this is an economic advantage, however,
it permits NRC to better plan its manpower requirements as well.
o Increased plant availability. In essence, this stems from increased
plant reliability, which is a good measure of improved safety.
As your recognize, each reactor manufacturer has recognized the importance
of standardizing his own nuclear steam supply system (NSSS) to provide for
a minimum number of variations in size. To have all reactor manufacturers
conform to a single design would probably violate anti-trust statutes, but
more importantly eliminate the competitive drive to achieve product
superiority as pertains to reliability and safety, exclusive of cost. With
the large variation of balance-of-plant equipment requirements due to site
related variables mentioned previously, I believe it would be impractical
PAGENO="0217"
213
to standardize components other than those in the NSSS.
11f. ~estion:
What design changes or procedural changes would you suggest to improve
the defense against the lesser accidents that were referred to in the
testimony?
Answer:
See answer to 15.
15. Question:
Discuss the design changes or modifications and the procedural changes that
you would recommend to minimize the frequency of occurence and the speed of
development of the operational perturbations that were mentioned in the
testimony. .
Answer:
The design approach, and procedures for. examination and implementation,
would be to postulate a wide variety of minor failures and then to postu-
late what coincidental failures of equipment or judgment could escalate
the original failure, and thus illuminate areas where a change in design,
greater redundancy, greater separation or isolation of equipsent, would
obviate escalation. We can provide no pat formula; it is rather a matter
of tedious, exhaustive, and largely repetitive series of examinations.
16. Question:
List your recommendations for research and development activities that would
improve the safety of nuclear power plants.
Answer: -
The research and development activities ths~ would improve the safety of
nuclear power plants are in the following areas:
o Hydrogen generation and behavior under accident conditions.
o Visual and acoustical surveillance for reactor containment and auxiliary
buildings.
o Environmental qualification of instrumentation for a broad spectrum of
accident conditions.
o Computer simulation of nuclear and non-nuclear systems to provide
dynamic response information to postulated challenges to safety -
and non-safety systems and components.
o Reliability of electrical power supply systems and configurations for
emergency power.
a Development of human engineering criteria for control room design.
PAGENO="0218"
214
o Development of seismic qualificatiOn criteria.
o Materials research and development, including the preparation of up
to date documentation of the ability of materials and electronic
components to withstand radiation exposure.
o Improvements in the methodology for the analysis of the relationships
between pressure and local effects near high energy pipe breaks.
17. ~q~~on:
What are the present deficiencies in nuclear power plant safety systems?
Answer:
Some deficiencies in nuclear power plant safety systems which should be
corrected are as follows:
o Control room engineering, including improvements in human engineering
the man-machine interface.
o Too many alarm indications for an operator to cope with. Consider
providing cathode ray tube displays of highest priority information.
o Improved control room indication of bypassed and inoperable equipment.
o More emphasis on dedicated safety systems with clear separation of
interactions between safety and non-safety systems.
o More emphasis on the role non-safety systems can play in preventing
and mitigating the consequences of small loss of coolant accidents.
o Improvements in the environmental qualification of instrumentation for
service under a broad spectrum of accident conditions.
o NRC seismic restraint requirements impo~e rigidity on components which
result in thermal stresses during operation which approach allowable
thermal stresses. Thus an attempt to address extremely unlikely seismic
conditions increase the probability of failure under normal operating
conditions.
o NRC insistance on the demonstrated ability to remove iodine from the
containment atmosphere of pressurized water reactors introduces caustic
additives to the containment spray system. TMI-2 experience indicates
that very little iodIne remains airborne. Since caustic sprays are not
required and their use degrades safety systems, use of fan coolers should
be in lieu of sprays.
o Development of design criteria related to single, multiple, and common
mode failure. - -
o Improvements to instrumentation which assures the reactor operator that
the core is covered-at all times.
PAGENO="0219"
215
18. ç~estion:
Provide details of the means of simplifying the interpretation of instrument
readings, together with your recommendations for displaying abnormal readings.
Answer:
Several means of simplifying instrument readings have been proposed and the
ones that appear most promising are as follows:
o Design instrument components so that during normal system operation the
instrument indicators are all pointing in the same general direction and
an abnormal condition is quickly recognized, not by an absolute value,
but by the semaphore change of the indicator.
o Provide cathode ray tubes (CRT) similar to a TV screen to display
instrument information only on demand or automatically when there
is a deviation from normal. If system conditions are stable, the
CRT should remain blank.
To quickly recognize abnormal conditions, the plant annunciator alarm
window or light should be adjacent to or part of the instruments that
monitor the fault..
19. ~q~stion:
Discuss and provide recommendations for means of using computers or micro-
processors to enhance the power plant operator's ability to recognize
abnormalities.
Answer:
Computers have been used by some industries to aid the operators ability
to recognize abnormalities but their use has been slow to penetrate the
electric utility industry because of early experiences with the high
failure rate of solid state devices.
To use computers in the nuclear industry it would be necessary to isolate
the safety related information from the non-safety related plant computer.
The addition of isolators will degrade, to some degree, the reliability
of the safety system and the NRC requires a documented analysis to prove
that the safety system has not been degraded below an acceptable limit.
For this reason the utilities have been slow to adopt computers in
safety systems. Furthermore, such computers could not be seismically
qualified -- a prime requirement for safety systems.
With the rapid improvements and price reduction in mini-computers and
micro processors, the industry may now be able to use several dedicated
mini-computers and eliminate the need for isolation.
PAGENO="0220"
216
20. ~p~ption:
Discuss the need for a "Swat Team" composed of people from industry, the
utilities, NRC, etc. -
Answer:
We have participated with industry in the preparation of improved
emergency response plans. The attached outline of such a plan was
prepared by the Atomic Industrial Forum (AIF) and was just recently
released for industry comment. The need for an Emergency Response
Team or "Swat Tess," and how such a team fits into updated emergency
preparedness concept stimulated by TMI-2 can be best discussed in the
context àf the recommended plan. Should you have any further questions
on the plan, the Stone & Webster member of the AlE' Emergency Preparedness
Subcommittee would be pleased to answer them.
21. Question: -
Provide details of the improvements in communications and the man-machine
interface that were suggested in the testimony.
Answer:
The testimony was meant to suggest that the most recent developments of
TV be incorporated for remote surveillance of containment and other areas
not readily accessed, or which might seem inaccessible.
PAGENO="0221"
217
COMMITTEE ON SCIENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
5U1TE2321 RAYBURN HOUSEOFFIcEBUILDINU
WASHINGTON. D.C. 20515
Jt!P~$O7147ç~
Dr. Chauncoy Kepford, Director
Environmental Coalition on lucisar Power
433 Orlando Avenue
State Collene, PA 19901
Dear Dr. Eeoford:
Thank you for orovidinq testimony at our subcommittee hearings on
Duclear Power Plant Safety on ~lay 22, 1979. During these hearings you
indicated that you ~,ould provide the subcommittee with responses to a
number of questions, tocether with other additional information. Enclosed
is a list of questions; wewould appreciate receiving your responseby
June 25, 1979.
Thant you for your c005eration,
Sincerely~
~E1~1ACK~Q
Chairman, Subcommittee on
Energy Research and Production
Enclosure
PAGENO="0222"
218
SUBCOM~1IUEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY -
ADDITIONAL QUESTIONS FOR DR. CHAUNCY KEPFORD
1. What role should your institution play in improving nuclear power plant safety?
2. List the research and development programs that you would recommend to improve
nuclear power plant safety.
3. List your recorrrnendations for changes in the design and layout of control rooms.
4. Should there be a standard design for control rooms and for the layout of control
panels?
5. Provide a list of recorrrnendations for improving the safety of nuclear power plants.
6. Is there a need to improve the radiation monitoring facilities for nuclear power
plants? List your recommendations.
7. In your testimony you stated "I have been lulled into this false sense of
security about nuclear reactors. Please provide more detailed background on
this statement.
8. Your testimony indicates that until the time of the Three Mile Island accident
you felt a sense of security about nuclear power plant operations. Is this
correct?
9. Provide a list of the locations at which you believe radiation monitoring equip-
ment was installed and the locations at which measurements were made during the
Three Mile Island accident. Provide the following reference data:
(a) The source of your information.
(b) The Agency responsible for the equipment. . S
(c) The time and date at which measurements were made.
(d) The `end use" of the data.
10. Your testimony indicated that you believe that the Nuclear Regulatory Commission
was dishonest in the use of certain data. Please provide references to support
your view.
11. In reply to a question by Congressman Walker, you said that you would provide him
with calculations that you had made of the potential fatalities caused by the
Three Mile Island accident. Please supply these calculations together with an
explanation of your treatment of the data in question.
12. Were the relatively long-range radiation measurements, made by helicopter
survey, satisfactory? Provide a brief explanation.
13. Did the "fall-off" of dose with distance, suggested by DOE measurements, satisfy
you that doses do decrease with distance?
PAGENO="0223"
219
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
HEARING ON NUCLEAR POWER PLANT SAFETY
ANSWERS OF DR. CHAUNCEY KEPFORD
1. [What role should your institution play in Improving nuclear power
plant safety?]
The role of an organization such as the Environmental Coalition on
Nuclear Power(ECNP) in improving reactor safety is ambiguous to say the
least. This ambiguity stems partially from the belief shared by the vast
majority of our members that the only known way to make any nuclear power
plant `safe' is to permanently remove all fuel from the reactor so that it
can never be made critical. Of course, this does not solve any of the
numerous other unsolved problems of the entire nuclear fuel cycle. However,
the question addressed only reactor safety.
The other aspect is that ECNP feels that we have an obligation to the
public that requires us to enter the legal process of the licensing of nuclear
power plants: in an adversary role even though we understand from long personal
involvement that this licensing process is totally biased; that the rules are
created to favor the result that the utility, in conjunction with the NRC
Staff, desires; and that this result will be sust~ined by the Licensing Boards,
the Appeal Boards, and, on the advice of the NRC Staff, the Commissioners
themselves. These parties to ~he proceedings know in advance the outcome of
any hearings: the record to date shows a monotonous record of success that
is unblemished by the denial of a single commercial licens? application. In
spite of this overwhelming bias, we still feel it is our mOral obligation to
enter this biased forum and do our best to try to make reactors, and the
rest of the fuel cycle, as safe as is possible for this generation of humans
and all subsequent ones as well. This latter point has yet to penetrate the
consciousness of either the NRC, the nuclear industry, or the supporters of
either.
2. [List the research and development programs that you would recommend to
improve nuclear power plant safety.]
Short of the defueling suggestion made in the answer to question 1,
which would require no R and 0 at all, and would have the Onormously bene-
ficial side effect of placing a limiton the amount of radioactive wastes
to be disposed of in some yet undetermined way; in some yet to be determined
place, I would recommend the immediate placing of all operating reactors in
cold shutdown until reactor safety becomes an experimentally verified reality.
This would require a series of experiments to show that safety systems are
capable of carrying out their designed functions under realistic operating
conditions. If this verification means that a 1000 MW(e) reactor--or even
2, 3, or 4 or more reactors--must be tested to destruction, then that must
be done, in my opinion.
If this is too drastic or dangerous a measure for thetotally irrespon-
sible nuclear industry,(i.e., not responsible for their accidents, wastes,
abandoned facilities, etc.), then this industry should not be allowed to
determine its safety record by using the public as a group of unwilling,
uninformed, and unprepared guinea pigs, a practice uniformly followed, from
uranium mining and milling through radioactive waste management, and, most
unconscionably at Three Mile Island. To date there has not yet been offered
a rational, reasoned explanationof why the corporations which in reality
consist of a file of papers, receive more protection from the failures of
PAGENO="0224"
220
nuclear power than do the lives and properties of members of the ptiblic
and al1~of their descendants who are affected by the nuclea~-power failures.
An area "the size of the state of Pennsylvania" (Working papers, 1964-65
WASH-740 update, document 92, page 4) to be placed at risk of radioactive
contamination is far too great a national asset to jeopardize for the
alleged marginal benefit of allegedly cheaper electricity. Here I can
only repeat the words of Dr. Clifford Beck, chairman of the study groups
which prepared WASH-740 and its 1964-65 revision, in a letter to Congress-
man Chet Holifield, Chairman of the Joint Coninittee on Atomic Energy, May
18, 1965
there is no objective, quantitative means of assuring that all
possible paths leading to catastrophe have been recognized
and safeguarded or that the safeguards will In every case
function as intended when needed.
Here is encountered the most baffling and insoluble
enigma existing in our technology: it is in principle easy
and straightforward to calculate potential damages that
might be realized under such postulated accident conditions;
there is not even in principle an objective and quantitative
method of calculating probability or improbability of acci-
dents or the likelihood that potential hazards will or will
not be realized.
Nothing has occurredsince 1965 to cast any doubt on Dr. Beck's words.
3. [List your recon~mendations for changes in the design and layout of
control rooms.]
If the reactors are to be defueled, as I believe they must be, no
control room, or control room changes, would be necessary.
4. [Should there be a standard design for control rooms and for the
layout of control panels?]
Again, no control rooms at all would be necessary if the reactors
are to be defueled and conmiercial radioactive waste production terminated.
However, even if the decision is made to place public safety in a position
subordinate to corporate profits, standardized control rooms would be a
difficult goal to realize, because, by~ necessity, the controls for a
BWR must be at least somewhat different from those of a PWR, and even
among the PWR5 of the three U.S. manufacturers, there would be features
found on one type which would not be found:on others.
But the problem of standardization is even more complex, because
to accept a "standardized" design for even one manufacturer would require
the assumption, still not the experimentally determined fact, that all
design problems have been identified in advance of standardization and
have been remedied. We have no assurance, as should have been learned
from the ThI-2 accident, that all such design deficiencies have indeed been
identified. Control rooms are, in this regard, just an extension of a
hazardous technology not yet understood.
PAGENO="0225"
221
5. [Proyide a list ~f recommendations for improving the safety of
nuclear power plants()
The ~ way to insure that the worst imaginable reactor accidents
will not occur is to insure the ppssibili~y of such an occurrence is prevented.
The only known, as opposed to estimated, projected, calculated, hoped for,
or fantasized, way to do this is to shut them all down, permanently. At the
present time, we must assume that the probability that' all design defects
in the presently operating nuclear reactors (and their associated control
rooms) have been identified is zero.
The present method of assuring safety as practiced by the NRC is
that of edict and speculation. The edict is in the form of an NRC rule
to prevent public interest intervenors, like ECNP, from litigating safety
issues in reactor licensing proceedings. The speculation is the extrapola-
tive kind of mathematical calculation, model creation, simplification,
and approximation necessary, in the eyes of the NRC, to support the edict.
An example is the ECCS problem, where litigation of ECCS issues was terminated
by the issuance of an edict Incorporated into the rules of the NRC. Such
practices, as the issuance of edicts by the NRC, are' effective means of
preventing litigation and public discussion of important safety issues, but
there is no assurance that the edict, `or the speculation upon which It Is
based, is effective at preventing accidents like TMI-2,
6. [Is there a need to improve the radiation monitoring facilities for
nuclear power plants?' List your recommendations.]
The environmental mOnitoring (and accident monitoring) around nuclear
power plants is abominable. It is based on two unsupported assumptions:
(a) all utilities operating nuclear power plants can be trusted
to furnish accurate and complete monitoring data,and,
(b) accidents won't happen.
To avoid the classical "fox guarding the chicken house" situation, it would
be advisable to have some agency other than the utility or the NRC perform
the all-important job of environmental monitoring.
Ofcourse, if there were really a serious intent behind environmental
monitoring, other than simply having a utility, employee waving data in the
air to show that no radioactive materials escaped a particular plant it
would begin with a thorough baseline epidemiological study of the people
within, say, a thirty mile radius of the proposed facility ~ to the
operation of the facility.
The TMI-2 accident, if, .nothing else, showed just how poorly agencies
of the federal government--even'agencies having three decades of experience
with environmental radiation monitoring--can collect data when an accident
does happen. About the only way the monitoring could..have been worse would
have been for the only monitor~ing to have been that of Metropolitan Edison
Company.
To resolve these problems, I suggest that some agency not dependent
on the continuance of nuclear power--as are the NRC, DOE, AIF, EEl, EPRI, or
the particular utility--do the environmental monitoring. A likely car~didate
would be some state agency, financed by a state tax on nuclear facilities.
48-721 0 - 79 - 15
PAGENO="0226"
222
This suggestion assumes that the ECNP recommendation of a complete, and
permanent shutdown of all commercial reactors is not accepted.
Monitoring in the case of accidents should be done with the idea in
mind that accidents happen at times when they are not expected. The moni-
toring capability should extend out to at least fifty miles, and the monitoring
devices should be capable of detecting, on an isotopic basis, beta and gamma
radiations from both gaseous and particulate sources. In addition, these,
and the normal environmental monitors, should be distributed in numbers in
the hundreds,thousands, or even higher numbers, according to population
densities, so that the members of the public at risk due to this inherently
dangerous technology can be promptly and fully informed of the actual risk
they bear and the actual radiation doses they receive.
7. [In your testimony you stated "I have been lulled into this false
sense of security about nuclear reactors." Please provide more detailed
background on this statoment.]
There is little more to be said. Core meltdowns have not occurred on
a monthly or annual basis. But the present course of action, which is geared
to react only after the fact of an accident,appears to guarantee that someday--
maybe next week, next month, next year, or whenever--an area "the size of
the state of Pennsylvania" will indeed be lost.
Perhaps this Committee should hold hearings on the economic impact
to the U.S. if, say, Pennsylvania had to be evacuated for as long as four
strontium-90 half-lives due to a reactor accident. The economic impact of
such an accident would be catastrophic to the U.S. economy, perhaps even
~rse than that of a limited nuclear war. Yet this "war" will have come
from within, under the guise of "progress" or simply the illusion of
cheaper electricity.:
8. [Your testimony indicates that until the time of the Three Mile Island
accident you felt a sense of security about nuclear power plant
operations. Is this correct?
As I stated in my testimony, this false sense of security was in part
based on the belief that when a serious reactor accident did happen, it
would be in someone else's backyard. I was mistaken. I made a serious
mistake. However, I have learned a lot from this tragic experience:
None of the assurances of "safe, clean, economical" nuclear power
will ever be believed again.
9. [Provide a list of the locations at which you believe radiation
monitoring equipment was installed and the locations at which
measurements were made during the Three Mile Island accident.
Provide the following reference data:
(a) The source of your informatiOn.
(b) The Agency responsible for the ,equipment.
(c) The time and date at which measurements were made.
(d) The "end use" of the data.
For parts (a), (b), and (c), these pieces of information about which I
have been talking in reference to monitoring around TMI-2 during the period
of the accident are all contained in the report entitled "Population Dose
PAGENO="0227"
223
and Health Impact of the Accident at the Three Mile Island Nuclear Station."
by the Ad Hoc Population Dose Assessment Group, May 10, 1979.
The "end use" of this data was to present a rosy picture to the American
people that the actual numbers of deaths attributable to the accident will
be only about one death. However nice such rosy pictures are, in this case,
the rosy picture is an enormous fabrication, distortion and misrepresentation
of the actual population exposures. The "end use" boiled down to the public
relations approach employed with the Reactor Safety Study, WASH-l400. There,
the Study was widely hailed as the last word in describing how safe nuclear
reactors were. In the end,~its use was far more as a public relations
gimick rather than a scientific study. It has now been thoroughly debunked.
10. [Your testimony indicated that you believe that the Nuclear Regulatory
Comission was dishonest in the Use of certain data. Please provide
references to support your view.
I have no "references" to provide such an answer. However, Ido have
my own analysis of-the data which suggests that the analysis carried out in
the report cited above was seriously flawed. If this were the first time
such ananalysis had ever been performed, fundamental defects might be expected.
Not only were the data which were used very deficient, but also the
analysis used took no account of the serious deficiencies and internal
inconsistencies of the data presented. In addition, the Ad Hoc group'presented
four analyses of the data and averaged them to arrive at a population dose
estimate. Yet no distinction was made at all as to which were the better or
the more applicable analyses to the real situation.
The data were deficient ma number of ways, at least including the
problem that for all time periods discussed in the report, there were far too
few dosimeter locations in operation to provide, adequate monitoring data
at any distance. But worse yet, there were none reported at distances
beyond 15 miles for the Metropolitan Edison locations and none beyond 13,8
miles for the NRC locations. As a result, much valuable data was lost due
to the refusal of the NRC to believe that measurable activity levels could
occur at distances greater than these. This policy of "protection" by
omission must be changed.
The Ad Hoc group made no attempt in their report to assess the validity
or the quality of the data which they used in their analysis. In particular,
1. The Ad Hoc group failed to see the disparity between the
1978 Met. Ed. background data between the "indicator" and
"control" locations. (Table 3-5). Nor did the group see
any difference between the Met. Ed. data for the two kinds
of.dosimeters (Table 3-5 vs. Table 3-6). This problem was
exacerbated by the fact that TMI-l was in operation at this
time contributing to the supposed "background."
2. The Ad Hoc group apparently did not notice that many of the
dosimeter readings of Met. Ed. March 31, 1979, through April 6,
1979 period (Table 3-3) measured not only much lower levels of
exposure than did NRC dosimeters at the same locations for about
the same period (Table 3-4) but also many of these Met. Ed.
dosimeters recorded exposuresof even `less than background. Yet
these zero and negative value~ were used essentially unquestioningly.
PAGENO="0228"
224
3. The Ad Hoc group made no assessment of errors, systematic Or
otherwise, in its report. Nor was any mention maØ~e, in
connection with the many consistently low Met. Ed. TLD
readings, of the fact that the Met. Ed., and NRC, TLD's were
read by Radiation Management Corporation, which is a wholly
owned subsidiary ofPhiladelphia Electric Company. Neither
the Ad Hoc group nor the NRC itself apparently saw any inherent
conflict of interest in having such a subsidiary of another
utility doing environmental monitoring for Metropolitan Edison,
in addition to Philadelphia Electric itself. It is difficult
to imagine how much more closely the chickens could be guarded
by the foxes than here.
4. The Ad Hoc group made no attempt to insure that the dose vs.
distance model that was used to calculate radiation exposures
to populations outside the range of the available dosimeter*
readings actually fit the available data. This serious defect
makes the DOE projections of doses in Appendix A of the report
utterly meaningless. This is particularly important where,
as with certain sectors (South; South West, and North West, North,
and North East) the exposures for the period March 31through
April 7 (NRC data), simply did not decrease rapidly with distance,
as the model requires. In fact, toward the Northwest, toward
Harrisburg, the doses increased with distance from ThI-2. This
observation is not reflected in the scanty, inconsistent Met. Ed.
data.
5. In a meeting before the NRC Commissioners on Thursday, June 21,
1979, almost three months after the initiation of the TMI-2
accident, NRC personnel revealed for the firsttime (publicly)
that all of the radiation monitors in the vent stack at ThI-2
went off scale on March 28, 1979. As a result, the Commissioners
were told (See Washington Post, Friday, June 22, 1979, page 3)
that exposure measurements were inconclusive that day. It truly
taxes my mind to expect anyone to believe that that simple fact
was not known to the Ad Hoc group when its "study' was being
performed. This belated disclosure fuels my contention that the
Ad Hoc report is nothing more than an intentionally dishonest,
misleading public relations "soother' or `pacifier."
11. [In reply to a question by Congressman Walker, you said that you
would provide him with calculations that you had made of the potential
fatalities caused by the Three Mile Island accident. Please supply
these calculations together with an explanation of your treatment of
the data in question.
To date, the pressure of other obligations has not permitted me the
luxury of sufficient time to carry out this important task. As soon as time
does permit, these calculations will be forwarded to this Committee.
PAGENO="0229"
225
12. [Were the relatively long-range radiation measurements made by
helicopter survey, satisfactory? Provide a briet exptanat~on. ]
and
13. [Did the "fall-off' or dose with distance, suggested by DOE measurements,
satisfy you that doses do decrease with distance?]
I have enclosed two graphs I have drawn using the data published in
the Ad Hoc Population Dose Assessment Group report. Graph A is a plot of
the total dose for the time period March 31 through April 7 taken from the
Ad Hoc Group report, Table 3-4, which contains the dosimeter data of the
NRC. Here I have summed the daily exposure recorded for each station for
the entire time.period and have plotted that total dose by sector as a
function of the distance of the stations from TMI-2. Straight lines were
drawn between the stations in each sector.Graph B contains data for
additional sectors not shown on Graph A. On both graphs is a curved line
which passes through circled points. This curve represents the doses that
should have been observed at these distances in accordance with the dose
vs. distance model that was used by the Ad Hoc group. The Ad Hoc group
applied this model to extrapolate doses to the population in the 50-mile
radius, beyond the 13.8 miles maximum distance where the NRC was actually
recording doses, that is, where the lines end on graphs A and B.
I plotted these curves to see if the data fit the model in the
region where recorded data did exist. While some of the lines on Graph A
show at least some similarity to the theoretical curve, on Graph B the
situation is very different. Here none of the sectors show the expected
behavior.
These data suggest that the doses did not fall off with distance in at
least some sectors as the DOE helicopter data suggest. ~Since the NRC
dosimeters were placed ( in principle) at or near ground level, where people
tend to be found, these data are preferable to projections which are not
supported by data. Lastly, the DOE measurements do not En any way satisfy
me that the doses decrease with distance.
PAGENO="0230"
27
V
226
~1k O.$nc~ :
1~'
12
ch~. I
d~
~/31 J//7
/0~
g.
* I ~ D~z~a~ ~oc,~4s ~
* a.
*~e Ykc.s'e ~oc~it4~ ~
* dose. oat 3/31.-q/, ~
tk~ dc,s~,xe~ers ~4~c.~.'c'*
q.
* 2
-*,*---~-` I ~ I
* * 2. 4 9 I0~ 12. ~l'i
PAGENO="0231"
.1*.:.
w.
S
Nu) . .
So.' SW. . . : .
~ ~ p~47Ls C~ilc~/aj4d
a. (d~~a.~e)
MadLY. :.
227
I0~
.9,
7.
dose,
1$,.
m ic,
3.
* ~ `~, (~2- `4
* J~~5z~cLnce, y,111es * *
PAGENO="0232"
C... -~. -~. :. cD L)
~
~ ~ ~
~
~ ~. ~
C. C.
~ .. .
-~ ~ (Ji
~ C.~-~* (t
H
PAGENO="0233"
229
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
ADDITIONAL QUESTIONS FOR MR. SAUL LEVINE
1. List the lessons learned from the accident at Three Mile Island and provide
recommendations or suggestions for rectifying the problems in question.
2. In your testimony you said that many of the details of the accident at Three
Mile Island had to be filled in. Did this imply that the Interim Sequence
of Events' provided by Mr. Denton on May 23 is incomplete, or that it had
not been brought to your attention prior to your testimony? Is this sequence
accurate?
3. Please expand upon your comment:
"From the viewpoint of nuclear power plant safety design, two principal
technical elements are involved in TMI. The most important is that the
plant was configured so that the pressure relief valve on the primary
coolant system opened very often due to events such as a failure of nor-
mal feedwater flow to the reactor."
Does this imply an abnormally high frequency of failure of the feedwater
supply or a poor design in the plant or equipment?
4. You indicated on page 5 of your testimony that there are significant differences
in relief valve behavior between the reactor studies in the Reactor Safety Study
and Three Mile Island. It would seem useful to apply Reactor Safety Study tech-
niques more broadly to see if other such differences can be found. Are you
doing anything about this?
5. On page 6 of your testimony you indicate that the bulletins issued by the NRC
should significantly reduce the likelihood of future TMI events. Are you
satisfied that these are the only actions needed?
6. On page 7 of your testimony you note that you are going to reexamine the basis
for the Reactor Safety Study-predicted failure probability for the auxiliary
feedwater system. Do you think that the RSS prediction was seriously in error?
7. On page 7 of your testimony you indicate that the techniques developed in the
Reactor Safety Study can be used effectively to help determine improvements
that may be needed in the safety of nuclear power plants. Could you elaborate
on this matter?
8. In regard to the consequences of the TMI accident, list the work that you said
would be in addition to that specified in the FY 1980 budget request.
9. In your testimony you mention the preparation of a supplemental budget request.
When will you have this finished and when will you be able to provide a list
of the items involved and an indication of their relative importance?
PAGENO="0234"
230
Fir. Saul Levine
Additional Questions
Page Two
10. Is there a need for a Swat Team composed of people from industry, the
utilities, NRC, etc.?
11. Should nuclear power plant operators be utility company employees? Are there
any reasonable alternatives.
12. Are there any advantages in standardizing the design of nuclear power plants?
13. Co you think that Computer i~odeling could be of importance in improving
operator training, or in developing response strategies for multi-failure,
multi-error incidents?
14. Is there an adequate data base upon which to develop a good computer model?
15. In your view, is there anything in either the Rasmussen Report, or in the
Lewis review, which if implemented would have decreased either the probability
of the Three Mile Island accident, or which would have reduced its severity?
16. ist your suggested modifications to the LOFT experiments, and provide details
of the transient analysis that you mentioned.
17. List the future reactor research safety programs that you mentioned.
PAGENO="0235"
231
~s REG~ UNITED STATES
- NUCLEAR REGULATORY COMMISSION
WASHINGTON 0. C. 20555
JtJL ~
** ~
The Honorable Mike McCormack, Chairman
Subcommittee on Energy Research and Production
Committee on Science and Technology
United States House of Representatives
Washington, DC 20515
Dear Mr. Chairman:
Enclosed are the responses to your additional questions resulting
from Saul Levine's May 22, 1979 testimony before your Subcommittee.
We hope the answers provided will add the additional information desired
to assist the Subcommittee in its important deliberations.
We will be most happy to provide you or your Subcommittee members with
any requested additional information or clarification as needed.
Sincerely
Gossi~~
Executive Director for Operations
Enclosure:
As stated
PAGENO="0236"
232
Response to Additional Questions Relating to the May 22, 1979
Testimony of Mr. Saul Levine to the Subcommittee on Energy and Production
Hearing on Nuclear Power Plant Safety
l.Q List the lessons learned from the accident at Three Mile
Island and provide recommendations or suggestions for
rectifying the problems in questions.
A. As part of NRC's investigation of the Three Mile Island (ml) accident
a task force titled "Lessons Learned" has been set up to identify areas
where improvements are needed in plant design, operation, and accident
response. The task force is being directed by the Office of Nuclear
Reactor Regulation and the main aim of the task force is to make
recommendations for changes in the licensing process to reduce the
likelihood of severe accidents at commercial nuclear power plants in
the future. The task force consists of approximately 22 full-time
staff members. The staff members are from various offices of the
agency, including the Office of Nuclear Regulatory Research (RES)~.
The task force expects to make specific recommendations on the NRC's
accident response role and on management, administrative, and
technical capabilities necessary to effectively deal with hazardous
conditions that may arise at licensed facilities. The task force
will review the current practices for accident response, make
comparison with TMI events and provide recommendations.
The task force will probably last for several months with interim
reports given to the Commission as information is developed(
2.Q In your testimony you said that many of the details of the
accident at Three Mile Island had to be filled in. Did this
imply that the "Interim Sequence of Events" provided by
Mr. Denton on May 23 is incomplete, or that it had not been
brought to your attention prior to your testimony? Is this
sequence accurate?
A. I have no doubt that the "Interim Sequence of Events" provided by
Mr. Denton is accurate. My statement was meant to cover the possibility
that, as additional study of the TMI-2 accident is made, some more
significant information might come forth.
PAGENO="0237"
233
2
3.Q. Please expand upon your conmient:
"From the viewpoint of nuclear power plant safety design,
two principal technical elements are involved in TMI.
The most important is that the plant was configured so
that the pressure relief valve on the primary coolant
system opened very often due to events such as a failure
of normal feedwater flow to the reactor."
Does this imply an abnormally high frequency of failure of the
feedwater supply or a poor design in the plant or equipment?
A. This does not imply a high frequency of failure of the feedwater
supply. All reactors are designed to accommodate transients
involving loss of feedwater, that occur several times a year;
however, it is clear in the B&W case that the relief valve lifts
each time there is a loss of main feedwater and this is an
undesirable situation that has been corrected by the bulletins
issued by the NRC since the TMI accident.
4.Q You indicated on page 5 of your testimony that there are
significant differences in relief valve behavior between
the reactor studies in the Reactor Safety Study and Three
Mile Island. It would seem useful to apply Reactor Safety
Study techniques more broadly to see if other such differences
can be found. Are you doing anything about this?
A. Reactor Safety Study techniques are already being applied in a
broader way and it is our hope that.such quantitative risk assessment
applications will increase in the future. For instance, in the
Methods Application Program we are studying four plant designs
which are different from those in the Reactor Safety Study to
further extend our engineering insights into reactor safety. These
analyses include a wide range of plant safety systems, components,
and operator activities. We are also currently applying the techniques
of the Reactor Safety Study to assist the Office of Nuclear Reactor
Regulation in a review of the auxiliary feedwater systems of about
30 nuclear plants. In addition, we are presently developing an
integrated reliability evaluations program in which event trees will
be constructed for all plants having significantly different accident
sequences. System logic models will be constructed for the critical
systems identified from the event tree analysis. This effort will be
performed on a priority basis and will provide an integral view of
the input design differences on plant safety.
PAGENO="0238"
234
3
5.Q. On page 6 of your testimony you indicate that the bulletins
issued by the NRC should significantly reduce the likelihood
of future ThI events. Are you satisfied that these are the
only actions needed?
A. I am satisfied that these were the most imediate actions needed.
I believe that additional actions will have to be taken in the
future as we digest more of the lessons of the TMI-2 accident.
However, these are not as urgent and require some careful analysis
before they can be effectively implemented. Some of the general
directions that have to be explored are indicated in the research
topics included in my testimony.
6.Q. On page 7 of your testimony you note that you are going to
reexamine the basis for the Reactor Safety Study-predicted
failure probability for the auxiliary feedwater system. Do
you think that the RSS prediction was seriously in error?
A. We believe that the RSS prediction is not seriously in error. This
judgment is based on the fact that each auxiliary feedwater system
is tested about 12 times per year and is called on to operate about
three or more times per year. Given at least 3000 trials of these
systems. over the years, we are aware of only one instance (ThI-2)
where the system was completely disabled. We will of course have
to do further evaluations as further data become available.
7.Q. On page 7 of your testimony you indicate that the techniques
developed in the Reactor Safety Study can be used effectively
to help determine improvements~that may be needed in the safety
of nuclear power plants. Could you elaborate on this matter?
A. Quantitative risk assessment techniques can be used, for instance, to
determine the relaUve safety significance of various design features in a
plant and among plants. For example, we are currently applying risk
assessment methodology to 30 nuclear plants with various designs to
look at a wide range of safety systems, components, and operator activities.
Also, a number of priority areas for investigation have been identified
using risk perspectives in the Improved Safety Program (which was
transmitted to Congress in early 1978 as NRC document NUREG-O438).
PAGENO="0239"
235
4
8.Q. In regard to the consequences of the TMI accident, list
the work that you said would be in addition to that
specified in the FY 1980 budget request.
9.Q. In your testimony you mention the preparation of a supple-
mental budget request. When will you have this finished
and when will you be able to provide a list of the items
involved and an indication of their relative importance?
l7.Q. List the future reactor research safety programs that you
mentioned.
A. We would like to undertake a significant amount of important research
in FY 1980. We are preparing a FY80 supplemental budget request for
FY80 to cover this area. I have attached a copy of the requested
budget supplement for FY 1980. All of the items listed in the
requested budget supplement are considered to be of high priority.
This budget supplement request is still preliminary in that it has
not been approved by the Cormnission.
Projects for future reactor safety research currently include
continuation of much of the work included in the FY 1980 budget
and the FY 1980 supplemental budget request. Areas where new
programs are likely to be suggested are in improved reactor safety,
improved risk assessment methodology, and some areas of exploratory
research as suggested by the Advisory Comittee on Reactor Safe-
guards (ACRS).
lO.Q. Is there a need for a "Swat Team" composed of people from
industry, the utilities, NRC, etc.?
A. Yes. Regional teams of nuclear experts specially trained to assist
during serious accidents at nuclear facilities could be a valuable
resource during an emergency. The group would provide expert advice
to plant management during an emergency; however, they should not be
chartered to take over operation of the reactor; the utility's power
plant operators should continue to operate the reactor.
ll.Q. Should nuclear power plant operators be utility company
employees? Are there any reasonable alternatives?
A. Yes, plant operators should be utility company employees.
We do not believe that reasonable alternatives exist for using
operators who are not employees of the utility company. Under
current methods of assigning safety responsibility, the utilities
are held accountable for safe operation of the nuclear power plants
and the use of other than utility operators would remove this
accountability.
PAGENO="0240"
236
5
l2.Q. Are there any advantages in standardizing the design of
nuclear power plants?
A. Many of the initial difficulties faced in coping with the TMI incident
would have been reduced had TMI been one of a family of standard plants
under a standardization policy implemented with a high degree of
discipline; standardization provides a policy and framework for the
staff and the industry to know, understand, and model the response
of plant systems, and thus, to quickly and effectively analyze differing
situations. This suggestion is based upon the assumption that the
number of nuclear power plants will continue to expand, perhaps
substantially, beyond those presently committed. With the number of
reactor vendors, architectual engineers, and site specific needs
there will be some difference in design between individual plants.
However, the potential benefits such as facilitating licensing review and
faster response during emergency or accident situations would indicate
a need for standardizing plant designs.
l3.Q. Do you think that Computer Modeling could be of importance
in improving operator training, or in developing response
strategies for multi-failure, multi-error incidents?
A. Yes. We are planning to investigate the feasibility of programming
a control room simulator to simulate numerous transients (WASH-l400
event trees might serve as a guide) with which control room operators
could be trained. Also we are looking at the technical feasibility
of using real-time computerized systems to monitor plant status,
display information, diagnose upset conditions and prescribe remedial
action as aids to nuclear reactor operators.
l4.Q. Is there an adequate data base upon which to develop a
good computer model?
A. A sufficient data base does exist to begin development of a computer
model for system response following transient and small LOCA events.
However, additional system data will be required to upgrade these
models and to test and validate the model application to reactor
systems. We expect that the planned tests in Semiscale and LOFT,
which we will undertake soon as a response to lessons we have
learned because of the Thi accident, will provide much of these
needed additional data.
PAGENO="0241"
237
6
15.Q. In your view, is there anything in either the Rasmussen
Report, or in the Lewis review, which if implemented would
have decreased either the probability of the Three Mile
Island accident, or which would have reduced its severity?
A. The Rasmussen Report noted that the small break LOCA had a potential
for a significant contribution to public risk. Also, human factors
could determine the direction of events and have the potential to
turn a less severe accident into a moresevere accident. It is
possible that if more attention had been paid to these areas the
accident at TMI-2 would not have been as severe and that the agency
would have been better prepared to respond. The Lewis Report
contains recoimiendations about the use of risk assessment techniques
to improve reactor regulation. However, the period between publica-
tion of the Lewis Report and the TMI accident was too short (only
a few months) that very little in the way of specific implementation
has had a chance to occur.
l6.Q. List your suggested modifications to the LOFT rxperiments,
and provide details of the transient analysis ~hat you
mentioned.
A. The LOFT test program which was established prior to TMI was to have
continued the large break tests in FY 1980 (simulating loss-of-offsite
power and at different power levels). However, our current plan is
to delay the large break tests and run three small break tests and
one natural circulation test during FY 1980. These tests are more
relevant to the TMI-2 accident analysis and therefore have been given
higher priority.
Prior to the TMI-2 accident the emphasis of the code development
program was on developing a multi-dimensional thermal-hydraulic
code for large break LOCA's in PWR plants. For small break LOCAs
and certain types of non-LOCA transients that are of much longer
duration, we need a much faster running code. Fortunately geometrical
details are less important in these analyses and can be simplified
allowing the codes to run faster. To this end Los Alamos Scientific
Laboratory is in the process of producing a code (TRAC-PF1), on an
accelerated basis and should be available by the end of this calendar
year.
48-721 0 - 79 - 16
PAGENO="0242"
238
DISCUSSION OF RESEARCH NEEDS TO ADDRESS
ISSUES RAISED BY THE TMI ACCIDENT
The major areas of research needs arising from the TMI accident are
discussed below.
It is clear that small LOCA, transient events and enhanced operator
capability are areas that need additional research resources. In
particular, better computer codes are needed (1) to enhance our under-
standing of small LOCAs and transients, (2) to allow multitudinous
studies to be made of these types of events and the many variations
that can occur -in them, and (3) to predict with greater precision than
now available the behavior of plants in response to such events. The
-development and checking- of these codes will require experiments in -
such facilities as LOFT and Semiscale (for PWRs) and TLTA (for BWRs) to
provide insights to develop the physical models in the codes and to check
their range of applicability. The availability of these same codes will
allow studies to be made toward enhancing operator capability. Studies
will be made of simulator requirements to enhance their capabilities for
training plant operators, analyses of the instrumentation needed by
operators to understand and react properly to the full spectrum of
potential reactor accidents, and studies of the control room display
and diagnostic equipment needed to assist the plant operators in effecting
proper responses and insuring that limiting conditions of operation are
met. In addition, these same codes will allow us to analyze the startup
transient tests already performed on operating reactors and will give NRC
the understanding and the basis for s~ecifying additional startup tests
that may be needed on operating plants. At the same time, risk assessment
tasks to construct event trees are needed to define accident sequences
covering severe core damage which the codes must calculate and to guide
the research tasks needed to assess the potential impacts of human error
on the course of these types of-accidents. In parallel with these studies
it is necessary to investigate potential means for improving plant design
features such as improved decay heat removal and ECC systems, vented
containment concepts, etc.
Also of great interest is the need to better understand-the response of
plants to accidents of the kind that occurred at ThI. It is clear that
we need a better understanding of primary coolant chemistry after severe
fuel damage, hydrogen evolution and behavior in the primary coolant system
and in the containment, behavior of important plant components under long
term, severe accident environments, equipment qualification and testing
requirements and structural analysis of important plant components and
safety features under accident conditions.
Finally, it is important to preserve the data on the amount and dispersion
of fission products throughout the plant and to examine the ThI fuel to
assess the type and extent of damage to the core. In parallel, it will
be necessary to examine safety-related equipment in the plant to assess
the extent of damage and to establish criteria for safety requalification
of the plant.
PAGENO="0243"
239
-2-
IDENTIFIED RESEARCH NEEDS (~~j_
FY 80 Supplement
- ($ Million)
A. Better Understanding of Transient and $13.4
Small LOCA Accidents
B. Enhanced Operator Capability 3.8
C. Plant Response Under Accident Conditions 5.1
D. Post Mortem Examination and Plant 2.7
Recovery
E. Improved Risk Assessment 3.1
F. Improved Reactor Safety
$ 29.8
Each of these research areas is further subdivided into research tasks in the
tables below:
A. Better Understanding of Transient and Small LOCA Accidents
Modifications and Checking of Existing Codes to $ 3.1
Improve their Capability to Handle Transient,
Natural Circulation and Small LOCA Accidents in
PWRs and BWRs
Upgrade Semiscale to Study PWR Transients 3.0
Upgrade TLTA to Study BWR Transients and Small LOCA 2.2
Modify LOFT to Accelerate Small LOCA Tests i.o
Separate Effects and Thermal-Hydraulic Tests 1.3
Coolability of Severely Damaged Cores; Release and 2.4
Transport of Fission Products
Establish Data Bank for Each Operating Reactor 0.4
for NRC Calculations
$13.4
PAGENO="0244"
240
B. Enhanced Operator Capability _________
Develop Improved Control Room Display and Diagnostic $ 1.8
Systems and Improved Requirements for Operator
Training Simulators
Develop Instrumentation Needs and Improved Status 1.0
Monitoring of ESFs
Define Data Transmission Requirements and Review 1.0
Accident Response Procedures
$ 3.8
C. Plant Response Under Accident Conditions
Improved Understanding of Coolant Chemistry after 0.5
Fuel Failure; Better Sampling Methods
Hydrogen Behavior in Coolant and Containment; 1.2
Effect of Hydrogen Explosions
Response of Plant Equipment and Structures to 2.1
Accident Conditions
Potential Design Improvements for Maintaining 0.5
Containment Integrity under Fuel Melt Conditions
Benchmark Testing of Structural and Piping System 0.8
Analysis Codes
- $ 5.1
D. Post Mortem Examination and Plant Recov~~y
Examine Samples of TM! Damaged Fuel 1.0
Measure Fission Product Chemistry and Plateout 0.6
Data
Post Mortem of TM! Safety Related Equipment and 1.1
Estabi ish Requal ification Criteria
$ 2.7
E. Improved Risk Assessment
Develop Event Trees of Accidents Leading to Severe 1.4
Core Damage and Assess Site Specific Accident
Consequences
Analysis of Human Error Rates and Impacts of Human 1.2
Errors on Risk
Operational Failure Data Analysis
$ 3.1
F. ~~p~oved Reactor Safety
Improved Containment Concepts $ 0.5
Improved Safety Systems for Coping with Accidents 1.0
Involving Severely Damaged Fuel
Improved Value/Impact Methodology
$ 1.7
PAGENO="0245"
C,
0
~cn-
0 ri
~co
g~z
cn
11~»=
`i
(flZ
C,
-x
mo
Cflr
0
6,
Ccv)
*1 ~+ -S -~
Z
22-n
-~
3
~S) _~-~
o ~()O2O
~< o~ -~
~
3 2
22-us ~<
(S (52-3. C)
-S 2.2 2
CS -` -u us
-~ uu Cu 2
<$ (D-C
52u, CD
CC)
C.O p
~- ~Jfl ~
PAGENO="0246"
242
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
ADDITIONAL QUESTIONS FOR DR. HAROLD LEWIS
1. Would there be any advantages in standardizing the design of nuclear power plants?
2. Is there any need for a Swat Team composed of people from industry, the utilities,
the NRC, etc.?
3. Should there be a standard design for control rooms and for the layout of control
room panels and instruments?
4. List the research and development programs which you would recommend to improve
nuclear power plant safety.
5. Expand upon your comment that the NRC has made little use of the Rasmussen Report.
6. List the "substantial problems" that you mentioned you have found in the Rasmussen
Report.
7. Expand on your comment that constructive human intervention was required to modify
the course of the accidents at Three Nile Island and Browns Ferry.
8. Expand on your comment that a flexible response is a key to limiting the course
and the consequences of accidents. What computer aid or assistance would you
suggest be provided to nuclear power plant operators?
9. Identify the lessons which have been taught as a consequence of the Three Mile
Island accident. Provide recommendations or suggestions for overcoming these
problems.
10. Do you think it is time for an updated version of WASH-l400 modified so as to
incorporate: your criticism of the risk assessment methodology; and a consideration
of transients, small LOCA and human errors as important contributions to overall
risk?
11. In your opinion, is there anything in either the Rasmussen Report, or in the Lewis
review, which if implemented would have decreased either the probability of the
Three Mile Island accident or which would have reduced its severity?
PAGENO="0247"
243
UNIVERSITy OF CALIFORNIA, SANTA BARBARA
REEL N AN RSID N SEC N FRAN ~ NTA RB BA NT
DEPARTMENT OF PHYSICS SANTA BARBARA, CALIFORNIA 93101
27 June 1979
The Honorable Mike McCormack
Chairman, Subcommittee on
Energy Research & Production
Committee on Science & Technology
U.S. House of Representatives
Suite 2321 Rayburn House Office Bldg.
Washington, D.C. 20515
Dear Congressman McCormack,
Thank you for your letter asking me to reply to a number of questions
intended to amplify my testimony before your Subcommittee, on May 22nd.
I'm sorry this is a bit later than you had requested, but I was out of
town and slow to receive your letter. I hope this is sufficiently
timely.
1. (Would there be any advantages in standardizing the design of nuclear
power plants?):
Ultimately there will be advantages in such standardization, since it
will reduce the number of specific plant designs which require de-
tailed analysis. For example, it is apparently so that there are now
some 24 separate feedwater systems among pressurized water reactors,
since the design of the feedwater system is left to the architect-
engineer. However, in my view, it is premature to move toward stand-
ardization while there are still so many generic safety issues out-
standing.
2. (Is there any need for a "Swat Team" composed of people from indus-
try, the utilities, the NRC, etc.?):
I do not see a need for such a "Swat Team", provided we work very
hard in upgrading the instrumentation and training available to
reactor operators, to enable them to cope on-site with a greater
variety of accident situations. On the other hand, lists of experts
on specific issues, and dedicated communications make sense, just to
reduce the lead time necessary to obtain useful advice. As has been
said before, the characteristic of a reactor accident is that it
takes a long time to develop, so that consultation is feasible.
PAGENO="0248"
244
3. (Should there be a standard design for. . control rooms and for the
layout of control room panels and instruments?):
I don't believe that one could now construct a good standard design
for control rooms. There is a great deal of variety, and a greatly
enhanced level of study of what is called the "man-machine interface"
is necessary, before one can decide which layout of control room
panels and instruments is optimal for the widest variety of accidents
in which the operator can intervene constructively.
4 (List the research and development programs which you would recommend
to improve nuclear power plant safety.):
I am reluctant to answer this question, since I am sitting on the
Advisory Committee on Reactor Safeguards, which will be reviewing the
NRC safety research program. On the other hand, the report of the
American Physical Society had very detailed recommendations for the
reactor safety research program, and I still support those recommen-
dations. I an particularly pleased that Bob Budnitz, who served on
that panel, as well as on the Risk Assessment Review Group, is now
deeply involved in the formulation of the NRC safety research pro-
gram.
5. (Expand upon your comment that the NRC has made little use of the
Rasinussem Report.):
My principal concern is, as I stated in my testimony, that the NRC
response to our criticism of the Rasmussen Report included the asser-
tion that it has made little use of it in the past. I believe that
the Rasmussen Report, flawed though it was, still represented a major
and serious, effort to delineate the principal reactor accident
sequences, and that the wisdom thereby provided ought to have been
seized upon to orient the research and regulatory programs of NRC.
In particular, as an example, the Rasmussen Report should have direc-
ted rere attention at small LOCAs and transients, and who is to know
whether one might thereby have prevented the accident at Three Mile
Island. I personally believe that the NRC overemphasis on large
LOCAs has been in part a response to ill-considered intervenor
pressure, which has outlived its usefulness.
6. (List the "subsstantial problems" that you mentioned you have found
in the Rasmussen Report.):
For this you should have our Risk Assessment Review Group Report, but
the list included there is, succinctly: statistical errors, an
inadequate data base, inadequate ability to quantify common cause
failures, an inadequate treatment of human response issues, etc.
PAGENO="0249"
245
7. (Expand on your comment that constructive human intervention was
required to modify the course of the accidents at Three Mile Island
and Browns Ferry.):
At Browns Ferry a control rod drive pump was used to cool the reactor
in other than the normal mode, and substantial repairs were accomp-
lished on failed relief valves. These are simple examples of many
places in which the plant superintendant, Jim Green, directed a major
human effort to save the plant. One has only to read the chronology
to recognize the importance of this.
At Three Mile Island, after the initial errors and the consequent
core damage, intervention consisted of managing the temperature and
pressure of the plant, managing the size of the hydrogen bubble,
removing the hydrogen bubble, and generally managing the cooling of
the plant. In this case, of course, one can imagine even more con-
structive human intervention earlier in the course of the accident.
8. (Expand on your comment that a flexible response is a key to limiting
the course and the consequences of accidents. What computer aid or
assistance would yu suggest be provided to nuclear power plant
operators?):
This is a comment which arises from a conviction that any accident
sequence that threatens a plant will contain surprises, and that the
number of possible accident sequences is sufficiently large that it
is not likely that they can all be catalogued. Consequently there is
a great premium on ability to understand what is happening inside a
reactor during the course of an accident, and on appropriate
response. As far as computer aid or assistance, though I have not
thought this through, an ideal would be an ability to program pos-
sible actions on a simulator to provide some guidance on the conse-
quences of those actions. We should, however, be careful not to
overstate the ability of a simulator to simulate a reactor under
accident conditions, in an area in which the codes which go into the
simulator have not been verified experimentally.
9. (Identify the lessons which have been taught as a consequence of the
Three Nile Island accident. Provide recommendations or suggestions
for overcoming these problems.):
My lessons are, in brief,
1) There will be accidents.
2) These accidents will contain surprises.
3) Flexible and informed human response is essential to
arresting the course of an accident.
4) Redundant and prolific instrumentation designed to des-
cribe the state of a reactor in an upset mode is impor-
tant, so that the human response can be informed.
5) Proper training, education, and selection of reactor
operators is essential.
// /
/
PAGENO="0250"
246
10. (Do you think it is time for an updated version of WASH-1400 modified
so as to incorporate your criticism of the risk assessment method-
ology; and a consideration of transients, small LOCk and human errors
as important contributions to overall risk?):
As I stated in my testimony, I do not think that an updated version
of WASH-1400 would be sufficiently better than the current one to
justify the effort. I do believe that the risk assessment method-
ology, as we said in our report, should be far more widely used on
subsystems for which it can be used well, and that it should also be
used as a principal means of resolving generic safety issues. That
more consideration needs to be given to transients, small LOCA, and
human performance is now well known to everyone, and the problem is
to get cracking on it.
11. (In your opinion, is there anything in either the Rasmussen Report,
or in the Lewis review, which if Implemented would have decreased
either the probability of the Three Nile Island accident or which
would have reduced its severity?):
Again, as I stated in my testimony, I find that both the Rasmussen
Report and the Risk Assessment Review Group report emphasized the
importance of understanding the issues of transients, small LOCA, and
human performance. Attention to those recommendations, which have
also been made by others in the past, would very likely have greatly
reduced the probability of the Three Nile Island accident. In addi-
tion, since problems of this sort have now been found to have
occurred in other reactors at earlier times, a more attentive
response to operating experience as a means of learning about the
weaknesses of reactors, again as has been recommended for a long
time, might have averted the Three Nile Island accident.
I hope you find these comments useful.
Sincerely,
E.W. Lewis
HWL/jb
PAGENO="0251"
247
APPENDIX II
ADDITIONAL MATERIAL FOR THE RECORD
RON PAUL
1110 NASA 860*0 1
So~i 406
CODg*~ of the ~intttb ~`ttite~ HCoo*so~
06 ~ou~e of ~.tpvtftntati13e~ (J~_
Ulasbingtun, a.e. 20515 77566
(713)753-1895
May 4, 1979
Honorable Jack Wydler
Committee on Science and Technology
Suite 2321 Rayburn
Washington, D. C.
Dear Jack:
In response to your letter of May 1 soliciting comaents
on nuclear waste, I am enclosing two articles by Dr. Peter
Beckznann that I placed in the Record on april 24 and 25.
I would appreciate it very much if they were entered
into the record of your Subcommit'cee8s hearings.
Sincerely,
Ron Paul, M.C.
* RP/jr
Enclosures
-
-~
PAGENO="0252"
PAGENO="0253"
to
t~.
to
n
0
z
0
ttj
Ct3
03
a
Co
PAGENO="0254"
250
E 1744 CONGRESSIONAL RECORD - E'~iensioni of Re,,iarks April 24, 1979
I-~::~ PETR BECKMANN ~ ~ land h~s t*~ ~ ~ ~ did ~ ~ th ere~e toz: And the con-
. PO\VER o~e leom r!-ocn o~hnt hnppcocd thccc? tolnoocot building. nthlch in enormously
.. A. The accident at the Three Olile Inland strong and bs.llt to nlthstnod eren a jet
. plant Is uoqucstlou~bly the most serious In plooe croahing Into It. held the codlonctisity
HON. RON PAUL the 22-yeor hlsto~y of nuclear po~cr But the just as It should. That to What It ~as built
most slgnlflccnt aspect of tbot accident seas to do.
.0F . not merely that It produced no deoths. no But then it appears that another huroan
IN THE BOUSE OF REPRESENTATIVES injured. no casualties, no Illness. no hctpttai- error was made by pumping rater Irons the
a A Ti! 24 1979 laotian; but that the zero caoua fly figure usa . containment building to the suofllaey build-
. - oat due to "good luck. The accident pro- log. mhlch held the radloactirlty better than
S Mr. PAUL. Mr. Spcaker. energy expcrt duced a gigantic test of the principle of nu- It ~as eapectedto do. It lrm eloborate 011cm
Dr. Petr Beckmann was Interviewed last clear safety; octmely the concept of the dc- whIch retoosed eserythlng radlooctlce except
week b John Roes in the Review of the fenae In depth In ahlch. there ace many for the noble goses such as oeoco, argon, nod -
- layers of compleoieotory and supplementary krypton. These are not retaIned by the body.
* . aalety meosuras. Anotber oery Important Q. Then you slew the Three Mile Island
Dr. Bcct.raann, pro mac a - potnt lx that It denionotrated the alosaaeuo Incident an proelIag the safety or nuclear
Vervlty of Colorado, was born and U~ with whIch a nuclear-plant areldeat hap- poser?
cated in Prague. He worked at a research ~eno, allowing plenty of ttoae to select . A. Yes Indeed. Whst we here seen In this
institute of the Ccechoslovak Academy ccunteroneaaures, .~ ** cane Is a sequence of ecentu that took place
of Sciences until 1963, when he had the Q. What was the nsalfanctlon; that Is, aser many boom, and by that I mean not
chance to lecture at the University of bow did the accident occur? * * anly the caxlfsanctlons but also the human
I d H r returned to Eastern A. All the details boee not yet been pub- errors. And yet there wan plenty of tIme to
lithed, said the Nuclear Regulatory Cam- make testu, discuss end drcide what the best
Europe. 55 if OS en a ~ *g mission and ether agencies are still oomph- options were and are, and to tote enuater-
the United Scales * log their rrpsrta. Bat, from the available meosures. By coropnrisioo, how macis tlme
Dr. Becknsann has Wrltten more than lnfurnsatioa, what happened at Them Mile and shat sort of coentrrmensurrs are araB-
60 scientifIc papers, as well as eIght, Island was a chain of four gigantic loilures. abel when an oil tooler explodes?
books, and he publishes and edits Access ten osrchccilcal and two human. A pump An y energy facilily, by Its very nature,
to Energy, a monthly newsletter on cireulotlog eccicot acter to the ccci ci she, cantatas a lot of pent-up energy. If that
u Ic r power . * reactor foiled. Immediately and aulamatl- energy is retained suddenly It coo be desleuc-
In the post-Three Mile Island hysteria, oaily the Emergency Core Cosling system tlce; and as bag an man is fallIble, It con
h ed (E.C.C.S.) sea a action as was 55lp happen. In a ship or tanker iiquesed natural
Dr. Bee mann . posed to do. Alan Immediately the control gas, a does, an oil tanker or refinery--the
calm and xclenttflc. His n rr,iew cc - rode dropped dawn to abut-off the reactor, release of rncrgy Is sudden and disastrous.
tams much Information of valor, and , just as they were designed to do. Macever There is Only one mception and that Ia the
would like to call it to my colleagues the human errors now came Into play. Valves ease of a auclear plant. There even If the
* attention: * * los the E.C.CS. system had teen msnually energy gets~loose asd does what it Is ant
sssooos aeon Aesswcns shut by a workose,n, and an water did not supposed to do, such an a mritdso'n, It melto --
li * B - 1 lososed.iately go Into the care. On at Iceut doss into the earth for many is nura and ends
* Q.Pro,easorBrr mono,se *~ - tw000casioanhuaoanbeloguworklnglnthe up ins big gloss marble aCCused earth.
argumentu from the opponen o - plant tamed off the EC.C.S., allowing the Meanwhile you hare mane possible counter-
erfhP~ufmri~hwould carp of the rosatar to be left uocosered by measures, upto and Incladiag evacuating
noise nuclear waste or corn plutonium and * Nocethelesu, the built-In safeguards with- P p . .,,.,* -
tts an d pet say by tare tog 5~ th Imp b b halo I re I and acrt ~Hrs~aidxrne~i Thr liii II 0? th
A. Not really It wauld be mush easter. and solely before a meltdown was likely. y'.~_ A. Len first lurk at the process. Shauld
cause vastly great damage. Car tetloriuto tO therm ore even If a meltdown had occurred there be a loss-or-coolant acridrat In a light-
throw hood-grenades. or set off high cepln-. most probably there wauld have been no water reactor-that Is, a reactor that uses
nives. at a dam above a city than for thorn to cansaitles because the cactcicmeat build- ordinary water, under pressure or stat, to
brockisto a nuclear power plact. They would lag would have held the rodiosctlre gases. 0001 the core-the temperature of t~e fuel
issue to assemble a vram of tchioaphreciea It rcvrd how steen It was hr withstanding rode may rise to the point where they melt
who as the one hand could be gvoisuet or a hydeoeea esplasias sad it could rosily their light metal cladding. VIse heat ormm
esperss In a large number of varied diaoip- base withstood stases eapimicas and radio- from the ecesinsulation of radiaaotlse fission
lines, and yet on theatherhaodlaet005tu- aetive gases products in thefuelrods.
* pid to realize that there are far easier osetis- That Liner-na Core Conltng Bc-stem to the worst possible cane, this material
ads a! inflicting griesous injury on the pepsI- which han hers a articulsr ia-get ~g th~ would term a red-hot gao on the floor of the
lotion at large. . * * anti-nuclear collies who claImed It could thick steel pressure teasel thnt would slowly
plutonium Is of murse toclo, and if you nerer work stormed well under the asast melt through the steel and through the floor
breathe plutoalalrn dust you nan get lung re ncl~itloaa, * . * . of the containment buIlding Into the earth
misrer. But you will ant get that caaeri' far , * to a depth af noose 25 feet ar 5w where It
Ia taco yearn, If at all. only & seep inept tee- The Iac,den at Three. Ic an would dissipate Ito heat. Very probably the
rorist would use a weapon that takes years presided a arrere Se test w * as a, maId goo now encased in a glans marble of
and ~esrs to kill Better to use finale nub- that the E.C.C.S. will pe. arm sin er fused earth could be remaved, even aslraged,
atoners like arsenIc soB other clsemlenI and most adverse and unfa~eseen con ens. * whtlaout major caanplleatlona. Usless It can
biological anslas that are diiflcsdt to trace, at he con loosen bu disg can con into an uadergrouad stream and munnged to
HadinaetIae material can be detected in lsdi- end accUse gears and coon a hydrogen ox- rent steam Into a blowhole outoide,sll radio-
crossly minute quantities, after alt arid so plosina. and, that the deters the sax sep satIre gases would still be rantoined Inside
defensire mensuren can be taken ogalast ~ hal g to wh.eb ra the cacitslnmest building a! macrate and
F rorseto pock knlf w uld be co re Pti"05i50 a~es th rtadi cure 10 1 ha th m lt site
O.e~5 ~~~sas ral tOOk matje alas gases and laden escaped into th tanas- EP ~ dm15 han h d I flit Dr
nuclear power plant ha far the p5rpose Of ~ - I I niaguafternucleararal-
ry g di dl I p w d f ~ re~d~ t~ h~r~1~ 1~a~ mdf ~ 0 tom Caned han die m Id `t think
Q. Could a euolear reaotar at spower plant matlcaliy was that the reaotor wan turned be thnn I:r ~iuidergrouad, shielded by ever'
espbadc an that oae moeniag we might --_ a aff. Hawesor, yau easnat prevent the auo ear lying. cork and earth, enclosed to a pocket
mustroom cloud looming over the debris fl.saiao products In the fuel rods from ~°~` d ~ -
of a devastated power plant? * tlnutag to be hot, When part of the core
A The uranium used In the powerplant becanse unmresed as the lerel ef cooling Q. How do the eopossreu to rodiaac V 7
reactors Is nat asflicieatly enriched f or an water dropped, the temperature rose and at the Three Mile Inland plea coiaparetO
enplmion to accur. *The danger at the Three the best broke down sonic of the water halo our normal eopmure to background cad a'
hIlle Island reactor In Peansybceala wan from Ito oonspoaestu, hydrogen and aoygen. The tb I
hrdro en that farmed be ause of heat reactor core was damaged presumably by the A. A radlalogical health expert from the
a°ter abe water hovel fell sad es d part oserheatlag. which may have caused meltIng Nuclear Regulatory Cansnslsslan, Frank
th r - tar And actuall It now turns or warpIng of the fuel rods that are nue- Cangel, has stated that the cumulathue dose
out that hydrogen did explode sad the con- rauaded by a llgbt-welght naelal cloddlag. of radIoactivity for a peroes livIng In the
talonsent building witbstaod hIs farce with- Q. What about that so-called `leaking" of closest haune to the plant who bad rensalned
out problem, * radioactivity autalde the plant? * out of doors far flee easseeuthoe days con-
Q. Prafesnar Seckmsnn, the axaso medIa A. itadhoactlte gas escaped from the re- tlauously, 24 haura-a-day starting at the
treatment of the accIdent at Three Mile Ii- - actor Into the asatahnnsent building those of the accident, could have receIved $5
PAGENO="0255"
onq; puy patnnq atsq van ~ aa~~ ~a tan; a~ j~i ao; pus aouo q~* fl40 s~ç; ;fl uaa ~ o;~qnd aq; ~a; ;ou pp £aqr~ uoç~
21a22 aip ?` S)(UB3 flu.zos flO £j;u33a.z ~ u;a~ uos~ndwo3 qtuoq-W03B GZfl 30j sy -v~pe.j ;o-swa.z;t~ OOO~2-stutz C pas;asaz
u; u puv 9L61 CL61 UI untq puw apotdxa floltn2n paso~aq .tlaq; Sq Ptfl inim 3U81003 atj; jo atduzss. i
a na s 3583BJ a tw~g no szaniq twit t~o an ats ;vq~ op a PUB paddo;s s £~;j; U; UT 3UU~ OqM 3UUId aq; ;v aaU.zoU aqU
-U U ; I *sqaaM x~s e puiq tao daaq o~ qow p2U&dU aaMod aq; qq~ sacro aq; an s~toqB 2tqua Bansuaa q aaiq i~patu aur~ v
aq; a ; ~ s; n ep B flU JO qaa £aq~ qa~qs u; £;a;ao~ q~noa-au B BJ 2 £111
-nq oooot Btnnq £;pBdBU BUBt%B2aw ooor &IIBa.z £aq; 3BU.A~ aOU sop; ajaq; ~; 2amod flOst aqvn UOflB; pu~a op tasa; ;Bq~ ;y ~
I . ~ B[ Bu pazaua3 pa.xg-flo try paao;B ~ .a;qB;;BtB 30U B; qu;q; £aq~ * qa;q* - * naaauaa
U B~ q qanux 0BaBUB aaq £;U;wpa~ v £2.zatza ;c, atto; ;vq; jo ;uawdo;atap aq~ ~O JUSUBUB £;paBq B; Ba;.rnaoo;d og aaataa y
. ~ BrtoaaZuBp a~ aaBaZBa o~B n3 WJ ;;BU BSBUB £aq~ *;Bo UBBB2B q B za.Uod `006't Bu;ddoqas B flU PBIBB ~UB ia;;; .iad
-;Ban;BBZ ~UB ;;o;Bq; aaqaia pa;ou no~ b napnu 2u;n ~Bnç aaaU £aqj. B3flBUBJ asaq; BUJUUOU;d ~ ~a8 BlaBB £aqB;tn a;;; .zad
. - q2Bap aq JB £UBW JO uoflBsflBw ;Bn aq; $OU Bfl ;BBfl (aujpo; 3Bnç ~ou) £2TB;2UBO;PBa ;OBajinUca;d
BUUq.zawy p~; pUB 0~ Uaa~;aq UtaaapuoU an aBznoU JO UBaI3 a~ataz q q asnBoa q ;n;q;;Baq * mv; 3UOqB 2U;ABq atflaBo;pax LUBUBaGU
aa.aod pa.ap-;~~a ;o UflBUBUaW o~a; aaB;daa aaotaa Zu;aq UB aatod aBa;anU papuawtao B ~;ajj Bap;saq 3Bq3 aa.to £aa3no a;;qnd
B; IBB;d aBa;anta B Ztqp;;rtq u; £BIap an aBac -aaa ~UB UU;B;UB BOU o; ~asoddo £aaa aaa.n BU BBs aaaq; ;a& aa3;; aad Ba;aBaUa;d q~q
. qaBa ;ng ;BOU qaauq ;BUf 0; UBU ;uop i Caq; ;BanaBadw; aa.nod .zBa;aBu BupB;q; U; Ofi JO s;ata; ;~;-au;p~; $aa;B;Uaa q;;tai
;npaaaBq aq ~ BLUOtU; aaB-auaacdcrauaq aq;; B096t £;aBa aq~ u; qaBq aaUod aBa;aruz Utfl BflB;B U~flBBatflzoN aq; ano U;B.B aq;
BBa2 ou;aaBa UUouq ap;xo B~oa~;aa ap;xo;p PaBaddo BLBUB;B UGU aUBq BB;;flBamUoa;s u; BaBUp aaaaBa quaoq WU~B asaaiw pau aqi
.BBJLUB-;BUU 2u;uanq wax; Buo;sstaz aa!J~-UaaBa qj no& ;aaaaoa aw p; ~Uapj y TUBa; 3BOUB aq; Baaq.U PB~ qt;w u;
a2tzo;B B~ U; aato Laaa4B aq $BnBaa BUaaB BUOtU tpXOaaa S ;aJBBaa UBd aBa;a~~ aq; q~ ~BUM q Ba;anaaa;d U U~ ~ JU ; aaa;B;;a ~
-aUUa PUB*U;U a~ £;qa;q B; q~ BUU USLY UUUU Bqtaaaq aBa;arata q;;.n waq; pa~BUba aABq ~ ;g;-aUpa; Baa flBaU P3U4fBU(U aq
I B~U;aBJB £q q;aBa aq; ;a UU;;thuB;p aaup Bq~ saçqaa Eq UB;;daaaq a;aq3 mBa; pasad ~ UU~ aqi aa;rabaa p;n~~ aq pica aUaaa
-a.a PflBU aBajaBta ZB;UU ~Bq; Bj ~za;ad acn~ -da Uaaq aaBq BUB;d aaUUd aBa;UUM b - -sa2 aq; `~;pacaa BBBLU aq; U BB;paUaay
(3023 30~ £q 3023 oot dq ;aa; ooo) £Uaaua Baood jo BPUBOOOB~ .203 )BB; 0B3 aaood aa~;; sad ao~oo;
02000 aq; aaopoad 03 Papaao 220 00003020 jo aBa;ooo ;na B~3~030a3 3033 B UB04; a.o003 ~ jo Ba;a0003;d ooo3o BU;o;taoo
3000(04 304; q~;o (Ba;;oz 001 dq ;ao; 001 dq 00 UBB 003 ;;o ~UB oo2 00003 333 3ooo 200 ~ ~ dq;;oaqoo SB 0003 30 oo;doono
332) 000 00003 ao;ooooz B) 3B03 03003003d 03 d;0;B3233 03B UBO aA;;B 3000 000&OB OBB43 -003 3043 ;ao;q 0; 34003 300 oaop 3~q aoj
pau;oo aq 30002 33233 (003 30 aoao;ot ~03 aaod 320303 0043 0; 3303.003 B 2B43 3004 `BOOpBq; `an;; sad B3300003;d 03 ~BB U; 013.04aq BB.0
-woo O30B.oBSaoB 0o~~q 3 03 OBO(3 B; £;;o;a; P332~ PUB 00 o2 P1003 30 3Bq; pooSa~ `B3BI& (;cl-ao;po;( ao;po; 3Ofl300Ipoa jo ;aoa; 004;
-3013 Jo oo;;d0000003 (BaBoon 0,1.033003 o;q,i, poooooq; BIO.030 20j ;ao; B ;o 00100 003 30033 poB(Bj 31100 aaaoo aq; p000IB B01~B2
j;oodw; ;BoaB000a;ooa 0043 3004B B0j30 0z0;oo;o;d pay `wo;oo;o(d ;a2 a~ `ooo;ooao' 3ow-~; 00 U; BOots; da;op ~ BOOS) 0a3d0300
`oo;;o;o 200'( 000(0 pa;qBo;p 03 0303300 30 d~ddoo BlOod 002 200 dot 2o;oaoq 3(32300 ~ 343 03 3040 0030000000 000 `oo(o;o;p
- 02(014 u; B.BB((0p 00111104 B d;.OBIU 2u;.Oad 0(- 10 ~0130o; ;ao; 30330 o; 003000 3103 003300332 £30300 `00234 043)0 0034 343 oo;ua~ p(oao~
2a.%030B;0B3(a300y 303 000300 43140-Ouaoo poB B20030lllapaaaq 000 3.0 33 203(300 o2 `~a PIUBIII2 32B 03300000 ;B;00030000 00
-023.402 (0.03)1) 303 .0031 0303 ~0j 10030(p P10040 0,0 dqao 000012 1303.00) B ;; aaaqj, 3B43 00 03003 B; 0203 30322 PUB `BaA -v
2003 3303ff 010 pl3Oq;1;;B 0210(02 (003 I0000B `130 300;B ;a; `~003 000; 2330343 -. 43; ;,osaop `puo;2
B4;Olp 0000 010 3234; IBId 4303 `BI0003 1003 ;;;;o o; 3( B(B03 00 43(,%j, `BlO((op ;ooo;;;ppo jot p;oadq; 3043 030; ~0B ~ø0) 300 o;o; .a2 oaop
B100IB(p ;030300p0; 34; 3B ojoo; poy `0230102 , Bo0(((;oo p00 000(;(;Bo 3003 23314.0 000(30(0 3B0(3 PUB `30013 a1w 31101 1043 BOOS) PI001(
000(0030 20) 0£B~ £31o4001p 391 pUB 0230(00 -232 ;Oawooaaoo2 34; PUB `0300(3 203(300 103 -aS oo.o 0010 aulpo; 3.010300(002 00009 `9
;B03 203 Blop £;(((q000p gpg'~ 3003 02(20(0; 300(030 30003 o; 1030 P00 040000 3423 dq.o ;oo~opoa 30 PIIP ;oap;
`P30000003 322303 3;r~oaja jo s;;oooo2aoo 001; `000110303000030.00330;30)B339,001 340 £q so' -0323 3311.230030; 200 3043 P010003 111.0 £aq;
-((00 234 0300(3 203(300 ao; 2o;ojoo 000(0010 P1(330 03003 3230 343 a30doap 00 s; 0140 ~00 0303 0,400(3 1 B(20o0J, `(03002 31003 03(30003
01 0.03 .4(00 300 `5300(3 p11310011-3003 10) 2o; 130 20 1003 0043 103(020033333002 43000 o; 21 203(300.1000300 323002110.0 o010003303ou0 210
-0(00 (003 U( 03011 631 3003 1.0 `p30000003 £ -lOod 3031300 `S(pl(BlJ,, `010303333 1(400000 0143 od'o42a3 `00033230(3 (tao `.131000 03200.0
-31300313 30 oo;o.00aw 00(33(04 31301303 y Jo 000(0(0 343 0030 loapoadap 34 03 3004 0303 0431.0333(000 3004 3033032203(3000 0302;
6 310400000040 P~0' `01 300 030) 030000 p13303 143 3043 BUolto .6( 0043 13(3(33003 003 0031 1(342(30 30sf 0332 300
`palOpold £Baaoa o 3000100 34303 -000(040 3 `RUB 030300,103 Jo 0300(004 100 3)3 `900000, B 4200 23(333(0 01,, `0(00 04.0 131(31.
00(30(32 o; 0430313 30 3340000 3003 01 0130100 101301310 sj;; ~o 02(3203 £oq 03 2o;ooq 300 plB.00p3 `~a 000 31 `13(3(30 343 00 030(0(30003
-32000300 300304(03(0 31(012 002 `(003 0000 01 2o;ooo ;0a12 B BUOIO! 0(02 `.6603(loa000p 2o;ojoooo 31030 £aq; 002123(3(00 3004 0303 0310
000(0010 B01( 10) 10(03 03 ~11U 234 `103003 p13013033 00 003 0300(3 30143 10) 121103 -0033! 001000000203 £looozo2ao 103(2034 300 lB
30 `00(113 2043 0~ 030113(302 U( 0110103 203(300 `1(000339 `0100303 1210( £q 23300 `1(100330 `RUB 30(1 £3133013 B3( 00 031000100
000(003030 B4303p ;q2~a £100 113.0 32141, 3004 01 3; `30233 `0000031 ;01303B 030 ~ .. SB 002121(001011(003(011 Iota 300(3 33.003 y
`6001 03 9361 p31313 103( 303 04301) OPI 00.0 60200(3 pasao;o3j;o `UB(d 23.003 201130003030 20(0(113(00.0.114;
3103100102 010(02 (003 o; 1011 4303 0303)13 30 1003 300 0000 314302 `0300(3 20(3031012 0043 31430 4301 02013 00(303)01 11000 30(1312
-30 10003 oot 0003 1100! 3000330 (00033(ppo 10311033(1 P111.0011-303(300 P1(04 03 300.0 1143 20333100 B P104 03(0000) 203(300-10000
3133 03U( 310 03 0(234 0103 300 010) 0(4,1, 3330003 0143 P10340 £63.0 `00010333ff `~0 `01 040 300(3 1.0103 3000310 0)00( 03 0004 I
`333 `31q(000330111(003.3l0 ` `2opoa
-003 PUB 0100323) 2001 (0033 00(301) 3103002 o; uoo~~aw B 00 PUB 3 330(312 03 o; 401( "342(2311302000( 00(406002 0300 `UOflO(pol JO
-323 00011 303 31010303011 £1100090 311.0 p(ooo 2jB `300 033(300(003 000100 002323; BUOllIlIlOlI 61 3000(0 00 010(2 301 1.0 P003.303
;do(;oo;oo;;~ 143 30 3003 0300(3 31.003 2o;omq P10040 3000314 `21030 00(0 B( 31 `013030133 3000303 00103001002 £3402000302 310 023(14
-~B03 100 3040 P100 3! 30103011002 1011p33 -0013 2142(04 043022 001 3 10003104 303(393 UOT.000( 0130 `0013(3(303 03301 300 001 010(2
300 lq p100113300 11(0032(0 ~00 33(03 ~~ao 32001 23 30 `2003012002 3300013300304314 343 330 00(0(03(3; 30(03 2001. `11(1330043 2o(lop_
31113 0134 0004 `1601 ~1 £1102 003301301U(010y o; 3043 )00 `20330112130.0 03313000123 303 3303010300 0101) 00130100230 00032111100 01(01
;oawdo~aoa~ ~U0 43101030 122309 343 £q PUB 2130.0 201(134 3043 4004 03 30111300 ~; 3314 00(1312 aoL 312; 300(111(0 9003-03-30003
P3001112 Q-p993 ;aoda~ `(003 33 4093 0,313 0; q2tooq; £130001 0033 01 4300! Loao paoo B 1403 001 1103014.0 `3003 0003 12034 -y
-Bad o; 13.0000 100 `00(3 20(14 300 1033012 30 33.43 P1(43 B o; 1310,1, 603000030 3(403000101 300110130
-saab 343 Bj 30043 33 `P04330! 33430 £oo 0043 `1310(410; 103.5 0201110 304; 000100aBoa3opo13 0; on. 2o;;o~po1 £330030000 320 00 (000020
23300 01 ~;;31~;3~(~ a;o23032 03 12.003 203(300 0; 31031(3 13010310 P00110 B 30010 3 2214.0 B)U(p9004 ~00 `A~o `00303 140 00 poy `9 -
20(00 1243300 93 00(30103 109,1, `3300 30131111 212004300 3014 B 0000 oao2 11(0.0 304 p13(200 `00010103 10)100014 01
001 10 003 £23301 2o;o(ooo; 20(4(034 `y -oaad .00 000330 30040 `0102 `3203 2033032 3230404300013(040 P00 2003 30) 30! 401.0 2o;
43300 343 o; 2130.0 ~01 JO 11020133103; 1030, 010102 -30010 0114 P04 £aq; 3; so 03100;p02 30100140
4 11,003 3011300 3040 01 301011 200,9, 63 3044 3014 3003(32 0040 0)12 (103 o; 00(03012 30040 3o2 300(3 O(000(&03013 343 0335100(3
- `00(3 (0(043 000(0 B 0002) 030003 0010 143 `3020(11 201011 a(11o13 340 09 `019330) 1030210 ~UB
-3032 0(043 2031300 301501303 00 0213po0 03 20(3011012 (0312(3311,paIaoJ_3031300 o oq `0102 3;0003 210020001012 43(4.0 1)63(3(0 100
~; 103 01(011411 30 0100( a3~ £q 1(01000330; 0~ , . `30(4203193 `0330223100123430; 13001;300lpoa 1020300 140
3; B304J, `933-010(0020 30332311 03 4313100 033(213 30043 010230 34~ 00300! 3043 30304 243 301000330 0( 09(3, `00033(33(00 ~ 3o2 ~1~3o~
o; 2033012 30033-31.003 B U; aoj 343 00ff 330po111 03 100 0011304.0 01 23 3101139;) ((Boo 33(03 PUB £11020000 2.0 `2311 I 11143413)3609
`00(33032 0(0043143301233 30,3 `10(0(263 B 00193 0314.0 010300 £q P13043 o; 300 00011(3(90 001 36040 o; 20313(012
-03 343 20030)0 3a4;a2o; P3310) s; 3U60100 -012 o; ~3;3123331a 0300(11 aooood a(ooo-a2.rs; 0P010103 B 10) 116903.011201100100 1031'
0(03233 B 00110036330 000003 00330012 0(043 o;, `;oo(d 312333(aolp,34 B oç" ;daooj -y `L;3a2 631000101 1(113 ~ 0002)
30(00(301 00 U10(~ 0303 `6(1-02010010 0~ 3 JO , 4300(3 231003-311203(1 p22~-(0030 03(100 boon 300 `OfooOoI&oooaj `0(0(1103 0160
;u111311 06 0043 32010 3049 00 (0(133001 393 0003) ~331P 21 OIOP 000 P00 000(3 13.0011 £(Uo B0((0Q 01201.6 0 000131(3(02 66 412 3(3020
043(101 20 3)1103 30631 no.9 `qoooq 000jUBIO B 101(300 o JO 03(0043101 1003 130 30030 `9 -300 001 `33(3 3101. 1019 o~ `ao'; nod aaaq.n
3400! 0,1, `3(00001000 01 0(3101.0 061-00030020 `B01033;B 00 201001111) 513100 001301002 p000223304
01 110 143 JO 3033133 60 22300 y `a(qooos 000300302 30 ~1P 1(qoqoad UI.s nod `00022 1026300 3003 `101(109 50003 1031 10 1~10203(
-004 300 01 40(4.0 6110061U010 01 00010030 (39 3~ `3131003 £03 o; 00132 C 30 0260110002 4030155 14,1 `3000 Lox o; 1,60 paooo(od z s's
04; jo 33332111 (00 `320 03010030 (026300 B 00,1.0 1011 (no o; 01312 9 03 do 30(3331 `00100(032 43000 0(03 no.6 030(2 (o3;d
01 0110643 30 0.001 100, 303000210010101 03 p333(00213 B~ 9301110)1011000 B o; 2331034 -500(0003 102-9 £poq 933(300030 `000(2031003
`apoploa 300 003 300111 aa.ood 101(300 B o; B 500030(00232 131)00 30120(31,0 200 31~00 La `L;;o;33oo~poa 30 0'2031111101 99 00 430004
£~LT a 91';vzua~j Jo ~ 1YNOISSflIONOD CLOT `!& L01dV
Tgg
PAGENO="0256"
PAGENO="0257"
253
University of California
LOS ALAMOS SCIENTIFIC LABORATORY
Post Office Box 1663 Los Alamos, New Mesico 87545 5051667-5061
In reply refer to: 0-6
Mailstop: 559 June 8, 1979
The Honorable Mike McCorrxack, Chairman
Subccerrnittee on Energy
Research and Production
Corrroittee on Science and Technology
U.S. House of Representatives
Suite 2321 Rayburn House Office
Building
Washington, DC 20515
Dear Mr. MaCormack:
This letter is in response to your May 18, 1979 letter (received
June 5) roguesting rr~r written testimony for the record of the May 22-24
bearings on Nuclear Reactor Safety. You indicated that the Subccmmittee
is particularly interested in suggestions for technology developre.nt to
enhance the safety of nuclear poser plants including the subject of
radiolytic hydrogen in a PWR reactor vessel following a loss of pressure
accident.
My experience in this area includes analysis of containment hydrogen
concentrations resulting frcmt radiolytic hydrogen produced in water on the
containment floor after a loss-of-coolant accident and, in addition,
analysis of hydrogen concentrations in the primary system of the Three
Mile Island plant in the weeks following the accident. Others in the area
of nuclear power plant reactor safety research at Los Alanos Scientific
Laboratory have direct experience in reactor materials and fission product
* chemistry and in Imxleling and analysis of primary coolant system flow for
accident conditions.
This testimony considers hydrogen in both the PWR reactor vessel (primary
coolant system) and in the containment, as produced in the. Three Mile Island
incident. The main line of defense always has been and should continue to
be prevention of such accidents. However, it seems prudent to improve our
understanding of hydrogen production and removal rates, anong other pbenaemna
of interest, at the temperatures and pressures of the accident conditions.
As an edditional measure, it also seems prudent to consider possible engineer-
ing approaches to remove any hydrogen produced during such an incident.
For example, a potential engineering approach is to design safety systems
to remove hydrogen in either the primary coolant system or the containment.
In the primary coolant system, hydrogen might be removed by using scavengers
that react with hydrogen and/or by adding en operator-controlled valve at
the top of the vessel to permit any hydrogen bubble to be vented into the
containment. In the containment system, the hydrogen might be renoved by
TWX 910-988-1773 Telex 66-0496 Fascimile 505/667-6937 (automatic)5051667-7176(operator assist)
48-721 0 - 79 - 17
PAGENO="0258"
254
using a rapid hydrogen reo:xrbiner system to eliminate the problem of
hydrogen burning in the containimant. Another or perhaps supplarental
option sould involve venting the containrrent atmosphere through filters
to rerove fission products. Any such systems added to either the primary
coolant system or the containrrent would have to be investigated for im-
pact on other safety systars and tested for total effectiveness.
As a basis for such considerations, additional data are needed to
improve the determination of the hydrogen production and reroval rates
in the primary coolant system at the ter~ratures and pressures of the
accident corx3itions. Areas where research could provide irrproved data
inelode: (1) hydrogen production by radiolysis and steen reactions with
zirconium (probably the major source of hydrogen in Three Nile Island),
(2) hydrogen r~mrval by reactions with zirconium, (3) hydrogen reumrbin-
aticm in a radiation field with the oxygen produced by radiolysis, (4)
hydrogen dissolving in the water, and (5) hydrogen reroval by scavengers.
Since the radiolytic hydrogen production and reumrfrination rates depend
partly on the quantity of solid fission products in solution, better data
are needed to determine hew much of the fission products go into solution
as a function of the arrount of zirconium reacted. ¶fl~e results of investi-
gations in these research areas could be crsthined into a primary system
coolant chemistry oorrputer code to calculate hydrogen production and re-
rroval for various accident scenarios.
Additional research is also needed to improve the determinations of
the hydrogen distribution in the containxrent resulting fran a concentrated
source (caning out of the vessel) plus a distributed source fran ra3iolysis
in primary system water released to the contairsrent building floor. A
catplter code could be developed that treats these t~m sources plus hydro-
gen reroval by remstbiners and/or contairirrant venting.
~Ib sunzrarize, the main line of defense sheuld continue to be preven-
tion of accidents. }~ver, it seers prrident to investigate possible
engineering approaches to reroving hydrogen if it is produced, and, as
a basis for this, research is needed to improve our understanding of
hydrogen production and rera~val rates at the tetperatures and pressures
of the accident conditions.
Please contact ire if you have questions concerning this testimony.
Sincerely yours,
Qrdon J. E. Wiflcutt, Jr., Ph.D.
¶L~rsmrel Reactor Safety Group, Q-6
Reergy Division
PAGENO="0259"
255
THE AEROSPACE CORPORATION
Post Office Box 92957, Los Angeles, Californio 90009, Telephone: (213) 648-5000
June 22, 1979
Dr. John V. Dugan, Jr.
Subcommittee on Energy Research and Production
Committee on Science and Technology
Room B3714, Rayburn House Office Bldg.
U.S. House of Representatives
Washington, DC 20515
Dear Dr. Dugan:
In accordance with our telephone conversation, I am sending you a
revised copy of my written testimony on "Human EngirieerinsI~luences on the
PTö~iance of Nuclear Power Plant Operators" which was prepared for the
record of the May 22-2~4 heari~~on Nuclear Reactor Safety. As a result of
the tight schedule for submission of the testimony, a few changes have been
required in the material which I sent to you on June 8, 1979. The enclosed
copy clarifies a few important sections of the material without changing the
substance of the conclusions.
Again, I thank you for the opportunity of expressing my views on this
subject.
Sincerely yours,
F d C Finla, on, Manager
uclear and Geothermal Systems
Energy Systems
Enclosure
PAGENO="0260"
256
HUMAN ENGINEERING INFLUENCES ON THE PERFORMANCE
OF NUCLEAR POWER PLANT OPERATORS
F. C. Finlayson
The Aerospace Corporation
El Segundo, California, USA
INTRODUCTION
Under off-normal operational conditions, operators in nuclear power
plants are inundated with an enormous amount of information which must be
collected, processed, and evaluated in a logical and timely fashion in order
to make appropriate control decisions. The operator's ability to make
decisions under stress is primarily influenced by three general factors:
(a) control room and control system design; (b) operator physical and
emotional characteristics; and (c) formalized plant operational procedures.
Human engineering is the science which attempts to harmonize the design
and/or capabilities of all three of these areas in order to optimize the
operator's performance in the control center.
In chis testimony, the author's views are presented with respect to the
effects of human engineering on operator performance in the control room. The
conclusions have their genesis in the results of a study which was conducted
by The Aerospace Corporation for the NRC in late 1976 (Ref. 1). Primary
attention has been given to the effects of control room and control system
design on the operator. Brief observations on the influences of operator
characteristics and operating procedures on performance in the control room
have also been presented. In the earlier Aerospace Corporation study,
special emphasis was placed on the evaluation of the control room-operator
relationships under severe emergency conditions in the power plant. The
observations presented below have also been restricted largely to material
related to emergency conditions in the control room. In spite of this
limitation, it is recognized that human engineering of control systems is at
least as important for normal and near-normal plant operation as it is for
emergency conditions. The restriction of the comments to emergency
conditions has only been used to keep the scope of the conclusions within
manageable levels.
BACKGROUND
Hum~.n errors, and especially operator errors, in nuclear power plants
have become an increasingly common source of concern. Operator errors in
nuclear power plants have been increasing at a rate which is nearly
proportional to the growth rate of the power plants themselves (Ref. 2). On
several occasions, of which the Three Mile Island accident is the most recent
and most severe, operator errors have contributed to accidents which have had
nerve wracking consequences. More specific examples of these experiences
will be d.scussed subsequently. It should be noted, however, that there are
PAGENO="0261"
257
two principal methods which have been used to evaluate the pOtential impacts
of operator errors on accidents in nuclear power plants: (a) probabilistic
analyses using fault tree/event tree formalisms; and (b) actuarial
statistical evaluations based upon results of abnormal incidents in nuclear
plants which have been documented in NRC Licensee Event Reports (LER).
The most prominent example of the application of fault tree/event tree
probabilistic methods is the Rasmussen, "Reactor Safety Study" (WASH-l1400 --
Ref. 3). One of the major limitations of fault tree/event tree methodology
is associated with defining a sufficiently complete set of branching failure
paths for the systems being considered. It is generally conceded that it is
practically impossible to define an absolutely complete set of event
tree/fault tree failure paths. LER statistics, on the other hand, may be
equally incomplete -- depending upon the quantity of data available and its
applicability with respect to the designs of current and future nuclear
plants. Under current circumstances, both event tree/fault tree methods and
LER analyses are needed to determine the probability of operator errors in
off-normal plant incidents. The relative areas of usefulness of these two
approaches in defining the potential impacts of human errors will be
discussed in more detail subsequently.
Two of the more significant physical factors contributing to operator
errors in a nuclear facility are: (a) the prodigious size of the control
board; together with, (b) the complexity of the power plant and its safety
related systems. Control boards have reached, and exceeded, lengths of 100
feet. Some boards have over 5000 control and display devices, which provide
information on about 10,000 functions. In these instances, over 1000 of the
functions displayed on the control panels can be classified as presenting
information which is critical to plant and public safety for normal and
emergency operations (Ref. 1). Simply keeping track of the operational
status of all critical equipment components in the plant has become an
increasingly difficult problem, especially if a substantial amount of
maintenance is being performed in the plant. If the operator is not fully
aware of the functional status of all significant equipment components at all
times, se.~ious problems can develop in the event of off-normal plant
conditions -- as the Three Mile Island accident dramatically demonstrated.
Control room designers have concluded that under emergency conditions
the size of the control board and the consequent "volume of raw information
exceeds the saturation point of the operator" (Ref. 11). The flood of
informatio~i delivered under such circumstances places heavy mental and
emotional demands on the operator for integration and comprehension of the
input data. The operator's problems are exacerbated because the unprocessed
data from the plant is presented without prioritization in short periods of
time. This excess of information results in conditions of extreme mental
stress for the operator. At these times, neither data integration nor memory
exercises are easily performed. Under such stressful conditions, mental
requirements of these types contribute to operator errors. Yet the concensus
of opinion among operators is that, more, rather than less, data are needed on
the critical elements of plant status. Operators do not wish to reduce the
PAGENO="0262"
258
quantity of information displayed on their control boards. Thus, the
elements of a dilemma become apparent: a recognized need exists to reduce
operator information overloads which must be balanced against a perceived
need for more data on the status of critical plant systems.
SOURCES OF OPERATOR ERRORS -- ACTS OF "OMISSION" vs. "COMMISSION"
An assessment has been made of the potential sources~ for operator
errors in the control room. Engineering analyses (Ref. 14) and empirical data
in the form of Licensee Event Reports (LER) results were surveyed in
addressing the problem. Table I (abstracted from Ref. 1) presents ~a brief
overview of a few of the major accident sequences involving the operator in
the control room for which fault trees were developed in the Rasmussen
"Reactor Safety Study" (Ref. 14).
It may be observed from the results presented in Table I that even
though the number of identified operator faults is small in comparison to the
potential hardware failures, an apparently disproportionate share of the
failure probability is due to the operator. This was largely the result of
assumptions made in the "Reactor Safety Study" (Ref. 14) concerning the
effects of stress on the limits of operator performance, based upon the
postulated stressful conditions of the accident sequence. As indicated, the
critical operator error related sequences were primarily associated with
Loss-of-Coolant Accidents (LOCA). Moreover, the sequences were dominated by
failures of the high-and-low-pressure injection systems, the containment
spray injection system, and a few other related Engineered Safety Feature
(ESF) systems. Examination of the fault trees in detail indicated that the
identified operator errors were generally related to failure to properly
manipulate one (or more) motorized valves, which required manual operation
from the control room.
Comparison of the hypothesized fault tree paths with actual incidents
involving operator errors taken from LER data produced some interesting
observations. The postulated operator errors in the fault trees were
dominated by "acts of omission", i.e., failure to perform some required
action, such as changing a valve setting for a coolant supply line from a
condition where fluid was being drawn from an external source (a tank which
ultimately would be pumped dry) into a recirculatory mode of operation. By
contrast, the incidents described in the LERs were dominated by "acts of
commission", i.e., gratuitous, unexpected, unnecessary actions which were
performed ("acts of God").
By their nature, the variety of operator error "acts of commission"
which might occur is partially boundless. As a result, it is impractical to
expect to catalog acts of commission completely. Development of a complete
set of fault trees identifying all possible acts of this type is beyond
reasonable expectations.
A classical example of an "act of commission" is found in the reactor
trip incident which occurred in the Rancho Seco plant in Sacramento on March
20, 1978. While the plant, a 900 MWe B&W reactor powered facility, was
PAGENO="0263"
TABLE I. MAJOR OPERATOR RELATED ACCIDENT SEQUENCES PWR~
Critical Systems
Identified Faults Sequence Fraction Probability Due to:
~p~rator Hardware Probability Operator Error Hardware
Control Bd. Remote - Control Bd. Remote
Low-Press. Inj. Sys. (LPIS) 14 5 92 2E-8 .52 .07 .141
LPIS + Contmt. Spray Recirc. Sys. 14 7 1140 2E-1O .51 Negligible .149
Contmt. Spray Inj. Sys. (CSIS)
+ LPIS 14 7 111 5E-ll .33 .12 .55
Small LOCA
Hi-Press. Inj. Sys. (HPIS) 14 17 166 9E-6 .11 .19 .70
CSIS + HPIS 14 19 185 8E-ll .06 .17 .77
*Based upon results of WASH_11400 (Ref. 14).
PAGENO="0264"
260
operating at a steady state power level of 70%, an operator removed the
translucent cover of a back-lighted push button switch from a panel in the
control ~oom in order to change the light bulb. The burned-out bulb was
dropped by the operator and fell into the open switch socket on the control
board console producing a dead short to ground in the switch. Breakers
opened immediately on two 214 VDC power supply circuits causing loss of
signals for about two-thirds of the non-nuclear instrumentation for the plant
and related control parameter indicators including: pressure, flow, fluid
levels iii steam generators and pressurizers, and all reactor coolant system
(RCS) teirperatures. Consequent spurious signals from all of the deactivated
instrumentation circuits were fed to the Integrated Control System (ICS) for
the plant, which caused the main feedwater flow to be automatically reduced
to zero. In a manner reminiscent of Three Mile Island, a rapid increase in
reactor coolant system pressure occurred when the feedwater flow was
cut-off. This in turn automatically produced a reactor trip on the basis of
a high-pressure signal to the ICS. Hampered by a lack of instrumentation and
an excess of equipment responding automatically to spurious signals, the
plant operators had their hands full in trying to maintain reactor control
and to prevent substantial damages from occurring to the nuclear steam supply
system from a rapid cooldown transient that the reactor experienced. An hour
and 15 minutes passed before the operators discovered the location and
secondary cause of the power loss in the 214 VDC power supply circuit
breakers. Only then were the operators able to restore power to the
malfunctioning section of the control panel and regain normal control of the
nuclear steam supply system. Nearly two hours passed before RCS pressure and
temperature were restored to within permissible technical specification
limits.
As an example, the Sancho Seco accident is neither unique, nor extreme
in its cnsequences. The events of Three Mile Island have indicated that
accidents of this type can come perilously close to producing a core
meltdown. Moreover, the incident demonstrates how the loss of control and
vital instrumentation can turn an apparently trivial incident -- dropping a
light bulb - into an unnerving experience.
Upon due consideration, it seems very unlikely that a fault tree would
have beer identified for an incident initiated by an operator dropping a
burned-out indicator light bulb into an open socket with resultant
substantial loss of instrumentation and control capability. Thus,
probabilistic assessment of the causes of such accidents by the use of fault
trees is only effective within a limited framework. This incident serves as
a rather classical example of the types of problems associated with
establishing the probability and consequent risks of operator errors
associated with acts of commission. Perhaps the most meaningful way to
attack problems of this type is on the basis of a statistical analysis of
operational power plant data through analyses of LESS and other data
sources. Certain specific problem areas, such as those associated with valve
manipulations, etc., may be amenable to fault tree analysis. As these
problem areas are identified, they may be eliminated through subsequent good
engineering practices. But in general, the diverse sources for accidents
PAGENO="0265"
2~1
involving acts of commission can neither be wholly anticipated, nor entirely
eliminated. However, some basic observations can be made with respect to
areas where improvements in human engineering can help to reduce
opportunities for errors.
EFFECTS OF CONTROL ROOM SIZE
As noted above, control boards have become extremely large.
Nevertheless, operators generally feel that no superfluous information is
provided on the boards. In fact, many operators feel that they need- more
plant data to aid them during operations. Therefore, elimination of data
displays does not appear to be a promising method for reduction in control
board size.
Soire initial steps have been taken towards an apparently desirable goal
of reducing overall control board dimensions through miniaturization of
cont?'ols and display devices. A few utilities have already proceeded along
lines utilizing this approach. As a consequence, the trend to steadily
increasing control board and control room size appears to have slowed (and
perhaps even reversed). No very dramatic changes in overall control room
dimensions are likely to occur from component miniaturization processes
alone. !n the immediate future generation of control rooms we can expect
essentially more of the dimensional status quo.
Meaningful breakthroughs in control board size must come through
application of advanced methods of information processing for plant
operators. Computer-supported data retrieval and analysis systems, utilizing
cathode-ray tube (CRT) data displays, must be developed and become accepted
if this goal is to be achieved. In a computer-supported control room,
top-level functional plant information would be pictorially displayed on CRTs
as the baseline presentation mode in a hierarchically ordered set of
ç~ocessed data displays. Lower priority displays would be subordinated and
could be called for by the operator as the need for the information arose.
The data retrieval and analysis system would also aid in integration of power
plant data into more meaningful formats for the operator which could reduce
the oppor-;unities for error on his part. The trend to such advanced systems
is clearly in evidence. Several reactor vendors have developed conceptual
designs for such systems. However, nuclear plants incorporating the first
integrated computer-supported control systems, though under order, are not
scheduled to be operational for some time in the future. A clear need exists
for development of an advanced, computer-driven information processing system
which would be compatible with the concept of retrofittability into existing
plants, and which could be included in those to be completed in the near
future. Though a retrofitted system would not reduce the size of the control
center, it could substantially improve the operator's comprehension of root
causes of off-normal conditions and aid in his determination of actions to be
taken to alleviate the problems. -
PAGENO="0266"
262
CONTROL/DISPLAY COMPONENT SIZES AND LOCATIONS
In current practice, control boards are frequently fabricated with
extensive, geometrically-regular, rectangular columns and rows of heavy
switchgear and large display components. Such large, undifferentiated arrays
of similar (or identical) control and display elements, where the primary
distinguishing features are small labels on individual board components, do
not represent good human engineering practices. The apparent aesthetic
appeal of such arrays to the designer is of small benefit to the operator.
Universal antipathy was apparent among operators for this widespread practice.
Although miniaturized controls and data display components may be the
wave of the immediate future, plants of the current generation generally use
large, heavy switchgear for controls and big meters for instrumentation
readouts. Many of these components appear to have been carried over from
fossil-fueled facilities to nuclear power plant control rooms. Their
continued utilization is representative of a general utility reluctance to
experiment with control elements with which they have little experience,
where component reliability has not been well established. It is easy to
understand this practice in a nuclear power plant where reliability is so
importani. Nevertheless, if progress is to be made in human engineering of
nuclear power plant control rooms, smaller controls must be incorporated into
the designs concurrently with the development of computer-driven information
processing systems. Some trend setting power plants have made progress in
the direction of utilizing smaller switchgear and meters.
Evidence of another related problem area can be seen in some power
plants; ~.e., visual limitations with respect to data displays. When small
display devices are used in large control boards, it is possible to be beyond
visual limits for displays, especially if they are not closely spatially
correlated with associated controls. During the transitional period to
utilization of miniaturized components coupled with conveniently located CRT
displays, designers will have to utilize great care to avoid problems of this
sort. Proper functional organization and grouping of associated controls and
displays will be an essential human engineering practice in this period.
As computer supported data retrieval and analysis systems with CRT
displays become accepted practice in future control room design, the problems
of exceeding visual limitations for the operator can be eliminated.
Th problem of visual limitations is generally associated with a
related problem, the lack of spatial correlation between data displays and
control devices. As a rule, there were few glaring examples of poor practice
in connection with this problem in the control rooms analyzed in The
Aerospace Corporation's study. Functional organizations of the control
boards appeared to have been a relatively important consideration in the
design of most of the plants visited. However, in some instances, it
appeared that retrofitted equipment, after the control board was initially
fabricated, might have contributed some problems of spatial discorrelation.
Adequate human engineering design practices should assure that potential
PAGENO="0267"
263
retrofit requirements are recognized during design and some,
well-distributed, extra space incorporated into the plans for control boards
and control rooms. Again, the utilization of computer-driven information
processing systems, with CRT displays of critical system parameters, can help
to resolve problems with such after-the-fact cases of recognition of the need
for additional data for plant control.
COLOR CODING OF COMPONENTS AND DISPLAYS
The use of color on a control board is a very beneficial and practical
method for aiding in discrimination between adjacent control systems and
their associated components. With care in the choice of colors, even most
color-blind individuals can distinguish between adjacent dissimilar color
tones as they manipulate controls.
With a few notable exceptions, standard color coding is broadly
utilized within the industry in indicator lights which show the operational
status of systems components. Traditionally, red lights have been used to
indicate equipment which is running, valves open, and circuits closed. In
plants utiliziog this color-coding system, green lights indicate equipment
not in operation, valves closed, and circuits tripped. Under normal
operating conditions, control boards in which this color coding concept has
been applied look like Christmas trees with red and green lights dappling the
surface of the board.
Sore facilities have incorporated an alternative color coding concept
for indicator lights called an "all green board". This practice, borrowed
from the Navy, uses green indicator lights for all components that are in
their normal operating status, whether valves or circuits are open or
closed. When small deviations from normal operation occur in the plant, red
lights appear highlighting any malfunctioning components. The concept is
useful for normal and near-normal operation. However, when a serious
accident occurs, immense numbers of changes occur automatically in the status
*of operational and safety-related equipment in the plant and the color coding
concept becomes totally ambiguous. Confronted by an enormous variety of red
and green lights initiated by automatic accident control system sequences,
where the color of the light no longer indicates either the proper or
improper functional status of equipment, the operator would have only his
memory and the plant emergency operating procedures to assist him in
assessin~, the appropriate status of plant components. Under these
circumstances, it appears that operators who are accustomed to operating with
the traditional red/green indicator light coding concept would be better
prepared to cope with the accident and could interpret the information
presented more reliably and with less ambiguity.
CONTROL SHAPE CODING
With a few notable exceptions, the use of tactile sensory
identification mechanisms has been largely overlooked in the current
generation of control rooms. Some control operations require close visual
PAGENO="0268"
264
attention to displays while related controls are manipulated. Under these
circumstances, it is certainly poor human engineering practice to use
identically shaped control knobs, levers, or push buttons for dissimilar
control functions, especially when the control devices are located adjacent
to each other. However, numerous examples of this undesirable practice can
be found in the control rooms of operational plants throughout the industry.
In more than one case, it was apparent that problems had already been
perceived and enterprising operators had backfitted nonconventional control
knobs, with clear tactile differences, for these critical components.
In the next generation of control rooms using smaller, back-lighted
switches (probably in relatively closely-packed arrays), the use of tactile
identifiers on switch surfaces could greatly decrease operator error
potential.
"MIMIC" DISPLAYS FOR CONTROL SYSTEMS
Control system mimics (logical schematic displays of system
relationships between components, switches, functional status indicators,
etc.) have long been recognized as valuable tools in control centers. The
control boards of older, smaller facilities indicate that mimics were more
widely used then than they are in the current generation of large nuclear
power plant control rooms. As time went on and control boards became
steadily larger, the use of mimics was increasingly neglected. In most of
the currently operational, large facilities, mimics are virtually
non-existent. However, because they are so useful as- memory aids, many
operators have configured quasi-mimics out of colored tape on otherwise
undifferentiated control panels to support decision making processes.
In the next generation of control rooms, there will evidently be much
more widespread utilization of mimics. Of course, when control rooms are
designed around CRTs for data displays, mimics will be natural formats for
utilization.
FUTURE UTILIZATION OF COMPUTERS AND CRTS
An inevitable (and certainly highly desirable) trend to greater
utilizat~.on of computers and CRT displays is already apparent in the designs
of future control rooms. The debate over computerization seems not to center
so much over whether to use computers and CRT displays, but over what the
functional interface will be between the operator - the computer - and the
control systems. The opinions of advocates of various alternatives range
from relegating the computer to a simple data handling system, in which plant
control -is exercised in a relatively conventional fashion by the operator, to
utilizing the computer to essentially take over complete control of the plant.
The most probable application of computers in the control room will no
doubt be a compromise between the two extremes, in which computer-aided --
but operator-responsible -- control will be utilized. Under these
PAGENO="0269"
265
circumstances, interactive data/control displays may be provided on CRTs by
the computer. This appears to be a flexible, reliable, cost-effective, and
safe com?romise approaoh to the problem, and one which has great promise.
OPERATOR CHARACTERISTICS AND TRAINING
On the basis of site visits conducted to a number of operational
nuclear power plant control centers, observations indicated that the
operatora seemed generally competent, well-qualified in their assignments,
and adequately motivated. Regular training programs for both initial
operator qualification and continuing skill maintenance were being conducted
at all plants surveyed. Within the limits of the brief survey conducted, the
training programs seemed reasonably adequate -- especially those associated
with normal and near-normal operations -- considering the training methods
available to the plant operational staffs.
Ho/lever, capabilites for conducting realistic on-site training for
emergency conditions in the power plants were virtually non-existent.
Operator "walk-throughs" of emergency operating procedures were essentially
the only available method for on-site training in emergency conditions. To
overcome this weakness, NRC relicensing requirements call for the operators
to have hands-on experience in emergency plant shut downs, either from actual
in-plant incidents or from simulated events conducted in an adequate control
room simulator. This effectively requires operators to have retraining
exercises on a simulator, as most operators will not experience a sufficient
number of emergency shutdowns of their own plants to meet the NRC
requirements.
Assuming that infrequent emergency shutdowns are representative of
reality, the only practical method for operator training in severe emergency
procedures is through hands-on training in a realistically modeled control
room simulator. If simulators were conveniently available, more frequent
training of this type would be desirable. The bi-annual training sessions
required by the NRC are less frequent than desirable for skill retention.
Unfortunately, the geographic availability of existing simulator facilities
is often too limited to permit training sessions to be conducted with a more
desirabl? frequency.
Moreover, the total number of available simulators is so limited in the
US that fidelity of control room simulation is a problem. Until recently,
there was only one END control room simulator in the US, a mock-up of the
Dresden 2 unit. In addition to simulating an older plant, with a control
board quite dissimilar to those of newer BWRs, the GE-Dresden 2 simulator
also employs an "all green board" color coding concept for indicator lights.
As previously noted, this color coding concept for indicator lights is not
commonly used in most utilities of the US. Although another BIlE simulator is
now available, a model of the TVA's Brown's Ferry unit, neither of these two
simulators are high-fidelity reproductions of other control centers in
general. The numbers, availability, and fidelity of PWR simulators is
equally limited. The transferability of experience gained in emergency power
PAGENO="0270"
266
plant operations is uncertain for training conducted on simulators with poor
fidelity with respect to the physical characteristics of the operator's own
plant. This potential problem should present a substantial incentive for
either standardization of control rooms, or making relatively high-fidelity
simulators more conveniently available to operators in order to assure better
training.
The effects of control room human engineering on perceived stress
levels were reviewed with respect to the operator's performance in an
emergency. It is clear that excessive stress can have very detrimental
effects on operator performance. However, at this time, it does not appear
to be possible to quantify operator stress levels, in emergencies, or even to
be able to quantify the specific influences of factors which might produce
calamitous effects through excessive stress. The determination of optimal
designs for control clustering and ideal ccncepts for information
codification to reduce stress levels on operators would be extremely
difficult, and would require extensive research and development programs.
However, careful application of good human engineering would go far toward
eliminating design features which contribute to error-proneness such as
mirror-imaged pontrol boards for side-by-side, two-unit control centers; or
the location of essential data displays outside of the visual limits of
operators, etc.
EMERGENCY OPERATING PROCEDURES
Emergency operating procedures (EOP) were analyzed to a limited extent
for the plants surveyed with respect to their effectiveness in supporting
operator actions under emergency conditions. Though the EOPs examined
appeared to be reasonably effective tools for near-stable plant operating
conditions, they seemed to be too cumbersome for time-critical, emergency
conditions. The formal, written procedures were, of necessity, generally
voluminous. Detailed indexing of the material covered in the EOPs was rare.
Consequently, the formalized procedures seemed to be of limited value as
diagnostic tools for evaluating actions to be taken in emergencies where the
root problems may be ambiguously defined. In fact, the voluminous size and
cross-rererencing inadequacies of the EOPs may reduce the operator to heavy
reliance on his memory -- which is quite the opposite of the intended role of
the EOPs.
In an emergency, most of the required control functions in the plant
would be actuated automatically by safety systems which are part of the
Engineered Safety Features (ESF) of the plant. Thus, the principal role
which has been defined for the control room operator in an emergency is
monitoring and verification of the adequacy of automated ESF component
performance. However, no evidence was observed of well-defined measures in
the EOPs for dealing with one or more malfunctioning ESF components -- if
they should be discovered during the monitoring and verification processes.
A general reluctance was observed on the part of NRC and plant personnel to
acknowledge that malfunctions could occur in ESF controlled equipment. With
the complexity of the ESF systems actuation logic and the number of systems
PAGENO="0271"
267
involved, performing the task of verification of the functional adequacy of
the performance of all components is non-trivial -- and it must be assumed
that the assignment is meaningful irrespective of any "single-failure"
criterion which may have been used for design purposes.
Considering the magnitude of the verification procedures, it is
apparent that an operator aid to simplify and expedite the review process is
needed. A supplementary "command/response" data display has been recommended
for this function. This unit would consist of paired indicator lights which
would provide an immediate indication of commands which had been generated by
the ESF actuation system and the responses of associated equipment
components. With such a system, the operator could tell at a glance whether
all actuation system commands had been received; whether the components had
function~d properly; and whether final system conditions were consistent with
requirements. Most importantly, the "command/response" display system would
provide an instant checklist which would minimize mental data integration and
EOP memory requirements for the operator and hence opportunities for error.
Initial steps have been taken by some reactor vendors to provide the genesis
for systems of this sort. For example, a related concept (Valve Position
Status Indicatprs) has been developed and fielded by Westinghouse and is
currentlj in use in some facilities.
In view of the apparent limitations of the EOPs, they may be most
useful as source material for operator "walk-through" training exercises in
emergency procedures. Though these exercises are not necessarily conducted
under real-time conditions, or under stress, they provide the closest
simulatin of hands-on emergency procedures that most operators will have the
opportunity to experience, outside of a control room simulator facility.
OBSERVATIONS AND CONCLUSIONS
This testimony has not been prepared with the intention of giving the
impression that control cen';er design has been grossly neglected. On the
contrary; the evidence indicates that control rooms in nuclear power plants
have received a substantial amount of attention and relatively good
engineering judgment has evidently been applied in their design layouts.
Reasonably good functional relationships were ~evident in the control system
layouts of most of the plants visited during the course of the Aerospace
study. Nevertheless, as discussed above, there is still room for improvement
in the application of good human engineering to control panels and data
displays. The needs of the operators have all too frequently been
subordinated to the designers' inclinations towards the use of symmetry and
regularity in control panel design. As a consequence, large rectangular
arrays of columns and files of virtually identical controls and displays are
common practice in control rooms today. Though mirror-image control boards
for dual-unit plants are not commonplace, they should not be considered
acceptable practice for control center design in future (or current)
licensing procedures. Moreover, color and tactile coding of control elements
should not receive more widespread utilization by designers, as these
practices justifiably deserve.
PAGENO="0272"
268
With only a few notable exceptions, utilities are reluctant to be
innovative in control room design. There was clear evidence of widespread
prevalence of an "I don't want to be the buyer of the first model of a new
system" syndrome. As licensing/construction periods for plants in excess of
ten years have become common, it is easy to understand the desire on the part
of utilities for utilization of conservative design technology and components
of proven reliability. Utilities simply wish to minimize licensing delays
for new plants. They m~y seek to achieve this objective by making as few
innovations from plant-to-plant as possible. The problem is further
exacerbated by those interveners whose recalcitrant attitudes towards nuclear
plants in general, and innovation in particular, promote replication of dated
practices. Consequently, movement in the direction of incorporation of
advanced control systems into nuclear facilities is, at best, slow.
The current lengthy schedules for power plant design and construction
induce similar serious problems with respect to utilization of advanced
computer systems in control rooms. As planning/construction schedules are
stretched, technical obsolescence of control room electronic equipment
becomes a painfully real prospect, even before plants become operational.
Over a 3O-~O year life span for the plant, even obtaining replacement parts
and performing maintenance may be expected to become a problem for the
original computer equippient installed in the facility.
Nevertheless, current computer and electronic equipment technology is
adequate to support the implementation of advanced control room concepts.
The materials are available which would allow major improvements in human
engineering of these facilities. Initial steps have been taken toward their
utilization, but advanced hardware is still a long ways from achieving
operability in control rooms. Additional steps need to be taken to encourage
the incorporation of computer-supported data analysis and control systems
into nuclear power plants in a more rapid and meaningful manner.
What steps can be taken to expedite improvements in human engineering
in control rooms? For one thing, it seems clear that regulations will be
required to assure that fundamental human engineering requirements are al~piyp
included in control room designs. Only in this manner can there be an
adequate basis for enforcement of good human engineering practices. However,
the standards which are being developed for control room human engineering,
upon which NRC regulations might be based, have been slow in coming. These
processe;~ of standards development need to be accelerated, and higher
priorities should be attached to their completion.
From the standpoint of expediting advanced control room development,
innovative approaches need to be taken for encouraging the incorporation of
advanced designs into plans for power plants. As a suggestion for the
direction which might be taken, the NRC should provide licensing incentives
for adva~~ced concepts. These might take the form of a preliminary Regulatory
Guide which would demonstrate NRC support for utilization of advanced design
PAGENO="0273"
269
approaches. In addition, some stronger encouragement of progress towards
stepwise standardization of control room design could also be given by the
NRC. Among other benefits, standardization would reduce the problems of
providing sufficient numbers of simulation facilities, with adequate control
board fidelity, for operator training.
Plant design practices should be reviewed with respect to the problems
associated with the rapid rates of technological advances in computers and
electronic equipment for use in the control room. The potential for
technical obsolescence occurring in electronic hardware over the lifetime of
the plant is real. In order to reduce the obsolescence potential, a special
attempt should be made to maximize the flexibility of the scheduling of the
final s~'leotion of control room computer systems while the plant is under
construction. Delaying the final selection of the hardware for the
computer-supported systems until the close of the licensing/construction
period should permit deployment of equipment which will have substantially
greater computational and data handling capacity, relatively lower costs, and
fewer maintenance problems.
To help overcome the natural reluctance of utilities for developing and
debugging the first computer-supported data analysis and control systems,
perhaps a joint utility, industry, NRC-supported program might be developed
which could assist in overcoming the initial operational system problems. In
addition, support should be given to the development of a concept for an
advanced information-processing and display system which could be retrofitted
into existing nuclear power plants. A system of this sort could take
advantag3 of the most recent advances which have been made in computer
hardware and the most recent developments in software for the provision of
creative and meaningful control system displays.
Experimental studies should also be conducted on the effects of
incorporating advanced concepts into control rooms on the reliability of
operator performance in emergencies. This data would be of evident value in
supportthg and evaluating the designs of advanced control systems.
Whatever steps are taken in the future with respect to improved reactor
safety, advances in human engineering are needed in control rooms.
Incorporating them may only increase the standards of control room excellence
from what is now an equivalent "B" level grade to an "A", but the efforts to
reduce opportunities for operator error and improve plant reliability will
certainly be cost-effective in the long run. The problems which occurred in
the control center at Three Mile Island have demonstrated the need for
greatly improved information processing systems. Improvements are also
needed in training which will reduce the operator's transition time under
emergency conditions from the automaton level (in which he mechanically
performs only prescribed furctions) to that of a creative problem-solver --
the only meaningful level for man's intervention in the control center of a
nuclear power plant.
48-721 0 - 79 - 18
PAGENO="0274"
270
REFERENCES
1. FINLAYSON, FRED C., HUSSMAN, JR., T.A., SMITH, JR., K.R.,
CROLIUS, R.L., AND WILLIS, W.E., "Human Engineering of Nuclear Power
Plant Control Rooms and Its Effects on Operator Performance", The
Aerospace Corporation, Report No. ATR-77(2815)-l, February 1977.
2. USAEC, "Summary of Abnormal Occurrences Reported to the Atomic Ene~g~~
Commission During 1973", Report No. OOE-OS-OOl, May 19714.
3. US NUCLEAR REGULATORY COMMISSION, "Reactor Safety Studi", WASH-1400,
October 1975.
11. COLEY, W.A. AND DARKE, R.S., "Operator Interface Requirements for
Nuclear Generating Stations - A Review and Analysis", Proceedings of
Specialists Meeting on Control Room Design, IEEE 1975 Summer Meeting,
p. 77.
PAGENO="0275"
271
UNIVERSITY OF FLORIDA
May 17, 1979
Honorable Don Fuqua
Cosssittee on Sciences and Technology
U.S. House of Representatives
Rayburn House Office Building
Washington, D. C. 20575
Dear Mr. Fuqua:
In response to your letter of Hay 3, 1979, I am pleased to offer my
recommendations as to the direction we should take to improve the engi-
neered safeguards facilities for nuclear power plants.
When it comes to "safety" of nuclear power plants, the number one
requirement is safety of the population, and the number two requirement
is safety of the plant itself. Hot only is this is required by present
regulations, but is the practice that has been followed by the nuclear
industry from its beginnings.
Title 10, Part 50 of the Code of Federal Regulations specifies
conditions the engineered safeguards facilities must meet during the
postulated maximum credible accident, that is the "large pipe break" in
the primary system. The containment vessel must contain all radioactivity
to protect the population and the Emergency Core Cooling System (ECCS)
must be capable of keeping the maximum fuel-tube temperature below
2200*F. The ECCS is designed to meet this specification. Other limits are,
oxidation of fuel-tube not to exceed 17% of thickness and hydrogen
production not to exceed 1% of the amount that oxidation of all the
fuel-tube could produce.
The adequacy of the containment vessel to contain the radioactivity
even with some controversial interference by the operators has been
demonstrated by the recent Three Mile Island (THI) accident.
The hard fact is that any accident that leads to a partially uncovered
core shortly after shutdown from full power operation may cause severe
oxidation and mechanical damage to the fuel-tubes releasing fission
products into the primary coolant. Fission products in the primary loop
can escape into the containment building as at TMI resulting in a costly
clean-up and repair situation.
We must analyze every existing nuclear power plant to determine its
vulnerability to such costly clean-up and repair that can arise from
credible scenarios less than the "large pipe break," similar to the TMI
FLORIDA'S CENTER FOR ENGINEERING EDUCATION AND RESEARCH
COLLEGE
OF
ENGINEERING
hAY 2 1 191S
PAGENO="0276"
272
situation. I believe this can be done with an acceptable cost increase
in any new plants that may be found to have inadequate protection and at
higher costs in any existing plants requiring retro-fitting. Additional
briefing and training of operators and limiting their options during
emergencies is also in order. A rerote controlled vent line from the
top of the reactor vessel, a direct reactor core water level indicator,
azong other minor changes, should also be considered. The ongoing loss-
of-flow-test (LOFT) program should be of considerable value in providing
* data on which to base decisions.
I have been in the nuclear business from its beginnings. I am not
committed pro or con to nuclear energy; in my view nuclear energy always
has had to, and must continue to, prove that it can be utilized safely
and it must, of course, be economical.
With the above accomplished so that after any failure, recovery
efforts and costs will be minimized, the reactor owners and the public
will have reason for renewed confidence in nuclear energy as a part of
our national energy selfsufficienry strategy.
I appreciate this opportunity and hope the above will be helpful.
If Icnb of as stanc in anyway pleflfreetOalloflme
PAGENO="0277"
273
A.Wm.Snyder Sandia Laboratories
Nwlew Feel Cycle Pogra~s Albuquerque, New Mexico 87115
June 8, 1979
The Honorable Mike McCormack
Committee on Science & Technology
U. S. House of Representatives
Suite 2321, Rayburn House Office Building
Washington, DC 20515
Dear Congressman McCormack:
Please find enclosed the written testimony for your
hearings on Nuclear Reactor Safety requested in your recent
letter to Dr. D. A. Dahlgren. This material concerns the
interaction of molten LWR core material with water and
concrete--the subject in which you expressed specific
interest.
Some time ago Dr. Dahigren undertook another assignment
not directly related to this area. The material which we are
submitting was compiled by Dr. Marshall Berman who supervises
investigations at Sandia Laboratories relating to molten LWR
core material interactions with concrete and water and Dr. Glen
Otey, the Manager responsible for these activities. Please
call Dr. Berman, (505) 264-1545, or Dr. Otey, (505) 264-9945,
if we may be of further assistance.
Sincerely yours,
Enc.
PAGENO="0278"
274
Testimony for the Record of the
May 22-24, 1979 Hearings on
Nuclear Reactor Safety
for
U.S. House of Representatives
Science and Technology Subcommittee
on
Energy Research and Production
By:
Marshall Berman, PhD, Supervisor,
Reactor Safety Studies Division
and
Glen R. Otey, PhD, Manager,
Light Water Reactor Safety Department
Sandia Laboratories
Albuquerque, New Mexico 87185
PAGENO="0279"
275
Molten LWR Core Material
Interactions with Water and Concrete
Introduction
The Nuclear Regulatory Commission sponsors research
investigations at Sandia Laboratories on the interaction
of LWR molten core material with water and concrete. The
objectives of the research are to identify, characterize
and quantify the physical phenomena postulated to occur in
meltdown accidents. The primary goal is to obtain suffi-
cient understanding of the safety-related phenomena so
that they may be modeled and predicted within reasonably
conservative bounds.
The concern in meltdown accidents is ultimately with
containment failure. The molten core/concrete interaction
is a threat in this regard for several reasons. Reactor
containment can be breached by erosion of the molten core
through the concrete sump. Another threat~ which is possibly
more serious to containment integrity, is posed by the gases
generated during the melt attack on the concrete. The gases
may cause the structural limits of the containment building
to be exceeded either by direct pressurization or by the over-
pressure due to a detonation since combustible gases are evolved
in the chemical processes of melt attack. Steam explosions are
considered a threat to containment because of the direct over-
pressure associated with this phenomenon and because of the
possibility that projectiles launched by the explosion can cause
local breaching.
PAGENO="0280"
276
If containment is breached radioactive materials may be
released to the biosphere in the form of noble gases, low boiling
point vapors, aerosol particulates and, in the case of core
erosion through the foundation, dissolved species leached from
the fuel materials, by groundwater. The discussion provided herein
deals with the work underway at Sandia concerning breaching of
containment by mechanisms associated with core melt phenomena.
The consequences of the containment being breached by these
various phenomena is not discussed since it has not been a
part of this investigation.
Melt/Concrete Interactions
The Sandia program has shown that gases liberated from concrete
during interaction with molten reactor core materials are responsi-
ble, in large part, for the safety related phenomena during a
meltdownaccident. These gases alter the mode of melt attack on
concrete, transport energy into the containment building, enhance
the risk of explosion within containment, cause pressure to build
within the containment, and enhance the release of aerosols from
the molten core materials.
The exploratory studies of melt/concrete interactions under-
taken to date have been fairly broad in scope. Detailed information
is available on the rate and mechanism of melt attack on concrete
and consequently the rate of gas generation. More refined
information is needed on the following topics:
PAGENO="0281"
277
A) Gas phase reactions that yield explosive or
flammable mixtures within containment,
B) Aerosol generation by gases passing through
the melt,
C) Aerosol decay, agglomeration and deposition
within containment.
Gases liberated from the concrete by the action of a melt are
carbon dioxide and water vapor. As these gases pass up through
the melt they are chemically altered to carbon monoxide and
hydrogen. As these reduced gases cool within containment, they can
further react to yield methane and higher hydrocarbons. Such
reactions would be considerably aided if materials within the
reactor containment act as catalysts. Explosion hazards within
containment have traditionally been considered only in terms of
hydrogen. The possibility of a methane explosion has received
less attention.
As gases pass through the melt they accentuate aerosol
formation either by sparging particulate from the melt or by
creating particulates mechanically. Exploratory information
indicates that gas-assisted aerosol formation may be ten
times as efficient as thermal aerosol generation. Further, a
significant fraction of the aerosol comes from sources other
than the reactor fuel. Little information is available onthe
details of the mechanisms of aerosol formation from the melts
and especially the influence of melt composition on aerosol
formation.
PAGENO="0282"
278
Once aerosols form they immediately begin to agglomerate.
When this agglomeration has proceeded far enough, the aerosol
particles will sediment out of the containment atmosphere.
Details of these processes with prototypic aerosols are
completely unknown. Factors that should be considered include:
A) Rate of aerosol agglomeration
B) Influence of water droplets or vapor on
aerosol behavior
C) Impaction and retention of aerosol on surfaces
D) Sedimentation of aerosols.
A limited program to consider some of these features in the
piping system of a reactor is underway at Sandia under NRC
sponsorship. A more ambitious program to study aerosol behavior
in containment has been initiated in the Federal Republic of
Germany.
If a core melt erodes the foundation of a reactor, it
will come into contact with the soil. Exploratory studies have
indicated that the thermal front preceding the melt will dry the
earth prior to melt contact. However, once the melt solidifies
it will again be innundated with ground water. This water will
leach radioactive materials from the solidified melt.
Since gas generation during melt/concrete interactions is
a source of numerous hazards, a candidate method for improving
safety would be to replace concrete as the material lining the
reactor sump. Concrete might be replaced by a material which,
as a minimum, would not yield gaseous products when exposed to
a melt of reactor core materials. Additional safety could be
PAGENO="0283"
279
achieved if the material was relatively immune to melt attack
or would dilute and cool the core melt.
A limited exploratory study of candidate materials to
replace concrete has been initiated. Candidate materials may
be categorized as:
A) Refractories which would contain the~ melt until
it had solidified. Examples are MgO, Zr02, U02.
B) Sacrificial materials which would dilute and cool
core melts. Examples are borax, basalt, and
magnetite.
These melt retention materials greatly mitigate the safety hazards
posed by gas generation. They do not eliminate hazards produced
by aerosol generation. In summary, the preliminary information
from this exploratory study indicates that:
A) There are materials which might be used to line sumps
that are very resistant to erosion by molten core material
and which would greatly mitigate hazards due to gas
generation.
B) The erosion resistant materials investigated offer
promise as a means for retaining the molten core within
containment but do not substantially mitigate aerosol
generation.
The continued efforts in this program will be directed to im-
proving the data base for the above topics as they relate to
release of radioactive materials. One area that is not being
PAGENO="0284"
280.
studied in the current program is the effect of reflooding
the melt with coolant. As with the existing data base for
melt/concrete interactions, the current program concerning
core retention materials is being conducted for the purpose
of risk assessment. The results may be useful for identifying
possible engineered safety features.
Steam Explosions
When a hot melt and water come into sudden contact and
the temperature of the melt greatly exceeds the vaporization
temperature of the water, a violent release of steam may result.
This phenomenon, which is believed to be due to the fragmentation
of the hot melt allowing a very rapid transfer of heat causing
vaporization of the surrounding water, is known as a steam
explosion. In a reactor meltdown accident, contact between
molten core materials and water could take place in the bottom
of the reactor vessel or in the sump beneath it.
A steam explosion following a fuel melt accident is of
concern since it introduces additional mechanisms for breaching
containment. Three such postulated mechanisms are:
PAGENO="0285"
281
A) Failure of containment due to the direct overpressure
from the explosion,
B) Penetration of containment by projectiles launched by
the steam explosion,
C) Failure of containment due to combustible gas (e.g.,
hydrogen) detonation initiated by the steam explosion
pressure pulse.
Sandia is investigating, under NRC sponsorship, various
phenomena associated with steam explosions. Triggering of these
explosions is being studied in small scale experiments (- lOg)
using core melt simulants. Intermediate scale (1-25 Kg) experi-
ments have been performed in open geometry to measure the thermal-
to-mechanical energy conversion efficiencies. A closed geometry
test facility is presently being constructed to extend these
efficiency tests to a broader and more representative set of
materials and to improve the accuracy of the measurements.
Analytic efforts are underway to: 1) model the fragmentation
processes; 2) estimate the work efficiencies; 3) develop scaling
models; and 4) estimate the probability of containment breaching
due to the direct overpressure from steam explosions or from
penetration by projectiles launched by steam explosions.
The program at Sandia is in an early stage. The results
to date indicate that steam explosions may be likely under
hypothetical fuel melt accident conditions. On the other hand,
PAGENO="0286"
282
the experiments indicate that multiple explosions, which
greatly spread the energy release in time, occur frequently.
The estimated efficiencies for observed explosions were all at
least an order of magnitude less than the maximum theoretical
value. Thus, the achievement of maximum theoretical efficiencies
in extremely large, coherent explosions appears to be unlikely.
These results are, of course, of a preliminary nature. The work
planned over the next two years should provide a firm technical
basis for assessing the probability of containment breaching
by steam explosions.
PAGENO="0287"
283
IN REPLY PLEASE ADDRESS:
1901 LStreet,N.W., #711
Washington D.C. 20036
4 AMERICAN INSTITUTE
OF CHEMICAL ENGINEERS
May 24, 1979
Mr. Ian Whyte
Committee on Science and Technology
B-374 Rayburn House Office Building
Washington, D.C. 20515
Dear Ian:
As you requested, the American Institute of Chemical
Engineers is pleased to submit the enclosed paper on
`Relative Health and Safety Impacts of Coal and Nuclear
Electric Power Generation" for the Subcommittee on
Energy Research and Production's hearings on nuclear
reactor safety.
The paper was written by Dr. Walter Meyer, Professor
and Chairman of the Nuclear Engineering Department at
the University of Missouri-Columbia, and will provide
an interesting dimension to the hearing record.
,$nce~l
T. J. Hamilton
Ocnc~,s-,vt J.YOLOS,WE, s~J.QKNUO$N,,,. ~
PAGENO="0288"
284
RELATIVE SAFETY IMPACTS
I would like to examine the safety aspects of electric power generation
in the context of the energy resource choices that are available generally
in the United States, i.e., coal and nuclear. Unfortunately much of the
analysis of nuclear safety issues has not been presented* in the broad con-
text of the alternative choices. Frankly, it is necessary tha~ we examine
these two alternatives in comparison with one another and fortunately for
this consideration a number of such analyses have become available particu-
larly in the last ten years. An attempt will be made here to bring a nucber
of these a~j~tses together and summarize them for your review.
One of the more important recent documents examining nuclear power
health and safety in the context of the coal alternative is Nuclear Power
Issues and Choices.1 Quoting from this report of the Ford Foundation
Nuclear Policy Study Group, The use of nuclear power to generate elec-
tricity inevitably results in risks to human health. The extent of these
risks is uncertain and the subject of considerable controversy. To be
meaningful in connecting the public policy decisions, these risks cannot
be considered in isolation but must be compared with the risks associated
with coal-fired power plants which are the principal alternative for electric
power generation for the rest of this century.
I. The Potential Means of Electrical Power Generation
The potential means of electrical power generation have to be examined
from four different perspectives: first, technical feasibility within the
1Nuclear Power Issues and Choices, Report of the Nuclear Energy Policy Study
Group, sponsored by the Ford Foundation, administered by the Mitre Corporation,
Ballinger Publishing Company (1977).
*Emphasjs added.
PAGENO="0289"
285
timeframe in which the added generating capacity is required; second, reliability
of the technically feasible means; third, cost of generation by the various
means; fourth, the future availability of fuels for the feasible means, and fifth
the health and safety iopacts. Here we ~iill limit our explanation to the first
~nd fifth points.
A. Present Practical ~eans of Electrical Power Generation
Historically, fossil fuels including coal, oil and natural gas offered
the technically feasible means of providing energy and generation of electrical
power. A recent addition to the technically viable means of electric power
generatingincludes nuclear fission. Because of increasingly severe shortaqes of
supply and qovernoent r.iandate, natural gas and oil will in fact no lonqer be
available for added generation capacity.
Coal is the fuel used in generating the major fraction of electrical power
in the U.S. today. Larger capacity coal-fired systems employing advanced com-
bustion systems in an attempt to achieve improved overall efficiency and reduced
pollutant emissions arebeing designed and constructed. The questions of the
technical viability of coal concern the practicality of achieving acceptable
emission byproduct controls arid containment, estmblishing the necessary trans-
portation system between the mines and generating stations, and locating,
cpening and operating the necessary mines. Emission and byproduct control, and
containment will be discussed in detail here.
With respect to the control of emissions from fossil plants the primary
objectives of controls up to this time has been directed at relatively large
sizes of particulates and sulfur dioxide. Particulates are removed from the
stack gases using various types of filters or precipitators. The use of filters
48-721 0 - 79 - 19
PAGENO="0290"
286
RELATIVE SAFETY IMPACTS
I would like to examine the safety aspects of electric power generation
in the context of the energy resource choices that are available generally
in the United States, i.e., coal and nuclear. Unfortunately much of the
analysis of nuclear safety issues has not been presented* in the broad con-
text of the alternative choices. Frankly, it is necbssary that we examine
these two alternatives in comparison with one another and fortunately for
this consideration a number of such analyses have become available particu-
larly in the last ten years. An attempt will be made here to bring a number
of these analyses together and sucrearize them for your review.
One of the more important recent documents examining nuclear power
health and safety in the context of the coal alternative is Nuclear Power
Issues and Choices.1 Quoting from this report of the ord oundation
Nuclear Policy Study Group, The use of nuclear po~:er to generate elec-
tricity inevitably results in risks to human health. The extent of these
risks is uncertain and the subject of considerable controversy. To be
meaningful in connecting the public policy decisions, these risks cannot
be considered in isolation but must be compared with the risks associated
with coal-fired power plants which are the principal alternative for electric
power generation for the rest of this century.
I. The Potential Means of Electrical Power Generation
The potential means of electrical power generation have to be examined
from four different perspectives: first, technical feasibility within the
1Nuclear Power Issues and Choices, Report of the Nuclear Energy Policy Study
Group, sponsored by the Ford Foundation, administered by the Mitre Corporation,
Ballinger Publishing Company (1977).
*Emphasis added.
PAGENO="0291"
287
is generally limited to small generating stations, 100 IWe or less with the
electrostatic precipitators used on large stations. The devices used are
generally effective with routine operatinq efficiencies over ninety
percent on coals with high sulfur contents (greater than one percent)*. With
low sulfur (less than 0.7 percent) coals which also have higher ash contents,
precipitators are inefficient. High ash and low sulfur2 content combined with
reduced precipitator efficiency significantly increase the cost of..
handling the particulates or fly ash for plants fired with low sulfur coal.
Once the precipitator collected particulates are removed from the stack
gases, they must still be disposed of. For a 1000 MWe station particulate
disposal may amount to a volume of thirty (30) or more 100 ton (nominal) coal
cars each day. This material contains lead, telerium, antimony, cadmium,
selenium, zinc, vanadium, arsenic, nickel, chromium, sulfur, berrylium and
manganese, concentrated in the smallest particle sizes+3, all of which are
known to be toxic to man at some low level. However the tolerable body burdens
for each of these elements are unknown.2 Disposal of coal wastes will be
discussed in more detail later but it would seem prudent that these materials
should be disposed of in some type of permanent disposal site that would
prevent release of these materials to the biosphere (a clay pit or other
disposal site that would prevent leaching of the toxic materials into the
It should be noted however that with a 99~ efficient precipitator, a 1000 MWe
(2800) WWth) power station would discharge approximately 6,500 tons of partic-
glate to that atmosphere each year.
Piperno, `Trace Element Emissions: Aspects of Environmental Toxicology', in
S.P. Babe, Trace Elements in Fuel, American Chemical Society Advances in Chemistry
+Series, ~ 3
The smaller the particle the sore biologically active is the particle.
3R.E. Lee, S.S. Gorandsu, R.E. Ern-ojne and G.B. Morgan, Environmental Science
Techno~gy, 6, 1025 (1972).
PAGENO="0292"
288
biosphere would be required). The volume of the material to be disposed
of in the thirty year life of the plant would be 15,500 acre feet (26 mil-
lion cubic yards). The State of Illinois is sufficiently concerned with
this problem that state laws controlling solid waste disposal are being
interpreted to prevent noncontained discharge of fly ash and bottom ash
to the biosphere. The cost and design of the necessary contained disposal
sites are just beginning to be estimated.
It should be noted that if precipitators are used they will not prevent
significant dissemination of the volatile toxic metals, mercury, lead,
arsenic, cadmium, vanadium, selenium, antimony, zinc and others to the
biosphere. The potential health effects of these materials will be discussed
later.
It might be expected that the use of a flue gas scrubber system would
reduce both sulfur and trace element emission from fossil fueled power sta-
tions as compared with plants fitted with precipitators only. However, the
lack of proven scrubber technology,4 is preventing the determination of what
reductions in trace element emissions might in fact be realized. The effluent
from scrubbers still has a similar potential for biosphere contamination as
does fly ash. For a 1000 HWe power plant burning 2 to 2.5 percent sulfur
coal over a thirty year life, 6100 acres (9.5 square miles) of storage pit
five feet deep would be required unless effective means of water drainage
can be developed. This acreage would be required in addition to those ap-
proximately 22,000 acres that would be necessary for the coal inventory
typical of a 1000 fIle coal-fired station.5
~II. S. Rosenberg, et. al., `Processing SO2: The Status of SO2 Control Systems,"
Chem. Engr. Prog., 71, 66-71 (1975).
5"Comparative Risk-Cost-Benefit Study of Alternate Soufces of Electrical
Energy," USAEC, WASH-1224 (December 1974).
PAGENO="0293"
289
Coal fired power stations will also yield sulfur and other volatile
trace elements that can be partially controlled with precipitators but the
ultimate disposal problem of the precipitated waste still remains. Most
analyses of the total impact of fossil fueled electrical power generation
stations to date have neglected the environmental impact of disposing of
precipitated or scrubbed waste. At the same time extensive efforts have been
made to evaluate the impact of nuclear electric power generation including
the total fuel cycle.
II. Backqround: Public Health Effects and Occupational Fatalities and
Injuries from Coal and Nuclear Electric Potter Generation
Much has been written about the potential public health consequences of
the improbable nuclear meltdown accident but relatively little attention has
been paid to a comparison of the health affects accompanyinc the routine
operation of commercial fossil fueled stations with the routine operation of
nuclear.stations or for that matter with the nonroutine accident situation
attending the operation of a nuclear power plant. Several studies of this
type, completed by 1973, indicate that a substantial additional
cost should be levied against the operation of fossil stations to account for
health and environmental effects accompanying routine operation. Following
in Tables 1, 2 end 3 are EP1~ 1970 estimates of the damages resulting front air
pollutants.6 In terms of the cost of damage alone it is expected that the
1970 costs noted would have to be increased by a ratio of about 220/126
6T.E. Waddel, `The Economic Damages of Air Pollution", Socio-economic Environ-
mental Studies Series, Environmental Protection Agency, EPA-600/S-74-Ol2,
pp. 130-131 (May 1974).
PAGENO="0294"
290
Table 1: Contribution to Air Pollution
6 (*)(+)t
by Fuel Combustion in Stationary Sources
Total Tons (xlO3) Amount emitted
emitted/year by by fuel comb.
all sources in stat. sources _________________
148.7 0.8
26.1 6.8
33.9 26.5
34.9 0.6
22.8 10.0
266.4 44.7
*
Derived from Table 20 `Estimates of Nationwide Eceussions 1970 from
J.H. Cavendor, D.S. Kirchcr, and A.S. Hoffman, Nationwide Air
Pollution Emission Trends lP4O-1978, Publ. Ho. AP-115, EPA;
flesearch Triangle Park, January 1973.
~Stationary Sources are defined as public utility and industrial power
plants, co~2rcial end institutional boilers, and residential furnances.
~This column does not total to 100 because the values above are for each
particular p~ilutant; the total is for all of the pollutants.
Poll utcint
Carbon Nonoxide
Parti cl es
Hydrogen Chloride
fox
Total
Percent emitted
by fuel comb. in
stat. sources
0.54%
26.1%
78.2%
1 .2%
43.9%
PAGENO="0295"
Table 2.
National Costs of
Pollution Damage, by Source and
($ billion)
Effect, 1970
Effects
Transportation
Stationary source
fuel conbustion*
Industrial
processes
Solid
waste
Agricultural
burning
Misc.
Aesthetics &
soiling
0.2
3.1
2.0
0.1
0.2
0.2
Tbta~
5.3
Hunan health
0.1
2.2
1.7'
0.2
0.2
0.2
4.5
Materials
0.6
0.8
0.3
*
*
1.7
Vegetation
0.2
,
*
*
*
*
02
.
Total
1.1
6.1
4.0
0.3
0.4
0.4
i2.3
*Megl igibl e
*Statjonary sources are defined as public utility and industrial power plants,
commercial and institutional boilers and residential furnaces.
PAGENO="0296"
Table 3. National Costs of Air Pollution Damage, by Pollutant and Effect, 1970
best LOW tiign Best
* 3.4 8.2 5.8
? 1.6 7.6 4.,6
* 1.0 2.4 1.7
* 0.1 0.3 0.2
** ? ? ?
Total 2.8 8.0 5.4 2.7 8.9 5.8 0.6 1.6 1.1 6.1 18.5 12.3
Notes:
aAlSO measures losses attributable to NON.
bproperty value estimator
0Adjusted to minimize double-counting
?Un known
*Negl igible
(S billion)
Effect sox - Particulate 0~ CO Total
* Aesthetics & soilingb~0
Huoan health
Materialsc
Vegeta ti on
Anirals
Natural environment
Low
1.7
High
4.1
Best
2.9
Low
1.7
High
4.1
2.9
?
?
?
0.7
3.1
1.9
0.9
4.5
2.7
?
?
?
0.4
0.8
0.6
0.1
0.3
0.2
0.5
1.3
0.9
*
*
*
*
*
*
0.1
0.3
0.2
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
.7
? ? ? ?
PAGENO="0297"
293
(ratio of cost indexes in 1978 to 1970) to account just for price increases
since 1970. Using the national costs of Table 2 for pollution damage caused
by stationary source fuel combustion, the price index corrected value is 10.6
billion dollars in 1978. This estimate does not take into account possible
expnsion in the number of pollution sources since 1970 or improvements that
might have occurred in pollutant control since 1970. An estimate published
by [PA7 in 1974 shows that damage due to SO2 and particulates amounts to 11.2
billion dollars per year in 1974 dollars (or 14.9 billion dollars in 1978
dollars).
In Table 4 following is a comparison between the environmental and health
effects resulting from the routine operation of coal and nuclear power systems.
These results show substantial costs in both dollars and lives if coal is
substituted for nuclear po~':er systems. These costs should be accounted for
in evaluating the total costs of using fossil fuel systems. Replacing nuclear
power capacity with coal fired systems would cost the lives of about 20 to
100 persons each year over those that would be lest if nuclear generating systems
were used. These additional deaths would continue for the lives of the coal
fired plants, or about 30 years. In addition there would be significant
economic losses if the coal alternative were selected. It is also worth
noting that many of the fatalities and economic losses would occur to persons
who derive no direct benefit from the electric power generated~ i.e., the
pollutants would be carried beyond the service area of the persons using the
electrical power.
7A.L. Dare, `What's a Scrubber', Office of Public Affairs (A-lO7), U.S.
Environmental Protection Agency, Environmental Facts (October 1974).
PAGENO="0298"
294
Table 4: Annual Uealth Effects and Occuoationul Fatalities
and Injuries Resultini from Electric Poster Productron
of 1000 Ole from Coal and Iluclear Fuels
Cateciorv of Effect or Injury
Industrial Injuries (Deaths)
Operations Related Injuries (non-
lethal industrial accidents in all
parts of thu progran)
Pneumoconiosis
(Black Lung Disease)
-HEll Payments to Black Lung Victims
Excess Desths of the Public Due to
Atmosp!:cric 02
Effects due to Acid Rain on
Buildings, Lend, etc.
- Ouclear
12
0.49/year
517 days off/year1°
Coal
3.05 11
100 miners totolly~in-
capacituted at any given
time with 6 new cases!
year
4.46 million dollars!
year 10,i2
20-100 fatalities/year 10
30 million dollaro,'yc:r
year 7,lO,lls
*This ns~;bor includes an allowance for the effect on the public of the low probability
sticicar calamity, meltdown accident, us well as accidents to workers in nuclear power
plents end uranium miners including radiation exposure. Thu majority of these deaths
~ure rinine accidents.
EPA reseerch cited in reference (7) indicates thut sulfur oxides and particulates
cause $11.2 billion psr year in damage. Rose stafes 61 percent of the sulfur effluents
come fret electric power plants.10
11 L.C. Lave and Freeburg, 1.6., `liucleur Safety", Vol. 14, pg. 409 (September-October, 1973).
~ Rose,, `Huclear Eclectic Power', Science, 184, 351-359 (April 19, 1974).
PAGENO="0299"
295
Figure 1 following shows the mortality data from chronic respiratory
disease prepared by the Environmental Protection Agency and used by the National
Academy of Sciences in their 1975 study of fossil fuels.8 The "best judgment'
line neglects (probably properly) early London and Oslo data and forms the
basis of the hAS and EPA mortality estimates. Acid sulfate levels in eastern
U.S. urban areas are 16-19 pg/rn3, which are apparently safe if the best-judgment
line applies strictly and if there is a real threshold at 25 pg/m3, as shown.
Dr. David Rose of MIT in evaluating these results states however, "But few
would feel satisfied to live so close to danger, especially in view of large
uncertainties in the data and of environmental fluctuations. `~ Using Figure 1,
the EPA has estimated that, if the 1975 SO2 standards were all met, the excess
mortality in 1980 owing to SO2 would be very small--in the order of one death,
or less, per power-plant-year. This number is comparable to the nuclear-plant
hazard.
Figure 2 shows an anomaly with respect to suspended sulfates and their
effect on cigarette smokers. In general pollutants will act synergisticaly with
the cigarette smoke to produce enhanc~d disease effects. This is an apparent
exception to that general rule.
Rose observes further, "If, however, the 1975 air standards are not met or
are significantly relaxed, the numbers of deaths climb spectacularly--to about
4,500 in 1980 or some 20 deaths per 1,000 MW coal-fired plant per year. If the
"mathematical best fit" of Figure 1 is assumed to apply instead (a pessimistic
assumption), the 1980 deaths jump to about 100 per plant-year from air-quality
deterioration alone. Such statistics overwhelm the nuclear risks of every kind."
8Air Q~iality and Stationary Source Emission Control, National Academy of Sciences
(1975).
9D.J. Rose, P.1!. Walsh and L.L. Leskovjan, "Nuclear Power Compared to What?"
A~erican Scientist, Vol.64, 291-299.
PAGENO="0300"
296
30 ~ ~r7jr
0 N~w `t'orlz City. t!;GOs
.25 C, L"ndt~n,
A O~tc. 1550,
~ j%1dj~flCflt
20 ,~,:*thcrn;itic.;tt bcst fit
15
0 ___L~__O.0 ~ L~._._L
0 5 10 15 20 25 30 35 40 45
24h oUr~USp~J~th'd sull;~tcs, ~g/n~
Figure 1. The percentage of expected excell mortality owing to acid sulfates
in the air is estimated from suspended particulates and sulfur dioxide levels
in three cities. The mathematical fest fit line is currently considered to
be a pessimistic assumption. (Data from EPA, summarized in Ref. 8.)
250 0'
0 no,n~oScr~ 0 /
200 ~ ,/I
~u1f.,~Im'
Figure 2. The excess chronic respiratory diseasm expected from acid sulfates
has a threshold at 10 pg/rn3 for nonsmokers and 15 ~ for cigarette smokers.
The data is based on studies in five areas and on the pooled results from the
Community Health and Environmental Survefliance System program for 1970-71.
(Data from EPA, summarized in Ref. 8.)
PAGENO="0301"
297
With regard to an analysis similar to that in Table 4 completed by Dr. Rose,1°
he states as follows: `What are we to conclude? The exact numbers are uncertain
but the general trend is clear. Apparently if we continue to burn coal in the
same way as in the past, or aggravate the problem by increasing coal production
and relaxing environmental standards, we are in for a great deal of trouble. The
predicted total excess deaths in 1980 due to this acid sulfate cause alone,
vary from a few--under stringent sulfur-removal conditions--to as much as 4,500
according to one EPA estimate, or as much as about 60,000 according to a different
source. Those numbers translate to about 20 - 100 deaths per year for each
(coal fired) electric power plant--about 20 to 100 times the mortality associated
with all phases of nuclear power, as presently judged. In addition, we find
vast non-fatal health effects.'
An extensive analysis of the total impact of using coal, oil and gas in
comparison with light water nuclear reactor power systems is provided in
WASH-1224.5 This document shows for example that the costs of pollution abate-
ment for coal and oil stations amount to respectively 30 million and 11 million
dollars per year in comparison to a cost of 3-4 million dollars per year for a
light water reactor station of the same size. Total environmental and health
effects of coal plants are noted to be three times more costly than those for
nuclear stations while oil is 1.6 times more costly than nuclear. It should be
noted that these costs do not include public health effects of air borne fossil
Rose, "Nuclear Versus Fossil Fuel Power", Nassachusetts Institute of
Technology, Cambridge, flass. (1975).
PAGENO="0302"
298
pollutants such as SO2~ NOR, particulateS~ trace metals, etc.* Table 4 shows
these latter costs would be very high.
The health effects of nuclear posier systems have been studied in detail
over many years. However the situation with regard to the health effects of
the combustion of fossil fuels is quite different. We have some knowledge of
the consequences of the excessive exposure to the conm~on products of combus-
tion and even some knowledge of effects of exposure to trace elements resulting
from such combustion, but we have not yet, particularly with regard to the
trace elements, been able to define tolerable body burdens for these combustion
products.1 *As a result of this lack of information we cannot accurately predict
the long-term effects of exposure of large populations to combustion products.+
Even short term effects are difficult to define in a consistent manner that
different analysts can agree on. Analysis of daily death figures in the U.S.
suggest to some that 2 to 3 percent of such deaths are a result of air pollutants.
Other analysts using the same data argue that the proper figure is 14 percent
of daily deaths.13
There has been debate concerning the effects of all these pollutants.
Early reports tended to indicate significant health effects. Later these
reports were attacked as exaggerating the consequences of the presence
of these materials in the envirnnment. However more recent reports tend to confire
the existeece of a substantial basis of concern over atmosphericpollutants
(see Chemical Ennineerino News: May 5, 1975, pg. 5; June 9, 1975, pg. 4 and
20; September 1, 1915, pg~TO~ September 29, 1975, pg. 17; and January 26, 1976,
pg. 7).
+Note EPA has moved to curb air pollutants emitted by new copper lead and
zinc sniellers when studies have shown a higher than average numboç of lung
cancer deaths among peOple living near arsenic emitting smelters.'3
13Chemical and Engineering News, pg. 7 (January 26, 1976).
PAGENO="0303"
299
It must also bc noted that the intrusion of. the products of combustion
on our lives is not through the air alone but also through our food and water.
The seepage of trace elements from coal and ash piles, scrubber sludge ponds
and the fallout of airborne particulates into surface and ground waters and
then into the food chain, is recognized as a potential source of degenerative
disease in man.' The effort to quantify the effects is however certainly in
its infancy.
In contrast with this risk in 1975 the American Physical Society published
an independent evaluation of the accident risks in commercial nuclear power
plants.15 This study shows that for the PWR-2 reference accident, in the
words of Dr. Wolfgang Panofsky of the APS study.staff, "As far as an individual
in the exposed population is concerned his risk of dying of cancer would be
increased by 0.1 percent over the normal 20 percent likelihood".16
This last sentence is particularly important. An individual in the
exposed population following an improbable nuclear accident with significant
radiation release (theApS study attributes a probability of one chance in
200,000 reactor years to this accident) the probability of developing cancer
changes by only 0.1 percent over the normal 20 percent cancer incidence statistics
that apply in the U.S. At the same time we simply tolerate a stiuation where
2 to 3 percent to 14 percent of daily deaths in the U.S. are a result of air
pollutants. The fraction of these pollutants due to stationary power plants is
about 32 percent. Therefore, we ignore a situation where fossil fueled
15"Report to the APS by the Study Group on Light Water Reactor Safety", Reviews
of1'odernPivsic~sics, Vol.47, Supplement No. 1 (Summer 1975).
16Lettcr from Wolfgang K. H. Panofsky to Congressman Norris K. Udall (Nay 9, 1975).
PAGENO="0304"
300
power plants routinely produce from about 1 percent to 4.5 percent of daily
deaths, a figure 10 times greater than the result of the improbable nuclear
accident.
As noted earlier an important recent study of the relative health and
safety risks of nuclear power was provided by the 1977 Ford-Mitre Nuclear
Energy Policy Study Group. This study examined all aspects of the health
impacts of nuclear power including mining, milling, mill tailings, transportation,
conversion and fabrication, normal reactor operation, impact of core melt
accidents, reprocessing and recycling of uranium and plutonium and finally
waste management. Taking the most pessimestic view of routine reactor operation
would produce 1.0 expected deaths per reactor Year. Taking the most pessimistic
view of the probabilities and consequences of nuclear power plant mel~ down
accidents would be about 10 fatalities per reactor year for a 1000 MWe power
plant. But here and I quote from the report, "It is significant that even under
such extreme assumptions, the fatalities are less than the high end of the
range of estimated deaths associated with coal-fired power plants, discussed
below. As the discussion in Chapter 7 stresses, this is not a prediction but
a limit to which no probability is attached. It is used solely to give an upper
bound on the range of estimates that are possible.
"A further important consideration arises if the estimate of health risk
is to be used not as an index of present performance of nuclear power plants
but as a guide to making a future choice between nuclear and coal or other
energy sources for electricity generation. The central average rate-of-loss
estimate in WASH-l400 of 0.023 fatalities per reactor year derives largely from
about 10 percent of the 100 reactors surveyed. Indeed, more than half its value
is probably contributed by only a few reactors whose location with respect to
dense populations is such that certain weather conditions at the time of
PAGENO="0305"
301
accident could expose very large populations and thereby lead to unusually
large numbers of presumptive fatalities. Thus, to the extent that reactors could
be located at less potentially risky sites, the average rate-of-loss risk for a
particular new reactor could be lowered by a factor of 10 to 100. Therefore,
even the higher risk probabilities that could possibly enlarge the WASH-l400
values upward toward an average rate-of-loss of 10 latent cancer deaths per
reactor year could be reduced by prudent site selection to average values
that are low relative to other contributions of the nuclear fuel cycle.'
With respect to coal the Ford-Mitre report states as follows:
`For new coal-fired plants meeting new source standards, this
analysis indicates a range of premature deaths from occupational and
public effects of the coal fuel cycle and the effluents of coal
combustion in the range of two to twenty-five per year for a 1,000
MWe plant. These numbers could be reduced by the use of lime
scrubbers alone or in conjunction with low-sulfur coal or by
the use of other new technology, such as fluidized bed combustion.
Despite these large uncertainties, the general conclusion is that
on the average new coal-fueled power plants meeting new source
standards will probably e~act a considerably higher cost in life and
health than new nuclear plants. However, both coal and nuclear
power plants built in the rest of this century could have m~ich reduced
health risks relative to existing plants. This can be accomplished
in the case of coal plants by limiting sulfur dioxide and other
emissions in conformity with present or improved air quality standards
and by prudent siting; and, in the case of nuclear power plants, by
improved siting and safety controls. In the im;nediate future, a
major effort should be made to improve the assessments of the health
48~721 a 79 20
PAGENO="0306"
302
effects of the pollutants from coal combustion. The most pressing
demand, however, would appear to lie in upgrading the research
end develop~iient directed at the reduction of the adverse health
effects associated with coal-fueled power plants.'
Van Horn and Wilson of the Harvard University Energy and Environmental
Policy Center have examined the relative effects of coal and nuclear from
the point of view of estimated past impacts. This analysis therefore does not
include any allowance for a nuclear accident that would affect the public. There
just haven't been any accidents of this type.~7
Table 5 following presents the results of Van Horn and Wilson. These
results are based on the generation of 750 x 106 Tlwh of electric power by
nuclear power plants operating in the period from 1967 to 1976. The health
impact of this nuclear generated power is evaluated and compared with what
impacts would be calculated to have occurred if the nuclear generated power had
been replaced by a mix of natural gas, coal and oil fired electricgeflerating
plants. The power was proportioned between the different types of fossil plants
based on the fraction of electric power generated by each type of plant
nationally. Again a very significant coal impact is noted compared to nuclear.
Van Horn and Wilson state as follows with resr.ect to the figures in Table
5:
`In su;woary, largely because of wide dispersal of sulfates,
the air pollution fatalities for fossil fuels given in Table 1 are
an underestimate by about a factor of three. Consequently, the
additional deaths which would have resulted in the United States
17A. Van Horn and R. Wilson, "Will the Past be Prologue?" E~jc~~.1li~i55.
L~j°~.1~ February 3, 1977, pp. 43-45.
PAGENO="0307"
TABLE 5
ESTIMATED U.S. FATALITIES FROM 750 MEGAWATT-HOURS
ELECTRIC POWER GENERATION (1967-December, 1976)17
Replacement Fuel Nix
18"The Health and Environmental Effects of Electricity Generation', Biomedical and Environmental Assessment Group,
B~L report 20582 (1974).
19L.D. Hamilton, "Health Effects of Air Pollution", BNL report 80743 (July 1975).
Wilson and W. Jones, ~y~Eco1ooyan(ithe Environment, i~cade;~iic Press, New York (1974).
Natural Gas Fired
(180x106 Mwh)
2.5
0.25
0.6
(- )
3.5
0.119
Fatalities
Extraction
Transport
Processing
Transport
Electrical Generation
(air polution)
Waste Disposal
Total Fatalities
(referenceslB'l9)
Total Per Year
Per `1000 MWe Plant
Total 20
(reference
Coal Fired
(420xl06 Mwh)
60- 500
(2 )+( 620)
62-1 90
185-6,200
(640)
940-7,500
13.7-109
Oil Fired
(l5OxlO6 Mwh)
2.0
1.1
23+(l80-2,500)
1.1
23-2,250
45-2,250
1.84-91.9
Total Replacement
Fossil Fuels
(750xl06 Mwh)
52-500
25
62-190
210-8, 500
(640)
1,000-10,000
11,300
Total
Nuclear Fuels
(750xl06 Mwh)
11-31
57
11-91
80-189
0.654-1 .54
PAGENO="0308"
304
from replacing nuclear power by fossil fuel electricity generation up
to December, 1976, is in the range of 1,900 to 27,500 deaths, and a
little more than twice this worldwide. The low-fatality figure is for
exclusive replacement by the lowest sulfur fuels and the high figure is
for high-sulfur fuels. If we assume the epidemiology of air pollution
is roughly correct, the actual sulfur content of fossil fuels burned
in existing power plants indicates that the number of fatalities is likely
to have been in the upper half of this range. In 1975 alone, the
estimated excess deaths would have been between 400 and 6,000. The
numbers we have quoted are only for mortality and do not include
morbidity."
With respect to morbidity the USEPA reports that the numbers for air pollution
morbidity are five times the mortality figures.21
In 1976 the House of Delegates of the American Medical Association requested
an evaluation of the health hazards of nuclear fossil and alternative energy
generating sources.22These evaluations were to include effects on both employees
in generating plants and to the general population. A summary report was
released in June 1978.
The report observes that despite varying degrees of difficulty, quantitative
assessments havebeen made of the mortality-morbidity associated with each of the
fuel cycle components. The report draws on some thirteen supporting documents
to arrive at its conclusions.
The results of the study are summarized in Tables 6 to 10. The data in
Table 6 reflect the deaths and injuries in coal mining, including coa~
21'Wealth Consequences of Sulphur Oxides: CHESS report 1970-71", USEPA,
EPA-650/l-74-004, (May 1974).
Evaluation of Energy Generating Sources", Report of the AMA Council
on Scientific Affairs; AMA House of Delegates, June 21, 1978.
PAGENO="0309"
305
* worters pheumoconiosis, train accidents and the mortality and morbidity of air
pollution from coal fired generating plants. Similarly Table 7 includes
estimates of deaths and injuries in uranium mining as well as fractional death
and morbidity estimates for the other components of the nuclear fuel cycle. It
does not include estimates of the effects of a catastrophic nuclear accident.
The AMA report states, "On the basis of these tabulations, a coal-fired
power plant each year results in from 48 to 285 times more deaths than does
an equivalent nuclear power generating station, 2-3 times more than an oil-fired
plant and 36-1120 times more than one fueled by natural gas."
If the upper limit of the nuclear statistics in Table 8 is augmented by
the upper limit of 10 deaths for the catostrophic nuclear accident from the
Ford-Mitre report~ the upper limit of the death impact of coal is still 28
times higher (a ratio of 314 to 11.1) than that for nuclear. Again we see a
very severe relative impact from the routine use of coal fired plants.
The AMA report states as follows:
"In summary, this brief report provides a range of estimates of the
occupational and non-occupational health effects of several predominant
modes of electric power production. It appears that cod end nuclear
power will be the principal fuels for electric po~:er production in the
next 25 years. At the present time, coal has much greater adverse impact
on health than does nuclearpower production, and efforts need to be directed
toward reducing both the health and adverse environmental impacts of all
forms of energy production."
Much concern of course exists regarding the catastrophic nuclear accident.
But at the same time there is significant and growing concern in scientific
PAGENO="0310"
306
TABLE 6: EST1NATES OF HEALTH EFFECTS OF COAL
Occupati onal
Occupational Injuries and
Deaths* Disease*
.45 - 1.24 22. - 80.
0.00 - 4.8 0.6 - 48.
.055 - 1.9 .33 - 23.
.02 - .05 2.6 - 3.1
.01 - .03 0.9 - 1.5
Procedure
EXTRACT I ON
Accidents
Disease
TRANSPORT
Acci dents
PROCESSING
Acci dents
POWER
GENER.4T1 ON
Air
Polution
TO T A L
FUEL CYCLE22
Non-occupati onal
Deaths*
.55 - 1.3
1. - 10.
.067 - 295.
.54 - 8.0
26. - 156.
1.62 - 306.
*Per 1000-NWe per year
PAGENO="0311"
307
TABLE 7: ESTIMATES OF HEALTH EFFECTS OF NUCLEAR FUEL CYCLE22
Procedure
EXTRACTION
Accidents
Disease
TRANS PORT
Accidents
PROCESSING
Accidents
Disease
POWER
LENERAT ION
Accidents
Disease
TOTAL
Occupational
Dea ths*
.005 - 0.2
.002 - 0.1
.002 - .005
.003 - 0.2
.013 - 0.33
.01
0.00 - 0.1
Occupational
Injuries and
Disease*
1.8 - 10.0
.045 - 0.14
0.6 - 1.5
1.3
Non-occupa ti onal
Dea ths *
.01 - .16
.035 - .945
3.7 - 13.
.01 - .16
*pCr 1000-MWe per year
PAGENO="0312"
TABLE 8: COMPARiSON OF HEALTH EFFECTS OF ALTERNATIVE FUELCYCLES
FOR ELECTRIC POWER PRODUCTION*22
EFFECT
COAL
OIL
Occupational deaths
0.54 - 8.0
0.14 - 1.3
~on-Occupationa1 deaths
1.62 - 306.
1. - 100.
Total deaths
2.16 - 314.
1.1 - 101.
Occupational impairments
26. - 156.
12. 94.
NATURAL GAS
NUCLEAR
0.06
-
0.28
0.035 -
0.945
---
0.01 -
0.16
0.06
-
0.28
0.045 -
1.1
4.
- 94.
4. -
13.
~èr 1000-MWe
PAGENO="0313"
TABLE 9: CONPAR1SOW OF HEALTh EFFECTS FOR ALTERNATIVE FUEL CYCLES
- -*- **-*-----** FOR ELECTRIC POWER PRODUCTION IN U.S. IN 197522
- Fuel
Coal
Oil
1975
KWhe x 1O9
844
292
297
168
Occup.
69. - 1024
6. - 57
45 3. - 13
26 0.9- 25
Estimated Occup.
Impairments
3330 - 20000
530 - 4100
180 - 1030
100 - 340
TOTAL
1601 243
79. - 1119
251 - 43572
4140 - 25000
Equivalent No.
of 1000-~We Plants
128
.44
Gas
~uc1ear
Estimated Deaths
_______ Non - 0CC U p.
207. - 39168
44. - 4400
0.3- 4
0
PAGENO="0314"
310
TABLE 10: EKHANCED RISK OFDEATH PER YEAR
FR0~I ELECTRICITY PRODUCTIOU*22
NORNAL RISK ENHANCED RISK OF DEATH PER YEAR**
AGE OF DEATH/YR. Coal & Oil Nuclear
10 1 in 3800 1.38 in 3800 1.0008 in 3800
25 1 in 700 1.07 in 700 1.0001 in 700
45 1 in 200 1.02 in 200 1.00004 in 200
65 1 in 40 1.004 in 40 1.000008 in 40
All ages 1 in 100 1.01 in 100 1.00002 in 100
~ and Segan~
**Risk of death per year from natural gas as fuel for electric power production
is equivalent to the normal risk (column 2)
~C.L. Cower and L.A. Sagan, "Health Effects on Energy Produ~ticn end
Conservation', Annual Review of Enero~, ~ PP. 581-600 (1516).
PAGENO="0315"
311
circles that tic increasing use of fossil fuels can produce a world wide
catastrophy. The J\t'J~ report states as follows:
The ~ong-terrn effects of carbon dioxide production from
combustion of fossil fuel have not been considered here. Each 1000 flWe
coal plant discharges 7.5 to 10.5 million tons of CO2 per year to the
atmosphere end the load from hundreds of fossil fuel plants nay be
greater tin the atmosphere and the oceans can absorb. Predictions
have been made of increased global atmospheric temperatures that might
eventually result in drastic changes in climate with unanticipated
health. effectS."23
An excellent review of the CO2 problem was provided by Chemical and Engineer-
ing News in Oct.nier 1977 (See Figure 3 )~24 The data indicate that the CO2
concentration j~ definitely increasing but what the effects will be is still
in question. fact that they are in question of course argues we should be
cautious and pmmmdeflt.
A rather toned consensus therefore exists that coal produces a generally
greater environmental impact than nuciear power.
`No mattel mOW you look at it, said John O'Leary, administrator of the
Federal Energy /\,iininistratiOn and the ran who will direct coal conversions for
President Cartel', a coal-fired power plant is more hazardous to health than a
nuclear fired imnt."25
This consn;us also indicates that the uncertainties about the effects of
coal are large ,mnd possibly we are in our present efforts at controlling the
health effects of coal not attacking the most significant problems at all.
~R.L.Got:hy. "Health Effects Attributable to Coal and Nuclear Fuel Cycle
Alternative'" * NtIREG0332 (1977).
~4W. Lepkowskl. "Carbon Dioxide: A Problem of Producing Usable Data", Chcm.
En. News (il ober 17, 1977).
The Washingt'll Post (ilonday, June 6, 1977).
PAGENO="0316"
PARTS OF ATMOSPHERIC CO2
PER MILLION PARTS OF AIR
330
320
310
1950 1960 1970 1980 1860 1900
1950 2000 YEAR
Year
Year
Ch~nge in Atmospheric CO2 Leve]s with Time.
Figure 3.
PAGENO="0317"
313
ill. WhereAreWeGoinqinControll~gCoal_Pollutants
The problems of air pollution from fossil fuels in general but coal in
particular we have believed in the past to be problems of particulates end
sulfur dioxide gas and sulfate sols. The problem of man made particulates
dates back to the beginning of the industrial revolution. In 1307 the King
of England issued a proclairnation against the use of coal. The proclaimation
in part stating as follows:
"--we have learned that, whereas previously the makers of kilns in the
aforesaid city and village and their neighbourhood were in the habit of using
brush-wood or charcoal for their kilns, they are now again, contrary to their
usual practice, firing them with and constructing them of sea-coal, from which
is emitted so powerful and unbearable a stench that, as it spreads throughout
the neighbourhood, the air there is polluted over a wide area, to the con-
siderable annoyance of the said prelates, magnates, citizens and others
* dwelling there, and to the detriment of their bodily health."
As industrialization grew so did the levels of pollution from fossil
fuel use. By the 1900's this pollution became a major national problem in
the industrialized nations of the world.
Today the situation is both better and worse than it was in 1900.
Beginning in the 1950's many industries switched from using coal to the
clean-burning fossil fuels, oil and natural gas. In many places they were
cheaper than coal, easier to handle and clean. Also the use of electrostatic
precipitators, cyclone filters, bag houses and scrubbers were introduced.. On
the other hand however the worldwhs continuing to industrialize end thus the
world ride burden of pollutants is increasing and it is becoming obvious that
the pollution does not have to be produced next door to produce a decay in
the quality of the local environment. Glacial ice samples in Greenland have
yielded lead particles presumably from auto emissions in North America. Lakes
in linnesota and on the Canadian side of the border as well as in upstate
New York are becoming increasingly acid due to airborne sulfates formed across
the tJnited States. The Norwegians are concerned over industrial emissions from
great liritian and Western Europe that have lowered the ph in Norwegian stre.:ns to
the ~n~nt they will no longer permit the rainbow trout to breed that these wairs
were once famous for. [he :resent hiqh costs of oil and gas and their likely fLst~re
PAGENO="0318"
314
shortage in the U.S. ore also forcing us to turn away from these fuels and
attempt to burn what are essentially dirty fuels if possible in a clean manner.
Thus we face a future with probable increasing levels of air pollution and
secondary water pollution. At the same time there are growing questions about
exactly what pollutants are producing health affects and what the mechanisms
of these effects are.
Flue gas scrubbers have been developed that willof course reduce the
level of SO2 below what it would be otherwise but these systems still are
technically flawed. As Chemical and Engineering News reports in a recent
26
review:
Whatever else may be said of utilities' switching to coal
from oil and gas, there is still only moderate enthusiasm over the
ways and means of controlling sulfur dioxide emissions from boilers
and other combustors. Scrubbers currently are the most popular way,
but by legislation and economics they seemingly have been all but
forced into a service for which they may not be at all suited.
The original scrubbing systems were based on calcium hydroxide!
calcium carbonate slurries to absorb thm sulfur dioxide. Reaction in
the slurries yields calcium sulfate precipitate. The precipitate is
difficult to handle, causes maintenance problems because of the
tendency to plug lines and fittings, and the sludge is difficult to
dispose of. Some sodium-based processes have been developed in the
laboratory that show poter~tial. Wagnesium oxide wet systems and some
other dry systems also are under investigation, but the present
technology is dominated by the calcium systems.
2~N~'wScrtbber5 Tackle SO2 [missions Problem', Chem. Engr. Ne, Nov. 6, pg.
24, (1978).
PAGENO="0319"
315
`About 90~ of all the systenis in place are based on calcium absorb-
ents. At least 10 vendors offer systems. As difficult as they may be
to operate, the sldrry systems are generally regarded as the best proven
technology."
In a recent state of the art report in the utility industry magazine,
Combustion, a report of actual scrubber performance shows that as flue gas flow
rate increases the SO2 removal rate drops from 73 percent to 60 percent or
lower.27 Also the particulate removal rate averages below 99 percent which
means that per 1000 Ule plant more than 6,500 tons per year of particulates are
escaping and in fact these may be the most dangerous particulates because they
fall in the respirable size range, i.e., they will be drawn into the lungs and
some will be retained there.
Another question has risen about scrubbers. This concerns the disposal
of the scrubber .yprod.uct sludge. As a recent article notes:28
`The removal of SO2 and particulates from flue gas converts
an air pollutant to a solid waste. In particular, utilities are faced
with the treatment and disposal of these wastes. It has bean predicted
that 45 million metric tons/v~ar (50 million short tons/year) of fly
ash and 24 million metric tons/year (26 million short tons/year) of
Flue Gas Desulfurizatjor (FGD) sludge will be generated during 1980-1985.
Land disposing this material represents tr.e least expensive and most
popular means of removal
"Although pumping raw sludge to ponds appears attractive, upon
examination the material would utilize approximately 2.5 x l0~
27K. Green, L. Conrad, J.R. Martin and MM. Kinqston, "Commitment to Air Quality
Control", Combustion, 50, pp. 12-18 (October 1978).
Goodwin and R. J. Gleason, `Options for Treating and Disposing of
Scrubber Sludge", Coambust ion, 50, pp. 37-41.
PAGENO="0320"
316
to 7.4 x ~ m3/year (2-6 x ~ Acre-foot/year) duripy 10801935.
Furthermore, EPA's present position on land disposal, as stated by
former EPA administrator Train, is, "EPA considers permanent land
disposal of raw sludge to be environmentally unsound"."
Scrubber sludge in addition tp its cumulative large volume has other problems.
Thematerial does not settle out of the water used to entrain it to settling
ponds. Thus, ponds that were supposed to be useful for the 30 to 40 year
lives of power plants may only be useful for 25 percent or less of that life
unless some very strong measures are taken. Such measures include vacuum
filtration of the sludge. This would add a cost of $2.16 per metric ton of
sludge or a cost of $97.2 million dollars per year to the costs of rate payers
if 45 million metric tons of sludge are produced nationally per year.
Finally there are problems with sludge disposal. The sludge contains
portions of the trace elements that were present in the original coal. Some
of these are now in a solubleor other transportable form that will remit them t.n
enter the biosphere. Water percolating out of sludge disposal conds will carry
this material into the ground water and then potentially into drinking water supplies,
Because of this growing problem the Envi~onrcmntal Protection Agency is
preparing regulations on sc~ubber sludge disposal. The following inforo'ation
was reported in the August 1978 issue of, Electric Liqht and Power: 29
`The Environmental Protection Agency is planning to crack down
on disposal of sludges generated by flue gas sulfur scrubbers. Right
now there are no federal regulations governing sludge disposal and
most utilities merelypond or landfill untreated sludge.'
"The first move may come this surmner~ warns EPA chemical engineer,
Julian Jones, with publication of federal regulations under the
29 EPA Readies Regulations on Scrubber Sludge Disposal", Electric_Li ~
Power, pp. 29-32 (August 1978).
PAGENO="0321"
317.
Resource Conservution & R[co~'ery Act of 1976. The law requires
EFA to regulate cnission of hazaidoi substances not covered by ~zitcr
pollution control legislation. `At this point,' says Jones, `flue gas
desulfurization waste and fly ash as yet have not been declared hazardous,
but they're both suspect." An evaluation from the Office of Solid
Waste is due this fall."
`[PA has a dozen research projects underway to measure the dangers
posed by scrubber sludges and to evaluate control techniques. Tests
at the Shawnee station of TVA have already shown that leachate from
deposits of untreated scrubber sludges have concentrations of disolved
solids that violate drinking water standards.
`The agency feels that strict standards are needed because of the
booming growth in coal-fired generating ca~acity projected for the
next decade and the associated increase in sulfur scrubbers and sludge.
Capacity with scrubbers will climb from the current 10,000 11W to
55,000 lW by the mid-80's. By then, 30 million tons of scrubber waste
will be produced every year with more than 60 million tons of fly ash,
according to Jones.
`There is little potential for converting scrubber sludge into
useful products, says the [PA engineer, so it has to be dumped somewhere.
a few utilities are able to put it into empty mines and some coastal
utilities are interested in ocean dumping, he adds, but most of the
sludge will have to go into conventional landfills or ponds. The
problem facing EPA, says Jones is to develop rules to make sure that
sludge dumping is environmentally, acceptable."
48-721 0 - 79 - 21
PAGENO="0322"
318
TEe Electric Po~:cr Research Institute states as ollo~:s with respect to
sluclije wastes:
There is industry concern that power plant wastes may be classi-
ffcdas hazardous under these tests; if the regulations and the tests
become final early next year, the cost of disposing of any hazardous
utility solid waste might reach $90 a ton. For an industry that
churns out 60 million tons of waste a year, the implications are in the
multibillion-dollar range. As Kurt Yeager, director of EPRI's Fossil
Fuel~Power Plants Department, explains, if all utility wastes are
declared hazardous, disposal costs under draft regulations could nearly
equal utility fuel costs.'3°
Whifë~there have bean no catastrophic nuclear power accidents there have been
catastrophic incidents stemming from the burning of fossil fuels. In October 1948 a
pall of pollution settled over Donora, Pennsylvania. Before it lifted twenty
people were dead and 6000 were ill. Almost half of Donora's population, 43E, c:ere
stricken. In London in 1952 a similar event occurred and in this case thousands
died and many thousands were riade ill. How can we ignore such events. Other
similar deadly events occurred again in London and also Oslo Norway.
In each of these cases the culprit was a combination of combustion gases and
Earticuistas; a~domhination we call smog or in scientific to-ms an aerosol. Those
s:;all particles (0.2 rn or smaller) that bypass scrubEors or electrostatic
precipitators and the volatile gases that are unaffected er ~ pass both types
of devices are the problem. The problem does not yet have a solution because
the technology that may he applicable is just beginning to he developed.
30'Disposal and Deyond," [Pill Journal, 3, pp. 36-41 (1973).
PAGENO="0323"
319
Table 11 presents data on particle sizes and concentration of elements
found in air samples taken in the vicinity ol the University of Missourj-Coltjnibja
power plant.31 It should be noted that a number of elements classified as
carcinoginic or toxic are present and the concentrations on particles of a
respirable size are large. The health impacts of the deposition of particles
of these sizes with these concentratio'ns of trace elements remains to be
deternii nod.
An element that epitomizes the question marks that exist with respect
to heavy metal air pollution is arsenic. Arsenic is of course recognized by
many to be toxic and at the same time there, is evidence it may be an essential
trace element in man and other animals. However, ttm preponderance of clinical
and epidemiologic studies indicates arsenic is a human carcinogen. Arsenic is
a component of coal and recent measurements indicate that man made air pollution
is the prirary source of arsenic in the air.32
* In the evaluations presented in Table 11 no attempt was made to determine
the presence of organic materials that may have been present in the stack gas
effluent. It is known that traces of the carcinogenic agent. benzo(a)pyrene
are present as are dioxins (including PCB's). The health inpact of this class of co.:-
pounds is yet to be determined. Mso present are small annunts of radioactive natei'~.~
including uranium, thorium and their radio decay products. Although the amounts
of these radioactive materials are small the estimated amounts are from 50
purcant igher to several times higher for ~he reference coal plant compared
to the reference nuclear plants.32
L. Reed, Seleniu:a Airborne Particle Emissions From Coal Fired Electric
Generating Plants, A Masters Thesis, University of Missouri-Columbia (August 1978).
32'Pollution Main Source of Arsenic in the Air, Chem. Engr. News, pg. 19
(November 27, 1970).
33J.P. flcRride, R.E. Moore, J.P. Witherspoon and RE. Blanco, `Radiological
Impact of Airborne [f fluents of Coal and Nuclear Plant~", Science, 202,
1045-1050 (December 1978).
PAGENO="0324"
TABLE 11.
MULTIPLE £LEME~T CONTEIT AND COSCENTRATIOI PER CASCADE IMPACTOR STAGE
S~~'.GE
~
Y A~
~39
7~ p.~
TI
5~
2,336 ppm
Dr
49~
13 ppm
Mg~
i?~5j
6,319 pPm
13
[ 4,006 ~pm
MnIC1
JLp_7Li~~9.L
453 ppm~ 2,411 ppm
Ca As
~
T2TTh&O p:m 11 ppm
Zn Sb
~
~ ~
C~
~_
~-
2
7~ r~ 29
~ pp- 33~L5~ ppr~
3m
2,542 ppm
7i7r"~
659 ~
14mm1
85 ppm
&~j~
4,23/ ppm
523 ppm I 3415 ppm
1~Ia1L.
142,3i0 ppm
35L~_
25 ppm
473r
933 pm
[ 3.5
~
77 -~
~-
3 ~_2' ~2~a -
2,~2_p;1 2,941 ppm 265 ppm 3m/i ppm
23 `; B ~~07
- ~: 27,539 ppm 2,242 ppm mO//S ppm
~i9n: ~ ~Ln3~ ~J~9
56 D9~ 1,111 ppm ~-2,PC3 ppm 1,930 ppm mlO.003 ppm
5,14/ ppm 1140_ppm
Liss._
3,9/1 ppm
1/0,530 ppm
1~_
29 pm:
~.QLo~
T~i2 ppm
::-
6,900 ppm
~L3 ~
7,222 ppm
21~
736 ppm
~Lao
4/2 ppm
L5~_
5,1/2 ppm
5,000 ppm
24u~
02,/sO ppm
~
22,203 pmm 1
12r: 392rm
41 ppm 1,352 ppm
L~o~ ~
~0 ppm 1,396 ppm
~m
20.: p,-
34 p:-
~-
i~:
pm-
~2'~_____
[~ cv-,
~
73 p~m
1 1 `-0.1 m~J ~1
3,573 P;m[~3O ppm T»=46 ppm
0.6~m L3~ -~-~--
7t23 ppm `~430 ppm 1,060 ppm
ml ,lmS ppm
~
m3,030 p~;n
3,24 ppm 235 ppm
JLOS
3,333 ppm 203 ppm
P~L~~_ ~~L32_
2,500 ppm ~/ ,000 ppm
~
3,000 ppm j ~3,300 pp
~5~_
57 ppm
L_o.s_
90 ppm
370 n:
,3Z2~p
615 r:
7~5O~pm
IC.5 --
-~ pp~
17
~ip,T
I
T~
-:
s~
,,
l_
26 mm
~
1 -c
`lliJ P?1
~.O.2 mm
2i~ P31
j2,613 mm
311I P
ml.Gum
`\` 300 11
4.7 my
mCOU PP
90~ 10.0 y~_
TO/ ppm 1iT 00 PP
m3p
j~3 bOO P
33~_
43 -
757 mm
27 mm
913 - j Z
-
PAGENO="0325"
321
IV. Su;:wry
The large scale cc:nbustion of fossil fuels for energy production has
been common practice in the industrialized nations of the world for ouny years.
The by-products of that combustion, soot, smog and ashus are accepted as a
problem but at a nuisance level. We know that the by products of combustion
are harmful but we accept them to a large degree because we are simply used
to the probles; we believe we can tolerate the situation. The evidence
presented bore however shows that this nuisance has on a number of occasions
caused catastrophic single events but more importantly it exacts a continuing
significant daily toll of death, disease and property damage and we have yet to
develop the technological tools to deal effectively with the problem.
Comparisons have been provided to show the relative isipacts of the use
of coal and nuclear power. A well supported scientific concensus exists
ttst shows coal under the best circumstances is only conpetitive with light
inter nuclevr po~:er systems in health effects but in general including allo~:anco
for tie catostrcphic nuclear plant accident, coal fired power stations produce
sigsificartly greater negative health ir.ipacts than do nuclear plants of the same size.
Jt is likely that technology to lessen the health iwpacts of coal and nuc~:ar
power systews will he further developed in the future. But the technology
required is significantly more advanced in the case of the nuclear system with
the development of improved coal systems having to wait upon the identificatior
of the most significant polluting agents and the c~eans of their control.
PAGENO="0326"
322
STATEMENT ON
"NUCLEAR POWER PLANT
SAFETY AND RELIABILITY"
TO THE
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
COMMITTEE ON SCIENCE AND TECHNOLOGY
UNITED STATES HOUSE OF REPRESENTATIVES
BY
HILTON U. BRC~N, III
CHAIRMAN, ENERGY COMMITTEE
INSTITUTE OF ELECTRICAL AND ELECTRONICS ENGINEERS
Institute of Electrical and Electronics Engineers
2029 K Street, N.W.
Washington, D.C. 20006
202-785-0017
PAGENO="0327"
323
The Energy Committee of the Institute of Electrical and Electronics
Engineers (IEEE) appreciates this opportunity to submit its views to the
House Science and Technology Committee Subcommittee on Energy Research and
Production on the issue of the safety and reliability of nuclear power plants.
As you know, the IEEE has long been on record in support of nuclear power.
At the present time about 30% of our nation's fuel consumption is for the
purpose of producing electr.ical energy. By 1990 this proportion is expected
tobe 37% and to increase to 50% by the year 2000. If the electrical energy
produced by nuclear power plants in 1978 had been supplied by oil fired
stations, an additional 470 million barrels of oil would have been required,
increasing our 1978 oil imports by about 12%. This would have increased our
imbalance in foreign trade by over $5 billion. By 1985 the additional imports
which would be needed to replace nuclear power are expected to almost triple.
The economic penalty without nuclear power is a vital concern to ct%r nation
and must be evaluated along with the risks.
On May 12, 1979, the IEEE Energy Committee convened a meeting of members
with professional backgrounds in the design, manufacture, construction, and
operation of nuclear facilities. The purpose of this group was to identify
safety and reliability issues which should be addressed. The issues iden-
tified and developed do not constitute a comprehensive view of the safety
and reliability aspects of nuclear power, but they do summarize the views
within their area of competence of a group of professional persons deeply
involved in continuing the safe and reliable development of nuclear power.
INSTITUTIONAL PROBLEMS
The regulatory environment in which the United States nuclear power
industry operates generates an adversary relationship between the regulated
and the various regulatory agencies. These adversary relationships have
occasionally inhibited the incorporation of safety designs recognized as
having potential for improving public protection. Safety issues might be
better served by a less adversarial role, possibly patterned after NASA.
It does not automatically follow that technical cooperation to improve
design compromises the integrity of the regulatory agency. The relationship
between the regulatory bodies and the various components of the nuclear
power industry is an economic, health, safety and reliability- issue which
should be addressed. We strongly recommend the identification of an office
within the Nuclear Regulatory Commission in which issues concering the safe
and reliable operation of Nuclear Power plants can be addressed in an
atmosphere of cooperation between the government and industry, rather than
under the adversarial relationship which currently exists.
THE REGULATOR' S ROLE IN OPERATIONAL MANAGEMENT
The relationship between the owner/operator of a nuclear power plant
and the regulatory agencies is an issue which needs clarification. The
PAGENO="0328"
324
owner/operator's responsibility for, and authority to carry out the normal
operations, mAintenance., testing, staffing, training, and operational plan-
ning should not be abridged. The responsibility of the regulatory agencies
in overseeing the operation and insuring compliance with the appropriate
safety standards must be more clearly defined. Overlapping and conflicting
regulatory review should be eliminated, as it leads to confused responsibility
and inefficient opera~tion, as well as unnecessarily diverting resources away
from the most effective application of the "defense in depth" philosophy
on which nuclear power plant safety is based. We urge that the current reg-
ulatory structure be reviewed in an effort to tailor its requirements to the
most cost effective fulfillment of our nuclear safety needs.
TEE REGULATOR' S ROLE IN INCIDENT MkMAGEMENT
For this purpose, an incident is defined as a situation in which plant
safety limits have been exceeded, or where the plant operator judges that
the limits are likely to be exceeded, or where the maximum permissible re-
lease of radioactivity has been exceeded. Incident management must address
four interrelated requirements: (1) Data gathering; (2) Decision making
(3) Information dissemination; (4) Assuring implementation of decision.
Data Gathering requires that proper instrumentation exists and that it
remains functioning during an incident to provide adequate information for
decision making. The actions required to assure adequate data gathering
include identification of the necessary data, procuring or developing the
equipment required to collect this data and qualifying such equipment for
accident environments and post-incident conditions. We strongly urge in-
creased R&D funding by both the government and the private sector toward
developing more reliable instrumentation to assure the proper evaluation of
necessary data during the earliest stages of an incident.
Decision Making under emergency conditions requires that proper re-
sponsibility and authority for decisions be clearly recognized. This
in turn requires that affected bodies (utility, NRC, public, etc.) are
coordinated through good planning prior to the incident.
Each of the involved bodies (utilities, NRC, state and local officials,
public information officers, etc.) must understand the decision areas for
which they are responsible, and the manner in which they are to coordinate
their action with the other involved bodies. We strongly recommend appropriate
planning with the full participation of each of the responsible groups,
with responsibility for determining the adequacy of this planning fully
defined.
Information Dissemination requires that a central and adequate spokes-
man be utilized. The public as well as personnel involved in the incident
must be kept informed. Different levels of information are required for
different users, however, all information released must be as accurate and
consistent as possible.
PAGENO="0329"
325
In incident situations the role of the NRC as direct technical advisor
to state officials should be clarified. An approved emergency plan should
serve as the basis for -action by state and local officials. The NRC should
advise in the continuation or modification of the plan.
- The authority and responsibility of the NRC in the review and approval
of strategy proposed by plant management during the course of the incident
and until the plant is restored to normal operation or is in a cold shut-
down condition is a major issue.
Assuring ~plementation of Decisions is vital to incident management.
Those groups or individuals making decisions must have the authority to
assure that they are implemented. Since civil authorities have the power
to implement evacuation, for instance, they must be included in the planned
decision making process.
HUMAN FACTORS
The human is the vital link in the design, maintenance, and safe op-
eration of a nuclear plant. To reduce the potential for incidents caused
or worsened by human factors the adequacy of information systems available
to the operator, together with the adequacy of operational procedures should
be the subject of continuous review. The degree of plant automation needs
to be reviewed to determine the best balance between automatic control and
human decision-making. Attention should be focused on the adequacy of initial
operator training and certification. Equipment in a power plant is continually
modified, and operational procedures are continuously updated, and there is
therefore a need for continuing operator retraining and requalification.
DESIGN CRITERIA AND DESIGN BASIS FOR SAFETY SYSTEMS
The major components of nuclear plants are themselves complex systems.
The interactions between these components is a factor in the performance of
safety systems. The adequacy and appropriateness of the design criteria
and design basis for nuclear power plant safety systems, taking account of
these interactions, is an issue which should be reexamined.
Many of the safety features of a nuclear power plant are designed to
deal with the maximum credible accident. Accidents of much greater prob-
ability hut with a much lower potential for endangering the public are not
adequately dealt with, and could result in releases of radioactivity. We
recommend Systems Engineering studies to identify scenarios which might
present a hazzard to the public, including the combined effects of operator
error and mechanical failure, which may be a better criteria and basis for
safety design. The scenarios developed should identify the need for addi-
tional accurate, unambiguous and reliable instrumentation. They may also
identify requirements for the more automatic processing and presentation of
PAGENO="0330"
326
timely information to guide operator actions. A part of the issue of-the
design basis arid criteria for safety systmas is also the qualification of
safety related equipment.
PUBLIC INFORNATION
Misinformation or the lack of adequate information on the part of the
public can lead to actions on the part of the regulatory agencies which may
be counterproductive in terms of nuclear plant reliability and safety. The
public needs help in understanding that all activity involves risks, and
that the relative risks associated with nuclear power are acceptably low.
The risks associated with restricted future energy supplies need to be made
more clear. The facts associated with nuclear power need to be pointed out
so as to put nuclear power radiation effects in the proper perspective.
The matter of public education is a nuclear power safety issue because
a poorly informed public may force energy policy decisions which will be
very detrimental to the environment, and to our way of life.
Two major points ~nerged from the panel's deliberations. Unambiguous
authority and responsibility are primary considerations in the safe develop-
ment and operation of nuclear power, and more expeditious ways of addressing
safety issues than the present adversarial approach might result in still
safer systems at lower cost, in both time-and money. -
The members of the panel have considerable depth in the areas which are
discussed above, and we would be pleased with an opportunity to expand upon
any of these issues if that should prove useful to you. I hope this material
will prove useful in the ~ work.
PAGENO="0331"
327
NATIONPL, SOCIETY OF PHOFESSIONA~ ENOINE[HS
`Putting It All Together For The Engineer" Add~s, R,ply T~:
LEGISLATIVE AND GOVERNMENT AFFAIRS
IINSPEIP OFFICE OF THE CHAIRMAN
r, ~
May 22, 1979
Honorable Mike McCormack, Chairman
Subcommittee on Energy Research and Production
Committee on Science and Technology
B374 Rayburn House Office Building
Washington, D. C. 20515
Dear Chairman HcCormack:
On behalf of the nearly 80,000 individual members of the National
Society of Professional Engineers, I am pleased to present this testimony on
the major issues of nuclear energy. NSPE is very interested in the continu-
ation of a safe and dependable nuclear power system.
It may interest you to know that NSPE, in conjunction with approx-
imately ten other national technical engineering societies, has formed a
committee to review the work of and cooperate with the President's Commission
on the Three Mile Island Accident. Engineers are in a unique position to lend
valuable insight into the issues to be raised by this investigation. The new
engineering committee would, if you desire, be pleased to meet with you or
the Committee.
NSPE believes the. questions current surrounding the nuclear indus-
try can be solved if the Federal government presents an organized outline of
steps to be taken to safely speed up licensing and permanently solves the waste
disposal problems. Our technology is capable of answering the questions pre-
sented by nuclear energy.
Thank you for this opportunity to present our views. We would appre-
ciate this statement being made a part of the official hearing record.
Very truly yours,
0~ ~
Otto A. Tennant, P.E.
Chairman
Enclosure
2029 K STREET N.W. . WASHINGTON, D.C. 20006 . 202/331-7020
PAGENO="0332"
328
STATEMENT OF THE
NATIONAL SOCIETY OF PROFESSIONAL ENGINEERS
ON THE
MAJOR ISSUES OF NUCLEAR ENERGY
TOTER
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
COMMITTEE ON SCIENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
May 22, 1979
The National Society of Professional Engineers welcomes this opportunity
to comment on the major issues regarding nuclear energy. NSPE is a nonprofit organ-
ization representing nearly 80,000 individual members. from virtually every discipline
of the engineering profession. Many of these members are intimately involved with
the technical aspects of nuclear energy generation and have been involved since the
advent of nuclear energy several decades ago. They are, therefore, uniquely quali-
fied to provide the technical expertise necessary for the safe and effective produc-
tion of nuclear energy.
The recent Three Mile Island accident has raised suspicions throughout the
country about the future of nuclear energy as a major energy source. NSPE believes
that an effort must be made to reassure the public of the safety of nuclear power
generation. In conjunction with other technical engineering societies, NSPE has
formed a committee to provide technical assistance and review the findings of the
President's Three Mile Island Accident Commission. We hope that the Commission will
fairly evaluate nuclear technology and put forth workable solutions which can be
easily adapted by the Federal government and the nuclear industry. NSPE is concerned
about the present haphazard system of licensing and siting permits which is causing
delays in nuclear power plant construction. We urge Congress to carefully review
these procedures and eliminate those policies which do not enhance the safety and
reliability of power plants but merely add unnecessary time and costs to the process.
NSPE emphasizes that extensive technology has already been developed to safe-
ly and reliably treat nuclear wastes. All that remains is for the Federal government
to make the political decision to proceed expeditiously with the demonstration and
implementation of the existing technology of nuclear waste management. The Federal
government's responsibility is clear since the bulk of existing wastes and by-products
is from Federal military/defense programs. Indeed, without considering commercial
reactor fuel, many millions of gallons of liquid fuel and solidified military nuclear
waste already exists. The Federal government should immediately select one or more of
the existing developed processes and proceed with the disposal of its military/defense
PAGENO="0333"
329
wastes. This could be accomplished by a pilot plant scale demonstration of the
solidification and disposal of high-level power reactor wastes.
Economically, the cost of establishing and operating an effective radio-
active waste management system is substantial in terms of today's dollars, but that
cost is small in terms of its enormous and essential contribution to our Nation's
goals of energy independence.
NSPE believes it essential that America lessen its dependence upon foreign
energy sources, specifically oil and natural gas. This can be accomplished by devel-
oping and utilizing technologies which better utilize our domestic energy resources.
For the short range, we must make better use of more abundant resources, such as
nuclear energy, by building more nuclear power plants. To do this we must accelerate
the licensing of new facilities and establish a Federal policy for the treatment and
disposal of nuclear waste.
NSPE wishes to assure the Subcommittee of our continued interest in the sub-
ject and of our willingness to be of service to the Subcommittee in whatever way
possible. We appreciate this opportunity to express our views.
PAGENO="0334"
PAGENO="0335"
NUCLEAR POWERPLANT SAFETY SYSTEMS
WEDNESDAY, MAY 23, 1979
HOUSE OF REPRESENTATIVES,
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION,
COMMITTEE ON SCIENCE AND TECHNOLOGY,
Washington, D.C.
The subcommittee met, pursuant to notice at 9:30 a.m., in room
2318, Rayburn House Office Building, Hon. Mike McCormack
(chairman of the subcommittee) presiding.
Mr. MCCORMACK. The meeting will come to order, please.
Good morning, ladies and gentlemen.
Today the Subcommittee on Energy Research and Production
continues its hearings on the topic of nuclear powerplant safety.
This is the second of a series of three hearings.
Yesterday we discussed the present philosophy and technology of
nuclear powerplant safety systems. During that hearing we heard
from representatives of a reactor manufacturer; a nuclear power-
plant construction company; from the Electric Power Research In-
stitute, which represents the private utilities; from the Environ-
mental Coalition on Nuclear Power; from the Nuclear Regulatory
Commission; and from Dr. Harold Lewis of the University of Cali-
fornia, who among other things was chairman of the panel which
reviewed the Rasmussen report.
This hearing was informative and provided sound guidance to
the subcommittee on various approaches to nuclear energy.
The witnesses clearly agreed that a significant amount of addi-
tional research and development on nuclear powerplant safety is
needed, although the nature and priority of specific tasks remains
a matter of opinion.
This morning, the theme of our hearing is the Three Mile Island
accident, what happened, what are the technological implications.
We will address industry, utility, regulatory, and State government
perceptions of the accident, with special emphasis on system fail-
ures and the extent to which human error played a role in the
accident.
Our witnesses are Mr. John MacMillan, vice president, Nuclear
Power Research Division, Babcock and Wilcox Co., the manufactur-
er, the vendor of the nuclear powerplant at Three Mile Island; Mr.
Herman Dieckamp, president, General Public Utilities Corp., the
operator of the utility; Mr. Harold Denton, Director of the Office of
Nuclear Regulation, who assumed management and control for the
Federal Government at the Three Mile Island site; the Honorable
William W. Scranton III, Lieutenant Governor of the Common-
wealth of Pennsylvania; and Mr. John Conway, President of the
American Nuclear Energy Council.
(331)
PAGENO="0336"
332
The subcommittee is, of course, pleased to have these distin-
guished witnesses with us today and we are looking forward to
their testimony.
It is important to understand that this hearing is not a witch
hunt. We are not looking for scapegoats but rather for truth and
understanding. Our purpose is not to sensationalize or to generate
fear or hysteria.
The Three Mile Island accident was a serious accident. It raises
important questions related to equipment reliability, plant design,
training and qualification of operators, and our responsibility on
this committee for initiating legislative action to be sure that we
benefit from the lessons learned and assure that all existing and
future nuclear plants will be even safer than they already are, and
that the chance of any similar accident in the future is reduced to
an absolute minimum.
Before hearing from the scheduled witnesses, we will have a
demonstration of a model of a reactor system. This is brought to us
by the University of Florida, Professor Schoessow, who is a friend
of the chairman of the full committee, the Honorable Don Fuqua.
I would like to ask Congressman Fuqua if he would introduce
Professor Schoessow and the presentation at this time. This will
provide background information before we start our testimony.
Mr. FUQUA. Thank you, Mr. Chairman.
Long before we ever dreamed that Three Mile Island would
happen, I had an opportunity to visit the nuclear engineering
school at the University of Florida, where Professor Schoessow
demonstrated this model.
I commented at that time that I thought it was very illustrative
of what really happens inside of a nuclear reactor. For the lay
person it provides a better understanding of the operation and I
hoped that we would have an opportunity for him to bring it up to
Washington and we would have a chance to look at it.
It is here now. I think it does a very excellent job of demonstrat-
ing, particularly to the lay person, just how it operates. Many had
a chance to see it yesterday, and I am very happy at this time to
present Dr. Glen Schoessow with his model and his student assis-
tants.
Mr. MCCORMACK. Doctor, would you like us to come over there?
Would you like to address us first?
STATEMENT OF GLEN J. SCHOESSOW, PROFESSOR OF NUCLE-
AR ENGINEERING, UNIVERSITY OF FLORIDA, ACCOMPANIED
BY DR. JOHN G. STAMPELOS ~ FRED DAMEROW
Dr. SCHOESSOW. I would prefer, sir, that the committee come
down here to get a good look.
Mr. Chairman, ladies and gentlemen, we are very glad to be
here. We come with our model and our hardware to put on a
demonstration which we hope will be helpful. We have a time
frame of 15 minutes, which is not very much, but we are going to
stay inside of it.
This means that we will not deal in lengthy or detailed explana-
tions. So it is likely that especially for the experts in the crowd-
and there are many, I am sure-we might not cover the system in
the detail they would like. You have to bear with us on that.
PAGENO="0337"
333
In making this working model, which we call a see-through
reactor simulator, because you can see through the system and see
what happens, we wanted first of all to be able to show our stu-
dents and others what the core of a reactor would look like if we
had windows in the big power reactor, so we could look in the core
when it is operating at full power.
In this demonstration, as it is set up now, the reactor is at full
power. The core, which we refer to here, is seven of these immer-
sion heaters, a kilowatt each, powered by that extension cord.
There is no uranium. We tried to make this core representative
of a part of a regular fuel assembly, which we brought along so you
could see it. We just took that piece on the side-we took a little
piece out of that and put it in here, and we power it with electric-
ity, and we make it so we can see through it.
Then we have to have the other systems. We have a system
which starts with the core, you can see through it. The center one
has thermocouple connections on it which are used to measure
temperature. We have many other temperature devices which nor-
mally go to a data panel, which we didn't bring.
We have just taken the hottest spot on the center fuel tube and
put it on this recorder so you can see what happens.
So having this much, then we need a cooling system. The water
comes in, the water gets .hot, it goes back here to a heat exchanger
and is cooled because we are putting 7 kilowatts in here, and that
is quite a lot of heat.
Then the water is recirculated by some pumps back there. Then
it comes back though a control panel system which has built into it
the steady state flow line, with which we are now operating.
We can operate, hopefully if nothing happens, for hours this way,
while we are studying the phenomenon going on.
The unique feature is that we are using distilled water, going
past fuel assemblies, that represent the real fuel assembly, and we
can see what is happening.
This is not a computer type simulator. You can see what hap-
pens. The water does its own thing that nature demands it do,
when it tries to cool the fuel assemblies. So the readout we get is
what happens, not what we might have programmed into a calcula-
tor or an electronic type computer. That is one of the main differ-
ences.
In addition to the steady flow line, we have what are called the
emergency core cooling systems in a large nuclear power plant. In
addition to the main circulating pumps, and the main cooling
system, which is this system here [referring to the picture-on the-
easel] that takes water, puts it into the core, to a steam generator,
makes steam, steam goes to the turbine, then to the electric gener-
ator, the water is recirculated by this pump, and this circuit here
just delivers hot water to a steam generator to make steam to run
the turbine.
We don't have a turbine, so we just cool the water with our heat
exchanger.
In the boiling water reactor [referring to picture on easel] there
is no steam generator. The steam is made right in the core, goes off
the top of the reactor, and goes to the turbine and drives the
generator, and then it is recirculated back to the reactor.
48-721 0 - 79 -22
PAGENO="0338"
334
Mr. MCCORMACK. Would it be proper to point out that the outer
sleeve there is just for your demonstration, to keep the system
cool?
Dr. SCHOESSOW. Yes, sir, it would. If we remove this containment
for a moment-seeing we are not going to have any accident-we
have two parts to this reactor core, this outside piece is a piece of
plastic, and the inside piece is pyrex glass. The inside piece con-
tains the hot fuel tubes.
If we let the core dry out, go all the way down, no water in, those
fuel tubes get hot, so we have to be able to cool this inside glass or
it would break on us. So the outside jacket of water here is just a
cooling device for the inside piece.
Mr. MCCORMACK. It is only for that demonstration that you have
the outside core. That has nothing to do with the reactor or any
portrayal of the reactor?
Dr. ScHoEssow. That is correct.
Now, we should discuss the emergency core cooling systems and
controls. In addition to having the manual controls, we have a
control panel which is just a timing unit. In the large powerplants
you have three sets of emergency cooling systems.
You have an accumulator, which is a big tank full of water-two
of them-inside the containment, half full of high pressure nitro-
gen, half full of water, just sitting on the line that is putting the
coolant normally through the reactor.
So if you have a small pipe break in the primary loop, we call it,
the reactor loop, you would have accumulators to put water in
because the problem is we want to keep the core covered. If we
save the fuel tube we save basically everything.
The second system is the high pressure injection system, which is
a series of pumps that takes the water from outside and puts it
into the reactor to cool the reactor.
The third system is a low-pressure injection system. So there are
backup systems, three of them, to provide cooling for the reactor if
something happens, like a small pipe breaks, or a safety valve
sticks open, or a crack in a large pipe or break in pipe from
pressurizer to reactor or multiple failure of steam generator tubes
or-some similar sort of thing that is not supposed to happen,
which lets water out of the core.
We then have three systems, and each of them are in duplicate.
They are redundant systems, so actually we have six systems. For
a very small pipe break, any one of them would do the job; that is,
keep the core covered with water. For a very large pipe break, all
six of them would probably be needed.
Now, why do we say so much about the fuel tube and the fuel
assembly? This is a one-third size fuel assembly; that is a zirconium
tube, zircaloy tube. It looks like this sample tube when it is new,
nice and shiny and bright. It is very good material, which we will
demonstrate to you.
It is oxidized here [in the fuel assembly] a little, like you blue a
gun barrel, so it doesn't show scratches, and also protects it a little
bit and makes it prettier.
There is no uranium in this fuel assembly. If there was, it would
be inside of these tubes, hermetically sealed by welding, with some
helium inside to prevent oxidation.
PAGENO="0339"
335
If we can keep this fuel tube, we call it-it is called fuel rod, fuel
pins, fuel tubes-it is a tube, fuel tube. If at any time during the
malfunction of any system in the reactors we can keep the fuel
tube temperature down, then everything has to stay inside the fuel
tube, the fission products, the fission gases, and they cannot even
get out into the containment, much less ever get to the public.
So our emphasis is on protecting this fuel tube, keeping its
temperature down. That is what we are going to try to show you
this morning.
In our first look here now, we have the reactor running just at
normal full power for a ptessurized water reactor (PWR), which
means very little boiling in the core, the picture on the left. Mr.
Damerow will change the amount of water that is coming up to the
center two-inch tube, cut it by a factor of two.
Now, then, the fuel rods still have the same heat. So we form a
lot of steam right in the core. That is the boiling water reactor
(BWR). Now you have a boiling water reactor. The steam is being
formed in the core, going up to the top, and then would go to the
turbine.
Now you are looking inside of a big boiling water reactor.
Now we can cut that back to normal PWR mode. Now the fuel
temperature here for the normal run, for the boiling water reactor,
you see this didn't change, go up or down, it is sitting right at the
normal fuel tube temperature, same as for the BWR, which we are
operating between 6000 and 700° F.
It is not so hot that you can see it glow. It is black to the eye,
basically.
Now, Mr. Damerow will set the system so that we are going to
break a small pipe. This is the core drain on the bottom. When he
sets the system, and flips this loss of coolant accident switch this
valve will open and the water will drain out of the core and the
fuel tubes; it will be on its way to becoming uncovered. That would
be very bad; but the emergency core cooling systems here will come
on, hopefully, since it has had a long ride from Gainsville, a lot of
bumps.
Hopefully it will come on just like it should, and the core will not
uncover. You will see this fuel temperature will not change.
Now, we need a volunteer. Chairman McCormack, just flip that
switch, sir, and you will be a little more famous than you are, if
that is possible.
Now you can see the core, the water is coming down in the core.
The reactor has scrammed. When a reactor scrams from being up
to full power, the remaining power for some period of time is 10
percent of what it was running at.
So you must take out that heat or the fuel will just keep on
heating up the fuel tube. Now the water level is dropping, and we
are getting just a little bit worried that maybe the system won't
come on and stop that water level drop before it gets down below
the top of the fuel.
This was a small pipe break. A small pipe break could be many
different things. I could give you a list of them, but let's just say it
is a small pipe break, maybe that big, [indicating about an 6-inch
diameter circle with hands] which would be a pretty serious thing
if you didn't have something to put water in. The high pressure
PAGENO="0340"
336
injection system came on automatically; the water level in the core
is rising, the fuel tubes were not uncovered.
We are back in a very safe condition. We did nothing manually
because this would happen by itself automatically in a reactor
plant. You can see the fuel temperature did not rise. It actually
went down a little bit because the high pressure injection system
takes colder water from outside and puts it in rather than the hot
water that has been circulating.
Now, Mr. Damerow will reset it back to just where it was before
this loss of coolant accident. We will run through it once more.
This time we need another volunteer to flip the switch.
Where is Mr. Denton?
Mr. Denton, you know all about accidents. You know how to cure
them, how to fix them.
Mr. DENTON. I really don't want to start one. [Laughter.]
Dr. SCHOESSOW. When I heard the name Mr. Denton, all I could
think of, sir, was the Dentons my three children wore in the crib.
So I would never forget Mr. Denton.
Now, if you will flip this LOCA switch down, we will repeat the
last--
Mr. DENTON. I am really not trained or qualified.
Dr. ScHoEssow. We will take a chance on you, sir.
Now, he has broken the pipe. He is letting the water drain out.
Don't be confused by this outside jacket cooling water. It is the
water inside the inside tube around the fuel tubes which you can
see is going down.
Now Mr. Damerow is going to change the controls, manually, he
is going to interrupt the automatic systems and the core is going to
uncover. This means the water is going down below the top of the
fuel, it is boiling dry, as you can see.
This we call an uncovered core. Now the fuel has no water to
cool it. It has no choice, except to rise in temperature. You can see
on this chart now the very rapid rise in temperature of that center
fuel tube. It will keep going on up until Mr. Damerow reactivates
the high pressure injection system to reflood the core and reduce
the fuel tube temperature.
The system was not on automatic emergency core system. Mr.
Damerow interfered with that. So the core was uncovered and the
fuel tube temperature rose rapidly. It has no choice. It will go up to
2,0000 F, after a scram reactor with all the water out.
If you leave the core in this uncovered condition for any length
of time, like an hour, then it would go up to 3,000° F. Over an hour
it will go up to maybe 3,500°. Very big numbers.
So we must not let that happen. That is the reason we have the
emergency core cooling systems working automatically with redun-
dancy and backup, so it will behave like you saw the first demon-
stration.
We will demonstrate the effects of high temperature on the fuel
tube.
We will leave this, and go over to the furnace. We have about 3
minutes left. We will show you what you would see if you could
look in a reactor, in which the water is drained out, after it has
been operating at full power and scrammed.
PAGENO="0341"
337
The. core would be up to to 2,0000 F. There is no question about
that number. Any nuclear engineer worth his salt and a lot of
others can make that number. It is just the average temperature of
all the fuel in the core and the fuel tubes.
This is a 2,000° core. [Opens furnace door.] That is what you
would see. We didn't let our core go up that high because we didn't
want to ruin our tubes, our heaters, for each demonstration. But
this is what you would see, the 2,000 for a short period after a
scram from full power.
Now, what is the significance of this as far as this tube is
concerned, in which we are trying to keep not only the fuel but all
the fission gases?
This fuel tube is zirconium, a zircaloy, a very wonderful materi-
al. We have some specimens in here. We will take one out of the
furnace, that was new and shiny just like this before we put it in
there, about 3 minutes ago.
We will take one of these out. We will drop it in the water. In
the furnace it is 2,000° probably 1,900° F. by the time I got it to the
water. We will take it out of the water, cool it off a little bit more,
to make sure we can get out hands on it.
Now, what do we have? The center section of this didn't cool as
fast as the ends. The center section doesn't look a lot different than
this, [pointing to the fuel assembly] but the end sections here
which cool the fastest has some white on it.
This white, is from the zirconium reacting with the oxygen from
the water, making the zirconium dioxide. That frees the hydrogen
from the water molecule. The hydrogen gas then is free, and being
the very lightest gas we know of, will go to the highest elevation in
*the reactor, which will be the top part.
Now, this is for one quench. It still looks pretty good. But let me
show you here-I need a volunteer, someone that is good with a
hammer, not me. Here is a piece of tube. She will hammer on the
end of that. That is a new piece of tube. Hit it. More. More. It is
very ductile. It can bend, flatten, take a lot of punishment. It is
still in one piece, which shows you that it is very good material.
Now, we will take this piece here, that has been in the furnace
once. John, will you come up and give this a whack. You hit this
with a hammer to see if it will behave the same. You see, it does
not, it is brittle. It might look the same, but it has been through
phase changes, between 1,200° and 1,800° F, and now it is brittle.
It is still a pretty good tube sitting there, but it is brittle so you
cannot use it again. You have to take it out of the reactor and
replace it. That is once it has been up to 2,000°.
If the core is uncovered for an hour or more, the temperature of
the fuel tube will go up to 3,000°. So we will take one out of the
furnace that has been up to 2,000° once, and this is the second time
for it, which would be about the equivalent of going up to 3,000
once.
We will take it out of here. It is already a little bit damaged. We
will drop it in the water, quench it, cool it off a little bit.
Now It is all white. A lot of zirconium dioxide powder. It is like
an egg shell. If we take this and hammer on it-there-that is
what I have left, only powder. So if the fuel tube is allowed to go
up to high temperatures, like 2,000°, which it will, if the emergency
PAGENO="0342"
338
cooling systems are not allowed to do their thing, we would have
problems. If it goes up higher, because the core stays uncovered a
longer time, we have more serious problems.
Ladies and gentlemen, in closing I would just say this. Emergen-
cy core cooling systems, properly built, always on a ready status,
with the proper redundancy, and allowed to operate through the
cycle, should keep that fuel temperature down to near normal for
this accident or any accident like this that could happen.
I thank you very much, ladies and gentlemen, for your kind
attention. It has been a pleasure to be here.
Mr. MCCORMACK. Thank you, Professor.
I want to thank you for bringing your demonstration here and
sharing it with us. I am sure it has helped us understand better.
The Professor has also provided us with some samples of quenched
zirconium for the members to examine.
Before we proceed further, without objection, I would like to
insert into the record a statement provided by Dr. Schoessow to
Congressman Fuqua, concerning improvement of engineering safe-
guard facilities in nuclear power plants.
[Material referred to follows:]
PAGENO="0343"
339
COMMFflE~ON-SClENCN~iF~t~GY
~ ~ U.S. HOUSE OF REPRESENTATIVES
SUITE23ZI RAYBURN HOUSEOFFJCEBUILOING
WASHINGTON DC 20515
- May 3, 1979
Professor G. J. Schoessow
300 N.W. 34th Terrace
Gainesville, Florida 32601
Dear Professor Schoessow:
Thank you for your telegram of April 3, 1979 concerning the accident
at the Three Mile Island Reactor No. 2.
Subsequent to your telephone conversation with Mr. Williams of the
Committee staff, an effort was made to obtain permission for you to
conduct a separate investigation of the accident by contacting the
Nuclear Regulatory Commission and Metropolitan Edison. Both organiza-
tions appreciate your interest and support, but have requested that you
wait until the current investigations have been completed. At that time,
I will again attempt to arrange for you to visit Reactor No. 2 so that you
can obtain the information necessary to simulate the accident in the "see-
through' model at the University.
As you know, the cause of the accident and particularly the management of
the events which followed, have become.somewhat controversial. There is
obviously much work to be done if nuclear energy is to make a significant
contribution to our energy future. The Committee will be conducting hear-
ings on reactor safety at the end of May and it would be useful to us if
you would submit a paper on the subjects of systems redundancy, control
systems, or on any subject you feel would be pertinent. In particular, it
would be most helpful if you could submit suggestions for improving reactor
design. Whatever information you choose to send will be inserted as part
of the official hearing records.
The reactor safety hearings will begin May 22 and continue through May 24.
I would be pleased if you could arrange the time to attend these hearings
as I am sure you would find them most interesting.
Again, thank you for contacting me and I look forward to hearing from you
regarding your submissions for the hearing records.
Sincerely,
/
DON FUQUA
Chai man
DF:Wgm
PAGENO="0344"
Date of ~tr: ~~/3 ~,
Date recd. in Conin.~3
From: ~
~~L~~4-w- ~
/
THIS IS FROM THE PROFESSOR AT GAINESViLLE FLCRIDA WITH THE SEE
THROUGH REACTOR MODEL, ~E ARE TRYING TO MAKE OUR SEE THROUGH MODEL
MALFUNCTiON TO REPRESENT THE THREE MILE PLANT. WOULD BE VERY HELMFUL
iF YOU WOULD ARRANGE WITH NRC SO I COULD HAVE ACCESS TO THE
BRIEFINGSAT THE SITE AND IN THE CONTROL ROOF TO OBTAIN FIRST HAND
DETAILS TO ~40RK~WITH, PLEASE ADVISE IF YOU WILL ARRANGE FOR THIS
ACCESS TO BRIEFINGS AND CONTROL ROOM, I WAS A SLNICR REACTOR
OPERATOR MOW MANY YEARS SO I CC UNDERSTAND THE PROBLEMS.
I WILL PAY MY EXPENSES AND BE RESPONSIBLE FOR MY SAFETY AND WILL -
HOLD ALL OTHERS MARMLESS,
RESPECTFULLY,
G J SCHOESSOW 300 NW 3A TERRACE GAINESVILLE FL 32b01 (900)372.3995
U9:17 EST (~~q)_9?L-i~1aL.
MGMCOMP MOM
iVti& ~
,~. ~)ç,~-
340
Reply due by ~-
If it is not possible to
prepare a final reply by the date
shown above, an interim reply will
be prepared by the above date
j~dicatingWhen a final reply may
be expected. Please return copy
of incoming letter with proposed ML Ill 04-03 0917A ESYPOMA
response. 1 DLY BY MGM
A~ J ~979
co:z~~:1 S~J'!C
--~:~~ `~CGY
4~.) ~
~t.rJ A0i~
PAGENO="0345"
341
UNIVERSITY OF FLORIDA
May 17, 1979
Honorable Don Fuqua
Committee on Sciences ahd Technology
U.S. House of Representatives
Rayburn House Office Building
Washington, D. C. 20575
Dear Mr. Fuqua:
In response to your letter of May 3, 1979, I am pleased to offer my
recommendations as to the direction we should take to improve the engi-
neered safeguards facilities for nuclear power plants.
When it comes to "safety" of nuclear power plants, the number one
requirement is safety of the population, and the number two requirement
is safety of the plant itself. Hot only is this is required by present
regulations, but is the practice that has been followed by the nuclear
industry from its beginnings.
Title 10, Part 50 of the Code of Federal Regulations specifies
conditions the engineered safeguards facilities must meet during the
postulated maximum credible accident, that is the "large pipe break" in
the primary system. The containment vessel must contain all radioactivity
to protect the population and the Emergency Core Cooling System (ECCS)
must be capable of keeping the maximum fuel-tube temperature below
2200"F. The ECCS is designed to meet this specification. Other limits are,
oxidation of fuel-tube not to exceed 17% of thickness and hydrogen
production nut to exceed 1% of the amount that oxidation of all the
fuel-tube could produce.
The adequacy of the containment vessel to contain the radioactivity
even with some controversial interference by the operators has been
demonstrated by the recent Three Mile Island (TMI) accident.
The hard fact is that any accident that leads to a partially uncovered
core shortly after shutdown from full power operation may cause severe
oxidation and mechanical damage to the fuel-tubes releasing fission
products into the primary coolant. Fission products in the primary loop
can escape into the containment building as at TMI resulting in a costly
clean-up and repair situation.
We must analyze every existing nuclear power plant to determine its
vulnerability to such costly clean-up and repair that can arise from
credible scenarios less than the "large pipe break," similar to the TMI
COLLEGE
OF
ENGINEERING
FLORIDA'S CENTER FOR ENGINEERING EDUCATION AND RESEARCH
PAGENO="0346"
342
situation. I believe this can be done with an acceptable cost increase
in any new plants that soy be found to have inadequate protection and at
higher costs in any existing plants requiring retro-fitting. Additional
briefing and training of operators and limiting their options during
emergencies is also in order. A remete controlled vent line from the
top of the reactor vessel, a direct reactor core water level indicator,
azong other minor changes, should also be considered. The ongoing loss-
of-flow-test (LOFT) program should be of considerable value in providing
data on which to base decisions.
I have been in the nuclear business from its beginnings. I am not
committed pro or con to nuclear energy; in my view nuclear energy always
has had to, and must continue to, prove that it can be utilized safely
and it must, of course, be economical.
With the above accomplished so that after any failure, recovery
efforts and costs will be minimized, the reactor owners and the public
will have reason for renewed confidence in nuclear energy as a part of
our national energy selfsufficiency strategy.
I appreciate this opportunity and hope the above will be helpful.
If I can be of assistance in any way, please feel free to call on me.
Res ctfully mitted,
I peorof Nuclear
Mr. MCCORMACK. At this time I should like to invite the ranking
minority member of the committee, John Wydler, to make an
opening statement.
STATEMENT OF HON. JOHN W. WYDLER, A U.S. REPRESENTA-
TIVE FROM THE STATE OF NEW YORK
Mr. WYDLER. Mr. Chairman, a lot has been written and said
about the March 28 nuclear accident at Three Mile Island. Maybe
people are getting tired of this subject because they read about it
on such a constant basis.
You wonder sometimes what new light is being shed on the
whole situation. Yet, Mr. Chairman, little or no attention has been
paid to what we can learn from such an accident.
I believe that careful analysis of the details of the Three Mile
Island accident, in terms of systems failures and human errors, can
be a constructive basis for a significant enhancement of nuclear
safety systems and procedures.
I intend to make every effort to see that this incident becomes
for nuclear power what the Apollo. spacecraft fire was for the
national space program.
As many of my colleagues will recall, the Apollo fire was a tragic
incident which took the lives of three outstanding astronauts. How-
ever, the National Aeronautics and Space Administration, in team
with its industrial contractors, revamped their Apollo systems and
upgraded their safety standards in terms of new materials, more
stringent operating procedures and additional measures aimed at
minimizing human error. This contributed greatly to the program's
successes in the years that followed.
The nuclear community is faced with a similar situation today as
NASA was 12 years ago. However, at Three Mile Island no fatali-
ties resulted from the nuclear accident and exposure of the citizen-
ry amounted to radiation levels comparable to several chest X-rays.
PAGENO="0347"
343
NASA had to enhance the quality of safety in the face of trage-
dy, and yet I feel the urgency to address the nuclear safety prob-
lem is just as great even though there has been no catastrophe.
Mr. Chairman, I think it is generally agreed in the technological
community that two major conclusions have been reached so far on
Three Mile Island.
The nuclear reactor safety systems were tested under conditions
so extreme that a saboteur could not have done a better job of
stressing the reactor. Probably the demonstration we just saw
makes that clearer yet.
Yet the system behaved better than anyone had the right to
expect. I cannot make the same observation about the Operators
performance. Human error combined with the absence of reliable
and confirmatory instrumentation obviously played a major role in
escalating a normal shutdown sequence into a potentially harmful
incident.
This has to be avoided in the future. I hope our committee's
deliberations are the first step in a meaningful congressional initia-
tive to enhance reactor safety by technological improvements, not
by adding another layer of regulatory complexity.
Thank you, Mr. Chairman.
Mr. MCCORMACK. Thank you, Mr. Wydler, for an excellent state-
ment. I very much appreciate the most constructive attitudes re-
flected in that statement.
Our first witness today is Mr. John MacMillan, vice president,
Nuclear Power Generation Division, Babcock & Wilcox Co.
Mr. MacMillan, please come up and make yourself comfortable
at the witness table. Your statement, without objection, will be
inserted into the record at this point, along with any supplemental
material you may wish to submit.
You may proceed with your testimony as you wish. You may
wish to introduce Mr. Roy.
STATEMENT OF JOHN MacMILLAN, VICE PRESIDENT, NUCLE-
AR POWER GENERATION DIVISION, BABCOCK & WILCOX CO.,
ACCOMPANIED BY DONALD ROY, MANAGER, ENGINEERING,
NUCLEAR POWER GENERATION DIVISION
Mr. MACMILLAN. Yes, Mr. Chairman. Thank you very much. I
have with me today Dr. Donald Roy, who is the manager of engi-
neering for the Nuclear Power Generation Division of Babcock &
Wilcox.
In response to your letter of May 11, I am prepared this morning
to discuss the manufacturer's perspective on the events that took
place at Three Mile Island, as an introduction this morning.
Second, to try to identify what we consider to be significant
factors in that sequence of events. You also requested some infor-
mation on the characteristics of the B. & W. design, unique charac-
teristics, specifically the once-through steam generator. I am pre-
pared to discuss that.
Finally, some very brief comments relative to the specific im-
provements in technology which might be indicated as a result of
the Three Mile Island experience.
I have submitted a full statement. I appreciate that it will be
incorporated in the record of these proceedings.
[The prepared statement of Mr. MacMillan follows:]
PAGENO="0348"
344
STATEMENT OF
THE BABCOCK & WILCOX COMPANY
The Babcock & Wilcox Company is pleased to submit its
statement before the Subcommittee on Energy Research and
Pioduction of the House Committee on Science and Technology.
This statement is submitted in conjunction with an invitation
by the Subcommittee to Babcock & Wilcox to appear before the
Subcommittee on Wednesday, May 23, 1979. At the Subcommittee
hearing Babcock & Wilcox will, be presenting a synopsis of this
statement.
This statement will address first, how a nuclear plant
comes into existence beginning with its inception as a planned
addition to a utility's generating capacity including partici-
pants and their roles; second, to briefly discuss a pressurized
water reactor nuclear steam system; third, the sequence of events
and the significant factors involved in the incident; fourth, the
once-through steam generator and its characteristics; and fifth,
the generic technological implications of Three Mile Island.
It is appropriate to begin this statement by briefly des-
cribing the genesis of a nuclear power plant and the particular
roles each of the participants plays.
Following a utility's decision that it wants to add a nuclear
power generating station to its electricity producing facilities,
it will generally employ an engineering firm to begin the process
of bringing that decision into reality. Several decisions such as
PAGENO="0349"
345
location, desired date of coercial operation, generating capacity,
and financial considerations are made. Generally, the engineering
firm will prepare bid specifications for the various components of
the plant. Eecause of the design and manufacturing lead times
required for the nuclear steam system, often these specifications
are released to bidders in the early stages of the project. Suppliers,
including B&~, review the specifications and prepare proposals for
submittal to the customers and their engineering firms. Following
what is usually a lengthy evaluation and negotiation period, an
award is made and the supplier and the engineer begin to proceed
with detailed design, licensing and procurement efforts to support
the customer's schedule.
Each individual customer~supplier relationship is governed
by the respective contract requirements and the requirements imposed
by the V~RC. The supplier's responsibility to the utility is to
furnish equi~rtent and services in accordance with these requirements.
Specifically, the supplier has the responsibility for the design
of the equi~nent which it supplies and the responsibility to provide
interface design information and criteria to allow the engineer to
integrate this equi~nent into the design of the complete plant. The
supplier's scope of supply usually includes the complete reactor
coolant system, components within major auxiliary support systems
and emergency core cooling systems, instrumentation and control
systems and other equipment such as fuel handling equipment.
PAGENO="0350"
346
Generally that part of the plant which is outside the scope
of supnly of the nurlear steam system supplier is referred to as
the "balance of plant'. The engineer is responsible for the design
and procurement of equi~ent for the `balance of plant'. The
nuclear steam system supplier and engineer work together to inte-
grate their respective scopes of supply at the interface through
the transmittal, review end application of interface information
and criteria in the form of drawings, specifications, system des-
criptions and instruction. For instance, the nuclear steam system
supplier provides the reactor coolant system which is located in
the containment. The containment is designed by the engineer. The
integration of the reactor coolant system into the containment
design is an example of the interplay between the supplier and the
engineer.
Another key participant in the genesis of a nuclear power plant
is the Nuclear Regulatory Cosmission. The NRC's role includes the
responsibility for the review of the plant design and the issuance
of the appropriate permits. During the early stages of the project
the NRC, in accordance with the provisions of the Atomic Energy Act,
must issue a Construction Permit based on their acceptance of the
design at that time. This permit is necessary before any significant
plant construction activity may take place. The NRC must also review
the final design of the plant and issue an Operating License before
PAGENO="0351"
347
the utility may load fuel into the reactor. This also is required
by the Atomic Energy Act. In addition, the NRC is responsible for
establishing operator training requirements and for testing and
licensing of operators. Once a plant has started operating, the
NRC maintains a surveillance function, monitoring plant operation
to insure compliance with existing plant technical specifications.
A particular engineer or customer may impose their specific
criteria on a supplier which nay vary from those imposed by another
engineer or customer even though the basic nuclear steam system
would be categorized as the same type. Additionally, varying criteria
may be imposed by the ~balance of plant" design or by the equipment
selected for the "balance of plant". Therefore, even though plants
supplied by a particular nuclear steam system supplier may be thought
of as being the same, in the specifics of the design they are usually
different.
It is additionally appropriate to describe the Babcock & Wilcox
pressurized water reactor in simplified terms with reference to
Figures 1 and 2 in order that one can have a basic understanding
of the production of electricity through the use of nuclear power.
A pressurized water reactor nuclear plant is essentially
made up of three separate and distinct loops. For definition
purposes we will call these loops the primary loop, the secondary
loop, and the condenser/cooling loop (Figure 1)
PAGENO="0352"
Block valve
FIgure 1
RC
Turbine generator
Primary
High preseure
injection
tower
Condenser/Cooling
Secondary
Main feed pump
PAGENO="0353"
349
The primary loop contains the following major components, all
of which are located in the containment building: reactor vessel,
steam generators, pressurizer, and reactor coolant pumps. The
reactor vessel is approximately 14 feet inside diameter with walls
approximately 9 inches thick made of steel with an inner lining of
stainless steel. It houses the fuel assemblies which are zircaloy
tubes housing slightly enriched uranium. Control rods which contain
material which controls the rate of nuclear reaction are also con-
tained in the reactor vessel. These control rods move up and down
within the fuel assemblies to vary the power from 0% to 100%. The
steam generators are pressure vessels approximately 68 feet high
with an inside diameter of approximately 13 feet. They contain
thousands of nickel-iron-chromium alloy tubes roughly twice the
diameter of a pencil. The pressurizer is a high pressure vessel
vertically mounted which provides a steam surge chamber and water
reserve which can be used to maintain desired reactor coolant pres-
sure. The reactor coolant pumps, 2 per steam generator, are very
high capacity pumps which deliver reactor coolant flow throughout
this primary system. Heat which is generated from nuclear reaction
of the uranium contained in zircaloy clad fuel pins is transferred
to water circulating through the reactor vessel under high pressure
and flow around the fuel pins. This heated water is carried
through piping to the steam generators where the heated water passes
through the tubes in the steam generator and returns to reactor cool-
ant pumps to recirculate it through the reactor around the fuel pins
again. The primary system maintains its pressure through the use of
48-721 0 - 79 - 23
PAGENO="0354"
350
the pressurizer. The pressurizer maintains reactor coolant pressure
at desired level throuch actuation of the heaters or spray in the
pressurizer. This is a closed system. (Figure 2)
The secondary system contains the steam generators, the turbine
generator, condenser, heaters, and main and awciliary feedwater
pumps. As the heated water from the reactor is passing through the
tubes in the steam ~enerator different water from the secondary
system is pumped around the outside of the tubes arid the heat is
transferred through the nickel-iron-chromium alloy material making
up the tubes to turn this water into steam which then leaves the
upper region of the steam generator and passes through piping to
drive the turbine. As the steam is cooled passing through the
turbine and further cooled in a condenser, it returns to its liquid
state and again begins its return to the steam generator. After
leaving the condenser and passing through a condensate system, it
returns to the feedwate.r pumps to be circulated through the steam
generators again. This is the secondary loop and is essentially a
closed system.
The third loop contains the cooling towers and condenser which
use a water source, such as a river, to cool the steam leaving the
turbine-generator through heat transfer in tubes in the condenser
and turn the steam in the secondary system back to water for its
return through the secondary steam and its reconversion to steam.
(Ficure 1)
PAGENO="0355"
Nuclear steam system
CO
Cu
Steam
generator
Pressurizer.
Figurei2
PAGENO="0356"
352
Recalling the earlier discussion of the division of responsi-
bilities between the participants in the design, manufacture, and
construction of a nuclear power plant, the following conments are
generally applicable with respect to a pressurized water nuclear
steem system. First, the major components of the primary loop are
the design and manufacture responsibility of the NSS supplier. The
secondary loop and the condenser/cooling loop are generally the
design responsibility of the engineering firm with specific com-
ponent design and manufacture responsibility, laid upon various
manufacturers such as the manufacturer of the turbine generator.
Additionally, there are split responsibilities and interfaces
between the participants. An example of such a split is in the
primary system, where the NSS supplier designs and fabricates the
major components and specifies certain parameters which must be met
within the engineering firm' s design of the containment, and where
the engineering firm has full design responsibility for the contain-
ment building itself and the location of certain components within
the containment.
Against this background the following describes the sequence
of events and significant factors of the incident at Three Mile
Island.
First, we will develop an overview of the sequence of events
at ThI. Following that, with the overview serving as a context,
we will provide our views concerning the significance of the
factors in that sequence.
PAGENO="0357"
353
Figure 3 (next page) is a diagram of the secondary system
at Three Mile Island. Steam from steam generators shown on the
right goes up through the main steam lines and is admitted to the
turbine, and then into the condenser. Condensate pumps take
suction from the condenser and pump through the condensate polishing
equipment, through condensate booster znimps, low pressure heaters,
main feedwater pumps high pressure heaters, back through feedwater
control valves and into the steam generator. In the absence of
main feedwater flow,~ three auxiliary feed pumps, two electric
and one steam driven, can draw directly from condensate storage
tanks or from the main feed system and pump through control valves
into the steam generator.
What happened in the initiating event at Three Mile Island
was apparently the result of work being performed on the condensate
polishing equipment. In the process, that equipment was isolated
so that the feedwater flow was interrupted. Suction pressure to
the feedwater pumps was lost and they both shut off. This interrupted
the feedwater flow to the steam generators. In that circumstance,
safety systems called for the auxiliary pumps to start automatically
and the turbine to trip. Both of those happened as designed.
Control valves functioned as required - the operator looked at his.
panel arid his debriefing has indicated that he established that
there was pressure at the discharge of the feedwater pumps. He,
therefore, probably assumed that the auxiliary feedwater system
was operating the providing flow to the steam generators. What
in actuality occurred was the isolation valves downstream of the
of the control valves were closed in violation of technical pro-
cedures and they should have been open. The interim sequence
PAGENO="0358"
Secondary System
CA~
FIGURE 3
PAGENO="0359"
355
of events published by the NRC states that operators apparently
failed to note the position indication lights of these valves in
the control room until about 8 minutes into the transient. These
closed valves precluded the admission of auxiliary feedwater to
the steam generators for that period of approximately 8 minutes.
During this time then there was no feedwater being introduced to
the steam aenerator.
Figure 4 (next page) is a diagram of the reactor coolant or
primary system. Briefly the flow paths in this system are the
reactor outlet line going into the steam generator, two lines coming
out through circulating pumps back into the reactor vessel. Also
shown schematically and not by actual physical elevation is the
pressurizer which is connected to one of the reactor outlet lines
or hot legs. On top of the pressurizer are two code safety valves
and a pilot operated relief valve with an isolation valve upstream
of it. All discharge lines from these pressurizer valves go to the
quench tank. The quench tank has a relief valve not shown on. Figure
4 and a rupture disc which protect the integrity of the tank if the
pressur.e gets too high. These devices discharge into the reactor
building, or containment. Also shown on Figure 4 are the various
emergency~ core cooling systems. The high pressure injection system
delivers water into the reactor inlet, or cold legs of the reactor
system. Intermediate pressure injection is provided by two core
flood tanks which are maintained at pressure by a gas pressure. If
pressure is low enough in the primary system, these tanks dump their
contents into the reactor vessel. -
PAGENO="0360"
ElM
RELIEF
VALVE
STEAM
Primary System
FEEDWATER
RCPUMP
(TYPICAL)
FROM MAKEUP CONTROL VALVE
FIGURE 4
PAGENO="0361"
357
With the feedwater flow to the secondary side of the steals
generator having been interrupted, there was limited capacity for
removing heat. The steam generator was boiling dry and the reactor
coolant system began to heat up and pressure in the reactor coolant
system began to increase because of expansion. The pressure in the
reactor coolant increased until the pilot operated relief valve
opened at about 6 seconds. Pressure continued to increase to the
point where the reactor was automatically tripped, or automatically
shut down. As a result, the reactor coolant pressure then started
to decrease and dropped down to around~ 1300 or 1400 psi. As it
decreased, the pilot operated relief valve should have closed. It
did not. As pressure dropped to approximately 1600 pounds, the
high pressure injection pumps started up automatically by action of
the safety system. The pressure dropped to the point where there
was flashing or instantaneous creation of steam in the hot leg of
the reactor coolant system and that was what was holding the pres-
sure up.
During that period the pressurizer level fluctuated and started
to increase. As the level approached a full. pressurizer the
operator apparently cut back on the high pressure injection flow to
maintain pressurizer level. As time progressed without additional
water entering the reactor coolant system and pressure continuing to
drop, primary coolant water began to flash to steam. The reactor
coolant pumps then began to operate erratically. Two pumps in the
B loop were turned off at 73 minutes and two pumps in the A loop
were turned off at about 100 minutes into the accident. After that,
with forced circulation terminated and emergency core cooling
PAGENO="0362"
358
through high pressure injection reduced by operator action, all
the evidence seems to indicate that the water boiled out of the
reactor coolant system. This occurred during the period from 2-4
hours after the start of the accident, or from 6:00 AM to 8:00 AM.
It was apparently during that time that most of the core damage
occurred. There was evidence of very substantial zirconium-water
reaction which generated hydrogen and the much publicized gas
bubble in the primary system.
Ultimately, through a combination of advice from various
sources, including B&W, high pressure injection was re-established
at a sufficient flow, pressure was brought up in the system and a
reactor coolant pump was put back into service. The last of these
actions was not completed until almost 16 hours after the accident
began. It was at that time that a cooling configuration was estab-
lished which was maintained for a matter of several days while
everyone concerned looked at the total picture of how to recover
from that situation and get into a long term cooling configuration.
With this overview of the TMI sequence of events in mind, it
is appropriate to move into a discussion of the significance of
the factors in that sequence.
S First, after the loss of feedwater occurred, two closed isola-
tion valves prevented auxiliary feedwater from reaching the steam
generators for a period in excess of eight minutes. This eliminated
the capab~ility of the steam generator to remove heat from the
reactor coolant system, and resulted in a corresponding increase
in reactor coolant system temperature and pressure, and diminished
PAGENO="0363"
359
the ability of the plant to promptly stabilize reactor coolant
system temperature and pressure as designed.
* Second, as a result of the initial reactor coolant system
pressure and temperature increase, the pilot-operated pressurizer
relief valve (located at the top of the pressurizer) opened as
designed, but did not reseat properly, thus allowing reactor coolant
system pressure to continue decreasing. After approximately 2-1/4
hours, the operators recognized the data from plant instrumentation
which indicated that the valve was open (including quench tank
rupture at 17 minutes), and closed the block valve in therelief
valve discharge line, thus preventing any further loss of primary
coolant.
* Third, the high pressure injection system, which had auto-
matically actuated as designed on low reactor coolant system
pressure, was prematurely terminated by the operator even though
there were simultaneous indications of an opening in the reactor
coolant system pressure boundary, such as increasing quench tank
pressure, decreasing reactor coolant system pressure and increasing
reactor containment pressure. This led to a diminished capability
to cool the reactor core as primary coolant inventory diminished.
Subsequent analyses have indicated that there would not have been
core damage or significant radioactive contamination and release
if the operators had left the high pressure injection pump in
service to perform the core cooling function for which they were
intended.
PAGENO="0364"
360
* Fourth, the containment isolated in accordance with the
licensed design. However, this allowed the transfer of radioactive
water from which subsequent radiation releases occurred.
* Fifth, high pressure injection was evidently manually operated
based on high pressure level indication. We have conducted reviews
of data from Three Mile Island and performed analyses that lead
us to conclude that the indicated pressurizer level was not sig-
nificantly in error. We believe that the pressurizer was essen-
tially full during a long period of this transient but a portion of
the reactor coolant system developed steam voids due to the decrease
in system pressure. This conclusion has been supported by an
independent NRC study. Consequently, operation of high pressure
injection flow should not have been based on the single parameter.
of pressurizer level.
* Sixth, in addition to two reactor coolant pumps having been
shut off at 73 minutes, the remaining two reactor coolant pumps
were shut off at 100 minutes after the initiation of the incident.
Although shutting off one reactor coolant pump in each loop in
response to indications of low coolant flow may be advisable,
shutting off all pumps under the circumstances then present is
believed to have caused an uncovering of the core and a degrada-
tion in core cooling capability. Ultimately, at about fifteen
hours after initiation of the transient, the reactor coolant system
was repressurized, and at about 16 hours the reactor coolant pumps
were restarted.
PAGENO="0365"
361
Our analysis of the six factors identified by the NRC has
yielded a set of four basic principles which we believe warrant
emphasis in considering any future action.
First, renewed emphasis must be placed in the near term on
administrative controls to assure that plant systems important
to safety are not defeated. In the longer term, consideration
should be given to whether plant systems to augment those admini-
strative controls should be developed and implemented.
Second, renewed emphasis must be placed on maintaining the
individual operator's focus upon the fundamental physical processes
which assure core cooling, and on ensuring that systems complement
or increase the likelihood of maintaining that focus.
Third, operator training programs must be reassessed and
upgraded to emphasize these fundamentals.
Fourth, any actions or modifications implemented must be con-
sidered in the broader context of total plant safety. Hasty and
ill-considered actions, which might be partially responsive to the
TMI-2 events, could, in certain cases, produce adverse impacts in
other safety systems which were not involved at TMI-2.
In response to an additional request of the Subcommittee,
the following is a brief description of the Babcock & Wilcox
designed once-through steam generator and its characteristics. V
PAGENO="0366"
362
As previously indicated, the steals generator is a pressure
vessel approximately 68 feet in height and 13 feet in diameter
containing approximately 15,000 small diameter nickel-iron-
chromium alloy tubes. These tubes are held in a uniform pattern
along their length by tube support plates.
Reactor coolant, at approximately 600°F and 2200 psi, enters
the single inlet nozzle at the top of the once through steam
generator and flows downward through the tubes either under forced
circulation from the reactor coolant pumps during normal operation
or by natural circulation during those emergency operations when
the reactor coolant pumps are not operating. The reactor coolant
then exits at the bottom of the steam generator through two outlet
nozzles. Recalling the early discussion and diagram 1, this is
the steam generator's role in the primary system.
Secondary system feedwater is introduced into the steam
generator through inlet nozzles at the side of the vessel. This
water enters tube bundle at the bottom of the generator and then
passes upward between the tubes which contain the primary coolant.
Heat is transferred through the tube walls from the primary coolant
to the feedwater. The feedwater turns to steam and then super-
heated steam as it passes upward between the tubes to the top of
the generator and exits at outlet nozzles located on the side of
the generator. This steam then goes to the turbine generator as
previously indicated.
PAGENO="0367"
363
The once-through steam generator functions :as an efficient
counterflow heat exchanger which delivers superheated steam.
The operating characteristics are such that the steam is produced
at a constant pressure over the entire operating: range from 15 to
100% full power. Higher plant efficiencies result from these
characteristics.
The basic difference in the primary system between the once-
through steam generator design and the other steam.: generator design
used in pressurized water reactor systems, variously known as
recirculating or U-tube generators, is that in the once-through
design the reactor coolant enters the'generator at the top and
the upper tubesheet directs the flow through the tubes toward
the bottom tube sheet which allows the reactor coolant to exit the
steam generator at the bottom. The recirculating or U-tube genera-
tor has its reactor coolant~ enter the generator at the bottom into
its single tubesheet and then go upward through the tubes which
bend in a U-shape at the top of the generator. The coolant flows
through the "U', bends, and returns downward to the bottom of the
steam generator through the same tube sheet and exits the steam
generator at the bottom. The incoming reactor coolant is kept
separate from the exiting reactor coolant through use of a separator.
The basic difference in the secondary systems between the
once-through steam generator and the U-tube or recirculating steam
generator is that in the once-through steam generator the feedwater
is all turned to superheated steam on a single trip through the
generator while in the U-tube, or recirculating steam generator as
the feedwater passes upwards through the tube bundle a part of it
PAGENO="0368"
&64
turns to non-superheated steam and a part of it remains water which
returns down to the bottom of the steam generator to return or
"recirculate~ up through the tube bundle again.
Simplified diagrams of the two types of steam generators
follow as Figures 5 and 6.
While the once-through steam generator in combination with
the secondary feedwater system are generally similar in all the
plants utilizing Babcock & Wilcox nuclear steam systems, there are
differences in the actual feedwater systems because of the utili-
ties' or their engineering firms' different designs. As indicated
previously, the secondary system design and scope of supply in a
nuclear plant are not within Babcock & Wilcox's scope of supply.
The Babcock & Wilcox input to the utility or its engineering
firm with respect to the secondary feedwater system is to specify
requirements of the feedwater in quantity and quality of the water.
Lastly, what are the generic technological implications of
Three Mile Island?
While the incident at Three Mile Island was certainly very
unfortunate and its seriousness should not be minimized, important
lessons have been and will continue to be learned about electric
power generation through the use of nuclear energy.
Three Mile Island has emphasized the importance of the man-
machine interface and the need for translating the designer's
concepts into unambiguous information and instructions for plant
operation. With the advancements in electronic and computer
technology there are three general areas inwhich the man-machine
interface can be improved.~
PAGENO="0369"
365
Once through steam generator
CTOR COOLANT ThLET
~
LOWER TUBESFEET
.REACTOR COOLANT OUTLET
AUX7fl~J~y
FEEDWATER
NflE
TUBE ~mr -
FEEDNATER I?LET
0
48-721 0 - 79 - 24
PAGENO="0370"
366
Recirculating steam geherator
REACTOR COOLANT
INLET NOZZLE
SHROW
C
STEAhI OUTLET NOZZLE
MOISTURE
SEPARATORS
NOZZLE
TUBE BUNOLE
TUBESHEET
REACTOR COOLANT
WTLET NOZZLE
PAGENO="0371"
367
- First, the measurement and display of the actual condition
of vital operational equipment and instrumentation.
- Second, the display of plant conditions in a format to
enhance the operator's awareness of the system condition and
trends or directions in which the system is moving.
- Third, remote visual monitoring of vital plant equipment to
confirm instrumentation indications already available.
In addition to providing better display of plant conditions
for the operator, recording plant conditions and being able to
retrieve these data in graphic display would help with trouble-
shooting and subsequent diagnosis of operational problems by
the plant engineersand designers.
In other words, examine the parameters to be measured or
monitored to assure that actual conditions are displayed. Display
these conditions to the operator in a fashion which is simple to
understand, shows graphically the important data and trends.
Assist the operator in diagnosing unusual conditions and suggest
appropriate corrective measures. And finally, provide him with
back-up remote visual means of confirming the operating status
of vital equipment. Some people have called these suggestions
"human engineering". The crucial lesson of Three Mile Island is
the need to improve the man-machine interface and provide means
of assisting the operator in both the operational and~ administra-
tive aspects of his job.
In conclusion, Babcock & Wilcox continues to be committed
to nuclear power as a means of generating electricity to meet our
nation's needs. While the incident at Three Mile Island was
serious the lessons learned will enable the industry to better
serve the nation in future generations,
PAGENO="0372"
368
Mr. MACMILLAN. In my full statement, I have spelled out at the
beginning the role of the various participants in a nuclear plant-
the utility, the NRC, the engineering firm, and the manufacturer
of equipment, such as Babcock & Wilcox.
As a general rule, the responsibilities of the nuclear steam
system manufacturer, are first to design and manufacture, and
provide the components of the primary system and the reactor
safety system, supporting instrumentation and control, to provide
interface information to the engineering firm for the balance of the
plant, and to provide licensing and startup support to the utilities.
The general responsibilities of the engineering firm or the util~
ity, if they do their own balance of plant engineering, is to coordi-
nate the design of the entire plant.
At Three Mile Island, Burns & Rowe was the engineering firm
on the balance of plant. Their responsibility was to provide the
containment design and the design of the balance of plant-that is,
that part of the plant which is not a part of the nuclear steam
system-and to integrate the various participants work scope in
the overall plant design.
The NRC, of course, reviews the plant designs. and approves
them, issues a construction permit as required by the Atomic
Energy Act prior to commencement of any significant construction,
issues an operating license prior to fuel loading, following its ap-
proval of the final design, establishes criteria and requirements for
licensing of the operators, issues operator licenses, and finally mon-
itors the operation of those plants once they have gone into service.
That very briefly puts into perspective the roles of the major
participants in the design, development, construction, initial oper-
ation of the plants-the utility being the organization that of
course is the ultimate customer and the ultimate operator, ulti-
mate licensee of the plant.
Now, with that background I would plan to go through a brief
description of the sequence of events that happened at Three Mile
Island on the morning of March 28, and then review with you after
that the significance of these, as we see them.
I have brought with me a very simplified chart of the total plant,
which is somewhat different than appears in the prepared testimo~
ny. It is a much more simplified diagram. I would like to use this
as an outline for the discussion of the events.
Mr. MCCORMACK. Good. We can see it very well. It will help us.
Mr. MACMILLAN. You will see in blue what we call the primary
system of a nuclear plant, with the reactor vessel here in the
center, where the reactor core is located.
Coolant circulate, through the reactor core, as you have just seen
a demonstration, going out to the steam generators-in our case
once through steam generator-entering the top of the generators,
flowing down through the generator, exiting at the bottom, being
circulated back to the reactor vessel by two reactor coolant pumps,
two in each loop, and back into the reactor vessel.
On the secondary side of the steam generators, feedwater nor-
mally is fed into the generator, converted to steam in one pass
through the generator, steam then is admitted to the turbine and
in the condenser where the steam is cooled and returned to the
water state, and then pumped back into the steam generator.
PAGENO="0373"
369
In the event where main feedwater is lost, there is an auxiliaiy
feedwater system provided as an emergency backup system. It can
either take suction from condensate storage tanks or from the
main feedwater system, and it is shown here taking suction from
the condenser.
Auxiliary feedwater pumps pump water into the top of the steam
generator, where it can provide for cooling in a natural circulation
mode, and provide for the cooling of the reactor coolant system for
emergency condition.
Shown as a part of the primary sytem is a pressurizer, which has
a surge line coming off the hot leg, or the high temperature leg of
the reactor coolant system. Normally in that system is a water-
steam interface.
The water is maintained at saturated temperature, correspond-
ing to a little over 2,000 pounds per square inch by. electrical
heaters. If the pressure rises to the point of about 2,350 pounds,
there is a pilot operator relief valve which will relieve that
pressure.
That valve discharges into a quench tank wjthin the reactor
building, the quench tank not being shown on this diagram.
There are also safety valves on the top of the pressurizer which
are set to relieve at about 2,500 pounds .pressure. They also vent
into or discharge into the quench tank.
Upstream of the pilot operator relief valve is a block or isolation
valve, put there for the purpose of isolating that relief valve if it
should fail to reseat.
The safety valves do not have isolation valves. They are pre-
cluded from having those by code. The purpose of the pilot operator
relief valve is to open and relieve the pressure without challenging
the safety valves in the event a transient occurs which requires
some pressure relief.
Shown schematically here is a high pressure injection system
which you just heard about. It pumps water into the reactor cool-
ant system at high pressure and provides for emergency core cool-
ing in the event that there is a small break in the reactor coolant
system and emergency cooling is required through the high pres-
sure injection system.
The heat from the condenser is taken out by the green system
shown here, which is in this case showing the use of cooling towers
for the ultimate removal of the low temperature, low energy heat
from the nuclear system.
Now, that is a description of the system. Let me go through the
sequence of events that occurred on the morning of March 28.
At about 4 o'clock in the morning, while operating with equip-
ment, polishing equipment in the. main feedwater system-that
equipment is not shown in this simplified diagram-by a sequence
of events which is still under some review, the net impact of which,
however, was to interrupt the main feedwater flow. The main
feedwater pumps lost suction pressure and under those conditions,
as designed, they shut down.
That interrupted the feedwater flow to the steam generator and,
as designed, in that circumstance, the auxiliary feed water pumps
came on. They are two electric driven pumps, one steam driven
pump, and all three came on.
PAGENO="0374"
370
The turbine tripped, as designed, shutting down the turbine gen-
erator.
The operator testified that he had checked the discharge pres-
sure on those auxiliary pumps and ascertained that the pumps had
come on, and there was pressure in that discharge header. Then he
went about other activities required in the event of loss of feed-
water flow.
Interrupting the flow of feedwater to the steam generator, which
is a normal cooling mechanism for the reactor system, caused the
reactor coolant system to heat up because the reactor is still deliv-
ering heat.
As the reactor system heats up, it expands, and increases the
pressurizer level, the water level in the pressurizer, and that com-
presses the steam at the top of the pressurizer. Within a matter of
about 4 seconds it reached a pressure at which the pilot operator
relief valve opened.
The pressure continued to rise after that, since there was still
more heat being put into the reactor coolant system than was
being taken out in the steam generators, to the point at which the
reactor protective system automatically shut down the reactor,
scrammed the rods, and stopped the fission process.
As Dr. Schoessow said, there continues to be about 10 percent
heat energy from the decay products being put into the reactor
coolant system.
Mr. MCCORMACK. The shut down came at about 9 seconds?
Mr. MACMILLAN. About 8 or 9 seconds. The pressure then did
turn around and decrease, and reached the set point at which the
pilot operator relief valve would normally have reseated.
In this particular case, the valve stuck open, this valve here, the
pilot operator relief valve, and pressure continued to decrease, and
dropped down to a pressure in the range of 1,300 or 1,400 pounds
over the next several minutes.
When the pressure dropped below 1,600 pounds, the emergency
safety systems call for the automatic startup of the high pressure
injection pump. In fact that happened. Those pumps came on. They
started to pump water into the reactor, the reactor coolant system.
Those pumps came on at about 2 minutes into the accident. So
we are still very early in the accident sequence.
Mr. MCCORMACK. This was tripped by abnormally low pressure.
Mr. MACMILLAN. Yes, abnormally low pressure in the coolant
system. Normally you operate over 2,000 pounds. If the pressure
for some reason drops down below about 1,900 pounds, that is low
enough so the safety system will shut the reactor down.
The reactor had already been shut down by high pressure in this
sequence. When the pressure drops down to 1,600 pounds, then the
safety system, recognizing that is an abnormally low pressure,
automatically starts the high pressure injection pumps.
The system pressure continued to decrease because the relief
valve is still open, and still blowing steam, or the combination of
steam and water out of the pressurizer, until it reached a pressure
around 1,300 or 1,400 pounds.
That is the pressure at which you have reached saturated condi-
tions in the high temperature leg of the reactor. At that point, you
PAGENO="0375"
371
start flashing water in the high temperature leg of the reactor and
forming steam in the reactor coolant system itself.
Mr. MCCORMACK. That is because the pressure goes down, and
the temperature is still what?
Mr. MACMILLAN. The temperature in this hot ioop is still up
around 575°.
Mr. MCCORMACK. So at that temperature, in dropping down to
1,300 pounds, it causes the water to flash to steam.
Mr. MACMILLAN. That is correct. In the hot leg of the reactor
system.
Now, during this time the pressurizer level fluctuated and start-
ed to increase. As the level approached the full pressurizer, the
operator apparently cut back on the high pressure injection flow,
emergency pump operation here, in order to maintain pressurizer
level.
This is now about 3 minutes into the accident.
Mr. WYDLER. I don't understand that. Why would the pressure
start to increase? That is still open, isn't it?
Mr. MACMILLAN. This valve is still open. But remember, we are
still in a situation-I forgot one very important item, I am sorry.
The auxiliary feedwater pumps came on, as I indicated, right at
the early part of the incident. But auxiliary feedwater was not
allowed to flow to the steam generator because of closed block
valves.
This closed valve right here precluded the auxiliary feedwater
from reaching the steam generator. So in the first 8 minutes of the
accident there was no auxiliary feedwater to the steam generator.
Therefore, there was no means of taking heat out of the reactor
coolant system, and the reactor coolant system continues to in-
crease in temperature, to increase therefore in volume, continues
to pressurize in the reactor pressurizer here, and the pressure was
going up.
That is when the pilot operator valve opened, pressure decreased,
and since this valve is still open, it continues to relieve water from
the reactor, steam from the pressurizer.
What is happening, and the reason the level apparently is in-
creasing, as you form steam in the reactor hot leg you get a steam
bubble in the hot leg which forces water up into the pressurizer,
and makes it look as though the pressurizer level is increasing.
In fact, the pressurizer, from all the evidence we have, was full
of water at this point. But there was steam being formed in the
reactor coolant system.
Mr~ WYDLER. I can understand why it is getting hotter. I don't
understand why the pressure was building up.
Mr. MACMILLAN. The pressure is not building up.
Mr. WYDLER. You just said it did and gave a signal to one of the
men in the control room, so that he started another procedure.
Mr. MACMILLAN. No. The pressurizer level was increasing. The
level at which--
Mr. WYDLER. Not the level of pressure.
Mr. MACMILLAN. The level of water in the pressurizer was in-
creasing. He was monitoring that pressurizer level. As he saw that
pressurizer level go up, apparently he cut back on the high pres-
sure injection, in order to keep that pressurizer from becoming full.
PAGENO="0376"
372
Mr. ERTEL. If the gentleman would yield for a second.
Mr. WYDLER. If you just let me finish this. You say these two-
the original pump shut down and the auxiliary pump went on. But
even though it was on, it wasn't pumping any water because the
valve was closed.
But there was nothing to indicate to anybody that no water was
going in, right? It just says the pump is running. You have some-
thing that says the pump is~ running, but you don't have anything
that says water is flowing. Is that the way the system works?
Mr. MACMILLAN. Normally, the indication that water would be
flowing would be the level of water in the steam generator. You
would expect to see as the auxiliary feed water comes on, you
would expect to see the level come up in the steam generator.
Ultimately, the operator recognized that situation and at that
point realized that the block valves were closed and at 8 minutes
into the incident, he opened those block valves with operators--
Mr. WYDLER. You said there was water coming in on this side,
the blue system, the primary system. You said water was coming
in there.
Mr. MACMILLAN. There is water coming into the reactor coolant
system through the high pressure injection phase.
Mr. WYDLER. So it was receiving water.
Mr. MACMILLAN. It was receiving high pressure injection water.
But it was not receiving any cooling water on the secondary side of
the steam generator.
Mr. ERTEL. You have two isolated systems.
Mr. WYDLER. The blue system puts the water in the reactor
vessel, doesn't it?
Mr. MACMILLAN. Let me go back again and say this.
The blue system is a closed circulation system which circulates
water normally at about 2,000 pounds pressure through the reactor
core, through inside the tubes in the steam generator, and back
into the reactor core. It is a closed circuit.
Mr. WYDLER. That is putting the water in the reactor core.
Mr. MACMILLAN. Normally that water is circulated through the
reactor core by the reactor coolant pumps themselves.
Mr. WYDLER. And that system was on.
Mr. MACMILLAN. That system was on. Water was circulating
through the steam generator and the reactor core. However, there
was no water on the secondary side of the steam generator.
They had, at one point in the event, essentially boiled dry, and
there was no water coming in here so that it could be converted
into the steam and remove heat from that steam generator.
Mr. WYDLER. The only thing-and then I will yield to the gentle-
man-the only thing that I was trying to get clear in my mind was,
because we have heard that the core-we are just talking about the
core-it was uncovered at some point.
Maybe you will get to that. I don't understand that because
apparently there was a system on and open which was putting
water in the core.
Mr. MACMILLAN. OK. I think I will get to that.
Mr. MCCORMACK. The gentleman from Pennsylvania?
Mr. ERTEL. Thank you, Mr. Chairman.
PAGENO="0377"
373
You made a statement that apparently he felt that the water
level was going up in the pressurizer and, therefore, believed that
there was enough water in the system.
Is there any indication of how he could have read that any other
way? Would there have been an analysis he could have gone
through to determine, in fact, that was not happening, that he was
creating steam somewhere in that core or in the leg there up to the
pressurizer?
Is there any way he could have analyzed that on that basis, at
that time, to understand the process that was going on?
Mr. MACMILLAN. He has other instrumentation available to him
which would have indicated that he had approached saturation
conditions in the reactor coolant system, and I think the most
significant one is the reactor coolant system pressure itself. The
reactor coolant system pressure was continuing to fall during this
period and, as I say, dropped as low as 1,300 to 1,400 pounds per
square inch, which is abnormally low.
Mr. ERTEL. There is no way to read that out specifically what the
water level is in the reactor vessel itself?
Mr. MACMILLAN. There is no water level indicator in the pres-
sure vessel.
Mr. ERTEL. In the pressure vessel or you are talking about the
reactor vessel? There is a direct readout of the water level in the
pressurizer, is there not?
Mr. MACMILLAN. There is a direct indication of water level in
the pressurizer, but there is no indication of water level measure in
the reactor vessel.
Mr. ERTEL. So what he has to do is go backward. He has to read
the other things, put them together and then determine as a result,
a deductive process, what the water level would be in the reactor
itself.
Mr. MACMILLAN. In a situation where he has sufficient pressure
in the reactor system so he has subcool conditions, the pressurizer
level is a clear indication of the water level in the reactor coolant
system.
When he gets to conditions where he has saturated pressure and
temperature in the reactor coolant system, such as in the hot leg
here, because the pressure has dropped way down, is abnormally
low, then that level indication in the pressurizer is no longer a
valid indication of the water level in the reactor coolant system.
Mr. ERTEL. Were there any written instructions to indicate to
him that he should be able to analyze that?
Obviously, sitting here doing it very calmly as you and everybody
else is doing, it is pretty easy to analyze this series of events. Now,
was there any written documentation, any kind of emergency pro-
cedure by which he could have put those things together?
Mr. MACMILLAN. There are emergency procedures which have
been written and which describe the symptoms of a small break in
reactor coolant system, and those systems would be similar to those
that we--
Mr. ERTEL. That was the next question; is there any difference
between the relief valve not reseating and a small pipe break
anywhere in the system, especially around the pressurizer, in that
area; is there any difference?
PAGENO="0378"
374
Mr. MACMILLAN. There are differences, depending on where that
break occurs. The small break procedure is intended to cover the
break regardless of location.
Mr. ERTEL. Therefore, if he followed the small break procedure it
may have been different, depending where. In fact, the relief valve
had not reseated, because he would* not know where particularly
that event took place. The relief valve not reseating is the same
thing as a small pipe break; is it not?
Mr. MACMILLAN. That is correct.
Mr. ERTEL. Therefore, depending on where it is in the system, is
there a different procedure to be followed?
Mr. MACMILLAN. No, the procedure is the same regardless.
Mr. ERTEL. So he should have followed a standardized procedure
in~ this event?
Mr. MACMILLAN. This event is covered by the small break proce-
dure, and in addition to that there is a procedure for the circum-
stances where the pilot operator relief valve fails to reseat, and so
he had that procedure available also to indicate.
Mr. ERTEL. There is a condition when it fails to reseat; how does
he know it does not reseat?
Mr. MACMILLAN. The indications on the failure of the relief
valve to reseat are primarily a thermocouple on the pipe which
leads from the relief valve to the quench tank which, when its
temperature exceeds 200 degrees he gets an alarm and that is an
indication that the valve is open.
In addition to that, in the quench tank there are pressure and
temperature monitors and alarms which indicate that he is con-
tinuing to put energy into that tank and that one of his safety
valves-either the safety valve or pilot operator valve-has failed
to reseat.
Mr. ERTEL. I have gotten the warning we are out of time.
Mr. MCCORMACK. I know we could sit here all day and ask
questions only of Mr. MacMillan, but we do have quite a number of
witnesses and we do have to move along.
Mr. MACMILLAN. I believe I was at the* point in the sequence
where the operator apparently cut back the high pressure injection
flow to maintain pressurizer level.
As .time progressed without additional water entering the reactor
coolant sytem and pressure continuing to drop, primary coolant
water began to flash to steam. The reactor coolant pumps then
began to operate erratically.
Two pumps in the B-loop, that is the loop shown on the left here,
were turned off at 73 minutes and two pumps in the A loop were
turned off at about 100 minutes into the accident.
After that, with forced circulation terminated and emergency
core cooling through high pressure injection reduced by operator
action, all the evidence seems to indicate-and this is about 2
hours into the accident-that the water boiled out of the reactor
core and that the core temperatures increased at that point caus-
ing the zirconium fuel cladding to oxidize and generate hydrogen,
which was, of course, the source of the much publicized gas bubble
in the primary system.
Mr. MCCORMACK. Excuse me. You say boil out. Did it boil part
way down, the fuel, do you know?
PAGENO="0379"
375
Mr. MACMILLAN. We don't know for sure how far it boiled down.
The indications are that the major part of the core was uncovered
and it boiled down so that the water level in the core was down in
the lower third to lower quarter of the core, and the upper portion
of the core was then just sitting in the steam.
Mr. MCCORMACK. Steam at 1,300° or pounds pressure?
Mr. MACMILLAN. At 1,300°. Actually, the pressure at this time
was a little bit lower than that.
Ultimately, through a combination of advice from various
sources, including B. & W., high pressure injection was re-estab-
lished at a sufficient flow, pressure was brought up in the system,
and a reactor coolant pump was put back into service.
The last of these actions was not completed until almost 16 hours
after the accident began. It was at that time that a cooling configu-
ration was established which was maintained for a matter of sever-
al days while everyone concerned looked at the total picture of hOw
to recover from that situation and get into a long-term cooling
configuration.
That's a brief overview. I would hope it would be a brief overview
of the sequence of events, Mr. Chairman. Let me just identify the
significant factors as we see them in the sequence, as a wrap-up.
First, after the loss of feed water occurred, two closed isolation
valves prevented auxiliary feed water from reaching the steam
generators; that was the step I left oUt, unfortunately, in the early
description of the incident. They remained closed in excess of 8
minutes.
This eliminated the capability of the steam generator to remove
heat from the reactor coolant system and resulted in a correspond-
ing increase in reactor coolant system temperature and pressure
and diminished the ability of the plant to promptly stabilize reac-
tor coolant system temperature and pressure, as designed.
Mr. MCCORMACK. When did the reactor shut down, how far into
the accident?
Mr. MACMILLAN. About 8 or 9 seconds into the accident.
Mr. MCCORMACK. Why was not the steam generator on one side
then able to handle the cooling, the one still functioning?
Mr. MACMILLAN. Both steam generators were functioning at this
time, but the turbine had tripped.
Mr. MCCORMACK. But on the other side, ignoring the right hand
side, you have shown that on the other side, there was still a
completely intact secondary cooling system, haven't you?
Mr. MACMILLAN. Well, the auxiliary feedwater system does not
show in the diagram. It feeds both steam generators.
Mr. MCCORMACK. Does the main system, main feed pump feed
both steam generators?
Mr. MACMILLAN. Yes.
Mr. MCCORMACK. So that failure in the main feed pump then
cuts off both steam generators?
Mr. MACMILLAN. Yes, sir.
Mr. MCCORMACK. So here's an area where we would probably
suggest redundancy, separate systems.
Mr. MACMILLAN. There are elements of redundancy in the
system. There are two feed pumps, there are two feedlines. The
difficulty was that between the condenser and feedwater there is a
PAGENO="0380"
376
point at which there is one condensate polishing or feedwater
treatment system, and that was the source of the initial cutoff of
the feedwater flow.
Mr. MCCORMACK. Why did the main feed pump fail?
Mr. MACMILLAN. It didn't fail; it shut down because it lost its
suction pressure, and it lost its suction pressure because the flow
from the condenser to that feed pump was interrupted.
Mr. MCCORMACK. Why?
Mr. MACMILLAN. I am not sure I can answer that in detail. It
involved a series of operations that were going~ on at the time in
the operation of the condensate polishing equipment which cleans
up the water coming out of the condensers before it gets to the
steam generator.
Mr. MCCORMACK. Some sort of special maintenance?
Mr. MACMILLAN. I think you would put it in the class of mainte-
nance, yes.
Mr. MCCORMACK. In other words, the maintenance operation was
the primary cause of the main feedwater system to fail. The first
incident, the first malfunction was the main feed pump or the
main feedwater system, and that was caused, you believe, by some
maintenance, something in the operation that was going on?
Mr. MACMILLAN. There is evidence maintenance operations in
the condensate polishing equipment was the initiating event that
interrupted the feed flow, which subsequently caused the feed
pumps to trip off the line.
Mr. MCCORMACK. The pump itself did not fail?
Mr. MACMILLAN. No, sir. The pump stopped when it lost its
suction pressure, which is the way it is designed to perform
Mr PEASE Mr Chairman, would you yield7
Mr MCCORMACK Yes
Mr. PEASE. I would just like to pursue that point a moment. Was
the maintenance work that was being done on the condensate
polisher in progress at the time or is it something that had been
done jn recent weeks or recent days?
Did someone leave a blockage in the pipe, or what happened?
Mr.~ MACMILLAN. That was work in progress at the time, just
prior to 4 o'clock in the morning on March 28.
Mr. PEASE. I see.
Thank you.
Mr. ERTEL. Mr. Chairman, will you yield on that point?
I wonder, you say you have not been able to identify exactly
what happened in either the condensate pump or what mainte-
nance they were doing. Has anybody other than you?
Mr. MCCORMACK. I would like to request we get that question
from utility operators. They will he the ones responsible for that
part of it.
Mr. ERTEL. I am asking if they did do that or somebody has got
it.
Mr. MACMILLAN. My suggestion is that information should be
supplied by the operator.
Mr. ERTEL. Do they have it, do you know?
*Mr. MACMILLAN. I don't know.
Mr. MCCORMACK. The next witness?
PAGENO="0381"
377
Mr. WYDLER. Could I just get one thing clear in my own mind:
This maintenance was actually in progress at this time, at 4 o'clock
in the morning; there was something going on with maintenance?
Mr. MACMILLAN. Yes; they were working on the condensate po-
lishing equipment just before ,4 o'clock in the morning. I am not
trying to dodge the question. I simply don't know the detailed
sequences that the operators were going through that was the
initiating event which caused the interruption in the feedwater
flow, and I am sure that information is available. I just don't
happen to have it.
Mr. MCCORMACK. Go ahead, Mr. MacMillan.
Mr. MACMILLAN. The first item was interruption of the auxiliary
feedwater flow that did interrupt flow to both of the steam gener-
ators so neither steam generator had feedwater flow going into it.
Second, as a result of the initial reactor coolant system pressure
and temperature increase, the pilot-operated pressurizer relief
valve opened as designed, but did not reseat properly, thus allow-
ing reactor coolant system pressure to continue decreasing.
After approximately 21/4 hours, the operators recognized the data
from plant instrumentation which indicated that the valve was
open, and closed the block valve in the relief valve discharge line,
thus preventing any further loss of primary coolant from the reac-
tor.
The third significant factor, the high pressure injection system,
which had automatically actuated, as designed, on low reactor
coolant system pressure, was prematurely terminated by the opera-
tor even though there were simultaneous indications of an opening
in the reactor coolant system pressure boundary, such as increas-
ing quench tank pressure, decreasing reactor coolant system pres-
sure and increasing reactor containment pressure.
This led to a diminished capability to cool the reactor core as
primary coolant inventory diminished. Subsequent analyses have
indicated that there would not have been core damage or signifi-
cant radioactive contamination and release if the operators had left
the high pressure injection pumps in service to perform the core
cooling function for which they were intended. You saw a demon-
stration of that a little bit earlier this morning.
Fourth, the containment isolated in accordance with the licensed
design. That design was such that it permitted the transfer of some
radioactive water from the bottom of the containment vessel into
the auxiliary building and subsequent radiation released occurred
from that source.
Mr. WALKER. Mr. Chairman, could I interrupt?
When did that occur in the sequence you are talking about?
That's where most of the radiation that the public was exposed to
came from. Where did that occur and was that a part of a proce-
dure that would normally go into operation of your plant?
Mr. MACMILLAN. I can get a specific time for you. Perhaps I can
look up the specific time and get that answer, but it did occur in
the early hours of the incident.
The sump pump in the reactor building transfer water from the
containment into the auxiliary building when the sump level in-
creases to the point where that pump turns on.
PAGENO="0382"
378
That sump line ultimately was isolated when the reactor build-
ing pressure increased to 4 pounds, and the building containment
isolation system came on as designed.
Mr. WALKER. So, in other words, this was a part of the inherent
design of the plant that allowed the radioactive water to move
outside of containment?
Mr. MACMILLAN. This particular piece of equipment or pieces of
e4uipment performed as designed, and I think the significance~ of
this item is the necessity to reassess the containment isolation
philosophy, on the conditions under which I would call our isola-
tion of the reactor building.
Mr. WALKER. Isn't that somewhat of a design flaw we ought to
correct to make. sure any radioactive water remains in contain-
ment instead of being pumped out?
Mr. MACMILLAN. That is something we need to reassess and
modify.
Mr. WALKER. Thank you, Mr. Chairman.
Mr. MCCORMACK. Go ahead, Mr. MacMillan.
Mr. MACMILLAN. Fifth, high pressure injection was evidently
manually operated based on high pressurizer level indication. We
have conducted reviews of data from Three Mile Island and per-
formed analyses that lead us to conclude that the indicated pres-
surizer level was not significantly in error.
There was some discussion early after the accident that there
was erroneous pressurizer level indication. Our own investigation
would indicate that, in fact, the instrumentation indicated the
pressurizer level was, in fact, indicating the amount of water that
was in the pressurizer.
Consequently, operation of high pressure injection flow should
not have been based on the single parameter of pressurizer level.
Finally, in addition to two reactor coolant pumps having been
shut off at 73 minutes, the remaining two reactor coolant pumps
were shut off at 100 minutes after the initiation of the incident.
Although shutting off one reactor coolant pump in each loop in
response to indications of low coolant flow may be advisable, shut-
ting off all pumps under the circumstances then present is believed
to have caused an uncovering of the core and a degradation in core
cooling capability.
Ultimately, at about 15 hours after initiation of the transient,
the reactor coolant system was repressurized, and at about 16
hours a reactor coolant pump was restarted. In looking at these six
factors we developed a set of four basic principles which we believe
merit emphasis in considering any future action.
First, renewed emphasis must be placed in the near term on
administrative controls to assure that plant systems important to
safety are not defeated. In the longer term, consideration should be
given to whether plant systems to augment those administrative
controls should be developed and implemented.
Second, renewed emphasis must be placed on maintaining the
individual operator's focus upon the fundamental physical process-
es which assure core cooling, and on insuring that systems comple-
ment or increase the likelihood of maintaining that focus.:
Third, operator training programs must be reassessed and up-
graded to emphasize these fundamentals.
PAGENO="0383"
379
Fourth, any actions or modifications implemented must be con-
sidered in the broader context of total plant safety. Hasty and ill-
considered actions, which might be partially responsive to the
TMI-2 events could, in certain cases, produce adverse impacts in
other safety systems which were not involved at TMI-2.
So we need to look at a total system impact of any changes that
are made in the equipment.
Now, Mr. Chairman, I know we are running way behind sched-
ule. I had planned at this point to talk about the steam generator
and unique characteristics and compare it with the recirculating
generator. I will be glad to do that, but it would take some addi-
tional time.
Mr. MCCORMACK. Would you mind waiting a little while? If you
can stay around until noon we might get back, but we have to hear
the other witnesses.
Would you mind; we will improvise our schedule.
Mr. MACMILLAN. Perhaps I ought to move quickly to the closing
observations which are directed at the question of technology impli-
cations of the Three Mile Island accident. My comments are ad-
dressed primarily at those aspects of the accidents which are in-
volved in the prevention, to some extent mitigation, but certainly
not recovery. It's too early I think to address the recovery implica-
tions of the Three Mile Island incident.
While the incident at Three Mile Island was certainly very un-
fortunate and its seriousness should not be minimized, important
lessons have been and will continue to be learned about electric
power generation through the use of nuclear power.
Three Mile Island has emphasized the importance of the man-
machine interface and the need for translating the designer's con-
cepts into unambiguous information and instructions for plant op-
eration. With the advancements in electronic and computer tech-
nology there are three general areas in which the man-machine
interface can be improved.
First, the measurement and display of the actual condition of
vital operational equipment and instrumentation. We talked earli-
er about perhaps the desirability of having a reactor vessel water
indicator. That is perhaps an area where there might be some
desirable work to be done.
Second, the display of plant conditions in a format to enhance
the operator's awareness of the system condition and trends or
directions in which the system is moving.
Clearly, an example would be something which would indicate to
him very clearly and very vividly the temperature and pressure
conditions in his reactor system, and whether he is approaching a
saturation condition that might generate steam in the reactor cool-
ant system.
Third, remote visual monitoring of vital plant equipment to con-
firm instrumentation indications already available.
In addition to providing better display of plant conditions for the
operator, recording plant conditions and being able to retrieve
these data in graphic display would help with troubleshooting and
subsequent diagnosis of operational problems by the plant engi-
neers and designers.
PAGENO="0384"
380
In other words, examine the parameters to be measured or moni-
tored to assure that actual conditions are displayed; display these
conditions to the operator in a fashion which is simple to under-
stand; show graphically the important data and trends; assist the
operator in diagnosing unusual conditions and suggest appropriate
corrective measures and, finally, provide him with back-up remote
visual means of confirming the operating status of vital equipment.
Some people have called these suggestions "human engineering."
The crucial lesson of Three Mile Island is the need to improve
the man-machine interface and provide means of assisting the
operator in both the operational and administrative aspects of his
job.
In conclusion, Babcock & Wilcox continues to be committed to
nuclear power as a means of generating electricity to meet our
Nation's needs. While the incident at Three Mile Island was seri-
ous the lessons learned will enable the industry to better serve the
Nation in future generations.
That concludes my comments, Mr. Chairman, and I will be
happy to stay here if it's your desire to discuss the generator later.
Mr. MCCORMACK. With the indulgence of the members, I would
like to hold off a discussion of the questions of the design, capacity
of the steam generator until after we have heard the testimony of
the other witnesses, and then we can have a special discussion on
that point alone, because that may take some special time.
So I am going to bypass my questions on whether the B. & W.
design is too much of a hot rod, whether there is too little water in
the system, whether the once-through system is adequate, and so
on.
Let me ask a couple of other questions very directly, and ask for
quick answers, if I may.
One of the problems that seems to have occurred is that with the
high pressure injection system running we eventually were flood-
ing the receiver tank, or whatever it is downstream from the relief
valve, this was filling up the bottom of the containment vessel, and
this tripped the sump pump and pumped out the water over to the
red waste building.
Water somehow or other was exposed to the ventilating system
in the waste building, getting the Xenon-133 out through the venti-
lating system.
What I don't understand is why in the world there was not a
large enough receiving tank inside the containment vessel to re-
ceive the water from the high pressure injection system so it would
have all been contained there and there would not have been any
need to pump it out of the building.
What is the volume? How long can the high pressure injection
system run under normal conditions without being interrupted
before it overflows the receiving tank inside containment?
Mr. MACMILLAN. Well, under normal conditions, of course, the
pilot operated or relief valve would have closed~ and that would
have kept the pressure up, and there would not have been a
necessity for high pressure injection.
However, accepting the condition that the pilot operated relief
valve stayed open, the quench tank is designed to receive the
PAGENO="0385"
381
discharge from that valve or the safety valves and to quench that
for some period of time, and I don't know what that period is.
Mr. MCCORMACK. Well, given the fact we have had a situation
now where we have actually both steam generators off, presumably
because we had splashing steam in the system and the pumps were
turned off so we were pumping water right through the reactor
into a quench tank, it strikes me this scenario calls for re~~evalua-
tion of the volume of the quench tank.
Mr. MACMILLAN~ Normally what would be done in this circum-
stance is that you would pump the high pressure injection into the
reactor coolant system, wOuld go into the quench tank and the
quench tank can only take so much water, and then it will open
up.
The intent of the system would be for that water to collect in the
bottom of the reactor building and should be retained there. The
difficulty in this sequence of events was water was pumped out of
the bottom of the reactor building and into the waste tank and
ultimately on the floor of the auxiliary building.
It is not intended that the quench tank would be able to accom-
modate the full capacity of the high pressure injection pumps. For
example, a small break may occur some other place in the system
which would not have access to the quench tank and the water
would then spill out on the floor of the reactor containmnent and
again would be expected to be retained there.
Mr. MCCORMACK. Yes, Dr. Roy?
Dr. Roy. I was just going to add that ultimately that water that
is spilled to containment and maintained in the sump and will be
recirculated back to cool the core.
Initially, the high pressure injection system will take suction
from the large storage tank in supplying the water and then ulti-
mately when that storage tank is exhausted then the source of
supply to the high pressure injection system will be from the sump,
the water.
Mr. MCCORMACK. Is that clean enough to pump back through the
reactor?
Dr. Roy. Yes, sir.
Mr. MCCORMACK. OK.
I have two quick questions.
Who trains the operators for B. & W. plants?
Mr. MCMILLAN. The operator training program is an extensive
program involving classroom training and then simulator training
and then on-site training, and we perform a segment of that total
training program.
Mr. MCCORMACK. You do part of it?
Mr. MACMILLAN. We do the simulator training for the operators.
We do offer the broader spectrum, but in the case of Three Mile
Island it was the simulator training.
Mr. MCCORMACK. Then the utility does the rest; is that right?
Mr. MACMILLAN. Or someone they would hire to do that; yes.
Mr. MCCORMACK. We don't have a standard for training opera-
tors in this country?
Mr. MACMILLAN. Each utility develops its own training program.
Mr. MCC0RMACK. Generally, is B. & W. exploring the possibility
of dramatically improving various pieces of equipment, such as
48-721 0 - 79 - 25
PAGENO="0386"
382
those that failed in this particular incident, such as the pressure
release valves and those that did not provide adequate or provided
confusing information?
Is there an attempt now to review the whole concept, first of all
being certain that valves will work, that equipment will work,
being certain~ that the operators know whether it has worked or
not and being certain that the operator has all of the information
he needs easily understandable before him, in any sort of an anom-
aly?
Mr. MACMILLAN. Let me answer that in two parts, Mr. Chair-
man.
First of all, the piece of equipment which failed to perform was
the pilot operated relief valve, and we are working with the sup-
plier of that valve to enhance the probability of its performing its
function.
The other question with respect to the instrumentation and the
information available to the operator, yes, we are working on that.
We are developing a technique by which we can indicate the actual
position of the relief valve or that indicates unambiguously wheth-
er it is opened or closed.
We are working on other instrumentation systems which will
give the operator a clear indication of the temperature and pres-
sure conditions in his reactor coolant system and alert him to the
possibility that he may be approaching saturated conditions in that
system.
Mr. MCCORMACK.' Thank you.
Mr. Wydler?
Mr. WYDLER. You are going to try to have some sort of notifica-
tion device to know if the valve is not only opened but that it is
closed again, and that will be part of what you are going to do so
you know that fact.
Is that what you just said?
Mr. MACMILLAN. Yes, sir.
Mr. WYDLER. I am intrigued with this auxiliary feed pump being
shut off. I mean that seems to me like an almost unbelievable
thing for somebody to do and leave like that. Yet, I am reading
here about something that happened in 1975, apparently the exact
same thing took place, some plant operator turned off the very
same valves.
The manually operated water supply valve, two auxiliary feed-
water pumps were shut and they didn't have a supply of water.
Because that is a manually operated valve, there was no control
panel indication that the valve had been closed. At least the one
auxiliary feed water pump must operate to remove heat, and so on.
Now, that was the exact same thing that happened here, wasn't
it?
Mr. MACMILLAN. I am not familiar with that particular situa-
tion. ~
Mr. WYDLER. Calvert Cliffs, unit 1, Lusby, Md., December 1975.
Mr. MACMILLAN. I would say, as you have read the description of
events there, I don't believe it is exactly comparable. The isolation
or block valve in this auxiliary feedwater system is indicated in the
control room and can be operated from the control room, and was
operated and opened up 8 minutes into the incident. So it was not
PAGENO="0387"
383
a case of some manual valve having been closed without the opera-
tor's awareness.
These valves are indicated in the control room and can be
opened from the control room.
Mr. WYDLER. So you mean to say that everybody knew then-we
were told this was something that they found out after a while-
that somebody had turned these valves off. Literally they had done
it intentionally and it was done and there was a constant indica-
tion they were shut at the time the accident took place; is that
what you are saying?
Mr. MACMILLAN. I don't believe I said they knew they were shut.
What I said was the position of the valves are indicated in the
control room and the operator did not recognize until about 8
minutes into the accident that they were, in fact, closed rather
than being open as they should have been, and at that point he did
take the action to open up those valves.
Mr. WYDLER. There is one other case here I was reading about, a
situation where apparently-have you been shown at any time this
report that was written on January 8, 1979?
A Commission inspector complained about the Babcock & Wilcox
designed nuclear plants, wrote a report about it and insisted that
the report be made public. He said that there were basic safety
problems with your design. This was a regional inspector; have you
ever seen this report?
Mr. MACMILLAN. Could you identify it more specifically?
Mr. WYDLER. January 8, 1979; I don't know why it's written in
these very vague terms, but here's the information I have. A Com-
mission inspector, unidentified, wrote a memorandum on January
8, 1979, stating there appeared to be generic safety problems with
Babcock & Wilcox designed nuclear plants. The regional inspector
asked that his memorandum be forwarded to the Atomic Safety
and Licensing Board.
Have you ever seen that memorandum?
Mr. MACMILLAN. I don't recognize it by that description.
Mr. WYDLER. Have you, Dr. Roy?
Dr. Roy. No, sir.
Mr. WYDLER. I understand it was brought to the attention of the
operators of Three Mile Island the day after the accident, which
would have been a little late. I am surprised that you gentlemen,
even at this date, have never seen or heard of this report.
I am told on March 6-that was the date of the accident-finally
after a lot of pressure was put on a lot of people, a Commission's
Assistant Director for Light Water Reactors also recommended
that those atomic safety and licensing boards with jurisdiction over
Babcock & Wilcox designed plants be informed of the regional
inspector's safety concerns.
He specifically recommended that the board for Three Mile
Island powerplant be informed.
Mr. MACMILLAN. I think I have identified the memo that you are
referring to, Congressman. I believe this is a report by a reactor
inspector named J. S. Creswell, in a memorandum he addressed to
NRC.
Mr. WYDLER. You know more than I do. That's probably so.
PAGENO="0388"
384
Mr. MACMILLAN. That's why I was having trouble identifying it.
This is dated January 8, 1979, and the subject was conveying new
information to licensing boards, Davis-Besse 2 and 3 and Midland
units 1 and 2.
Those four units are under construction and they do incorporate
Babcock & Wilcox nuclear steam systems, and we have seen that
letter and we have responded to that letter as it is applicable to
Three Mile Island.
Mr. WYDLER. When did you respond?
Mr. MACMILLAN. We ought to get you a more detailed break-
down of that.
The letter Mr. Creswell wrote referred to a rapid cooldown which
occurred at the Sacramento Municipality Utility District at Rancho
Seco District, which is the background for which he raised his
concerns. I am prepared to tell you, if you want to know, how they
would respond to that cooldown and what its applicability was to
Three Mile Island.
Mr. WYDLER. I am asking when was the report brought to your
attention and when did you respond to it?
Mr. MACMILLAN. I am not able to identify, Congressman, that
this was brought to our attention, this particular Creswell letter
was brought to our attention. We were aware of that because it
was made public. We recognize that it was referring to the earlier
incident at the Sacramento unit.
We were responsive to that earlier incident at the Sacramento
unit and had alerted our operators to the problem that developed
there, and had discussed the implications of that with the people at
Three Mile Island.
Mr. WYDLER. I am going to have to get off this topic, but I just
would like to know, have you a copy of the report? Does your
company have a copy of the report? Have they made an answer to
it?
Mr. MACMILLAN. We have a copy, but I don't believe we have it
because it was brought to our attention through the normal licens-
ing channels.
Mr. WYDLER. In other words, you have never been officially
informed of it; is that what you are telling me?
Mr. MACMILLAN. I believe that is the case. I can confirm that.
Mr. WYDLER. Well, would you and would you make available for
the record the copies of the report and any memorandum or an-
swers that you made to it?
Mr. MACMILLAN. Yes, sir.
Mr. WYDLER. And if you would, if it's not apparent on the face of
the document, would you give me a time sequence of these items, if
it is not otherwise apparent from the documents you are going to
supply?
Mr. MACMILLAN. Yes, sir.
Mr. WYDLER. All right.
Thank you, Mr. Chairman.
[The information follows:]*
Mr. MCCORMACK. Thank you, Mr. Wydler.
*This information is provided in Mr. MacMillan's letter to Congressman Wydler of May 29,
1979. A copy of this letter is included in the Appendix "Questions and Answers for the Record",
for May 23, 1979.
PAGENO="0389"
385
This particular series of questions and answers raises the point
that there will undoubtedly be questions submitted~ in writing to
Mr. MacMillan, and I assume you will be prepared to answer them.
Mr. MACMILLAN. Yes, sir.
Mr. MCCORMACK. Mr. Ertel, do you have any questions?
Mr. ERTEL. Thank you, Mr. Chairman.
Mr. MacMillan, on page 12 of your testimony you indicated as
one of the significant events, the second one you said:
After approximately 2¼ hours the operators recognized data from plant instru-
mentation which indicated the valve was opened, including quench tank rupture at
17 minutes, and closed the block valve in the relief valve discharge line, thus
preventing any further loss of primary coolant.
Can you give us any reason it would take 2¼ hours if there were
proper instrumentation to read out that line was open, why it
would take 2~/4 hours to recognize that relief valve had not reseat-
ed?
Mr. MACMILLAN. I think I commented earlier on one of the
questions that the evidence that was available to the operator that
the valve was open included a thermocouple on the discharge
piping from the valve that goes to the quench tank, the quench
tank pressure and level, which is alarmed, and indicated on a
panel in the control room.
Mr. ERTEL. It indicated it was over-full, did it not, that the water
level was high?
Mr. MACMILLAN. Yes, sir, and should have been a clear indica-
tion that there was energy being discharged and water, steam
being discharged, through this tank on a continuing basis.
Mr. ERTEL. I guess that the next question would follow on: The
simulator which you use, ançl I think you have one at Lynchburg,
Va., on which you train the operators, is~there any training there
to show that by utilizing both the temperature readout and the
quench; thaj. there is too much water, if you want to call it that, in
the pressurizer, what you should do?
Do you have a training program on it?
Mr. MACMILLAN. The simulator in Lynchburg is capable of simu-
lating th~ condition of an open pilot operated relief valve and that
is one of the equipment failures which we do simulate in the course
of the training of the operators.
Mr. ERTEL. So you would say that he should check both the
temperature and the water level in the pressure?
Mr. MACMILLAN. In the quench tank.
Mr. ERTEL. So that he would have that training and he should
know that, the proper procedure to follow?
Mr. MACMILLAN. He had been through that and he had a proce-
dure available to him for that purpose, yes.
Mr. ERTEL. Do you have any idea how long prior to this accident
this operator had gone through that training program with the
simulator?
Mr. MACMILLAN. I don't know specifically.
Mr. ERTEL. I know I have a lot of questions but I want to turn
now to page 13, the fourth item:
"The containment isolated in accordance with the license
design." It's my understanding that the purpose of the NRC, at
least some of their ideas are to make sure that there is a contain-
PAGENO="0390"
386
ment and none of the radioactive material gets outside of the
containment building.
Now, is that a policy of the NRC and if so, why would they
license a design which would allow for the escape of radioactive
material to the atmosphere?
Mr. MACMILLAN. Let me say that it is certainly the intent of the
containment building to contain the contents of an accident that
might develop in a reactor coolant system and keep that radioactiv-
ity in the reactor building. As I indicated earlier, clearly the design
basis for this containment isolation system needs to be and will be
re-evaluated.
Mr. ERTEL. I don't think that is really a response to the question.
Why would they give a license if their policy is to have a contain-
ment? That is what a containment building is for, it seems to me,
is to contain and isolate.
Then do you know how you got your license application through
with a license design which would allow escape into the atmos-
phere if the policy says there should be a containment?
Mr. MACMILLAN. Well, the containment was designed to isolate
when the containment pressure got up to 4 pounds. Now that
would normally occur if there were a moderate to large size coolant
system break. In this particular case, the break was very small and
the pressure did not build up to that level for some time into the
incident and it was during that time when the water was trans-
ferred.
So I think that I would have to speculate that the line of think-
ing at the time was that in the event a loss of coolant accident the
building pressure will go up to 4 pounds and it would isolate, and
there was not a recognition of the potentiality of a very small
break creating this situation.
Mr. ERTEL. So what you are saying is we have a mistake prob-
ably in both the design and the licensing procedures, because they
did not consider a small pipe break.
Is that what you are saying?
Mr. MACMILLAN. That is my opinion, yes, sir.
Mr. ERTEL. Thank you.
Thank you, Mr. Chairman.
I will submit a lot of questions in writing.
Mr. MCCORMACK. Thank you, Mr. ErteL
We are going to our next witness now.
Mr. MACMILLAN. We want to thank you. We have taken, as is
usual, attempting to get our feet on the ground, more time with
one witness than is really fair to the other witnesses. Maybe we
will pick some of that up as we go along, because we have gained a
lot of information from this discussion.
I want to thank you and ask you if you will stand by for the rest
of the hearing?
Mr. MACMILLAN. Yes, sir.
Mr. MCCORMACK. Thank you.
Our next witness is Mr. Herman Dieckamp, president, General
Public Utilities Corp.
We want to welcome you. I recall seeing you the day after the
accident on Thursday, when Mr. Fuqua and I and others from the
PAGENO="0391"
387
committee visited you, we are still trying to understand what was
going on.
Your testimony has been received by the committee and will,
without objection, be inserted in the record at this point with all
supplemental information.
[The prepared statement of Mr. Dieckamp follows:]
PAGENO="0392"
388
Testimony
by
Herman Dieckamp, President
General Public Utilities Corp.
The accident at Three Mile Island on March 28, 1979 has had a profound
and shocking impact on the residents of central Pennsylvania, Met-Ed and GPU,
our customers and employees, and on the future of nuclear energy. While
nuclear power plant systems and procedures have been designed to accommodate
extreme malfunctions of both equipment and personnel, the reality of this
accident has had a far greater impact than we could have ever projected.
We pledge our sincere support and cooperation in the efforts of this
committee to make known and to assess the full meaning of this accident. At
the outset we would like to emphasize that we do not in any way wish to
minimize the significance of this accident and we seek no excuse from our
responsibilities as plant owners and operators. We strongly believe that it
is important to understand the factors which contributed to this accident and
to the ability of our Company, government agencies and the affected population
to cope with it. If this accident is viewed simply as a matter of management
or operator failure, the full significance of this experience will be lost.
The accident was a result of a complex combination of equipment malfunctions
and human factors. The accident departed from the accepted design basis for
current nuclear plants. The response of all organizations was influenced by
the fact that it was the first accident of this magnitude in the history of
the U.S. commercial nuclear power program.
It is our hope that this testimony and these hearings can contribute to
an understanding of this accident, the many complex factors that led to it, and
the critical learning that we are obligated to derive from it.
ACCIDENT CAUSES
We would like to focus this portion of the testimony on our initial im-
pression of the primary causes of the accident. We do not propose today to
present a detailed description or sequence of events for the accident. We are
in general agreement with the NRC testimony on this subject as previously
PAGENO="0393"
389
presented to the U.S. Senate Subcommittee on Nuclear Regulation. We may,
however, differ somewhat on the relative importance of the various ingredients
of the accident.
While extensive data and information have been made available Met-Ed and
CPU have not completed a detailed reconstruction of the accident or verified
the relative importance of the many ingredients. The following appear to be
the major causes of the severity of this accident.
a) Shortly (4 sec.) after the turbine and reactor trip at about 4:00 a.m.
on March 28, a reactor coolant system pressure relief valve opened to
relieve the normal pressure excursion, but the valve failed to re-
close after the pressure decreased. The operator was unaware the
valve had not closed. An order for valve closure was signaled in the
control room. The operator monitored temperature near the valve to
indicate valve position. However, the temperature did not clearly
confirm the continuing coolant flow thru the valve. The loss of
reactor coolant and accompanying reactor coolant system pressure
decrease continued for about two hours until the operator closed the
block valve which stopped the uncontrolled loss of reactor coolant.
b) The operator anticipated reactor coolant system behavior and immedi-
ately began to add make-up water to the system. When system pressure
decreased to 1600 psi about 2 minutes into the accident the High
Pressure Injection (HPI) safety system was automatically initiated.
Four to five minutes into the accident the operator reduced injection
of water from the HPI system when pressurizer level indicated that
the system was full.
PAGENO="0394"
390
c) Operator training and experience had emphasized the retention of
a steam vapor space in the pressurizer. However, following the rapid
depressurization of the system, the pressurizer level indicator
inferred a fullness of the reactor coolant system. This level
indication led the operators to prematurely reduce HPI flow. The
operator apparently did not anticipate that continued depressuriza-
tion could lead to steam void formation in hot regions of the system
other than the pressurizer and that under these conditions his level
or fullness indication was ambiguous and misleading.
d) Because of the presence of steam voids in the primary system, indi-
cated primary coolant flow decreased. The operator turned off the
main coolant pumps in order to prevent damage to the pumps. The
plant staff expected cooling by natural circulation. Voiding pre-
vented natural circulation and prevented reestablishment of pumping.
e) An emergency feed system, designed to provide cooling to the steam
generators in case of loss of the normal feed water system, was
blocked because of two closed valves. This system would have
been available to provide secondary cooling. The operator discovered
this condition and initiated secondary system emergency cooling by
opening the closed valves 8 minutes after the start of the plant
transient. The plant safety system surveillance program had called.
for the placing of these valves into the closed position six times
during the first 3 months of 1979 for testing of the operability of
the pumps or valves. The surveillance program required a verification
of valve position twelve times during this period. The last test of
the emergency feed system was conducted on the morning of March 26,
about 42 hours before the March 28 accident.
PAGENO="0395"
391
f) Primary coolant initially vented through the pressurizer relief was
pumped into the auxiliary building because the containment design
did not require isolation until building pressure reached 4 psi.
Continued plant operation required some transfer of fission products
to the auxilliary building.
The first five of the above factors led to severe undercooling of the
reactor core. The fuel became extremely hot and the integrity of the fuel
cladding was lost. The first indication of fuel cladding damage and fission
product release came with high radiation alarms. An extensive reaction
between fuel cladding and primary coolant steam liberated large quantities of
hydrogen gas into the primary reactor coolant system. The resulting configur-
ation of the reactor core is still the object of analytical attempts to
reconstruct the accident. At various times during the day of March 28 as the
operators worked to reestablish control of system cooling, the core suffered
additional overheating and damage. Forced cooling of the primary system was
reestablished at about 8:00 p.m. on the 28th. A summary sequence of events is
attached as Appendix A.
Performance of the plant operators has been the subject of much specu-
lation. Their performance must be viewed in the context of:
1. Ambiguous and contradictory information relating to pressurizer
level and relief valve closure.
2. The experience and training underlying the operators' emphasis on
maintaining pressurizer level.
3. The operators' awareness of equipment limitations.
4. The time and opportunity to assimilate large quantities of data
with varying degrees of physical and chronological availability.
PAGENO="0396"
392
The operators on duty at the time of the accident are a qualified and
competent group. They performed their functions professionally in a period of
extreme stress. Our own investigation and the many other governmental
investigations will ultimately attempt to determine the role of operator
performance in this accident.
PLANT STATUS - CURRENT AND FUTURE
The plant is stable and in a cold shutdown state. The fission product
decay heat being liberated in the damaged reactor core/fuel is just slightly
in excess of 1 Mw thermal (O.04E of full power). This power level is normal
for this time after a reactor trip. The core is being cooled by the natural
circulation of primary reactor coolant. No primary system pumps are required
in this mode of cooling. The average temperature of the primary coolant is
about 175°F. As a result of local flow restrictions associated with the
physical damage to the core, the highest in-core thermocouple reading is about
3OO~F.. The heat from the reactor is being rejected through one steam gener-
ator and the plant condenser.
An immediate objective of the activities at the plant has been to establish
a redundant heat removal path through the plant's second steam generator and
an intermediate heat exchange loop without using the plant condenser. This
will enable the transport of the core heat through the plant's two steam
generators for ultimate rejection through two independent secondary paths.
The objective is to minimize the number of active components that must func-
tion in these circuits in order to ensure reliable heat removal.
The plant has been in the natural circulation mode since April 27, 1979.
The plant's several and original emergency cooling capabilities are available
to backup this cooling approach. One of these systems, the plant's decay
PAGENO="0397"
393
heat removal system has been the subject of a high priority effort to upgrade
the ability of that system to miminize releases to the environment while
operating with high primary coolant radioactivity. As part of this effort,
work has been under way to enable the installation of redundant backup modules
in addition to the two that are part of the plant design.
DEVELOPMENT OF UNDERSTANDING
The accident differed from the popular perception of common accidents
because of the extended time necessary to achieve a full definition of its
scope. In this case, the time required to develop areasonably complete
understanding of the accident and its result was approximately 2-3 days. It
should be stressed that while the full impact of the accident was not fully
evaluated, there was sufficient understanding of system conditions to maintain
plant cooling stability during this period. There were three key areas in
which full evaluation required time:
1. Assessment of the degree of core damage.
2. The generation of hydrogen gas during the accident and a)its
potential impact on system heat transfer and b) its implications
relative to core damage.
3. The impact of continued operations on the potential for re-
lease of radioactive material from the plant.
The accident's initiating event was a loss of feedwater flow. During the
first few minutes following this event, the plant staff attempted to recover
from what they thought was a normal transient. Beyond this time, the plant
behavior became inceasingly abnormal. The loss of coolant vis the reactor
coolant system relief valve was identified and the valve was isolated around
6:20.a.m. At approximately 6:50a.m. several radiation alarms alerted the
PAGENO="0398"
394
staff to possible reactor core damage. In the time period of 5:30-7:30 a.m.
the reactor core became uncovered and suffered extensive damage, including
significant zirconium-water reaction. During the next 12 hours, the operators
attempted a number of strategies to establish dependable core cooling. This
objective was achieved about 8:00 p.m. on March 28, at which time the plant
symptoms included:
a) Some local reactor coolant temperatures were above coolant saturation
temperature.
b) High radiation levels existed in the reactor containment and the
auxiliary buildings.
At this point in time the high radiation levels indicated that fuel
damage had occurred but the extent was not defineable. The complicating
presence of hydrogen gas in the primary system had not yet been detected.
A preliminary sequence of events was being extracted from the various
plant records by the afternoon of March 28. The data for the 16-hour accident
period became available in summary graphical form on the morning of March 29.
The probable occurrence of a zirconium - water reaction and the presence
of hydrogen gas in the reactor containment building was deduced during the
the evening of March 29 from containment pressure records that indicated
a pressure spike during the accident. The size of the hydrogen gas bubble in
the reactor coolant system was first measured from system data just after
midnight March 30. The concentration of hydrogen gas in the containment
building was determined from analysis of the first containment gas sample
taken about 4:00 a.m. on March 31. The first quantitative data with respect to
fission product release and degree of reactor fuel damage became available via
analysis of a primary coolant sample taken at 5:00 p.m. on March 29. The data
PAGENO="0399"
395
on hydrogen and fission product release provided the bssis for the next level
of core damage evaluation.
The point of the above enumeration is simply to indicate the time neces-
sary to gain insight into the scope of the accident and, in turn, to provide
the basis for a meaningful~analysis. In any review of the timeliness of the
accident assessment, it must be remembered that the plant management and staff
faced immediate, continuing and first priority demands to maintain the damaged
plant in a controlled and safe state.
LEARNING FROM THE EXPERIENCE
As a result of the accident, we can already with hindsight, identify many
areas that should be reviewed-in depth, including emergency planning, operator
training, reactor design philosophy, man machine interface, financial risk
diversification, and crisis management procedures, to name a few. While the
list of specific areas is already large and growing, it is still too soon
after the incident to define and implement specific actions. The lessons of
TMI-2 should be identified and applied only after an objective review of the
accident and its aftermath. We must resist pressures to act precipitously.
In the following-sections I will attempt to present a general perspective
on some things that the nuclear industry and the various government agencies
should be reviewing. I shall not attempt to present complete answers to the
host of questions raised by the ThI-2 accident or detailed recommendations for
changes in nuclear plant design, operations, or regulations.
(1) Physical Data
The accident at TMI-2 produced a large amount -of technical data relating
to the behavior of materials and systems under extreme accident conditions. A
major contribution the government can make is to play a leadership role in
PAGENO="0400"
396
evaluating the physical data and material resulting from the accident. This
should include an examination of the damaged core and an assessment of the
damage in relationship to the extreme environmental conditions imposed by the
accident. Such data must be of great value in the future evaluation of
emergency cooling criteria. The accident has also resulted in a large number
of components having been subjected to intense radiation and thus consti-
tuting a wealth of information on environmental effects and failure modes.
(2) Design Philosophy
Among other things, the TMI-2 incident control and recovery activities
suggest areas of design philosophy that should be carefully considered.
Specific areas that merit attention include:
a. An overall review of the complexity of nuclear power plant systems
to assure that in the light of required surveillance and increased
opportunity for human error, additional systems add incrementally to
the safety of the plant. We should seek affirmation that the design
criteria are being met by the simplest and most direct approach.
b. The design tradeoff between minimizing pressure vessel penetrations
to provide assurance of primary system integrity and the ability to
accommodate unforeseen needs for additional access to the primary
system, eg. for instrumentation or venting,
c. The ability to place a stricken plant into a relatively passive and
stable mode with minimal reliance on active components (i.e., pumps,
instruments, power supplies, etc.) whose reliability may have been
degraded by the accident and its aftermath. An example is reliance
on natural circulation in the primary coolant system. An envelope
PAGENO="0401"
397
of conditions (decay heat levels, pressures, temperatures,
equipment integrity, etc.) under which each particular plant may
be safely placed in a natural circulation state might be developed,
along with operating procedures and operator training in such pro-
cedures. Design modifications to enhance natural circulation capa-
bility might also be considered. another example is pre planning
for operation with minimum instrumentation.
d. The ability of electrical components (monitors, controls, pressurizer
heaters, instruments), pump seals, and other equipment to survive
under post-accident conditions potentially involving abnormally
high temperatures, humidity levels, radiation levels, flooding,
and emergency usage. In many cases, this ability may be enhanced
by hermetic sealing or relocation to places not prone to flooding or
collection of highly radioactive liquids or gases. In other cases,
additional redundancy and diversity may be preferable.
e. Improved ability to assess equipment status and environmental
conditions with emphasis on areas of the plant where post-accident
access may be prohibited by high radiation levels. Examples include
ability to extract primary coolant samples including pressurized
samples for dissolved gas analysis, measurement of radiation levels
within containment and in other areas where primary coolant dispersal
could occur, and measurement of water level within containment. Im-
proved methods of ascertaining hydrogen gas concentration and explosion
potential in the containment atmosphere would also be helpful.
f. Facilitation of emergency modifications, such as special interface
provisions for emergency closed loop cooling systems or other pieces
of equipment whose temporary installation could reduce the risk of
radiation releases and contaminatiaon of permanent plant equipment.
48-721 0 - 79 - 26
PAGENO="0402"
398
(3) Man/Machine Interface
A review of the causes of the TMI-2 accident indicates one of the as-
pects of nuclear plant design and operation that requires attention is the
control room. The design of the control room and the philosophy of provid-
ing operators with information needs to be reviewed. The opportunities for
improvement in this segment of plant design includes;
a. The ability of the operator to quickly and unambigously determine
the status of key systems or components. For example, valve closure
indications, key system flow rates, etc.
b. The ability of the operator to fully determine the operational
characteristics of important plant systems, such as the determina-
tion of the degree of coolant boiling in the primary system or the
actual level of fluid in the primary system.
c. A review of the human engineering of reactor control rooms in order
that an operator's ~attention is directed and prioritized to malfunc-
tioning or prolematical areas of the plant's safety systems.
d. The design of the control room should emphasize consideration of
accident mode operations.
e. - Enhanced ability for communication both inside the control room and
within the plant, such that all:key personnel are fully cognizant
of plant status at all times. Particular attention should be paid
to the problems associated with plant operation when the plant is
in a contaminated state. This category also includes the ability
to communicate significant plant data to offsite locations.
PAGENO="0403"
399
(4) PLant Staffing/Operator Training
There are a number of aspects of plant staffing and operator training
that should be reviewed. We believe that the on-site presence of more senior
nuclear reactor engineers with significant operating experience could be of
substantial benefit. The mature judgment of such individuals could complement
the ability of the operators to immediately respond to plant difficulties and
be immediately available in the event of crisis.
In the area of operator training, we believe that additional emphasis
should be placed on fundamental principles of plant operations The critical
nature of the need for adequate core cooling at all times must be stressed.
In this regard, greater attention should be paid to ranking the objectives of
operator action in order of priority (i.e., accepting minor equipment damage
to reduce risk of major damage, accepting major damage to reduce risk of
radiation releases, etc.) Training should enhance operator knowledge of plant
behavior under abnormal conditions. Operator qualifications should include
such knowledge and the development of the capability of almost instinctive
proper reactions through routine simulator experience. Finally, while the
adherence to procedures must be emphasized, the ability of the operator
to gain knowledge and understanding of situations to determine when combina-
tions of procedures are required or when procedures are not applicable should
be improved.
(5) Emergency Support Team
The level of effort to effectively manage the aftermath of a major
nuclear accident will always be greater than that required for managing
ruotine operations. Additionally, coping with an emergency at a nuclear power
plant will require that resources far beyond those normally available at any
plant site be assembled and placed into effective action as quickly as
PAGENO="0404"
400
possible. Technical and management support are needed to:
a) assess and understand the status of the plant and how this status
came about;
b. identify and provide pre planning and procedures for contingencies.
c) identify and evaluate alternative courses of action to improve
the plant status and minimize public risk;
d) control radioactivity releases and monitor accurately those that
are unavoidable;
e) reinforce plant systems and equipment to assure safety on a
long-term basis.
One of the bright spots in the TMI-2 experience has been the support
provided by the entire utility and nuclear industries. A wealth of technical
and management talent, as well as vitally needed equipment, was provided
quickly at our request. This type of support Is vital for rapidly gaining
control over emergency situations and for engendering public confidence that
the best talent in the world is on the job to *ensure its protection. Con-
sideration should therefore be given to establishing, on an industry-wide
basis, one or more emergency support teams to provide the needed talent in an
even shorter time than it took to assemble the TMI team, and to prearrange the
organizational and logistical deployment and direction of such a team at each
nuclear plant. This would involve:
a) review and, if necessary, extend each nuclear utility's emergency
planning to include an emergency organizational structure into
which the support team would interface;
b) development of criteria for calling the emergency support team
into action;
PAGENO="0405"
401
c) participation by NRC and other government agencies, not only for
their technical contributions, but also to ensure complete and
thorough communication with the federal resources and expeditious NRC
approval for `off-normal" actions and procedures;
d) development of the composition and organization of the team it-
self. Functional areas that should be represented include plant
operations, existing plant systems design including instrumenta-
tion and control systems, emergency modifications engineering
and construction, plant operations analysis under abnormal con-
ditions, radioactivity contamination and release control, health
physics, site logistics, and public information. A separate
advisory group may also be desirable. The teams would be as-
sembled with utility and vendor personnel, who would, as a
team, undergo periodic training exercises and be available on
a quick-reaction basis.
Let me also emphasize the demanding logistics of assembling and maintain-
ing a large emergency support operation site merits advance consideration by
each individual nuclear utility.
(6) Emergency Equipment Pool
Any future nuclear plant emergency will undoubtedly call for rapid
on-site availability of equipment that is not normally available. Considera-
tion should be given to developing and maintaining, on an industry-wide basis,
a pool of such equipment that would be useful in a nuclear plant accident to
control radioactivity releases, reduce reliance on existing plant equipment
whose reliability may be uncertain because of exposure to stressful environ-
mental conditions (heat, humidity, radiation), to handle large volumes of
radiation waste. The emergency equipment pool might include:
PAGENO="0406"
402
a) filters, demineralizers, etc., needed to control radioactivity re-
leases or contamination;
b) pumps, piping, heat exchangers, etc., or packaged emergency cool-
ing systems;
c) respirators, air compressors and other equipment needed to support
operations in highly cdntaminated areas;
d) tanks for interim storage of large volumes of radioactive liquids;
e) containers for radwaste and corttaiminated material, including
used filters, resin, tools and equipment, etc. Both short-term
on-site storage followed by off-site disposal and long-term on-
site storage should be considered in establishing criteria for
these containers.
This equipment should be available in air and truck transportable pack-
ages. In addition to determining what kinds of equipment should be available,
consideration should be given to how these equipment items interface with
existing plants.
(7) Communication
The TMI-2 accident emphasized a number of deficiencies in our ability
to communicate relevant facts both internal to the GPLJ and Met-Ed organiza-
tion and to the public. Internal communication difficulties exacerbated the
inherent difficulties in our external communications systems.
A major source of interenal communication difficulty was the constrained
number of telephone lines in and out of the plant and the control room. Addi-
tionally, the scarcity of qualified communicators both inside the plant and
throughout our organization led to additional stress on the part of the plant
operators who were also being used as communicators. This increased the
potential for misinformation being conveyed to the civil decision makers.
PAGENO="0407"
403
The experience further emphasises the need for knowledgeable information
assumption in all involved organizations.
It is clear our external communications, particularly in the early days
of the accident could have been improved. The errors in judgment which were
made in early, optimistic assessments of plant status,
were based upon an incomplete understanding of the then current
situation. Later, nuances of difference between various organizational spoke-
persons caused the media to highlight discrepancies and thus confuse the pub-
lic. Ultimately, we decided the public interest would best be served if we
allowed NRC to act as the sole, source of "official' information about the
TMI-2 accident.
Clearly, the public information aspects of emergency planning merits
careful consideration. A fine balance must be struck between giving out
too little information, thereby giving an impression of secrecy, and giv-
ing Out too much information or giving it out prematurely and conveying
an image of confusion and uncertainty.
Procedures to disseminate credible and objective information to the public
through a single authoritative source, who is identified at the onset of the
emergency, should be established. Most importantly, the plant staff needs to
balance the demands for factual plant information with the priority demands
to maintain the plant in a controlled and safe state.
Finally, if we are to utilize nuclear energy for a significant portion
of our countries energy needs, we need to convey to the public a much better
understanding of the character of this technology including its benefits
and risks.
PAGENO="0408"
404
CONCLUSIONS
The term "learning experience" doesn't begin to describe the ThI-2
accident. Nobody can afford such expensive "lessons', and this may be one of
the most important lessons of all. Insights gained from a comprehensive re-
view of this accident and its aftermath will need to be implemented in order
to eliminate the risk and consequences of a future accident of this magnitude.
However, these insights must be applied with care. Wholesale plant modifica-
tions, hardware additions, changes in operational procedures, etc., may not
provide improvement in real safety. We need to remember that every new piece
of hardware brings with it new failure modes that must be analyzed for protec-
tion adequacy. Existing designs and design philosophies should not be dis-
carded until we are sure that the changes offer real improvements.
Two things are needed if nuclear power is to benefit from TMI-2; follow-
through on the part of the nuclear industry and its regulators to seek out and
apply the lessons of this incident, and a recognition on the part of the
public and the utility commissions that it is in everyone's best interest to
maintain a viable nuclear program and viable utilities to implement this
progrOm. Let us hope that both of these will be forthcoming.
PAGENO="0409"
405
Appendix A
Preliminary Description of Three Mile Island Unit 2 Accident
1. Normal Operation
The Three Mile Island #2 nuclear unit shown schematically in Figure 1 is a
pressurized water reactor. The system normally operates with primary sys-
tem temperature of about 5800 Farenheit and pressure of about 2150 pounds
per square inch. The reactor core (1) is the heat source in a nuclear power
plant. It is in this region of the system where the nuclear reaction takes
place.
The rate at which heat is produced in the core is regulated by the control
rods. This is the system that shuts down the nuclear reaction when requir-
ed. In normal full power operation 2772 MW of heat is produced in the
reactor core. It is important to note that even after the nuclear reaction
is stopped, heat continues to be produced by the fission products within the
core. Immediately after shutdown from full power this heat is about 100 MW,
a week after shutdown 6 MW, and a month after shutdown decreases to 3 MW.
The heat which is produced in the reactor core is transferred to the primary
reactor coolant (purple) and circulated by the reactor coolant pumps (2)
within this closed system through the steam generator (3). The heat which
has been produced in the primary system is transferred to the secondary sys-
tem (green) through the steam generators where steam is produced (light
green). This steam is then circulated to the turbine. The steam turns the
turbine (4) which turns the generator (not shown) producing electricity.
This steam is then condensed (5) and is recirculated back to the steam gen-
erator by means of several pumps and heaters. In the schematic, only the
condensate pumps (6) and feedwater pumps (7) are shown. Two thirds of the
heat produced in the primary system must be discharged as waste heat and is
removed from the secondary cooling system by means of cooling towers. This
heat rejection system is shown in blue.
A key piece of equipment in the accident was the pressurizer (8). The pur-
pose of the pressurizer is (a) to maintain the high pressure in the primary
system and to assure that primary coolant is maintained in a liquid or
non boiling state and (b) to absorb changes in volume as the primary system
heats up and cools down.
In normal operation, the only steam present in the primary system is in the
pressurizer (light purple). The water level in the pressurizer (9) is in-
dicated in the control room by the pressurizer level indicator, If pres-
sure in the primary system gets too high it is relieved by the automatic
opening of the pressurizer relief valve (11).
2. Accident Sequence on March 28,1979
Approximate Time
4 a.*m. A malfunction in the secondary. system (green) caused
a condensate pump (6) to turn off. This resulted in
(t = 0) the automatic tripping of both secondary feed pumps (7),
which in turned caused the turbine (4) to trip. The
tripping of the feed-water pumps caused a reduction
of heat removal to the steam generator.
PAGENO="0410"
406
When heat removal from the steam generator (9) was
reduced, it began to heat up and, in turn, the primary
system began to heat up.
(t = 2 sec. ) The loss of normal secondary feedwater flow caused the
actuation of theemergency feedwater pumps (10).
(t = 4 sec.) As the primary system heated up, pressure increased.
When it reached 2255 psi, the pressurizer relief valve
(11) opened to relieve pressure. In opening to vent
excess pressure this valve was operating as expected.
(t = 9 sec.) The nuclear reaction occurring in the reactor was auto-
.inatically shut off as pressure reached 2355 psi. At
this. point in the accident everything has occurred as
would be expected and as designed.
(t = 12-15 sec.) By venting thru the relief valve, reactor pressure was
reduced to 2205 psi; at this point the valve (11)
should have closed but it didn't. This was the first
abnormal occurrence in the accident (NRC item #2). It
should be noted that the operator was unaware that the
valve had not closed. An order for valve closure was
signaled in the control room. As time passed the op-
erator monitored temperature near the valve to indi-
cate valve position. However, the temperature did not
clearly confirm the continuing coolant flow through
the valve. The primary reactor coolant continued to
vent through the open valve into the drain tank (12)
and pressure continued to drop.
~In response to the anticipated ~normal transient be-
havior the~ operators began:to inject water into the
system through the make-up system (13).
(t = 39-41 sec.) The emergency feed pumps (10) actuated at 2
sec. achieved discharge pressure at 15 sec. were
called upon to provide cooling to the steam
generator (3). However, the block valves (14) on
that emergency feedwater system had been inadvertent-
ly left closed (NRC item #1) and the system was
unable to function as intended. The relief valve
(11) had already opened at this point so that the
availability of the emergency cooling system
on the secondary side could not have prevented the
actuation of this valve which ultimately failed to
close.
(t = 2 mm.) Pressure decreased to 1600 psi. At this point the
high pressure injection (HPI) emergency core cooling
system (ECCS) is automatically initiated (13).
(t = 2 mm. 12 sec.) The Drain Tank pressure increased to the point where small
amount of coolant is released through the drain tank
valve (not shown) and begins to collect in reactor
building sump (15).
PAGENO="0411"
407
At t = 14 minutes 50 sec. the drain tank rupture
disc blew due to continued release of reactor
coolant thru the failed pressurizer relief valve
(11). Large quantities of water begin to spill
from the drain tank.
(t = 4 mm. 40 sec.) Pressurizer level indication reached 90%. Operator
turned off one ECCS pump. Primary pressure was
now down to 1400 psi.
Following the rapid and continued depressurization of
the system the instrument which measures the water level
(9) in the pressurizer inferred a high level throughout the
reactor coolant system This was due to the production
of steam voids elsewhere in the primary reactor system.
Operator training and experience had emphasized the
retention of a steam vapor space in the pressurizer.
The indication of a major decrease in that vapor space
led the operators to prematurely reduce ECCS flow.
(NRC item #3). The operator apparently did not
anticipate that continued depressurization could lead
to steam void formation in hot regions of the system
other than the pressurizer and that under these
conditions his level indication was ambiguous and
- misleading.
(t 7 mm. 30 sec.) Reactor building sump pump begins to pump water from
reactor building to auxiliary building into the radio-
active waste storage system (16) (NRC item #4). It
should be noted that the operators turned off the sump
pump 30 minutes later at t = 37 minutes. This was
prior to any major fuel damage occurring.
(t 8 mm.) The operators discovered the closed block valve (14)
in the emergency feed system, opened it and initiated
emergency secondary system cooling. At this point no
major fuel damage had occurred.
Note at this point that the relief valve (11) is still open and primary cool-
ant was still being vented. Steam voids had been generated in the primary
system preventing the normal flow of coolant. Due to the ambiguous pressur-
izer level readings, the operators were unable to determine the state of the
system. The operators made a number of attempts to verify system conditions
during the next 30 minutes During this time, indicated flow began to
decrease and operators began to note reactor coolant pump (2) vibration
which indicated cavitation.
(t = 20-60 mm.) System parameters in saturated conditions at 550°F and
1015 psi. Indicated flow decreasing and vibration in-
creasing.
(t = 1 hr. 13 mm.) The operator turned off two of the four primary reactor
coolant pumps (NRC item #6). This action was taken by
the operator in order to prevent damage to the pumps.
PAGENO="0412"
408
(t = 1 hr. 40 uiin.) The reactor operator turned off the remaining two
reactor coolant pumps. At this point, primary
pressure had reached 920 psi and there was no forced
flow in the primary system. The operators attempted
to establish natural circulation in the system. The
unknown presence of the very large steam voids in
the primary system prevented the operators from
accomplishing the natural circulation state.
It was at this point that a heat up transient began to occur in the system
and in the next hour, the major portion of the fuel damage occurred. The
lack of adequate cooling caused fuel temperature to increase to the point
where the zircaloy fuel cladding reached a temperature where it reacted with
the hot steam and produced hydrogen. This hydrogen gas was released to the
primary coolant system. Some of the gas was ultimately vented through the
failed relief valve to the containment building. Two points should be noted
here:
1. There was never a possibility of an explosion in the reactor
pressure vessel- due to the presence of hydrogen in the primary
system. -
2. Despite the high temperatures experienced in the fuel, coolant
sample data Indicate no fuel melting.
(t = 2 hrs. 22 mm.) The operator discovered the presence of the
failed pressurizer relief valve (11) and closed
- the relief valve block valve (not shown). This
cut off further release of steam and water from
- the system and closed the primary system for the
first time in over two hours.
(t = 2 hrs. 45 mm.) Reactor containment building radiation monitor
indicates potential for off-site releases. -
(t = 2 hrs. 50 mm.) Site emergency declared.
(t = 10 hrs.) 28 psi pressure spike occurs in containment building.
This was later deduced (evening of 3/29) to have re-
sulted from the explosion of a locally high concentra-
tion of hydrogen vented from the primary system.
(t = 2 hrs 22 mm. The operators endeavored to restore primary cooling to
to t = 16 hrs.) the system. However, the presence of large amounts of
- hydrogen and steam voids prevented this. After attempt-
ing a number of approaches to restore adequate cooling to
the primary system, the operators were finally successful
in restarting a primary reactor cooling pump at- about
8 p.m., 16 hours after the initiation of the accident.
The plant was cooled in this mode for several weeks
until the primary reactor coolant pump was shut down
and the system was brought to a natural circulation state
on 4/27/79.
PAGENO="0413"
409
This information taken from US NRC IE Bulletin 79-05A, April 5, 1979 - Enclosure I.
NUCLEAR INCIDENT AT THREE MILE ISLAND - SUPPLEMENT
Description of Circumstances:
Preliminary information received by the NRC since issuance of IE Bulletin
79-05 on April 1, 1979 has identified six potential human, design and
mechanical failures which resulted in the core damage and radiation releases
at the Three Mile Island Unit 2 nuclear plant.
1. At the time of the initiating event, loss of feedwater, both of the
auxiliary feedwater trains were valved out of service.
2. The pressurizer electromatic relief valve, which opened during the
initial pressure surge, failed to close when the pressure decreased
below the actuation level.
3. Following rapid depressurization of the pressurizer, the pressurizer
level indication may have lead to erroneous inferences of high level
in the reactor coolant system. The pressurizer level indication
apparently led the operators to prematurely terminate high pressure
injection flow, even though substantial voids existed In the reactor
coolant system.
4. Because the containment does not isolate on high pressure injection
(HPI) initiation, the highly radioactive water from the relief valve
discharge was pumped out of the containment by the automatic Initiation
of a transfer pump. This water entered the radioactive waste treatment
system in the auxiliary building where some of It overflowed to the floor.
Outgassing from this water and discharge through the auxiliary building
ventilation system and filters was the principal source of the off site
release of radioactive noble gases.
5. Subsequently, the high pressure injection system was intermittently
operated attempting to control primary coolant Inventory losses through
the electromatic relief valve, apparently based on pressurizer level
indication. Due to the presence of steam and/or noncondensible voids
elsewhere in the reactor coolant system, this led to a further re-
duction in primary coolant inventory.
6. Tripping of reactor coolant pumps during the course, of the transient,
to protect against pump damage due to pump vibration, led to fuel
damage since voids in the reactor coolant system prevented natural
circulation.
PAGENO="0414"
TMI-2 Schematic
Containment Building
Auxiliary
(12) Drain Tank
CS Line~
Borated
Water
Storage
Tank
Condensate
Pump
Circulating Water Pump
(1 D) Emergency Feed Pump
(14) Block Valve Condensate Sturag~ Tank
H
(1 6) Radioactive Waste
Storage System ~1:tIfftø Pre~urizer _________
I r31L_!~Q~ Reactor
~ Stea~ Gene~or
(2) Reactor Coolant Pump
PAGENO="0415"
411
Mr. MCCORMACK. Mr. Dieckamp, you understand the siti~iatic~n
the committee is in as far as our time constraints are concerned
and the testimony we have just heard.
I would like to ask you to aid us by presenting to us such
information from your testimony as you feel would supplement or
be in addition to what we have learned about the plant today.
In other words, if you can, tell us from your perspective what
happened and what information you think is vital to this commit-
tee; this would help us a great deal.
STATEMENT OF HERMAN DIECKAMP, PRESIDENT, GENERAL
PUBLIC UTILITIES CORP.
Mr. DIECKAMP. Thank yOu, Mr. Chairman and members of the
committee.
We greatly appreciate the opportunity to appear here today.
We certainly want to do everything we can to insure that the
accident, its causes and its consequences, are fully understood, and
that we, and indeed the entire industry and the world benefit from
whatever learning is available.
As you perhaps have noted, my testimony includes two things:
First, a brief summary of what we see as the major elements or
the major contributing factors to the accident. Those do not depart
in any significant way from the items that have been enumerated
by either the NRC or by B. & W.
I suspect, on occasion, our emphasis on individual ingredients of
the accident may differ slightly.
The testimony then goes on to try to provide a brief and clearly
just a beginning identification of some of the kinds of learning
lessons that we can see out of the accident and some of the kinds of
followup actions that certainly will want to be evaluated.
From the discussion that has gone on so far this morning, I sense
that there is a considerable desire yet for more knowledge about
the cause of the accident, and I would certainly be happy to stop at
this point and take any further questions about the cause of the
accident to try to continue on that phase of the discussion that was
started with Mr. MacMillan.
Mr. MCCORMACK. We very much appreciate that, Mr. Dieckamp,
so let us ask some questions very quickly.
First of all, why were the valves turned off on the auxiliary
water system?
Mr. DIECKAMP. The point I would like to make about that first is
that there clearly was a procedural failure on the part of the plant
operators.
I would like to add, though, that one of the things that we take
on with the large number of redundant systems in the plants is an
obligation to survey those systems and equipment routinely to
insure that they are in a functioning, ready-to-act mode. With
respect to this system, the auxiliary or emergency feed system, it
was the subject of surveillance tests 12 times during the first
quarter of 1979.
That simply indicates the frequency of such testing. Six times
during that 3-month period the tests required that those specific
valves be placed in the closed or unsafe position in order to per-
PAGENO="0416"
412
form the tests. The test, of course, requires that at completion of
the test the valve be returned to the open position.
I can only surmise that through some human error, oversight,
administrative or procedural detail, that final step did not get
accomplished as it was thought to have been accomplished. The
last testing of that system that put those valves into the unsafe
position occurred just 42 hours before the accident during the
morning of the day shift on March 26.
Mr. MCCORMACK. Was there an indication on the control panel
that those valves were closed?
Mr. DIECKAMP. There are, indeed, switches and lights on the
control panel that indicate the status of those block valves.
Mr. McCORMACK. In spite of the fact that there were lights lit on
the panel showing that the valves were closed, the plant was
operated for a number of hours with those lights on?
Mr. DIECKAMP. As best I know, that is correct.
Mr. MCCORMACK. That would be a violation of procedures. There
is no reason to have them closed during normal operation; it would
be a violation of procedures to operate with those valves closed.
Mr. DIECKAMP. You get into a technical detail there that I would
not really want to argue about as to whether it is or is not a
violation to have them closed. They are available for the operator
to open or close as is necessary. I think we do agree that they
should have been in the open position.
With respect to your question of how could they be overlooked, I
think one has to think about the control room, the control boards,
and visualize a significant array of instruments and indicator
lights. Those lights are not of any one all green or all red sort of a
status indicator. There is a mixture, and intermixture of red, green
and amber lights.
The situation is not such that the operator automatically almost
has it drawn to his attention that something is in the improper
position. Again, I don't present that as an excuse for the situation.
I simply say that it is one of the aspects, and I think it goes to Mr.
MacMillan's comment about human engineering, which I also
touch on in my testimony.
Mr. MCC0RMACK. So if we make a broad category, we simply
have to say this was an operator or human error?
Mr. DIECKAMP. I can provide no other explanation.
Mr. MCCORMACK. Why did the primary water system fail, Mr.
Dieckamp?
Mr. DIECKAMP. The auxiliary feed system?
Mr. MCCORMAcK. The primary pump.
Mr. DIECKAMP. The main feed system.
Mr. MCCORMACK. The main feed system; why did it fail?
Mr. DIECKAMP. Yes; a report that I have with me-and let me
just read from it, and it is going to be somewhat terse-but it reads
as follows:
The steam generator feed water pumps were in service-at the start of the
accident-condensate booster pumps were in service and condensate pumps were in
service.
An attempt was being made to clear a clogged resin transfer line in the standby
demineralizer. A loss of feed water flow transient started when condensate pump 1-
A tripped, resulting in both main feed pumps tripping. The main feed water pump
trip caused the main turbine to trip.
PAGENO="0417"
413
So I think, going back to the earlier discussion, there was,
indeed, some maintenance activity going on in that total feed water
train. However, I think we have not yet been able to deduce the
exact sequence of events or the exact cause or cause and effect
relationships.
Mr. MCCORMACK. Two quick questions: Wouldn't it have been
proper, wouldn't it be proper procedure to bypass that system
while it's being worked on and use the auxiliary or some other; was
it not possible to bypass it if you are working on it?
Mr. DIECKAMP. I am uncertain as to whether the auxiliary feed
pumps are capable of supplying sufficient power for full load oper-
ation.
Mr. MCCORMACK. Mr. Dieckamp, there is something that bothers
me about your answers and that is, it's been now 2 months since
the accident and these are critically important questions.
Mr. DIECKAMP. I would not want you to think that we have been
lackadaisical about looking into the accident. I must say, though,
that for the approximately first 4 weeks, we were intensively in-
volved in bringing the reactor to the cold shutdown mode. During
the next couple of weeks we have been in the process of finishing
up those activities.
All of the time we have had an activity ongoing to research the
details of all of these various factors to bring them together, to
coordinate the data, to consolidate it, to begin to be able to deduce
the learning that is there.
In some cases-I don't think in this one, but in some cases-we
are inhibited from that process by the residual radioactivity levels
in the auxiliary building, but I would only say to you that it is a
monumental task to pull together all of that data and try to make
sense out of it.
Mr. MCCORMACK. Has anyone interviewed the maintenance per-
sonnel who worked on this thing?
Mr. DIECKAMP. Yes; operators have been interviewed; mainte-
nance personnel have been interviewed. Again, it's a case of our
coordinating all of those subjective observations along with the
actual records of the plant, the instruments, the recorders, the
computer and the like.
It will be an extensive job, indeed, to elaborate all of these
details.
Mr. MCCORMACK. One final question? What are the educational
qualifications of your operators? What are the requirements for an
operator, education requirements?
Mr. DIECKAMP. The requirements for the operators are that they
be at least high school graduates.
Mr. MCCORMACK. Or their equivalent?
Mr. DIECKAMP. I am not sure about that. If that is what the
regulation says.
Mr. MCCORMACK. I am not certain.
Mr. DIECKAMP. I am not certain either about that. A number of
our operators, a significant number of them, have nuclear Navy
experience. One of the things that I would want to interject is it is
my understanding that when we examine the pass-fail record of
our operators on the NRC licensing test, that failure record is
48-721 0 - 79 - 27
PAGENO="0418"
414
something like one half of the industry average during the last 4-
year time period.
The other thing that I might follow up on a prior question, the
senior reactor operator present at the time of the start of the
accidents, and present during most of the day of the accident, Mr.
Zewe, was at B. & W. for simulator training in January of 1979.
Mr. MCCORMACK. Thank you.
We are going to have to recess to go vote. This is an important
vote. We will recess for about 10 minutes.
[Brief recess.]
Mr. MCCORMACK. The meeting will come to order, please.
Mr. Ertel?
Mr. ERTEL. Thank you, Mr. Chairman.
Good morning, Mr. Dieckamp.
Mr. DIECKAMP. Good morning.
Mr. ERTEL. Mr. Dieckamp, I have not had an opportunity to read
all of your testimony, although I have read part of it. The first part
seems to me relates to a series of questions I asked the previous
witness concerning the operator training, and in addition to that,
identification of what was happening within the system.
You seem to take an absolutely opposite position. In paragraph
(a), page 2, you indicate that there was no way the operator could
definitely know what was happening within the system as far as
the pressurizer level gOing up and the need to keep the cooling
water, emergency cooling water going in.
Would you explain what you think should be done to that system
so that a person would be able to identify what is actually happen-
ing?
Mr. DIECKAMP. Congressman Ertel, I am not sure that I can
absolutely do that. I may not even be able to come close to fully
doing it.
I do think there is no controversy about the apparent fact that
the operators responded, giving most dominant consideration to
pressurizer level. Their prior training, their prior experience had
in some way drilled into them very strongly the importance of not
taking the system solid; namely, not filling it completely with
water.
I think that may well have led to their very strong dependence
upon level indicator.
I would characterize the level indicator slightly different than
Mr. MacMillan.
I have no disagreement that the level indicator was indeed indi-
cating the level in the pressurizer. The problem is that that level
was ambiguous in terms of its normal interpretation; namely, indi-
cating the degree of fullness of water in the system itself.
When we look at our procedures, we indeed find that the proce-
dures called for the operators to lOok both at level and system
pressure before making judgments about high pressure injection.
For some reason or other that I am unable to explain, they gave
their dominant consideration to level.
Mr. ERTEL. Didn't you indicate that the operator of this plant
had just previously been, in January, to the school that Babcock
and Wilcox ran on a simulator-primary operator?
PAGENO="0419"
415
Mr. DIECKAMP. The seniOr reactor operator, Mr. Zewe, had been
at B. & W. for simulator training in January. Now, I cannot
comment in detail on the exact things that the simulator was set
up to look at during that session.
Mr. ERTEL. Do you rely on Babcock and Wilcox to do most of
your training on the simulator and the type of training for emer-
gency control in the event of a casualty in the plant?
Mr. DIECKAMP. B. & W. has the simulator, and we do indeed
work with B. & W., and in a sense depend upon them to assist us
with the simulator training. I could not say, though, that the
operator training is their prime responsibility. It is our prime
responsibility to achieve the training of the operators.
Mr. ERTEL. Let me turn to another area quickly because I know
that time is limited. The chairman wants to move along.
The valves that were closed on the auxiliary feed system were
closed for a period of 42 hours. Now, if you run an 8-hour shift on
that, that would indicate that you had at least what, either six or
five shifts change during the time that those auxiliary feedwater
valves were closed.
* You said it was indicated on the control panel, that there were
lights indicating that they were closed. Do you have any kind of
checklist that an oncoming operator must go over, to gO over each
and every system, to determine its operability and what state it is
in? Have they been signed off by the intervening operators for the
42-hour period, and do they have a checklist that they go through?
Mr. DIECKAMP. There is not in use a system turnover or a shift
turnover checklist, the kind of device that is sometimes used. it
was used during the startup testing period of the Three Mile Island
plant. It was not in use since the plant went commercial.
It gets down to a judgment of whether one depends upon the
surveillance program to routinely assess the status of systems, or
whether you attempt to do it on each shift turnover, or each day.
The only consideration that I can suggest is that the plant's staff
felt that in order to make such a turnover list significant, the
number of items that would have to be included on it might cause
it to become something of a routine item, and not get the kind of
attention it should get.
Mr. MCCORMACK. Would the gentleman yield?
Mr. ERTEL. I would be happy to yield.
I fly an airplane. It doesn't matter how many times I fly that
airplane, I go through that checklist every time
Mr. MCCORMACK. That is exactly the point I was going to make.
Every time that a commercial airliner takes off, the copilot and
pilot go thfough a checklist, which they read off, and each one of
them repeats the words.
Yet we had five shift changes, with those lights on, according to
your testimony, at least five shift changes, and nobody noticed it.
What happens when these shifts change? Do people just walk in
and other people walk out?
Mr. DIECKAMP. There are procedures concerning turnover. There
are procedures relative to informing the oncoming shift ó.f the
status of the plant. I think that the only comments that I would
want to make on your analogy is to compare the number of items
that would have to be on the checklist and also compare the
PAGENO="0420"
416
situation ol pilot and copilot sort of changing in flight and normal
operation.
Mr. ERTEL. I ran a boiler system in the Navy, same sort of
teakettle you did, except it didn't have a nuclear reactor. We had a
checklist on each and every watch, every 4 hours. When you came
on, you checked visually, and checked it off and signed it off. Each
one of my operators did the same.
That is a pretty good analogy, I think.
Mr. MCCORMACK. How much of an overlap is there between
shifts, Mr. Dieckamp?
Mr. DIECKAMP. I am not able to say exactly in terms of minutes,
Mr. McCormack, but indeed there is an overlap between the shifts;
the people do come in-it isn't a case of one guy off the other guy
on in just 1 minute. There is a definite overlap.
I think the principal overlap function is performed by the shift
supervisor, who comes in ahead of time and gets himself briefed on
the status of the plant.
Mr. MCCORMACK. But there is no ritual of any sort that you go
through, in changing shifts?
Mr. DIECKAMP. There is that kind of a status review ritual. There
was not a detailed turnover checklist that was in operation.
Mr. MCCORMACK. Thank you.
Mr. ERTEL. I think that is an area that should be examined in
good detail.
I am also curious about another factor. On page 4 you said that
the c9ntainment design did not require isolation until the building
pressure reached 4 p.s.i.
Now, I asked the previous witness about that, and I asked if a
small pipe break would not be the same as the failure to reseat a
relief valve, and I think he indicated there wasn't much difference.
Would you agree with that?
Mr. DIECKAMP. I think in terms of the impact on containment
and the anticipated response of the temperature and pressure
levels in the containment, they would probably be similar.
Mr. ERTEL. Then my question is, in a small pipe break, as well as
a failure to reseat a relief valve, you are going to have, under the
design of this system, a leak into the atmosphere of containment
materials, radioactive water, into the atmosphere. Is that correct?
Mr. DIECKAMP. The main difference between the general design
basis for the plants and what happened in this accident is~ that it is
presumed that pressure levels get to the point of isolating the
containment before there has been a significant fission product
release.
I think that may well have been the case here, had the accident
not gone on for such a long period of time. I would like to also
comment on the earlier discussion about the water pathway.
The sump pumps that transferred water were turned off after 30
minutes. So in terms of the water pathway, there was very likely a
high degree of isolation of that.
The other comment that I would want to make is that I do not
feel-and I think the record will show-that the water pathway
was the signiflcant mechanism for impact on the public.
The water pathway brought some iodine into the auxiliary build-
ing, which subsequently was released. But the major exposures to
PAGENO="0421"
417
the public were from the noble gases, and those were released
during Wednesday and also during Friday morning.
I think largely associated with continued operations of the plant
that had to be performed, to keep certain tanks within their proper
pressure levels in order to prevent uncontrolled releases.
Mr. ERTEL. I guess you have answered my question in a circu-
itous manner. I know you didn't intend to do that, but isn't it true
that with this plant design, and with a small pipe leak, you are
almost accepting a contamination of the outside, until the pressure
reaches 4 p.s.i. within the containment building? And if that
doesn't build to that point quickly, you have got to release to the
atmosphere.
Mr. DIECKAMP. Again, I think the important question there is
whether or not there has been significant fuel damage in that time
period of getting to the 4-pound isolation pressure.
Mr. ERTEL. In this case there was a release to the atmosphere
before it reached 4 p~s.i.
Mr. DIECKAMP. That is right.
Mr. ERTEL. Do you know if NRC has a requirement that the
standard design is for there to be a containment?
Mr. DIECKAMP. The 4-pound isolation requirement met the licens-
ing.
Mr. ERTEL. At least it passed, it got a license. There is a differ-
ence.
Thank you.
Mr. MCCORMACK. Thank you.
Mr. Walker?
Mr. WALKER. Thank you, Mr. Chairman.
I don't want to take too much time, Mr. Dieckamp, but there is
something that I do want to relate to your testimony, and to talk
about in terms of some of the present goings on.
You refer throughout your testimony to the fact there has been a
learning experience and that we are going to learn a great deal
about nuclear operation from what happened at Three Mile Island.
I would certainly hope that that is going to be the case.
I do fail to note anywhere in yOur testimony some of the prob-
lems connected with the public, with the public fears that have
arisen from this, from the credibility problems, the communication
problems. A lot of these are part of the learning experience, too,
dealing with plant safety here.
In particular, what I am concerned about is the public fear, right
now, that the radioactive water that is presently in the auxiliary
building and in the containment is going to be dumped into the
Susquehanna River, after being treated. In all honesty, the public
refuses to accept that that water can ever be treated to a point
that they will consider it acceptable as drinking water. They will
never consider it acceptable for being dumped into the stream, for
sportsmen, and everything else.
Aren't there some alternatives that Met-Ed, GPU, can consider,
other than dumping that radioactive water into the Susquehanna
River?
Mr. DIECKAMP. Congressman Walker, on page 16 of my testimony
I give passing reference to your introduction to that question, when
I say that finally, if we are to utilize nuclear energy for a signifi-
PAGENO="0422"
418
cant portion of our country's needs, we need to convey to the public
a much better understanding of this technology, including its bene-
fits and risks.
Now, specifically with respect to the water, we have in the
course a meeting that the NRC invited local community leaders
and water companies to attend about a week or so ago, we have
said that we would certainly consider alternatives.
I think there are some alternatives, however, that carry with
them potential costs and potential precedents. I think it would be a
mistake if we were to somehow bypass the issue of, is that water or
is it not of danger to the public.
If I could just give you a few, burden you with a few numbers, let
me put it this way.
During the 6 weeks after the accident, when we had to manage
radioactive wastes with respect to our liquid effluents to the river,
we discharged less activity, in terms of curies, total curies, to the
Susquehanna, than we did during a similar period in 1978 when
TMI-1 was under normal operation.
Second, with respect to the 500,000 gallons of highly contaminat-
ed water in the primary containment building, we think it is
important that that water be dealt with and disposed of.
We also are confident-and the people that are most knowledge-
able about the technology are confident-that the solid or soluble
fission products can indeed be stripped out of that water, so that
that water can be discharged under conditions no different than
those appropriate for an operating nuclear plant.
There is one element that I cannot make that statement about,
with respect to a pressurized water reactor; that is, the amount of
tritium that is in that water.
There is estimated to be 2,000 to 3,000 curies of tritium in that
water. However, if one were to assume that that inventory of
tritium were discharged either in one large slug or uniformly, over
a period of 5 years or so, the amount of radiation that a down-
stream person drinking the water, eating the fish, swimming,
would receive is of the order of a few tenths of a millirem, which is,
I would say, almost indistinguishable for that person in relation-
ship to the natural background environment that he is receiving-
his medical treatments and so forth.
Mr. WALKER. I thank you for that. I think, though, that the
problem is that your statement reflects the industry's viewpoint,
and you need to convey to the public a much better understanding
of the characteristics of the technology.
I guess my point is, I think the industry better get some under-
standing of what the public can mean to the industry. The fact is
that your credibility, regarding your ability to clean it up, is practi-
cally nil with the public.
They consider any level of contamination of that water right now
totally unacceptable. From my standpoint, I think your ability to
continue to operate nuclear plants is very much based upon the
credibility which grows out of your learning experience with regard
to TMI.
It would be my assumption, right now, that when the first thim-
bleful of that water is mixed into the Susquehanna, you will have a
revolt on your hands. You will never be able to contain it in terms
PAGENO="0423"
419
of putting Three Mile Island back on line. In terms of the nuclear
industry being able to point to this as a learning experience, I
think the public interpretation at that point will be that you have
learned nothing.
Mr. DIECKAMP. Congressman Walker, I accept your characteriza-
tion of the public attitudes and feelings in that area, that they are
indeed as you state them. I would hope, though, that we would all
try to convey to the public the facts of the situation, so that their
attitudes can be shaped by a better understanding of the* meaning
of the kinds of activities that we do need to carry on at the plant.
Mr. WALKER. I guess your problem is that-and I will conclude
with this-I guess your problem is that the public is being bom-
barded with many different sets of facts.
We had a panel before this group yesterday in which we had a
couple of different extremes, as to how much radioactive release
reached the public, and how many millirems members of the public
got, and so on.
Regardless of whose figures can be confirmed, the fact is that the
public is under the impression that there are all kinds of facts, all
of which are misleading and doubtful. They don't want further
exposure.
Thank you, Mr. Chairman.
Mr. MCCORMACK. Thank you, Mr. Walker.
Mr. Wydler?
Mr. WYDLER. Can you tell me who was in the control room when
the accident took place?
Mr. DIECKAMP. Two licensed control room operators. A Mr. Craig
Faust and a Mr. Ed Frederick. In the glassed-in office just adjacent
to the controls was the senior reactor operator, Bill Zewe.
Mr. WYDLER. Those are the three people that were present at the
time the initial breakdown took place; is that right?
Mr. DIECKAMP. I know those three were there. I cannot be posi-
tive whether there was another one present or another one walked
in in a few minutes, or something of that sort. But those are the
three that were specifically present.
Mr. WYDLER. Hasn't anybody asked those questions yet?
Mr. DIEcKAMP. Congressman, as I sit here I don't happen to
know the exact schedule of each individual. That is known, though.
Mr. WYDLER. At the time that the initial breakdown took place,
if I understand what you just said, there were two people in the
control room, one in a nearby office, is that right?
Mr. DIECKAMP. Nearby means glassed-in within 20 feet of the
nearest control.
Mr. WYDLER. All right. And for the next 7 or 8 minutes-we have
been told the sequence of events here~ During that 7 or 8 minutes,
did anybody else come into the control room?
Mr. DIECKAMP. I can't be specific in answering that. I think
someone else came in on the basis of alarms being heard. But I
cannot be specific. We can provide th-at for the record, a detailed
chronology of who was in the control room at what time, for the
record, if you would like.
Mr. WYDLER. I would like that.
[The information follows:]
PAGENO="0424"
420
GENERAL PUBLIC UTILITIES CORP.,
Parsippany, NJ., June 5, 1979.
Hon. JOHN W. WYDLER,
Rayburn House Office Building,
Washington, D.C.
DEAR CONGRESSMAN WYDLER: During the May 23 hearings of the subcommittee on
Energy and Production of the House Committee on Science and Technology, you
asked about the occupants and the immediate arrivals to the control room at TMI-2
on the morning of the accident.
Attachment 1 indicates the original occupants and the post accident arrival of
station personnel on duty at the time of the accident initiation.
Attachment 2 indicates the arrival of personnel not on duty at the time of the
accident initiation.
This information is available for incorporation into the record if you so desire.
If you have any further questions please contact me.
Sincerely,
H. DIECKAMP.
Attachments.
ATTACHMENT 1.-Unit 2 on-shift operations personnel; initial arrival times' in
control room after 04002 until 0700
Name and title: Approx. time3
T. Daugherty-Auxiliary operator 0401
F. Scheimann-Shift foreman 0401
D. Miller-Auxiliary operator 0405
J. Gingrich-Auxiliary operator 0415
D. Laudermilch-Auxiliary operator 0420
S. Mull-Auxiliary operator 0445
1 Based on recollection of operators.
2 W. Zewe, E. Frederick, and C. Faust were in the control room at 0400.
`Times given are for initial arrivals in the control room and do not reflect departures or
subsequent returns to the control room.
ArPAÔHMENT 2.-Senior station personnel arriving on-site
Name and title: Time
G. Kunder 1_Unit 2 superintendent-Technical support 0445
M. Ross-Unit 1 operations supervisor 0510
R. Dubiel 2_Supervisor, radiation protection/chemistry 0540
J. Logan `-Unit 2 superintendent 0545
B. Mehier-Shift supervisor 0545
D. Shovlin-Maintenance superintendent 0610
G. Hitz-Shift supervisor 0615
I. Porter a-Lead I&C engineer 0625
J. Seelinger `-Unit 1 superintendent 0650
G. Miller s-Station superintendent (approx.) 0705
B.S. mechanical engineering.
`B.S. physics, and MS. nuclear engineering.
B.S. marine engineering.
B.S. electrical engineering.
`B.S. and MS. math.
Mr. WYDLER. There was a crew working on some part of the
cooling system, and it has been theorized that this may have
caused the pump to stop. How many people were working on that?
Mr. DIECKAMP. I don't know the answer to that.
Mr. WYDLER. Well, who would?
Mr. DIECKAMP. The plant staff knows that. We can provide that.
Mr. WYDLER. From what you have told me, frankly, I am trying
to get some picture of a control room operation. I cannot imagine
anything more boring in my life than to try to sit in a control room
at 4 o'clock in the morning, watching a panel, lights, or anything of
that nature.
PAGENO="0425"
421
But what I cannot understand is that you apparently have no
procedures. I just want to make sure I understand your testimony
in this regard, that when a shift came on duty, their first responsi-
bility was not to go around and to check each and every control
under their jurisdiction, to see how it was operating.
Is that or is that not the standard operating procedure in a
control room? Or do you just come on and assume if there is no
emergency taking place, everything is fine, you sit down and wait
for something to happen.
What is the procedure in the control room?
Mr. DIECKAMP. There is no formal transfer checklist.
Mr. WYDLER. I just want to know the procedure. The next two
men come on, take their seat somewhere in the control room, and
wait for something to take place. Is that really what you are telling
us?
Mr. DIECKAMP. The shift supervisor comes on in sufficient time
to be briefed on what is going on, what is the status of the plant,
whether things have changed, what problems they are having, or
the like.
He transfers that information to the operators that will be with
him during that shift. There is not a formal checkoff sheet on
positions, switches, valves, instruments.
Mr. ERTEL. If the gentleman will yield on that point.
Mr. WYDLER~ Let me just finish this. I just want to make sure I
do understand. Now, you described the problem of reading this
particular dial, which apparently was in a danger position, I pre-
sume, since it was shut, had shut the backup system for the cool-
ing. It must have been in sort of a danger position.
Does it have a red light on it?
Mr. DIECKAMP. Are you speaking of the indicator lights or the
auxiliary feed valves?
Mr. WYDLER. Exactly.
Mr. DIECKAMP. Yes; they have indicator lights.
Mr. WYDLER. Was there a red light on, on this indicator light?
Mr. DIECKAMP. The convention that is used in the control room is
that if something is open, the light is red; if something is closed,
the light is green. That is applied both to electric systems and to
hydraulic systems.
These valves had indicator lights on each, just adjacent to the
switch, red and green. Since the valves were closed, the lights must
have been indicating green when they should have been indicating
red.
There has only been one suggestion, that perhaps a tag on a
controller just above the valves may have obscured one set of
lights. It doesn't seem conceivable to me that it could have con-
cealed both sets of lights, and also I don't find solace in the fact
that that tag might have occasionally concealed a light.
But the lights are there. They must have been reading green
when they should have been reading red.
Mr. WYDLER. But that is just the opposite of what we would
expect, isn't it? Wouldn't you expect when something is in a dan-
gerous condition, that it would read red, and that when it is in the
nondangerous condition, it would be green?
PAGENO="0426"
422
I don't understand that system. Why would you put a valve that
is shut in a green position? Wouldn't you want to show-shouldn't
there be something in the control room, when something is not in
its normal condition, red or green, open or closed, doesn't really
indicate.
What you really want to know as an operator or somebody
responsible is is there something wrong. You don't want to know
where a valve is open or shut. You want to know is there some-
thing wrong with the system. What tells you that?
Mr. DIECKAMP. Congressman Wydler, we are back to the question
of the human engineering. I think there are areas here that can be
looked at. But let me simply say that. there are a great number of
valve positions and switches for electrical controls.
Sometimes open is safe; sometimes open is unsafe. The designers
of the control room adopt a definition or a convention, and the
convention that they have used in this case-and I don't know that
it is unusual-is that red means open and green means closed.
The only other factor that I would add to you is that in varying
conditions of, the plant, varying operating phases, from, shutdown
to startup, some of those positions are. not the same, as you go from
one phase to the other.
Thus, it is difficult-I wouldn't want to say impossible, but it is
difficult-to conceive of a situation where under all operating
modes of the plant you could walk into the control room~.and see all
the lights be green, and be assured that it is OK.
Mr. WYDLER. No, they are meaningless, I agree with you. The
color of the light doesn't mean anything unless you go and exam-
ine it in relation to the whole board.
But isn't there some system in the control room, this is what I
am asking, that tells the operator that there is a danger point in
the control room? I would assume that was true. I just found out
today it is not true at all, from what you are telling me.
Isn't there something in there that tells you there is a danger
point here, some light goes on, red, green, yellow, orange or a bell
rings and says there is a danger, look at it. There is nothing like
that?
Mr. DIECKAMP. There certainly is an alarm system which is
attached to many of the functions in the control room, which has
the purpose of bringing to the operator's attention an improper
status of some measurements, some piece of equipment or the like.
On these valves there was not that kind of alarm.
Mr. WYDLER. Thank you, Mr. Chairman.
Mr. MCCORMACK. Thank you, Mr. Wydler.
Mr. Ambro?
Mr. AMBR0. Mr. Chairman, I just have one quick line of question-
ing.
We have heard recently that Vepco is in financial trouble. What
is the financial status of Met-Ed?
Mr. DIECKAMP. The financial status of Met-Ed and, indeed, all of
the owning companies of Three Mile Island is at best tenuous.
Mr. AMBRO. Is there a relationship between costs and safety?
Mr. DIECKAMP. Absolutely not.
Mr. AMBRO. In other words, no expense was spared for safety?
PAGENO="0427"
423
Mr. DIECKAMP. For all practical purposes, I can subscribe to that
statement. We did not, however, cause the cost of the plant to
reach infinity. It did have a finite cost. But I know of no case
where conscious decisions were made which undercut or reduced
safety in the interest of cost reductions.
Mr. AMBRO. Now, I recognize that testimony as the result of
Three Mile Island comes after the fact. But this committee was
fortunate enough to have Dr. Teller and other expert testimony on
a theoretical level, and they suggested that in the first place reac-
tors themselves could be improved.
The line of questioning here proceeds from two other things they
said.
One, that the operators were ill-trained and that we would be
wise if we moved in the direction of training them, much the same
as pilots are trained. Check lists of the kind you heard talked
about, should have been used. They said as well, and I think I am
correct, computers today are sufficiently sophisticated to provide
data and information for almost instant action.
Now, if after the fact these observations are offered, are we to
believe that since they are relatively simple that the same observa-
tions were not part of the dialog when one was dealing with the
question of safety in these plants?
Mr. DIECKAMP. I think all of those questions or all of these topics,
training and use of computers, use of procedures and check lists,
certainly have been an integral part of the safety of nuclear plants.
I must say, though, that there is no absolute truth, and so one
makes judgments about how far you need to go in a given area
based upon your analysis of the situation, your postulated failure
modes or problem areas and your experiences.
Mr. AMBRO: Well, I recognize that. I think that this is the way
that most things do take form. If there was no relationship be-
tween costs and safety, what was it that prompted decisionmakers
to turn away from better trained operators, check lists, automatic
systems, computer data retrieval and things like that?
It seems almost cavalier to look away from that and not develop
a variety of worst-case scenarios, even based on the kinds of acci-
dents that could never happen, but indeed did happen, in order to
come up with these kinds of systems which I would suspect are
relatively inexpensive in terms of safety consideration.
What would motivate one not to move in the direction of these
kinds of procedures?
Mr. DIECKAMP. I think there are motivations that cause one to
adopt a certain level of sophistication or Oertain level of coverage,
and I think I can give you a few examples.
In terms of the equipment area, I think if one adopted the
approach of continuing to add equipment you would soon find that
the plants would become so complex that they became increasingly
difficult to understand and operate.
Let's talk about the checklist, the problem of the open block
valves on the auxiliary feed system, the testing of those, the sur-
veillance of testing of those was accomplished with a very specific,
very detailed checklist.
The check list alone does not prevent human failure. In fact, I
might almost suggest that one of the things that has happened to
PAGENO="0428"
424
us is we have taken on such an administrative burden of paper-
work in the plants that people become somewhat inured to the real
meaning of what they are doing.
We get to be doing things by the numbers rather than because
they are really important.
Now, I know that does not sound good, but I think we are
dealing with human beings, and if something becomes a paperwork
burden, it does not necessarily engender the best possible response.
In the computer area, I would be reluctant to decide that com-
puters were the solution to the problem because, after all, comput-
ers know nothing more than what the man puts into them. To the
extent that the computer could be used to expand the man's ability
to gain visibility or to assess what the situation is, I think there is
an area that should be explored fully. But I would be reluctant to
assume that we can just solve the problem by computers.
Mr. AMBRO. Well, it seems to me that your response indicates,
when you say that an operator would become inured to what they
are doing, that check lists alone don't prevent human failure.
Further, you would be reluctant to move in the direction of com-
puters, there you fly in the face of the testimony of most well-
respected scientists. But more than that, you hint at the notion
that you are not open, as the result of this accident, to reassessing
these very basic concepts and utilizing them for the assurance in
the future that they won't happen again.
Now, am I reading that right or am I not?
Mr. DIECKAMP. I would like to state emphatically that you are
reading it wrong.
Mr. AMBR0. OK.
Mr. DIECKAMP. I am definitly open. I think I would like to hope
that the last half of my testimony suggests an openness to consider
all of these factors. My comments really are comments to provide
additional perspective so that none of us leap to premature conclu-
sions.
Mr. AMBRO~ I know we have a time constraint, Mr. Chairman,
but I must tell you, well, let me just ask you this final question.
In your appraisal or reevaluation with respect to the accident,
and in terms of these suggestions, costs will not be a consideration
in implementing any of these items that your review finds effica-
cious in dealing with anticipated problems?
Mr. DIECKAMP. That is correct.
Mr. AMBRO. All right.
Mr. Chairman, we have the opportunity to provide written ques-
tions to pursue these further?
Mr. MCCORMACK. Yes; indeed, we do, and Mr. Dieckamp, I am
sure will respond to any questions in writing.
Mr. AMBR0. Thank you.
Mr. MCCORMACK. I want to thank you, Mr. Dieckamp. We are
going to terminate our testimony with you at this time because we
have to move quickly to our other witnesses. But, if you are availa-
ble and can stay around for the rest of the hearing, maybe the
other members would want to ask you additional questions before
we finally adjourn.
I want to thank you very much.
Mr. DIECKAMP. Thank you.
PAGENO="0429"
425
Mr. MCCORMACK. We appreciate your testimony and look for-
ward to talking to you again in the future.
Our next witness is Lieutenant Governor William W. Scranton of
Pennsylvania, and I would like to ask Congressman Walker if he
would like to present him to us.
Mr. WALKER. Thank you, Mr. Chairman.
It is indeed my privilege to present to the committee Lieutenant
Governor Scranton. I think we should particularly welcome him
because he was on the scene throughout the crisis at Three Mile
Island, participated in all of the briefings, and was dealing with the
public and with the technological aspects of the crisis. I think he
can probably give us more information than practically anybody
else who dealt with this problem from a very personalized stand-
point.
So I thank you for inviting him and I welcome him here.
STATEMENT OF HON. WILLIAM W. SCRANTON III, LIEUTENANT
GOVERNOR, COMMONWEALTH OF PENNSYLVANIA
Mr. SCRANTON. Thank you.
Mr. MCCORMACK. Thank you and, Lieutenant Governor Scranton,
I want to join in the commendation Congressman Walker has
extended. I think that the conduct of the State government and
you as Lieutenant Governor and the Governor as well was exem-
plary.
Mr. SCRANTON. Thank you.
Mr. MCCORMACK. We are very proud and pleased and we are
very happy to have you here today to testify.
Your testimony in its entirety will be, without objection, included
in the record, and you may proceed as you wish.
[The prepared statement of William Scranton III follows:]
TESTIMONY OF L'r. Gov. WILLIAM W. SCRANTON III
Good morning. I wish to thank the members of the Subcommittee on Energy
Research and Production for the opportunity to express my views and recollections
of the Three Mile Island accident. I will keep my formal comments as brief as
possible and general in nature to give you an opportunity to focus in on specifics in
your questioning.
As Chairman of the Pennsylvania Emergency Management Agency (PEMA), I am
notified of every accident, disaster, and major emergency that occurs in our Com-
monwealth.
It was in this capacity that I was notified shortly after 8 am. on the morning of
Wednesday, March 28, 1979, of an incident that had occurred at the Three Mile
Island Reactor No. 2.
From the outset, the thought of an evacuation and the role that PEMA would
have to play was paramount in my mind. It is important, I believe, to point out that
throughout the entire incident, we took precautions to evaluate our civil defense
preparedness through outside sources and that we insisted on the assistance and the
approval of such agencies as the Federal Disaster Assistance Administration, De-
fense Civil Preparedness Agency, the Nuclear Regulatory Commission, the White
House and others in verifying our readiness.
I am sure that this esteemed subcommittee, along with the several other House
and Senate Committees in Washington, will in their search for bickground informa-
tion, question the events and how and why decisions were made.
The most difficult obstacle that we who advised Governor Thornburgh during the
seven day trial had to overcome was the gathering and evaluation of proper infor-
mation. Even with the nation's best minds and resources available, a nuclear
incident of this magnitude had never occurred in peacetime, and the ultimate
challenge, an evacuation of up to 600,000 people, was a task that everyone prayed
would never be necessary and still had to be anticipated.
PAGENO="0430"
426
From the first erroneous reports on the extent of the accident to my personal visit
to the plant site on Thursday to the appearance of the hydrogen bubble and the
disastrous consequences that it portended, the information problem grew.
The problems at the site were compounded by loose talk of a "massive" evacua-
tion, confusion over how many hydrogen bubbles were in the reactor, and, eventual-
ly, that celebrated bulletin on an imminent "explosion"-all of which seemed to
originate from sources who had yet to set foot in Pennsylvania, to say nothing of the
plant itself.
These sources-both official and self-appointed-simply could not appreciate the
complexity of what we were facing here.
They may have meant well, but they were a burden.
As you know, it has been widely reported that even Harold Denton and Dr. Roger
Mattson suggested evacuation early in the crisis-although neither of them made
such a proposal to me or my staff.
What has not been fully understood is that both men were saying these things
before they left the Washington area, and both changed there minds after arriving
at the plant site.
When Mr. Denton left us, he told the press, and I quote, "I guess I've learned that
emergencies can only be managed by people on the site. They can't be managed
back in Washington."
Although Mr. Denton is capable of speaking for himself, I believe his remark
applied not only to the fact-finding needs of decisionmakers, but to the technical
operations at the plant as well.
I feel that this point was, indeed, one of the most important lessons to be learned
from the incident. I recommend that it be considered in any revisions to be made in
our federal emergency response procedures.
Without reenacting the entire process, I would like to give you an account of some
of the more significant actions we took in this matter.
The moment we learned of the accident, the Governor ordered the acceleration of
an appraisal we had begun on the emergency prepardness system developed by the
previous Administration in Pennsylvania.
It was a workable system, but we did find weaknesses-which we moved as
quickly as possible to correct.
We also ordered our civil defense and National Guard units to assume an alert
status, taking care, however, to aviod a show of helmets and sirens which might, in
themselves, have caused a panic.
While the plan itself, like all such plans, depended, in the end, on the people
behind it, there were some structural problems to which this commission might
address itself.
The existing federal requirement was for a plan that contemplated evacuation of
the area within five miles of the facility.
At the time of the incident, there was a proposal on the table related to extending
that area to ten miles. There were also some speculation about a twenty-mile
evacuation.
This speculation made it extremely difficult for our planners to predict the
psychological impact of even a five-mile order.
They had to consider the possibility, for example, that people twenty miles
away-having heard the speculation affecting them-might take to the highways
and further complicate movement of people out of the real danger zone-the five
mile area.
I believe the development of clear evacuation parameters, and the education of
the public as to what those parameters should be in any given situation, would
greatly aid emergency preparedness officials in the future.
We don't want anyone to have to deal with a TMI again. But if it happens, let us
see that this particular lesson is not lost to posterity.
There are many improvements that can be made to enhance nuclear safety and
improve the capability of public officials to deal with a nuclear emergency. I am
sure the various special commissions and committees looking into the Three Mile
Island nuclear accident will come forth with many necessary changes among which
I would hope to be requirements for closer monitoring of nuclear power plants by
qualified federal and state agencies as well as a clearly defined state role in
ensuring the safe operation of nuclear plants. As a result of Three Mile Island,
there should as well be developed clearly defined emergency procedures which are
well understood by the populace in advance of any potential incident and a greater
effort must be made to arrive at a popular understanding of both the perils and the
potential of the fission process. This is particularly important in alleviating the
potential of panic and fear which is particularly prevalent in nuclear incidents due
to the fact that radiation is invisible and not well understood.
PAGENO="0431"
427
It is important, I believe, to review current permissible dosages of radiation and
arrive at specifically understood radiation levels whose presence in a nuclear acci-
dent would trigger specific actions by civil defense and other state agencies. Fur-
thermore, I would suggest that both on-site and off-site readings during an incident
be taken and reported by public agencies rather than the utilities themselves as the
mere fact of information coming from a utility raises severe questions of credibility
in the public's minds, questions that may or may not be warranted but yet inevita-
bly contribute to fear and uncertainty.
Finally, in any emergency, it is necessary to establish as quickly as possible
credible and coordinated sources of public information, sources whose authOrity,
equanimity, and veracity will help still the many conflicting voices which often
serve more to confound than to enlighten.
Mr. SCRANTON. Thank you, Mr. Chairman.
Since the testimony in its entirety will be in the record, and I
assume most of the members if not all of the members of the
subcommittee have had a chance to look it over, in the interest of
time I would summarize some of the main points.
First of all, I was asked before coming here what on the first
page the term "PEMA" meant in the third paragraph. It means
Pennsylvania Emergency Management Agencies, which is a new-
fangled name for civil defense.
I think what my testimony points out are some of the problems
that we were involved with, and some of the suggestions that I
have, although I am sure there will be more from me and from the
Governor as we learn more about this accident, as to how to avoid
this or how better to handle it if it should happen again.
First of all, many witnesses have mentioned this, and it will be
mentioned for a long time to come, there is a very real, definite
informational problem both in getting information, reliable statisti-
cal information, that reasonable decisions could be made upon, and
also in dealing with information that was coming from other
sources which tended to be either inflammatory or tended not to be
based in fact as it was investigated.
A great deal of our time was spent not only finding out what
actually was happening but running down misleads we were get-
ting from other areas which tended to sap the energies we might
have put into finding exactly what was going on.
This is important. I don't mean to accuse anybody of anything
because I think this is natural. This happens very often in disas-
ters. But in a nuclear disaster there are particular dangers of a
psychological nature that there are not in other disasters.
In a flood or hurricane or fire or such, people can see it, they
know where the damage is. They understand it, because it's tangi-
ble or they can visualize it. But a nuclear disaster is not the same,
and because of that I think the psychological aspect of it is height-
ened tremendously, and in dealing with a nuclear emergency we
have to be aware of that.
Second of all, we at the State level took every precaution we
possibly could to bring in outside experts and to evaluate our civil
defense capability.
That included people from Washington, from the Defense Civil
Preparedness Agency, from the Federal Disaster Assistance
Agency, and others whom we sent out to the various counties
involved, of whom we asked, are there any holes in our civil
defense and, if so, what are they, and can you help us plug those
holes.
PAGENO="0432"
428
It was our posture all along to make sure we were not the only
ones that were having a look at how we could respond insofar as
civil defense was concerned.
Finally, I would like to read the very end of my testimony which
outlines to you some of the lessons which I think we learned, at
least the beginning of some of the lessons.
There are many improvements that can be made to enhance
nuclear safety and improve the capability of public officials to deal
with a nuclear emergency.
I am sure the various special commissions and committees look-
ing into the Three Mile Island nuclear accident will come forth
with many necessary changes among which I would hope to be
requirements for closer monitoring of nuclear power plants by
qualified Federal and State agencies as well as a clearly defined
State role in insuring the safe operation of nuclear plants.
As a result of Three Mile Island, there should as well be devel-
oped clearly defined emergency procedures which are well under-
stood by the populace in advance of any potential incident. A
greater effort must be made to arrive at a popular understanding
of both the perils and the potential of the fission process.
This is particularly important in alleviating the potential of
panic and fear which is particularly prevalent in nuclear incidents
due to the fact that radiation is invisible and not well understood.
It is important, I believe, to review current permissible dosages
of radiation and arrive at specifically understood radiation levels
whose presence in a nuclear accident would trigger specific actions
by civil defense and other State agencies.
As many of you know, this came into question in the middle of
the crisis and it's something I think has to be resolved.
Furthermore, I would suggest that both on-site and off-site read-
ings during an incident be taken and reported by public agencies
rather than the utilities themselves as the mere fact of information
coming from a utility raises severe questions of credibility in the
public's minds, questions that may or may not be warranted but
yet inevitably contribute to fear and uncertainty.
Finally, in any emergency, it is necessary to establish as quickly
as possible credible and coordinated sources of public information,
sources whose authority, equanimity, and veracity will help still
the many conflicting voices which often serve more to confound
than to enlighten.
I thank the chairman and the members of this committee and
Harold Denton's indulgence in allowing me to precede him in this,
and I would be happy to answer whatever questions I might be
able to answer at this point.
Mr. MCCORMACK. Thank you, Governor Scranton.
I might say the members of the committee and our friends here
today would be perhaps pleased to know one of the reasons we
moved you up is because of the fact that you are anxious about the
fact that the stork is fluttering about your chimney at the moment.
Mr. SCRANTON. Indeed, it is.
Mr. MCCORMACK. For the first time, and so we are all wishing
you well.
Mr. SCRANTON. Thank you.
PAGENO="0433"
429
Mr. MCCORMACK. And we wish your new family, your present
and new family well.
I have a couple of quick questions.
The first one is do you feel that you obtained adequate knowl-
edge as to the radiation exposure levels, total amount of radiation
release in this instance?
In other words, I am not saying what you could do in the future
to draw what you might design as an optimum system, but between
what you did with your own energy agencies and between what
NRC did and maybe what other operators do in ground monitoring
stations and helicopter sampling, do you believe that you had
adequate information and adequate knowledge of the radiation
release and exposure to population?
Mr. SCRANTON. Yes; I do. And if we had not, I think the probabil-
ity of evacuation would have been much higher. I am not sure we
had adequate readings on what was coming out of the plant. I am
confident we had adequate readings on what was showing up off-
site.
The reason I say I am confident about that is because almost at
the moment this occurred, we sent out, Metropolitan Edison sent
out monitors as part of the nuclear plan or assessment from the
Department of Environmental Resources, which quite frankly had
a limited ability to monitor, but nevertheless we sent them out.
We called in the Department of Energy emergency monitoring
team, which came in later that morning as well as a team from the
Nuclear Regulatory Commission which came from King of Prussia
outside of Philadelphia, the local regional team, and set up almost
immediately after site monitoring.
Those readings we received tended to fluctuate as radioactivity
will in the wind. The highest we received in those first few days
was 30 millirems offsite. At one point 30 millirems per-hour but
that soon dispersed.
I am confident, certainly, that the process of gathering informa-
tion could be enhanced, and I would suggest it be. But we never got
such conflicting information from those sources that would make
us question the credibility of the information we were getting.
Mr. MCCORMACK. So you are in general agreement with the
Nuclear Regulatory Commission's evaluation of the radiation re-
lease and radiation dose levels in the area, in general I mean?
Mr. SCRANTON. Yes.
Mr. MCCORMACK. You have a general consensus of what the
approximate exposure levels of the population were?
Mr. SCRANTON. Yes; yes.
Mr. MCCORMACK. The monitoring system is made up of a mix of
radiation level devices and dosimeters, film packs and so on. Did
you feel that these were adequately integrated and that they rein-
forced each other? Shall we say for the purpose of your knowledge,
do you think that they did integrate and reinforce each other?
Mr. SCRANTON. I would like to see more dosimeters. I think our
capability of making a determination as to the aggregate radioac-
tivity, particularly in the beginning, may have been weaker than it
ought to have been. But what we tried to do was take those areas
where we were receiving particularly high levels of radiation on a
per hour basis..
48-721 0 - 79 - 28
PAGENO="0434"
430
Mr. MCCORMACK. High being how much?
Mr. SCRANTON. The least was 30.
Mr. MCCORMACK. Thirty millirem?
Mr. SCRANTON. But I would say it was one or two sites, and
paying some attention there insofar as the aggregate was con-
cerned. I think in the future there ought to be some kind of NRC
or federally mandated plan to maintain a dosimeter capability
within 5, or whatever miles the NRC decided, radius of the plant in
the future. I think it would be more helpful.
Mr. MCCORMACK. It's a relatively simple thing to do to put the
film packs out.
Mr. SCRANTON. Yes.
Mr. MCCORMACK. You feel in retrospect that the dosimeter read-
ing you get and a monitoring device in operation reinforced each
other, in fact?
Mr. SCRANTON. Yes, and also, to my knowledge, and I would have
to. check this, but to my knowledge there were also dosimeters on-
site, and if you can extrapolate to what is occurring, assuming you
are going to get a much higher exposure on-site, I think you can
assume that, whatever you are getting offsite will be clearly less
than that.
I think the area where it is critical to have dosimeters are
various areas offsite. You can never predict the direction of the
wind or the weather conditions. You are always going to have to
extrapolate from information based on your experience. But I think
if I were designing a system, I would probably put a few more~~
dosimeters around.
Mr. MCCORMACK. OK. Now, we had a witness yesterday, Dr.
Chauncey Kepford who claimed that the Nuclear Regulatory Com-
mission lied to the public, claimed that there were radiation levels,
at some distance of 8 as high as 12 rads per hour, and he claimed
that there would be from hundreds to thousands of deaths from the
accident.
Do you have any comment on those statements?
Mr. SCRANTON. At no time did we receive information, and we
were not only getting it from the NRC, we were also getting it from
our Department of Environmental Resources, from the Department
of Energy, who was working for the State, and to be fair, even from
the utility.
Did we receive those kinds of doses? I am not an expert on
nuclear radiation, but we were very careful to monitor iodine levels
in milk, offsite, "nd to the extent that those large doses would
show up in milk I think we showed relatively small amounts of
iodine in the milk.
Furthermore, we are following up with a very extensive long
term health study to determine what deaths may have been related'
to this
Based on what we knew at the time, we had no information that
would corroborate what that witness said.
Mr. WALKER. Mr. Chairman, would you yield?
Mr. MCCORMACK. Certainly.
-. Mr. WALKER. Just quickly,. one of the contentions made by
Chauncey Kepford was there were no readings done more than 13
miles offsite. Were some of those readings being done by DER and
PAGENO="0435"
431
some of your work being done? Did they go out further than that,
say down toward Lancaster or out toward Reading?
Mr. SCRANTON. Bob, I don't know the answer to that question. I
would have to get that and check the record.
Mr. WALKER. If there were some readings done by the Depart-
ment of Environmental Resources, would you provide that for the
record, please?
Mr. SCRANTON. Certainly.
Mr. WALKER. I think that needs to be corrected if that were, in
fact, the case.
Mr. MCCORMACK. What was this that needs to be corrected?
Mr. WALKER. I am looking to correct if, in fact, it should be, Dr.
Kepford's testimony yesterday that there were no readings of more
than 13 miles out.
Mr.. MCCORMACK. Yes; I understand, OK.
Where was the site where he said the readings were up to 10
rads, what was the location he said yesterday; do you recall?
Mr. WALKER. I don't recall.
Mr. MCCORMACK. He didn't cite any location.
Mr. WALKER. I don't believe so.
Mr. SCRANTON. I would also add that the Department of Energy's
helicopter, which we called in, whose job is specifically to monitor
radiation, followed for the first couple of days the so-called plume. I
don't know how many miles out it followed, but continued to follow
it and monitor it, which commonsense would indicate would be the
highest level of exposure, and never came up with a level that
would put the public health in danger. But I will check that.
Mr. MCCORMACK. How far is Gouldsboro?
Mr. SCRANTON. That is cross the river, a 5-mile radius.
Mr. WALKER. 300 yards.
Mr. ERTEL. Less than half a mile.
Mr. MCCORMACK. OK.
Mr. WALKER. On that it would be helpful, and maybe we need to
ask the Department of Energy, NRC for this, but those readings
where the helicopter went out in the plume further I think would
also be very helpful to know what those readings were, because
that is really what we are talking about, I think.
His contention was that there was an inversion layer as the
plume went out which might not have gotten very high readings
close into the plant but very high readings further out. Readings
taken within the plume I think would be valuable in trying to
assess that particular argument.
Mr. ERTEL. If the gentleman will yield, I think maybe that would
be appropriate to develop in Mr. Ambro's hearings because he is
going to be talking about that in June.
Mr. MCCORMACK. This subcommittee will be handling low level
radiation hearings and we will be discussing that.
Mr. ERTEL. Well, the two of you, I guess.
Mr. MCCORMACK. Governor Scranton, the NRC says, we had.
testimony yesterday, that the integrated dose to the population in
the vicinity was an increase of about 1½ m-rem total integrated
dose. Do you feel this is a reasonable calculation?
Mr. SCRANTON. I hesitate to be pinned down on the specifics
because I don't know. What I can tell you is that on the basis of
PAGENO="0436"
432
our information that the integrated dose offsite was so low as not
to require even a precautionary evacuation except in the case of an
advisory precautionary evacuation, which the Governor advised for
pregnant women and preschool children.
It may have been higher, Mr. Chairman, but I really don't know.
It was never at the point that I think it became alarming.
Mr. MCCORMACK. Do you think that the Governor would, in
retrospect, knowing what he knows now, would he, if he had
known it then, have issued the advisory evacuation?
Mr. SCRANTON. Yes, yes, I do.
Mr. MCCORMACK. OK, thank you.
Mr. Walker?
Mr. WALKER. I wonder if you might comment, based upon your
experience with the public, what your impressions were as you
visited them in the refugee centers, and your assessment of the
public attitudes today, that have grown out of this, that might be
of help to us in evaluating their views of safety of nuclear plants.
What do they expect us to do in terms of assuring safety of nuclear
plants in your opinion?
Mr. SCRANTON. I think that there was at the time of the incident
exhibited a great amount of confusion in people's minds, apprehen-
sion. Maybe to some extent fear, but not panic.
I must say that I was impressed at the calm with which the
people of that part of Pennsylvania handled their situation. I think
after the tension of the incident was eased somewhat, that the
fears and the doubts came more to the forefront and are continu-
ing.
There is a very real problem of credibility. Whether that prob-
lem of credibility has a foundation, there is a very real problem of
credibility.
I think that people, first of all, want-if I could presume to talk
for them-a breather, just to recover.
Second, I think they want to know that there are responsible and
credible sources of oversight concerned with their health-not just
with the operation of the plant, but also with doses that are coming
off the plant, that will be frank in how they present that informa-
tion.
Finally, I think they want some knowledge, some knowns. There
has been so much that is unknown and controversial about nuclear
power that there is no place to hang your hat. Therefore, public
opinion is the victim to some extent of the slings and arrows of the
debate.
This has a terrifying-not terrifying, that overstates it-it has a
very unsettling effect on peoples' lives. I think what they want to
know is that they are going to be protected. I think what they want
to know is what they do if something like this happens.
I think they want to know to the extent this ever happens again,
they don't want it to happen there. But I think we want to know
what radiation does and doesn't do, and what they can expect. It is
a very big desire to fill.
Mr. WALKER. Thank you, Mr. Chairman.
Mr. MCCORMACK. Mr. Ertel?
Mr. ERTEL. Thank you, Mr. Chairman.
PAGENO="0437"
433
I am curious about two questions, and they are very brief. One is,
evidently recently-and I don't know where-Colonel Henderson
indicated that he had recommended an evacuation early in the
process. If my recollection is correct, it was on the day of the first
occurrence.
I really talk about two different occurrences-on the Wednesday
and the Friday. I am talking about the Wednesday. Do you have
any knowledge of that, and were you there? Is that true?
Mr. SCRANTON. Colonel Henderson, first of all, is the executive
director of Pennsylvania defense. I believe, Congressman, that-
you are talking about Friday morning?
Mr. ERTEL. I think Wednesday morning was my information.
Maybe I am incorrect. On the first day.
Mr. SCRANTON. I have no knowledge of him having advised evac-
uation on Wednesday.
Mr. ERTEL. OK. How about Friday?
Mr. SCRANTON. I do know that he advised the Governor of an
evacuation on Friday. Let me give you the background.
On Friday morning I received a call from Colonel Henderson at
my house saying that he had received a call from an official of the
Nuclear Regulatory Commission, a Mr. Collins, I believe, saying
that there had been a 1,200 millirem release from the plant, that
the plume was traveling down river, and that we should evacuate
within a 10-mile radius.
I called the Governor. I asked Colonel Henderson how long we
had to make a decision on it. His estimation was at that point
about half an hour. I did not ask him what his opinion was on
evacuation.
Mr. ERTEL. May I interrupt you for a moment. You are in charge
of civil defense by law in Pennsylvania, or by--
Mr. SCRANTON. By appointment.
Mr. ERTEL. Just so everybody understands how your role fits?
Mr. SCRANTON. I am the chairman of the Oversight Council. He
is the day-to-day executive director.
I called the Governor. I told him of the situation. He said had I
heard from our Department of Environmental Resources. I said no.
I said I haven't talked to anybody about it, it is just the word I
received from Colonel Henderson.
As we had done all through the crisis-and by this time we had
been subject to many conflicting pieces of information-we had to
track that down because we felt there were liabilities to evacuating
if there were not liabilities to not evacuating.
The Governor got on the phone with Colonel Henderson, with
our DER and NRC people in Washington. Apparently-I was not
there at the time-but Colonel Henderson says, and the Governor
agrees-the Governor said is your advice to evacuate. Colonel Hen-
derson said, based on what I know, which was the information that
came from Mr. Collins, yes.
We continued to track that down because we didn't know who
Mr. Collins was, and we didn't have any confirmation of that from
our people at DER.
It became clear to the Governor as he made those calls that
there was not substantiating information to require an evacuation,
that the downwind readings were not high, the plume was not at
PAGENO="0438"
434
the 1,200 millirem, although it was high, and there was not the
danger.
Mr. ERTEL. Were you there when this was going on?
Mr. SCRANTON. No, I was not. I was on my way into the civil
defense headquarters. Then later that morning I left civil defense
headquarters. and went into the Governor's office. He was on the
phone with NRC.
Colonel Henderson came with me. Colonel Henderson having
found the information that we then knew-and he has said this
publicly-indicated that he felt that at that point the Governor
was right, and there was no need for an evacuation.
Mr. ERTEL. The second question is one that I have received a lot
of communications about from people in the area. This is from
Swatara Township, which is a very large township, close to the
site, within a 3-mile radius.
They indicated and wanted to find out five answers to five ques-
tions. There is only one you may be able to provide an answer to. I
will read it.
Mr. Constanza has referred to the complete lack of communication which existed
at all levels during the emergency. He has also presented five important and critical
questions which have as yet remained unanswered.
I guess there are two here you may be able to answer. They said:
No cooperation, communication, coordination or decisions as the question of evac-
uation, either from Met-Ed, NRC or the Governor's office. All three organizations
ignored all local directors in Dauphin County Office of Emergency Preparedness as
though they were not in existence.
I guess he wants to know-he is the Swatara Township civil
defense director and I think he is also the township supervisor. I
had the same complaint from the Borough of Royaltown, adjacent
to Middletown. I had the same complaint from the director of civil
defense there.
Probably you could clear that up in the record.
Mr. SCRANTON. Yes~ I have admitted this and I will admit it here.
I think to sOme degree their complaints are warranted.
Let me explain to you how civil defense works in the State
because it is important to an understanding of that.
The State office of civil defense does not have a great deal of
power over the local counties, but it is a coordinating body and a
directing body. It is up to the local counties to come up with these
kinds of plans.
When this accident occurred, as planned Met-Ed notified Penn-
sylvania civil defense and the Dauphin County civil defense direc-
tor. Pennsylvania civil defense director then notified Dauphin
County and the surrounding county directors.
It is their job to notify their local municipal directors. To the
extent that may or may not have happened, I don't know.
Mr. ERTEL. May I interrupt you for a moment. I talked to some-
body in Dauphin County, and they were complaining to me they
were getting no information, either.
Mr. SCRANTON. That is further down the line. This is when the
accident occurred.
Second, the information that came out of the State Council of
Civil Defense, I think, for the first couple of days was pretty good
to the extent we knew the information.
PAGENO="0439"
435
It is not the job of the Governor's office to communicate with the
county civil defense; although I visited Dauphin County on two
occasions, one on I believe Saturday and perhaps Sunday morning,
and one again Monday afternoon because of this very problem.
By that time, Harold Denton was in Harrisburg. We had made
an agreement with the President that all technical information,
onsite information, information about what was going on at the
reactor, would come from Harold Denton.
He would come to the Governor's office and talk to us, and then
we would take him out, and there would be press conferences.
There would once or twice every day, be updates.
I think I, and I can only speak for myself, assumed that the local
civil defense people were listening to what Harold Denton had to
say. I think I probably underestimated the extent to which there
`was confusion on that level.
I think there was a feeling all along by the Governor's office that
~what was reliably known ought to be made public, and that it
ought to be disseminated. But I think as we go back and investi-
gate and search over the emergency management aspect of it, I
think the communication thing is going to take some looking into.
I personally visited Dauphin County on a number of occasions,
tried to placate them. I don't know about the local townships. That
has to come from the county. But our responsibility is to `the
county level.
There may have been some lack of communication. There was
never at any time a holding back of information on Three Mile
Island. That was the important thing. If we ever thought there was
a need to evacuate or had we ever thought they were not getting
information sufficient to prepare them for evacuation, that would
have been remedied immediately.
Mr. ERTEL. One other question. I think that is going to be a fuzzy
area, that people are going to be looking at for a long period of
time, because all I am getting is the aftermath, not getting the
information.
Dauphin County says they were not getting the information. This
keeps spiraling. I suppose as people's recollections fade a little bit
it is going to get worse instead of better.
Mr. SCRANTON. We kept Dauphin County very closely informed,
particularly during the height of the situation, over the weekend. I
went down there personally, and kept them informed.
Mr. ERTEL. The next question: "What is account No. 1978.323
S.B. 1104, Title 35, Health and Safety Emergency Management
Services, enacted 26 November 1978, if the State of Pennsylvania
doesn't abide by its contents?"
I haven't had a chance to look up that section. Do you know
what it is?
Mr. SCRANTON. No; I don't.
Mr. ERTEL. Then you won't have to answer the question.
Thank you.
Mr. MCCORMACK. We are going to recess in about 5 minutes,
until 1:30. This is at the request of both Congressmen Ertel and
Wydler. We are going to come back' at that time and pick up with
Mr. Denton.
PAGENO="0440"
436
I think you all can appreciate the fact that we are trying to get
the inforn~ion out, give~ people a chance to testify, and ask and
answer questions. If we have a fault, it is because we have sched-
uled so many interesting witnesses all in 1 day.
I shall not ask that the witnesses who have testified return at
that time, if it is inconvenient for you. That is up to your discre-
tion. Please don't feel obligated to come back unless it is conve-
nient because I don't want to hold you beyond this time.
Now, Mr. Ambro, do you have any questions?
Mr. AMBRO. I do not, Mr. Chairman.
Mr. MCCORMACK. I have a question.
Very quickly, in your testimony, you referred to the State role in
insuring safe operation of nuclear plants. This conjures up a great
number of problems.
Mr. SCRANTON. Yes; I know.
Mr. MCCORMACK. If I may interpret that as reflecting your desire
to know by examining, shall we say, the procedures, the NRC
licensing and so on, that it is being done properly.
Mr. SCRANTON. I am not suggesting that another bureaucracy be
set up on the State level. I am fully aware of the. dangers of that,
and particularly if there develope squabbles, for other the n techni-
cal reasons, between state and federal.
I do think, however, there was a feeling on the part of those of us
in State government, and the people in the area that State govern-
ment had a responsibility for the safety of the people, and yet had
very little control over what was going on at the plant.
I am only advocating in my testimony that State government
have more participation. I am not sure at this moment what the
extent of that participation ought to be. But I think it is definitely
warranted that it have more participation.
I don't think a nuclear powerplant, if the regulations of NRC are
adequate, should have to go through another State exhaustive
search. But I do think there ought to be a presence of the State,
and some power by the State to have some control, particularly in
an emergency situation.
I realize that is very vague. I only say that to introduce the
principle. What the specifics of that principle will be I cannot
outline here.
Mr. MCCORMACK. I appreciate that. I think it is wise to keep it
vague at the present time. I sympathize with your problem, but I
am sure you recognize the problems it conjures up.
Mr. SCRANTON. Absolutely.
Mr. MCCORMACK. Let me ask you one final question, if I may. In
your role as civil defense director for the Commonwealth of Penn-
sylvania, one of the obvious responsibilities that you have, it seems
to me, would be to mitigate potential fears that might lead to
hysteria, and-hysterical reaction.
I had telephone calls coming to my house, from people who lived
in Baltimore, wanting to know if they should evacuate because
they had 18-year-old daughters and were they safe. I told them the
Huns were not coming and the girls were safe.
Mr. SCRANTON. From radioactivity. [Laughter]
Mr. MCCORMACK. But the problem we run into is this hysterical
reaction, which has unfortunately been fanned by a lot of antinu-
PAGENO="0441"
437
clear activists-I will he charitable and call them activists-and a
large part of the press and media, hysterical and emotional reac-
tion, and overdramatization, oversensationalism, associated with
the whole question of nuclear energy and radiation exposure.
It would seem to me one of the contributions you could make to
the ultimate safety of the people of Pennsylvania is a sort of a
general appreciation of this, along with many other problems, so
that you would not have a hysterical reaction, in case you have an
accident.
For instance, I find it somewhat interesting that airline stewar-
desses get more radiation than any other professional group simply
because they fly high, they receive from 50 to 70 millirems of
exposure per month, which is more than virtually anybody around
the plant, and that is the maximum anybody around the plant
could have received, according to NRC calculations.
In other words, every airline stewardess, especially flying long
flights at high altitudes in jet planes, receives more radiation every
month than anybody received in total from the accident, any
member of the public around the plant.
Yet the airline stewardesses have just, because of their protest,
been allowed to fly while they are pregnant. So here they are
getting more radiation than anybody could have received around
the plant, and insisting that they work while they are pregnant.
Now, this is just a little example of the lack of understanding
and comprehension about radiation, and its effect and what low-
level radiation is. I wonder if it has occurred to you that a contri-
bution you might make to the people of Pennsylvania is some sort
of education program related to low-level radiation hazards, and
lack of hazard, so that they could treat these problems rationally if
such a problem should occur again.
Mr. SCRANTON. You are right on that. We are currently design-
ing a booklet, civil defense booklet, which is very rudimentary,
about what you do in a nuclear accident, what basically occurs.
Every cloud has a silver lining, and I think there is one here.
I think that any reluctance there might have been on the part of
populations in the United States to worry about radiation has been
swept away. I think we have an opportunity now to impose upon
people an education which they otherwise might not have gotten as
to what exactly are the differences between radiation that comes
from an atomic bomb, a nuclear plant, or cOme from a granite
building, or an airplane flight.
What are the thyroid hazards and others to pregnant mothers
and preschool children. I think that that will be known over time
as we investigate Three Mile Island. We are going to push it on the
State level, so people, when an accident occurs, know exactly what
is going to happen, or what can possibly happen and what can not,
so they can worry about what they ought to worry about.
A great deal has to do with the feeling of vulnerability out there
now. For instance, Europe, which has been vulnerable to wars for
several generations, has half again as much higher regard for civil
defense, military civil defense, than the United States of America
because we never felt ourselves threatened.
Just the ability to take precautions in case of an attack was
always something that we never took very seriously.
PAGENO="0442"
438
I think the same is true of nuclear power plant incidents. We
now feel vulnerable. I think that very vulnerability gives us the
opening to educate ourselves more as to what is going on. I think
that education will take place.
To the extent that I or the Civil Defense Agency of Pennsylvania
can be helpful in that, we are going to be.
Mr. MCCORMACK. Thank you very much. I might say that we will
be holding hearings on low level radiation in June, and I would
invite you to have some member of your staff come and sit in. They
look like they will be very worthwhile.
I want to thank you for coming. Especially I want to thank you
again for the remarkable responsibility, maybe it wasn't remark-
able in your case, but it was an outstanding example of responsible
leadership that you and the Governor of Pennsylvania provided.
I want to congratulate both of you for it.
Mr. SCRANTON. Thank you, Mr. Chairman, very much.
[Lt. Governor Scranton provided answers to additional questions
for the record. These questions and answers are in the Appendix,
beginning on page 1163.]
Mr. MCCORMACK. We will recess Until about 1:30.
[Whereupon, at 1:05 p.m., the subcommittee recessed, to recon-
vene at 1:30 p.m., the same day.]
AFTERNOON SESSION
Mr. MCCORMACK. The committee will come to order, please.
We will resume our hearing on Three Mile Island.
Our next witness is Mr. William Denton, who is Director of the
Office of Nuclear Reactor Regulation of the Nuclear Regulatory
Commission.
Mr. Denton covered himself with glory and became a TV star
during the days immediately following the Three Mile Island acci-
dent.
I understand there were T-shirts printed in the Three Mile
Island area that said something to the effect that, "Harold Denton
can activate me any time he wishes", or something like that.
Mr. DENTON. That came after I left.
Mr. MCCORMACK. In any event, we are very happy to have you
here, Mr. Denton, and we would like to ask you to introduce your
colleagues you have brought with you.
Your testimony has already been inserted in the record in its
entirety.
[The prepared statement of Mr. Denton follows:]
PAGENO="0443"
439
TESTIMONY
OF
HAROLD R. DENTON, DIRECTOR
OFFICE OF NUCLEAR REACTOR REGULATION
BEFORE
THE SUBCOMMITTEE ON ENERGY
RESEARCH AND PRODUCTION
OF THE
HOUSE COMMITTEE ON SCIENCE AND TECHNOLOGY
WEDNESDAY, MAY 23, 1979
Thank you, Mr. Chairman. I appreciate the opportunity to discuss with the
Subcommittee the accident at the Three Mile Island Nuclear Station and'its
implications to reactor regulation and to nuclear safety technology.
The significant events of the accident have received considerable publicity and
have been discussed at some length with various Congressional committees. I
will not attempt to recount those events in detail here. However, I have brought
a copy of a detailed sequence of events prepared by the Office of Inspection and
Enforcement. I would like to submit a copy of that for the record along with
several figures that I will be referring to later in my testimony.
The details of the accident continue to be extensively investigated. However,
based on the partial investigations to date, six main factors have been identi-
fied that caused or increased the severity of the accident. The apparent fac-
tors include a combination of design deficiencies, equipment failures, and oper-
ator error. Specifically, they are:
1. At the time of the initiating event, loss of feedwater, both of the auxiliary
feedwater trains were valved out of service. This was a violation of the plant
Technical Specifications which are part of the facility's Operating License.
PAGENO="0444"
440
2. The pressurizer electromatic relief valve, which opened during the initial pres-
sure surge, failed to close when the pressure decreased below the actuation
level. The block valve downstream of the relief valve was not used immediately
for isolation of the leak.
3. Following-rapid system depressurization, the pressurizer level indication may
have led to erroneous inferences of adequate water inventory in the reactor
coolant system. The pressurizer level indication led the operators to pre-
maturely terminate high pressure injection flow, even though substantial
voids existed in the reactor coolant system.
4. Because the containment does not isolate on high pressure injection (HPI)
initiation, the highly radioactive water from the relief valve discharge was
pumped out of the-containment by the automatic initiation of a transfer pump.
This water entered the radioactive waste treatment system in the auxiliary
building where some of it overflowed to the floor. Outgassing from this water
and discharge through the auxiliary building ventilation system and filters
was the principal source of the offsite release of radioactive noble gases.
5. - Subsequently, the high pressure injection system was intermittently operated
attempting to control apparent primary coolant inventory losses through the
electromatic relief valve, based on observed pressurizer level indication
which led to a further reduction in primary coolant inventory.
6. Tripping of all reactor coolant pumps during the course of the transient
to protect against pump damage due to pump vibration, led to fuel damage
since voids in the reactor coolant system prevented natural circulation.
PAGENO="0445"
441
Certain actions have already been identified and are being implemented on
operating plants similar to Three Mile Island and on other operating plants
to prevent recurrence of the accident. Reviews of these plants are ongoing
by the NRC staff. I will discuss these ongoing actions later.
In addition to the various Congressional investigations being conducted and
the Presidents Commission to Investigate the Three Mile Island Accident,
extensive investigations of the accident are being conducted by the NRC, in-
cluding the Advisory Committee on Reactor Safeguards. These investigations
are to determine the facts, to identify the need for improvements in the de-
sign and operation of nuclear plants, to identify the need for changes in
regulatory requirements and procedures, incident response capability and emer-
gency preparedness, and to identify safety research and development needs.
Our initial review of the accident indicates that there are a number of areas
where improvements should be made. First, an area that will receive increased
emphasis in our staff reviews is on the analyses of anticipated transients and
small break loss-of-coolant accidents. Our bounding approach to the analysis
of such transients and accidents in the past must be rethought and replaced by
a more rigorous approach that includes a more appropriate treatment of equipment
failures, system interactions and operator actions. This idealized approach has,
in the past, given us a level of confidence in our existing licensing require-
ments and procedures that perhaps appears unwarranted in retrospect. Increased
emphasis in this area will include an upgrading of the NRC's independent capa-
bility to perform calculations for transients and small break loss-of-coolant
accidents.
PAGENO="0446"
442
A second area is a careful reexamination of. the sensitivity of all plant de-
signs based on these transient and accident analyses to determine the need for
new safety systems or improved operating procedures.
A third area is a substantial upgrading of reactor operator training and staffing.
In addition, a hard look at the adequacy of the information available to oper-
ators, th~ procedures which operators employ and various aspects of human factors
engineering will be undertaken. The objective of such reviews will be to make
the operator a more effective recovery agent or incident/accident mitigator.
A fourth area, which has already received considerable publicity and discussions
is a renewed examination of the emergency response capability of licensees and
local, State and Federal officials. We are moving rapidly to install direct
and dedicated telephone lines between operating plants, the NRC Response Center
and the NRC Regional Offices. We anticipate that the first system will be in-
stalled by the end of May and that most facilities will have a direct line by
the end of June. In additionto the improvements to off-site response capability,
increased priority will be given to the licensee's post-accidentmonitoring
equipment. Such equipment will be upgraded where necessary to improve the
ability of licensees to determine and advise others as to the magnitude of an
accidental release.
There are many more areas where improvements will be considered. Requirements
for design changes and operational improvements beyond those already being
implemented are likely to result from the extensive investigations being con-
ducted. These requirements will be reflected in new or revised regulations,
changes in review and inspection practices and procedures, new or revised in-
dustry standards, and improved and more explicit regulatory guidance.
PAGENO="0447"
443
The immediate focus of the staff's activities arising from the TMI-2
accident was three-fold: (1) provide the technical and regulatory support
necessary to assure the safe operational shutdown of TMI-2; (2) assure that
other reactor ope~'ators, particularly for those plants similar in design
to TMI-2, take immediate actions to substantially reduce the potential for
subsequent TMI-2 type events and (3) start comprehensive investigations into
the potential generic implications of this accident onother operating
reactors. This evaluation sequence is shown in Figure 1.
Priority of these last two actions was initially on reactors of the B&W de-
sign, but as short-term actions on these plants are completed, priority is then
shifted to other PWR plants manufactured by Westinghouse and Combustion En-
gineering. Activities relating to boiling water reactors, a significantly
different light water reactor type manufactured by General Electric Company,
are being pursued as a third priority.
The preliminary review of the accident chronology identified several events
that occurred during the accident and contributed significantly to its
severity. All holders of operating `licenses were subsequently instructed
to take a number of immediate actions to avoid repetition of these errors,
in accordance with bulletins issued by the Coninission's Office of Inspection
and Enforcement. The initial bulletins defined actions by operating plants
using the B&W reactor system, but as staff evaluations determined that
additional actions were necessary, these bulletins were subsequently expanded,
clarified, and issued to all operating plants for action. For example, as
a result of staff evaluations, holders of operating licenses for B&W
designed reactors were instructed by I&E Bulletins to take further actions,
including irrinediate changes to decrease the reactor high pressure trip point
PAGENO="0448"
444
and increase the pressurizer pilot-operated relief valve settings. A
chronology of bulletins issued by the Office of Inspection & Enforcement
is shown on Figure -2.
In addition, as noted previously, the NRC staff began immediate
reevaluation of the design features of B&W reactors to determine whether,
and if so, what additional safety corrections or improvements were necessary.
This evaluation involved numerous meetings with B&W and certain of the
affected licensees, and included the formation of an interoffice evaluation
team to review the actions taken by licensees in response to the I&E
Bulletins.
The conclusion of these preliminary staff studies were documented in an
April 25, 1979 status report to the Comission. We found that the B&W
designed reactors appeared to be unusually sensitive to certain off-normal
transient conditions originating in the secondary system. The features of
the B&W design that contribute to this sensitivity are: (1) design of
the steam generators to operate with relatively small liquid volumes in the
secondary side; (2) the lack of direct initiation of reactor trip upon the
occurrence of off-normal conditions in the feedwater system; (3) reliance
on an integrated control system (ICS) to automatically regulate feedwater
flow; (4) actuation before reactor trip of a pilot-operated relief valve
on the primary system pressurizer (which, if the valve sticks open, can
aggravate the event); and (5) a low steam generator elevation (relative to
the reactor vessel) which provides a smaller driving head for natural
circulation.
PAGENO="0449"
445
Because of these features, the B&W reactor design relies more than other
PWR designs on the reliability and performance characteristics of the
auxiliary feedwater system, the integrated control system, and the emergency
core cooling system (ECCS) performance to recover from certain anticipated
transients, such as loss of offsite power and loss of normal feedwater.
This, in turn, requires greater operator knowledge and skill to safely
manage the plant controls during such anticipated transients. Also as a
result of the work supporting the April 25, 1979 report, the NRC staff
identified that certain other short-term design and procedural changes at
operating B&W facilities were necessary to order to assure adequate protection
to public health and safety.
After a series of discussions between the NRC staff and licensees of
operating B&W plants, each licensee agreed to perform promptly the following
actions
(a) Upgrade the performance and reliability of the Emergency Feedwater
(EFW) system
(b) Implement operating procedures for initiating and controlling EFW
independent of the Integrated Control System
Cc) Implement a reactor trip that would be actuated on loss of main
feedwater and/or on turbine trip
Cd) Complete analyses for potential small breaks and implement operating
instructions to define required operator action in the event of such
small breaks
(e) Provide at least one Licensed Operator who has had Three Mile Island
Unit No. 2 (TMI-2) training on the B&W simulator in the control room.
48-721 0 - 79 - 29
PAGENO="0450"
446
Actions were initiated by the licensees to shut down the B&W plants
and kept them shut down until these actions could be completed and the
results reviewed by the staff. In addition to these modifications to be
implemented promptly, each licensee also proposed to carry out certain
additional long-term modifications to further enhance the capability and
reliability of the reactor to respond to various transient events.
These actions have been confirmed by a Commission order to each licensee.
In the case of the three-unit Oconee station, the necessary short-term
actions were satisfactorily completed last Friday (May 18), and the Duke
Power Company was given authorization to resume operation. Other sections
of the order, however, remain in effect pending completion of the longer-
term actions. Review of the actions completed and information submitted con-
tinues for the other B&W operating plants, and it is expected that authori-
zations to resume operation will be issued as individual plants satisfactorily
comolete the short-term actions over the next several weeks.
In terms of generic implications,wehave completedthe initial staff study
primarily focused uoon B&W reactors. The results of this study have been
published in a staff report (NUREG-0560). As shown in Figure 3, this study
considered the particular design features and operational history of
B&W operating plants in light of the TMI-2 accident and related current
licensing requirements. As a result of this concentrated effort, a number
of findings and recommendations (Figure 4) resulted which are now being
considered in other on-going and future investigations. Similar studies
are now well underway for the Westinghouse and Combustion Engineering operating
plants. These studies are expected to be completed and published next month.
PAGENO="0451"
447
A similar study of the operating boiling water reactors will also be performed
as a short-term effort. In addition, because of the importance that operators
play in assuring a safe recovery from unexpected transients and continued safe
plant operation, the staff has initiated a comprehensive review of current
programs for operator training.
As noted previously, the staff has concentrated on the imediate and short-
term actions necessary to assure the safe operation of ooerating olants.
However, basedupon actions already completed, we are aware of a relatively
large number of items which warrant serious, careful study. These actions are
being documented for detailed assessment as a `lessons learned' activity.
Preliminary areas for investigation are identified later in this testimony.
This activity, coupled with other ongoing investigations, both within and
without the NRC, is expected to result in a number of imorovements in our
regulatory requirements, and in the review and inspection process. These
efforts are also expected to identify additional technical concerns which
should be addressed throuqh new or redirected research programs. For ex-
ample, discussions are now underway to conduct some small break LOCA tests
at the LOFT facility to obtain a better understanding of small break LOCA phenomen
phenomena and to use the results to verify calculational techniques. Other
recommendations in this regard will be a specific element of our longer-range
studies.
The final area that I would like to address is the realignment of priorities and
resources within NRR that have resulted from the accident at TMI-2. The accident
has and continues to require that a significant number of managerial and technical
members of the staff be diverted from their regularly scheduled licensing activities.
PAGENO="0452"
448
It is clear that certain tasks that have evolved since the accident require high
priority attention. These activities (ThI Direct Support, Bulletins/Orders,
and "Lessons Learned") are currently assigned the manpower necessary to support
these efforts. This manpower has been diverted from other NRR work and the
remaining NRR priorities are the support of operating reactors (including the
Systematic Evaluation Program and Safeguards), the resolution of Unresolved
Safety Issues and a limited amount of casework reviews.
The 1111 support effort includes monitoring, reviewing and approving licensee's
core cooling, cleanup and recovery operations to assure that the reactor is
maintained in a safe, cold shutdown condition and that occupational and offsite
doses are as low asreasonably achievable. This effort will require a total
of about 14 professionals and managers assigned to the site and headquarters.
Since this task reqiires contiiuing and imediate attentior. and a task force
aooroacn appears to be in order ~see ~ 5). This level of effct has
decredsed from the approximately 150 staff members that were at or supporting
the site shortly after the accident. I would expect that this activity would
continue to about the end of this year.
The second major ThI related activity that utilize a dedicated task force is
the reviews of NRC issued bulletins and orders that were issued to all licensees
of cerating plants. This effort has already been discussed and the
organization of the approximately 35 managers and professionals is shown in
Figure 6. The initial efforts dealing with the shutdown B&~I reactors
is expected to be completed by about June 1, after which the task force will
PAGENO="0453"
449
assume an analogous role for the other operating plants. It is expected that
this group will apoly the results of other ongoing "lessons learned" grouos
to those olants under review that are nearing a licensinq decision date.
The third and final task force activity related to TMI is the tiRR
"lessons ~earned" study. This study will examine the accident at
TMI-2 to determine the implications on the technical basis used in
licensing to determine what requirements or research are needed
to buttress the regulatory process to continue to assure that there
is no undue risk to the public health and safety. The range of
areas of interest to NRR in which possible regulatory improvements
are suggested by the TMI accident, include:
(1) Reactor Operator Training and Licensing.
(2) Reactor Transient and Accident Analysis.
(3) Licensing Requirements for Safety and Process Equipment,
Instrumentation and Controls
(4) Offsite and Onsite Emergency Preparations and Procedures.
(5) Reactor Siting.
(6) Licensee Technical Qualifications.
(7) NRR Accident Response Role, Capability and Management.
(8) Reactor Operating Experience.
(9) Environmental Effects.
(10) Licensing Requirements for Post-Accident Monitoring
and Controls.
(11) Post-Accident Cleanup and' Recovery.
(12) NRR Engineering Evaluation of TMI-2 Event Sequence.
PAGENO="0454"
450
This effort will initially involve about 15 NRR managers and technical staff
members (see Figure 7). Some of the evaluations and all of the implementation
activities will be coordinated with other NRC offices. In addition to other
NRR staff, representatives of other NRC offices will work with other Federal
agencies, state and local governments, university, national laboratory and
industry groups.
The major recommendations of this group will be implemented as they are
developed on operating plants and license applications under review.
The task force efforts described above to support TMI related activities
will divert resources from other NRR tasks. This will be done by realigning
current and FY 1980 resources taking into account existing organizational
priorities. The other major post-flu priorities that will be briefly dis-
cussed are operating reactors, unresolved safety issues and casework (see
Figures 8-12 for the organizations perforniing these tasks.) A summary of
the impacts on our work will also be provided.
We will continue to review operating experience and to take those actions
necessary to assure safe operation, review requests to amend operating
licenses and implement new or revised regulations or licensing criteria.
Included in this effort is the evaluation of five plants that were shutdown
in mid-March due to computer errors in the seismic design. Also included is
the reactor related safeguards program and the Systematic Evaluation Pro-
gram (SEP). The SEP effort involves the review of the older operating
facilities with respect to current criteria and documents the results
PAGENO="0455"
451
and identifies the need for plant changes. It is felt that these efforts
could best be handled by the existing organizational structure and still
meet our FY 1979 goals.
The next priority area to receive redistributed resources is the Unresolved
Safety Issues Program. These items are those generic issues with potentially
significant public safety implications that are reportable to Congress in
accordance with Section 210 of the Energy Reorganization Act, as amended.
This task is to continue to perform those reviews and analyses necessary to
complete generic tasks that address `Unresolved Safety Issues" with minimum
impact on current schedules. Initially this task will include the 19 generic
tasks identified in NUREG-0510 that address "Unresolved Safety Issues." Several
of these 19 generic tasks will likely be expanded to address issues identified
as a result of the TMI-2 accident. In addition, new `Unresolved Safety Issues"
will likely be identified as a result of the TMI-2 accident. This "Unresolved
Safety Issues" task will be expanded to include generic tasks to address these
new issues as they are identified.
As a result of the realignment of resources and priorities, the expected
accomplishments in the casework task will be severely limited. The priority
of case reviews will be:
o Near-Term OLs
O Comoletion of CPs in hearinq
* Other OLs where comoletion of construction is anticioated by
January 1981
o Soecial review considerations of a few CP and OL anolications
PAGENO="0456"
452
A preliminary and generally optimistic identification of specific reviews
that will be continued is contained in the final document I would like to
submit for the record. A final andmore realistic assessment of the expected
casework accomplishments can only be made after resour~e allocations to other
higher priority tasks and assignments to the Commission investigation have
been made. At this point in time the available resources can be matched
against the resources required to continue the reviews identified in the
above document on a "best-effort basis." It is our expectation that the case-
work accorntlishrnents are the most we can expect to accomplish and that it
is highly likely that accomplishments in this area would be less than iden-
tified.
In addition to the identified impacts on casework, the following FY 1979 and
FY 1980 efforts will be severely restricted in that these efforts will
continue only as available resources permit:
* Generic Issues (other than USI's)
* Licensing Improvements
* Topical Reports
*` Contract Management
* Research Coordination
* Non-NRR Support
* SRP Revisions
* Audit Calculations
* Advanced Reactors*
* Standards Assistance
* Training
In summary, I would note Chairman Hendrie's remarks where he stated:
PAGENO="0457"
453
"It is my view, and I am sure it is yours as well,
that we cannot have an acceptable nuclear power
program in this country if there is any appreciable
risk of events of the Three Mile Island kind occurr-
ing at nuclear power plants. The Nuclear Regulatory
Cocimission must promptly carry out a searching review
and evaluation of our own policies and procedures, in
addition to our investigation of what has taken place
at the Three Mile Island facility. We must find out
where our inspection and enforcement of safety-related
operating requirements, our design standards, and our
reviews of possible transient and accident situations
have somehow been inadequate to prevent the Three
Mile Island accident. We already have put those
elements of the staff that are not irnediately in-
volved in dealing with the situation at Three Mile
rsland to work on this essential and major effort.~
Mr. Chairman, that concludes my prepared remarks. I will be happy to
respond to any questions that you may have.
Thank you.
Mr. MCCORMACK. You may proceed with your testimony as you
wish.
Mr. ERTEL. If the Chairman will yield?
Mr. MCCORMACK. I will be glad to.
Mr. ERTEL. I think the things you said were very apropos of Mr.
Denton, and he is one of the bright spots, and in the good sense of
the word, at Three Mile Island as far as the people in Central
Pennsylvania are concerned, and they certainly appreciate the fact
he worked the long hours he did and brought the credibility he did
to the situation there.
On behalf of those people I want to thank him, too.
Mr. MCCORMACK. I must say I agree with the gentleman from
Pennsylvania, and I thought Mr. Denton's appearance and precise
handling of the matter and especially the way he did not allow the
press to put words in his mouth was a singular service to the
country.
Mr. Denton, please proceed.
STATEMENT OF HAROLD DENTON, DIRECTOR, OFFICE OF NU-
CLEAR REACTOR REGULATION, NUCLEAR REGULATORY COM-
MISSION, ACCOMPANIED BY ROGER MATTSON, DIRECTOR,
DIVISION OF SYSTEM SAFETY, NUCLEAR REGULATORY COM-
MISSION, AND FRANK CONGEL, ACTING BRANCH CHIEF, RA-
DIOLOGICAL ASSSESSMENT BRANCH, NUCLEAR REGULATORY
COMMISSION
Mr. DENTON. Thank you.
I should say at the outset I was supported by a large number of
NRC employees and other Federal employees, and I was really a
spokesman for the organization there.
The Chairman sends his regrets; he has a respiratory illness and
cannot be here today.
PAGENO="0458"
- 454
I am accompanied by Dr. Roger Mattson, who is Director of our
Division of System Safety. I have recently appointed him chairman
of a special task force to determine what lessons we can learn from
the Three Mile Island accident, and incorporate those lessons in
our requirements and in our research program.
On my right is Dr. Frank Congel, who is Acting Branch Chief of
the Radiological Assessment Branch, and Frank spent a lot of time
at Three Mile Island.
He was one of the coauthors of the report that has been dis-
cussed here concerning total man rem and occupational dose off-
site. So if we get to questions in that area I will need assistance
from him.
My testimony covers about three principal areas. First, I have
tried to summarize the highlights of the causes of the accident. The
second part of the testimony deals with the bulletins and orders we
have issued to licensees since the accident and the status of those
plants. The final part of the testimony deals with the realinement
of priorities and original structures within the organization to deal
with the implications of the Three Mile Island accident and the
plants for which we have not issued a license.
Let me review these, and in view of the time problems we can
take questions from the committee.
With regard to the first issue, the accident itself, I think a lot of
our major points have already been covered. I have attached to my
testimony a chronology developed by our Office of Inspection
Enforcement.
This is based on the results of the investigation of that office.
They have interviewed over 100 employees of the company. In the
right-hand side of that chronology is indicated the source of the
information, whether it's from interviews, charts, logs, computer
printouts, and this sort of thing.
I guess the only point I would like, or the major point I would
like, to add about the accident is the fact that if you get away from
what failed during the accident and the operator errors and equip-
ment design inadequacy, what was going on was inventory loss in
the reactor core that was unknown to the operators.
They were losing water and due to the fact that the instrumenta-
tion on the pressurizer was indicating high levels of water they
turned off the means by which they were adding water and the
core continuously lost water.
They also lost control of the pressure and the pressure dropped
in the system to what is called the saturation point to where voids
would form and the core began to uncover, and at 100 minutes into
the accident the temperature difference between the water going
into the core and the water coming out of the core began to diverge
widely indicating flow stagnation.
It was at that point that core damage first began, and there were
several subsequent times where the core may have been partially
uncovered also and further damage occurred.
Congressman Walker asked about the time at which water was
pumped out of the containment. According to the chronology I
have given you, it indicates that the water was first pumped out at
about 7 minutes into the accident. It's of some interest to note that
the sump of the containment at that time was not arranged so that
PAGENO="0459"
455
it pumped water into the normal tank in the auxiliary building,
which is a very large tank.
The system was alined to a very small tank in the auxiliary
building and besides that, the tank had a rupture disc which had
blown. This tank was not able to hold very much water and,
apparently, water overflowed this tank very shortly.
The amount of water that had to be processed in the auxiliary
building would have been markedly different if the system had
been alined to the more normal tank.
Mr. MCCORMACK. I interrupt you just to get some facts straight
at this point. You say the pumping from the sump started 7 min-
utes into the accident.
Mr. DENTON. Yes, sir.
Mr. MCCORMACK. What is the scale of the tank that receives the
water after it goes through the pressure release valve, the quench
tank? The quench tank was already filled?
Mr. DENTON. Let me ask if Roger remembers that.
Mr. MATTSON. There is some indication that the quench tank
relief valve was leaking. The relief valve was opening at a pres-
sure, I believe it says in the chronology attached here on the order
of 120 pounds, where it was designed to relieve at 150 pounds. So
there is speculation at this point-and little hard evidence, but
speculation-that there had been some leaking from the quench
tank during normal operations.
Mr. MCCORMACK. Isn't the quench tank very large, or is it as-
sumed it would only be receiving water for a very short time?
Mr. MATTSON. No; it's not very large.
Mr. MCCORMACK. It's normally expected to overflow or blow the
seal in any prolonged operation of pumping water along that path
from the high pressure injection system through the reactor
through the pressurizer, through the pressure release valve. You
then expect the quench tank seal to break in a relatively short
time; is that correct?
Mr. MATTSON. No; I think that is probably coming at it a little
bit wrong.
The quench tank is sized to take the expected opening of the
PORV to quench the steam that comes from the PORV and neither
pop its relief valve nor blow its rupture disk. It does have a relief
valve, so for prolonged opening it can relieve some of the steam in
a safe manner without rupturing the disk. But then it also has the
rupture disk so that for a very long opening of the PORV the
rupture disk will go rather than have the tank blow up.
Mr. DENTON. The system was designed for many types of tran-
sients and the pressure relief valve would open and prevent pres-
sure at that point of the system and might open from 15 to 30
seconds.
Mr. MCCORMACK. This is for steam, not water.
Mr. DENTON. This would be for steam, and it's a very, very small
opening in the system, so the quench tank size, I don't know the
precise size, but it obviously would be sized to withstand that
amount of water.
Mr. MCCORMACK. W~s there water overflowing out of the pres-
sure release valve or was it always steam?
PAGENO="0460"
456
Mr. DENTON. It certainly started as steam, but the pressurizer
was very nearly filled at some times.
Mr. MATTSON. The pressurizer level indicators were off scale,
high. We expect there was some two-phase water flow and some
solid water flow.
Mr. MCCORMACK. All right.
Another question, so we all understand what we are talking
about here. When the quench tank overflowed for whatever reason
into the sump, it activated the sump pump, and that was at 7
minutes.
Mr. DENTON. Yes, sir.
Mr. MCCORMACK. That started pumping water then into a small
tank instead of a large receiving tank in the auxiliary building?
Mr. DENTON. That is correct.
Mr. MCCORMACK. That tank had a rupture seal which also rup-
tured; is that correct?
Mr. DENTON. According to your investigation the rupture disk on
the small tank was ruptured prior to the accident and was sched-
uled for replacement.
Mr. MCCORMACK. So this may be categorized as additional me-
chanical failure?
Mr. DENTON. Well, I would read it more as a valve alinement
question. I am surprised it was aimed to a tank that was leaking.
Mr. MCCORMACK. An operational failure. Now, is this the path?
We have had some conflicting testimony, and all I want to do is get
the facts straight so we all understand this.
The primary path for the release of radiation to the atmosphere,
that is, from the sump to the auxiliary building and following, and
allowing for the fact that the tank in the auxiliary building also
overflowed, that the ventilation system in that building then would
have picked up the inert gases escaping from the water and they
would have gone out through the ventilating system and through
the traps and scrubbers and absorbers, and whatever.
Is that the path that the radiation release followed?
Mr. DENTON. I need to correct my testimony in that regard. I
think on~page 2, on item 4, I say that this was the principal source;
and I think we thought that at one time. It was a considerable
source, it was primarily coolant water which contained gases and
iodines and these were certainly evolved, having been spilled in the
auxiliary building.
However, a lot of gases that were released during the first few
days were the result of deliberate let-down flow into the auxiliary
building and controlling level inside of the reactor, and because of
leaks in the let-down system. This was also a significant cause.
So I don't think I can say whether it was the principal cause or
not. It was certainly a considerable amount, but which part we
have not ascertained.
Mr. MCCORMACK. The high pressure injection system uses borat-
ed water, doesn't it?
Mr. DENTON. Yes, sir.
Mr. MCCORMACK. This would take out the iodine, take out virtu-
ally all of the iodine, wouldn't it? It's the sodium tetraborate.
Wouldn't it pick up virtually all of the iodine in the water? Don't
PAGENO="0461"
457
you have an option here that you must choose, if you are getting
iodine out, you are not going to the borated water?
Mr. DENTON. Well, it certainly should bind it up but nonetheless,
there were still amounts of iodine being released from this let-down
tank several days after the accident, even in spite of the high
pressure injection system being used. So for one reason or another
iodine was still being evolved from the primary coolant let-down.
Mr. McC0RMAcK. Sorry to interrupt.
Mr. DENT0N. I think maybe I have said all I want to about the
accident per se.
Let me just touch briefly on some of the actions that we have
taken since the accident, then we will come back for questions.
In reviewing the accident we found B. & W. plants are unusually
sensitive to secondary system transients, and on page 6 I identify
five factors that make B. & W. pressurized water reactors consider-
ably more sensitive to transients than those designed by Westing-
house or Combustion Engineering.
First, design of the steam generator is such that it operates with
very small liquid volume in the secondary side. The amount of
water in a B. & W. steam generator is one-third to one-fourth the
water in a steam generator of the other types of suppliers, so this
means they have less tolerance for upset conditions.
The steam generator at TMI boiled dry in 1 to 2 minutes follow-
ing the loss of main feed water, and without auxiliary feed water
coming in. The other designs have times between 15 and 30 min-
utes before they would boil dry, so they have considerably higher
tolerance for errors, and to allow time for operator reaction.
Second, the B. & W. designs do not trip or scram on loss of feed
water or turbine trip directly. The other designs do. The B. & W.
plant, as originally designed, tripped only on high pressure, which
is much further away in time than tripping on loss of feed water
flow initially.
Third, B. & W. plants rely on an integrated control system to
regulate feed water flow. This controller itself has led to loss of
feed water flow transients in some plants and has had the capabili-
ty to interfere with the proper operation of the auxiliary feed
water system.
Fourth, the actuation before the reactor trip of the pilot operated
relief valve is unique to B. & W. plants. The other types of designs
do not or have not experienced the opening of the pressurize relief
valves as often as the B. & W. plants.
Last, the B. & W. plant has a smaller driving head for natural
circulation.
When we realized these features of the B. & W. plant more
clearly after the accident we issued orders to all of the B. & W.
plants, requiring they make certain changes. We required that
they upgrade their performance of the auxiliary feed water system,
they divorce the integrated control system from the auxiliary feed
system; they install wiring such that they would trip on loss of feed
water flow and turbine trip.
This reduces the heat generation of the reactor by 8 to 10 full
power seconds compared to the situation that existed before. We
required that they do detailed analysis for small breaks and that
PAGENO="0462"
458
they develop procedures and train operators to cope with these
events.
I have now permitted one B. & W. plant to go back into oper-
ation. That is the Oconee plant in South Carolina. We made a
finding prior to that they had complied with the terms of the order.
One plant at Oconee did not have to shut down according to the
order. The second plant had shut down and the third plant was
down for refueling.
All of the other B. & W. plants are all shut down. We are
reviewing those in a schedule to see when they comply with their
orders and allow them to return to operation.
Turning next to the longer term issue, we have restructured our
organization slightly to deal with the implications of the Three
Mile accident. I still continue to have about 20 professionals in-
volved in following modifications and cleanup at Three Mile. I have
a number of people involved in reviewing the bulletins and orders
we have issued to all of the plants.
We have created a special lessons learned group that Dr. Matt-
son is heading. This has required that I deplete the resources of the
staff that formerly would do a case review, so the Commission has
approved by deferring action on a large number of plants that we
would otherwise be working on during the next 6 months.
What we hope to do is to develop a list of those changes that we
would like to see made in plants before they receive operating
licenses or construction permits in the future. Once we develop this
list and have it reviewed by the ACRS we will send it to the
licensees and we will review their responses. The impact of this
kind of approach means that there is at least one plant, Salem II,
which is otherwise ready for an operating license that will not
receive an operating license until they have received from us the
changes we would like to see.
There might be one or two other plants which will be affected in
the schedule. Plants which are due to receive operating licenses by
the end of the year probably will not be affected if we are able to
complete our review of the Three Mile Island implications by that
time. So with this brief summary I would be happy to go into detail
on any of the aspects and I think perhaps we can take questions.
Mr. MCCORMACK. We will have questions for a few minutes and
then we have to go over and vote.
Mr. Denton, Dr. Chauncey Kepford yesterday in his testimony
talked about exposure rates which he said existed or said someone
else said existed. He claimed there were radiation levels of 10 rads,
said the NRC lied, said that there would be somewhere between
hundreds to thousands of deaths as a result of radiation from the
Three Mile Island accident.
Would you care to comment on that?
Mr. DENTON. We have followed radiation levels very closely from
the time we arrived. We had some 89 people on site Friday night,
about half of whom were involved in monitoring offsite. We in-
stalled our own monitoring equipment. I never heard those levels
ever reported or approaching those kinds of levels.
Mr. MCCORMACK. You heard Lieutenant Governor Scranton's tes-
timony just a few minutes ago where he claimed that his figures
PAGENO="0463"
459
and your figures agreed. I have forgotten the levels he quoted but
they were in the millirems.
Mr. DENTON. My estimate of the maximum offsite dose is on the
order of 100 millirems and I concur in those numbers contained in
the record generated by representatives from NRC, HEW, and a
number of other Federal agencies who pooled all of the data availa-
ble to us on doses and calculated maximum doses and man rem.
Let me ask Dr. Congel, who participated in writing the report, if he
would like to comment specifically.
Mr. MCCORMACK. Sure.
Dr. C0NGEL. The group I was a member of did make use of data
that were taken on and offsite, initially by the utility only and
subsequently by a number of agencies, including the NRC and
DOE. As Mr. Denton pointed out, it's our best estimate that the
maximum offsite exposure is less than 100 millirem and in our
report we say that the best value we have for it is 83 millirems.
This refers to a hypothetical individual.
We just chose a point where the dispersion was the poorest and,
therefore, the dose would be the highest, and hypothesized an
individual being there.
Mr. MCCORMACK. And this would take a person having to con-
stantly move to wherever the radiation level was highest.
Dr. CONGEL. No, sir; this would be at one location and the expo-
sure would take place during the time the plume--
Mr. MCCORMACK. So you chose the highest spot outside of the
fence?
Dr. CONGEL. Yes.
Mr. MCCORMACK. And the person there at that point for that
period, how long a period of time was that?
Dr. C0NGEL. This was for the duration that we covered in our
report, and that was from the beginning of the accident through
April 7. -
Mr. MCCORMACK. So about 10 days?
Dr. CONGEL. About 10 days.
Mr. MCCORMACK. Now, a person at the maximum exposure point
for about 10 days you believe would have received about 83 mil-
lirems.
Dr. CONGEL. Eighty-three. Because of some trimming of the
number we say less than 100, and that would characterize this.
This is at a location just offsite, in the east, northeast sector.
Mr. MCCORMACK. Do you think anyone actually was in that area
to receive that much?
Dr. CONGEL. No. The committee's consensus, as well as my own
view, is that this is a conservative or overestimation of a true
individual dose.
Mr. MCCORMACK. What is your belief that the maximum expo-
sure to any one person actually was?
Dr. CONGEL. Because of some uncertainties in times a person
would actually be there, I would say, off the top of my head, that
we probably overestimated by a factor of two, maybe more than
that.
Mr. MCCORMACK. You think the maximum exposure would be 30
to 40, right?
Dr. CONGEL. Thirty to forty, right.
PAGENO="0464"
460
Mr. MCCORMACK. Millirem?
Dr. CONGEL. Millirem, yes.
Mr. AMBRO. Mr. Chairman, would you yield just for a second?
Mr. MCCORMACK. Certainly.
Mr. AMBRO. As I recall the testimony of Lieutenant Governor
Scranton, he said Colonel Henderson of the commonwealth was
told by Mr. Collins, whoever he is, that the release was 1,200
millirems from the plant. Now, we are not only dealing with re-
ality we are dealing with government officials' perception.
Have you ever traced that account?
Mr. DENTON. Yes, sir. I can clarify that. I was in Bethesda that
morning at our incident center and we received a report from our
people at the site that a helicopter had measured a plume Over the
containment of approximatey 1,200 millirems an hour. We were
not sure of the source of the plume and what the chances were of
another puff release and, in fact, I think we had been told that
another release should be expected in 3 to 4 hours.
So, based on that, I and others recommended to the NRC that we
advise the Governor that evacuation was recommended.
Mr. AMBRO. But later the report turned out to be spurious or
false.
Mr. DENTON. We had the extreme communication difficulties
with people at the site. It was very difficult to communicate with
people who had source data and we had failed to establish any
contact with one person in the company who could verify certain
numbers, and this was understood to be a company helicopter and
a company number.
By the time we had informed the Commission we had data
coming into our incident center that the offsite doses were not
anything like what you would expect if you extrapolated that
plume, they were more on the order of 10 millirems an hour under
the maximum spot, for the plume. Apparently, the 1,200 number
could not be verified.
So, we had misinformation and, in fact, once I arrived at the site
I have never been able to pin down the source of this~ 1,200 mil-
lirem that was reported back.
So that particular number was one of many, I think, in those
early days that in retrospect we cannot confirm.
Mr. AMBR0. How fast was the wind moving at that time?
Mr. DENTON. Very stagnant, and the data indicated that what-
ever plume had been released that morning sort of hung over the
site, because the offsite doses, as I recall, were never measured to
be very high.
Mr. AMBRO. You feel if there had been a high reading you would
have found it?
Mr. DENTON. Yes, sir.
Mr. AMBR0. It would have blown away.
I think we should interrupt at this time and go to vote and we
can recess for about 10 minutes and take up where we are.
[A short recess was taken.]
Mr. McCORMACK. The committee will come to order.
Mr. Denton, although it is not specifically within the jurisdiction
of this committee, I would like to ask you a question about the
delay in licensing that you just mentioned in your testimony.
PAGENO="0465"
461
Can you tell me how many B. & W. plants there are that have
been on the line, that are now down, excluding Three Mile Island
II, following the Three Mile Island accident? How many are now
off the line and approximately when do you expect them to come
back on?
Mr. DENTON. Yes, sir. There were a total of nine B. & W. plants
licensed to operate before the accident. Three Mile Island unit 1
was down at the time of the accident of unit 2, and both of those
units still are shut down.
This left seven plants that had licenses to operate. When we
decided to issue orders, there were only four plants I believe actual-
ly in operation. That was the Rancho Seco plant in California and
the three units owned by the Duke Power Co., in South Carolina,
the Oconee units 1, 2, and 3.
The orders required that Rancho Seco shut down and that one
unit of the Oconee units shut down for that weekend. It gave the
Duke Power Co. 2 weeks to shut down a second unit, and 3 weeks
to shut down a third unit, if by that time they had not made the
changes that were required.
We focused our attention in reviewing their responses to the
order only on Oconee units, and we did complete last Friday a
review of the changes made by Oconee, and I found they had
complied with the order.
So, they did not have to shut down the unit that would have
otherwise been required by the order. However, they were not able
to start up the second unit because they had not qualified a suffi-
cient number of operators in the new required training.
Whenever they completed the qualfication of sufficient operators
to meet our requirements, they could. put the second unit into
operation. I understand they expected to meet that requirement
early in this week. So today or tomorrow they may be bringing the
second unit back into operation.
So they would be the only two units of B. & W. design that would
be operating in the near future. We would hope to complete on an
approximately one-a-week basis the other B. & W. plants.
Mr. MCCORMACK. So in about 6 weeks you would expect them to
be back on the line?
Mr. DENTON. Those who had completed their refueling. Some of
the B. & W. plants were down for other purposes than the order,
and they would remain down for whatever the activity was.
I understand that Rancho Seco, for example, is making some
modifications to the turbine generator equipment that requires
them to be down for several more weeks anyway.
Mr. MCCORMACK. What about the plants that were closed down
because of the uncertainty on the earthquake computer analysis?
There were six of those altogether, I believe.
Mr. DENTON. There were five.
Mr. MCCORMACK. When do you expect them to be back up?
Mr. DENTON. We have made very considerable progress on those
five, and I anticipate allowing one of those, Maine Yankee, to
resume operation this week.
At least one other plant is very near completing the analyses,
and they show with a few modifications, stresses will be within
limits, and perhaps a second one to follow next week.
48-721 0 - 79 - 30
PAGENO="0466"
462
There might be one plant which will take a considerably longer
period than the others, but we have come a long way since the
original five.
Mr. MCCORMACK. The plants that will be delayed getting their
licenses, like Salem, because of the general overall workload, and
the other plants whose licenses have been delayed because of the
overall workload, do you expect they will be on the line by late this
year, by summertime?
Mr. DENTON. There were six plants expected to receive operating
licenses between now and the end of the year. These are the ones
that, with the concurrence of the commission, we have said we
were not going to issue operating licenses until we have deter-
mined what changes they should make as a result of the Three
Mile Island accident.
We anticipate that will take at least 3 months, starting from
today, on each plant. So plants who would otherwise have been
ready between now and 3 months will be delayed.
But plants such as LaSalle, for example, that didn't expect to
complete construction until December, I would anticipate we could
review and make whatever changes were necessary in that plant
before it would be completed in any event.
Mr. MCCORMACK. It looks like we would have about 75 plants on
the line by the end of the year if everything goes well. Total in the
country.
Mr. DENTON. That is approximately correct, sir.
Mr. MCCORMACK. Thank you very much, Mr. Denton.
Mr. Wydler?
Mr. WYDLER. If I can just clear this up in my own mind. You
heard the testimony concerning this memorandum of January 8,
commission memorandum. You are aware of this memorandum?
Mr. DENTON. Yes, sir.
Mr. WYDLER. Did this memorandum-it is only described to me
as being a memorandum in which a commission inspector stated
there appeared to be generic safety problems with Babcock and
Wilcox designed nuclear plants.
Did it deal with any of the problems that we have been hearing
about all day today regarding Three Mile Island?
Mr. DENTON. Yes, it did. Mr. Criswell exhibited a good deal of
prescience in writing this memo. The events and types of concerns
he had were very much on the mark. I think it was reviewed in a
regional office f:~ a period of time and I think was transmitted to
headquarters on March 6.
Mr. WYDLER. March 6, they say the commission's assistant direc-
tor recommended that the Atomic Safety and Licensing Boards be
informed of it.
Mr. DENTON. So the memo was just beginning to get attention
and get in the formal chain about the time the accident happened.
Mr. Criswell has since appeared before the commission and other
bodies and explained the circumstances.
In our decision to order down the B. & W. plants, his views
played a considerable role and, in fact, we went back and reviewed
all the accidents or similar types of events that had occurred in B.
& W. plants before the Three Mile Island accident.
PAGENO="0467"
463
Mr. WYDLER. Well, I presume, then, what happened is that on
March 6 they decided to look at it in any event. You didn't arrive
at Three Mile Island until the day after the accident, so you
wouldn't have had much to do with that.
All of these matters that he has raised, whatever they are, are
being incorporated in your thinking regarding the relicensing of
the Babcock and Wilcox plants.
Mr. DENTON. Yes, sir. Let me ask Roger to be more specific.
Mr. WYDLER. All I want is a yes or no.
Mr. DENTON. Yes, sir.
Mr. WYDLER. Now, what would normally happen? Suppose there
had been no Three Mile Island accident and this report had
reached the people at Three Mile Island, and the other people with
Babcock and Wilcox plants?
What would they normally have done with a report of this kind
without Three Mile Island? They just read them and file them, or
did they actually do something with them?
Mr. DENTON. No, sir. Our procedures are as follows. If we have
already completed our safety evaluation, and issued it on a plant,
and that proceeding is before a board, and we obtain new informa-
tion, such as Mr. Criswell's memo, we send it to the board so that it
can be included as a part of the adjudicatory record, and be subject
to the normal hearing process, since we didn't know that at the
time we wrote our SER.
We would address those new items that come up before our
licensing board for all plants that we had already written an SER
on. But for the plants we had not written a report on, we would
have taken Mr. Criswell's memo and begun to reflect in our review
the kind of things he had brought up.
Since it had just reached my office that month, we had not yet
formally taken action on it. But the process for new information is
that we be sure that the boards know what we know whenever we
first get the information.
Mr. WYDLER. All right. Now I would like to spend the next few
minutes, if I can, just trying to get this clear again in my own
mind, picture what was taking place in the control room at Three
Mile Island, within the first couple of hours of the accident.
We did go there the next day, and frankly, I didn't get any kind
of useful information at all from that trip. As a matter of fact, on
reflection, I think it was probably harmful for me to go there and
get the report I did because it really lulled me into a sense that
everything was in pretty good shape.
But from what I have heard here today, the real damage to the
core took place not in the first few minutes of the accident-and
practically all those things we talk about, and spend so much time
on, discussing the valve and the pressure valve which didn't open
and close, almost seem terribly trivial and unimportant, frankly.
They all just seem to me to lead up to what was really done,
which was about an hour after the accident. It seems to me that
gave somebody the opportunity, the machines an opportunity, to
make a terrible mistake.
So, I would really almost discount everything that took place in
the first few minutes. If everything else had been handled properly,
they wouldn't have amounted to much.
PAGENO="0468"
464
It would be an incident and not an accident. It would be like
these other incidents we have from time to time in nuclear plants.
All the trouble seemed to start about an hour or so afterward,
when somebody started to take all the water out of the core. That
doesn't seem to me to have been done under any great pressure of
decisionmaking.
That seemed to me to be a situation that arose much later, and
somebody was making, it seemed to me, very deliberate decisions
on what was going to be done next. Isn't that a fact? The damage
really started much after all these first few minutes-that was just
a prelude, or set the stage for what really was done wrong.
Isn't that a fact?
Mr. DENTON. There were plenty of opportunities up to about 100
minutes to take action, to preclude core damage. The instrumenta-
tion--
Mr. WYDLER. In other words, there hasn't been any real damage
at all of any significant type for a long time-an hour or more,
almost 2 hours went by. Then the damage took place. Something
started to happen at that time, so that they got almost all the
water out of the core.
That was done long after the pressures of the initial malfunction
and all of these valves misfunctioning. That was all in the first few
minutes. This was 1½ hours, 2 hours later, that these dramatic
events took place, where the real damage took place, and where
the real accident took place. It happened 1½ or 2 hours later.
Mr. DENTON. But they had an incorrect impression of the condi-
tions in the core, because of those events that did occur. Let me ask
Roger to try to explain that.
Mr. WYDLER. Before you do-and I will give you every opportuni-
ty as far as I am given time-we have been told how there were
three people in the control room when the series of events started.
We didn't get a clear answer after that, but apparently those
three men were there for a while, and other people might have
arrived, although we are not sure they did, and if they did, we
don't know who they are.
But do we know who was in the control room at these controls at
the time that the water was all drained out of the core?
Mr. DENTON. Yes, we do.
Mr. WYDLER. How many men were in the control room at that
time?
Mr. DENTON. I and E has listed in the chronology, the details on
how many people arrived at each time. For example, the shift
foreman entered at 2½ minutes before the accident.
To set the stage for talking about the number of people, I think
it does reveal a deficiency in the way we have approached operator
licensing. We have tended to focus our requirements exclusively on
those people who are present at the controls of the plant.
We have never had any requirements for people who are auxil-
iary operators, people who run equipment other than the controls
of the reactor. Likewise, we don't have requirements on the super-
visors of the operators.
At the time of this accident there was not a college level engi-
neer in the unit. There is not one required by our regulations.
PAGENO="0469"
465
I think we need to look very hard at the staffing of power-
plants-not just the operators. They are trained to respond within
a certain construct of sequences that one might reasonably expect
and write procedures for.
But when a situation gets sufficiently far out of hand, then you
need engineers who understand the basic phenomenology.
So at the time of 21/2 minutes there was not anyone in the
control room but high school graduates who had been trained. We
have the times listed, as to how many people entered the control
room.
They called certain of the supervisors who took certain periods of
time to arrive. But the first few minutes it was just the three or
four people from the units there, and they built up to a very large
crew and eventually had to move people out of the control room
because of the large numbers of people.
But they were under a total misconception of the water level in
the reactor vessel because they kept seeing adequate level in the
pressurizer. What they didn't realize is that if the water in the rest
of the system got 2 or 3 degrees hotter than the water in the
pressurizer, it generated a sufficiently high pressure to keep the
water in the pressurizer from draining back to the reactor.
So what happened during this time is the pressurizer did stay
reasonably full of water. Yet the core uncovered more and more
and more because they let pressure drop to the point where water
was actually boiling in the reactor vessel, but not in the pressur-
izer.
So they uncovered the core at about 100 minutes and that is
when the real damage began to occur in the core. All that time,
they thought the reactor core was covered.
Mr. WYDLER. And there is no instrument that tells you defini-
tively that the water is draining out of the reactor core? I am a
layman, but all the demonstrations I have seen here today, every-
thing points to one thing-keep the water in the reactor core.
That is the No. 1 item. There is no definitive way to know the
water is in there?
Mr. DENTON. Under normal conditions if you keep the pressure
in the system high, so you keep the water from boiling, then it is
quite proper to measure the level at the highest point in the
system, such as the pressurizer.
If it is not boiling somewhere, you know you have water below
that point. They let pressure decline in the whole system below the
saturation pressure for the water that was in the reactor vessel,
and it began to create a steam void and bubble.
Mr. WYDLER. Just one more question. What are you doing about
the other reactors similar to this, to know in the future that the
pressurized water-that there is water in the core? How are we
making sure we are going to know that in the future?
Mr. DENTON. Our bulletins emphasize that you must keep the
pressure of PWR's higher than the pressure at which water would
boil for any given temperature. So our bulletins have already rein-
forced for all operators of these types of plants, don't rely merely
on the level indicator; you have got to look at the combination of
temperatures and pressures and keep the pressure at a certain
PAGENO="0470"
466
level higher than the boiling point for that water, and a number of
other actions.
Mr. ERTEL. Will the gentleman yield on that point.
You have to interpret the temperature pressure curve, is that
correct?
Mr. DENTON. You have to stay above the boiling point.
Mr. ERTEL. Now you have an interpretation by a reactor opera-
tor. What is the time sequence? If that gets out of sequence and
you get boiling in there. How soon will you in fact damage the
core? How much time does it take? Are we talking seconds?
Mr. DENTON. No. If you go to the other type of designs, they can
lose all water--
Mr. ERTEL. I am talking about B. & W.
Mr. DENTON. B. & W. only had 1 or 2 minutes to start with
before we made the changes that came out in the order. Let me ask
Roger if he remembers how many seconds we now have as a result
of the changes.
Mr. MATTSON. I think I understand the Congressman's question
to be slightly different. You are asking the question if he has a
saturation curve for the water, the operator, and he is comparing
the pressure in the reactor vessel versus the saturation curve, and
he finds out lo and behold that the pressure has dipped below the
saturation curve, how long does he have before he gets into trouble.
Three Mile Island of course is one accident sequence. If we stick
to the relatively slow moving accident sequences, which seems to
be the difficulty we have discovered through the Three Mile Island
accident, that is a very slow rate loss of coolant accident, he has
minutes to make adjustments of that sort.
Clearly the operators at Three Mile Island had tens of minutes
while they observed the reactor coolant pumps begin to behave
abnormally; that is, to vibrate, and for their flow to go down, even
though their power being delivered was constant.
That told them that the primary cooling system was voiding;
that is, it had become saturated and was generating steam. They
also made comparisons with the saturation curve apparently based
on their interviews, and had some appreciation of the fact that
there was a potential for boiling in the hot leg of the reactor
coolant system; that is, for diminishing core flow.
What isn't certain today, based on that kind of factual knowl-
edge, is why the operators chose to believe one instrument when
they had several other indicators which were contradictory to that
instrument.
Getting back to Mr. Wydler's question, there are indicators. It is
not simply because there is no direct level mesurement device
above the core, that does not mean that there are not indirect
indicators of whether or not there is water in the core.
The temperature of the water leaving the core is measured. It is
measured in several locations-in the piping, in the reactor system,
prior to the water being delivered to the steam generator.
It was also being measured in 52 locations 4 inches above the top
of the core, all of which were being printed out on the computer. It
can be argued that the computer is a little slow and wasn't intend-
ed for that kind of immediate hands-on operation. But the tempera-
PAGENO="0471"
467
ture indicators in the hot leg were intended for immediate hands-
on control and operation of the plant.
When they began to indicate higher temperatures-that is, su-
perheated steam coming from the core, the direct indication that
the core is uncovered-there is no other way to interpret those
thermocouples.
Mr. DENT0N. The temperature of the water leaving the reactor
vessel actually went off scale for a period of about 15 minutes at
that time, indicating the core was generating steam, and it wasn't
heating water.
Mr. WYDLER. We were told the next day that they thought there
must have been something wrong with the measurement devices, it
couldn't have taken place.
Mr. MATTSON. That is another one of the lessons. On several
occasions there were indications that were chosen not to be be-
lieved.
Mr. ERTEL. I think we are going to have to move on, Mr. Wydler.
We have two bells. I think we can recess at this time and we will
be back, reconvene at 3 p.m.
I hope you can stay, Mr. Denton. We have to vote.
The committee will stand in recess for 7 minutes.
[Brief recess.]
Mr. ERTEL. The subcommittee will come to order.
Mr. Denton, you obviously are aware of some of the questions I
have had, since I have asked the same question of the last two
witnesses.
If you want me to repeat the question for you, I will be glad to.
Well, I will, and then you can answer it.
The question is that the containment didn't go into actuation
until you had a 4 pounds per square inch of internal pressure
within the containment as I understand it. Up to the 4 p.s.i. there
was no real containment, is that correct?
Is that a design flaw of the plant? If it is, how did that manage
to be licensed?
Mr. DENTON. At the time it is true that we only required contain-
ment isolation on pressure. Before Three Mile Island we focused an
awful lot of attention on big pipe breaks, and we put a lot of our
resources into what would happen when a major pipe broke.
We didn't tend to focus nearly as much on small pipe breaks and
what they would do. We did change our design criteria some time
ago and required that containment isolate also on activation of the
emergency core cooling systems.
So that is two diverse signals. There are also radiation alarms
which would activate containment isolation, but containment isola-
tion is one of the lessons we learned, and we will be changing our
requirements in that area I am sure.
Mr. ERTEL. If you learned that previously, did you learn it prior
to the Three Mile Island incident that you ought to have contain-
ment even with a small pipe break? When did you set out some
sort of criteria for a containment in that area?
Mr. MATTSON. The licensing requirements on containment isola-
tion have changed in recent years. They changed in about 1975,
when the standard review plan in the Office of Nuclear Reactor
Regulations was first issued.
PAGENO="0472"
468
The requirements changed from allowing a single actuation
signal for containment isolation to a requirement for diverse actu-
ation signals.
Now, since the standard review plan was put out, any changes in
regulatory requirements have to go through a value impact consid-
eration. When a regulatory guide changes or a branch technical
position changes, you have to assess the safety significance and the
impact of the change before you can make a decision by the top
management of NRR, as to whether to backfit that requirement to
other plants.
Now, when the standard review plan was put out no such sys-
tematic value impact assessment was performed. Hence, there was
only forward fitting, no backfitting, of any new requirements con-
tained in the standard review plan.
Mr. ERTEL. May I interrupt you for a moment.
Mr. MATTSON. The diverse actuation signal was not backfit. In
retrospect, it appears it should have been.
Mr. ERTEL. Was this actuated when the containment went up to
4 p.s.i. and is that the correct criterion at the present time?
Mr. MATTSON. No, in a new plant that alone would not be an
acceptable criterion.
Mr. ERTEL. When did that change?
Mr. MATTSON. About 1975.
Mr. ERTEL. When was the approval of this plant?
Mr. MATTSON. 1978.
Mr. ERTEL. And why wasn't the approval of this plant subject to
the criteria which were developed in 1975?
Mr. MATTSON. Because of the policy decision in 1975 to not
backfit the requirements--
Mr. ERTEL. You are not backfitting. This plant is not built.
Mr. MATTSON. I am sorry. I should define what I mean by the
period of backfit. The standard review plan was forward fit to new
construction permit applications, not operating license application.
Mr. DENTON. Now, I might add, Congressman-we now require
that plants that receive operating licenses be compared to the
standard review plan, and differences from the standard review
plan be documented and justified.
Mr. ERTEL. So that has been corrected, is what you are telling
me. In the future we would not have this situation except possibly
for ongoing plants. Do we have ongoing B. & W. reactor plants
which still actuate at 4 p.s.i.?
Mr. DENTON. I think we do, sir.
Mr. MATTSON. But that is one of the lessons learned. I think it is
clear to us at this point, as we said in the bulletins immediately
following the Three Mile Island :incident, that all operating plants
and other people who receive the bulletin should review their
containment isolation provisions.
Further than that, we would expect to go back and require
diverse actuation of containment isolation.
Mr. ERTEL. Mr. Denton, you were saying I think that you require
that now, that there are plants with a 4 p.s.i. actuation for isola-
tion of the containment?
Mr. DENTON. What I was trying to say is I think there are plants
that don't meet our present standard review plan that are in
PAGENO="0473"
469
operation. This is new requirements on containment isolation for
all plants and will no doubt be one of the lessons learned-that we
backfit.
Mr. ERTEL. One lesson I learned in aircraft, if you find a design
flaw which can be in fact dangerous, they put out an air worthi-
ness directive, and that means change this. They do give you some
time. I agree with that.
On the other hand, many of those are on an immediate basis.
Mr. DENTON. We put out the ones that we felt to be of immediate
significance in the order. This other has been flagged in our report
as a forthcoming one. Since it is more after the accident than
preventive, we did the preventive ones first.
Mr. ERTEL. But it certainly has a lot to do with the health of the
public.
Mr. DENTON. Yes, sir.
Mr. ERTEL. I think it is something that I would be very con-
cerned about.
Second, I have a question based upon Mr. Wydler's statements
that he had a report which I think you documented-I wrote it
down-transmitted to you on March 6, concerning the problems
with B. & W. reactors, the Creswell report.
You received that on March 6. I think you said that immediately
the information is then given to the board, is that correct?
Mr. DENTON. We give it to all the boards which are in place, and
for which we have already otherwise completed our safety review.
So that when they are considering that application, they will have
all the information we have.
Mr. ERTEL. I just want to know-I am not sure you can answer
this, but it kind of upsets me, having heard that. I wrote a fairly
long letter to the chairman of the Nuclear Regulatory Commission
on February 9.
One of the questions raised in that was, "How will the NRC deal
with the types of safety issues raised by the Lewis study and what,
if any, improved safety precautions are needed in existing power-
plants?"
I had talked earlier about powerplants, some of them. The re-
sponse I received-I am trying to find the quote, I find to be quite
misleading.
His letter back to me 1 week prior to the accident stated:
The designers, builders, and owners of these plants are required to have effective
quality assurance programs and their work is subject to a continuing license inspec-
tion processes by the NRC. We believe this regulatory system has served us well. It
is an exceptionally rigorous system.
Now, it indicates to me, 1 week before this incident, you had a
report called the Creswell report, at least at your full staff level.
That letter was written to me on March 15.
Now, March 28, Three Mile Island went down. How can you
explain that response from the commissioner when you had the
Creswell report in your files?
Mr. DENTON. The original Creswell report was considered in our
region 3 Chicago office, and apparently Creswell had been raising
these concerns, I believe, for some time. It led to the documenta-
tion of his report, and the region in Chicago decided to send it into
headquarters.
PAGENO="0474"
470
I am not sure how long it had been in headquarters. It was
certainly there on March 6. I assume it is just our administrative
laggardness in making sure that everyone knew at the time you
received your reply.
Mr. ERTEL. So there really is no explanation for that.
Mr. DENTON. I would be happy to look into the matter. I can't
explain it today.
Mr. MATTSON. I think it is worth noting that our business is
reviewing potential safety questions. That is how the Office of
Nuclear Reactor Regulation spends its time. Certainly there is
more than one safety question in front of us at any given time.
That would be 1 of maybe 100 board notification matters present-
ly before the boards raising issues warranting further considera-
tion. The Creswell memorandum treats one aspect of the accident
at Three Mile Island. It certainly did not forecast the sequence of
events, it didn't forecast the equipment malfunction. It spoke to the
sensitivity of the machine to the level indicator.
It would have been better had that been received, processed, and
understood well in advance of Three Mile Island. It simply wasn't.
Mr. ERTEL. Well, I take it Mr. Denton indicates five problems you
envision with the B. & W. reactor. Basically, whether or not most
of those problems or those considerations were known prior to the
Three Mile Island accident you were having problems with the B.
& W. reactor?
Mr. MATTSON. With hindsight we certainly had a lot of precur-
sors. Other plants had similar types of events-none that quite
involved, the same sequence, but one of the things we are now
working on is a much better way of being sure that events which
happen at plants which are identically designed are collated and
trends looked for, so that these accidents are caught before they
turn into big ones.
Mr. ERTEL. The other question I have--
Mr. DENTON. Let me elaborate on that one just a little bit. I
think we might very well require that the licensees in the future
analyze, and diagnose all the events that happen in plants similar
to theirs, and propose solutions to us, as to how to keep it from
happening in the future.
I think perhaps in the past we took on too much of the burden
ourselves to review everything that was happening out in the
reactor world, and then writing regulations and rules that deal
with those, and allowed our licensees to sit back and not make
corrections until they were forced to by regulations.
Mr. ERTEL. Mr. Denton, I don't want to be critical but in another
area-it is my understanding that you issued the license for this
plant in March of the preceding year, 1978? Somewhere in that
neighborhood?
Mr. DENTON. Yes.
Mr. ERTEL. Then the plant is really brought on stream-it came
on stream just prior to the new year. My understanding further,
subject to correction, is that no NRC personnel were at the plant to
look it over, bringing this thing up to operating levels.
Once you issued the license, you never went back, is that correct?
Mr. DENTON. No. Our expected frequency is higher during the
startup of a plant than at any other phase, so once we issue the
PAGENO="0475"
471
license the plant is turned over to our Office of Inspection and
Enforcement, and I am sure it was inspected once a month during
that year. But we did not have resident inspectors at that site. We
had them in about 20 other sites, but not at Three Mile.
Mr. ERTEL. Then how do you explain it? My information is that
this plant was trying to be brought on-stream, and it was having
tremendous difficulties throughout the trial period, if you want to
call it that, before it went into commercial operation. In fact, I
think it was down three-fourths of the time because it was having
problems and a lot of them were feedwater problems, as I under-
stand.
Why wasn't that analyzed along with the other information we
had on feed water information on other B. & W. plants? Second,
how could this get on line just prior to the beginning of the year
when, in fact, it did add to Met Ed's certain financial capability? I
assume they get an investment tax credit and got additional depre-
ciation as a result of bringing it on line, and it was a substantial
financial gain to Met Ed, and this question is being asked by a
tremendous number of people.
Mr. DENTON. It's my understanding--
Mr. ERTEL. Now, we go back and say we have five different
things which we are looking at in this particular operation. That
we knew or should have known, and I think we do, frankly, and
when I say we, I mean the Federal Government, about the design
problems.
Now we are saying we are going to correct that and in addition
we get a statement, you quoted from Mr. Hendrick saying you are
going back and review this, and I got the same kind of statement
before that saying everything was hunky-dory, and now we are
saying there is something wrong with the way the NRC operates.
I wonder where is the credibility going to be established here?
Mr. DENTON. I guess my own view is maybe subconsciously we
had thought we had done enough, and that the process as it was
was adequate. I would compare it maybe to launching 300 ships
and they all seemed to be sailing fine, and perhaps you get compla-
cent about your design and then you have a ship sink and you
suddenly need plumbing and we really were not aggressively
changing our requirements in these areas before that.
I can only say that I hope we now learn, having had this, that
things were not nearly as good as we thought they were in a
number of areas.
Mr. ERTEL. I have the real problem of telling people we have
confidence in NRC and we are now going through a self-criticism
stage. But we are doing that and we might have had forsight. How
do I say to people we will have the foresight in the future?
Mr. DENTON. I think maybe we need some different mechanisms.
It certainly should not be business as usual. I would hope that in
our lesson learned study we can identify not just equipment fixes
or a valve here or indicator there, or new instrument, but see if we
cannot find ways to make the process totally function better.
For example, I think one of the things I learned up at Three
Mile was the need for the applicant or licensee to have his own
incident center. I think perhaps you mentioned how could things
have been managed better in the first few days.
PAGENO="0476"
472
Perhaps we should require the licensee have an incident center
where their technical staff, our staff, and State staffs can assemble
the kinds of information the public needs much earlier. Perhaps we
need licensees to produce daily reports for the public to be aware of
what is going on, find some way to change the mechanism of how
we review plants.
Mr. ERTEL. One further question and then I know we have to
recess to go vote again, I am sorry.
All of the time I was getting reports on Three Mile Island,
everybody said this hydrogen bubble or hydrogen problem, was
unexpected, that we had no models, we had no anticipation this
would happen. Are you still under that impression, Mr. Denton,
that we had no studies which would give us any kind of insight
into a possibility of hydrogen bubble.
I know it's not yours personally, but I am talking about the
experts in your group.
Mr. MATTSON. We had done no loss of coolant analysis, to my
knowledge, prior to Three Mile Island with a noncondensible
volume of gas in the primary cooling system.
Mr. ERTEL. There was a paper reported in the proceedings of the
topical meeting on thermal reactor safety, July 21, to August 4,
1977, at Sun Valley, Idaho, which talks about hydrogen generation
in reactor systems. The paper mentions dangers to the integrity of
the containment.
Mr. MATSON. Perhaps you didn't understand what I said. I said
in the primary coolant system there has been none. There has been
a lot of analysis of generation of hydrogen in loss of coolant acci-
dents with emphasis on the large break loss coolant and the track-
ing of hydogen out of the primary coolant system into the reactor
containment, and the potential for detonation inside of the contain-
ment.
That is a routine licensing requirement flowing from appendix
K, of 10 CFR part 50. That is what led to the need for recombiners
at Three Mile Island in their licensing.
It's a different matter to talk about a small break loss of collant
type accident as occurred at Three Mile, with the generation of
hydrogen during the accident, with the containment of that hydro-
gen inside of the reactor coolant system, where it could not get out
into the containment building and then to the auxiliary building
for burning in the recombiner. So the hydrogen bubble inside the
reactor coolant system was a new and novel problem in reactor
safety.
Now, there have been codevelopment activities over the years,
some at Idaho National Engineering Laboratory, as a matter of
fact, attempting to treat the movement and effect of noncondensi-
ble gases in reactor coolant systems during transients or small
break losses, but not from the standpoint of large volumes of
hydrogen.
They were more concerned with the effect on condensation and
heat transfer in the steam generator.
Mr. ERTEL. Perhaps I ought to read the first two lines of this to
you so you understand what I am referring to. But we will have to
recess at this time. However, with the uncovering of the core, it
would have been logical to anticipate the formation of hydrogen
PAGENO="0477"
473
and it would have been just as logical to expect that hydrogen to
rise to the top of the reactor. Since the outlet of the primary
coolant is many feet below the top of the reactor, there was every
reason to anticipate the accumulation of the lighter weight hydro-
gen gas. Whether or not it was a large break in the coolant system
or a small break, the fundamental physics is the same; hydrogen
was formed, it is a light gas, it rose to the top of the reactor and
nothing in the design provided for venting it to a recombiner.
Mr. McCORMACK. Before we recess, can I ask how long you can
stay, Mr. Denton?
Mr. DENT0N. We are at your convenience.
Mr. MCCORMACK. Thank you.
We will be back in a few minutes.
[A brief recess was taken.]
Mr. MCCORMACK. We will reconvene the hearing of the subcom-
mittee.
I will ask Mr. Wolpe if he has questions for Mr. Denton?
Mr. W0LPE. Thank you, Mr. Chairman.
Mr. Denton, I would like to followup on some of the questions
being asked by the gentleman from Pennsylvania for a moment
and then move to a more general evaluation.
If I understood the testimony that you just gave, it was in at
least one respect to the effect that the plant at Three Mile Island
was below the standards that have been established by the Nation-
al Regulatory Commission at the time it came into operation. But
that the reason that that deficiency was permitted was because of a
policy decision that those standards should not be imposed in situa-
tions in which construction licences had been granted.
Was that your testimony?
Mr. MATTSON. Mr. Wolpe, I think it was my testimony.
It was a decision to not require the newer, more stringent stand-
ards for plants already in construction, that is, those that had
already received a construction permit. It was a requirement that
was being imposed on new applications for construction permits.
Mr. Denton went on to say that the standard review plan is used
for operating license applications; that is for plants already under
construction, but in a different sense, not in the sense of an abso-
lute requirement but rather plants are measured against the stand-
ard review plan, deviations relative to the standard review plan
are identified, and then justification must be made for these devi-
ations.
But, it is still a little more complicated than that. When the
standard review plan was issued in 1975, there were some plants
very far along in construction and some that were just starting
construction. So for an early group of plants, of which Three Mile
Island II would have been one, there was an exemption from the
requirement to justify deviations.
Now, we are trying to construct a chronology of the licensing
process for Three Mile Island unit II to treat this detail and all of
the other details we can resurrect from the records. I will speculate
that this deviation from the standard review plan was neither
identified nor justified in the operating license review of Three
Mile Island unit II. Nor would it have been required to be identi-
fied or justified.
PAGENO="0478"
474
Mr. WOLPE. Why was the policy decision made not to apply the
standards that were developed for safety reasons, I presume, to
plants under construction?
Mr. DENTON. I think at the time the standard review plan was
prepared it was recognized that that was the one chance the staff
had to get all of its favorite advances into the system and after the
standard review plan was adopted it would be more difficult to
make changes.
So at the time I remember deliberately putting in the standard
review plan things that I was not requiring the previous week. But
things that I felt would advance safety and would be in the right
direction, so the standard review plan was sort of the effort the
staff made to say for new plants here's what we think they should
meet, recognizing that we had gone beyond what was standard
practice when we wrote it.
Mr. WOLPE. In other words, you did not believe that additional
requirement that was now part of the basic plan, not simply for
any newly constructed plants, was that essential to the safe oper-
ation of the plants?
Mr. DENTON. In this area we apparently didn't. There were some
areas in the standard review plan that were perhaps picked up but
in the containment isolation one it was one that the staff didn't
feel that strongly about or, for plants already under construction or
near completion. It was felt to be something that would be desir-
able though for new plants.
Mr. WOLPE. In the Three Mile Island would you make a different
judgment today as to the significance of that particular item?
Mr. DENTON. Yes; we have and that is reflected in the bulletins
we have sent all of the operating plants.
Mr. WOLPE. You indicate in the body of your report three areas
of sensitivity in the B. & W. design. First of all, were any of these
areas of sensitivity known in advance of the accident at Three
Mile, in the same way that this other area of deficiency was known
in advance of the accident at Three Mile Island?
Mr. DENTON. We have obviously reviewed the B. &. W. design
and had approved it for some very early plants. And it had been
reviewed by our advisory committee, so we had looked at things
such as once-through steam generators.
I think at the time we felt that by designing the plant inside the
containment to be sort of invulnerable to secondary system tran-
sients, that whether it had a lot of water or little water in the
steam generator didn't make a great deal of difference.
You may recall that the reactor safety study, WASH 1400, im-
plied that the staff had focused an excessive amount of attention
on large pipe breaks, and that really small pipe breaks and antici-
pated transients were more dominant risk contributors and the
Lewis committee critique of the WASH 1400 reached the same
conclusion and recommended the staff move away from the focus
on large pipe breaks into anticipated transients and the staff had
done that and was in the process in several areas of looking at
anticipated transients, but transients associated with feed water
malfunctions was not one we had put high on the list.
PAGENO="0479"
475
Mr. WOLPE. So that while you were aware of most of those areas
of sensitivity you simply did not, at that point, attach to them a
significance they subsequently had.
Mr. DENTON. That is correct.
Mr. MATTSON. It's fair to say in several of these areas work was
ongoing because we were aware of a number of challenges to the
safety systems arising from malfunctions in the secondary systems
so, for example, the reliability of auxiliary feed water systems was
a subject of study.
What was failed to be recognized was the urgency of getting on
with that kind of work, and that urgency certainly was under-
scored by Three Mile Island. But it's fair to say we had anticipated
some of these things and work was ongoing in these areas.
Mr. DENTON. You may recall Three Mile Island did have redun-
dant and diverse auxiliary feed water pumps; it had two electrical-
ly driven pumps and one turbine driven pump, so it had three
types of pumps. I guess what we had not anticipated was the
likelihood of those valves being closed and the consequences that
could rapidly flow consequentially.
Mr. WOLPE. Are there any respects in which the deficiencies that
you have identified in the case of the B. & W. reactors are similar
to deficiencies that may exist in the other types of pressurized
water reactors, those which are produced or manufactured by Wes-
tinghouse?
Mr. DENTON. There is a fundamental difference in time available
for corrective action between the B. & W. plants and the others.
The Westinghouse plants I think have on the order of 30 minutes
before the steam generator boils dry upon loss of all feed water
flow, and the combustion engineering plants are perhaps 15 min-
utes. We are looking at all those designs and have letters to all
pressurized water reactors to be sure that in the microscopic view
of them, that their auxiliary feed water systems are reliable and
that these same sorts of defects don't exist.
Mr. WOLPE. You have not issued the same order--
Mr. DENTON. We have issued bulletins which require that they
reply to exactly what their situation is in each one of these areas,
and we are presently meeting with them one by one. But we have
not found it necessary yet to issue an order to any of them to date
to require changes.
Mr. WOLPE. Because in your judgment the Westinghouse reactors
have a different time factor that allows for corrective action to be
taken.
Mr. DENTON. Yes. I would not preclude as we go down the list we
won't find some who maybe for one reason or another require
certain changes. But to date the staff has not identified anyone.
Mr. WOLPE. A more general question, Mr. Denton. It has been
suggested by some that there was an overreaction on the part of
the public, on the part of the Congress, and others, to the magni-
tude of the problem that occurred at Three Mile Island. I have read
with care the material, transcripts that have appeared at least in
the newspapers, of your own proceedings in the Commission. I have
the distinct impression that you were rather worried at different
points by the activities that occurred in that period. I don't want to
put words in your mouth, but I would be interested in whether or
PAGENO="0480"
476
not that is an accurate assessment of your state of mind at the
time.
Mr. DENTON. I was quite worried Friday morning back in Bethes-
da when this report that proved to be false first came in. And even
after arriving at the site, with a lot of my staff, who were able to
get in the plant and give me first-hand views, it was evident that a
lot of things had to be done and had to be done fairly fast. I mean
they were ones that you might take days to do, but you could not
let the situation deteriorate.
So I was very concerned in that sense, and we had to take a lot
of actions.
Mr. WOLPE. Had those actions not been taken, or had there not
been an appropriate response to the sequence of events that oc-
curred, would a meltdown have been a possible event?
Mr. DENTON. I think you have to say a meltdown is always a
possibility.
Mr. WOLPE. Was that one of the events about which you were
concerned?
Mr. DENTON. That was one. And in fact after a few days, after I
had arrived we had developed an action plan in which we said if
we lost offsite power, or if we lost all recirculation pumps, we
would call an alert, or if we lost all instrumentation due to radi-
ation levels in the containmant, we would advise an evacuation.
So eventually we were able to put down on paper those plant
conditions which if reached would require evacuation.
However, the longer the time went, the longer it would have
taken a core meltdown to have breached the containment, and the
more time there was actually available then to accomplish an
evacuation. So the longer we were able to keep the conditions
stable, the more time we would eventually have in the event an
evacuation was necessary.
Mr. WOLPE. Thank you. And I assume further that you would not
have even considered the possibility of evacuation were there not
some very real concern at the initial phase of. this development.
Mr. DENTON. After I arrived at the site and had a much better
understanding, I never felt any imminent danger and never recom-
mended to the Governor evacuation after that. I did recommend
that if we were unable to remove the bubble through the means
that we were attempting, and we had to change the basic core
cooling mode, that we do that in the daytime, at a carefully select-
ed hour, with civil defense fully in a state of readiness, so if things
did not go the way they were expected to go, that all the necessary
evacuation steps could be taken. But fortunately we never pro-
gressed to that stage.
Mr. WOLPE. I really very much appreciate your candor and your
response to that question. It becomes very important that there be
a recognition that there was some basis for a very real concern on
the part of those that were closest to the event.
I should point out that your testimony directly conflicts with
that which we received from eminent nuclear scientists, who I
think more appropriately might be described as eminent nuclear
advocates, who insisted there was never any basis for concern or
alarm in the entire episode.
Thank you very much.
PAGENO="0481"
477
Mr. MCCORMACK. You are not referring to anybody who testified
before this committee, are you?
Mr. WOLPE. Yes; I am.
Mr. MCCORMACK. Who?
Mr. WOLPE. The panel that was associated with Dr. Teller. I
don't have all the names in front of me.
Mr. MCCORMACK. You are talking about the Teller panel.
Mr. WOLPE. That is right.
Mr. MCCORMACK. OK. Thank you. That was before the full com-
mittee at another time.
Mr. Ambro.
Mr. AMBRO. I would like to say, Mr. Chairman, that Mr. Denton's
calm, clarity and sanity breaking through the babble of confusion
gave me a feeling that there was someone onsite who knew what
he was doing at Three Mile Island.
Having said that, I would like to ask you this.
Just two fast questions about those two horrors that we kept
hearing about. What my friend and colleague was alluding to was a
statement by Dr. Cohen that there would never be a meltdown in
the United States except in computer simulations. That was his
statement. You said meltdown is always a possibility. Do you want
to comment on the conflict?
Mr. DENTON. I have not read his testimony. But the studies I
have seen are that if you lose all core cooling early in the sequence,
when the decay heat is still high in the core, a meltdown is certain-
ly likely.
Now, as time progresses and there is less and less heat being
generated in the core, there is a time at which you can actually
lose the bulk of water and perhaps still prevent an actual melt-
down, just by cooling, from radiation, thermal radiation means.
Mr. AMBRO. With respect to that hydrogen bubble, it would never
explode because there was no oxygen, is that correct?
Mr. DENTON. Yes, sir.
Mr. AMBRO. And it could never burst the containment vessel
because there wasn't sufficient pressure, correct?
Mr. DENTON. There was a hydrogen explosion the day of the
accident.
Mr. AMBRO. What does that mean?
Mr. DENTON. It was an explosion in the containment, and the
recorder indicated a peak pressure pulse of about 28 p.s.i. It was
believed-it wasn't recognized by the licensee at the time as a
hydrogen explosion. It was thought by the operator to have been a
false signal. You may recall that Saturday we were concerned
about the explosion of the hydrogen bubble inside~ the reactor
vessel. And it did turn out that as we looked into the area in more
detail, that the oxygen that was being generated in the water
through radiolysis would be combining again with hydrogen dis-
solved in the water and oxygen would never actually be present in
a free state in the hydrogen bubble. So it took us a number of
hours before we came ta the realization that oxygen was not really
being added to the hydrogen bubble and there never was a danger
of an explosion of the bubble in the reactor vessel, although there
had been an explosion in the containment.
48-721 0 - 79 - 31
PAGENO="0482"
478
Mr. AMBRO. Well, could pressure have built to the point where
you could have had an explosion in the reactor vessel?
Mr. DENTON. In order to have an explosion in the reactor vessel,
we would have had to have some means--
Mr. AMBRO. I'm sorry-burst the reactor vessel.
Mr. DENTON. No. I think our whole concern over hydrogen explo-
sion in the reactor vessel was in retrospect misplaced, because
physically you could not generate oxygen and get it into that
hydrogen. It would recombine in the water with other free hydro-
gen atoms.
Mr. AMBRO. What I am getting to is if pressure could build to the
point where it would burst the vessel, then you would have inad-
vertently, even though pressure would be moving it out, a combina-
tion of external oxygen with the hydrogen and a possibility of
explosion.
Mr. DENTON. No. The hydrogen pressure would never have built
just on its own accord to a point where it would have ruptured the
vessel.
Mr. MATTSON. Once the core cooling was re-established, the gen-
eration of hydrogen was stopped.
Mr. AMBRO. So the whole business of hydrogen buildup and the
possibility of an explosion was totally misplaced.
Mr. DENTON. With regard to the bubble in the reactor vessel,
that is correct. It was a concern of ours at the time, and we
realized about 24 hours later, as we got in touch with other experts
and looked at data, that it would not be possible to form a combus-
tible mixture in such an atmosphere.
Mr. AMBRO. Obviously the press didn't understand or believe you,
because day after day we were regaled with the possible horrors of
a hydrogen explosion, as I recall it.
In any event, let me get to something else far less technical.
Are your bulletins mandatory in terms of compliance?
Mr. DENTON. Yes, they are.
Mr. AMBRO. How do you assure compliance? Do you have a
network of inspectors, implementing people running around saying
do this and do that?
Mr. DENTON. We have an Office of Inspection and Enforcement
of about 700 people and they have regional offices. Many plants
now have resident inspectors on site, permanently stationed there.
In fact, all of B. & W. installations now have resident inspectors.
The way we enforce the bulletins is require that applicants write
back what they are doing in response to the bulletin. This is
reviewed in my office for technical adequacy. And it is reviewed by
the Inspection Department for factual adequacy, that this is really
the way the plant is constructed and operated. And we determine if
it is a correct response.
If we don't think the response is adequate, we go back to the
licensee to enforce the requirements.
Mr. AMBRO. That has to do with construction. What about oper-
ation?
Mr. DENTON. The same thing applies during operation.
Mr. AMBRO. How many people are there in the inspection arm?
Mr. DENTON. Approximately 700.
Mr. AMBRO. We have about 71 plants on line.
PAGENO="0483"
479
Mr. DENTON. They inspect other licensees, other than reactors.
But reactors under construction and in operation are probably the
largest workload they have. They also inspect users of isotopes for
other purposes.
Mr. AMBRO. Is there any validity to the notion of keeping or
maintaining a resident inspector in a plant on line?
Mr. DENTON. The Commission plans to put resident inspectors at
every site of an operating plant and in fact have approximately 20
resident inspectors now in place.
Mr. AMBRO. If I understand this whole situation correctly, then,
from this point of view, TMI met lower standards than other plants
for a variety of circumstances. As a result of that, were bulletins
issued to bring them up to a higher degree .of safety prior to the
accident?
Mr. DENTON. No. The bulletins I am referring to were issued to
all plants after the TMI accident.
Mr. AMBRO. After.
Mr. DENTON. Yes, sir.
Mr. AMBRO. There were no bulletins or advisories or what-have-
you issued in advance of the accident at TMI?
Mr. DENTON. Not on the issues that are concerned here. But
there have been bulletins on other matters that we routinely deal
with. I was referring to bulletins that dealt with the kinds of
matters that caused the Three Mile Island accident.
Mr. AMBRO. Well, I don't know the terminology. I just use your
word.
Let me put it another way. Do you have any evidence of noncom-
pliance of the kind of safety requirements you saw had to be
implemented at Three Mile Island?
Mr. DENTON. Well, certainly the fact that the valves in the
auxiliary feed water train were locked closed is a violation of the
technical specifications. Right at that point if those valves had
been open these redundant pumps that I mentioned would have
supplied water to the steam generator, as it did in 152 instances in
B. & W. plants--
Mr. AMBR0. If the valve was blocked shut for 42 hours, NRC has
to accept, because of the lack of onsite inspectors for compliance, a
degree of the blame, if you will, for what happened.
Mr. DENTON. I think we all feel responsibility for what happened
and it is conceivable to me that if we had a resident inspector, this
sort of thing might have been prevented. I cannot guarantee that
he would have spotted these valves. But perhaps he would have
spotted some other valves being misalined and this could have led
to a review of shift turnover procedures and procedures for check-
ing valve alinement at the start of each shift, which has already
been discussed.
I was frankly surprised to find that the company did not employ
a means so that as every crew comes on there is a requirement
that all vital valve positions and conditions such as that be routine-
ly reverified.
Mr. AMBRO. Well, assigning blame is not an idle exercise if it
develops better accountability in the future.
The question, though, has to follow, what is the penalty for
noncompliance?
PAGENO="0484"
480
Mr. DENTON. It varies, all the way from dollar fines to revoc~tion
of the license.
Mr. AMBRO. Now, you have this situation of noncompliance by
virtue of the valve being shut. Have you, in a far narrower sense
than the broad picture of what happened, how it happened and so
forth, addressed the question as to whether or not there should be
some penalty against Three Mile Island for this violation?
Mr. DENTON. This matter is the responsiblity of the Inspection
and Enforcement Office and they have the ongoing investigation. I
guess I would prefer not to speculate until they have completed
their investigation and determined what course of action might be
appropriate.
Mr. AMBRO. So we have mandatory requirements that the utility
companies must follow. But we have less than--
Mr. DENTON. We have an audit procedure.
Mr. AMBRO [continuing]. Less than timely, though, onsite inspec~
tion, with a variety of penalties that may or may not be imposed.
Now, don't you think that whole thing should be tightened up?
That is one area where we could provide a great deal more confi-
dence. Even in the face of the public perception that there is too
much regulation, I think they would agree in this area there
should be even more. Who will be looking into that?
Mr. DENTON. The Commission is focusing on this entire question.
I guess I can say that our office is looking at the question of
whether there shouldn't be more technical skills available at the
site also around the clock. Bear in mind that the people who are
running this station and who are actually present at the time were
skilled individuals and following procedures for the kinds of events
in which they had been trained.
Mr. MCCORMACK. I am going to interrupt at this point. I didn't
realize Mr. Walker has not had a chance to ask questions. I want
to give him that chance now.
Mr. WALKER. Thank you, Mr. Chairman. Maybe I can just get
some quick answers here to a number of questions and then go into
one matter.
You mentioned that one of the ways that radiation is released to
the public is because there were leaks in the letdown system. Is
that the filter problem that was running-I hadn't heard about
leaks in the letdown system prior to this. What kind of leaks were
they? Was it an operational problem, another mechanical failure?
Just what was this?
Mr. MATTSON. Congressman Walker, I think you may recall the
puff releases, the first of which occurred on Friday, and then a
couple of sporadic occasions therafter. Maybe the terminology of
the makeup system doesn't strike a bell. It was the vent header
between the makeup tank and the waste gas decay tank, when
radioactive gases were being transferred, there was a relief valve
that would occasionally pop below its setting and lead to a puff
release.
Mr. WALKER. Wasn't that still partially a function of the fact
that some of the contaminated water had gotten over into the
auxiliary building?
PAGENO="0485"
481
Mr. DENTON. I think it ~was the fact that they had extraordinary
amounts of water meant they had filled up space that otherwise
would have been available to deal with the letdown flow.
Mr. WALKER. So even so, what we are saying is the mechanical
problem, or the design failure that led to all the water going over
into the auxiliary building is still in part responsible for the puff
releases.
Mr. DENTON. Yes. There is certainly a connection between the
two. As I mentioned, the relative contribution of one source versus
another, I don't think we have completely straightened out.
Mr. WALKER. OK. Another question. There has been some ques-
tion raised about this exposure point we talked about for individ-
uals. One of the witnesses here yesterday who the chairman re-
ferred to, Dr. Kepford, mentioned that he felt, that by measuring
exposure points that were close to the site, we failed to measure
the real problem; because as a result of the inversion layer, the
real devastating exposure points were further out. Do you have any
information on that? Were there measurements taken out, say, 15,
20 miles, to find out whether people were receiving abnormal levels
of radiation at that distance?
Mr. DENTON. I know there were a number of instances during
those early days where the helicopter did pursue plumes until the
readings were essentially at background. So they would track the
plume until they could no longer identify it, even with the sensi-
tive instruments they had. From a meteorological standpoint, dis-
persion continues with distance.
Mr. WALKER. Obviously, if the radiation level is going down in
the plume, it could not be gathering strength as it drops toward
the ground.
Mr. DENTON. No. As long as the plume is in the air and has not
touched the ground there is a potential that the ground dose might
go up slightly as the plume comes down. But certainly no more
than a small amount. And in fact, from the kinds of conditions I
saw up there, I would be very surprised if there were a lot of-if
radiation levels of any magnitude existed beyond the kinds of
distances we are talking about.
Mr. MCCORMACK. Wasn't Dr. Kepford's statement yesterday to
the effect that first of all you had inversions which caused the
radiation to accumulate at 15 miles on the one hand. Then they
were saying it was highest at Goldsboro.
Mr. DENTON. In Gouldsboro the licensee had from day one moni-
tors in place that integrated the total dose. And we had other
monitors thereafter.
Let me ask Dr. Congel if he would like to comment on that.
Dr. CONGEL. Right. In the assessment that we prepared for the
population exposure we used the detector out as far as 15 miles.
And the detectors all showed a decreasing dose as distance from
the plant increased. We saw no evidence of the kinds of things that
were alleged yesterday.
Mr. WALKER. OK. Thank you.
Within that 42-hour period when those auxiliary valves were
shut off and supposedly there were lights on the panel showing
that they were shut off, wouldn't there have been NRC people in
the control room during that period of time? Shouldn't somebody
PAGENO="0486"
482
from NRC maybe have noticed the fact that the system was not
operating properly?
Mr. DENTON. That is the 42-hour period up to the accident.
Mr. WALKER. Forty-two hours before the accident. I see. QK. I'm
sorry.
Could the license of Met-Ed to operate this plant be lifted as a
result of all of the kinds of failures that took place? Is that one of
the possibilities that exists, looking down the pike?
Mr. DENTON. It certainly is a possibility. I know the other office
has criteria for various discretionary enforcement actions they
take. But I am not that familiar with what types of events trigger
which enforcement actions. But certainly the Commission has the
authority to revoke licenses for good cause.
Mr. WALKER. And finally, I would just like to. discuss with you
for a minute a topic I know you addressed when you were in the
area this weekend, the topic of the waste water dumping into the
river. You were here I think before when I talked about the situa-
tion. My perception of 4he public viewpoint is that it is not really a
question of how wel1~the water can be cleaned up, but rather the
public perception that they are not certain that any amount of
cleaning of the water is acceptable.
The thing that has disturbed me in some of the briefings that
NRC has held on this subject, and so on, evidently the talk of
options has been really options for treatment, but the final result
of it was that the water is going to be dumped into the Susquehan-
na River.
You know, it is the end product that we are concerned about. We
don't want the water dumped into the river.
The treatment procedures and so on, we will leave those up to
the people technically competent. But it is the dumping of the
water into the river which is the problem for many of the sports-
men, for the communities involved.
Can't other options be explored? Can't we find other ways of
doing this? Do we simply have to sit still for the fact, as the utility
said this morning, that we are stuck with the economics and the
precedents here?
The public is not concerned with the economics and the prece-
dents. They are concerned with the health and safety questions.
Mr. MCCORMACK. Excuse me just a moment. Would you like to
have that in writing, Mr. Walker? We are going to be late to vote.
Mr. WALKER. Yes. But are there other options that can be ex-
plored?
Mr. DENTON. This has been raised and suits have been filed. We
will try to identify all alternatives.
Mr. WALKER. Good. Thank you.
[The information follows:*]
Mr. WALKER. One further thing. I understand you gave kudos to
the performance of Mr. Denton, Mr~ Chairman, when he was at
Three Mile Island. I would like to be on public record at this
hearing endorsing that wholeheartedly. You did a fantastic job up
there, Mr. Denton. The people appreciate it.
ThiS information is provided as the response to question 7 in Mr. Denton's "Questions and
Answers for the Record" for May 23, 1979. See Appendix I, P. 529.
PAGENO="0487"
483
Mr. MCCORMACK. Gentlemen, I want to thank you very much for
your testimony and for your patience today. We appreciate it.
Mr. Conway, do you want to stay?
Mr. CONWAY. It's up to you, Mr. Chairman.
Mr. MCCORMACK. Would you like to just submit your testimony
for the record?
Mr. CONWAY. I will be pleased to do so.
Mr. MCCORMACK. Mr. Conway will submit his testimony for the
record. I appreciate your patience, Mr. Conway, sitting here all day
waiting to testify.
[The prepared statement of Mr. Conway follows:]
PAGENO="0488"
484
STATEMENT
BY
JOHN T. CONWAY
PRESIDENT
AMERICAN NUCLEAR ENERGY COUNCIL
BEFORE THE
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
HOUSE CO~'T11UEE ON SCIENCE AND TECHNOLOGY
MAY 23, 1979
My name is John T. Conway. I am President of the American
Nuclear Energy Council.1 I amhere today in response to a request from
your ConTnittee to discuss what happened at Three Mile Island and its tech-
nological implications.
Obviously, those in government and in industry who are actively
involved in analyzing and solving the problems connected with the mishap
are best able to describe to you what actually took place. Governor Thornburgh
of Pennsylvania - who, along with Lieutenant Governor Scranton had to assume
awesome responsibilities during the first several days - has publicly decried
the numerous `so-called experts" who had no first-hand knowledge of the situation
but who nevertheless were gratuitously offering advice to him and the public,
and making dire pronouncements as to the dangers of the situation. The news
The American Nuclear Energy Council - established in 1975 - is a nuclear
trade association located in Washington, D.C., and it is supported by
nuclear steam supply vendors, architect-engineers, nuclear utilities and
nuclear fuel and equipment suppliers and others. Currently, more than 100
organizations are members. The Council's principal task is to furnish factual
information to the members of the Congress and their staffs, and also to rep-
resentatives of the Executive Branch of the Government, including members of
the White House staff, on the needs and problems of the nuclear industry and
In support of our country's nuclear energy programs, in order to help maintain
a strong and viable nation.
PAGENO="0489"
485
media, you will recall, were filled with statements by these so-called experts
who, despite their lack of knowledge of the factual situations, were quick to
make contact with the press and to respond to all sorts of questions pertaining
to Three Mile Island. The public, understandably, has been confused and un-
necessarily freightened by so much inaccurate information and false speculation.
For example, a number of `experts with no first-hand knowledge were
before TV cameras in the early days of the accident to speculate on the large
number of cancers that would result. Much coverage was given to their speculative
figures. On the other hand, little media coverage has been given to calculations
by the official Ad Hoc Interagency Group set up to evaluate the health effects.
This group of knowledgeable and qualified individuals, including members from the
HEW Center for Disease Control and the Food and Drug Administration, as well as
the Environmental Protection Agency and NRC, conservatively have concluded that this
accident will at most result in one fatal and one non-fatal cancer among the public.
I would hope, in the performance of your duties and in the furtherance
of your responsibilities, that your Committee and staff will help the public
differentiate between fact and fiction - what is known and unknown - and what is
speculation, and that in any reports that may ensue from Congressional investigations
of the Three Mile Island accident, they will clearly identify these differences
for the public. If this is done, I believe it will help the public have a
better understanding of the benefits of nuclear power and its relative risk.
More important, it will help the American people to intelligently decide the
proper contribution nuclear power can make in solving our Nation's future energy
problems, for in the final analysis it is they who must make that decision.
I would also hope that your Coninittee and other committees of the
PAGENO="0490"
486
Congress keep a proper perspective in evaluating the risks of nuclear
power compared with other risks we face.
On April 8, at a time when it had been determined that no evacuation
was required by the Three Mile Island accident, 4,500 to 5,500 persons had to
be evacuated from a 300 square mile area of Florida because a freight train
carrying harmful chemicals had derailed. A Civil Defense official was contem-
plating evacuating 7,000 more persons if a wind shift were to occur.
On February 22, 1978, in Waverly, Tennessee, 2,000 people had to be
evacuated when a railroad car exploded after a derailment. Fifteen persons were
killed and 48 persons were injured by that explosion.
On December 28, 1977, 800 people in a ten mile radius had to be evacuated
due to a chemical explosion after a train derailment in Goldonna, Louisianna. Over
$2 million property damage resulted in that accident which took place at the main
street crossing of that town.
The Department of Transportation records reveal that in a seven year
period, 1971 through 1977, there were 130 derailments or vehicle accidents that
resulted in high property damage and/or evacuation of persons due to hazardous
chemicals. The 130 accidents resulted in 75 deaths, 1049 injuries and property
damage just under $43 million. Of the 130 accidents in that seven year period,
41 required evacuation of people.
I mention this because a great deal of discussion is taking place
today with respect to evacuation plans in states where nuclear power plants
are located. Under the guise of advocating public preparedness, opponents of
nuclear power are demanding annual exercises where the population actually would
be evacuated out to a given distance. If they were rational in their demand,
they would require the same for every town and village through which a railroad
passes or through which toxic chemicals are transported by vehicles.
PAGENO="0491"
487
Based on experiences to date, evacuation plans are more apt to
be put to the test in areas through which railroads and trucks handling
chemicals travel than in places where nuclear plants are located.
There is no doubt in my mind, nor do I believe there is any
doubt in the minds of other knowledgeable persons in the nuclear industry,
that some significant changes will result once we have had an opportunity
to gather all the facts and thoroughly review them.
The Edison Electric Institute - an association of electric
companies whose members generate in excess of 77 percent of all electric
power in this country - has undertaken a review of the event, including a
technical study designed to implement necessary chances in present safety
systems and procedures (see attachment 1). This review will augment presently
on-going studies initiated by individual electric utilities currently operat-
ing nuclear power plants. The Edison Electric Institute has appointed an ad
hoc corrmittee of top-level utility executives to oversee and coordinate efforts
of the industry to address the impacts resulting from the accident in Pennsylvania.
Representati~e~ of public power systems have been asked to participate in the
work of this comisittee and have indicated their intention to do so. In
addition, the Electric Power Research Institute, an R&D arm of the electric
power industry, has undertaken a detailed technical study of the Three Mile
Island accident, and a scientific review by recognized experts not associated
with the electric power industry is being established to examine the corrective
industry response to the safety reviews relating to Three Mile Island.
These actions by the industry are in addition to its pledge to
fully cooperate with the President, the NRC and other government agencies
PAGENO="0492"
488
responsible for investigating the accident.
The nuclear industry is most appreciative of the actions taken
by President Carter and the White House staff. The visit by President and
Mrs. Carter to the site at the Three Mile Island facility on April 1 and
subsequent Presidential statements did much to help put the matter in proper
perspective, and help alleviate unnecessary fears previously being engendered
by irresponsible speculation. The President pointed out that it was too early
to make judgements about the lessons to be learned from the nuclear incident,
but he assured citizens of Middletown, Pennsylvania and the public at large
that there would be a thorough inquiry into the original causes of the events
that subsequently occurred.
In his April 5 address to the Nation, President Carter noted the
concern that the Three Mile Island nuclear accident had caused, and announced
the establishment of a fully independent Presidential Comission to investigate:
1) the circumstances leading to the accident and the chain of events as it
unfolded; 2) the technical questions which this accident raises concerning the
operation of the safety and back-up systems of this plant and design; 3) the
nature and adequacy of the response to the accident by all levels of government.
Without doubt, when the Presidential Commission has completed its
investigation, coupled with the studies being undertaken by the electric utility
industry, the NRC and others~, changes will occur in a number of areas, including
regulatory activities. Prudence would dictate that premature actions not be
taken until completion and a thorough review is made of these studies, unless,
of course, a specific safety problem is uncovered during the course of any of
these investigations, at which time, immediate corrective action should be taken.
As your Subcommittee well knows, there are organizations and individuals
in our country that would have our government shut down all nuclear power plants
PAGENO="0493"
489
and prohibit all future construction and operation of such plants. Even
though the accident at Three Mile Island and apparent meltdown of a portion
of the core did not result in any fatalities or injuries to the employees at
the facility or to the public, as many anti-nuclear activists claimed would
occur with such an accident, they are attempting to use the Three Mile Island
accident as justification to deny our Nation the benefits of civilian nuclear
power
Some have testified and submitted testimony to your Subcommittee
and other committees of the Congress in the past, and undoubtedly will con-
tinue to do so in the future. We are pleased that your Committee and other
committees of the Congress that have had an opportunity to hear their testimony
and review their submitted data, have wisely not followed their recommendations.
In the United States today, we have 70 nuclear power plants in
operation with a rated capacity of 51,000 MWe. As President Carter noted in
his April 10 news conference, we now derive between 12 and 13 percent of our
electric energy in the United States from nuclear power.
The President went on to say, "There is no way for us to abandon
the nuclear supply of energy in our country, in the foreseeable future."
President Carter reiterated his recognition of the need to speed up the
licensing of nuclear plants and said I think it does not contribute to
safety to have a bureaucratic nightmare or maze of red tape as licensing
and siting decisions are made."
We agree and recommend thatin evaluating any necessary changes
to regulatory activities resulting from lessons learned at Three Mile Island,
the Congress recognize the contribution to safety that could result when
PAGENO="0494"
490
technical people are permitted to devote their time efficiently to technical
matters and be relieved of unnecessary and time-consuming paper studies.
Our installed electric generating capacity from nuclear power
today exceeds the entire electric installed capacity as it existed in the
U.S. at the end of World War II. It is fortunate, indeed, that this is so
when one examines our perilous dependence upon overseas petroleum supplies.
Sections of our nation are especially vulnerable to the continued increases
in the OPEC oil prices and to the threat of significant curtailment or cut-off
of these foreign oil supplies.
In 1978, approximately 17 percent of our electric generation in the
United States was from oil-fired facilities. In New York State, however, 44
percent of all electric generation was from oil. New York State was fortunate
in that nuclear power plants within the New York Power Pool were able to furnish
18 percent of all electric generation, and thus, save the equivalent of'37
million barrels of oil that otherwise would have been required. The New York
Power Pool has calculated that nuclear power plants in its system saved its
customers $550 million in 1978 - the incremental costs for alternative generation.
During the same year in New England, over 30 percent of Boston
Edison's customers' electricity was furnished by the Pilgrim Nuclear Unit. Fuel
adjustment charges to its customers would have been 29 percent higher if the
electricity had been produced by oil.
In the Midwest, nuclear power supplied 45.4 percent of the electricity
generated by the Comonwealth Edison Company, which supplies electricity to
Chicago and surrounding areas, with hundreds of millions of dollars savings to
Its customers.
PAGENO="0495"
491
We live in a world of innumerable risks to each of us as individuals
and to the public at large. We as a nation and the entire western world are
facing tremendous risks to our economic well-being, not to mention our national
security, by our present dependence upon mideast oil. I need not tell this
Comittee how perilous and tenuous that oil supply line between the western
world and-Saudia Arabia is, and what the economic and security implications
would be were it to be interrupted.
Presently, we have 92 nuclear power plants under construction in
the United States, representing 100,000 MWs of additional electric generating
capacity. Of those 92 plants, 37 presently are under operating license review.
Those plants due to come on the line in the near future, together with our
existing 70 nuclear plants, can and will make a. significant contribution to this
nation in assuring an adequate supply of electricity for our nation in the years
to come.
Hardly a week goes by that one or more OPEC nation does not
announce an additional increase in the price of its oil. Nuclearplants presently
operating and those that will be coming on the line in the near future will help
insulate our citizens from the economic consequences of those continuing price
increases and help protect us from future oil embargoes directed at the United
States for political or other reasons.
Let there be no mistake, those who advocate the shutdown of our
operating nuclear power plants and a moratorium on future nuclear power plants are
in fact supporting an action that would constitute an unreasonable risk to the
health and safety of the people of the United States. Many of those same people
PAGENO="0496"
492
who are against the building of nuclear power plants oppose the construction
of coal-fired and hydro electric facilities, which are also essential to
our Nation.
The electric utility industry in the United States has indicated
its continued belief in the future of nuclear power. At its annual convention
in Atlanta, Georgia on April 9, the Board of Directors of the Edison Electric
Institute passed a resolution reaffirming its faith in the safety of nuclear
power, and reiterated its determination to utilize every conceivable caution
to prevent accidents. The Resolution restated the industry's concern for
the public safety and for the production of safe and reliable electric power for the
benefit of the public it serves (see attachment 2).
Nuclear power has a safety record second to none. When compared with
other alternatives today, and for the foreseeable future, nuclear power, if not
fettered and burdened with additional and unnecessary handicaps - be they technical
or political - can and will serve this nation well. Nuclear plants can be and
are being operated safely today to the economic advantage of our Nation. Their
economic advantage will continue to improve in the future as we gain more experience
and particularly if fuel oil becomes increasingly expensive as the result of foreign
action over which we have no control.
The electric utility industry - both public and private - together
with all other segments of the nuclear industry, is prepared to help our country
solve our energy crisis by providing a significant portion of the electric needs
of our nation in a safe, reliable and environmentally acceptable manner.
PAGENO="0497"
493
ATTACHMENT 1
ACTIONS OF THE EEl BOARD OF DIRECTORS REGARDING NUCLEAR POWER
april 11, 1979
The Institute
1. Has appointed an ad hoc committee of top-~level utility
executives that will oversee and ôoordinate efforts of
the industry to address the impacts resulting from the
Three Mile Island accident and is inviting representatives
of public power systems to participate in the work of
this committee.
2. Commended the President for the actions he has taken in
appointing a fully independent Presidential Commission to
investigate the Three Mile Island accident, offered to
Cooperate with the President's efforts and those of the
Nuclear Regulatory Commission to the fullest extent, and
is advising the President of the efforts the Institute is
undertaking.
3. Endorsed the agreement reached with the management of the
Electric Power Research Institute to undertake as expedi-
t~ously as possible, with an augmented staff of experts, a
detailed technical study of the Three Mile Island accident.
The study will include analysis of the specific incident
and identification of the generic safety lessons to be
learned from it and also provide recommendations resulting
from the EPRI study and from reviews by individual electric
utility systems.
48-7210-79-32
PAGENO="0498"
494
4. Will assist the Electric Power Research Institute in raising
the necessary funds to finance the technical study described
in recommendation No. 3. In providing the assistance to
EPRI, Edison Electric Institute will urge all member companies,
including those without nuclear programs, to support financially
the EPRI effort.
5. It has been agreed that the Electric Power Research Institute
will communicate to electric power systems with nuclear
programs technical information regarding the Three Mile
Island accident which it obtains from General Public
Utilities and the Nuclear Regulatory Commission.
6. Urges each member company with a nuclear power program to
continue to give the highest priority to its study of the
Three Mile Island accident, to identify the generic lessons
* to be learned, to implement any necessary changes in safety
systems anti procedures resulting from this review and make
such findings available to EPRI.
7. Through efforts of the ad hoc committee appointed under
recommendation No. 1, will establish a scientific review
board of knowledgeable and recognized experts not associated
with our industry to examine the collective industry
response to the safety reviews relating to the Three Mile
Island accident, including the-study which will be under-
taken by EPRI. Representatives of public power will be
invited to participate in the selection of this technical
review board.
PAGENO="0499"
495
8. Through the efforts of the ad hoc committee appointed
under recommendation No. 1, will provide guidance to an
augmented nuclear communications program, coordinating
the resources of EEl, AIF, ANEC arid others, which will
meet the challenges of the months ahead.
9. Will communicate its over-all program to the American
Public Power Association, the National Rural Electric.
Cooperative Association, the Atomic Industrial Forum
and the American Nuclear Energy Council and urge their
support.
Mr. MCCORMACK. We will meet tomorrow morning at 9:30 in this
room and continue these hearings. We stand adjourned.
[Whereupon, at 4:10 p.m., the subcommittee was recessed, to
reconvene at 9:30 a.m., Thursday, May 24, 1979.]
PAGENO="0500"
496
APPENDIX I
QUESTIONS AND ANSWERS FOR THE RECORD
Babcock&WiIcox Power Generation Group
P.O. Boo 1260, Lynchburg, Va. 24505
Telephone: (804) 384-5111
June 22, 1979
The Honorable Hike McCormack
Chairman, Subcommittee on Energy Research and Production
Committee on Science and Technology
House of Representatives
Washington, D.C. 20515
Dear Chairman NcCormack:
In response to your letter received on June 12, 1979, 1 am pleased to provide the follow-
ing responses to the questions presented.
1. "Would there be any advantages in standardizing the design of nuclear power plants?"
I believe that there are advantages to standardizing the design of nuclear
steam systems and coupling those nuclear steam systems with standard
balance-of-plant designs. While streamlined licensing has been used as
- the incentive for standariza~lq~, I believe there are greater benefits to
be derived by having available at the beginning of the project, well ahead
of construction, design data for early completion of detailed, engineering.
By this means, the number of changes required during construction can be
reduced, with the corresponding reduction in cost and construction
schedule. Secondly, standardization provides a disciplined means of
change control in which proposed changes are fully evaluated and engineered
in a planned manner before implementation. While I support this type of
standardization program, I would be opposed to the selection of a single
- power plant design for the total utility industry, believing that such
an approach would eliminate the benefits of competitive designs.
PAGENO="0501"
497
Babcock&Wilcox
The Honorable Mike McCormack June 22, 1979
2. "Is there any need for a "Swat Team" composed of people from industry, the
utilities, NRC, etc.?"
The Three Mile Island experience indicates the desirability of identi-
fying personnel and equipment resources from industry, the utilities
and the government to assist an operating utility in the mitigation of,
or recovery from nuclear incidents. Work is under way through the
sponsorship of EEl and the AIF to identify desirable resources and get
commitments to their availability in an emergency. These resources
would be intended to reinforce the capabilities of the operating
organization and not replace them. The prevention of incidents and
the early response must remain the responsibility of the operating
utility.
3. "Should there be a standard design for control rooms and for the layout of
control room instrument and control panels?"
Each plant is different and, therefore, the control requirements
differ. However, I believe it would be appropriate for EPRI, or some
other industry organization, to standardize certain elements of control
room design such as color coding, symbols, shape conventions and display
conventions. Each vendor could then develop a reference control room
design incorporating these standard design elements. This would be
done recognizing the need for certain necessary variations from plant
to plant. Future control room designs will also take more advantage
of lessons learned in equipment design, human factors engineering and
maintainability.
In addition to the advantages noted in the response to Question 2,
standard elements of control room design would result in fewer design
variations to analyze and review and simplified operator training,
testing and requalification.
PAGENO="0502"
498
Babcock&Witcox
The Honorable Mike McCormack June 22, 1979
4. "Should the control room operators or supervisors be employed by the utility or
by some other agency?"
It is my opinion that the owning agency, in this case the utility,
should be responsible for the operation of the plant. Therefore,
the control room operators and supervisors should be employed by
the utility.
5. "List your recommendations for improving the instrumentation monitoring and
control equipment."
Several improvements in instrumentation for nuclear plants have
already been put in place by the operating utilities and others are
under study. Each recommendation should be systematically studied.
The listing here is not exhaustive but typical of the industry approach.
1) During operation, provide an improved indication that the Engineered
Safety Features Systems are in a ready state.
2) Improve alarm indications by grouping - such as "actions required"
and "status indication."
3) Review "survivability" of instrumentation in environment resulting
from accident conditions.
4) Increase use of "mimic" boards which show process flow lines as
well as process condition.
5) Improve indications of vital functions - for example:
a) Flow conditions on any device permitting exiting of primary
coolant from the pressure boundary such as the relief valves.
b) Indication of approach to saturation temperature or pressure
in the primary coolant.
c) Water level indication in reactor vessel.
d) Water level in the reactor building.
e) Indication of readiness of primary systems to go on natural
circulation.
f) Indication of natural circulation.
PAGENO="0503"
499
Babcock&Wilcox
The Honorable Mike McCormack June 22, 1979
6) Improved indications of off-normal conditions:
a) Increased range of temperature measurements.
b) Provide remote visual and audio equipment.
c) Provide "flight recorder" data acquisition equipment.
6. "Who designed the instrumentation, control and display panels for the TMI control
room? Is the design checked and approved by NRC?"
General Public Utilities maintained the final approval rights for the
arrangement of the instruments and controls on the control room panels.
CPU also had the final say regarding layout of the control room.
Detailed engineering on the panels was done either by the architect-
engineer, Burns & Roe, or by the panel supplier.
B&W provided two panels for the control room. For these panels, we
provided a suggested arrangement of instruments and controls. The
final arrangement was jointly developed with CPU having the right of
final approval.
The NRC reviewed and approved the control room design from the
standpoint that it met NRC regulations in effect at the time.
The NRC did not review the design from the human engineering or
man-machine interface standpoint.
7. "List any reasons you may have for believing that the Three Mile Island plant
should not have been in operation at the time of the accident."
There was no reason, to my knowledge, that TMI Unit 2 should not have
been in operation. The plant design and procedures had been reviewed
and approved by the NRC and j~ad been licensed to operate. Let me
clarify this response, however, by stating that subsequent to the
incident, it has come to light that the plant was actually operating
in violation of its Technical Specifications, i.e., the auxiliary
feedwater system block valves were closed. Neither this plant, nor
any other, should operate in violation of approved Technical Specifications.
PAGENO="0504"
500
Babcock&WiIcox
The Honorable Mike McCormack June 22, 1979
8. "In your opinion, what was the cause of the onset of the Three Mile Island
accident?'
As I stated before the Subcommittee on May 23, the initiating event
of the accident was the interruption of main feedwater flow to the
steam generators. I am not personally familiar with the specific
events that directly led to this interruption. I understand that
the interruption was the result of certain maintenance operations
that were under way at the time in the condensate polishing
equipment area.
9. "In regard to the pilot valve that failed to reseat, is the position of this
valve directly or indirectly monitored? Describe how it is monitored."
The position of the pilot operated relief valve is indirectly
monitored. This is the case because the position of the main disk
of the valve is not accessible to direct detection by means of
mechanical linkage.
The open or closed status of the valve is indirectly indicated by
a light on the main control console which is "ON" when the solenoid
is electrically energized. When the valve is functioning normally
and the circuit is energized, the valve is open.
There are other indirect indications available to the operator,
such as, reactor coolant system pressure, quench tank level, pressure
and temperature and valve discharge pipe temperature.
10. "In your testimony you indicate that there are emergency procedures to assist
the control room operator in analyzing the instrument readings. Who produced
this analysis? Please send us a copy of this procedure and the analysis."
The emergency procedures which I referred to in my testimony were
prepared by Metropolitan Edison.
B&W's involvement in the evolution of the procedures for TMI Unit 2
consisted of providing draft procedures or operating specifications
for TMI Unit 1. Metropolitan Edison then prepared the Unit 1
procedures. After the Unit 1 procedures were written, B&W reviewed
PAGENO="0505"
501
Babcock&Wilcox
The Honorable Mike McCormack June 22, 1979
and commented on them. Metropolitan Edison then finalized these
procedures and may or may not have incorporated B&W's comments.
Metropolitan Edison prepared the ThI Unit 2 procedures based on
those that were initially prepared and in place on TMI Unit 1.
Since the operating utility prepared the procedures, it would be
more appropriate to request copies of them from Metropolitan Edison.
11. "You indicated that the temperature of the "quench tank" was 200 degrees. Was
this degrees C or degrees F?"
Degrees F.
12. "Please send the detailed description of the maintenance work in progress prior
to the accident. Was the work normal maintenance? Was the work done in
accordance with any instructions which you may have supplied?"
The description of the work in progress prior to the accident
should be requested from Metropolitan Edison or General Public
Utilities. The condensate polishing equipment was not supplied
by B&W and we did not provide any operating instructions or
procedures related to it.
13. "What is the volume of the quench tank? How long does it take to fill it?"
The TMI Unit 2 Final Safety Analysis Report indicates that this
tank has a volume of 1000 ft3 and that it is normally filled with
650 ft3 of water. Assuming the design steam relief rate of the
pilot operated relief valve, it would take about seven and one-half
minutes to completely fill the tank based on these nominal conditions.
Further information related to the specific water volume and times,
prior to and during the accident, should be requested from
Metropolitan Edison.
B&W did not design or supply the quench tank at TMI Unit 2.
PAGENO="0506"
502
Babcock&WiIcox
The Honorable Hike McCormack June 22, 1979
14. "How frequently had similar maintenance work been done prior to the accident?
Is similar maintenance work frequently performed on other B&W power plants?
How `frequently?"
I do not have specific information related to operation or maintenance
procedures for condensate polishing equipment. Although all B&W
nuclear units are equipped with condensate polishers, B&W has not
supplied this equipment on any of its contracts. Information
related to operation and/or maintenance procedures and frequency
should be requested from the operating utilities.
15. "Provide a schematic description of the operation of the Condensate Polishing
System including the means of ensuring adequate redundancy."
This information should be requested from either Metropolitan
Edison or General Public Utilities..
16. "You mentioned that there was a release of radiation while transferring radio-
active water from the bottom of the containment vessel to the auxiliary
building. At what time did this occur and was this a part of the procedure
that would normally go into operation? Does this call for a reassessment of
the overpressure design criteria of the containment?"
I would like to address this question by briefly going through the
sequence of events that led to the spill of fluid in the containment
vessel and the ultimate transfer to the auxiliary building. The
following times are from the Hay 8, 1979, Interim Sequence of Events
published by the NRC.
At 3 to 6. seconds into the incident, the pilot operated relief valve
(PORV) on top of the pressurizer opened and began relieving steam
to -the reactor coolant drain tank. At 2 minutes and 4 seconds into
the incident, the high pressure injection system cut on and began to
pumpwater into the reactor coolant system. The PORV stuck open and
continued to relieve to the drain tank. As the pressure increased
in the drain tank, its relief valve opened at approximately 3 minutes
and 30 seconds and beganrelieving the contents of the drain tank to
the. containment vessel. The water level in the containment somp
- increased-until reactor building-sump Pump A started automatically
PAGENO="0507"
503
Babcock&Wilcox
The Honorable Mike McCormack June 22, 1979
at 7 minutes and 43 seconds on a high sump level. This began trans-
ferring fluid from the containment vessel to the auxiliary building.
Water level in the containment sump continued to rise until at 10 minutes
and 19 seconds, sump Pump B automatically started.
Pressure continued to increase in the draink tank until at 15 minutes,
the drain tank rupture disk burst. With the PORV stuck open and the
drain tank rupture disk blown, there was a direct path for the release
of reactor coolant to the containment.
Finally at 38 minutes, the operator cut off sump Pumps A and B. This
stopped the transfer of fluid out of the containment vessel. This
transfer had been initiated automatically by a certain level of water
within the containment vessel sump.
As I indicated on May 23, these transfer lines would not be auto-
matically isolated until the reactor building pressure increased to
4 psi. It is this criteria, the containment isolation criteria, that
I indicated is being reassessed.
17. "What is the volume (gallons or cubic feet) of the receiving tank inside the
containment vessel? Assuming that the HPIS runs without interruption, how
long does it take to fill the receiving tank?"
I assume that "the receiving tank inside the containment vessel"
referenced in the question is the containment sump which is an
integral part of the containment structure. Since the containment
was designed by the architect-engineer, information related to its
capacity should be requested from Burns & Roe or General Public
Utilities.
I think it is best to address the second part of this question by
stating that the High Pressure Injection System with two pumps
running, which is the normal case following emergency actuation,
will supply between 1000 and 1100 gpm depending on the pressure
PAGENO="0508"
504
Babcock&WiIcoX
The Honorable Mike NcCormack June 22, 1979
in the reactor coolant system. The time required to fill the sump
depends on numerous parameters, such as, sump capacity, initial
inventory, sump inputs and outputs.
18. "It appears that some of the events at ml took place very rapidly. Is this
indicative of inadequate thermal capacity in the cooling and heat transfer
systems?'
No, the B&W design does not suffer from inadequate thermal capacity
in the cooling and heat transfer systems. I should clarify that in
any large power station, a major upset such as turbine trip or
reactor or boiler trip will result in a number of events taking
place in a short period of time.
The subject of thermal capacity is a very complex one. It involves
considerations of such things as reactor coolant system thermal
capacity, secondary system thermal capacity, load change requirements
and capability, containment design considerations and overall plant
safety considerations.
B&W's nuclear system design is different from other pressurized
water reactors (PWR's) because of the application of the once-through
steam generator rather than a recirculating steam generator. As a
result, in terms of reactor coolant system upsets, the B&W system
contains more thermal capacity than do other PWR's and in terms of
secondary system upsets, it contains less. Based on an evaluation
of the distribution of thermal capacity and the distribution of
upsets, we have concluded that the net effect is a tradeoff. That
is to say, our system is more tolerant of some transients and our
competitors' systems are more tolerant of others.
The B&W design provides certain load follow and operational benefits
which I believe are important. It provides these benefits without
sacrificing overall plant safety.
PAGENO="0509"
505
Babcock&Witcox
The Honorable Hike NcCormack June 22, 1979
19. "On page 10 of your testimony you mention three actions taken by the plant
operator:
"(1) He cut back on the high pressure injection to maintain the
pressurizer level. Was this the right thing to do?
"(2) He turned off the two pumps in the `B' loop at 73 minutes
into the accident. Was this a reasonable thing to do?
"(3) At 100 minutes into the accident the operator turned on
the two pumps in the `A' loop. Was this a reasonable action?
On what basis would you expect these actions to be taken?"
Part (1)
As I stated before the Subcomnittee on May 23, the premature
termination of the high pressure injection flow led to diminished
capability to cool the reactor core. This was because reactor
coolant system inventory was being reduced by blowdown through
the open pressurizer relief valve.
The Loss of Reactor Coolant/Reactor Coolant System Pressure
Emergency Procedure that was in place on TMI Unit 2 at the time
of the accident requires that both the pressurizer level be
maintained and that the reactor coolant system pressure be
maintained above 1600 psi before the operator may proceed with
reduction of the high pressure injection flow. Based on the
information that I have, that procedure was not followed because
reactor coolant system pressure was below 1600 psi when high
pressure injection flow was reduced. This reduction in flow was
apparently based on indicated pressurizer level only.
Had the procedure been followed and had the high pressure injection
system been allowed to continue in operation at full capacity,
subsequent anlayses have indicated that adequate core cooling
would have been provided, reactor coolant system pressure would
have been recovered and it would not have been necessary to shut
off the reactor coolant pumps. Therefore, this was not the right
thing to do.
PAGENO="0510"
506
Babcock&Wllcox
The Honorable Mike McCormack June 22, 1979
Part (2)
I have stated that shutting off one pump in each loop in response to
indications of low reactor coolant flow may be advisable and therefore
reasonable.
Part (3)
I assume you mean that the operator turned off the two pumps in the
`A' loop. While turning off the last two reactor coolant pumps
eliminated all forced circulation through the core, I cannot fault
the operators for taking that action at that point in the sequence.
Based on my understanding of the vibration levels and system
conditions that existed at the time, I believe the operator acted
appropriately in turning off the pumps.
I think it is important to point out that although the shutting off
of all reactor coolant pumps by the operator may have been a
reasonable action for protection of the pump under the circumstances,
if the high pressure injection system had not been cut back, the
situation would not have deteriorated to the point where this action
would have been necessary.
20. `Please comment on the following statement:
`From the viewpoint of nuclear power plant safety design, two principal technical
elements are involved in ThI. The most important is that the plant was
configured so that the pressure relief valve on the primary coolant system
opened very often due to events such as a failure of normal feedwater flow to
the reactor."
The B&W design philosophy has been to provide a runback capability
for anticipated transients that occur during plant operation. This
includes such transients as turbine trip, load rejection, loss of
one main feedwater pump or a partial loss of main feedwater flow,
the loss of one reactor coolant pump, frequency variations on the
electrical grid and partial or complete drop of one control rod.
The objective behind the runback philosophy is to minimize the
challenges to the protection and safety systems, thus enhancing
overall plant safety.
PAGENO="0511"
507
Babcock&WiIcox
The Honorable Mike McCormack June 22, 1979
This philosophy is implemented through a system control design concept
that incorporates a pilot operated pressurizer relief valve. It is my
opinion that this implementation does not lead to a degradation in
safety since appropriate means are provided for isolation of that
valve, if necessary.
21. "Provide details of the training program giv~en to Mr. Zewe by B&W."
Mr. Zewe completed a one-week operator training course on the B&W
nuclear power plant simulator in January 1979. This course consisted
of 16 hours of classroom time and 20 hours of simulator operations.
The detailed list of evolutions performed on the simulator and the
classroom and control room schedule are included as Attachments 1
and 2, respectively.
In addition, Mr. Zewe completed a refresher course in July 1977
in preparation for his TMI Unit 2 operator's license. That course
consisted of 20 hours of classroom time and 20 hours of simulator
operations. The detailed list of evolutions performed on the
simulator and the classroom and control room schedule are included
as Attachments 3 and 4, respectively.
Prior to June 1977, it is my understanding that Mr. Zewe was assigned
to ThI Unit 1 and was a licensed senior reactor operator on that unit.
I hope the above responses will be of benefit to the Subcommittee's continuing investi-
gation.
Very truly yours,
THE BABCOCK & WILCOX COMPMW
JHM/mjc John'ki. MacMillan, Vice President
Nuc1e~Power Generation Division
4 Attachments
PAGENO="0512"
508
SIMULATOR TRAINING SUMMARY SHEET
January 15-19, 1979
Mr. Bill Zewe has completed a one week training program consisting of
16 hours of classroom time and 20 hours of simulator operations.
The time spent in the simulator consisted of performing the evolutions listed
below with the remainder of the time devoted to manual and automatic ICS power
operations.
Evolutions Performed No. Performed
Fail Makeup Pump 1
Defeat Neutron Error Signal from ICS 2
Motor Fault 1
Dropped Rod 1
Stuck Rod 2
Retarded Rod Notion 1
Pail Power Range NI
Reactor Trip 7
RC Pump Trip 2
Fail Selected TH Instrument 2
Fail Selected Tc Instrument 2
Fail RC Flow Signal to ICS 2
Fail Pressurizer Spray Valve 3
Fail Pressurizer Level Signal 1
Reactor Coolant Leak Inside Containment Building 2
OTSG Tube Rupture 2
Steam Leak Outside Containment Building 2
Steam Leak Inside Containment Building 2
Turbine Trip 2
Fail Feedwater Pump LiP i
Fail OTSG Startup Level to ICS 1
Fail OTSG Operate Level to ICS 3
Condensate Pump Trip 1
Fail Feedwater Flow Signal to ICS 1
Feedwater Pump Trip 3
Load Rejection -8 3
Reactor Startup (Hot shutdown, all rods in, to 10 amps) 1.
Reactor Startup (108 amps to 5% power)
Reactor Startup (5% power to 15% power) 1
Power Escalation (15% power to 100% power) 1
Plant Reduction (100% power to 15% Power) 1
>10% Reactor Power Change wish Reactor Control in Manual
Plant Temperature Change >50 F 1
Reactor Trip without Turbine Trip 2
Failed Tave to 570 in the ICS 2
Failed Main Feedwater Valve Open 1
(Continued)
PAGENO="0513"
509
Evolutions Performed
Failed "A" Stean Generator Pressure to ICS
High
Failed "A" Main Feedwater Valve Closed
Decreased Condenser Vacuum
Failed Reactor Power to 60% in ICS
Feed Pump Trip with Neutron Error Defeated
in ICS
Dropped Rod Group 7 with Diamond in Manual
Ejected Rod Group 7
Loss of Both Feed Pumps
Failed Turbine Bypass Valve
Failed Header Pressure Signal to ICS
Degraded HP Heater
Reactor Startup (Hot shutdown, safety rods
-8
out, to 10
amps)
Instructor, Nuclear Training Center
No. Performed
1
1
2
1
1
1
1
1
1
1
1
1
Date
48-721 0 - 79 - 33
PAGENO="0514"
* ROll Eeoc
Sb OroASi.y
Jim Moeterc
CONTROL ROOM SCHEDULE
INSITtDCPORS NUCLEAR TRAINI115 ~rr~
0.J. (Worry) Weiieeier
J.A. (Joho) Liod
IL. (Tod) look
Vt. (Viooo) Roppol
A.V. (Al) While
601-8027-09.00
.SUVLATOR REQUALIFICATION TRAINING
GROUP 1
CLASS ROOM SCHEDULE
P19
WI. Rap/Date
Tim'
Seblect
Reference
Instructor
TI~~
T
Opinatle.
Reference
tnitructor
1 R4TNEAY
1/15/79
.
1400
COD REVIEW/OPURAT100IAL PI15OLUIS
J,L.
0130
to
1130
ROACTOR STARTUP P115.! ALL RODS IN TO
100% P051.0
REACTOR TRIP
01.065150 TRIP
Ta.
1400
~
IWrECDATED C mIol. OlSON.!
1.5.
- -
2 TUIISIAS
1/16/79
1030
1~0
CONTROL DOD DRIVE
*
JL
°~
tO
0)30
PCWTR OPERATIONS WITH tft(AM65IJNCEIJ
CASUALTIES
`
`~`
V.0.
AL
1400
to
1600
. *
91160 TIWISPER
.
*
0.8.
~
1200
to
.!!2.2_.
lOWER OPERATIONS WITH IODOGIOIOICED
CASUALTIES
.
3 WFOIOESIAY
1/17/79
0730
to
0930
OUSt WtVItO/TOIt RUPTURE .
.
*
~
0930
to
1130
POSER OPERATIONS WITH 000POIC900CED
CASUALTIES
*
J.L.
`i;;;
to
1400
POWER lIST. 10)0 WIThDRAWAL LIMITS
yR.
*
to
.!±99_
--....-."......
CASUALTIES .
J.L.
*
4 I}RJDSDAY
1/10/79
0930
to
1130
.
POSH POLL
oo.soo
0730
to
0930
.
POWER OPERATIONS WITH RHARUOSRIERD
CASUALTIES
*
AR
(*;
6.0.
.
to
160)
ICS REVIEW/TRANSIDNT RESPONSE
TO.
tO
.1!2!...
IThRNA000IOICED
CASUALTIES *
S PRIIIWY
1/19/79
0930
tO
1130
*
.
001 000 Rod Withdr~o~1 & Diet.
.
*
. ro,
0730
to
0930
P0511 OPERATIONS WITH RRA)o0)tJMED
CASUALTIES
90
to
1600
REACTOR COOIAJff'pIJSpS
0.0.
`u~a"
tO
1400
~ö~'öi~i.~iIoNS ITO UNA(6I007ICED
CASUALTIES
-
9.0.
cii
METROPOLITAN EDISON COMPANY
Coliltif
IAICOCR I WILCOX
AT090T27
NUCL(0R 78*10(81 CINTRI
LUICHIURI. ((0166(0
ATTACHMENT 2
PAGENO="0515"
511
SIMULATOR TRAINING SUNMARY SHEET
June 27~.Ju1y 1, 1977
Mr. W. H. Zewe_ has caipleted a one-week ~airJr~g prcgran
consisting ofR3Tc rs 6tc sroat tite axi 20 hours of sirrulator operations.
The tirr~ spent in the siruiator consisted of perforning the evolut~tcrs 1~s ted
below with tl~ rerair'.der of the tic~ devoted to rx~riua. and autanatic CS power
operations.
~1uticrts Perforned ~. Perforr~ed
Dropped Rod 2
Stuck Rod 1
Reactor Trip . 3
RCPu~pTrip 1
Fail Selected ~. Instrt~t 1.
Fail Selected Ir.smz~rit 2
Fail Pressurizer Spray Valve 1
Reactor Ccolant Leak Inside Cozita.ircent ~.ii1ding . t
OtSG. Tube ~ti.~re 1
Fail 1\rrbir~e Bypass Valve 1
Stean Leak Inside CcncaL-xent &iildthg 3
Fail Header ?ressure Si~al to ICS I
Ttirbfr.e Trip
Fail Feed~:er ?~.ti, .P 2
Fail OTSG Scrup Level to ICS 2.
Fail C1~SG Operate Level to ICS . 4
Feed~ster ~ Trip -8 1
Reactor Startup (Fot s1a.edo~n, all rods in. to 10 a~is) 1
Reactor Star-'~ (08 an~s to 5~ pcwer) I
Reactor Startup (5~ power to l5~ power) 1
Power Escalaticn (15~ power to 1OQ~ power) 1
Plot 1/~ 1,
Failed Main Feed Valve B Opcsi 2
Loss ICS Pc~..er
Fail Mi Control Valve 1
ATTACHMENT 3
PAGENO="0516"
1~~i.&~toto-.0ucIe~r Trathint Cont,t
J 0. 53.3 Cavnnn
~ Porla
C.?.C) Alien
~:~ry, I!ellsnIsr CUSS ROOM SCHEDULE
60l*S027~07~06
PLANT OPERATIONS TRAININO
GROUP D
CONTROL ROOM SCHEDULE
9111 Zoos
7Sba )~rsNaI1
I.~i.h RY137t
I's'lEs,!!!!!
t~~S
hued -
hfsosecs
*
Ti..
U~sva1s.
Issuscs
I M~\3NY
o 21 77
`
7:50
to
11:30
cOHTROL ROD DRIVO
DIA'Cd7P.U~L*IVI~
*
.
4:00
9:30
PL000ED NOZZLE STARTUP PEON ALL RODS
IN TO 1000
REACTOR TRIP
T000INE TRIP
" Cpsoo
~
~
2 TUESDAY
6/20/17
.
- -
9:30
02:00
t~
2:00
*EA~OR PROTECTION S STEM
IC, REVIEW
W* Perks
.7. Carson
to
4:00
0:30
POWER OrCUATIONS WITH UNANNOUNCED
POWER OPERATIONS WITH UNANNOUNCED
CASUALTIES
~. P~~5
.1 Carson
`
WED.
0129/71
7:30
t
12:00
to
2:30
ICS REVIEW
ICS REVIEW
.7. Carsos
V. Perks
2:00
ER
4:00
POWER OPERATIONS WITH UNANNOUNCED
POWER OPERATIONS WITH UNANNOUNCED
CASUALTIES
.7. Carson
W. Perks
TH~RSDA
~
E.~
0750 REVIEW
~.
..!!._
9:30
CASUALTIES WITH UNANNOUNCED
~. Pork,
7:30
to
FRIDAY 9:30
711/77 12:00
to
t_*_____~-_-
REACTIVITY CHANCES WOL . EOL
WEEELT REVIEW
H.H.tlseL.r
0. Perks
00
11:30
2:00:
00
REVIEW SELECTED CASUALTIES .7 Carson
REVIEW SELPCTED CASUALTIES .7 Carson
t-~
lABElER I WILCOI
soCilal IOAIOHC CIRTEB
1s~Wl0R5. RIICIR:A
ATO7NTZ7
ATT~CHMENT 4
PAGENO="0517"
513
Congressman Mike McCormac'k
Babcock &WiIcox Power Generation Group
P.O. Box 1260, Lynchburg, Va. 24505
Telephone: (804) 384.5111
May 29, 1979
J~m ~
The Honorable John W. Wydler
Ranking Minority Member
Subcommittee on Energy Research and Production
Science and Technology Committee
House of Representatives
Washington, D.C. 20515
Dear Congressman Wydler:
During my appearance before the Subcommittee on Energy Research and
Production of the House Committee on Science and Technology on
Wednesday, May 23, 1979, you raised a series of questions regarding
a Nuclear Regulatory Commission memorandum dated January 8, 1979,
from J. S. Creswell, Reactor Inspector, to J. F. Streeter, Chief
Nuclear Support Section 1 (Creswell memo). I regretfully did not
have the following information available at that time to respond
to your questions but,as I indicated,I would supply a response for
the record.
The Creswell memo discussed six points that the author raised which
he felt should be considered by the licensing boards for license
application by Consumers Power Company for its Midland. Units 1 and 2
and Toledo Edison Company for its Units 2 and 3. These units will
incorporate Babcock & Wilcox nuclear steam systems. The Creswell
memo was an internal memorandum of the Nuclear Regulatory Commission
and was not transmitted to Babcock & Wilcox. This is normal for
NRC internal memoranda. To the best of Babcock & Wilcox's knowledge,
the customers of Babcock 6 Wilcox, Toledo Edison and Consumers Power,
did not receive copies of the Creswell memo.
Item 3 of the Creswell memo referred to an incident at Toledo
Edison's Davis-Besse Unit 1 where off-site power was lost. This
incident occurred on November 11, 1977. Babcock & Wilcox worked
with Toledo Edison in investigating the incident.
We believe Item 6 of the Creswell memo refers to a letter sent by
Babcock & Wilcox to Toledo Edison dated August 9, 1978. This letter
referred to an incident that occurred at Sacramento Municipal Utility
District's Rancho Seco Unit 1 plant on March 20, 1978. This unit
also incorporates a Babcock & Wilcox nuclear steam system. Babcock
& Wilcox informs its customers having operating units of. incidents.
PAGENO="0518"
514
which occur at one of the plants which may provide helpful informa-
tion to the owners and operators of its other plants. This was the
purpose of the August 9, 1978 letter to Toledo from B&W.
Returning to the -Creswell memo, the normal course of events, as we
understand it, would be for the NRC to review the points raised and
follow the memorandum to a conclusion.
In the course of the NRC's investigation of the Creswell memo, the
NRC wrote to Babcock & Wilcox on January 31, 1979 and requested a
meeting in Lynchburg to discuss items related to an NRC invàstigation
of an incident at Davis-Besse. That meeting was held in Lynchburg
on February 14, 1979. The discussions were apparently about the
points raised in the NRC memo of January 8, 1979, although no copy
of the Creswell memo was given to B&W at this meeting or prior
thereto.
On February 28, 1979, apparently following its own internal procedures,
an NRC memorandum was sent from Norman Moseley, Director, Division
of Reactor Operation Inépection, IE, to Dudley Thompson, Executive
Officer for Operations Support, IE. The subject was "Notification
of Licensing Boards" and sent its preliminary evaluation of the six
points raised in the Creswell memo~ This Noseley memo stated:
"Our preliminary evaluation indicates these items (the six points
raised in the Creswell memo) do not appear to be new issues or to
puts different light on the issues and therefore, in our opinion,
do not meet the intended criteria for Board notification." This
memo went on to say that Creswell, upon notification of the Division
of Reactor Operations Inspection preliminary findings, requested that
the Licensing Boards still be notified and pursuant to the NRC
procedures Moseley did so.
On March 28, 1979, another internal NRC memorandum was sent from
N. C. Moseley to D. Thompson which included the final evaluation
of the six items set forth in the Creawell memo.
We hope that the above brief chi~onology is helpful and responsive
to your question. It is important to again note that the Creswell
memorandum and the follow-on NRC memoranda were internal to the NRC
and were not sent to B&W. Following the Three Mile Island incident
B&W first became aware of the existence of the Creswell memo even
though the subject matter had been discussedwith theNRC. On
March 29, 1979, B&W first received a copy of the Creswell memo and
the follow-on NRC memos.
PAGENO="0519"
515
If I can provide you or the Subcommittee with any further informa-
tion, please advise.
Very truly yours,
JHM/mjc Job . MacMillan
Vice resident
Nuclear Power Generation Division
Enclosures:
- 1/8/79 Memo J.S.Creswell to J.F.Streeter
- 2/28/79 Memo N. C. Moseley to D. Thompson
- 3/28/79 Memo N. C. Noseley to D. Thompson
enclosing Evaluations of Concerns
cc: w/Enclosures
The Honorable Mike McCormack
Chairman, Subcommittee on Energy
Research and Production
Science and Technology Committee
House of Representatives
Washington, D.C. 20515
PAGENO="0520"
u?.ItEO STatES
NUCLEAR RSGULITORV CC'.tt.tISSICN
`I
7~! ~OO1CVt~. a5*~
Ct.E~ (t~t.v~. t.~.OiS IO~37
January 8, 1979
::~1OANDUN FOR: 3. F. Sereeter, Chief, Nuclear Support Section 1
FRON: J. S. Cresvell, Reactor Inspector
SUgJECT: CO~JE?ING N~ INFORIIATION TO LICENSING 3C?RDS -
DAVIS-3ESSE UNITS 2 & 3 AND MIDL4ND UNITS 1 & 2
During the course of oy inspect±ons at Davia-Basse, certain issues have cone
to ny attention vhich I ~ submitting for ccnsidarstion for forvarding Co
the A:cnic Safety and Licensing loan vhich has proceedings pending for the
afora~.encioned :acilit~as. This subnictal is n.ade pursuant to Resional
?rocedu:e 1530A (Novenbe: 16, 1978), ste~ 3 and infoctnacion supplied to ne
per step 1. The issues for consideration are:
1. During a recant inspection at Davis-Easse tnit 1 infc~stion has
been attained vhich indicates that at certain condi:icr.s of resctor
- coolant visccsicy (as a funcz.on of tenperature) core lifting nay
occur. The licensee infoed the inspector that this issue involues
other E&W facilities. The tavis-3esse FSAR states in Secc:on t~.A.2.7:
The hydraulic force on the fuel aesanbly receiuing the nost
flow is shovn as a function of systec flay in Figure 4-39.
Additional forces acting on the fuel assenbly are the asserbly
weight and a hold deL-n spr1ng force, vi-.ieh resulted in a net
do~nvarf force at all tines during nor~.sl station operati~r..
The licensee states that there is a 500°F interlock for the starting
of the fourth reactor coolant p~p. Ncvever, no Technical Specifi-
cation :equires that the p~p be started at or above this tanpera-
ture. A concern regarding this nacter vould be if asaanblies ncved
upward into a position such that control rod nov~nent would be
hindered.
2. Inspection Report 5C-3~6/7S-O6, paragraph 4, reported reactivity -
paver cscillations in the Davis-lease cork. Those oscillations
have also occurred at Oconee and are ac~ributed to stean generator
level oscillations. 3&N report EAS-10027 states an a9.2:
516
Docket No. 50-300/501
50-329/330
~1
PAGENO="0521"
517
The OTSG laboratory nodel test results fndicated that periodic
-- oscillations in steso pressure, szean flow, and steangenarator
prinery outlet :e:zpar~tu:es could occur under certain conditicns.
It was shown that the oscillations were of the type asrociated
with the relationships betvven feedvater heatang chanber pros-- - -
* sure drop and tube nost pressure drop, which are elininsted or
reduced to levels of no. cchsequence (nofaadback to reactor
~.~!en) by adjustnenc of the tube nest inlet resisronce. As
a rosult of the tests, an adjustable orifice has been installed
* in the dovoccoer section of the stean generators to proviae
for adjuscnent of the tube nest inlet resistance and to provide
the eear.s for elinination of oscillations if they should develop
during the operating lifetine of the generators. The initial
orifice setting is chosen ccnset~atively to nininize the need
for further adjuatnent during the star:up test prcgrsn..
We also note that the effect on t~e incors detector syston fcr
nonitoring cors paransters during the oscillations is no: clear.
3. Inspection ~nd Znforzenent Report 50-346/78-06 docutanted that pres-
surizer level had gone offscsla for approxinately fi:e ninutas du:-
ing the Novenber 29, 1977 loss of offeite power even:. There are
sane indications that other l&W plants nay have prabens naintainirg
pressurizer level indications during transients. In addition, under
certain conditions such as loss of feedvater a: lOOl power with the
reactor coolant p~ps running the pressurizer ~sy void ccnpletaly.
A special anal~.'sis has been perfot~ed concerning this event. This
analysis is attached as Znclosure 1. Secsuss of pressurizer level
taintenance problans the sizing of the pressurizer cay require
further revi~v.
Also noted during, the. event was the fact that Tcold vent ofiacala
(~es ian o20 ) n a~d son st as no en tn~ t~ un ow
sonit.oring is. l~ited. to lass than 160 gp and that nnkaup flow
cay be sube:~nriaily greater than this value. This info~ation
shculd be exooi:ed in l~.ght of the,require~ents of GDC 13.
4. A neno froc B&W. regarding control rod drive syst~ trip breaker
naintenance is attached as Znclosure 2. This neno should be evaluated
in terns of shutic-n rargin ~intenance and All'S considerations par-
ticularly in light of large positive noderator coefficients allowable
with 3&~ facilities.
PAGENO="0522"
518
5. l~specricn and forceoent F.epor: lC-3L6/7f-17, psr~raph 6 raf.:s
to inspec:icn findir.gs re;arding the capability of the inccre derac-
.tor systw to da:er~ir~a ~crs:. cisc ths~al c~n:i~ns. The reactor
- can be cperated per the Technicil Specifi-~acions vith the center
incore string out of service. Lf the peak power lo~atior.s is in
the center of the core (this has been the case cc Davis-~esse),
fa~cto:s are not applied to conservatively nc~itcr values such as
and F delta H.
6. Eo~losure 3 describes an event that occurred at a I&W facility vhich
reaulted in a severe theral cran~ient and extrsoe difficulty in
controlling the plant. The aforerentioned facilities should be
r~vie~ed in li~nt of this inforr~cion for possible safety inplica-
clone. -. 1 -
.1. S. Cresvell
P.aactcr inspector
Zoclosures: As stated .
cc yb enclosures
G. Ziorelli
R. C. }Znop
T. N.. Ta~bling -
PAGENO="0523"
519
tJ?Jt1to s~.r. rEs
NUCLEAR REnuLATo~Y Cc:;:.asoioN
mASHINCTON. 0. C. ~5S5
EBB 28 T~73
WE;1OR~:wuM FOR: ~)á~I~y Thompson, Executive Officer for Operations
Support, IE
FROM: florman C. ;loseley, Director, Division of Reactor
Operations Inspection, IE
SUBJECT: HOTIFICATJON OF LICENSING BOARDS (AITS F30468H2)
Enclosed are six items sent in by Region III for for.:arding to sitting
Licensing Bcards for cases involving Babcock and Wilcox as the ~uclear
Steam System Supplier. Our preliminary evaluation indicates these
items do not appaar to be new issues or to put a different light on
the issues and therefore, in our opinion, do not meet the intonded
criteria for Board notification.
The originator ~tas informed, via telephone, of this determination on
February 27, 1979. His position was that our evaluation did not
provide any information thot he did not already have ~nd his concern
was whether or not these items had been considered and resolved on a
generic basis for all B&W plants. Because of this he still believed
the items should be sent to the Licensing Boards. IE Nenual Chapter
1530 requires that if, after a negative determination, the originator
continues to believe that the information should be submitted to the
Board(s), the information will be submitted. We therefore request the
enclosed items be sent to the appropriate Licensing Boards.
We will provide a written discussion and evaluation of each item within
seven (7) days of the date of this memorandum.
)
,r~Direc't~r
Div.is'ion of Reactor
Operations Inspection, rE
Enclosure:
ilemorandum Creswell to Streeter
dated January 8, 1979
cc w/o end:
S. E. Bryan
E. L. Jordan
0. Kirkpatrick
J. C. Stone
G. C. Cower
R. F. Heishmen, R1II
PAGENO="0524"
520
STAT ES
£~UCLEAR REGULA1ORY COM:.~SSION
JO ON 0 C 2055
1~AR 2 8 1979
t1EI4OP..~DUM FOR: Dudley Thompson, Executive Officer for
Operations Support, IE
FROM: Norman C. Noseley, Director, Division of
Reactor Operations Inspection, IE
SUBJECT: ~diOTIFI~ATION OF LICENSING BOARDS
On February 28, 1979, six it~tns concerning Babcock and Wilcox
designed nuclear plants were sent to you for foi~~arding to the
appropriate licensing boards. At that time only a preliminary
evaluation had been done. 1~e have completed our evaluation of
each. of the items ard that information is enclosed. This
additional information should be fonzarded to the licensing
boards.
Norman C. Moseley
Director
Division of Reactor
Operations Inspection, IE
Enclosure:
Evaluations of Concerns
cc: S. E. Bryan
E. L. Jordan
R. F. Heishman, Rill
J. C. Stone
D. Kirkpatrick
* LG~C~ Gower
V. 0. Thomas
CONTACT: 3. C. Stone
(x280l9)
PAGENO="0525"
521
EXCERPT FRON MD:oRA~;Du~ ENTITLED "CoI;VEYINC ~w INFor~'t;TIoN TO LIC:~Su;G
~OA7~DS - DAVIS-~ESSE U1~ITS 2 & 3 AND NIDU~ND UNITS 1 & 2', DATED
JANI~ARY 8, 1979, FED>! J.S. CRES~ELL TO J.F. STREETER
1. During a recent inspection at Davis-Besse Unit 1 information has
been attained which indicates that, at certain conditions of reactor
coolant viscosity (as a function of temperature) core lifting may
occur. The licensee informed the inspector that this issue
involves other B&W facilities. The Davis-Besse PSAR states in
Section 4.4.2.7:
The hydraulic force on the fuel assembly receiving the
most flow is shawn asa function of system flew in Figure
* 4-39. Additional forces acting on the fuel assembly are the
* assembly weight and a hold down spring force, which resulted
in a net downward force at all times during not~nal station
operation.
The licensee. states that there is a 500°F interlock for the start-
ing of the fourth reactor coolant pump. However, no Technical
Specification requires that the pump be srarted.at or above this
temperature. A concern regarding this matter would be if assem-
blies moved upward into a position such that control rod move-
ment would be hindered. ` -~ `
DISCUSSION A.'~D EVALUATION
The `potential for core lifting in B&W plants is a concern which
has been previously reviewed by NRR. The concern was first raised
in conRection with the Oconee 2 and 3 reactors, where the primary coolant
flow `rates were found to be in excess of the design flow rates. For
example, the Unit 2 flow rate was found to be 111.5% of the design flaw
rate. Since this was very near the predicted core lift flow rate of
111.9%, an analysis was done by B&W to determine what effectcore lifting
* ~~ould have on the previous safety analysis for these plants. This
analysis (dated Hay 2, 1975) indicated that the potential for core
lifting did not result in an unrevieved safety question. *A subsequent
review of this B~W analysis by NRR also concluded that an unsafe condition
did not exist (letter from R. A. Purple to Duke Power,' dated 9/24/75).
It should be noted that the potential vertical displacement of the core
is limited to a very small distance by the upper core support structure.
Core lifting, at paver would result in a slight reduction in reactivity
since the rising fuel would tend to engage the withdrawn control rods
to a slightly greater extent than it would in. the bottomed condition.
The amount of this change in reactivity is, of course, available for
reinsertion should the fuel settle back to its original position. The
potential reactivity increase caused by the settling of the .16 centrally
located control rod assembly elements (assumed ~o have been subject to
lifting in the Oconee 2 reactor) was calculated to be 0.1% 1~ K/K. This
value is insufficient to have much effect on the accident and transient
safety analyses. * .
PAGENO="0526"
522
6An additional concern was thepotential for damage to the fuel assembly
end fittings which night be caused by fretting due to repetitive fuel.
movement. Consequently, Duke Power was requested by KR?. to make certain
e:~aninations of the Oconee 2 fuel during the first refueling to confirm
that fuel element c~otion was not occurring. The results of this
examination (letter from W. 0. Parker to R. C. Rusche dated 7/21/76)
showed that no fuel lifting or other type of notion had occurred during
the first cycle of operation.
After the core lift concern was identified, B&W developed newer types
of fuel holddo~.i-i springs which provide more margin against core lifting
than the previous springs did. It is our understanding that the newer
types of springs have been installed in all B&W reactors.
For these reasons, we believe that there is- presently little likelihood
that core lifting will occur during normal pcwar operation. At lower
temperatures, there is an increased flow induced lifting force on the
fuel due to the hither visccsity of the reactor coolant. gonsequentl)',
we view the restriction against 4 pump operation below 500 F as a
prudent precaution against fuel fretting. However, since the potential
for core lifting has little safety significance and because critical
operation below 500°F is not permitted, we have no basis to recommend
including this restriction in theTechnical Specifications.
PAGENO="0527"
523
EXCERPT ~o~i ~*~o~u~i ENTITLED "co~v~n;c ~;~` I~~FO~iA~ION TO LICENSING
BOARDS - DAVIS-RESSE UNiTS 2 & 3 AND 2~lDLA:;D UNITS 1 & 2', DATED
JA~ARY 8, 1979, FRO:t J.S. CRESVELL TO J.F. STREETER
2. Inspection Report 50-346/78-06, pa;agraph 4, reported reactivity -
power oscillations in the Davis-Besse.. core. Theme oscillations
have also occurred at Oconee and are attributed to steom genera-
tor level oscillations. B&W report EItW-10327 states in P.9.2:
The OTSG laboratory model test results indicated that
periodic oscillations in steam pressure, steam flow, and
steam g~nerator primary outlet temperatures could occur
under certain conditions.
It was shown that the oscillations were of the type associa-
ted with the relationships between feodwater heating chamber
pressure drop and tube nest pressure drop, which are elimi-
nated or reduced to levels of no consequence (no feedback
to r~ac.tor svs:am) by adjustment of the tube nest inlet
resistance. As a result of the tests, an adjustable
orifice has been installed in the downconer saction of the
sta~m ge~e~ ots to pro~ide for adjust-ien or the tune
ne~t'.inle~ resistance and to provide the nrans for chains-
tionof oscillations if they shculd developduring the
operating lifetime of the generators. The initial orifice
* setting is chosen conse~'atively to minimize the need for
further adjustment during the startup test program.
We also note that the effect on the intore detector system for
monitoring core parameters during the oscillations is not clear.
DISCUSSION AND m\?t.LUATION
Power Oscillations of the order of 1.5% of full power have been observed
at all of the Oconee plants and are considered normal. In ]977 the
power oscillations experienced by the Oconee 3 reactor increased to a
maximum of 7.5% of full power. At that time the problem was reviewed by
NRR with the conclusion that there was no significant safety considera-
tion at that value (Note to B. C. Buckley from S. D. ~acRay, dated
January 27, 1978). it should be noted that the 7.5% power oscillations
cause about a 1 F oscillation in core average temperature due to the
short period of the oscillations. The important core safaty parameters,
which are, the departure from nucleat~ boiling ratio and the average
maximum linear heat generation rate are affected very little by oscilla-
tions of this amplitude. The primary cause of the power oscillations
is believed to be a fluctuation of the secondary water level in the
steam generators. This can be minimized by increasing the flow resistance
In the dovnconer region of the steam generators. The corrective effort
a: Oconee 3 was complicated by the fact that the orifice plate provided
for this purpose could not be fully closed.
~owever, the oscillations at other B&W plants have been kept to about
1.5% of full power by appropriat~ adjustment of the downcomer flow
resistance. For these reasons, the power oscillations at B&W plants
are not considered to-be a significant safety concern.
PAGENO="0528"
524
EXCEF~?T FRaN ~i iOF~Ut~t ENTITLED "CCNVEY1N~ NEW INF *L~T1ON TO uc~::sn:c
~DS - D.~VIS-i~ESSE UNITS 2 & 3 AND MIDL!~ND UNITS 1 & 2', DATED
J;.N~ARY 8, 1979, FRON J.S. CRESTELL TO J.F. STREETER
* lnspect4on and Enforcement Report 50-346/78-06 doc~znented that
pressurizer level had gone offscale for approximately five
minutes during the November 29, 1977 loss of offsita power event.
There are acne indications that o~cher BiW plants cay have prob-
* lens maintaining pressurizer level indications during transients.
In addition, under certain conditions such as loss of feedwater
at 100% power with the reactor coolant p~~ps running the pros-
*surizer may yoid completely. A special analysis has beenper-
formed concerning this event. TMs analysis is attached as
* Enclosure 1. Because of pressurizer level maintenance prob-
lems the sizing of the pressurizer nay require further review.
Also noted during the event was the fact that Tcold went off-
scale (less than 520°F). In addition, it was noted that the
makeup flow monitoring is limited to less than 160 gpm and
* that nakeup.flow may be substantially greater than this value.
This information should be e~mined in light of the require-
ments of GDC 13.
DISCUSSION *L_ND EVALUATION
The event at Davis Besse which resulted inioss of pressurizer level
indication has been reviewed by NF~ and the èonclusion ~es reached
that no unrevieved safety question existed.
The pressurizer, together with the reactor coolant nzkeu~ system, is
designed to maintain the primary system pressure and water level within
their operational limits only during normal operating conditions.
Cooldown transients, such as loss of offsite power and loss of feed-
water, sometimes result in primary pressure and volu~e changes that
are beyond the ability of this system to control. The analyses of
and experience with such transients show, however, that they can be
sustained without ccrpronising the safety of the reactor. The principal
concern caused by such transients is that they might cause voiding in
the primary coolant system that would lead to loss of ability to ade~
quasely cool the reactor core. The safety evaluation of the loss of
oifsite power transient shows that, though level ~indicaticn is lost,
some water remains in the pressurize: and the pressu~e dces not decroase
below about 1600 psi. In order for voiding to occur, the pressure nust
decrease below the saturation pressure corresponding to the system
ten~eratura. 1600 psi is the saturation pressure corresponding to
~3°F which is also the maximun allowable core outlet temperature.
Voiding in *the primary system (excepting the pressurizer) is precluded
im this case, since pressure does not decrease to saturation.
PAGENO="0529"
525
The safety analysis for more severe cooldown transients, such as the
loss of feedvater event, indicates that the water volum~ could decrease
to less than the system volume exclusive of th~prmssurizer. During
such an event, the emptying of the pressurizer would be follo~,cd by
a pressure reduction below the saturation point and the formation of
small voids throughout much of the primary' system. This would not
result in the loss of core cooling because the voids would be dispersed
over a large volume and forced flow would prevent them from coalescing
sufficiently to prevent core cooling. The high pressure coolant
injection pumps are started automatically when the~primary pressure
decreases below 1600 psi. Therefore, any pressure reduction which is
suffi~ lent to allow voiding will also result in water injection which
will rapidly restore the primary water to nor~al levels.
For these reasons, we believe that the inability of the pressurizer
and r.ormal coolant makeup system to control some transients does not
provide a basis for requiring more capacity in these systems.
General-Design Criterion 13 of Appendix A to 10 CTR 50 reqt~iires
ir.strumentation to monitor variables over their anticipated ranges
for `ar.cicipated operational occurrences".. Such occurrences are
specifically defined to include loss of all offeite power. The fact
that T cold goes off scale at 520°F is. not considered to be a deviation
from this requirement because this indicator is backed up by wide
ran'ge tenperature indication that extends to a low limit of 50°F.
Neither do we consider the makeup flow monitoring to deviate since
the amount of makeup flow in excess of 160 gpm does not appear to be
*a significant factor in the course of these occurrences.
The loss of pressurizer water level indication could be considered to
deviate from GDC 13, because this level indication provides the principal
means of determining the prima~' coolant invanto~'. Nowever, provision
of a level indication that would cover all anticipated occurrences may'
not be practical. As discussed above,, the loss of feedwater event can
lead to a momentary condition wheaein no meaningful level exists,
because the entire primat3r system contains a steam water mixture.
It should be noted that tha introduction to Appendix A (last paragraph)
recognizes that fulfillment of some of the criteria may not always be
appropriate. This introduction also states,that departures from the
Criteria must be identified and justified. The `discussion of GDC 13
in the Davis Besse PSAR lists the water level instrumentation, but
does not mention the possibility of loss of water ic-vol indication
during transients. This apparent omission in the safety analysis
will be subjected to further review.
48-721 0 - 79' - 34
PAGENO="0530"
526
EXCERPT TRO:l I: ORANDUN ENTITLED "CCNVEYIN~ NIl' I u~'.TION TO LIC1NSINO
LOA~.DS - D.\VIS-ERSSE UNITS 2 & 3 !~iD MIDLAND u:;ITS 1 & 2", DATED
JAN~JArtY 8, 1979, FRO:I J.S. CRESktLL TO J.F. STREETER
4. * A memo from B&W regarding control rod drive system trip breaker
maintenance is attached as Enclosure 2. This memo should be
evaluated in terms of shticdown martin maintenance and AT~S
considerations particularly in light of large positive mocerator
coefficients allowable with 36W facilities.
DISCUSSION AND EVALUATION
Our investigation of the above circuit breaker problems has revealed
/ that eight failures of reactor scram cir~uit breakers to trip during
test have been reported from Babcock & Wilcox (E&W) type operating
facilities since 1975. Ineach case, the faulty circuit breaker was.
identified as a CE type AK-2 series (i.e., AR-2A-15, 24, or 50). The
causes for failure were attributed to either binding within the linkage
mechanism of the undervoltage trip device (liv) and trip shaft assembly
or an our-of-adjustment condition in the same linkage mechanism. 3~W
and GE determiaad that the binding and the out-of-adjustment conditions
resulted from inadequate preventive maintenance programs at the affected
operating facilities.
In addition to the breaker problems experienced at the 36W facilities,
three circuit breakers of the aforementioned GE oy~a failed in similar
fashion at the Oyster Creek cperating facility on November 26, 30, and
December 2, 1973. As in each case above, cleaning and relubricating
of the UV/trip shaft assembly within the circuit breaker was required to
correct the problem. It is significant to note that during the November
30, 1978 event, both redundant service water pump circuit breakers
failed to trip as required during the loss of off-site power test. These
failures in turn created ~ potential overload condition~on the emergency
busses during the sequential bus loading byeach diesel generator.
However, both diesel generators successfully picked up their required
bus loads without experiencing aunit shutdo~n~ from an overload condition.
With respect to the generic implications and safety significance of this
issue, bcth BE.W and GE are in the process of issuing alert letters to
their customers. These letters are scheduled for issuance by late
~larch and will describe the causes for failure and provide recormcndaticns
to resolve the problem.
Based on our study findings and on information obtained in discussions
about the breaker problem with the knowledgeable people from E&W, GE and
Region II, we plan to issue an IE Circular covering the matter. The
thrust of the Circular will be directed toward the need for adequate
preventive maintenance programs at all operating facilities. Specific
recommendations fr: GE to resolve the above breaker problem will also
be mentionee in the Circular.
PAGENO="0531"
527
E~:CER?T r~o:~ MENoRA~;DuN E~TITLF.D "co:~VEyt!:~ i;~~ I FOi~ATION TO LIc~:sn:~
EOA?DS - DAVIS-BESSE UNITS 2 & 3 /~D ?I1DL4ND UNITS 1 & 2", DATED
J~A?X 8, 1979, FRO:1 J.S. CflESWELL TO J.F. STREETER
5.' Tnspecticn and Enforcement Report 5O-3~6/7S-17, paragraph 6 refers
to inspection findings regarding the capability of the incore.
detector system to dttermine worst case thermal conditions. The..
reactor can be operated per the Technical Specifications with the
center incore string out of service. If the peak power locations
is in the center of the core (this has been the case at Davis-
Besse), fact~rs are no.t applied to conservatively monitor. values
such as F~ ~nd F delta H.
DISCUS SION A~D EVALUATION
~e do not believe that there is a valid basis for requiring the center
string of incore detectors to be always' operable in E&N reactors.
The power distributions for various plant conditions, throughout tha fuel
cycle, ~re calculated prior to the cperation of the reactor. The power
distribution is verified at the beginning of operation,' and periodically
thereafter, by comnarison with the available incore detectors. The power
in fuel assenblies that lack detectors (including those with `failed
detectors) is derived by using the known power distribution to determine
the power ratios between such an assembly and nearby assemblies that have
detectors. These ratios cam then be multiplied by' the power in the
measured assemblies to derive the power level in any specific'unmoasured
assembly. The central assembly is not fundamentally different than any
other assembly in this respect. Although this assembly is the highest
powered assembly in the Davis Besse reactor at the beginning of the fuel
cycle, this is not the case at all reactors. Nor does the central assembly
have the highest power, in the Davis Besse reactor, at the end of the
first fuel cycle. Since there is some variation between the calculated
power distributions and the actual ones, an appropriate margin is
assumed for this variation in establishing the allowable power peaking
factors.
Fixed incore detectors must function in an extremely harsh environment
and are subject to high failure rates. In order to ensure that an ade-
quate number will survive the fuel cycle, many more detectors are
installed than are necessary for the power distributions determinations.
To require the central string to be always operable would likely result
in unnecessary power restrictions. Neither the standard Technical
Specifica:icns (STS) for B~W plants nor the STS for CE plants (which
also have fixed incore detectors) require the central detectors to be
operable. , .
PAGENO="0532"
528
EXCERPT FROM M~~OP~NDUN ENTITLED "cC:~VE?INC INW I:;FoR~ATiON TO ~cE~:sINC
- DAV1S-EESSE UMITS 2 & 3 AND MIDL~D UNITS 1 & 2", DATED
JANuARY 8, 1979, FROM 3 . S. CRESVELL TO 3. F. S7REETER
6. Enclosure 3 describes an event that occurred at a 86W facility
which resulted in a severe thermal transient and extrez~e dif-
ficulty in controlling the plant. The aforcnenticned facilities
should be r~vi~ued in light of this infornation for possible
safety inpli~tions.
DISCUSSION AND EVALUATION
Following the cooldown transient at ~ancho Seco, NRR evaluated the event
and concluded that no structural damage had occurred to the primary
coolant system which would preclude future, operation of Rancho Seco.
}owever, in their safety evaluations they concluded that positive steps
should be taken to preclude similar transients and that the generic
implications of this event should be reviewed. In addition, IE initiated
a Transfer of Lead Responsibility~ Serial No. IE-P.OI 78-04, dated
April 25, 1978, rec~_mending that:
1. NRR perform a generic review of the non-nuclear instrumentation
power supplies for cther 06W units, if design changes to the non-
nuclear instrumantation. (NNI) pcwer supplies are required at
* Rancho Seco~ -
2. NRR evaluate the susceptibility of 36W plants to other initiating
events or failures which could cause similar significant cooldown
transients.
This event is currently being evaluated by NRR.
PAGENO="0533"
529
UNITED STATES
NUCLEAR REGULATORY COMMISSION
WASHINGTON, D. C. 20555
The Honorable Mike McCormack
United States House of Representatives
Washington, D. C. 20510
Dear Congressman McCormack:
Enclosed are answers to questions you sent to Harold Denton in connection
with his testimony at your subcommittee hearings on Nuclear Power Plant
Safety.
These answers to your questions are furnished in advance of completion of the
work of the various NRC task forces and of the investigations in process
within and outside of the NRC concerning the Three Mile Island accident.
There will undoubtedly be a great deal more to say on these matters in the
future.
Sincerel
~
Lee V. Gossick
Executive Director for Operations
Enclosure:
Response to Questions
Question 1. Is there need for a "swat team" composed of people from
industry, the utilities, the NRC, etc.?
ANSWER
As a result of our experience at Three Mile Island, it is clear that
there is need for an organized, preplanned response ~ accidents. The
composition, logistics, authority and responsibilit'es of a response
team are subjects of studies now taking place within NRC. We expect
that preliminary conclusions from these studies will be available
within a few months.
PAGENO="0534"
530
QUESTION 2 Is there any advantage in standardizing the design of
nuclear power plants?
ANSWER
The Comission has continued to strongly encourage the use of
standardization in the design of nuclear power reactors. An
important advantage is the enh~1cement of public health and
safety due to the concentratijn of staff and industry efforts
on the in-depth review of standard designs.
The experience and knowledge gained as a result of the 1141 incident
pointed out clearly the widely varying plant designs, differing
operating parameters and procedures, and different safety margins
to postulated transients and plant conditions, even for plants
involving a single NSSS vendor. The combinations of designs,
procedures, set-points, response to transients, etc., for all
plants, PWR and BWR, is staggering.
As a result of this siutation, a number of observations may be
made:
(a)
the staff has detailed knowledge of representative plant
systems and predicted responses to transients, but often
lacks ready in-depth knowledge and understanding of any
specific plant design and performance;
(b) generic analysis and predicted plant responses have only
limited value - generally, plant-by-plant and case-by-case
studies and analyses are required because of specific plant
differences;
(c) plant simulators us'ed for operator training cannot accurately
simulate plant responses and procedures associated with all
plants of that NSSS design - and thus, operator training must
be~augmented through unique plant specific training;
(d) when a problem having public health and safety implications
is experienced, there is an inherent time delay as staff and
technical support personnel get up to speed, with regard to a
particular plant design and anticipated operating characteristics,
and the possible impact on other plants from the same problem;
(e) irruiediate and long-term corrective action to assure adequate
margins for all plants from serious problems are not easily or
rapidly determined - generally, a plant-specific analysis must
be conducted and a unique plan of action developed for each
plant;
(f) because of the nature of the competitive nuclear industry and
under the present regulatory process, this situation is not
likely to be different in the future. As the TMI and the Brown's
Ferry accidents make clear, the NRC must be able to move quickly.
and decisively for situations having public health and safety
implications;
PAGENO="0535"
531
(g) because of the NRC role and responsibilities and public and
Congressional perceptions of our role in cases involving serious
reactor operational problems, one aspect of on-going studies
fnclude the procedural and prganization changes which offer
potential for the staff to react more quickly for serious
operational events;
(h) ~any of the initial difficulties faced in coping with the TMI
Incident would have been reduced had TMI been one of a family
of standard plants under a standardization policy implemented
with a high degree of discipline; standardization provides a
policy and framework for the staff and the industry to know,
understand, and model the response of plant systems, and thus,
to quickly and effectively analyze differing situations.
When viewed in the context of prevention of and recovery from
accidents, such as experienced at NI and Brown's Ferry, disciplined
standardization provides a number of distinct advantages,- such as:
(1) A uniform system design results in a much greater understanding
of the specific design and associated plant response charac-
teristics. This Is true for utilities, NSSS vendors, A-Es,
ACRS, ASLB's, and the public and staff.
(2) Definition and examination of interfaces between NSSS, BOP and
site aids in gaining an understanding of system interactions.
(3) More complete and effective simulation and R&D are possible when
results are applicable to a class of plants whose population is
relatively significant.
(4) Uniform design, procedures, and setpoints from plant to plant
permit efficient feedback of design solutions to minimize
recurrence of operational difficulties.
(5) Generic reliability studies, FMEA or WASH-l400 analyses can be
effectively conducted since applicability is to a class of
plants whose population is relatively significant.
(6) Operator and maintenance training can be conducted using
uniform procedures and accurate simulation.
Thus, when investigating and assessing the lessons learned and the
corrective actions flowing from the NI accident, the potential
* for proper and disciplined application of standardization policies
should be recognized for minimizing similar type events in the
future and maximizing the ability to react quickly, effectively,
and decisively should unexpected serious events occur, having real
potential for public health and safety impacts.
PAGENO="0536"
532
Question 3. Should there be a standard design for control rooms and for
the layout of control room instrumentation and control panels?
ANSWER
We do not recorrrnend that there be a standard design for control rooms and
for the layout of control roc~ instrumentation and control panels. However,
to assure that control room operators get clear information on plant
status, we do reconinend that additional design criteria and requirements
be established for the design and qualification of control rooms, control
room instrumentation and control panels. The Lessons Learned Task Force
in the Office of Nuclear Reactor Regulation expects to define and recom-
mend a program for establishing such design criteria and requirements within
the next few months.
The need for additional design requirements stems not only from the lessons
learned at ThI-2, but also results from control room studies conducted
prior to the accident. The results of these studies as well as the lessons
learned from TMI-2 will be evaluated prior to establishing control room
design requirements. Additionally, the functional capabilities of the
state-of-the-art digital computer based displays will be assessed ir.
establishing requirements regarding information which should be conveyed
in an unambiguous way to the operator.
PAGENO="0537"
533
Question 4. Provide recommendations for using computers or microprocessors
to enhance the power plant operator's ability to recognize
abnormalities.,
ANSWER
Prior to formulating recommendations for computer-based diagnostic
aids, we will be assessing the design and qualification of several
prototype diagnostic aids currently under development. We plan to
define a program for the evaluation of these systems, the establishment
of design criteria and reconinendations for computer systems within the
next few months.
The advantages of a computer based diagnostic system are that it can
monitor and evaluate the status of many components and systems much
faster than the human operator. Potential disadvantages of such systems
are that the plant operator can be mislead if error exist in the stored
programs within the computer. Thus, the computer software must be highly
reliable if safety benefits are to be achieved.
Our program to evaluate the use of computers for status monitoring and
diagnostics will include the assessment of three on-going projects. In
response to Regulatory Guide 1.47, "Bypassed and Inoperable Status
Indication For Nuclear Power PLant Safety Systems" the Tennessee Valley
Authority (TVA) has developed a computer based monitoring system. This
system uses television monitor-type displays to provide flow diagrams
to show the status of main line safety system components. The use of
computer technology makes it possible to provide a great deal of data on
concise displays to the plant operator. The operator is warned of an
abnormal condition by safety system status lights, abnormal indications
on the TV monitor diagrams, and by alarm messages on the computer print-
out. This design is being modified to also monitor those safety systems
that are required to operate i~miediately after an accident.
Another type of system that we will study is a computer based disturbance
analysis system developed by EPRIand Combustion Engineering, Inc. A
prototype of this system has been developed and will be evaluated with the
TMI-2 accident scenario later this year. The Nuclear Regulatory Commission
has been invited to observe these tests. We plan to observe these tests
and to utilize our observations in formulating recomendations for computer
based diagnostic systems.
The ORNL Instrument and Controls group, currently performing noise diagnos-
tic research for NRC, has developed a minicomputer based on-line system
for monitoring signals from nuclear plants to provide advanced warning of
anomalous conditions. The system is currently being tested at the High Flux
Isotope Reactor at ORNL. Some 14 signal channels at HFIR, including power
range neutron channels, pressure, loop flows and loop inlet and outlet
temperature are being monitored and recorded. We will also study and
evaluate this system prior to formulating our reconinendations for Computer
based diagnostic systems.
Question 5. Should the control room operators be employed by the utility
or should they be employed by some other agency?
ANSWER
Although this suggestion will undoubtedly receive continued attention
by NRC and others, we currently believe the control room operators should
continue to be employed by the utilities. We have no clear reason ~o
conclude that health and safety of the public would be better ser'ad
if the operators were employed by some agency of government. Itis highly
unlikely that a utility would accept the delegation of responsibility
for operation of a billion dollar investment to individuals outside of
their control. There is no precedent for such an action and we see no
reason to establish one in the case of nuclear power.
PAGENO="0538"
534
QUESTION 6 What is the radiation background level of the Susquehanna
River water? Provide data for average and maximum readings
at several different distances both upstream and downstream
from the Three Mile Island power plant.
ANSWER
The following two paragraphs `Care taken from the licensee's Environmental
Report, operating license state (1975), for Unit 2. They describe the radia-
tion background levels in the surface water prior to the operation of TMI-2.
"Gross beta activities in Susquehanna River water for the preoperational
period averaged 16 pCi/l (Met-Ed), 4.7 pCi/l (Teledyne Isotopes [Tele-
dyne]), and 6.7 pCi/l DER. For the same time period, EPA measured3.l
pCi/l (Average of Conowingo samples). Gamma spectroscopy by Teledyne
of water samples showed large variations in the naturally occurring
L~OK (from <12 to 500 pCi/l). These water analyses indicated low levels
(<9 pCi/l) of nuclear weapons debris such as 60Co, 58Co, 1311, and 137Cs.
"Tritium levels in Susquehanna River water are well documented, by the
U.S. Department of the Interior Tritium Laboratory (Wyerman, 1970), by
EPA (Radiation Health Data 1970-74) and others (Porter, 1973). These
tritium levels (primarily due to weapons fallout) peaked in 1965, dropped
to ~7OO pCi/l In 1968 and have continued to drop to the present 1974
level of ~300 pCi/l. The Met-Ed January-February 1974 tritium data is
too high by an order of magnitude as compared to EPA, Teledyne, Radia-
tion Management Corporation (RMC) and DER."
The data collected subsequent to initiation of criticality do not indicate
any significant changes in surface water radioactivity from gamma emitting
nuclides. For example, during 1977 surface water was sampled at six locations,
two upstream and four downstream of the plant, for gamma emitting isotopes;
specifically, K-40, Zr/Nb-95, and Ra-226. None of the 72 samples that were
analyzed were equal to or above the minimum detectable level for those iso-
topes indicating that the concentrations at all sampling locations were less
than 7 pCi/l for K-40, 0.5 pCi/l for Zr/Nb-95, and 0.9 pCi/l for Ra-226.
Some increases in tritium downstream of the plant for the 1977 year were
detected but are within fluctuations observed in the past. The following
table lists the data for 1977:
Concentrations of H-3 in Surface Water - l977-pCi/l
Jan-Mar Apr-Jun Jul-Sep Oct-Dec Average
2.3 mi. upstream <200 196 160 100 164
8.7 mi. upstream <200 <200 140 230 193
Upstream average <200 196 150 165 178
0.5 mi. downstream <200 230 600 430 365
1.5 mi. downstream 270 268 720 350 402
4.1 mi. downstream <200 188 100 130 155
15 mi. downstream <200 222 170 190 196
Downstream average 218 227 398 275 ~28O
PAGENO="0539"
535
The figure depicts the average H-3 concentration for the last few years. The
dashed line depicts the average of the downstream locations and the solid line
depicts the average of the upstream locations. While the above data suggest
that the downstream values for 1977 are statistically higher than the upstream
ones, t~e figure indicates that they are within the range of background fluctua-
tion observed over the previous few years.
Special samples were taken for Sr-89 and Sr-90 at the following three water
treatment facilities: (1) Steelton Municipal Water Works, 8.7 ml. upstream;
(2) Brunner Island Water Treatment Facility, 4.1 mi. downstream; and (3)
Columbia Water Treatment Plant, 15 mi. downstream. All analyses resulted in
Sr-90 concentrations below the minimum level of detection of 0.2-0.6 pCi/l,
whereas the Sr-89 concentrations were all below 1.0 pCi/l. The following
table gives the quarterly results for each location.
Concentrations of Sr-89 and Sr-90 in Untreated Drinking Water
pCi/i
Sr-89 Sr-90
Steelton, 8.7 mi. upstream <0.7 <0.5
<1.1 <0.4
<3.0 0.6 + 0.5
<1.2 0.4+0.2
Brunner, 4.1 ml. downstream <0.7 <0.5
<1.3 <0.4
<1.3 <0.4
1.1 ±1.0 <0.2
Columbia, 15 ml. downstream <0.8 <0.6
<1.3 0.3+0.3
<2.8 0.29 4- 0.003
<1.7 0.3*0.2
Comparison of the upstream concentrations to the downstream concentrations
Indicate that the downstream concentrations are not significantly greater
than those upstream.
PAGENO="0540"
10
7100*1 1
AVEMEE T*ITIIII COOCINTOATI001 IN
001guE0009A RIVER IN ThE RICINITO or mios
1!174- 1977
4- CHINESE NUCLEAR -~-
DETONATION
1974 1971 1974 1977
~-1.
rP
0I
TO
CD
eF ~7R
o CAD
CD
~1
0
C
CD
10
1+
0
*------` INDICATOR
* `CONTROL
1000
900
101-9
INITIAL CRITICALITY
PAGENO="0541"
537
QUESTION 7 We understand that there is a proposal to deposit or pump
back water that had been irradiated during the Three Mile
Island accident into the Susquehanna. What will be the
radiation level of this waste water?
ANSWER
On May 25, 1979 the Nuclear Regulatory Commission issued an orde which
stated that, except for t~ discharge of waste water decontaminated by
existing EPICOR I system I.') and the discharge of industrial waste water
as consistent with the facility operating license, there would be no discharge
of radioactively contaminated waste water from Three Mile Island (TMI) Unit 2
until the completion of an environmental assessment by the NRC staff of pro-
posals to decontaminate and discharge this water.
This waste water, generated as a result of the March 28 accident at TMI
Unit 2, consists of intermediate radioactivity level waste currently present
in the TMI Unit 2 auxiliary building tanks and high radioactivity level waste
in the THI Unit 2 containment building and primary system. There are cur-
rently proposals to decontaminate this intermediate level waste water in a
newly installed system, EPICOR II, at TMI Unit 2 with potential eventual
discharge of the treated waste to the Susquehanna River. However, as part
of the May 25, 1979 order, the Commission directed that there would be no
decontamination or discharge of this waste prior to the completion of an
environmental assessment by the NRC staff of the proposed actions. This
assessment is divided into several portions. The first portion of the
assessment will deal with the proposed decontamination of the intermediate
level waste water in the auxiliary building using the EPICOR-Il system at
TMI. The assessment will include discussions of potential risks to the
public health and safety, including occupational exposures and the risk of
accidental releases, discussions of principal radionuclides to be treated
by the EPICOR-Il system and a discussion of alternatives to the EPICOR-Il
system. The second portion of the assessment will deal with any proposed
discharges from the EPICOR-Il system to the Susquehanna River. This portion
will include a discussion of principal radionuclides which have been treated
and which would be released and a discussion of alternatives to discharge
into the Susquehanna River. The decontamination and disposal of the high-
level waste water will be the subject of a subsequent assessment.
Therefore, with the exceptions noted above, there is at the present time,
no discharge to the~ Susquehanna River of radioactively contaminated water
generated as a result of the TMI Unit 2 accident. Furthermore, there will
not be any discharge unless and until the completion of the environmental
assessment noted above demonstrates discharges are acceptable. Discharges
will only be found to be acceptable if the release of radionuclides in the
discharge are within NRC effluent criteria.
(1) Primarily pre-accident waste water from Unit 1 which has been partially
contaminated by water from Unit 2, with an activity level of less than
1 microcurje per ml prior to treatment and with an activity level approxi-
mately 10' microcuries per ml in the discharge canal after treatment.
(2) Waste water slightly contaminated (approximately lO~ microcuries per ml)
due to leakage from secondary plant service support systems. The dis-
charge of this industrial waste water is necessary to maintain TMI Unit 2
in a safe condition.
PAGENO="0542"
538
QUESTION 8 Provide a list of the ground locations at which radiation
monitoring equipment was installed and the locations at which
measurements were made during the Three Mile Island accident.
Provide the following reference data:
(a) The source of your information.
(b) The Agency responsible for the equipment.
(c' The time and date at which measurements were made.
(d) The "end use of the data.
ANSWER
Attached is a table listing the sampling locations and types of samples
required by the TMI-2 operating license technical specifications. This
program was in place at the start of the accident (`~ 4:00 a.m., March 28,
1979) and provided data for the duration of the accident. Metropolitan
Edison or one of its subcontractors was responsible for data collection,
analyses, and reporting. The measurements were used to determine the extent
of any contamination, the persistance of the contamination, and the impact
on the public from the releases. -
Also attached is a copy of the report, `Population Dose and Health Impact ~
of the Accident at the Three Mile Island Nuclear Station." On pages l7-29,
data regarding exposure of thermoluminescent dosimeters to the released noble
gases are listed. These data were used to estimate population dose and
health impacts as described in the text of the report.
The Environmental Protection Agency was assigned the responsibility to
collect and analyze the environmental data in the vicinity of the TMI site.
There is most likely more data in the EPA file than in the NRC file.
PAGENO="0543"
539
Attachment 1 to Answer to Question 8
Sampling Locations for Radiological Environmental Monitoring
Program In Place At Time of TMI-2 Accident
Location
c2!!ip!ss Sector
N
N
E
SSE
NW
N
SE
E
NNE
N
NNE
E
SSE
WSW
SE
NW
SSE
NW
SE
Distance From
Plant in Miles
0.4
2.6
0.4
2.3
15.
1.0
1.6
1.0
11.
2.6
0.7
0.4
2~3
1.6
15.
15.
2.8
8.7
15.
Iyp~e of Sample
Air Samples
Air Samples
Air Samples
Air Samples
Air Samples
Milk Samples
Milk Samples
Milk Samples
Milk Samples
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
TLD (Radiation Dosimeters)
Susquehanna River Water
Susquehanna River Water
Susquehanna River Water
Sampling locations and types are taken from the Three Mile Island Unit 2
Environmental Technical Specifications.
PAGENO="0544"
540
__________ Provide a complete list of the radiation measurements made by
helicopter survey. The list should include the following:
(a) The altitude, position, speed, time and date at which
measurements were made.
~b) Wind velocity, air pressure and relative humidity at the
time of each measurement.
(c) The agency which made the measurements.
(d) The final use of the measurements.
ANSWER -
The tables attached list the helicopter measurements made offsite and onsite
during March 30, 1979, through April 12, 1979. The tables give time, date,
location, altitude, and reading for each measurement. The following tables
list meteorological measurements of station pressure, wind direction, wind
speed, temperature, and dew point temperature made at Harrisburg weather
station during the period of the helicopter flights. From the latter two
measurements the percent relative humidity can be calculated. The set of
maps following this table indicate how this information was used to predict
the movement and location of the plume.
PAGENO="0545"
541
Attachment 2 to Answer to Question 8
NUREG-0558
POPULATION DOSE AND HEALTH IMPACT OF
THE ACCIDENT AT THE THREE MILE ISLAND
NUCLEAR STATION
Preliminary Estimates Prepared by the
Ad Hoc Interagency Dose Assessment Group
U. S. Nuclear Regulatory Commission
48-721 0 - 79 - 35
PAGENO="0546"
542
Table 3~1. METROPOLITAN EDISON TLD STATION LOCATIONS
STATION LOCATION DESCRIPTION*
CODE
1S2** 0.4 miles N of site at N Weather Statfón:~.
1C1 2.6 miles N of site at Middletown Substation
2S2 0.7 miles NNE of site on light pole in middle of North Bridge
4S2** 0.3 miles ENE of site on top of dike, East Fence
4A1. 0.5 miles ENE of site on Laurel Rd., Met. Ed. pole #668-OL
4G1~ 10 miles ENE of site at Lawn - Met. Ed. Pole #J1813
5S2'~ 0.2 miles E of site on top of dike, East Fence
5A1*~~ 0.4 miles E of site on north side of Observation Center Building
7F1~ 9 miles SE of site at Drager Farm off Engle's Tollgate Road
7G1 15 miles SE of site at Columbia Water Treatment Plant
8C1** 2.3 miles SSE of site
9S2 0.4 miles S of site at South Beach of Three Mile Island
901 13 miles S of site in Met. Ed. York Load Dispatch Station
~0B1 1.1 miles SSW ofsite on south beach of Shelley Island
US1~ 0.1 miles SW of site on dike west of Mechanical Draft Towers
1281 1.6 miles WSWof site adjacent to:Flshing Creek
1453. 0.4 miles WNW of site at Shelley Island picnic area
15G1~ 15 miles NW of site at West Fairview Substation
16S1~ 0.2 miles MNW of site at gate in fence on west side of Three Mile Island
16A1 0.4 miles NNW of site on Kohr Island
*
All distances measured from a point midway between the Reactor Buildings of
Units One and Two. All 20 stations had Teledyne-Isotopes Environmental TLD's.
**
Stations with RNC TLD' s. Data obtained with RMC TLD' s at these locations
are designated by adding the letter "Q" as a suffl~x to the station code.
PAGENO="0547"
Location of Metropolitan Edison Dosimetry
Sites Within a One-Mile Radius of Three
Mile Island Nuclear Station for Period
March 28 through April 6, 1979.
PAGENO="0548"
/~
I
I
WNW
w
%AISW
Ei~ure 3-2. Location of Metropolitan
Edison Dosimetry Sites Within
a Five-Mile Radius for the
Period March 28 through
April 6, 1979.
V
CJ~
S
PAGENO="0549"
0*
IJORTU
WSW \ \r"
Figure 3-3. Location of Metropolitan
Edison Dosimetry Sites
Outside of a Five-Mile
Radius for the period
March 28 through April 6, ~g79.
5W'\/~.
C;'
a
C;'
by
S
PAGENO="0550"
0)
a) a) a) a) C C) 0) 0)
N N N N- 0 N N N
4)
in U) U) U) >, in if) >, 0- U)
10 S-.. 4) ~. ~- 4) 0
~ `0 40 *v- 0.
* - 0 0- V 40 C %- V
a-a v o-a i CIU V ~ V ~C> `V ~ *.-C V
S-I 40 40 CW LU ~ 40 40 40(l) 40400 40 40 <10 40
1- V U~ cU) 00 `OVv-IV 40 04-) v-v-0~ V 40 V~
0. V C 0 ~ 0 40 11) V 9- 4) 40 ~ -D 40 0 C V ~ 40 ~ Si) (0 ~ V 0 > >, 0)1. 0) 0)V
5-4 40~40 00. 4-).C (0 00) .C+'vlIUD)U 4040 `- i-s 40 OI000L.0-S-WW1-S-40
..~ Q %s 4' w 400-1 0.~-.- U 40 4) sO S-.' ~ -~ .C > `-` 0 V 4) -v- 4.) 4- .-~4- 1. 4- ~ .04- i ~
0-) 4.) CU)0 (0 v- ZCv--Wv-->~ v-V4)4)I0 0)v-CWC>C0 OVWW.040v-.0.0
In .-W'-- 0v-- U4.Cv- 0) ~40 W~~~v--lU>1U4-4U 0~W.0.0U))0.4fltflv-
LU O.-0 4)40C .C$-u)0 -0-.-IO0~0.0E00 O~-OEU)0U)E4flv-C.~1fl.v-v-0
0 ODO 9-400 4-)WCO 0-v-~P.lO.COC40EE.~0WD)V-C40C4-'V0V404-v-4- .C(-1.0
U) C D C v- 40.4- 1. >, ~ -C 0 0) ~ *v- 0. D).C v- C 4-C C -v- 0 0) 40 Q U) 4-'- .C C ~ ~ 1. ~ 0) 0- 1.. .C
Z 0.4-U `-DC 04000 C~4WWv-C-v-U40C1U400U0E040v-'v-400U0CWW(0Wv-'0(0U
0 ~
`-4
I-
9
`5
~ ~ ~ ~ ~ ~ ~ ~ ~
z LU ~ZZWWZ IflWWWIflL1)U) U)V)~
In ZZZZZZZZZ~ZZZZLULUWWW~~
40 000000000000000000000000000 00 000000000000000000
(0000 a) v-I 0(00(') U) 0) N ~ N rIO ~ ~ ON LOU) i-I C'.) 00) mOO v-I ~ 0 C') U) U) C'.) N m 00'.) 0'.) U) NO (00'.) (0 U)
U) U) ~ U) 0'.) r4 v-I ~ ~ U) 0)0) a) v-I U) ~ C') U) (OW to N NOD (0)00 C.) C.) if) ~ to N N (DO a) v-I Ov-I ~ U)
mm mm v-I v-I v-I v-I v-I v-I v-I v-I v-I v-I v-Sv-I 0'.) (`4 C'.) C.) (`4 C'.) C'.) C'..) C'.) C'.) U) c-j mm mm U)
LU 40 0 40 40 40 40 40 40 10 10 10 10 40 40 10 40 40 40 E 40 40 10 40 10 40 40 E 10 10 10 10 E E 40 40 40 4040 10 40 E 10 E 40 10 40 40
`U) U)
~ (00 U) 0 rI ~ m to 0000 v-I to N U) ~ 0) ON (0000 ~ m C') U) U) 00 C'..) (0 (1) ~ m ~ U) 0~ 0) ~ (0 ~ C) (0 U) N. U)
C'..) C'-.) mm ~ U) N a) v-,~ tO 0 m N ~ ~ N v-I v-I C') mm U) 0) C.) C') COO v-I ~- v-I C-I in N C'-) N U) a) C') C') U)
I- 40 OW's- -IC'JU)m~ 10~U)v-4C'JU) so -Ic.)m~d- 0 v-4U)C'J~tfl.QV
v-4 v-I v-I i-I i-IC") U) ,~ U) I 5 $ 4 v-I U) m ~ C'4I 4 55 5 5 v-I ,-I C'.) C') 4' 4 4 i 4 C') U) ,-4 U) ~ if)) 4 4 5 4 v-I v-I
I- SI S S\4 III ILIJLUUJUJLUI I SI )LUUJLULULULUI III ~ 1411 ~ ~S S
In Z Z Z Z Z ~ ~ Z Z ~ Z Z Z LU Li.) LU W LU (1) U) U) U) U) U) (F) (F) (F) U) U) 4/) (F) (1)1/) ~
PAGENO="0551"
`I
01
a
wsw
Figure
S
PAGENO="0552"
~1~
0*
PJORTR
w
C,'
a
S
PAGENO="0553"
549
Table 3-3. METROPOLITAN EDISON TLD DATA RADIATION EXPOSURES
FOR PERIODS ENDING 04/06/79
Station~1~ Exposure Period
12/27/78 03/29/79 03/31/79 04/03/79
-03/29/79 -03/31/79 -04/03/79 -04/06/79
mR ± std. deviation per exposure period (includes background)
1C1 20.1±1.3 3.2±0.7 1.4±0.4 0.5±0.1
7F]. 24.1±1.8 1.1±0.1 0.5±0.5 0.9±0.1
7F1Q 23.3±0.5 0.8±0.2 1.5±0.2 0.9±0.0
15G1. 18.4±2.0 1.9±0.3 -0.7±0.1 0.5±0.0
15G1Q 17.6±0.6 1.1±0.1 0.8*0.1 0.7±0.2
1281 16.3±0.9 9.4±1.6 0.2±0.3 1.2±0.2
9G1 21.3±1.4 1.4±0.1,3~ 0.1±0.2 0.6±0.1
5A1 18.6±1.0 8.3±2.8~ ` 7.7±2.5 3.0±1.2
5A1Q 16.1±1.3 5.4±1.0 5.2±0.9 2.0±0.6
4A1 20.2±1.3 34.3±8.6 41.4±8.5 2.2±0.4
2S2 43.7±4.4 32.5±5.6 3.4±0.6 0.9±0.2
1S2 97.9±1.9 20.0±3.4 -0.1±0.1 0.6±0.1
1S2Q 95.7±5.0 15.3±3.2 1.3±0.1 0.8±0.1
16S1 1044.2±128.2 83.7*17.5 7.0±0.7 1.5*0.3
1651Q 929.4±90.5 61.6±12.2 5.6±1.0 1.3±0.5
11S1 216.0±24.1 107.1±12.7 45.0±15.2 21.8±7.3
11S1Q 168.5±15.6 75.7±12.7 35.2±3.3 14.2±1.1
9S2 25.0±3.0 25.3±2.6 4.6*1.0 1.8±0.3
4S2 35.5±4.3 124.3±32.7 28.0±9.1 7.9±2.3
4S2Q 31.4±1.6 71.4±13.0 21.3±6.6 4.7±0.4
552 30.5*1.3 49.3±U.2 26.7±5.3 15.5±5.0
5S2Q 27.7±4.0 36.6±0.8 21.2±3.1 11.5±2.4
4G1 17.2±2.1 1.2±0.2 0.6±0.2 0.6±0.1
4G1Q 17.7±0.1 0.6±0.1 1.4±0.1 0.1±0.1
8C1 13.0±0.3 10. 7±1.6 1. 7±1.1 1. 3±0.4
8C1Q 12.6*0.6 8.4±1.0 2.6±0.2 1.1±0.1
7G1 25.8±0.6 , ~ 1.0±0.1 -0.5±0.0 0.8±0.0
15A1 907.7±49.4)~ 45.1±2.1 1.7±1.1 0.9±0.1
453.4±12.2) ~
14S1 13L2±20.~~~ 48.8±8.6 9.5±4.3 1.5±0.4
148.3±9.7~ ~
1081 40.6±3.5~2~ 14.9±0.9 0.4±0.3 1.1±0.2
36.6*1.3 /
(1) Suffix "Q' indicates RMC data; otherwise data are from Teledyne Isotopes.
(2) Results for 6-month exposure period 09/27/78-03/29/79.
(3) AdditIonal values for 5A1: 7.8±1.5, 7.4±1.2.
PAGENO="0554"
Tab1e 3-4. NRC lID DATA-RADIATION EXPOSURES FOR PERIODS
FROM 03/31/79 to 04/07/79 (inc'udes background)
3/31-4/1 4/1-4/2
mR mR
4/2-4/3 413-4/4 4/4-4/5 4/5-4/6 4/6-4/7
mR mR inK inR mR
Station
N-i
N-2
N-3
1.0 ±
(wet)
1.2 ±
.1
.3
.3
.3
.3
.37 ± .08
.45 ± .05
.43 ± .05
.32 ± .08
.40 ± .06
.32 ± .08
.28 ± .08
.33 ± .08
.34 ± .09
.32 ± .04
.48 ± .15
.47 ± .05
.43 ±
.40 ±
.50 ±
.05
.05
.11
N-4
1.0 ±
.1
.3
.48 ± .08
.33 ± .05
.37 ± .05
.42 ± .02
.48±
.10
N-S
(wet)
.3
.58 ± .08
.37 ± .05
.35 ± .05
.48 ± .10
.52 ,±
.08
NE-i
7.0±
2.1
.2
.45 ± .08
.32± .04.
.45 ± .05
.38. ± .04
.45 *
~O8
NE-2
(wet)
.3
.48 ± .09
.37 ± .10
.33 ± .08
.47 ± .10
.47 ±
~i2
NE-3
1.6 ±
.5
.3
.42 ± .09
.38 ± .08
.37 ± .08
.46 ± .05
.45 ±
.10
NE-4
2.ix.~
.3
.37±.05
.38±.04
.33±.05
.40±.09
.43±..05
E-1
25.0±8.1
.4
.53±.1
.32±.04
2.6±.60
.50±.09
.48±.08
E-5(E-la)
8.4 ±
4.6
.3
.73 ± .2
.38 ± .08
1.7 ± .45
1.2 ± .27
.32 ±
.04
E2
.E-3
E-4
4.3 ±
2.1 ±
2.5 ±
.5
.4
.4
.3
.4
.3
55 ± .7
.42 ± .1
.4 ± .1
.55 ± .10
.40 ± .06
.35 ± .14
.38 1 .08
.50 1 .06
.43± .19
.45 1 .10
.48 1 .08
.42 t .04
.35.±
.32 1
.22 ±
.08
.08
.04
SE-i
10.1 ±
2.0
.3
9.1 ± 1.6
.43 ± .10
.92 1 .19
~40 ± .00
.55 1
.06
SE-2
3.5 ±
.5
.3
4.4 ± .7
.87 ± .16
.38 ± .08
.35 1 .05
.25 ±
.05
PAGENO="0555"
Table 3-4. (Continued)
3/31-4/1
4/1-4/2
4/2-4/3
4/3-4/4
4/4-4/5
4/5-4/6
4/6-4/7
aR
aR
mR
mR
iaR
mR
mR
Station
.
SE-3
23±6
3
28±7
57±10
45±05
40±06
25±
05
SE-4
3.0±.4
.3
2.1±.4
.30±.06
.53±.08
.47±.08,
.25±.05
SE~5
2.5 ±
.7
.3
.13
± .1
.42 ±
.04
.37 ±
.08
.62 ±
.31
.38
± .13
S-I
16±1
4
22±4
11±05
37±05
35±05
40±
00
S-2
.
1.0 ±
.2
.4
1.5
± .2
.52 ±
.08
.32 ±
.10
.35 ±
.05
.43
± .08
S-3
*
1.2±.3
.4
*
1.5±.3
.47±.05
.40±.06
.40±.06*
.55±.10
S-4
1.2±.2
.3
1.4±.2
.33±.05
.45±.10
.55±.18
.42±.08
SW-i
.9±.i
.8
1.2±.3
1.1±.18
~37±.08
.37±.i0
.45±05
SW-2
9±2
5
13±3
37±
12
30±09
43±08
38±08
SW-3
1.1 ±
.3
.4
.78
± .1
.65 ±
.10
.45 ±
.10
.38 ±
.08
.42
± .02
SW-4
.9±.1
.5
.75±.1
.62±.10
.45±.14
.50±.14
.50±.09
W-i
3.0 ±
1.9
1.2
1.4
± .24
1.7 ±
.35
1.3 ±
.29
.57 ±
.10
.48
± .08
W-2
.9 ±
.1
.5
1.
± .1
.62 ±
.04
.72 ±
.04
.37 ±
.08
.38
± .08
W-3
1.1±.1
.5
.78±.2
1.i±.15
.42±.08
.38±.08
.47±.08
W-4
1.0±.2
.4
.67±.1
.42±.10
.45±.14
.45±.05
.57±.08
W-5
1.2 ±
.2
.6
.4
± .15
.65 ±
.12
.60.±
.13
.40 ±
.06
.57
± .14
PAGENO="0556"
Table 3-4. (Continued)
3/31-4/1
4/1-4/2
4/2-4/3
4/3-4/4
4/4-4/5
mR
mR
mR
mR
aiR
4/5-4/6 4/6-4/7
aiR aiR
Station
NW-i
NW-2
NW-3
NW-4
NW-S
S-la
SE-4a
W-3a
NE-3a
N-ia
N-lb
N-ic
N-id
N-le
N-if
.9±.2
1.7
l.3±.25
*.30±.06
.38±.08
1.2 t
.5
.4
.62 ± .08
.40 ± .15.
.33 ± .05
l.4±.7
.8
.63±.12
.40±.25
.38±.04
5.5 ±
1.8
.3
.4 ± .06
.30 ± .06
.37 ± .08
4.6±2.
.4
.42±.04
.42±.21
.32±.04
Not in Service
untIl
4/5/79
ss ii
U
SI
IS
II II SI II II
SI SI SI II II
II U IS II IS
U Ii is is is
is is ii is u
IS ii Si is ii
is U ii U
ii 55 55 iS
.52 ± 12
.35 ± .05
.40 ± .09
.32 ± .04
.48 ± .08
.35 ± .05
.33 ± .05
.65 ± .39
.38 ± .08
.50 ± .19
.40 ± .06
.40 ± .09
.35 ± .05
.40 ± .06
.47 ± .15
.53 ± .04
.38 ± .08
.42 ± .05
.45 ± .10
.45±.05 ~
.43±
.25 ± .05
.45 ± .10
.57 ± .08
.47 ± .04
P.50 ± .06
.45 i .08
.50 ± .06
.44 ± .08
~37 ± .08
ii
PAGENO="0557"
* ~. >
8') Ui
* * I-' < ~
0 -8
0-4 ".` 8+01 118111$
N) ~ I-I 1-4 I-I -41-4 P-I I-I 1-4 I-I I-I I-I I-i P-I - I-I -`. I-I P-I P-I (-4 P-I Cf -8
Ui Q 03 000000000000000 (`I 00000 -i P-I
(00$ O~- (0 IllIllIll I $11 I I ØI 1111$ 0 0
m i-' p-' ~ ~ ui -~ ~-` ~-` ~ (0(0 ui ~ r~ i-' ~ -~ i-' 10-01.1 z -~
~ flN)Oai>>4UiC)UiUiUUI 0 310)0-n 0$
01 ID ~0. $-4(0~0)>nnN)N)N)N)N) `i 3~I0)3.4$.3$.J r ~
~1 0' 3-33.3$~l 3-13-43-1 3-3 0 0 -`
-`0 011 ** (`3 - ID
`< lAO. 01* 0 01
-`(A A (*3
10$ CID 0$ -`.
0$-~90 1+
0 1+ -`. ~ ~ (*3 3-' N) .~ ~ 0) N) Ui ~ (4 Ui Ui 0) 0 Ui
0 0 -` -
o 0Cf 0 Ui - 40 (~) N)
-s -`- (0 ~ $o I~I Ui (000101.01 1-' 00) Ui (~30)0 Os 0 - I-' 01(9 Ui I I
Cf 0 Ui 0 `.4 `.4 (~3000 `.4 `.4 `.4000 `.4 `.4 (A CD (*300 `.4 N) Cf (*3 X
14 1+141+141+ 1000 m
~ 1-Ill ~ ~ 00000 I I
Ui
- 3 3 (*3 - `.4 `.1 ~ -4 ~
ID ~1 0 `-4 N) 0 N) 0 I-' N) N) 8-' N) I-' N) I-' N) I-' 1-' -.4 3-~ $-~ (~3 I-' CO `.1 ID r 0
ID -` PD * 0 0'..jO `.4 `.40 `-4 (*3008,4 (*40(9 (*3 0(40 `--8 UI 0 `0
10.01.01 C 0
ID ~-`< -1>
0 (0
C 3-- (0 0i0)I.0'-.~0)Ui0000Os'.4 -`0)10(01-' 0 0 ~ -I
$0 ~ (ON) `-3- 0- - - 3-4 01 (4 P-I fl3
< (*3 0$ 0$ -010) 0$ Ui - - - Ui Ui 000(9 - `.4 0$ (31 - I I C 00
~< Dl N) (90(~3(~3 `.4 -1-01 N) 0(9 `-40 `.18*3.4 0$ (*3 `.4(9(0 N) Cf N) 0 Z 3-4
* C 8+148+8+8+ 0)0(0 -`- Ui
00000000 00000 I I p+ m 0
0$ 0$ `.4 `.4 IA )(Z
IA IA 0 N) 19(9(41-' I-' `.4 0$ 0$ (48*3(9 N) I-~ 0$ Ui 0$ Ui -018*3 00 0) `0
0$ (*30 `.4 `.4 `.18*3 (*10) `.1 `-3 `.4 -4 (400 0 08')
Ui 0 . -Ip 0)0
-i CX
3 ~ 01
~
0 ~ ~ ~-<
0 Dl Ui 0$ 0$ Os Ui 0$ Ui 01 Ui Os Ui 0$ (31 Ui .01 Ui -1 Ui 0) Ui `.1 0 0 Cf > --
(A -` (0 0) DI -4
Ui $-`0 Ui 3.3 Ui 0(0.1 Ui Ui 3.~0I-' `.10 1-' Ui 0 `.48*3 I I 0 CA
3-~ 0) (4(448*3'.1(*3(9'.J0-.308*3'.4(4(4 (*3'.40..10 (*3CfN) 0. Ui-I
I-' 1+ 1+1+
(13 1 N) 8+8+8+8+8+ 0000 DI CA
00000 I I I I
~ 0$ -1 `-i 0. CA
~ 0 (4N)3-3N)N)N)0$4N)N)3-40$p.~(*3$.4 0)N)N)3.40$ 0) (0 1.10
Dl 0 0 O'.t0(9'.400(4'.10'.10W(4(4 (4(40(4(4 3 w-(
0 -~ 0 ".JX
0. Cf 0 0)CA
0$ Cf
1-' 0.
0$ ~`. 0)
Ui Di I-' 0
(0 Ui p.01 0111 ~(:015~~ 1
$-~ N) (*33.3 0)3-' 0) alaS Ui N) (aN) (~3 N) 01(010 Ui I I `0
(4 (*30 (*3(90 0'.JO(9(9O `.3 0(9 `.400 N) Cf (*3 CA
B ~ ~*~*~~1fI+1+ `.100 Ui
-S
0 I I
ID - . `.- `.-l 0
01 I-' N) 3-1 N) (-3 N) l-* (93-' I-' N) N) N) I-' Ui I-' (MN) 0) 0) 0
0) -`40 (90'.4 0 `.4(40 `.400 00(9(40 Ui
$0
Cf X
01 CA
0 -8
0. CA
Dl
-i 0$ 0$ Ui Ui Ui Ui (00)0)0) 0$ (7' Ui 0$ Ui 8~1 a~asaCo us
0. 0 - -
`-4 Ui (00(9(7' Ui `.4Ui I-' 1-' (9 Ui `.40) N) `.4(4(4
Ui (~1(00 N) 0)00
$3'.40)(0N)
3-411 11-'8,3P-'(,38*31-'N)
00
N) Ui Ui 0)0001- ` - (~3(0 Ui (~3C0 0$ N) (~3 05 (00)
as 0$ N) 00)0) N) N) (*3 0$ 0)0)0)0 N) N) 0$ N) 0$
PAGENO="0558"
(1) "liDs stolen."
(2) "No sample received."
(3) Standard month = 30.4 days; originally reported as "mrem/standard month" assuming 1 mrem 1 mR.
(4) Originally reported, erroneously, as value for Station "11S2".
Table 36. METROPOLITAN EDISON COMPANY: RADIATION MANAGEMENT CORPORATION DOSIHETERS
110 RADIATION EXPOSuRE RATES 1978
Results In Units of mR/standard month
12-30~77
3~29~78
6~28~78
9~27~78
STATION
to
to
to
to
AVERAGE
NUMBER
3-29-78
6~28-78
9-28-78
12-27-78
±
2a
Control Locations
TM-IDM-7F1Q
6.15±0.73
7.60±0.67
7.79±0.29
8. 04±0. 45
TM-IDM-4G1Q
TM-IDM-15G1Q
4.94±0.52
4.70±0.40
5.95±0.38
5.61±0.38
5.68±0.46.
5.65~±O.45
6.37±0.77
6.47±0.50
Indicator locations
TM-IDM-1S2Q
5.71±0.34
5.32±0.31
5.31±0.42
5.82±0.27
TM-IDM-4S2Q
4.91±0.44
5.69±0.24
5.55±0.51
5.05±0.43
TH-IDtl-5S2Q
TM-IDM-11S1Q
4.32±0.21
5.35±0.45
5.15±0.56
9.72±0.88
5.47±O.32,A~
6.75±O.52'~"
5.44±0.44
6.09±0.23
TM-IDM-16S1Q
3.93±0.27
12.09±1.31
6.68±0.75
6.02±0.61
TM-IDM-5A1Q
4.57±0.16
5.18±0.38
4.88±0.28
5.60±0.17
TM-IDM-8C1Q
(1)
4.07±0.16
(2)
4.35±0.31
TM-IDM-4A1Q
4.56±0.60
(2)
(2)
(2)
TM-IDM-8S1Q
(2)
(2)
4.04±0.21
*(2)
Average ± 2o
4.91±1.33
6.64±4.96
5.78±2.11
5.93±1.96
~J1
7.40±1.70
5.74±1.20
5.61±1.45
5.54±0.53
5.30±0.76
S. 1O±LO7
6.98±1.92
7.18±6.95
5.06±0. 88
4.21±0.40
4.56
4.04
PAGENO="0559"
555
B. OFFSITE POPULATION COLLECTIVE DOSE ESTIMATE
1. Introduction
The collective dose for the population within 50 miles of the plant
was calculated for the time period of March 28 to April 7, using two independent
procedures. The first procedure utilized the empirical distribution of TLD
dose data within each direction sector. Doses at distances between those
locations with measured values were estimated by Interpolation. A power law
method-was used to extrapolate when necessary. The second procedure utilized
onsite meteorological data in-conjunction with the TLD readings to estimate
the distribution of dose within a 50-mile-radius of the facility. The distribu-
tionof dose and population were then used to obtain the-collective dose.
The population data used for the dose estimates were the 1980 projected
offsite population distribution as presented in the Final Safety Analysis Report
These population distributions are contained In Tables 3-7 and 38
covering radii of 0-10 miles and 10-50 miles respectively.
2. - Dosimeter Background Correction
The TLD exposure data reported In Tables 3-3 and 3-4 include a back-
ground due to terrestrial radiation, cosmic radiation and other sources unrelated
- to plant releases. In order to estimate the net exposure dye to plant emission,
this- background must be subtracted from the total TLD exposure. The background
`~~FInal Safety Analysis Report, Three Mile Island Nuclear Station, Unit 2, Vol-i,
Chapter 2, FIgures 2.1-5 and 2.1-10.
PAGENO="0560"
Attachment 1 to Answer to Question 9
ON-SITE DATA
Date: 3/30/79
Time (EST) Location Instrument Reading Remarks
0240-0250 Grid S - 900' Met. Edison Co. <0.1 mR/hr gamma
Helicopter
Grid SW - 800' " <0.1 mR/hr gamma
Grid NW - 800' " <0.1 mR/hr gamma
0241 Grid NE - `900' " 0.4 mR/hr gamma
Grid E - 900' II 3.0 mR/hr gamma
c.11
Grid E - 800' " 1.5 mR/hr gamma
* 0243 Grid NE - 900' " 4.0 mR/hr gamma
0257 Grid ENE - 700' " 20 mR/hr gamma ¼ mile from Unit 1
Cooling Tower
Grid ENE - 700' " 15 mR/hr gamma between Cooling Tower
and stack
0258 Grid ENE - 650' 50 mR/hr gamma between Cooling Tower
and stack
Grid~1E - 650' " 60 mR/hr gamma
0300-0330 reflight of above locations All readings less
at 650' and 1400' than 1 mR/hr
PAGENO="0561"
ON-SITE DATA
Date: 3/30/79
fl~JEST Location Instrument Readj~ Remarks
1000 Over Reactor Bldg. at 600' Met. Edison Helicopter 1200 mR/hr
-&s--l--3 mR/lw-
1058 Over Island at 500' " 130 mR/hr
1100 East side of Island at 700' " 0.8 mR/hr
c,1
North Bridge at 700' O.,~ mR/hr
NW side of Island at 700' " 0.7 mR/hr
Warehouse south of Auxiliary Bldg " 2 mR/hr
at700'
1135 SW quadrant of plant at 600' " 80-90 mR/hr Ground level reading
was 1-3 mR/hr
1700 Goldsboro " 6 mR/hr Offslte data;
Ground level reading
was 1 mR/hr
PAGENO="0562"
ON-SITE DATA
Date: 3/30/79
Time (ESTI Location Instrument Reading Remarks
1223 North Parking Lot at 500' Helicopter 4.7 mR/hr Note: all helicopter
readings are beta-gamma
1223 " " " at 150' " 5.7 mR/hr
1227 Over Screen House at 450' ` 11 mR/hr
1230 " " " at 500' " 10-15 mR/hr
1231 " " " at 450' ` 50 mR/hr
1232 ` " " at 450' " 30 mR/hr
C.'l
1234 MCDT at 450' " 40-75 mR/hr
1236 Over Reactor Bldg. at 500' " 50-70 mR/hr
1309 Over MCDT at 600' ` * 5-10 mR/hr
1315 West of MCDT at 600' " 45-60 mR/hr
1309 Over BWST at 500' ` 55 mR/hr
1312 Over BWST to MCWT at 600' 20-75 mR/hr
131a Over pre-treatment at 650' 90 mR/ hr
1:319 " " " at 500' 30 mR/hr
1321 " " at 400' 20 mR/hr
PAGENO="0563"
Date: 3/30/ 79
Readj~ Remarks
1355 10-55 mR/hr
1358 10 mR/hr
1415 " 0.5 mR/hr
1415 " 100 mR/hr
1415 ` 150 mR/hr
1530 " 5-35 mR/hr
1705 " 18.0 mR/hr
ON-SITE DATA
Location Instrument
Over Unit 1 Cooling Tower North Helicopter
at 500'
½ mile north of site at 550'
Over south cooling tower at 550'
Over RB at 500'
Over RB warehouse at 520'
Westside of Island at 620'
Over Screen House at 600'
c)1
Data pt.
illegible on report
received at Hdqtrs;
may be 180 mR/hr
PAGENO="0564"
ON-SITE DATA
Date: 3°30-79 ARMS
TIME L0C~]IOtj Reading (mR/hr)
2105 south Unit 2, MDCI, 550 ft. up. 10
2105 south Unit 2, turbine bldg, 550 ft up 10
2105 south reactor bldg., 550'ft up 15
2105 north of Unit 2 reactor bldg., 550 ft up 100
2105 Unit 1 screen house, 550 ft up 10
2105 Unit 2 screen house, 550 ft up 20
2105 north Unit 1 MDCT, 550 ft. up 130
2105 south Unit 1, MDCI, 550 ft. up 100
2105 between reactor bldg., 550 ft up 20
2105 north Unit 1, reactor bldg, 550 ft. up 10
2100 west Shelley Island, 700 ft. up 0.1
2120 Crawford Station 25 ~ .25 ~
2130 Omstead Plaza 0.5 py
?30() Unit 2 turbine west, 500 ft. up <0.1
2300 Unit 2 MDCI, 500 ft. up 5
2300 west of warehouse, 500 ft. up 18
230(1 west of north tip of island, 500 ft. up 9
2320 Unit 2 reactor bldg., 550 ft up 35
2324 Unit 2 reactor bldg., 550 ft. up 65
PAGENO="0565"
ON-SITE DATA
03-31-79 License Heliocopter Data (700 ft altitude)
TIME LOCATION READING (MRIHR)
0225 Unit 2 Rx Bldg 3
Unit 2 Turbine 0.5
Unite 1 Rx Bldg 3
PAGENO="0566"
ON-SITE DATA R137
Date: 3-31-79 Helicopter readings at 600 feet
Time (~fl Location Reading (mR/hr)
C)1
1200 West Side of. Island 01 - 0.25
A Cooling Tower 12
N Parking Lot 2
B Cooling Tower 10
1300 East Cooling Tower 4.0 - 5.0
PAGENO="0567"
563
0 (`4
V
.CI.
`-I
EJ 0
(`4
(`4
0
0 44
0
< U) LI) C') LI) LI) LI) IC) C')
LU,<. I
~ COO ~O C-S 0300 00 ~O 0000 (`5 U) 0 (`4-0 (`40 (`4 (`4 U) (`S C') C')
V V C~4 V V
0)
C
- -
<10 E 000
1-01 0 000 C')
0 NN- C-I
0
5- 41~1~)
LUG) I- (0(01(0
- 0
0- 5-
(/1 0 00 ~3 - C) 0) 010
U - LO 0 C 0 ,~3 ~3
O 0 ~O 0 030 C C C)
0 4-' LI 4.00)010) -
0) ~O 10 ~4 C.) LI U +3 0
= - 01 C'S 4)44 10 0 1-
O 4-' 1- C01CCC C)
O (0 C.) 0) ~) 01 0 0 0 0 0- -
- - 0 0 .I (0 0 C) 43 ~
0 0 - C C 0+343+3 ~ (0 - 0 ~
~) 0 In 0 0 CC ~ .- (0 (001+3 0 00)
(0W 5- W - 0 (`4 1003> >> (0 5- -.- 0 C
0) 0- W I 1- - 01 4~) 4- 1- 1-41 (0- 0) +3 01
<+3 ~ 4.3 00 ~ 00 > 0 C 5- 0) 0) 01 3) 0) 0 (0- - 01
100 (0 W 0+3 +300 C 0 0 `U) In U) .0 C C') 04) 00-
I- W 0- 4.~ U 10 .0 (0LI +I.0.0.0 ~ 5-fl- 0) (0 COO 0 43
5- 01'..' 01+) 0 U) 10 (0 U 00 0 3) 0)01 4- 00)0)0 01
LI 0 0 (5 +3 < 0 (0 0) ~) UI C'S (0 0, ~ 0 0 +3 05-.- 03 .0
O'-CO'- (0 WLU~ (001,-li 019-14-9- ~- 00 (0 C+)+3+3
CO I CO < F- +1 ~ 0 0 0 .~ CO I- LI UI .- (010 (0+1 0)
`-4 $ <5-) +3 0 (`S `- `I- 010+~ (0 0
1-F- 0)5- I 0 (0 C 0) U) 09- (`4+3 +3+30 1- C)- ~- 0) (5 U) 1-)-
0 LI C LI 5- (0k) C 0 U) U) U) 0 0 C I 0 1. 01.0 LI C.) 0) -1
I +30 0 LI .)C .- -.- C U) 0 ~ (0 (001 LI) +3 -.- 0< ~ 00+)
Z U~.0~O'-CInC01InC41 0)010) U- S. InZ~1041
O 4~I (0 1- Z I (0~4 ~.0 0 LU 109- (4_ 01 0'4- ,-~) (~ .0
( .-0J,-J ~CO LI).. (000101010010001(010>.-.- .01
5- C ~ I $~ 03 U .0 LU .-.- ~ LI 5- 0) )~ I I .0
I 3-41 0 >41 0+3 ~ *,. ., ~.3 4.3 .~ w .C ~ ~ +3 (0
LI C'S ~0U) 010 1-01InEEEu)('5~-inEC('so S-S..
O . I LU I ~ 01 LU.0 0) LU 0 (0 (0 I I ((0 01..- C') LU LU 0.I.I
-.4 Z~LUOLULU~LU,~(IC~C,J2ZU)
0)
N.
5-i
C') (1)5
LUl
C')
LU LU 0 0 ~U)0U)U)N.0O0OLI)OO._LC)0LflW
I- X C') C-S ~(5~LI)OO0O,-C')C')(5-10-U)U)U)Lfl000
LI) 10 0303030)0)0)0)0)0)0)0)0'0i0)0)0)000
0 5- . C'JC'JC'S
PAGENO="0568"
564
Licensee On-Site Data
~- ~--~
Date: 4/1/79 Helicopter Data R194
Time - Location Reading (MR/HR)
Beta Gamma Gamma
1543 800 ft. up, unit two Rx bldg. 3
800 ft. up, utility bldg. 9
800 ft. up, security bldg. 15
800 ft. up, couzit between
security and site fence 5
800 ft. up, site fence 3
700 ft. up, 2 mi. south 0.1
2012 500 ft. up, unit 1 warehouse <0.1
500 ft. up, unit 1 screen-
house fO.5
500 ft. up, unit 2 screen-
house 2.0
500 ft. up, unit 2 collector
tanks 4.0
500 ftJ up, south of unit 2, tanks 0.5
500 ft. up, west of unit 2 tanks <0.1
500 ft. up, all other perimeters <0.1
2023 600 ft. up, unit 1 warehouse 0.5
600 ft. -up, unit 2 screenhouse 5.0
600 ft. up, unit 2 collector
tanks 4.0
2023 600 ft. up, unit 2 collector
tanks 1.7
0.3
600 ft. up, south gate
PAGENO="0569"
565
Licensee On-Site Data
Date: 4/2/79 Helicopter Data R194
Time Location Reading (MR/FIR)
Beta Gamma Gamma
0317 600 ft. up, north gate <0.1
700 ft. up, from north gate
to unit 2 cooling tower 0.2
8.3
0.4
0.9
1.5
0345 700 ft. up, vent, cooling tower 2
700 ft. up, unit 2 Rx bldg. 0.5
*700 ft. up, unit 2 cooling tower 1.3
6346 700 ft. up, over TMI 3
700 ft. up, north gate <1
700 ft. up, west above 0.6
PAGENO="0570"
566
Licensee Helicopter On Site Data R-200
`1-~~' 7? __________
Readings (mr/un
Time Location Beta Gamma Gamma
1148 North End of Island @ 500 feet 1.5 mr/hr
1230 North End of Island @ 500 feet 0.4 mr/hr
1310 Unit 2 Screen House @ 450 feet 5 mr/hr
1315 Unit 2 Screen House @ 450 feet 1.5 mr/hr
1317 Unit 2 Screen House @-450 feet 4.5 mr/hr
1330 Unit 2 Screen House @ 450 feet 20 mr/hr
1335 Unit 2 Screen House @ 450 feet 14 mr/hr
1340 Unit 2 Screen House @ 450 feet 3 mr/hr
1345 Unit 2 Screen House @ 450 feet 5 mr/hr
1352 Unit 2 Screen House @ 450 feet 2 mr/hr
1400 Unit 2 Screen House @ 450 feet 2 mr/hr
1405 Unit 2 Screen House @ 450 feet 1 mr/hr
1420 Unit 2 Screen House @ 450 feet 12 mr/hr
1445 Parking Lot @ 500 feet <.1 mr/hr
PAGENO="0571"
Date: 3/30/79
OFF~
~-SITE DATA
Th!~JEST)
Location
Instrument
Re~g
Remarks
1000
½ mi.
SW at
300
ARMS
.
Highest reading in
450 mR/hr. at 600'
plume
1030
½ ml.
ESE at
300'
ARMS
2 mR/hr.
1045-1145
1045-1145
1045-1145
¼ mi.
¼ ml.
½ mi.
radius
radius
radius
at 300'
at 500'
at 500'
ARMS
ARMS
ARMS
20-30 mR/hr.
8 mR/hr.
1 mR/hr.
Peak in West Quadrqpt
Peak in West Quadrq~t
Peak in SSE sector
1045-1145
1 mi.
radius
at 500'
ARMS
0.5-1.0 mR/hr.
Peak in SW to NNE
1045-1145
1 mi.
radius
at 1500'
ARMS
0.1-0.15 mR/hr.
1045-1145
3 ml.
radius
at 600'
ARMS
0.5-1.0 mR/hr.
Peak in SE
PAGENO="0572"
oF~
SN-SITE DATA
Date: 3/30/ 79
Time (EST) Location Instrument Reading Remarks
1230 Over Siqelley Island NW at 550' Helicopter 20 mR/hr. Note: All helicopter readings
beta-gamma
1315 East of Island at 600' " 2 mR/hr.
1324 Shelley Island W at ? " 10-20 mR/hr.
1326 Over Shelley Island at 620' " 16 mR/hr.
1328 Over Hill Island at 700' " 7 mR/hr.
1331 Over Hill Island at 850' ` 7.5 mR/hr.
1332 Over Hill Island at 1100' " 2.3 mR/hr.
1333 Over Hill Island at 950' " 10 mR/hr.
1333 Over Hill Island at 750' 6 mR/hr.
1334 Over Goldboro at 700 1.5 mR/hr.
1335 Over North Bridge at 720' " < 1 mR/hr.
1335 ObservatIon Center at 720' 1.5 mR/hr.
1340 Over Hill Island at ? " 1-12 mR/hr.
PAGENO="0573"
2
Time (EST) Location Instrument Reading Remarks
1400 Northeas4. Hill Island at 550' Helicopter 2-5 mR/hr.
1405 1½ mi. north of Island at 550 " 2 mR/hr.
Iqoç I~Jor~P~ 0F S+ ~ ~
1410 Over Sunset Go1~ Course at 600' 3 mR/hr.
1410 Over Hill Island at 600' " 5-12 mR/hr.
1410 Over Hill Island(golng from L4Je44o 5-50 mR/hr.
~- ~+ ~ro')
1655 One mile west of Island at 600' 4 mR/hr.
1655 One mile northwest of Island at 600' " 1.5 mR/hr.
1655 One mile northwest of Island at 600' 1.2 mR/hr.
1655 One mile northwest of Island at 600' 0.1 mR/hr.
1655 One mile east of Island at 600 " 0.1 mR/hr.
1713 3/4 mi. west of Island at 500' 20 mR/hr.
1713 West bank at 500' 2 mR/hr.
1714 Over Golsboro at 600' " 2 mR/hr.
1715 One-half `~`west at 500' " 65 mR/hr.
1715 3/4 ml. west at 500' " 20 mR/hr.
PAGENO="0574"
Off-Site Data
3-30-79
ARMS I~,o() t,
Helicopter flight with hand held instruments between 4:00 to 6:00 p.m. today. General pattern- circled at 1/2 and 1 mile
radius from plant at an altitude of 300 to 1000 feet. Then radials were flown in highest dose rate directions.
Wind speed is slight, wind direction is approximately 115 degrees.
Highest reading is approximately 8-10 mr/hr over site.
Plant reading in plume is approximately 6-8 mr/hr over Hill Island just north of the site. Elevation of maximum
reading at 300-400 feet; top at 800 feet.
Plume disappeared after 5-6 miles.
Plume appeared to follow the river.
PAGENO="0575"
-~
OFF-SITE DATA
3-30-79
ARMS - FLIGHT WITH HAND HELD INSTRUMENT BETWEEN 2120 AND 2225 HR
1. Flew circle @ 1 mi radius @ 500 and 1000 ft alt. max. reading on 1 mile was 0.5 mR/hr @ 500 ft.
2. At 3 mi out, at 330°, performed altitude spiral from 1500 to 300 ft. Top of cloud at 1000 ft; max at 500 ft, decreased down
to 300 ft where they had to pull up.
3. Tracked on radial at 330 heading; 500 ft. altitude found levels of 100-200 pR/hr all the way out to 18 mi- where had to break
off because of a ridge.
4. @ 5 mi out; made 1/2 circle across above radial; plume cut about 30-40 sector.
5. Wind @ 500 ft from 150° @ 10 knots, @ 1000 ft from 200~ 8 20-30 knots.
6. Tlpton said that they will attempt to standardize survey in above format.
7. Tentative schedule is one flight about every 3 hours around the clock for next 12 hours or so.
.iJ~j..
PAGENO="0576"
OFF-SITE DATA
3-31-79 MET ED HELICOPTER
TIME LOCATION READING
0012 Grid N <0.1
3 mi N TMI
ALT 600 ft
0013 Grid NE 0
1 ml N TMI
600 ft
0017 Grid NNE . 0.5
Turnpike
1100 ft
0045 Grid Direction Plume 0.5
550 60° 9°
Turnpike to Hershey
800 ft
PAGENO="0577"
OFF-SITE DATA
3/31/79 ARMS FLIGHT TIME 0015-0115
1. Flew at 1 mile radius at 500-1000 ft alt max reading was 1 mR/hr
2. Angular extent and direction 20° wide 010°
3. Wind Condition from 240° speed 10 knots
4. Radial 100 at 500 ft followed the plume to 18 miles
5. Alt spiral at 6 miles from the plant 1500 -300 ft profile. Top of plume 800 ft. Max reading at 300 ft (1.50 iit~/hr)
6, Next flight at 0300.
PAGENO="0578"
OFF-SITE DATA
3-31-79 ARMS FLIGHT TIME 0300-0400
1. Flew at 1 mile radius at 500 ft alt max reading 1.5 mR/hr In the NE sector.
2. Flew at 1 mile radium at1000 ft alt observed 0.5-0.7 mR/hr at the NE.sector
3. Radius from 550 at 500 ft alt observed 1.5 mR/hr near the plant. This decreased to 100-200 pR/hr at 14 miles from the
plant, and tO 50 pR/hr at 18 miles from the plant.
4. Spiral flight at 3 miles from the plant at NE sector (1500-200 ft). Top of the plume was at 600 ft reading 1 mR/hr.
5. Wind direction 180° at 3 knots (25-30 knots at 800-1100 ft).
PAGENO="0579"
OFF-SITE DATA
Date: 3-31-79
ARMS Flight Data for 0600-0715 hrs:
At 1 mile radius circled site at 500.
Peak readings obtained NE of site were 2-2.5 mR/hr. with a reading of 0.7 mR/hr. at 1000'.
Other readings showed less than 1 mR/hr out to 7 miles, 0.5 - 1 mR/hr to 10 miles, and from 10 miles out to 30 miles
levels were 0.1-0.2 mR/hr.
The plume was 1-1/2 - 2 miles wide the full distance. The max. width was 2 miles at 20 miles out at 500'. A sharp
distinction of plume top was noted at 600-700' from 5-30 miles out.
At 27 miles out on a heading of 060°, plume top was at 600' and extended all the wasy to ground.
Next flight scheduled for 0900 hrs.
PAGENO="0580"
ofoo /z'/'5
OFF-SITE DATA
3/31/79 ~m 0
Tin~é(9:OO - 10:15 am~~-
ARM?~Jãff~collected 3/31/70 0600 - 0715
Still good
- ARAC Projection are in good agreement with,j~plume. Source term ? will be attempted
- Winds to remain light and variable. This afternoon winds will _______ S-SW, 5-10 knots
PAGENO="0581"
Date: 3/31/79 0FF-SITE DATA
131c
ARMS overflight report for 3/31/79, 1200 to ~5 hours:
Essentially no change from earlier two overflights.
Plume direction is from 030° to 060°.
Maximum readings observed (beta-gamma):
1.5 mR/hr at 1 mile at 500'
1.5 mR/hr at 3 miles at 300'
At 3 miles plume top observed at 2,800'.
Plume is on the ground at 3 miles.
No iodine observed; xenons are the only activity.
PAGENO="0582"
OFF-SITE DATA R137
Date: 3-31-79 Helicopter readings at 600 feet
C)1
Time (EST) Location Reading (mR/hr)
1300 G~i.ge.r Church 0.1
Rte. 230 2
Rte. 283 < 0.2
Turnpike < 0.1
PAGENO="0583"
OFF-SITE DATA
Date 3/31/79
ARMS Flight data for 1430-1640 hrs:
At one mile radius of 500, maximum level was 3mR/hr at i100_1400
(readings with ~M instrument)
In an altitude spiral at 3 miles, top of plume was at 1700' with a maximum
level of lmR/hr at 500'.
Could not fly any lower than 500' because of weather.
Due to high variability of winds, plume shifted to south of, plant so above.
measurements no longer hold.
Raining hard with wind squall situation.
Next ARMS flight scheduled for 1800 hours.
PAGENO="0584"
DATE 3-31-79 OFFSITE DATA R144a-k
Helicopter Readings
TIME (EST) LOCATION READING (mR/hr)
1533 Geye/s Church Rt 232 Observation Center at 600 0.1
1555 Black swamp, high spot South of Island l.3
(R. Fruit) to Black swamp to substation
1932 East Side Hill Island <0.1
1934 Shelley Island <0.1
1936 Hill Shelley Island at'900' <0.1
2005 Middletown Junct. at 800' 3
2008 1 mile 060 degrees (ENE) at 1000' 4.5
PAGENO="0585"
OFF-SITE DATA
Date: 3-31-79
ARMS Flight Data for 1843-1945 hrs:
Plume extends generally E to ESE
One-mile radius flight at 500' showed max of 2 mR/hr at the above direction.
At 3 miles out the reading increased to 3 mR/hr at 500' with top of plume at 1000'.
At 8 miles out at 500' the level was 1 mR/hr.
Wind speed was 4 knots/hr.
The ARMS group thought that there was a "puff" at about 1800 hrs based on the higher reading at 3 miles;
the higher reading may have been due to return of a "pocket" considering the light and variable winds.
PAGENO="0586"
Note:
Measurements Made
With GMSM Not yet
standardized with an
ionization chamber
1. At 1 mile
At 3 mile
At 10 miles
At 15 miles
2. Altitude spirals
At 3 miles
At 15 miles
750 feet top of plume
850 feet top of plume
Data 3/31/79
Time
Between 2100 and 2140
(Air Force Helicopter)
Offsite Helicopter Data
Location
Measured extent and Plume Width
at 500 feet
B-22
Reading (MR/hr)
Max. 0.8 at 045-075 degrees
Max. 1 at 070 - 090 degrees
Max. 0.15 at 070 - 080 degrees
Max. 0.15 at 070 - 075 degrees
Wind speed 3-5 k~vfj shifting slowly.
next flights 0000 hrs, 0300 hrs, 0600 hrs, 0700 hrs.
Reported by John Tifton Arn~s
3/31/79
2300 hour
PAGENO="0587"
OFF-SITE,~HELICOPTER DATA R148
+J'O~iriE ON-~[/T
Date: 3-31-79, 4-1-79
Time Location Reading (mRj~
Beta-Gama Gamma
800-FOOT LEVEL
2045 Unit 1 `A' MDCI 0.3
2045 SE 2 mi. out 0.2 CO
2050 0.5 mi. E TMI 1.4
2053 North Gate 0.01
2053 Unit 1 "A" NDCT 0.05
2055 E Unit 2 NDCT 6.0
PAGENO="0588"
OFF-SITE HELICOPTER DATA (Continued) R148
Date: 3-31-79, 4-1-79
Time Location Reading (mR/hr)
Beta-Gama Gamma
700-FOOT LEVEL
2320 Unit 2 Turbine Building 20
2334 Middle Substation 10
2325 0.5 ml. E Observation Center 15
0.25 ml. E Observation Center 25
N of Observation Center 0.5
Going S from Observation Center 20
Going S from Observation Center 19
Going S from Observation Center 10
500 K~"Substation
(0.5 mi. from Observation Center) 0
PAGENO="0589"
OFF-SITE HELICOPTER DATA (Continued) R148
Date: 3-31-79, 4-1-79 -
Time Location Reading (mR/hr)
Beta-Gama Gamma
700-FOOT LEVEL (Continued)
2340 0.5 mi. E of Observation Center 20
(4-1-79)
C.'l
0000 N-S, 0.5 mi. W of Radio Tower 1.5 - 0.2
0005 Middletown Junction N-S £0.1
0010 S of TMI Unit 2 to 500 KV
Station (800 feet) 5
0015 0.25 ml. S of TMI and 500
Station (800 feet up) 1
PAGENO="0590"
OFF-SITE DATA B-23
Date: 4-1-79
ARMS Flight Data for 0030-0100 hours:.
1. Flew 1-mile circle at 500 feet altitude Cl'
Plume width and direction 850_1200
1 mR/hr maximum
2. Few 3-mile circle with a maximum of 0.05 mR/hr
3. lop of plume was at 600 feet
Flight terminated - fog
PAGENO="0591"
OFF-SITE HELICOPTER DATA 8-24
Date: 4-1-79 ARMS FLIGHT - 0145 hours to 0230 hours
1. Flew at 1 mile circle at 500 feet altitude
Plume direction east from the plant
Maximum 1 mR/hr
C.'l
2. At 2 miles at 500 feet altitude
Maximum was 1.0-1.2 mR/hr
3. At 4 miles at 600 feet altitude - 50-100 pR/hr
Plume from the plant due east
4. Winds are light and variable
INFORMATION PROVIDED BY Tom McGuire 0300 hours
PAGENO="0592"
OFF-SITE HELICOPTER DATA
Date: 4-1-79
Time Location Reading (mR/h~
0223 ¼ mi. E of Op Center 15
½ ml. E of Op Center 14
Over River E of _______ 11
Final pass 14 mm. circle 4
PAGENO="0593"
589
-I
(%4 ~
u,.~1
~
U)
* U) . ~
(~ C~J (~J ~ ~ U) tO (~J C~4
a)
o a-
a)
4.) 4.3
(a
a)
U)> > > U
0)0) ~ a) U) ~ Q 0 ~ C
*0 ~ 04.' Q 00 0
0),- = > U) U) to 1-43
00 ~ 4.) a) C..) (a 4.) 4.3 4.)
(a U 4.) 4.) 4.) LU> (a (a (a 4.3
.0 X )C 4.) 0 U) U) U) U- 4.) 4..' 4.) U)
~~U~OCa (a (a ~Wiflu)u)(a
a) .0 0 10) a) a) a) ~J- U) .0.0.0 a)
(a C~4 C~J c~j ~ .,.. (a.0 ~
4.) U)4.34.3a) a) a) 0U)inU)
(a `.0+34-) (aU- ~- -
0 ~ .~ .,~ 435>>>
~.U-WE a) a)
5- ~ a) 0>
a) ~ U) a) C~J U) 0000
4.' 4-4-9-4-0.0 ~- . 000
0. 0 0 0 0 U) 0 `- I I I * I U) tO) U)
0 a) c-.i
o C 4.34.) 4.' 4.) 5. 5- 0. 0. 0. 0.0.5.4-' 43
0 U)U)U)U)a)WC4~ ~ = a)U)U).-
>raca 0
a) 4.) WWa)a)00-4-3 4.' 4.' .`4.'0Wa)-*.-
~ (a a) a) a)~ a)a) 4)
U ii 1111W a) a) a)a)I III (a
a) 0 4- 4- 4- 9-4- 4.3
4.) -.3 0.0.0.0.0.0.0. 0.0.0.0. U)
U) 00000000
4.. 4.34.34.34.34.) 4.34) ~3 ~- .,- ~- ~3 43 4.) 4.3 4.3 U)
4- a)Wa)WWa)W 4.' ~3 4.) a)a)a)a)
0 a)wa)a)a)a)a)o(aO'aO(aOOa)a)ww>
4-9-4-4-4-9-4-434-) 4.) 434.34.) 434.34-4-4-4-
U) U) U)
00000000.00.00.00000000
0000 LU) U) 00 0 0 0 U) LU) 0000
LU) LU) U) N tO tO N N LI) N U) N U) N tO to 03 N N U)
0~)
N
U)
0
a) a) 00)0000 tOO 0 N 03
4.' a) ,-- 0 `-~--~ C'.J C4 C~1 C~4 C~J Cl)
(a *,- C') (a `4. `4. `4 .4. `4 `4. `4
O 1- 00000000 0 0 000
48-721 0 - 79 - 38
PAGENO="0594"
OFF SITE HELICOPTER DATA
2 miles east of observation Center
over 500 Ky substation
3 miles east of Unit 1 Rx Bldg
5 miles east of Unit 1 Rx Bldg
Disk MILE3
Job B p. 15
R-152
Time
0431-0445
-0445
-0445
-0447
-0448
-0450
-0458
-0458
-0500
-0500
-0501
-0502
-0506
-0509
-0510
Location
700 feet up -
700 feet up -
700 feet up -
No altitude -
700 feet up -
700 feet up -
600 feet up -
600 feet up -
600 feet up -
600 feet up -
600 feet up -
700 feet up -
700 feet up -
600 feet up -
700 feet up -
Reading (mR/hr)
16
4
1.4
7
7.
25
10
2
18
8
5
6
7.5
4 miles east of 0EV Court
over 500 Ky substation
SECTUnIt2
East Unit 2 Rx Bldg
SE Unit 2
South Unit 2
East Unit 2
between Unit 2 Rx Bldg & 500 KV substation
East Unit 2 stack
over 500 KV substation
1 mile east 500 KV substation
PAGENO="0595"
4/1/79 Offsite Helicopter Data
Time Location Reading (Mr/hr)
0610 - 500 feet up and 120 degree 2 to 3
radial at 1/2 to 1 mile
C.'l
- lop of plume 800 feet clearly
defined
- at 3 miles out plume edge at 130
degrees and 170 degrees with poorly
defined edges.
Next flight 0900 or 15 minute notice (?) for gas sample
PAGENO="0596"
DATE: 4-1-79 OFF-SITE DATA R158
TIME (EST) LOCATION READING (mR/hr)
Beta-Gamma Gamma
0833 SE TMI at 700' 8 2
PAGENO="0597"
ON-SITE DATA R-159
DATE: 4/1/79
Helicopter Surveys (ARMS)
0900 hours
Plume between headings 140 degrees and 165 degrees. Winds 3200_3550
surface to 1000 ft. speed " 5 mph
C~TI
- At 500 feet altitude max 3 mr/hr 1 mile out
- Top of plume 1300 feet, maximum ~ at 200 feet was 0.5 mr/hr 3 miles out
- At 10 miles out, had 0.2 mr/hr
- Plume broadened at higher altitude and shifted slighly to the West
Report by Bob Shipman 4/1/79 1040
PAGENO="0598"
594
Licensee On-Site Data
Date: 4/1/79
Time Location Reading (MR/HR)
Beta Gamma Gamma
1256 600 ft. up, toward Bainbridge 0.2 0.1
800 ft. up, toward Bainbridge 0.3 0.1
1323 600 ft. up, ~1mouth 0.1 0.05
700 ft. up, Valmouth O?1 0.05
800 ft. up, 1~a1mouth 0.2
1410 700 ft. up, south end of
island 1.5 0.4
1420 800 ft. up, S end of island 6 1.5
PAGENO="0599"
Disk #MILE1
Job:
OFF-SITE DATA
ARMS Flight Data fro 1800-1900 hrs:
On a one mile radius flight around plant at 500', plume was at
500', plume was at 2200 to 2500 with a maximum reading of 0.5 mR/hr. CY~
On a three mile radius at 500', plume was at 2400 to 2600 with
maximum reading of 0.1 mR/hr. at 3 miles, top of plume observed at
600'.
All readings with hand-held GM.
Visibility dropping; not sure of time of next flight.
PAGENO="0600"
LICENSEE ON-SITE DATA
April 1, 1979 DOE ARMS FLIGHT - 2100 to 2115 HOURS
Condition: Rain and Fog
Plume from 2700 - 315°
At 500 Reading 0.5-0.75 MR/HR
Waiting for Better Flight Conditions
PAGENO="0601"
597
c'.j
S~l
El r4 ~l 4~
E~~~00 Joou~ * 00-40c-.j .0. *0
.0.0 `00.
~D 0.00 ~4 T1 000000 v4 C~j W V 0 U) ~J r-f V 0 ~ C'~J ,4 r~ r$ r-I V C~4 V V V
o~1
=1
~l r~
IE 0
OlrtS
CC~ r4
C)
U)
C)C)
0
0) -c
I- )- C
.0 USC)
0 0.0. r-4 C)C) 5- ~
)( WU)S. C) (~ 0C0
U.) 4-~+~O . ~ US~UC) ~ .- CS~C
I- C.-r-10 4.) ~0U)U) 0 LI)
.~ -C C 0 C) 1-4 0 .C 4) .- U)
VS 4.) 4.) ~- . . .C U) C'4 E C r-4 0 U) . U)
LL ~ S.- 0 0 ~- U ~ 0) 5- C .c 0) ~-4 ~-4
U.- 0 0 .~.- C C `- 5- C 0) 0 0 4.) C C) 4.) C) C 0 >~
0 U) C 5) >~ ~ C .~ 4- 5) ~) 5- ~ C 0 >~- >s
~ W.0C0C)S.-Cfl~ ~-
0~.0 .~S- S-U~~ OS) SS~I5,-C),-C)
U.) 0.'- .~.- 0.4-) C C) S. (5 X 0 U U) 5) C) 0 4) 4.) U) ,- C) .C 5)4.)
5- . . -~ .C C .~ ~ 5) S.- 5 ~ 4- C U) 4- E 4-) U) U (5 U) U) U) C 5/) C (5
0 0 4.) 4.) 5- -~ -~ 0. 0 C) C 00 (5 0) C) -.- U) 5/) ~
0 C C 5- 0. 0 ~- 0. v-S v-S (~4 C) S.. 0)0 r4 ~ S.- C)
.C C) ~ C S. c 0. U) C c C C) C 4- .C -~ S C C) C .C .C .C
(-4 - ~- 4.) 4) 4.) 4) 4.) C . 4) 4.) 4.) 4.) 4.) 4.) ~ 4.) 5) 5)4.) 4.) ,- .~.) 4) .5.) 4) 4) ~ 4.) 4)
LU C v-OC)~000~~OCCOOCC)O.CO.v-(5OC)OO.v-OO
= 0 U)U~CUC4)CCU)~.0C04)~~cC)CUU)CEU)
4)
(5 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0. 0.0.0.0.0.0.
U
0
_S 4)4.) 4) ~) ~) 4)4.) 4.) 4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4)4.)
4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4-4- 4-4-4-4-4-4-4-4-4-4-4-
00000000000000000000000000000000
0000000000 ~ ~ 0000000000000
a, a, N N N N N- N N- N Lr) U) U) U) U) U) VS U) VS U) U) U) U) 5/) N- N N N N- N N N
0)
N
5) 0) C'.) C') C') C?) U) 0
v-S E ~ C'.) C') C?) ~.
-~ 0 .- i-I ~
~ 5-. C'..) C'.) C'..) C'..) C'.) C~ C'..)
PAGENO="0602"
598
HELICOPTER OFF-SITE DATA B-33
4-2-79 Arms Flight 0300-0400 hr
1. At 1 mile. Plume WNW, 0.5 mile wide, max. 1.5 mR/hr.
2. The 1.5 mR/hr was observed most of the time.
3. Wind S & D 140° at 15 knots.
4. At 2 miles, max. 0.5 mR/hr, top of plume at 800 ft.
PAGENO="0603"
599
HELICOPTER OFF-SITE DATA B-34
4-2-79 Arms Flight 0600-0615 hours
1. Plume direction was NW from plant.
2. Maximum levels reading 1.0-1.5 mR/hr.
3. Wind S&D 1400 at 15 knots. Flight time was limited to 15 minutes
due to fog.
PAGENO="0604"
600
HELICOPTER OFF-SITE DATA
Date: 4/3/79
Datg for distance away from 1141 in the plume. As of 0800 the wind direction
was from 270°-325°.
Time Distance (Mi) Reading (mR/hr)
0900 0.25 1.7
1.0 0.8
3.0 0.5
5.0 0.4
6.5 0.3
1200 - 1.0 2.0
3.0 1.2
6.5 0.5
PAGENO="0605"
601
OFF SITE DATA B36
4-4-76 ARMS FLIGHT 0000-0100 hours
Ceiling at 800 H
1. Circle at 1 mile at 500 feet
Plume 2200 to 255°
Maximum rate 1.1 mR/hr
2. Circle at 3 miles
Plume 215° to 230°
Maximum rate 0.5 mR/hr
3. Circle at 6 miles
Plume 210° to 2300
Maximum rate 0.3 mR/hr
4. Over river 1/2 mile from plant
Plume 185° to 210°
Maximum rate 0.8 mR/hr
Next flight 0300
PAGENO="0606"
B-33
~1-SITE DATA
4/4/79: ARMS FLIGHT 0300 - 0330 hours
1. Circle at 1 Mile at 500 ft.
Plume at 2000 - 220°
Max rate 0.3 mr/hr
2. SE at 3 miles at 600-700 ft.
Max rate 0.1 - 0.2 mr/hr
Did not go cut further since they crossed a ridge at 3 miles and radiation levels dropped to 0.05 mr/hr and
plume was undefined.
PAGENO="0607"
603
4/4
ARMS
1520 - 1545 flight
Narrow plume @ 500' level
@ 1 mile "5 x bkgd (`~ .1 rn/rem)
@ 2 miles "3 x bkgd C" .06 rn/rem)
____ ~ to~
~LLWT with a few spikes @ 2900
plume is in sector 270-300°
PAGENO="0608"
604
Kotsch
Disk # MILE7
Job: H
4/5/79
HELICOPTER DATA
ARMS
Date: 4-5-79; received 1120 hrs.
ARMS flight at 0950 identified plume in sector 1250_1300.
Measurements: 1 mi. - .3 mR/hr
3 mi. - .05 mR/hr
10 mi. - .03 mR/hr
Radiation measurements made using a portable gamma scintillation survey
instrument.
PAGENO="0609"
605
BMurray 4-5-79
Ground Survey Results - 4/5/79 MILE7 JOB I
1. NRC Survey per Dan Montgomery (site) 4/5/79
Winds at 2500_3250
Location Radiation Levels*
West side of River <0.01 mR/hr
East side of River 0.01-0.15 mR/hr
2. ARMS Survey 1430 hrs 4/5/79
Plume at 1100_1200 at 300 feet
Distance (miles) Dose Rate
0.1 mR/hr
2 0.1 mR/hr
5 0.05 mR/hr
7 0.05 mR/hr
10 0.03 mR/hr
48-721 0 - 79 - 39
PAGENO="0610"
606
ARM Flight - 4/12/79 - 0938-1016
Reported by Geruskey - State of Pennsylvania
Distance Altitude Sector Dose Rate mR/hr
1 mile 700 ft. 3000 bkgd.
1 mile 500 ft. 3l5°~ .030
3 miles 700 ft. 270° .008
4.5 miles ? ? bkgd.
Reported 1400 - 4/12/79 Sly
PAGENO="0611"
607
PAGENO="0612"
SURFACE WEATHER OBSERVATIONS ~*Y*~A~*~ J, 1'~ Y* A7 ~ ~41
GMTLSTJ~J - 3 ~3~j9~'_ - - -
1/ ~
.e-J ~pI~1o~'a~
~
.1
kJco~b~
3~jI ~
i ~lj ~~O'1~
r,i /
Z4 24p*
2~JO~L
H O.~L
H ~ ~ ~
21 D~i/O'
I-'! ~
`4' /a~oc
/)~$~
1/ 3i~
A,'
1/ 17i/OL~.
7 1~P~J~4
~_,*1 ~i/~ii1
A - (( IiVC
~ ~
±
-
~Tj
~2O
( 7/ô ~ ~O f
1/13
/
/t
7 ~
it'p
."
~
/~
`t
:~
~
~j
, I'..
~
L~
d
~
~L
~
~
~
-i ~
3 //~
.~
a ~e
~
I ~
~/
~2j
/1~ z~ f~s
/./;z- 3c~7 Ic
7; - -
~..yj;y ~gg i
/,`,~,/3~3 n ii::
-~ -
fl~)J.L -
r,i.~. Ij7~ -
I
/1;'
~ I ~ ~1 - -4
- -
H.' - -
7.~ii --7
~
- `f-
~27 7,~ - - L
- - -
- -
7j0 - -
1 ` (" ~(/,
ii
t7~V
~
I
*~~/
.~j
ii~
~
0AL
Oil
2W
~L~I
~LJ,L
~j
(~L~
~,o
QLQ
C!~L
I ... . I .*. .~A .1 A'.~ ~ I ..:.. - UAAA~YOF WAY
I A~LA~KI WAY LAY L;YrPL LAAVY;;% PAPAYL~AA
PAGENO="0613"
~~ST G$T JT~ ~ 2 SU~FACE WEATHER OBSERVATIONS I
~MT_LST~ .sC~,) ~ c
-
//(O oL~'c:
-
;~_~ ~ (,IJC
/ ,~_ (f_dc
~
`~
(_ _/c.
7
,~1 1i0;
VW1~kk~IOO i~0i
`LoT
~o1i
07/
&,
~
Yc7
7t~;
~
~~ii1'E~
1~~
- -
I
S
(oc-
-
/ / S7 A~At 7 ( (` I'/(,oI
I - -, f:/f)jL__
~1 t~~' O"C_
10
"~2.
~(2
/(~
?
`
120 ~
/ ~ c.~ Sr 7~
L~L~ /::~ * 1- `~ i~o ()P'*~~
L~tI cos~ ~~r~ic
L~ /;~-~cDv~~
L~ 1- ~S1 IT j/rnj /~,() `~1~/ 1!~
2-
f~ (-*~~
-
`I
7 ~~`t7 ~43
--*17~
r/5 4.1//I 3o~OI~~~
H `~t~A~*
I, v
3
1 ~cl L31 I
JO 14) ~
i~ /.. ~S.' 0 ~
.2_
~
~!_
III
2~2-~
I-,;
,,,,,
/7/
~L5 (34) iSl'/I /1) -~ 4)
~-~s~,",VfI/)~)'/'
2~cc~T ~
~O I (/``O~/c
-
-~ j~~)O.~>JL~
~ 3o.c~r e~-~ ot'c-.
2~_~4
E~1
3D~co~7 e'e~~ c~'C.
i~
c~/'~O /~,v
2~
-
~) j~~?Jfl
-
~-
~
~7/4I S
"-
-
J~_~3/_)
-
~
-
,
-
1'~/~~T4
-
!/4~. ~
-
-
-
`I
p.
I)
`t) 7j.
~-
i~
3~3;7
~iii~i'~i7i~*-
- ~_
-~
~q
~
~_c~_____.
~`~O~//
f(~( L -
c~c~iL p.---
.Y7~_~
4~~j_
4~
-
-
- L
i~
t ~J i
dn~
OlD «=
- ___________
`1
~Ti~
-.
~iii~i~
/;,; ~z;
*1
1'
I ~
1 "2
,,,..`!tt!f,r!.rt~,._
PAGENO="0614"
H1~
~Li 0(1
I~kf~.oWi~o6 ~Q
_E~_1J~4~~JWV*. "it
U,
F:
E'~ F
7f3
I, U~' c'iih
,,~
/e~ LC_
,.G~T IT~ C~h~ SURFACE WEATHER OBSERVATIONS -*,,~$-,-
~MTLST_1 Ii I ~ - ` ~
-
51~ ~ I ~ 0 (2~J C~-
~t / ~ / / ~j
q
/t~
~
-:.` / fr, /`~,V
£_
ri'-
IF4
T /1 (t1(~
/ (( (tiC
tI
~- ~.1
L~.
UF4
-: / ~ -
-~ f (cj' (i/C
L
f~
~L - *I5/~ (~i~
(~
I 7~2r0J 72-_ !iøcL_ - I
(1) .~ I
a,, ~t (~.
(iy(
(I
1/
F~1
-:~ c~ i.~ ~
A ~
~/O c'r/C-
~Ji~
4~iL
`I ~4(j~
4/
A
(~rT7
19$]
J(' t'
I/~
T LI 7 çf 2~6~J 2~
9231
1 ~
I;',,
,~
0/4'
~__;-
/e'r~',
:~:
i!/~
/~
ft,..;
~P~5~i
J~o
o~#c~
~L ~
7
I
1531
-7
7; ~ ~/ /~/i&) / I I' ~) (I -
7~; ,J,~_y
-~
1q31
4L_)~tL
?L~L
-
~7
~v.si
"UT
- f~_
:2
*141 /~i_~~
~~VJT~
11. J~jI)/ //` 7
LT4L- ~;iii ~ IO~t~O ~
I
~,-~
5I~ "i
`I)
`I
I~1
STATION PUISURS COMPUTATIONS
:LLLI: :~: ~
~` ~LL_~
PAGENO="0615"
T C
IGMT_LST2II
SURFACE WEATHER OBSERVATIONS ~ ,`i:::::_~
-
L~
)~f~
~_~~_qi `AJ~5
5Ef~ /~j~
,~
/f~J~
~ i~-~
~~`t__1_'
"~"*
~SL `~c~c1
~c "~iC'~
~ 1 `0:01:
~_L~?! /Ott)~
O1~DI
4:i~_~ )o'o~
~ I
tp~
I -/ tc ~
ficT~
`P 71 j~bV
Fj~ it'd'-"
"~"i.
~ `~2~L
*~*~
Li'
- --
~,
-
L~~I t/O &t/C~
L~~oI ,ci~, I'4~
.2__~~
(~~3
,,,~
LL
~
~is
~
~
`_9~~~
~i~L~t
`~i
-. -
iQ~ o~c Vt' ?~ - - -
(s~~fv *`,14.
t~c~S~v 2I~- 7i4
~W~124- ~4o w -
~2~y~!24 ~3i~ - -
Ø~1ft/JYLV.4'O! 9L/ - -
~~i~'i)'c' - -
go~1&l.2'/i~
i~ø~vv~Y~. siz. -
hL~i~lL `~* L__~
I
.
.iT-t L
~(-~
T1[~
F
I -
PAGENO="0616"
F `3Vs,~A~i~ST
~I~L~LA19X
1A~
-
V~
r»=O
LI (~ 0 V C~ -~ -
I:~'~~
~?. ~.)
!i
Ti
, jer 2 rrs ~,<,,,, jj~ -
~1i _____________ -
Ii
~ I / II9~ii~LIi
? ~JAL
`21 lCn!
~*
/1
SURFACE WEATHER OBSERVATIONS /`-`-`-i'-~- ~~~-`--~ -
~
*
z ,~:; ~ ~L i~tA1'/~' 4c~~t~ d~f ~ ~
~`_/-~ /77~i$7~3~2~ ~ ~ ~`. A' oV~/ ~
~j_i- pj~,i~nc~/ ~ I' --
//1/
~ot w~
/
1)f-
iT ~TiFTE~'
es ~ ~7 ~ ~9O (WC~~
~21/ ~(I~ctN'/~,
3
- 4---~--h--' I
1~)
/*j t/t -
._
ig
1u~
/0 j~
cmi ~ L)/ ~
J,'leI'Vt/ /4's'
li
2o4
~/Th(r~. -,
3~ ,,- ~
~jç~~q;~
/0
0, t~
~LL
QE7
0'
1
(fl
i~ ~
I0
(-I
YI (~Lf~
CLI?
/. /i J~/~
T7
~L
/O L&
7J1
~T
L~!/~~ ~ /03
~
JiI~2~I)41~ ~
~r2/Vo~$1~
I/v
3 .Ai
~--
~-~-~--~
;, ?~
ImTospussuucoM;uT*.ToWs ,~, I' I UMAWKSWOTUANOMI:CELt.ANEOUSPHEHO~E$A
.- -
PAGENO="0617"
/1
~~ST G~T ~ SURFACE WEATHER OBSERVATIONS ___________________________________________
- MT_LST~ _______ _____________________ _______________________
I k if
~fL
~
(:,1Ct~ ~
(1,,e
i:
7
~~?i
~ I
~_*~f
,2ai~
T" $2.
4
-
~ 1_
~-
22~~_
- -
-~
7ç
ft
,~
~t)2~
-
I- ,
-
-
F~'t)
Z
~t
0~#'rn~PJfl k~ ~
.
~`
A £~ ~
C 4o ~ 1c0 o'c~.
£ Jo t~t/C~-
~ii
`J f//'~4- ic~.
liii
N ~ i~';s
`C: (
ET
(uIZfL(~
~«=`- RZC
Ti:
~?
!; I I
j~ .1
7
4~ ~
`I
M2 4/
vn
/~ ~
N2~ ,iye
`1
,~, ~rf.1/ ~.
J~4/i
t~,i~fflh,F ~
0/ti
I'r~ `-i~'A) 1(1 (iI~1(
,i'J'11'f~A1 /1 ()~/C'
/?_// H-V4~1//14~
`~`f~ /~~In'V~i
~ lI~)5//~d"/~
~
~-r L~it/~I3~?169II
S
42t~ OL/C.
f~-) V0
kc
(I
LL._L. A *` `C
(~I.
A~ r tá~k~1OY N
/
i2-I~ W~fJrt~
(// ~K
~ç~'3K,i `It;' CA1C~.
`I-,
~i,i ~1r~ ~
~iI
71~
Q94~
I
/ ~*C
- f I
iv) 7n~/C.
F
S
* ~ -
f;w! i2~
~ ~) I
~1ItC~C4~ d~~S~a0
~I/Oi7~ 177
.1 --
-cr
,t') ~J
PAGENO="0618"
r2'~
~
..~-
LST~1
SURFACE WEATHER OBSERVATIONS `~ ~Ji ~`-`.4 / (. -
-________ - - - - -
- ~ IGMT
-
-
-. I
~ fl
p.
P ~C 3~ 211 ~ 22
C ~ 33~p~ ~
~ ~ ~` ;~~i -i~~
f3 2~~b9'_ ~Q
~ ~J *~`YJo2 - ~
~
~
~ ~I$fr4~R
7~.2.3 L~II~4I)~ ,)?~
i~
3 q'~4o?~ 9~i
Jo ~ c
jq~
3~ ~/$ `L
J3'~o /~~jj
q ,c~ ~
~c~J~/ `~3
~i~'
~2L.?I~
?~~`&`~`
~9O
~
iii
:
~
`~
/±~4'
~
`~
L
~b'
ci79 o
vc..
~&1cLL~
~L~s~'
~
~!i~2
4I~Z
~
~
~
~
ff19pt'L
~7~7 Olic-
,,~//~n'C.-
~) `I 4~'~/
i7~1//~j3A,~/ tJP'(.~
,vly%MW
cc~r-
t~1~r9
C~0f1~
a
Z
~
~`
/o
~o
-
-
*
~o3
L f3/.~U~'L
-
?.Zit 91 .7o~O
~QJ
~L7~
~L
~
,
11
`
an
VIt~
Jk'A/
Li
~
,`)
~
L~
fju,
-
,~)
L ~
~O7 "I
~- ~
r: ; LI34
~
~f~so
~
$~
~3 w~1
~j
i~KiV
.~C7
/0
7'
7~
/.S
:
~.?C
/J(fl
-
-
~Jft~
aL
111c~
~ez
/
~
,~,
Li..
3.9iO~1_1/s
rnO~1_'v~
~T,~7V
~
~
-
*;4~-
- - - -
I'.- - I
/7/1..
T.
~.
-
-
~ç
~i'1,2«=
(I
(
(L
*
(~
fl
y~ç~t
-
-
;~ ~i2~
-~.f-
.
-
- -
-
-
-
-
~j____
~~~I[I[IEIIE
STATION PRESSUU COMPUTATIONS
_________ ~TNISIC.~.T.)I~.. I#I,,~-~ ~
*1
PAGENO="0619"
T.~.~ST,.G*T IGMT~IIIJ SUFACEW~HS .`-:I-*
C L. ~
LfL
2c~i«=
(L~/~H
2c~O c~T
op S C~i-
2 o~ cc. T
~e~i3( £~3U
Q5~' E 30 `i~~I 5~ o~-
~~,4r~2ç /2 ~C7
~ C~~L4~_
CULL.
~
~
~
LI' ~
2.
~
?~
iS
J*~
L~
ei_
*
JOCI 6~p'
~.i~3iq
(I
- -
-o-~
~
J
-
`a ~
Ic
FOlD ________
r
jS
CL&
CL~
1-'?
Ic
(LaZ
.
CL(~
I_c
1 C~ti~.
7oSC~T
1~
~1
!~tt
J.L
~
~
~f/
~--
~T'P/3
r'4p~
~"
~q~i
s.--.
~
-
`~`J *3~ -`-~ ~ -
~~~L-'-',-" .2,'/j/;.''
`U'~'~ 1~/9/LCI ~9qy4
w~i'- ."~i/~ 7/,' ~T~J -
#~ c~~J `-~6'~Jb 3o4'~~f I
~ .-
-
7
i
L
~`i-~'~ i~E~IIi I
~?coI
-
` `
2i ~
--______
. -___
~: `: -
~`:~ -!--1-! ~
.~-*. (N~((~M~s~)
I `v'cu~ I ~ I ~-~- I ~-~-
PAGENO="0620"
G~T C*I~~I1 SURFACE WEATHER OBSERVATIONS
- _~ ~MT_LST~ I I
___________________ _____________ ______________________ - - -
-71) ~C7
7/~ ~`-~Y
-~---
-
~O E~c() 3X~/ -
~ ____________
* I I/~ .7- /~- ~Z~'I~I~1 Fb `!J~,
~I/(~ ~
/j~~
7?
j~
J_i
Is'
:~
L
i.7
.-~
~
lI~ ci~
*-;.~-~
I
.
~`;-~
-.
-
12I3~
~
-
~tjf~
~/2~
~
\,/?
7?
-
,
13~
-~-
-
c'~x
-
U-/~
7'-
~N'WIiIX~6~
107o1 4/9
;~:,c~ I~
¶~- - .~-
!~L_ `~ I
~L - /i~ ~- /~
~J~L ~
c'.~ ic'3 ~75I
?
I
/~wCL' -
`~L `,/oo 41-7 ~
-1 :~:~
( I-A I ~if~
~~EFEI~E~
A
-4
4
- 7~i ~C~T
7'i cc~T
r9o #~&/
2iS3~iI `9i(~,i2~- ~1q
1/? ~
iq7scl
I
`ii,) ~) -~ -, -)/ ~
.
1~
` -`I
2.l
~( 7
7
,,(i~
~I/ 7
7#~,
7
CYi
/ I_U'
)
`3
L~) kt~
] I I
IIIMMARY YIP (lAY
PAGENO="0621"
- f~oO .~
C~T i~ CoI~~~;
£DD~~s kMT I~T
SURFACE WEATHER OBSERVATIONS I /i'1~'~~iSB"~ C- ~4
CL I~
~ ~~i~oo ScY
-
ii
-~?~i c-r
~O
~
&~L
c.~_
~er
`C-
(`it ________________
4/(~C) /1? ~7~«=iii~i
~t~it~i
~T
~M1
-~
r~
(~JH,
~L'
.) ,~`-- ~
~
/,,)t~, i~'A1
~ ~ 4/
/~OLI(.-
/~`~-I~-
/$o cr'c
~
/~,
i~i~:
i5~~
~
#~~:;
~
-
~J
2
r1.()t-~A;
~ ,~t,.'
~éo ~k~/
~?
F'1.~,:~,SJ
.1
I,~ ~ ~I th'
/1.,-
~(7~Mvl~ :ei;
~i731~3L~W4i
~/~`~3~: ~
L4jo6á~
-I.
~J ~,,
Cl
I .isJC.
`2
~_
i~_
-
t~T:) ~ Z21
;.~j;-~~;:
~r~i~? ~ ~7~ii
/~y,,. --`I-.
Ii
Th /4)~,~#(~'
~`.I'~
j,,,
~ -
II
`
/
H-
L c~ tn'C
`~
I
I''~1~13.I
--
-
(c~
/ 1
4~.
- 1I"i!17~;TiI1''~t' (~ - Iliiii'i'
~`i-~i~~ ~ ~
PAGENO="0622"
T~ C~I~ 2 SUVONS //,1,('~~is&Ie( ~
£OD~ ~MT_1ST~
4Y:i~_
:~- ~f.~L&
1)
t~ ((j (~~j(
fr1~(') ~
!~ ~i
I~s:~-
.LC~
J~i_
~_
~L__
rn~ civ'.~
1/
/f
E1
t.~_E._.
~
ii, ~ u C
~ ti t~L) ji (.
jV ~ 11A4 ~ ~ U i/C~-
~3-
~
"S ~ 9 41 ,~/ ~ fi (1 ~/ C~
~
2"
LU -~
1~`~` ~17
-~
C3c~ c~1~
12,1 ~?~`3 ii',- ~i
22'53/
2 ~o
~) -,9 `/.
.i~ic'~ C k; .Z
4~'~i1ii
/, -,
:1±::~:~~
REMADK$, NOIDS ANN
I"~'/-"1misCr. J'c-M,~~'1) ~
PAGENO="0623"
rn At
SURFACE WEATHER OBSERVAflONS ~ ~ ` & ?~ O(/( L'~ I
~:/~ /0 ~7 ~;
(tIC) OVs~ - R5/ /ç,4~~ ~ //,J~. ~ /1) ~
/i,L!rj (It/C ~./~~3~l%'4t. .,~ - - ~ ~:
- ~
E«=«= ~k/~ iii TEI ~ /~7 -
E 5~' cJVC `~`ia~3f/$1-..~ LL~ - - I /~ ,~
~ ~ ~
/5 - `v~ 4a':'~_ `~j' F~'~i~ - -
* "/~"t'~y -f `
f ~ *`!
I (I'. /`~ ~ 1 (
- liii iii
VI /~ -Li )(`
1~.?1~1qy3~ ~`Z7
~ ~ iiiii ~ i~ ,o ~ - - 2-
`2~: ~ ~ ~-~«=
i2
i~
Ti
/i
~-~Im~.il33:,z;
~
~
1,~2~7Md~
~
~`
~
(~/*~.
-
4 -
~*~- ~ -
-~ -~
"
~i
:c
~.4
-;z~
~
~
~
(~
7
~~iq~.~±r(
1/I
.2~
--
--
--~--
- ~--
--~--
--,-
-. .------
* ~
I `~~" !t\n' (SiiSOI1~/.4ft *L~~!1~ I ~ ~ I I
PAGENO="0624"
/14
1. /,` ~
~H:
jH ~
`L~
~2
`*( ,lII~,,
I(
2~ ~7
~
--2
T,~T
.,
~
/ -
-
c----
-
~..
, I
!
~ii~i~
il$.a
`7'
c~
,*~*
-
L~ii~
~_~___,`
!~_____~J
~Io~ ~
11O44~2.~_~1, 2~3i"2
j: 1)11 `1-b' ,:--~
41 ~T -
a b?
I ~~2~__________
`I ~ ~ (1/ ~
~t1 i p721
~
P5, t-~j 714.
~ I II
ZIi-' 2' o30
~rfyc~'c~qc,,'
Jt~i~
-i ~
,~qi ,~-e,--~-'~---
& #3~~ ~2_
~
~`
c
~
~
"S.-.
- -; ~` - -
- - - -
~
/
7~
L~.IIIiiIL/
~~c.'..:c,&;,'
`~
- -
,` ~
j,S~r~O-~K"~
~J
~
2s~ 6~
I~
/~
/*`
Z~
-
5 ~
2ec c~iC-
jZ~ci~/~
~
~
/S
17_;
siiI~!~'
.--..--___
,i~
/0
..____
2
72
~Puo O~
IC)
,o
- -
1 -~i~ ~~&~`ri ...~. -. .. I ..., ,,. I
!E~**KS, SOTES £SSD ~SCELLASSEOuS PHfSSO~!NA
PAGENO="0625"
- ~ JG TLS~II1 SURFACE WEATHER OBSERVASIONS ~- ;:" L__ ~-~--~ :~
7-
I-
-
/4~j
~
27,~
r~
c'i~
LLI~:'~
!`
ri
/i~
~.,
;,~;(~
I~iItu
o ci~c..
I
-~-
-,( r s
-
~
,~W-/4
r ~ t~'. ~/ "ii 0 L/ L
~~A-,s1 ~e~cVc~.
`I
£~~`i 9k~v ~) jSfL
3
~
~
4~&~'~1 ,`coC~~
~ ~3/CN ~UCIIIL
3«= ~k~',d ~ ~
lo c~r- ~3«= e3r~J ~ o~IC.
~() St-~ I:~ ~, ~p t~~/C.
S~ ri-~. 2~ t~k~ ~
2.
7'~7 `-`/.
c!2~
I)?
~; .-
!2It~
i
T
14-
V -
i~I
`~
-
LL~~~__________
/-~
-,.,
,~i -- ~iii~I,~
- 9~
~ ~-
2_
/
I ~) ~cr- ~ ~?o Out.
~t
-5L
E/~'~ /°~` ôC'C-~
~ /&&(i//C
3
~L
2!iii
P
z
11271
t~t~ ~ ~ ~ic
~`- / J~~) / L~
~
50 5~7
*~L~
~
~i3
~
1W
)~ 1~C (~L/(--
L : LJc~L~:~ k~$~?) flATION PWEssu:E:o~puT*TioN;
J~( ,f.
1.
)`~If7T~,J bVi
f
~~V~i?~ii/ ;w~
Cs-
I
-ç
V
/0
/`iT5Y~ H?
Eli
~iJ
/1
~I ii
5~~I
C)!
()I/-~ I -:`j-;~j~~,
(~1~ ~
9-1-r~
2e:~«='J c~'m
LJ~
I
t
,-~
`I I
I-,"
11)7
0/1
isif
"-`S
,~
7
I-.
PAGENO="0626"
622
APPX SCALE
S
Miles
March 28, 1979 4:30 p.m.
Plume in a N to NE direction, about 3O~ sector.
Primarily Xe-133. At distance of about 16 miles,
radiation measurements in the plume were about 0.1 mr/hr.
PAGENO="0627"
623
A~PX SCALE
5
Miles
March 28, 1979 8:00 p.m.
Plume in a N to NW direction. Primarily Xe-133.
Over Harrisburg, radiation measurements in the plume
showed about 0.1 mr/hr. At 10 miles from the site,
the plume was about 4-5 miles wide; top of plume at
about 3000 feet.
PAGENO="0628"
APPX SCALE
S
Miles
1979 10:45 e.m.
Plume in e N to NW direction. Primerily Xe-133.
Redietion measurements in the plume et ebout 10 miles
from plant in centerline of plume were 0.2 mr/hr; et
1 mile from plent, about 0.5 mr/hr meximum.
624
Narch
29,
PAGENO="0629"
625
March 29, 1979 5:00 p.m.
A Residual cloud (Xe-l33) N to NW between Mechanicsburg
`~ and Hershey, Pennsylvania. Radiation neasurements in
the cloud in the microroentgenho ~ highest
readings in cloud center.
J3 Ground level measurements on the island indicated a plume
in the southerly direction. Radtation measurements at
fenceline south of plant were ~ and one-half mile
south of fenceline, ~
PAGENO="0630"
626
APPX SCALE
5
Mi 1 es
March 29, 1979 8:00 p.m.
Survey aircraft circled the site at distance of about
8 miles at altitude of 1000 feet. No detectable
plume; `pockets" of residual radioac~yib~ were
detected with radiation readings in the range of
of 25 - 50 microroentqens/hour.
PAGENO="0631"
627
A~'PX SCALE
5
-`-
Miles
March 29, 1979 1Q:30 p.m.
Plume in a NW direction, width about equal to width
of river. Plume touches down about 1 mile from plant
at Hill Island. Radiation measurements at east shore
line at Hill Island, j~~j~; one mile north of Hill
Island, j~j~r; and at five miles from the plant,
25-50 microroen~gens/hr.
PAGENO="0632"
628
PAGENO="0633"
629
Li ,4,QFnS DI4TA
rimE Z3o -~;~o 1'v~t
k~E-,4r~#t~: I?C-,flg~1~~ ,/WS1c~ SG»=UA1-~
PAGENO="0634"
630
tX 3/~ ,q~q ~71K/'1& tfr
FIç~ht ~ -
L)e*&(e-r : &;-~~;,~ -Witd
PAGENO="0635"
631
OFFSITE GROUND LEVEL GAMMA SURVEYS performed in the predominant wind direction
showed a maximum of 0.6 mr/hr at 500 yards from the plant to a low of 0.06 mr/hr
at distances of 2 to 3 miles. An exception was during the collection of a sample
from the waste gas decay tank when gamma levels of 3 mr/hr were measured at a
distance of 500 yards east of the plant.
PAGENO="0636"
632
April 1, 1979
AERIAL SURVEY plume direction and radiation
readinga ahown above conducted at 6:00 AN. -
PAGENO="0637"
633
Attachment (2)
April 1, 1979
AERIAL SURVEY plume direction arid radiation
readings shown above conducted at 9:00 AN.
PAGENO="0638"
634 -
,4n~ XsJQ~~ ~)`-~ ~ *~YOy,~
4o~ce~c~ c~~'~'fl ~ The
~ ~7ø~ m~. ~e, ~
~.`;s a..I~ou~t )~ ~1e ~ ~ ~ fy &.t
(oo ~
PAGENO="0639"
635
PAGENO="0640"
636
s9ERIAL sup ygy
/2001,r«= `/Ji/~q
)~-r~1c~~ 27o°-2W°
0F O~oo ~1r*.
PAGENO="0641"
637
Question 10. Is it correct that there were about sixty people in the
control room during the early stages of the accident? Are
there any operating procedures which should have prevented
this congestion?
ANSWER
At the start of the accident, a normal shift complement (3 to 4) was
present in the control room. The number of people estimated to be
in the control room between 8 and 9 a.m. grew to 20 to 30. Several
days into the accident, when the plant was in a severely degraded con-
dition, the number of people in the control room exceeded 80 during
some periods. There were instances in which the control room had to
be cleared in order for the operators to carry out their responsibilities.
As a result of the TMI-2 experience, the Lessons Learned Task Force
within the Office of Nuclear Reactor Regulation, expects in the very
near future to recommend the adoption of the following position:
The licensee shall make provisions for limiting access to the control room
to those individuals responsible for the direct operation of the nuclear
power plant (e.g., operations supervisor, shift supervisor and control
room operators), such technical advisors as may be requested to support
the operation and appropriate NRC representatives. Provisions shall include
the following:
1. Develop and implement an administrative procedure which establishes
the authority and responsibility of the person in charge of the
control room to limit access, t.e., permission must be obtained
for entry into the control room.
2. Develop and implement procedures which establish a clear line of
authority and responsibility in the control room in the event of
an emergency. The line of succession for the person in charge of
the control room shall be established and limited to persons
possessing a current senior reactor operator's license.
48-721 0 - 79 - 41
PAGENO="0642"
638
Question 11. We gather that it was nearly three hours after the accident
before the plant operators recognized that they had a major
problem on their hands. Please explain how this can be true.
ANSWER
The operators did not realize they had a major problem on their hands until
the first radiation monitor alarm came on, approximately three ~ours into
the event. Until that time, they apparently recognized indica~ions of plant
conditions which were beyond the scope of training they had uidergone. Knowing
what we now know, it is possible to fault their performance, but considering
the nature of their previous training, the actions taken by the operators early
in the event are reconcilable with the situation they perceived. Later in the
event, and before the three hour time frame indicated in the question, it
should have been possible for the larger variety of expertise becoming available
to the operations decision makers to recognize and correct the problems.
Historically, training programs have emphasized certain parameters as
being of importance and have attached specific precautions attendant to
those parameters. Hence, the operatbrs' apparently emphasized attempts
to control pressurizer level in an effort to prevent going "water-solid".
Throughout the first few hours the variety of parameter values displayed to
the operator caused some confusion about whether the situation was degrading
or, in fact, stabilizing. When the radiation alarms came on, the answer
became obvious, and a site emergency was declared.
Question 12. What type of audio device was used to listen to the steam
generators? Would television cameras, at appropriate locations,
have been of any benefit?
ANSWER
Operators have stated in Interviews in reconstructing the sequence of events
that they were able to hear the initial flow of auxiliary feedwater into
the steam genera~~rs on the vibration and loose parts monitoring system.
This system has transducers (accelerorneters)mounted on the steam generator
shell very near the top and bottom tube sheet. These accelerometers,
along with others mounted on the reactor vessel, were used later in the
accident as part of the "noise diagnostics" monitoring effort related to
assessing cooling conditions in the reactor system.
Television cameras, while not useful in monitoring the steam generators -
or other internals of the reactor cooling system, may have been useful in
determining such things as the containment water level. Whether or not
television cameras could have survived the severe environmental conditions
in the containment building for a sufficient length of time to provide
a useful monitoring service is a subject requiring further study.
PAGENO="0643"
639
Question 13. Why did the control room operators put on protective masks?
At what time did they put on these masks? Why did the masks
donned by the operators make communications difficult? What
type of communications system is used by the operators when
they are wearing masks?
ANSWER -
At or about 10:17 a.m., March 28, 1979, control room personnel went into
protective masks at the instruction of a health physicist. Just prior to
this action, a radiation detector in the air intake to the control room showed an
increase. The detector Is sensitive to particulates, noble gases and iodines.
Prompted by this indication, the health physicist counted an air sample
using a GM counter and very conservatively concluded that radioactive
particulates were above the procedural limit for using protective masks
against airborneparticulates. Spectral analysis of an air sample
was not feasible because of high background activity in the plant counting
room.
The masks used at TMI-2 had no provisions for voice amplification. Verbal
communications are performed through the masks, although voice resolution
is impaired. Practice communications with the masks on is considered
valuable. Using the telephone with the masks on is more difficult because of
the additional lost resolution. At times during the TMI-2 event, personnel
removed the masks in order to more effectively use the telephone.
Question 14. The testimony indicates that the valves for the auxiliary
feedwater system were both closed about two days prior to
the accident; is this correct? What was the exact time
that they were closed, and what was the exact reason for
closing them?
ANSWER
The investigation of the events leading up to the accident has not yet
been completed, and the circumstances resulting In the closing of the
auxiliary feedwater valves have not been completely determined. The
valves were closed for a routine surveillancetest of the auxiliary
feedwater system on the morning of March 26, 1979. In subsequent interviews,
the maintenance personnel who performed the surveillance stated that the
valves were opened after the surveillance test and the position of the
valves was confirmed by checking the indication in the control room. The
opening of these valves is not explicitly included as a step in the
surveillance procedure, and a sign-off that the valves were re-opened is
not required. No other subsequent closing of these valves has been
identified In the interviews and investigation to date.
PAGENO="0644"
640
Question 15. Is closure of both valves supposed to take place only when the
plant is shut down?
ANSWER
There are no operating conditions ~allowed by the Technical Specifications
under which both auxiliary feedwater injection valves could be closed. One
of the two valves could be closed for up to 72 hours to allow for test,
maintenance or repair. If not corrected within this time the reactor was
to be placed in hot standby, i.e. at operating tempetature and pressure,
but with the core subcritical. If not corrected within an additional 12
hours the reactor was to be placed In cold shutdown i.e., low pressure
and temperature and subcritical. A general requirement of the technical
Specifications would require the reactor to be in the hot shutdown mode
within one hour and the cold shutdown mode within 30 hours if both valves
were closed. Preliminary information indicates that the original test
procedures properly implemented these requirements and specified the
closure of one valve at a time during the surveillance test. However
the procedure may have been revised to specify that both valves be closed.
This revision may have been made to permit testing of the system even
though valves In the cross over piping between the two Injection lines
were leaking.
Qt~estion 16. In light of the Three Mile Island accident and the very obvious
deficiencies in plant design, what Is the NRC planning to do with
regard to improving Internal design reviews to eliminate such
deficiencies as major valves which have no indicator on the con-
trol panel to indicate open/seated positions? (Other.design
deficiencies seem to include water level indicators on the reactor
vessel and reactor gas venting provisions).
ANSWER
The Comission has established within the Office of Nuclear Reactor Regulation
(NRR) a Task Force to review the lessons learned from the Three Mile Island
accident. One of the elements of the charter of this task force is to
recomend to the Coninission any necessary changes in the licensing review
process Including the Cormiission's regulations, the NRR Standard Review Plan
and Regulatory Guides. The Task Force Is currently reviewing the information
available from the Three Mile Island accident.. In the near future It will
issue a report describing short term actions that are considered necessary
for licensed reactors and for reactors which are currently under review and
scheduled to be licensed in the near future.
Several of these recoiiinendations will cover specific areas, such as, direct
indication of certain valve positions, instrumentation to indicate the operating
status of safety systems and a systems analysis to assess the type and design
of additional instrumentation that could be added to assist reactor operation.
This includes instrumentation which could be used to indicate water level in the
reactor vessel. The potential benefits or drawbacks of making provisions for
gas venting need further study before any conclusions are reached.
The Task Force will then study the review process and make recomendations
that may require longer implementation times for design improvements, hardware
modifications, and revisions to the NRR licensing review procedures and
methods.
PAGENO="0645"
641
Question 17. On March 30, 1979, the NRC was not in contact with its field
personnel during the morning hours. What action does the NRC
plan to take to organize communication provisions for future
emergencies? When will new provisions be available? What will
they consist of? -
ANSWER
As an immediate effort toward improved early communications a Bulletir has
been issued that requires licensees to notify NRC within one hour of the time
a reactor is not in a controlled or expected condition of operation. The
Bulletin also stated that when such notification is made, an open continuous
communications channel shall be established and maintained with NRC. To
facilitate the requested improvements, we h~v~ ~ad citrect dedicated tele-~
phones installed in the Control Room, reactor supervisors office and other
locations at all operating nuclear power plants. These telephones will auto-
matically ring at the NRC Headquarters Operation Center when the receiver is
lifted off the telephone cradles. This system became operational on June 1,
1979, and is being tested to identify areas where additional features will
be helpful and improvements can be made. It should be noted that this new
communications system will allow Headquarters and Regional Operations Centers
to handle simultaneous calls from a number of facilities. This will allow
NRC to respond to simultaneous incidents.
A second direct line, which will be dedicated to comunications concerning
radiological and environmental information, will be installed at each of
these operating facilities within the next few weeks. This will be a dial-up
line with several extensions which will be used primarily for continuous
communications during an incident.
Other future actions to improve communications that are still under con-
sideration include:
1. The need for alternate (to telephone) systems, such as satellite
communication.
2. Additional mobile units to support NRC Inspection & Enforcement
regional offices.
3. Air-transportable pods that contain monitoring & transmission
equipment.
Question 18, The NRC appears to be well equipped to respond to "design basis"
conditions. Now that it is recognized that events can occur out-
side the prepared "design basis", what action does the NRC plan
to take to implement a broader approach to design of reactors
in the future?
ANSWER
The NRC recognizes the need to corsider a broader approach to the design of
reactors. The TMI-2 accident ir~olving design, equipment and human failures,
demonstrated a combination of events that was clearly outside the design basis
envelope and suggests the need to have additional capability and flexibility
to respond to those events. The Lessons Learned Task Force will consider to
what extent and for what purpose the licensing process should look beyond
current design and operations requirements. Analyses may be required of
accidents and transients with multiple failures, core uncovery scenarios and
consequences, natural circulation core cooling, etc. It is possible that
certain of these conditions would be absorbed into the design basis while others
would be used to educate people, Including plant operational staff, to
recognize and respond to the wide variety of event sequences that can occur
in comparison to the finite set of design basis events. The Task Force
expects to make recommendations in this regard within the next few months.
PAGENO="0646"
642
QUESTION 19 Recognizing the human error at TMI, what action does
the NRC plan to take to improve operator qualifications,
training, re-training and re-certification?
ANSWER
We are presently in the process of preparing recommendations for Comiss~on
approval that will address these items in question. Items under consi'er-
ation include the following: increasing the educational and experience
requirements for an individual to be administered a license examination;
specifying the training requirements in more detail; administering NRC
examinations at different phases of the training, as well as at the conclu-
sion of the training; and requiring more simulator training. In addition, we
are considering increasing the scope of our operator licensing examinations
as well as increasing the passing grade. There will also be more active
involvement in the facility-administered requalification programs.
Question 2c1. Is the NRC properly staffed, not in number, but in talent,
to provide more effective regulation with respect to nuclear
power safety?
ANSWER
The NRC staff is composed of engineers and scientists for all the major
disciplines and with a range of experience in nuclear power plant design,
analysis, md operation. In addition the NRC has at its disposal the resources
of the n~cional laboratories and other consultant specialists through its
research and technical assistance programs. The current staff composition
has evolved in accordance with the NRC's regulatory role and prior to the
TMI-2 accident was thought to be adequate to fulfill its mission. In light
of the TMI-2 accident, changes in the mission and additional emphasis
in certain areas; e.g., operations and accident response, are likely to be
required, and staff resources would need to be increased.
QUESTION 21 The TMI plant was operated with the auxiliary
feedwater valves locked closed and this was
"operation in violation of technical specifications."
List all other operations of the TMI plant, prior
to the accident, that were in violation of any
operating procedures or specifications.
ANSWER
The Technical Specifications for TMI-2 require reporting of a variety of
situations and events which appear to be in the category of "operations. . . in
violation of operating procedures or specifications." These reports include
a "Licensee Event Report (LER)" which describes the event, its cause if
known, and a description of how the situation was resolved. Attached is a
copy of a computer printout of a tabulation of those LER5 on ThI-2 up to the
date of the accident which could be considered in the category of such
operations.
PAGENO="0647"
JUN 21, 1979
Attachment to Answer to Question 21
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET NO.1 EVENT DATE/
LER NO./ REPORT DATE/ EVENT DESCRIPTION/
CONTROL NO. REPORT TYPE CAUSE DESCRIPTION
FACILITY/SYSTEM,
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2 05000320 020878
GAS RA.DIOACT WSTE MANAGMNT SYS 78-OO1/03L-0 022878
COMPONENT CODE NOT APPLICABLE 020998 30-DAY
SLJBCOMPONENT NOT APPLICABLE
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
FIRE PROTECTION SYS + CONT
COMPONENT CODE HOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
OTHR INST SYS NOT REQD FR SFTY
INSTRUMENTATION + CONTROLS
SENSOR/DETECTOR/EL EMENT
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
REACTOR VESSEL INTERNALS
INSTRUMENTATION + CONTROLS
SENSOR/DETECTOR/ELEMENT
DEFECTIVE PROCEDURES,
NOT APPLICABLE
ITEM NOT APPLICABLE
DURING INITIAL FUEL LOADING, A SURVEILLANCE (REQUIRED BY T.S. 4.9.9, AND
4.3.3.1 TABLE 4.3.3 ITEM 2.B.1.A AND 2.B.IIA) INDICATED THAT THE REACTO
R BUILDING PURGE SUPPLY FANS AND ASSOCIATED PURGE RECIRCULATION DAMPER S
YSTEM, WERE INOPERABLE. THIS EVENT PRODUCED NO EFFECT ON THE HEALTH AND
SAFETY OF THE PUBLIC.
INCOMPLETE CONSTRUCTION. REACTOR BUILDING PURGE FANS AND DAMPERS COULD
NOT BE DEMONSTRATED OPERABLE. DO NOT OPERATE TAGS WERE PLACED ON CONTAI
NMENT PURGE AND EXHAUST VALVES. AFTER COMPLETION OF CONSTRUCTION SURVEI
LLANCE TESTING WILL BE RUN. UNTIL THEN CONTAINMENT PURGE VALVES AND EXU
AUST PENETRATIONS WILL REMAIN CLOSED.
WHILE IN MODE 116 IT BECAME EVIDENT THAT A CONTINUOUS FIRE WATCH (AS REQU
IRED BY T.S. 3.7.10.3) WAS NOT ESTABLISHED, WHEN THE CABLE ROOM HALON SY
STEM'S AUTOMATIC ACTUATION FEATURE WAS RENDERED INOPERABLE TO ALLOW CONS
TRUCTION WELDING. THIS EVENT PRODUCED NO EFFECT ON THE HEALTH AND SAFET
Y OF THE PUBLIC.
MISINTERPRETATION BY PORC AND SHIFT SUPERVISOR. ASSUMED HALON SYSTEM OP
ERABLE BUT AUTOMATIC ACTUATION FEATURE WAS DE-ENERGIZED. THUS FIRE WATC
H NOT ESTABLISHED WHILE AUTOMATIC ACTUATION DEFEATED. SYSTEM REENERGIZE
D. PERSONNEL INSTRUCTED.
AFTER INITIAL FUELING DISCOVERED 2 FUEL ASSEMBLIES WERE LOADED INTO THE
REACTOR VESSEL WITHOUT HAVING SOURCE RANGE AUDIBLE COUNTS IN THE CONTAIN
MENT BUILDING AS REQUIRED BY T.S. 3.9.2. BOTH VISUAL AND AUDIBLE COUNTS
OBSERVED IN CONTROL ROOM AND CONTROL ROOM PERSONNEL Ill COMMUNICATION WI
TH PERSONNEL IN REACTOR BUILDING. NO EFFECT ON PUBLIC HEALTH AND SAFETY.
AUX IN-CORE NEUTRON DETECTORS REMOVED TO LOAD FINAL 2 FUEL ASSEMBLIES.
THESE PROVIDED AUDIBLE COUNT RATE INDICATION INSIDE CONTAINMENT. SINCE
AUDIBLE COUNT RATE INDICATION IN REACTOR BUILDING IS REQUIRED AT ALL TIM
ES IN MODE 06, AUDIBLE INDICATION PROVIDED BY PERMANENTLY INSTALLED OUT-
OF-CORE DETECTORS.
AFTER INITIAL FUELING IT WAS DETERMINED THAT CORE ALTEERATIONS, INSERTIO
N OF INCORE DETECTORS, HAD BEEN MADE WHEN CONTAINMENT INTEGRITY HAD BEEN
BROKEN AND WHILE DIRECT COMMUNICATIONS WITH THE CONTROL ROOM WERE NOT M
AINTAINED. SINCE THE FUEL WAS UNIRRADIATED AND NO ACTIVITY WAS RELEASED
THERE WAS NO ADVERSE EFFECT TO THE HEALTH AND SAFETY OF THE PUBLIC.
05000320 021378
78-003/OIT-0 022778
023077 2-WEEK
05000320 021478
78-O04/OIT-0 022778
023078 2-WEEK
05000320
78-006/0 1T-0
020986
021778
030278
2-WEEK
PRIOR TO INSERTION OF INCORE DETECTORS IT WAS NOT RECOGNIZED THAT THIS E
VOLUTION FELL WITHIN THE DEFINITION OF CORE ALTERATIONS. TO PREVENT PUT
URE RECURRENCE, SHIFT PERSONNEL INSTRUCTED THAT INCORE MOVEMENTS CONSTIT
UTE CORE ALTERATIONS. FUELING PROCEDURES WILL BE MODIFIED.
PAGENO="0648"
JUN 21, 1979
FACILITY/SYSTEM'
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/,
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
FIRE PROTECTION SYS + CONT
PENETRATIONS,PRIMRY CONTAINMNT
ELECTRICAL
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
REAC COOL CLEANUP SYS + CONT
VALVES
OTHER
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
CNTNMNT'HEAT REMOV SYS + CONT
PUMPS
OTHER
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM NOT APPLICABLE
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET NO./ EVENT DATE'
LER NO./ REPORT DATE/
CONTROL NO. REPORT TYPE
05000320 022478
78-008/03L-0 032578
021001 30-DAY
SEALS WERE BREACHED DURING COMPLETION OF CONSTRUCTION. FIRE WATCH WAS P
OSTED AND SEALS RETURNED TO FUNCTIONAL STATUS. CONSTRUCTION PERSONNEL H
AVE BEEN INSTRUCTED AS TO THE NEED TO COMPLY WITH THE REQUIREMENTS OF TE
CH SPEC RELATIVE TO FIRE BARRIER SEALS.
CONTRARY TO TECHNICAL SPECIFICATION 4.0.5 WHICH INVOKES ASME SECTION XI
TESTING FOR CODE CLASS 1, 2, AND 3 PUMPS AND VALVES, THE RIVER WATER PUM
P OUTLET AND PRELUBE VALVES, AND THE REDUNDANT RCP SEAL INJECTION VALVES
HAD NOT BEEN FUNCTIONALLY TESTED BEFORE THEIR RESPECTIVE SYSTEMS HAD BE
EN PLACED IN SERVICE.
PRELUBE AND REDUNDANT SEAL INJECTION VALVES WERE NEWLY IDENTIFIED AS BEI
HG WITHIN ISI SCOPE HAVING BEEN ADDED BY DESIGN CHANGES. RIVER WATER PU
MP OUTLET VALVES NOT INCLUDED IN ORIGINAL IS! SUBMISSION DUE TO MISINTER
PRETATION OF THEIR OPERATION. THESE VALVES HAVE BEEN INCORPORATED INTO
IS! `PROCEDURES AND TESTED.'
031178 T.S. 3.6.1.3 VIOLATED. ENTERED MODE 4 WITHOUT PROPERLY ESTABLISHING CON
040778 TAINMENT INTEGRITY. SURVEILLANCE ON R.B. DOOR SEALS NOT PERFORMED WITHI
30-DAY N PREVIOUS 72 HOURS. All CONTAINMENT AIR LOCK DOORS WERE IMMEDIATELY TE
STED. RB. PERSONNEL HATCH INNER DOOR FAILED TO MEET LEAKAGE ACCEPTANCE
CRITERIA. SINCE UNIT HAD NOT YET GONE CRITICAL NO EFFECT ON HEALTH AND
SAFETY OF PUBLIC.
SURVEILLANCE PROCEDURE NOT SPECIFIC ENOUGH TO IDENTIFY THAT R.B. DOOR `SE
AL LEAKAGE TEST MUST BE MET TO BOTH ESTABLISH AND MAINTAIN CONTAINMENT I
NTEGRITY. INNER DOOR FAILED DUE TO DAMAGED 0 RING SEALS. THE 0 RING WA
S REPLACED AND INNER DOOR RETESTED SATISFACTORILY. PROCEDURES WERE CHAN
GED TO CLARIFY TESTING REQUIREMENTS.
ENTERED MODE 4 WITH ONLY ONE OPERABLE BUILDING SPRAY SYSTEM SINCE SURVEI
LLANCE ON BUILDING SPRAY PUMP 1A WAS NOT CURRENT WITHIN THE LIMITS OF TE
CH SPEC 4.0.2.A, 4.0.2.0 AND 4.6.2.1.0. PUMP IA WAS PREVIOUSLY TESTED 5
ATISFACTORILY AND WAS AGAIN TESTED SATISFACTORILY FOLLOWING THIS EVENT.
NO EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC.
CLERICAL ERROR. DATE WHICH MUST BE USED TO DETERMINE IF A SURVEILLANCE
IS CURRENT IS THE EARLIEST DATA DATE AND NOT THE DATE THE SURVEILLANCE W
AS COMPLETED. THE DATE SURVEILLANCE WAS COMPLETED WAS RECORDED ON THE M
ODE 4 CHECKLIST. OPERATIONS PERSONNEL WILL BE REINSTRUCTED..
EVENT DESCRIPTION/
CAUSE DESCRIPTION
DURING MODE 5, WHILE PERFORMING FINAL TURNOVER INSPECTIONS, IT WAS DETER
MINED THAT THREE FIRE PENETRATION SEALS WERE NOT FUNCTIONAL, PER T.S. 3.
7.11. BECAUSE THERE WAS NO FIRE AT THE TIME, AND BECAUSE A FIRE WATCH W
AS IMMEDIATELY POSTED, THIS EVENT PRODUCED NO ADVERSE IMPACT ON THE HEAL
TN AND SAFETY OF THE PUBLIC.
05000320 030778
78-010/03L-0 040478
021003 30-DAY
THREE MILE ISLAHD-2 , 05000320
CHTNMNT ISOLATION SYS + CONT 78-011/03L-0
PENETRATIONS,PRIMRY CONTAINMNT 021004
PERSONNEL ACCESS
* DEFECTIVE PROCEDURES
NOT APPLICABLE
PITTSBURGH-DES MOINES STEEL CO
05000320 031478
78-012/03L-0 041078
021005 30-DAY
PAGENO="0649"
FACIL ITY/SYSTEM/
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
EMERG GENERATOR SYS + CONTROLS
ENGINES,INTERNAL COMBUSTION
SUBCOMPONENT NOT APPLICABLE
PERSONNEL ERROR
CONSTRUCTION PERSONNEL
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
EHGNRD SAFETY FEATR INSTR SYS
PUMPS
OTHER
DESIGN/FABRICATION ERROR
DESIGN
ITEM HOT APPLICABLE
THREE MILE ISLAND-2
REACTIVITY CONTROL SYSTEMS
COMPONENT CODE HOT APPLICABLE
SUBCOMPONENT HOT APPLICABLE
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM HOT APPLICABLE
THREE MILE ISLAND-2
SAFETY RELATED DISPLAY INSTR
INSTRUMENTATION + CONTROLS
POWER SUPPLY
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM HOT APPLICABLE
EVENT DESCRIPTION.'
CAUSE DESCRIPTION
B DIESEL GEN TAGGED OUT OF SERVICE 1445 FOR MAINTENANCE. REDUNDANT DIES
EL GEN NOT DEMONSTRATED OPERABLE UNTIL 1805. ADDITIONALLY BREAKER ALIGN
MENT REQUIRED BY TECH SPEC 4.8.1.I.1.A NOT PERFORMED UNTIL 1805. NO EFF
ECT ON HEALTH AND SAFETY OF PUBLIC.
INADEQUATE REVIEW OF TECH SPEC 3.8.1.l.B AND ASSOCIATED ACTION STATEMENT
SUCCESSFULLY TESTED REDUNDANT DIESEL GENERATOR AND VERIFIED BREAKER A
LIGNMENT IN ACCORDANCE WITH TECH SPEC. PERSONNEL WILL BE INSTRUCTED.
IN MODE 3 PERFORMING BUS VOLTAGE VERIFICATION AND OPTIMIZATION STUDY TWO
INDEPENDENT NUCLEAR RIVER WATER LOOPS WERE NOT OPERABLE T.S. 3.7.4.1.
TWO NUCLEAR RIVER WATER PUMPS IN ONE LOOP COULD NOT BE STARTED.
BECAUSE A REDUNDANT LOOP WAS AVAILABLE THIS EVENT PRODUCED NO ADVERSE EF
FECTS OH HEALTH AND SAFETY OF THE PUBLIC.
THE BURNING OUT OF A SUPERVISORY LIGHT BULB ALLOWED A "SNEAK" CURRENT PA
TN TO BE INTRODUCED, PREVENTING RELAYS FROM DE-ENERGIZING AND PREVENTED
BOTH NUCLEAR RIVER WATER PUMPS IN A LOOP FROM OPERATING. THE BURNED-OUT
LIGHT BULB WAS REPLACED. NUCLEAR RIVER WATER PUMP CIRCUIT DESIGNS WILL
BE REVIEWED.
WHILE IN MODE 4, IT WAS DETERMINED ONLY ONE BORON SOURCE FLOW PATH VERIF
lED OPERABLE PRIOR TO MODE 4 ENTRY, THUS VIOLATING 1.5. 4.1.2.2.B. BECA
USE THE VALVE LINEUP FOR THE REQUIRED SECOND FLOW PATH WAS FOUND TO BE U
NCHANGED FROM THE PREVIOUS SURVEILLANCE PERFORMANCE, THIS EVENT POSED NO
THREAT TO THE HEALTH AND SAFETY OF THE PUBLIC.
CLERICAL ERROR. SURVEILLANCE PERFORMED IN ACCORDANCE WITH MODE 5 REQUIR
EMENTS. SECOND SURVEILLANCE DONE IN ACCORDANCE WITH MODE 4 REQUIREMENTS
PERSONNEL WILL BE INSTRUCTED CONCERNING NEED TO REFERENCE PROCEDURE D
ATA SHEETS AND VERIFY CURRENT VALVE LINEUP.
IN MODE 3 FAILURE OF AN AMPLIFIER PRODUCED ERRONEOUS READINGS ON ABSOLUT
E CONTROL ROD POSITION INDICATOR FOR ROD 5 OF GROUP 8. POSITION OP CONT
ROL ROD WAS DETERMINED FROM PULSE STEPPING POSITION INDICATOR AND ZONE R
FERENCE INDICATION. MODE 2 ENTERED CONTRARY TO 1.5. 3.0.4. NO ADVERSE
EFFECTS ON HEALTH AND SAFETY OF PUBLIC.
INCORRECT INTERPRETATION OF T.S. 3.1.3.3.A.2 LED TO VIOLATION OF T.S. 3.
0.4. APPROPRIATE STATION PERSONNEL WILL BE INSTRUCTED AS TO THE CORRECT
INTERPRETATION OF T.S.
JUN 21, 1979
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET NO./
LER NO.1
CONTROL NO.
05000320
78-013/0 IT-B
021006
EVENT DATE.'
REPORT OATE/
REPORT TYPE
031578
032770
2-WEEK
05000320 032278
78-016/011-0 040578
021008 2-WEEK
05000320 032578
78-023/03L-0 042478
021278 30-DAY
05000320 032878
78-019/O1T-0 040578
021009 2-WEEK
PAGENO="0650"
JUN 21, 1979
FACILITY/SYSTEM/
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
RESIDUAL HEAT REMOV SYS + CONT
VALVES
NOZZLE
COMPONENT FAILURE
MECHANICAL
ASSOCIATED CONTROL EQUIPMENT
THREE MILE ISLAND-2
MAIN STEAM SYSTEMS + CONTROLS
VALVES
OTHER
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
THREE MILE ISLAHD-2
AC ONSITE POWER SYS + CONTROLS
ENGINES,INTERNAL COMBUSTION
SUBCOMPONENT NOT APPLICABLE
OTHER
NOT APPLICABLE
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
CNTNMNT ISOLATION SYS + CONT
INSTRUMENTATION + CONTROLS
SWITCH
OTHER
NOT APPLICABLE
ITEM NOT APPLICABLE
EVENT DESCRIPTION/
CAUSE DESCRIPTION
WHILE IN MODE 5, WHILE PERFORMING SPAS TESTING, A NUCLEAR SERVICE CLOSED
COOLING VALVE (NS-V83B) FAILED TO OPEN, THUS VIOLATING T.S. 3.7.3.1. B
ECAUSE THE UNIT WAS IN COLD SHUTDOWN (MODE 5) AND THE SYSTEM WAS NOT REQ
UIRED, THIS EVENT POSED NO THREAT TO THE HEALTH AND SAFETY OF THE PUBLIC
THIS EVENT WAS CAUSED BY THE MALFUNCTION OF THE SOLENOID OPERATED PILOT
VALVE. THIS SOLENOID OPERATED PILOT VALVE WAS REPAIRED AND RETURNED TO
SERVICE.
IN MODE I REACTOR TRIPPED FROM 30Z R.T.P. RCS RAPIDLY COOLED DOWN AND D
EPRESSURIZED. DURING DEPRESSURIZATION, SAFETY INJECTION WAS INITIATED.
RCS AND PRESSURIZER COOLDOWN RATES WERE EXCEEDED (T.S. 3.4.9.1 AND 3.4.
9.2). PRESSURIZER VOL BELOW LIMITS OF T.S. 3.4.4). CALCULATIONS AND RA
DIOCHEMISTRY SHOW THAT CORE REMAINED COVERED AT ALL TIMES AND NO RELEASE
OF RADIOACTIVE MATERIAL RESULTED.
FOLLOWING RX TRIP, MAIN STEAM RELIEF VALVES DID NOT RESEAT AT CORRECT PR ~.
ESSURE. FEEDWATER SYSTEM RESPONSE SLOW SINCE INITIAL INTEGRATED CONTROL C~)
SYSTEM TESTING STILL IN PROGRESS. COMBINATION OF RELIEF VALVES FAILING
TO RESEATAND CONTINUING TO FEED STEAM GENERATORS RESULTED IN RAPID DEP
RESSURIZATION AND COOLDOWN. RVS WILL BE TESTED.
IN MODE 5, DURING MONTHLY SURVEILLANCE TESTING OF THE "B" DIESEL-GENERAl
OR, DIESEL TRIPPED DUE TO HIGH CRANKCASE PRESSURE AFTER RUNNING FOR APPR
OXIMATELY 32 MINUTES. T.S.4.8.1.1.2.A.5 REQUIRES A DIESEL BE DEMONSTRAT
ED OPERABLE BY RUNNING FOR 60 MINUTES OR MORE. BECAUSE IN MODE 5 AND 01
HER DIESEL OPERABLE, EVENT POSED NO THREAT TO HEALTH & SAFETY OF PUBLIC.
DIESEL GENERATOR WAS CHECKED FOR ANY ABNORMAL PARAMETERS BUT NONE WERE F
OUND. THE DIESEL WAS RESTARTED AND SUCCESSFULLY PASSED SURVEILLANCE. I
N ADDITION, CALIBRATION OF CRANKCASE PRESSURE SWITCHES WILL BE CHECKED A
ND AIR EJECTOR WILL BE INSPECTED.
PERFORMING MONTHLY REACTOR BUILDING ISOLATION AND COOLING/SAFETY INJECTI
ON SURVEILLANCE, THE SETTING OP BS-PS-3260 GREATER THAN ALLOWABLE VALUE
OF SPEC 3.3.2.1 BY 0.02 PSIG. SINCE REDUNDANT PRESSURE SWITCHES AVAILAB
LE AND WITHIN CALIBRATION, NO EFFECT ON HEALTH AND SAFETY OF THE PUBLIC.
BS-PS-3260 ERROR CAUSED B INSTRUMENT DRIFT DURING SURVEILLANCE TIME FREQ
UENCY. CORRECTIVE ACTION TAKEN BY ADJUSTING PRESSURE SWITCH TO A VALUE
BELOW THE TECHNICAL SPECIFICATION TRIP SETPOINT. NO FUTURE ACTION REQUI
RED SINCE MONTHLY SURVEILLANCE WILL BE PERFORMED AS REQUIRED.
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET NO./ EVENT DATE/
LER NO./ REPORT DATE/
CONTROL NO. REPORT TYPE
05000320 040478
78-024/03L-0 050478
021277 30-DAY
05000320 042378
78-033/011-0 050878
021273 2-WEEK
05000320 042578
78-037/03L-0 052578
021609 30-DAY
05000320 051278
78-038/03L-0 061278
021608 30-DAY
PAGENO="0651"
JUN 21, 1979
FACILITY/SYSTEM/
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
FIRE PROTECTION SYS + CONT
COMPONENT CODE HOT APPLICABLE
SUBCOMPONEHT NOT APPLICABLE
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
EVENT DESCRIPTION/
CAUSE DESCRIPTION
FLOOR FIRE BARRIER PENETRATION SEAL BETWEEN RELAY ROOM AND CONTROL ROOM
DEFICIENT VIOLATING T.S. 3.7.11. NO CONDITION EXISTED WHICH REQUIRED TH
E OPERABILITY OF THE FIRE SEAL. NO THREAT TO HEALTH AND SAFETY OF PUBLI
C.
IMPROPERLY CURED FOAM MATERIAL WAS USED TO MAKE THE SEAL. CONTINUOUS Fl
RE WATCH WAS POSTED. DEFICIENT BARRIER REPAIRED AND RETURNED TO FUNCTIO
HAL STATUS.
THREE MILE ISLAND-2
EMERG GENERATOR SYS + CONTROLS
CIRCUIT CLOSERS/INTERRUPTERS
CIRCUIT BREAKER
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM NOT APPLICABLE
05000320 063078
78-044/03L-O 072478
021936 30-DAY
IN MODE 6, 6/29/78, AT 1430, A DIESEL GENERATOR PLACED IN EMERGENCY STAN
DBY. 6/30/78 AT 1600, DISCOVERED BREAKER G2-1E2 NOT CLOSED WHEN A D.G.
PLACED IN EMERGENCY STANDBY CONSTITUTING VIOLATION OF T.S. 3.8.1.2. UNI
T IN MODE 6, AND NO CORE ALTERATIONS OR CHANGES IN REACTIVILTY WERE MADE
THUS EVENT DID NOT EFFECT HEALTH AND SAFETY OP PUBLIC.
PROCEDURE INADEQUACY. PROCEDURE REVISED TO ENSURE G2-1E2 CLOSED WHEN A
DIESEL GENERATOR IS PLACED IN EMERGENCY STANDBY. APPROPRIATE PERSONNEL
WILL BE INSTRUCTED ON PROCEDURE CHANGE.
THREE MILE ISLAND-2
FIRE PROTECTION SYS + CONT
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
CNTNMNT ISOLATION SYS + CONT
VESS EL S , PR ESSURE
CONTAINMENT/DRYWELL
DESIGN/FABRICATION ERROR
CONSTRUCTION/INSTALLATION
ITEM NOT APPLICABLE
05000320 072478
78-048/03L-O 082278
022052 30-DAY
05000320 081278
78-050/OIT-O 082878
022389 2-WEEK
DURING A FIRE BARRIER PENETRATION SEAL VERIFICATION INSPECTION, A WALL P
ENETRATION WAS FOUND LACKING A FIRE BARRIER SEAL. THIS 12" X 6" PENETRA
lION IS LOCATED IN THE SOUTH WALL OF THE SWITCHGEAR ROOM IN THE A EMERGE
NCY DIESEL GENERATOR BUILDING. SINCE THIS FIRE BARRIER WAS NON-FUNCTION
AL, IT CONSTITUTES A VIOLATION OF TECrI SPEC 3.7.11.
LACK OF A FIRE BARRIER SEAL IN THIS PENETRATION WAS DUE TO AN OVERSIGHT
ON THE PART OF THE CONTRACTOR. A CONTINUOUS FIRE WATCH WAS ESTABLISHED
IN ACCORDANCE WITH TECH SPEC 3.7.11 PRIOR TO INSTALLING THE SEAL AND SUB
SEQUENTLY A FIRE BARRIER SEAL WAS INSTALLED USING ANI APPROVED MATERIAL.
DURING PERFORMANCE OP THE REACTOR BUILDING PERSONNEL AIRLOCK LEAK RATE T
ESTING, THE OVERALL AIRLOCK LEAKAGE RATE EXCEEDED THAT ALLOWED IN THE UN
IT'S TECHNICAL SPECIFICATIONS. ALTHOUGH THE UNIT WAS IN MODE 5 AT THE T
IME OP THIS TEST, IT HAD ENTERED MODES 1 THROUGH 4 SINCE THE PRECEDING
EAK RATE TESTS WERE PERFORMED IN DECEMBER, 1977, AND THUS CONSTITUTES A
VIOLATION OF TECH. SPEC. 3.6.1.3.B.
LEAKAGE WAS CAUSED BY A 1/4" HOLE DRILLED THROUGH THE AIRLOCK BULKHEAD D
URING INSTALLATION OF SUPPORTS FOR THE ELECTRICAL CABLING. A MODIFICATI
ON HAS BEEN MADE TO PLUG THE HOLE. THE AIRLOCK WILL THEN BE TESTED AND
VERIFIED AS SATISFACTORY PRIOR TO ENTRY INTO MODE 4.
DOCKET NO./ EVENT DATE/
LER NO./ REPORT DATE/
CONTROL NO. REPORT TYPE
05000320 060978
78-043/03L-0 071078
021980 30-DAY
PAGENO="0652"
FACILITY/SYSTEM/
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
REACTOR TRIP SYSTEMS
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM NOT APPLICABLE
THREE MILE ISLAMD-2
REAC COOL PRES BOWl LEAK DETEC
COMPONENT CODE NOT APPLICABLE
SUBCOMPONEHT NOT APPLICABLE
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
OTHR INST SYS REQD FOR SAFETY
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM HOT APPLICABLE
THREE MILE ISLAHD-2
REACTIVITY CONTROL SYSTEMS
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
PERSONNEL ERROR
RADIATION PROTECTION PERSONNEL
ITEM NOT APPLICABLE
LER OUTPUT ON PARTICULAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
EVENT DESCRIPTION/
CAUSE DESCRIPTION
PERFORMING PSEUDO DROPPED ROD TEST, TP 800/31, DISCOVERED NUCLEAR OVERPO
WER TRIP SETPOIHT HOT VERIFIED WITHIN 8 HOURS PRIOR TO USING SPECIAL TES
T EXCEPTION 3.10.1 OF THE TECH SPEC AS REQUIRED. SINCE TRIP SETPOIHTS W
ERE VERIFIED BELOW 50i(, NO EFFECT ON PUBLIC HEALTH AND SAFETY. PROCEDUR
E TO BE MODIFIED.
PROCEDURE FOR PSEUDO ROD DROP TEST NOT DIRECT PERSONNEL TO IMPLEMENT T.S
3/4 10.1 PRIOR TO PERFORMING TEST; ONLY INFORMED THEM THEY WERE USING
SPECIAL TEST EXCEPTION SECTION. TESTING SUSPENDED AND NUCLEAR OVERPOWER
TRIP SETPOINTS VERIFIED WITHIN ALLOWABLE LIMITS. NUCLEAR HEAT FLUX AND
NUCLEAR ENTHALPY RISE HOT CHANNEL FACTORS OK.
PERFORMING SURVEILLANCE PROCEDURE 2301-3D1 ON 10/19/78 DETERMINED THAT
CO ACTION B FOR TECH SPEC 3.4.6.2 HOT INVOKED WHEN SURVEILLANCE PROCEDUR
E 2301-301 DATA OBTAINED AT 1935 ON 10/16/78 SHOWED UNIDENTIFIED LEAKAGE
GREATER THAN I GPM (2.6 GPM ACTUAL). ALL LEAKAGE FROM RCS IS PROCESSED
THROUGH RADWASTE TREATMENT SYSTEM AND EVENT DID NOT AFFECT PUBLIC HEALT
H AND SAFETY.
MISINTERPRETATION OF T.S. 3.4.6.2 AND 4.4.6.2 LED TO PERFORMANCE FREQUEN
CY FOR SURVEILLANCE ABOVE THAT REQUIRED BY THE T.S. NOT CLEAR TO PERSON
NEL WHICH SET OF DATA CAME WITHIN T.S. REQUIREMENT AND WHEN TIME REQUIRE
MENTS OF ACTION STATEMENT WERE APPLICABLE. UNIDENTIFIED LEAKAGE SUBSEQU
ENTLY REDUCED TO ALLOWABLE.
IN MODE 3 HEATUP PROCEDURE 2102-1.1 WAS BEING PERFORMED WHICH REQUIRED C
LOSING OF CRD BREAKERS. AFTER BREAKERS WERE CLOSED DETERMINED THAT INTE
RMEDIATE RANGE NEUTRON FLUX AND RATE FUNCTIONAL SURVEILLANCE (2313-SU2)
WAS NOT PERFORMED AS REQUIRED BY T.S. 4.3.1.1.1. INSTRUMENTATION WAS PR
OVEN TO BE FUNCTIONAL AND EVENT DID NOT AFFECT PUBLIC HEALTH AND SAFETY.
WHILE COMMENCING UNIT HEAT UP THE REQUIREMENT IN 2102-1.1 TO INSURE THAT
2313-SU 2 BE COMPLETED WAS INADVERTANTLY MISSED. UPON DETERMINATION OF
THIS REQUIREMENT 2313-SU 2 WAS PERFORMED IMMEDIATELY WITH SATISFACTORY
RESULTS. PROCEDURE 2102-1.1 WILL BE REVISED TO PREVENT RECURRENCE.
ON 01-03-79 IN MODE I DETERMINED SURVEILLANCE PROCEDURE 2304-Wi BORATED
WATER SOURCE VERIFICATION SCHEDULED FOR 0 1-02-79 HAD HOT BEEN PERFORMED.
THIS IS A VIOLATION OF T.S. 4.1.2.9 AND 4.5.4. SINCE BWST WAS IMMEDIA
TELY CHECKED AND FOUND WITHIN ALLOWABLE LIMITS, NO EFFECT ON PUBLIC HEAL
TN AND SAFETY.
BWST WAS IMMEDIATELY SAMPLED AND ANALYZED FOR REQUIRED CONCENTRATION.
NSTRUCTIOH OF PERSONNEL ON SURVEILLANCE VERIFICATION TECHNIQUES HAS TAKE
N PLACE TO ASSURE THAT THIS EVENT DOES NOT RECUR.
JUN 21, 1979
DOCKET NO./ EVENT DATE/
LER NO./ REPORT DATE/
CONTROL NO. REPORT TYPE
05000320 100378
78-061/03L-0 110178
023079 30-DAY
05000320 101978
78-062/OIT-0 110178
023080 2-WEEK
05000320 120178
78-070/03L-0 122878
023426 30-DAY
05000320 010379
79-006/03L-0 013179
025008 30-DAY
PAGENO="0653"
JUN 21, 1979
FACILITY/SYSTEM,
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLAND-2
CNTNMNT HEAT REMOV SYS + CONT
INSTRUMENTATION + CONTROLS
INDICATOR
PERSONNEL ERROR
MAINTENANCE & REPAIR PERSONNEL
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
ENGNRD SAFETY FEATR INSTR SYS
INSTRUMENTATION + CONTROLS
SWITCH
OTHER
NOT APPLICABLE
BARTON INSTRU CO., DIV OF ITT
THREE MILE ISLAND-2
STATION SERV WATER SYS + CONT
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM NOT APPLICABLE
THREE MILE ISLAND-2
RESIDUAL HEAT REMOV SYS + CONT
COMPONENT CODE NOT APPLICABLE.
SUBCOMPONENT NOT APPLICABLE
DEFECTIVE PROCEDURES
NOT APPLICABLE
ITEM NOT APPLICABLE
EVENT DESCRIPTION/
CAUSE DESCRIPTION
ON 1/4/79 REVIEWING DATA COLLECTED DURING PERFORMANCE OF 2303-M7 ON 12/1
/78 DETERMINED REACTOR BUILDING PRESSURE HI-HI CHANNEL A FUNCTIONAL TEST
NOT PERFORMED VIOLATING T.S. 4.3.2.1.1. SINCE RB PRESSURE HI-HI CHANNE
A FUNCTIONAL TEST WAS PERFORMED SATISFACTORILY ON BOTH 11/10/78 AND 1/
5/79 SYSTEM WAS NOT OPERATING IN DEGRADED MODE AND THERE WAS NO EFFECT 0
N PUBLIC HEALTH AND SAFETY.
A SECTION OF SURVEILLANCE PROCEDURE 2303-M7 WAS INADVERTENTLY OMMITED BY
TECHNICIAN WHO PERFORMED SURVEILLANCE ON 12/1/78. APPROPRIATE I&C PERS
ONNEL WILL BE ADVISED OF THIS EVENT TO PREVENT A FUTURE RECURRENCE.
DURING INSPECTION OF EQUIPMENT & CABLES IN CONTROL BUILDING AREA ON 1/17
/79 DISCOVERED SETPOINTS OF 2 FEEDWATER LINE RUPTURE DETECTION PRESSURE
SWITCHES (FW-DPIS-7883-1 0 FW-DPIS-7883-2) OUTSIDE T.S. ALLOWABLE LIMITS
SPECIFIED IN SECTION 3.3.2.1 (196 PSID VS 192 PSID). NO EVENT OCCURRED
SUBSEQUENT TO OUT-OF-TOLERANCE CONDITION OF SWITCHES WHICH WOULD HAVE R
EQUIRED THEM TO BE OPERABLE, AND SINCE VARIANCE FROM LIMIT WAS ONLY 2Z N
O EFFECT ON PUBLIC HEALTH AND SAFETY.
INSTRUMENT SETTINGS MAY HAVE CHANGED FROM INSTRUMENT DRIFT OR STEAM LEAK
AGE. CALIBRATION OF THESE INSTRUMENTS WILL BE CHECKED IN FUTURE TO DETE
RMINE DRIFT CHARACTERISTICS. PRESENT PLAN IS TO REPLACE SWITCHES DURING
FEEDWATER ISOLATION MODIFICATION SCHEDULED FOR FIRST REFUELING. SWITCH
ES RECALIBRATED AND TESTED SATISFACTORILY.
IN MODE 5 TRAVELLING WATER SCREENS WERE FOUND INOPERABLE DUE TO SIGNIPIC
ANT BUILD UP OF DEBRIS CAUSING A HIGH DIFFERENTIAL LEVEL ACROSS THE IDLE
SCREEN SYSTEM. BECAUSE NO EVENT OCCURRED WHICH REQUIRED EMERGENCY USE
OF RIVER WATER SYSTEMS AND BECAUSE SUFFICIENT FLOW TO THE RIVER WATER PU
MP IN OPERATION AT THE TIME EXISTED, THIS EVENT DID NOT HAVE AN ADVERSE
EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC.
PROCEDURES DID NOT REQUIRE ONE OF THE SCREENS TO BE CONTINUOUSLY OPERABL
E DURING PERIODS WHEN LARGE AMOUNTS OF DEBRIS ARE PRESENT IN THE RIVER.
AFFECTED SCREENS WERE CLEANED AND RETURNED TO SERVICE. PROCEDURES TO B
E CHANGED TO ENSURE AT LEAST ONE SCREEN REMAINS IN CONTINUOUS SERVICE DU
RING PERIODS OF HIGH DEBRIS ON THE RIVER.
PREPARING TO ENTER MODE 4 FOUND THAT SURVEILLANCE REQUIRED BY T.S. 3.1.2
I FOR MODE 5 HAD NOT BEEN PERFORMED AFTER MAKEUP PUMPS HAD BEEN TAGGED
OUT SUBSEQUENT TO ENTRY INTO MODE 5. BECAUSE NO CORE ALTERATIONS WERE P
ERFORMED OR POSITIVE REACTIVITY CHANGES MADE, THIS EVENT DID NOT HAVE AN
ADVERSE EFFECT ON THE HEALTH AND SAFETY OF THE PUBLIC.
LACK OF CLARITY IN THE SHUTDOWN PROCEDURE WHICH DID NOT ADEQUATELY SPECI
FY PERFORMANCE OF THIS EVENT RELATED SURVEILLANCE. THE SURVEILLANCE PRO
CEDURE WAS COMPLETED SATISFACTORILY AND UNIT ENTERED MODE 4. THE SHUTDO
WN PROCEDURE: WILL BE REVISED TO CLARIFY NEED TO VERIFY VALVE LINE-UP FOR
BORON INJECTION FLOW PATH WHILE IN MODE 5.
LER OUTPUT ON PARTICuLAR EVENTS FOR THREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET NO./ EVENT DATE/
LER NO./ REPORT DATE/
CONTROL NO. REPORT TYPE
05000320 010479
79-001/03L-O 020179
025004 30-DAY
05000320 011779
79-008/03L-B 020979
025504 30-DAY
05000320 012679
79-0O7/03L-B 022679
025343 30-DAY
05000320 013079
79-009/03L-0 022679
025333 30-DAY
PAGENO="0654"
FACILITY/SYSTEM/
COMPONENT/COMPONENT SUBCODE/
CAUSE/CAUSE SUBCODE/
COMPONENT MANUFACTURER
THREE MILE ISLANO-2
REACTIVITY CONTROL SYSTEMS
COMPONENT CODE NOT APPLICABLE
SUBCOMPONENT NOT APPLICABLE
PERSONNEL ERROR
LICENSED & SENIOR OPERATORS
ITEM NOT APPLICABLE
EVENT OESCRIPTION/
CAUSE DESCRIPTION
WHILE IN MODE 1 FOUND BORON CONCENTRATION IN TNE BORIC ACID MIX TANK WAS
OREATER TMAN THAT REQUIRED BY T.S. 3.1.2.9 AND THAT THE LCD ACTION STAT
EMENT HAD NOT BEEN INVOKED. BECAUSE A REDUNDANT SOURCE OP BORON WAS AVA
ILABLE AND BECAUSE NO EVENT OCCURRED WHICH REQUIRED BORON INJECTION, THI
S EVENT 010 NOT ADVERSELY AFFECT THE HEALTH ANO SAFETY OF THE PUBLIC.
THIS EVENT WAS CAUSED BY UNIT PERSONNEL FAILINO TO RECOONIZE THAT THE AC
CEPTANCE CRITERIA OF THE SURVEILLANCE PROCEOURE MAO NOT BEEN MET. THE P
ERSONNEL INVOLVEO WILL BE COUNSELLEO TO MORE CAREFULLY REVIEW SURVEILLAN
CE RESULTS VS. ACCEPTANCE CRITERIA.
JUN 21, 1979
LER OUTPUT ON PARTICULAR EVENTS FOR TNREE MILE ISLAND 2
FROM 1969 TO THE PRESENT
OUTPUT SORTED BY EVENT DATE
DOCKET ND./ EVENT DATE/
LER ND./ REPORT DATE/
CONTROL ND. REPORT TYPE
BSOOB32B 021479
79-010/BiT-B 022679
02S334 2-WEEK
C)
En
0
PAGENO="0655"
651
Question 22. What action is the NRC taking to reassess the design and
licensing criteria for containment isolation involving
pressures below 4 psi?
ANSWER
There are 18 operating PWRs for which automatic containment Isolation is
initiated only by containment high pressure (2 to 5 psig). The Lessons
Learned Task Force expects to recommend shortly that the provisions of
Standard Review Plan 6.2.4 `Containment Isolation System" paragraph 1.1.6
(i.e., that there be diversity in the parameters sensed for the initiation
of containment isolation) be immediately backfit for those units.
All containments have used a positive containment pressure signal for the
initiation of automatic containment isolation. The most commonly used
diverse (or second) parameter is safety injection demand. Safety injection
demand is a safety-grade signal suitable for an early containment isolation
demand and is available through the plant protection system. We expect the
18 operating units will incorporate safety-injection demand as their diverse
isolation parameter.
The Lessons Learned Task Force is also evaluating the advisability of
requiring further redundancy in the containment isolation demand, e.g.,
high radiation level in the containment atmosphere, containment sump and/or
process fluids, in addition to signals from containment high pressure and
safety injection demand. Paragraph 11.7 of Standard Review Plan 6.2.4 and
Branch Technical Position CSB 6-4, "Containment Purging During Normal Plant
Operations" require that a containment radiation level also be used to initiate
automatic isolation of containment purge and vent lines which may be used
during normal plant operations. These requirements are now being imposed
for new OL applications and have been used for new CP applications since
publication of the Branch Technical Position.
PAGENO="0656"
652
Application submitted for construction
permit (CP)
CP Safety Evaluation Report (SER) issued
by NRC staff
CP issued
Application for operating license (OL)
tendered
Application for OL docketed
Staff SER issued
ACRS report issued
Start of public hearing
SER Supplement (SSER) No. 1 issued
Atomic Safety and Licensing Board
initial decisions
SSER No. 2 issued
Operating license issued
April 29, 1968
September 5, 1969
November 4, 1969
February 15, 1974
April 4, 1974
September, 1976
October 22, 1976
January 28, 1977
March, 1977
December 19, 1977
February, 1978
February 8, 1978
QUESTION 23 Please provide a complete chronology of the licensing
process for the TMI plant.
ANSWER
Attached is a detailed chronology of the review for
the TMI-2 operating license from the receipt of the
operating license application to the issuance~of the
license. Also attached is a description of the
evolution of the operating license from the time of
issuance to the time of the accident.
For clarity an abbreviated chronology of key events
up to issuance of the license is presented below.
PAGENO="0657"
653
Attachment `to ~AnsWer to Question~23
APPENDIX A
CHRONOLOG
RADIOLOGICAL SAFETY REVIEW
OPERATING LICENSE REVIEW
THREE MILE ISLAND NUCLEAR STATION
UNIT 2
February 15, 1974
March 18, 1974
March 19, 1974
April 4, 1974
April 18, 1974
April 25, 1974
April 25, 1974
April 27, 1974
May 6, 1974
May 28, 1974
May 30, 1974
June 3, 1974
June 3, 1974
Application tendered for acceptance review
Applicant informed of results of acceptance review and
of additional information required.
Meeting with applicant to discuss results of acceptance
review and additional information required.
Application with Amendment 13 to the Final Safety
Analysis Report was filed, accepted, and docketed.
Letter to applicant accepting application and confirvnnq
schedule for required additional information.
Letter to applicant on omission of fluid block and
penetration pressurization systems.
Letter to applicant requesting additional information on
seismology, geology, and foundation engineerinq.
Letter from applicant on Quality Assurance organizatior
Amendment 14 filed.
Federal Register notices published on receipt of appli-
cation and opportunity for hearing.
Letter to applicant on safety review schedule.
Amendment 15 filed.
Letter from applicant responding to our letter of
April 24, 1974 on fluid block and penetration
pressurization.
48-721 0 - 79 - 42
PAGENO="0658"
June 13, 1974
June 18, 1974
June 20, 1974
July 1, 1974
July 11, 1974
July 12, 1974
July 15, 1974
July 17 and 10, 1974
July 25, 1974
July 29, 1974
August 1, 1974
August 6, 1974
August 6, 1974
August 21, 1974
August 23, 1974
September 4, 1974
Letter fro' applicant acknowledging safety review
schedule.
Amendment 16 tiled.
Letter from applicant submitting P61 diagrams.
Amendment 17 filed.
Site visit by Accident Analysis and Radiological
Assessment branches.
Supplement 1 to Industrial Security Plan submitted.
Amendment 18 filed.
Site visit by Site Analysis Branch.
Meeting with applicant to discuss additional informa-
tion on containment systems and structural engineering.
Site visit by Meteorology section.
Amendment 19 filed.
Letter to applicant on Quality Assurance personnel
authority.
Letter to applicant requesting additional information
on geology, seismology, and foundation engineering.
Letter to applicant transmitting first round questions.
Letter from applicant noting delay in responding to
some items of our letter of March 18.
Letter from applicant submitting schedule for
responding to first round questions.
Letter from applicant defining schedule for response
to our letter of August 6.
Amendment 20 filed.
Revision 6 to Industrial Security Plan received.
654
September 19, 1974
September 27, 1974
October 4, 1974
PAGENO="0659"
655
October 4, 1974 Letter from applicant submitting schedule for
response n anticipated transients without scram.
October 18, 1974 Amendment 21 filed.
October 18, 1974 Letter from applicant requesting lengthenimq of safety
review schedule and noting delays in responses to first
round questions.
October 29, 1974 Letter from applicant submitting some instrumentation
and control drawings.
November 4, 1974 Revision 7 to the Industrial Security Plan received.
November 19, 1974 Amendment 22 filed.
November 29, 1974 Letter to applicant transmitting questions on reactor
physics and accident analysis.
December 3, 1974 Letter to applicant transmittinq questions on radio-
logical technical specifications.
December 10, 1974 Letter to applicant transmitting revised safety
review schedule.
December 11, 1974 Letter to applicant transmitting questions and positions
on foundation engineering.
December 19, 1974 Letter to applicant requesting responses to open items.
December 19, 1974 Amendment 23 filed.
December 20, 1974 Letter to applicant transmitting second round questions
on operator licensing and industrial security.
December 27, 1974 Letter from applicant providing schedule for response
to our letter of December 11, 1974.
January 3, 1975 Letter from applicant transmitting initial response on
anticipated transients without scram.
January 6, 1975 Letter from applicant proposing delay in response to
questions on technical specifications until standard
technical specification review is complete.
PAGENO="0660"
Letter to apolicant requesting infornation on changes
in tendon system.
Letter to applicant advising of changes in safety
review schedule due to applicant's delays.
Letter to applicant transmitting second round questions
on reactor fuel.
Amendment 24 filed.
Letter to applicant advising of open items and
inadequate responses and of required schedule.
Letter to applicant noting procedures for submittal of
industrial security plans.
Letter from applicant transmitting revision 7 to
industrial security plan.
Letter from applicant responding to our letter of
December 19, 1974.
Letter from applicant stating that no changes are re-
quired for anticipated trancients without scram.
Response from applicant to our letter of February 6,
1975.
Letter to applicant concurring with their analysis of
containment prestressing system.
Meeting with applicant on anticipated transients
without scram.
Amendment 25 filed.
Letter to applicant transmitting second round questions
on reactor systems.
Letter from applicant revising open items response
dates requested in our letter of February 6, 1975.
Meeting with applicant on Materials Engineering Branch
items.
656
January 13, 1975
January 17, 1975
January 27, 1975
January 31, 1975
February 6, 1975
February 12, 1975
February 14, 1975
February 18, 1975
February 19, 1975
February 24, 1975
February 25, 1975
February 27, 1975
February 28, 1975
March 10, 1975
March 12, 1975
March 15, 1975
PAGENO="0661"
657
March 19, 1975 Letter to applicant advising of revised safety review
schedule.
March 25, 1975 Letter to applicant on Quality Assurance questions.
April 4, 1975 Amendment 26 filed.
April 14, 1975 Letter to applicant on Accident Analysis questions.
April 14, 1975 Letter to applicant on questions on industrial security.
April 17, 1975 Meeting with applicant on containment isolation.
April 23, 1975 Letter to applicant on review schedule revision.
May 12, *l975 Hydrology site visit.
May 19, 1975 Amendment 27 filed.
May 19, 1975 Letter to applicant transmitting second round ciuestions
on effluent treatment, containment systems, site
analysis, and electrical and control items.
May 19, 1975 Meeting with applicant and intervenor prior to ore-
hearing confernece.
Flay 22, 1975 Prehearing conference.
May 30, 1975 Amendment 28 filed.
June 5, 1975 Revision 8 to Industrial Security Plan filed.
June 20, 1975 Letter to applicant covering second round questions
from Auxiliary and Power Conversion, Mechanical
Engineering, Materials Engineering, and Radiological
Assessment Branches.
June 27, 1975 Amendment 29 filed.
July 11, 1975 Amendment 30 filed.
July 14, 1975 Letter to applicant transmitting requests for additional
information.
Letter from applicant transmitting drawings on sub-
compartment pressurization.
July 14, 1975
PAGENO="0662"
658
July 24, 1975 Letter to applicant identifying additional information
required ci ev:erqency core cooling system.
July 28, 1975 Letter froii applicant respondinq to our letter of
April 14, 1975, on industrial security.
July 30, 1975 Letter to applicant transmitting request for additional
information and staff positions.
August 6, 197S Letter to applicant transmittinq Babcock & Wilcox
standard technical specifications.
August 15, 1975 Amendment 31 filed.
August 21, 1975 Meeting with applicant to discuss open electrical and
instrumentation and containment system items.
September 2, 1975 Letter from applicant transmitting marked up copies of
standard technical snecifications sections.
September 5, 1975 Amendment 32 filed.
September 12, 1975 lleeting with applicant to discuss preoperational
testing.
September 17, 1975 Meeting with applicant on standard technical
specifications.
September 20, 1975 Letter from applicant transmitting revised industrial
security plan.
October 1, 1975 Meeting with applicant on standard technical
specifications.
October 8, 1975 Amendment 33 filed.
October 16, 1975 lleeting with applicant on standard technical
specifications.
October 30, 1975 fleeting with applicant to discuss steam line break and
other open items.
October 31, 1975 Amendment 34 filed.
November 3, 1975 Letter from applicant transmitting additional marked
- up sections of standard technical specifications.
PAGENO="0663"
Meeting ith applicant on standard technical
specifications.
Letter to applicant requesting additional analysis on
steam line breaks.
Amendment 35 filed.
Meeting with applicant on subcompartment structures.
Letter to applicant regarding transient loadings on
reactor vessel supports.
Meeting with applicant to discuss open items in the
staff review
Amendment 36 filed.
659
November 19, 1975
November 21, 1975
November 24, 1975
December 2, 1975
December 9, 1975
December 18, 1975
December 19, 1975
January 6, 1976
January 13, 1976
January 14, 1976
January 19, 1976
January 20, 1976
February 6, 1976
February 19, 1976
February 20, 1976
February 23, 1976
March 1, 1976
Letter to applicant transmitting revised safety review
schedule information.
Letter from applicant responding to our letter of
December 9, 1975, on reactor vessel support loading.
Transmittal to applicant of preliminary draft standard
technical specifications for Unit 2.
Revision II to Industrial Security Plan filed.
Amendment 37 filed.
Meeting with applicant on open items in staff review.
Meeting with applicant on open items in staff review.
Amendment 38 filed.
Letter to applicant transmitting guidance on meeting
Appendix I.
Letter from applicant responding to our letter of
July 24, 1975, on additional information on emergency
core cooling systems.
Letter to applicant identifying open items in safety
review.
March 5, 1976
PAGENO="0664"
660
Meeting with applicant on containment subcompartment
codes.
fleeting with applicant on open items in staff review.
General meeting on Appendix I.
Amendment 39 filed.
Meeting with applicant on electrical and instrumentation
open items.
Revision 12 to Industrial Security Plan filed.
Letter to applicant stating we will consider model test-
ing to satisfy Regulatory Guide 1.79.
Amendment 40 filed.
Letter to applicant regarding equipment used to nitigate
steam line break.
Letter to applicant regarding technical specifications
dealing with Appendix I.
Letter to applicant transmitting revised safety review
schedule.
Meeting with applicant on open items in staff review.
Meeting with applicant on standard technical
specifications.
Letter to applicant transmitting `Summary of Outstanding
Review Items.
Letter from applicant transmitting information to be
included in Amendment 41.
Meeting with applicant on open items.
Appendix I response from applicant.
Letter from applicant defining schedule for
response to open items.
March 8, 1976
April 1 and 2, 1976
April 8, 1976
April 9, 1976
April 13, 1976
April 19, 1976
April 20, 1976
April 29, 1976
May 5, 1976
May 10, 1976
May 13, 1976
May 13, 1976
May 25, 1976
June 1, 1976
June 1, 1976
June 2, 1976
June 4, 1976
June 11, 1976
PAGENO="0665"
661
June 11, 1976 Meeting with applicant on open itetis.
June 16, 1976 Amendment 41 filed.
June 25, 1976 Letter from applicant completing response to `e.~esr
for additional information on emergency core coolin~j
system.
June 30, 1976 Amendment 42 filed.
July 12, 1976 Letter to applicant on anticipated transients without
scram.
July 15, 1976 Letter from applicant transmitting Amendment 43.
July 19, 1976 Meeting with applicant to discuss meteorological data,
models, and results.
July 30, 1976 Letter from applicant on dike repair.
PAGENO="0666"
662
APPENDIX A
CHRONOLOGY OF OPERATING LICENSE STAGE
RADIOLOGICAL SAFETY REVIEW
The following updating of the chronology is provided.
August 6, 1976 Letter from applicant on dike repair.
August 31, 1976 Letter from applicant on reactor vessel support analysis.
September 7, 1976 Letter from applicant transmitting Amendment 44.
September 8, 1976 Letter from applicant transmitting Amendment 45.
September 13, 1976 Meeting with applicant to discuss open items.
September 17, 1976 Safety Evaluation Report issued.
September 23 and 24, 1976 Meeting of subcommittee of Advisory Committee on Reactor
Safeguards.
September 30, 1976 Letter from applicant transmitting Amendment 46.
September 30, 1976 Letter from applicant transmitting Amendment 47.
October 6, 1976 Meeting with applicant on open itmes.
October 15, 1976 Meeting of Advisory Committee on Reactor Safeguards.
October 22, 1976 Report of Advisory Committee on Reactor Safeguards.
November 9, 1976 Meeting with applicant on open items.
November 10, 1976 Letter from applicant on information on fire protection.
November 15, 1976 Letter from applicant transmitting Amendment 48.
November 30, 1976 Letter from applicant transmitting Amendment 49.
December 8, 1976 Letter from applicant transmitting Amendment 50.
PAGENO="0667"
663
December 20, 1976 Letter to applicant on fire protection.
December 20, 1976 Letter to applicant transmitting letter to Babcock &
Wilcox on Appendix K evaluation.
January 5, 1976 Letter to applicant transmitting request for additional
information.
January 21, 1977 Letter from applicant furnishing information on
Appendix K evaluation.
January 24, 1977 Meeting with applicant on change of ownership percentages.
January 26, 1977 Meeting with applicant on operating organization.
PAGENO="0668"
664
APPEHOIX A
CHRONOLOGY
February 25, 1977 Letter to applicant re guidance on implementing the new rule re physical
security plan
Letter from applicant transmitting Amendnent 52
Letter to applicant on secondary system line break
Letter to applicant requesting additional information to resolve certain
open issues
Letter to applicant re fuel handling accident inside containment
Letter to applicant requesting additional information on proper selection
of instrumentation trip setpoint values
Letter to applicant transmitting Supplement 1 to SER
Letter from applicant requesting Appeal Meeting
January 21, 1977
January 28, 1977
February 1, 1977
February 7, 1977
February 9, 1977
February 11, 1977
February 17, 1977
February 17, 1977
Letter from applicant on ECCS evaluation model
Letter from applicant re proposed draft tech specs
Letter to applicant requesting information by Systems Analysis Section
Letter to applicant acknowledging corrective and preventive actions
Letter from applicant transmitting Amendment 51
Letter to applicant on fire in motor control cooler
Letter from applicant concerning B&W ECCS reevaluation
Letter from applicant on schedule regarding steam line break accident
analysis
February 28, 1977
March 15, 1977
March 15, 1977
March 18, 1977
March 24, 1977
March 25, 1977
March 25, 1977
PAGENO="0669"
665
March 28, 1977 Letter from applicant requesting extension of construction permit
March 30, 1977 Letter from applicant transmitting Amendment 54
April 1, 1977 Letter from Shaw, Pittman, Potts and Trowbridge requesting ainenOment to
construction permit
April 1, 1977 Memorandum and Order
April 11, 1977 Letter from applicant re vital power supply inverters
April 13, 1977 Letter to applicant re appeal meeting
April 13, 1977 Letter from applicant transmitting Amendment 55
April 22, 1977 Letter from applicant transmitting Amendments 55 & 56
April 26, 1977 Letter to applicant requesting additional financial information
April 27, 1977 Letter to applicant on reactor vessel overpressurization
May 2, 1977 Letter from applicant on fuel handling accident inside containment
May 5, 1977 Letter from applicant re steam line break accident
May 11, 1977 Letter from applicant re instrument trip setpoint values
May 25, 1977 Letter from applicant transmitting physical security plan
June 1, 1977 Letter from applicant re hermetic seals of instrument boxes
June 6, 1977 Letter to applicant re open issues
June 28, 1977 Letter from applicant re financial information
June 29, 1977 Letter from applicant re fire protection program
July 7, 1977 Letter from applicant re.f ire protection technical specifications
July 20, 1977 Letter from applicant transmitting Amendment 57
July 21, 1977 Meeting with applicant
PAGENO="0670"
Letter from applicant re fire protection technical specifications
Letter from applicant re irradiation of fuel rods
Electrical Site Visit
Letter from Shaw, Pittman, Potts and Trowbedge requesting amendment to
construction permits to change ownership
Letter from applicant transmitting Amendment 58
Letter to applicant re fire protection
Letter to applicant re low grid voltage
Letter to applicant re physical searches of individuals
Meeting with applicant on steam generator instrumentation
Letter from applicant re reactor vessel supports adequacy
Letter from applicant transmitting Amendment 59
Letter from applicant submitting Fuel Densification Report
Letter from applicant transmitting Amendment 60
Meeting with applicant on Spray Pump NPSH
Meeting with applicant on open items
Meeting with applicant on steam generator sleeves
Letter from applicant re steamline break accidents
Letter to applicant re search requirements
Meeting with applicant on open items
Meeting with applicant on steam line break
Letter from applicant requesting extension of construction permit comple-
tion date
666
August 1, 1977
August 1, 1977
August 1-3, 1977
August 23, 1977
August 26, 1977
August 29, 1977
September 19, 1977
September 19, 1977
October 5, 1977
October 6, 1977
October 7, 1977
October 17, 1977
October 31, 1977
November 2, 1977
November 9, 1977
November 22, 1977
November 23, 1977
November 28, 1977
December 8, 1977
December 9, 1977
December 12, 1977
PAGENO="0671"
Letter from applicant transmitting Amendment 61
Initial Decision
Letter to applicant re fire protection review
Meeting with applicant on fire protection
Meeting with applicant on open items
Fire protection site visit
Letter to applicant on technical specifications
Meeting with applicant on steamline break
Letter from applicant transmitting Amendment 62
667
December 16, 1977
December 19, 1977
December 19, 1977
December 22, 1977
December 28, 1977
January 3-6, 1978
January 6, 1978
January 10, 1978
January 24, 1978
PAGENO="0672"
Letter from applicant on fire protection
Letter from applicant on steam line break
Letter to applicant transmitting order
extending completion date
Letter from applicant on radiological
monitoring program
Letter from applicant on containment peak
temperature profile
Letter from applicant on OTSG, sleeve test
program
Letter from applicant on construction items
and licensing commitments
Letter from applicant on open items in
tech. specs.
Letter from applicant on building spray pump
head curves
Letter from applicant on makeup tank isolation
after LOCA
Letter from applicant transmitting revision
of security plan
Letters from applicant on fire protection items
Letter from applicant on electrical terminal
blocks in containment
Letter from applicant on containment peak
temperature and building spray pumps
668
January 11,
January 13,
January 16,
January 24,
January 24,
January 25,
January 25,
January 25,
January 25,
January 26,
January 27,
January 27,
January 30,
February 1,
1978
1978
1978
1978
1978
1978
1978
1978
1978
1978
1978
1978
1978
1978
PAGENO="0673"
669
The evolution of the TMI-2 license from its issuance to the date of the
accident, March 28, 1979, is described below.
1, Pni~ndment No. 1 , dated March 3, 1978, added paragraph H to Attachment
2, permitting certain hydrostatic testing prior to initial criticality.
2. Amendment No. 2, dated March 10, 1978, revised certain Technical
Specifications, deleted and revised license paragraphs, and added a
paragraph to Attachment 2, as follows:
a. License paragraph 2.C.(3).b was deleted. The licensee provided
voltage and frequency variations resulting from a 500 Kw load rejec-.
tion from the diesel generators.
b. License paragraph 2.C.(3).l.1 was deleted. The licensee provided
design details of an automatic water suppression system in each
diesel generator room basement as required by this paragraph. (See
e. below.)
c. License paragraph 2.C.(3).l .2 was deleted. The licensee provided
a firewater pipe rupture analysis and noted that design of appropriate
water spray protection could not be done until further analysis was
completed. (See d. below.)
d. License paragraph 2.C.(3).l .3 was revised to assure that design
of water spray protection features would be accomplishee at a
suitable later time.
e. Paragraph G.l2 was added to Attachment 2 to require installation
of the automatic water suppression system discussed in b. above.
f. Various Technical Specifications were revised to correct typo-
graphical and editorial errors.
3. Letter dated March 10, 1978, NRC (Boyd) to Metropolitan Edison (Herbein)
noted completion of the construction and test items of paragraphs 8.1
and 8.2 of Attachment 2, and also noted submittal of inforoation to
satisfy the fire rating requirements of paragraph G.l of Attachment 2.
Authorization was given to proceed to Mode 4 (hot shutdo~).
4. Amendment No. 3, dated March 24, 1978, deleted certain license para-
graphs, and added and revised certain paragraphs of Attachment 2, as
follows:
a. License paragraph 2.C.(3).c was deleted. The licensee provided
documentation of their proposal to permit utilization of smaller
impellers in the reactor building emergency cooling booster pum~s.
b. License paragraph 2.C.(3).d was deleted. The licensee provided
documentation demonstrating the adequacy of the NPSH for the reactor
building spray pumps.
48-721 0 - 79 - 43
PAGENO="0674"
670
c. License paragraph 2.C.(3).e was deleted. The licensee provided
analyses defining the containment temperature response to a stea~i
line break, and justifying the adequacy of environmental qualification
temperatures of components inside containment.
d. Paragraph C.i of Attachment 2 was revised to delete as requirements
for entry into Mode 2 three fuel handling system tests and a test of
the reactor coolant waste evaporator. Technical Specifications already
required equivalent tests of the fuel handling equipment, and newly
added paragraph I will provide for the required waste evaporator test.
e. Paragraph C.5 of Attachment 2 was revised to clarify equipment align-
ment to assure that the HPI pimps will not empty the makeup tank in
the event of a LOCA, prior to implementation of paragraph F.l
f. Paragraph F.2 of Attachment 2 was revised to correct a typographical
error.
g. Paragraph I was added to Attachment 2 to require the waste evaporator
test discussed in d. above.
5. Letter dated March 25, 1978, NRC (Boyd) to Metropolitan Edison (Herbein)
noted completion of-all items in Attachment 2 required to be completed
prior to entry into Mode 2 (startup), and authorized entry into Mode 2.
Items include completion of test procedures, environmental/administrative
procedures, various work list items, and makeup tank hydrogen isolation
valves, procedure revision, and equipment alignment in accordance with
4.e. above.
6. Letter dated April 7, 1978, NRC (Boyd) to Metropolitan Edison (Herbein)
noted completion of all items in Attachment 2 required to be completed
prior to entry into Mode 1 (po~r operation) , and authorized entry into
Mode 1. Items required to be completed were:
a. optimization of voltage levels at the safety-related bases and
verification of such optimization (paragraph 0.1);
b. modification of the diesel generator air starting system to provide
10 starts (paragraph D.2); and
c. making the intermediate closed cooling water heat exchangers
seisnic Category I.
7. Letter dated May 1, 1978, Metropolitan Edison (Herbein) to NRC (Varga),
supplemented by letter of ~June 30, 1978, Herbein to Varga, submitting
fire protection information required by license paragraphs 2.C.(3).l.3
and 2.C.(3).l.4. Review by the staff and implementation of correctiv2
action was scheduled prior to the end of the first regularly scheduled
refueling outage.
8. Amendment No. 4 dated May 19, 1978, revised the Technical Specifications
to avoid injection of NaOH into the reactor coolant system during inadver-
tent actuations of the ECCS, and to reduce the maximum allowable value
of neutron flux tilt in each quadrant.
PAGENO="0675"
671
9. Amendment No. 5 dated June 5, 1978, revised the Technical Specifications
to require appropriate testing of the fuel handling bridge and associated
mast assemblies.
10. Letter dated 1~a.igust 7, 1978, Metropolitan Edison (Herbein) to ~C ~Varga)
submitting information as required by license paragraph 2.C.(3),f regarding
reactor protection system and engineered safety features trip setpoint
valves. This information was originally requested in our generic letter
of March 24, 1977, and is being evaluated on a generic basis.
11. Amendment No. 6 dated August 17, 1978, revised the Technical Specifications
to:
a. permit a more effective method of containment air lock seal leakag~
verification;
b. permit operation with higher ultimate heat sink temperatures;
c. permit removal of all but two orifice rod assemblies and to permit
installation of retainers on the remaining orifice rod assemblies
and the burnable poison rod assemblies;
d. permit replacement of the 12 dual port main steam safety valves
with 20 single discharge port valves; and
e. allow other miscellaneous changes.
12. Letter dated August 25, 1978, NRC (Varga) to Metropolitan Edison (Herbein),
correcting typographical errors in Amendment No. 6.
13. Amendment No. 7 dated September 5, 1978, revising the Environmental Tech-
nical Specifications to satisfy the requirements of license paragraphs
2.E.(2).a, b, c, and d, and deleting those paragraphs.
14. Amendment No. 8 dated December 15, 1978, revised the Technical Specifica-
tions to permit specified reduced RCS flow at certain reduced power levels.
15. Letter dated January 12, 1979, Metropolitan Edison (Herbein) to NRC (Varga),
noted implementation of fire fighting plans as required by license condition
2.C.(3) .1.5.
16. OlE Inspection Report 50-320/78-38 dated January 17, 1979, found the addi-
tional emergency lighting required by paragraph 6.9 of Attachment 2 to be
inadequate. Letter dated February 8, 1979, Metropolitan Edison (Herbein)
to NRC IE Region I (Carison) notes resolution of this item.
17. OlE Inspection Report 50-320/79-02 dated February 7, 1979, verified core-
pletion of the following items in Attachment 2:
a. paragraph E.l , requiring installation and test of new impellers in
the reactor building emergency cooling booster pulips; and
b. paragraphs 6.5, 6.6, and G.7, requiring provision of fire fighting
procedures and equipment.
18. Amendment No. 9 dated February 23, 1979, documented implementation of an
updated physical security plan.
PAGENO="0676"
672
Questiop~. ~You said that the "correction time" for Westinghouse plants
is about 30 minutes and for Combustion Engineering plants it
is about 15 minutes. What Is the corresponding time for B&W
plants?
ANSWER
The "correction time" for B&W plants is less than two (2) minutes as used in
the context of the response during the hearing. This is based on the assump-
tion that the plant sustains a total loss of main feedwater and a total loss
af auxiliary feedwater. (Ref. - Page 144, of hearing transcript, lines 3426
throught 3431)-
PAGENO="0677"
673
Herman Dieckamp
Presdent
[~ GENERAL 260 Cherry Hill Road
PUBLIC Parsippany New Jersey 07054
UTIUTIES 201 2634900
CORPORATION
June 26, 1979
The Honorable Mike McCormack
Chairman
Subcommittee on Energy Research
and Production
Suite 2321
Rayburn House Office Building
Washington, 0. C. 20515
Dear Congressman McCormack: -
In your letter of June 14, 1979, you forwarded a
list of questions. The enclosed answers to these
questions supplement my testimony before your sub-
committee on May 23, 1979.
I hope the delay has not inconvenienced the sub-
committee. If you require any further information,
please contact me.
lda
enclosures
PAGENO="0678"
674
ANSWERS TO QUESTIONS BY THE SUBCOMMITTEE
ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
Q - 1. Would there be any advantages in standardizing the design of
nuclear power plants?
A - While significant NSSS standardization does exist, it is our view
that further industry-wide efforts to standardize nuclear plants
would be desirable.
Standardization would be beneficial to the maturation of the
technology and to the assessment of reliability and effective-
ness of safety systems. The process of learning through the
feedback of operating experience can be greatly aided if there
exists a minimum of uncertainty about the applicability of the
experience because of equipment and design differences.
However, achievement of this objective requires a discipline in
the licensing process so that changing regulatory requirements
do not eliminate the possibility of design uniformity.
Since experience will always lead to the need for design
modification for purposes of plant reliability or safety, a
standardization program must be accomplished under a licensing
program which would approve a block of plants. When the
experience is sufficient to justify changes of true net benefit,
the criteria for the next block of plants would be changed.
The SNUPPS plants are certainly evidence of interest in and
support for plant standardization.
PAGENO="0679"
675
In the-narrower context of ~he nuclear steam supply (NSS) and critical
safety systems, a significant degree of standardization has already
-occurred by each nuclear steam supply vendor. All B&W-177 plants, typi-
fied by TNI-2, have very similar nuclear systems. Nuclear steam supply
systems offered by all vendors offer a considerable degree of standardiza-
tion within each of their product lines.
It should be noted that aany designfeatures of a power plant relate to
the particular site or to the environment in which the plant operates.
The type of heat sink can dictate many features of the plant secondary
system and equipment selection which are critical to many aspects of the
power plant design.
Beyond this, the NRC policy has encouraged standardization and the supply
industry has responded with "standard" designs. The implementation of this
policy has been very difficult by virtue of the tendency to continually
seek "improvements" during regulatory review. Certainly improvements of
significance should not be overlooked. But, there needs to be a more
critical assessment of the true value of intended improvements in relation-
ship to the extra complexity and unstandardization they can also produce.
The movement toward standard designs has, however, been thwarted by the
absence of sales. - - -
It is also my firm belief that future standardization would greatly reduce
the lead time for nuclear plants not only for licensing but also for
construction and that it would significantly reduce construction cost.
PAGENO="0680"
676
Q - 2. Is there any need for a "Swat Team" composed of people from industry,
the utilities, NRC, etc.?
A - The concept of a "Swat Team" which is assumed to mean a trained and
available pool of resources to assist in a major nuclear incident,
would be desirable. In our view, such a team would not have to represent
a dedicated full-time capability, but rather could be a team rapidly
formed from members of the utility and nuclear industry and the NRC.
The essentials for effective implementation would include:
a. Pn identification of anticipated skill requirements and the
source of those skills by company and name.
b. A pre-defined and thoroughly understood management structure
including lines of authority and responsibility.
c. A definition of how the team is to be assembled and supported.
4. An inventory of critical materials and equipment.
Q - 3. Should there be a standard design for control rooms and for the layout
of control room instrument and control panels?
A - It is our opinion that significant improvements can be made in overall
control room design. Some of these improvements could. take the form of
future standardization for example, of the meaning of red and green
indication lights, etc. However, a much more important aspect of the
overall control room design is the human engineering or instrumentation!
operator interface. Information could be displayed to the operator
in a more meaningful form; the information display systems must have -
priority assignments built in to assure critical data is made available
to the Operator, without the Operator being submerged in information of
secondary or of a relative unimportant nature. The use of more advanced
computer and digital display and control techniques should be expanded.
PAGENO="0681"
677
We believe this general area is probably one of the most critical,
and deserving of overall industry attention. A higher degree of
standardization could be beneficial in enabling increased and more
effective simulator use.
Q - 4. Should the control room operators or supervisors be employed by the
utility or by some other agency?
A - From the perspective of nuclear power plant safety, the control
room operators cannot be separated from overall plant operations.
An organizational interface would be difficult to unambiguously
define and could be counter productive to safety. The important
consideration is that the operators have the proper technical and
educational background, that they are thoroughly trained in the
design and operating characteristics of that particular plant and
that they are completely familiar with plant and operating proced-
ures and they perform in a highly disciplined way. To achieve
this high level of performance, there must be properly considered
operator selection criteria, continuous training, and thorough and
effective evaluation.
Q - 5. In your opinion,, what was the cause of the onset of the Three Mile
Island accident?
The cause of the onset of the TMI-2 accident was unquestionably the
fallure.of the power operator relief valve (PORV) on the primary system
pressurizer. While the overall turbine and reactor system "trip' was
triggered by a signal from the feed system, the plant is designed to
handle these "trips" and would have done so in this case routinely
except for the failure of the PORV.
PAGENO="0682"
678
Q - 6. It appears that some of the events at ml took place very rapidly. Is
this indicative of inadequate thermal capacity in the cooling and heat
transfer systems?
A - We do not consider the rate at which the transient developed at TMI-2 to
have been unusually rapid. From studying the incident and the dynamics
of the plant response, we do not believe that any reasonable increase in
the thermal capacity of the cooling systems would have had any bearing on
the end result, given the same equipment failure and operator actions.
Q - 7. Please comment on the following statement from the testimony of another
witness
"From the viewpoint of nuclear power plant safety design, two principal
technical elements are involved in ThI. The most important is that the
plant was configured so that the pressure. relief valve on the primary
coolant system opened very often due to events such as a failure of
normal feedwater flow to the reactor."
A - The ThI-2 plant is configured so that on certain plant trips the reactor
primary system pressure does cause the power operated relief valve to
open. This was originally done in the design to minimize reactor
"scrams" and allow a much more rapid plant recovery from secondary
system trips. While in this case subsequent failure of the~power
operator relief valve was a major ingredient of the incident, from a
much broader perspective the key question is the assurance of satis-
factory performance of all critical equipment within the plant. We
believe a very important pert of the plant design be focuzed on critical
components and that there be adequate engineering, development, and test
programs to verify component performance and reliability.
PAGENO="0683"
679
Q - 8. The testimony indicates that there are emergency procedures to assist
the control room operator in analyzing the instrument readings. Who
produced this analysis? Please send us a copy of this procedure and the
analysis?
A - There is a written response which details the follow-up action for each
of the approximately 1200 alarms in .the Unit 2 coi~trol room. Each
alarm has its individual procedure. Additionally,each of the emergency
procedures contains a listing of the anticipated alarms for the condition.
The emergency procedure contains the appropriate corrective action for
the condition. These procedures were prepared by site engineers and
consultants reviewed by the Plant Operation Review Committee and
approved by the Unit Superintendent. We have not included this material
because of its bulk but it will be supplied if the committee wishes.
Q - 9. Provide a schematic description of the operation of the Condensate
Polishing System including the means of ensuring adequate redundancy.
A - Enclosed is a system description and a schematic diagram of the Conden-
sate Polishing System. Since the Condensate Polishing System is not a
safety system its design does not include complete redundancy.
However, there are eight condensate polishing tanks in the system and
only seven are required for normal operation. This allows one tank to
be removed from service for maintenance or recharging without affecting
system operation.
Q - 10. Is it correct that there were about sixty people in the control room
during the early stages of the accident? Are there any operating
procedures which should have prevented this congestion? Provide a list
of those present.
PAGENO="0684"
680
A - During the early stages of the accident the number of people in the
control room cbang'ed from hour to hour. The following is a breakdown
for the first few hours of the accident.
a) 0400-0500 - The number of people varied from three (3) people at
0400 to about eight (8) people by 0500. These consisted of the
operating shift in the control room, Auxiliary operators that
came to the control room as needed, and three support people
from Unit I.
1) Bill Zewe - Shift Supervisor.
2) Fred Schiemann - Shift Foreman
3) Ed Frederick - Control Room Operator
4) Craig Faust - Control Room Operator
5) Ken Bryan - Shift Supervisor
6) George Kunder - Unit 2 Superintendent Technical Support
7) Various aux. operators in and out
8) Scott Wilkerson - Nuclear Engineer
9) Kevin Harkless - Nuclear Engineer
* b) 0500-0600 - The above mentioned people were joined in Control
room by additional personnel.
1) Walter Marshall - Ops Engineer
.2) Doug Weaver - I&C Foreman
3) Joe Logan - Unit II Superintendent
Total people in Control Room during this time numbered less
than twelve (12).
PAGENO="0685"
681
c) 0600-0645 - During this period more people were arriving
including the remainder of the scheduled shift personnel. The
total number of people was about 20.
1) Mike Ross_- Supervisor of OPS Unit I
2) Brian Nehler - Shift Supervisor
3) Adam Miller - Shift Foreman
4) Carl Guthrie - Shift Foreman
d) After 0645 - After this period a site emergency was declared
- and the total number of people in control room rose to about
-25 people.
A number of the people, listed above, that were in the control room at
this time were there as a result of being called to provide assistance.
At times later in the day the number of people increased in the control
room to about 60 people largely because of the evacuation of the
~sergency Control Station (ECS) from Unit I Control Room due to air
borne activity, and establishing ECS in Unit II Control Room. Use of
the Control Room as an ECS and the resulting activity was clearly
separate from the plant operations and did not hinder in any way
control of the plant.
We do not have operating procedures that limit congestion in the
Control Room but we do have clearly defined areas in the Control Room
~here personnel may go only with permission of the Duty Operations
Group. There are large red signs overhead and yellow lines on the
floor to indicate these areas, and the Shift Supervisor strictly
enforced these areas during and following the accident.
PAGENO="0686"
682
Q - 11. We gather that it was nearly three hours after the accident before the
plant operators recognized that they had a major problem on their
hands. Please explain this.
A - The operators knew they had an unusual problem early into the event
because of the high pressurizer level and low RCS pressure. During the
period the operators were responding to their indications and taking
action to place the plant in a stable condition. Two hours and 45
minutes into the event high radiation alarms were received. At this
time the radiation level began to exceed the pre established level for
the declaration of a "site emergency".
Q - 12. What type of audio device was used to listen to the steam generators?
Would television cameras, at appropriate locations, have been of any
benefit?
A - Audio Monitors used to listen to the steam generators were:
a. Loose Parts Monitor channel #5 "Steam Generator A Upper tube
sheet East."
b. Main steam relief valve noise monitor.
Television cameras would have been of no use as far as the steam
generators are concerned.
Q - 13. Why did the control room operators put on protective masks? At what
time did they put on these masks? Why did the masks donned by the
operators make communications difficult? What type of -communications
system is used by the operators when they are wearing masks?
A - The control room personnel put on particulate protective masks when the
air borne activity in the control room reached 1 x 10-8 uci/cc.
PAGENO="0687"
683
Communication is more difficult in masks because they are not equipped
with a speaking diaphram or another means of good clear speech transmis-
sion.
While wearing masks the personnel communicated with each other - face
to face, and communicated by telephone.
While using masks personnel speak slowly and loudly to insure they are
understood.
Even with the masks, communication was not seriously impeded.
Q - 14. The testimony indicates that the valves for the auxiliary feedwater
system were both closed about two days prior to the accident; is this
correct? What was the exact time that they were closed, and what was
the exact reason for closing them?
A - The auxiliary feedwater valves EF-V12A and B were found closed at
about eight (8) minutes into the event. At this tine we are unable to
document when these valves were shut.
However, the EF-V12A and B valves were shut about 42 hrs. before the
event during a scheduled surveillance test performed on the emergency
feed system. The operators involved have testified that they returned
these valves to the open position at the completion of the test.
Q - 15. Is closure of both valves supposed to take place only when the plant is
shut down? .
A - The closure of both EF-V12A and B in performance of the Surveillance
test was in accordance with an approved procedure which was not restrict-
ed to periods when the plant was shut down.
PAGENO="0688"
684
Q - 16. The testimony indicates three actions taken by the control operator(s):
a. He cut back on the high pressure injection to maintain the pressur-
izer level. Was this the right thing to do?
b. Re turned off the two pumps in the ~B~' loop at 73 minutes into the*
accident. Was this a reasonable thing to do?
c. At 100 minutes into the accident the operator turned on the two
pumps in the ~A" loop. Was this a reasonable action?
Specify why these actions were taken. Specify who performed each
action.
Specify who authorized each action.
(a) A control room operator cut back on high pressure injection
flow to try and maintain pressurizer level. The operators
were trained to respond to maintaining pressurizer level, to
insure it does not go empty nor completely full. The operator
was using approved procedures and responding to the indications
available to him.
The operator under direction of the shift foreman cut back on
high pressure injection. The shift supervisor agreed
to this action.
(b) The control room operator turned off lB and 2B reactor
coolant pumps under the direction of the Shift Supervisor
because of excessive RCP vibration, reduced and oscillating
Reactor coolant flow and fluctuating amperes on the running
RCP'S. Securing RCP'S would preclude severe pumps and motor
damage.
PAGENO="0689"
685
(c) Answer is same as (b) above for tripping of 1A and 2A RCP.
The plan was to rely on natural circulation to provide flow
through the RCS.
Q - 17. Describe in detail how your company contacted or alerted NRC about the
accident. Provide a detailed chronology of these actions together with
a list of people involved in the decision to contact NRC. Did you have
difficulty in contacting NRC?
March 28, 1979
0400 Turbine trip followed by a reactor trip.
0445-0705 Senior station personnel are called at home and arrive at
the site.
0650 Radiation monitors in auxiliary building and the reactor
(approx.)
building dome monitor escalated quickly to alert ranges.
* 0655 Senior personnel in the Unit 2 Control Room (J. Logan -
Unit Superintendent, C. Kunder - Unit Superintendent -
Technical Support, W. Zewe - Shift Supervisor) briefly
discussed the situation and reached rapid agreement that a
Site Emergency was in effect.
Mr. Zewe announced the Site Emergency and started the
notifications required by procedure. (See Enclosure
(1)).
0702 Pennsylvania Emergency Management Agency (State Civil
Defense) notified.
* 0704 NRC Region I notified. The answering service was contacted
and directed to get in touch with the duty offi~cer.~~
0720 Remaining notification complete.
48-721 0 - 79 - 44
PAGENO="0690"
686
0724 General Emergency declared. I~his decision was made, by the
Station Superintendent (Gary Miller) based on the reactor
building dome monitor reaching 8 Rem/hr., one of the
specific criteria requiring a General Emergency declaration.
* 0750 NRC Region I called the TMI-2 Control Room and established
an open phone line.
* NRC notification was required by procedure after a Site Emergency declara-
tion. Since NRC notification occurred before normal working hours, the
NRC duty officer was not in the office and had to be contacted to return
the call.
Q - 18. Provide a detailed description-of themaintenance work being performed
prior to the accident. This should include, but not be limited to, a
description of the work being done on the condensate polishing unit at
0400 on March 28, 1979. Was all of this work normal maintenance work?
Was the work done in accordance with B&W maintenance instructions?
Provide a chronology of the work and a list of those who did it.
A Work being done at condensate polishers at 0400 on March 28.
Number 7 polisher resin was being transferred to the regeneration
receiving tank. This-is a pert of normal operating procedure for
regeneration of the system and is not considered maintenance. Resin was
* clogged in the transfer line and operator Don Miller and Shift Foreman
Fred Schiemann were trying to free the clogged transfer line. This
system is not part of the B & W scope.
Thetransfer is done with demineralized water. Service air is applied
periodically to keep the resin swirling in the vessel. It is believed
PAGENO="0691"
687
that the water under higher pressure than the air, backed up through
the service air system and got into the instrument air system and
causing a loss of signal air to fail closed the condensate polish outlet
valves. This resulted in total loss of feedwater, which caused the
subsequent turbine trip.
Other Shift Maintenace work:
Shift Maintenance Foreman: C. Leakway
Electrical - K. Ebersole Troubleshooting electrical controls of
- L. Cisney Unit 2 Condenser Cleaning System.
Q - 19. Provide a detailed description of your operator training programs.
Provide the "Pass-Fail' grades of the operators on duty during the
period of the accident, and for the prior 48 hours.
Operators at nuclear power plants are licensed by the NRC as reactor
operators CR0) or as senior reactor operators (SRO) for each individual
reactor. Licensed operators undergo both NRC administered tests and
Company administered tests. Initial licensing as either an RO or 5R0
requires NRC examinations. Every TMI-2 operator listed in the table
below passed the NRC examinations for RO and SRO the first time they
were administered. NRC also requires that licensed operators undergo
requalification examinations administered by the Company every two
years. Met-Ed actually administers these requalification exams every
* ~ No operator listed below has failed an annual requalification
examination.
A number of TNT SRO's are licensed on both Units 1 and 2. Licensed
SRO's denoted in the table by an asterisk, first held -SRO licenses on
Unit 1. In those cases, the NRC approved and audited a cross-license
PAGENO="0692"
688
training program and Met-Ed administered "cross-license" examination
prior to aznmending the individuals' license to include Unit 2. ~In one
case (noted by a double asterisk) the; individual first held an RO
license on Unit 1. He then took the NRC SRO examination for Unit 2 and
upon passing, was licensed by NRC as an SRO on both Units 1 and 2.
The detailed description of our operator training program is attached
as Enclosure (2). The following table gives data on licensing of
operators who were on duty during the period of the accident, and for
the prior 48 hours.
1 1978 (March) 1979 (February)
Unit 2 Requal. Exam Requal. Exam
Control Room Operators CR0 License) NRC License Unit 1 / Unit 2 Unit 1 / Unit 2
23
E. Frederick 10/19177 NA/MR NA/Passed
C. Faust 10/20/77 NA/MR NA/Passed
T. Illjes 10/19/77 NA/MR NA/Passed
J. Kidwell 6/23/78 NA/NA NA/Passed
N. Coop~r 7/5/78 NA/NA NA/Passed
J. Congdon 10/19/77 NA/MR NA/Passed
H. McGovern 12/6/78 NA/NA NA/NR
E. Hemrnila 12/6/78 NA/NA NA/NR
* C. Nell Awaiting results of NRC Exam
L. Cermer Not licensed - CR0 in training
Senior Operators (SRO License)
W. Conaway CR0) 10/19/77, (SRO) 513178 NA/NR NA/Passed
*~, Cuthrie 11/9/79 Passed/MR Passed/Passed
F. Scheimann CR0) 10/19/77, (SRO) 5/3/78 NA/MR NA/Passed
**B. Nehler 10/19/77 Passed/MR Passed/Passed
*J. Chwastyk 11/9/77. Passed/MR Passed/Passed
*~, Zewe 11/9/77 Passed/MR Passed/Passed
*K. Bryan 11/9/78 Passed/NA Passed/NR
PAGENO="0693"
689
1 Date initially licensed on Unit 2 based either on NRC examination or Company
cross-license examination.
2 Not Applicable - individual does not hold license on this Unit.
3 Not Required - Annual requalification examination by Company not required
when scheduled within first six months following NRC licensing.
Q - 20. What necessitated thi~maintenance work; that is, was it an emergency,
or routine? Had similar maintenance work been performed on this unit
before? If so, how often?
A - The maintenance being performed prior to the accident other than that.
discussed in 18 was routine. Troubleshooting electrical controls of the
Condenser Cleaning System is performed routinely, about once in each,
one/two month period or as required for a specific problem.
Q - 21. How many condensate polishing units are there on Reactor No. 2 at ThI?
If more than one, were they both (all) undergoing maintenance at the
time the accident was initiated?
A - Unit II has 8 condensate polishers. Only one was in the process of
having resin transferred to the receiving tank. Transfer of exhausted
resin is part of the normal operating procedure required for regener-
ation of the units and is not considered maintenance.
Q - 22. How many condensate polishing units are required to sustain normal
plant operation?
A - Normally 7 polishing units are used during operation at full power
while the 8th vessel is in standby.
Q - 23. Specifically, what occurred on or before 0400 on March 28, 1979 that
caused a reduction in net positive suction head to the feedwater pumps?
What human errors were made; what components failed? Was there a pipe
blockage and if so, what blocked the pipe and why did it occur?
PAGENO="0694"
690
A - At 0400 on Narch 28, 1979, net positive suction head on the feedwater
pumps was lost because the condensate booster pump tripped. The
condensate booster pump trip occurred as a result of the condensate
polisher outlet valves closing, interrupting flow to the condensate
booster pumps. Valve closure was caused by loss of control air
to the condensate polisher outlet valve positioner, which automatically
signals the valve to close.
We cannot at this time positively identify the cause of the air failure
to the valve positioner. A probable cause may have been water
induction to the air system while operations were being conducted to
clear a pipe blockage in a resin transfer line. The resin transfer
lime is not part of the condensate flow path. Because of the resin
transfer line blockage, both the fluffing valves and the water sluice
valve on the polisher were open for some periods of time which could
have admitted some water to the station and instrument air supply
system through a leaking check valve.
On tests conducted in the plant subsequent to the incident, we have
not been able to reproduce condensate outlet valve closure on flooding
the instrument air supply to the condensate polisher.
Q - 24. Was any other plant equipment involved in the initiation of the accident
and if so, what equipment and what was the nature of the contribution?
A - We do not consider the equipment identified in answer to question 23 as
being part of the ~initiation" of the incident. As previously mentioned,
the plant is designed to accommodate loss of feedwater flow. The TMI-2
accident was a result of the failure of the PORV to close on low
primary system pressure.
PAGENO="0695"
691
Q - 25. Considering normal operations at Plant No. 2TMI and assuming 80% power
with no systems (either operating systems or back-up systems) undergoing
maintenance or test or otherwise inactivated, how many lights on the
control panel would be red? If any, what equipment would they relate to
and what would be the significance of the red indication as opposed to
green?
A - Under normal operating conditions there are about five hundred fifty
red lights in the Control Room.
The significance of red vs. green depends upon its use..
a. For a valve - red indicates open and green means closed.
b. For a motor - red means running and green means off.
c. For a breaker - red means closed and green means open.
d. For RNS - red light means high alarm.
e. For control rod position - red light means control rod position
is at full out position.
f. On the IC.3 - red means automatic.
The significance of an amber light.
a. For a breaker or motor control - amber light means disagreement
between breaker position and control switch.
b. For RNS - amber light means alert alarm.
c. For control rod position.- amber light means the rod is out of
alignment with its group average.
The significance of a white light.
* a. Indication of power available.
b. On the ICS white means manual.
Q - 26. Are there definite written procedures which define specific reasons or
conditjons upon which the reactor would be shut down manually. Do
PAGENO="0696"
692
these conditions include maintenance of certain equipment? If so, what
equipment is included?
A - There is no procedure which defines specific reasons or conditions upon
which the reactor would be shut down manually. However, the technical
specifications list the minimum amount of equipment in various safety
systems that must be operational for continued operation of the reactor
plant. Where these minimums cannot be met within the required time the
reactor is shutdown manually in accordance with Procedure 2102-3.1 -
Unit Shutdown. Additionally, Administrative Procedure - Organization
and Chain of Command gives the authority to the Control Room Operator
to manually shut the unit down for any condition he deems necessary.
Q - 27. Why were the auxiliary or emergency feed systems subjected to surveil-
lance tests twelve times in the first quarter of 1979? List the
reasons together with the dates and the result of the tests. Was ~he
last test on these systems 42 hours before the day shift on the morning
of Narch 28?
A - Technical Specification 4.7.1.2.a requires that each of Unit 2's 3
emergency feedwater pumps * shall be demonstrated operable at least
once per 31 days on a staggered test basis." Surveillance test 2303-
MI4A/E which complies with 4.7.1.2.a, must be performed nine times
during the 3-month period in question, once each month for each emergency
feedwater pump, EF-Pi, EF-P2A, and EF-P2B to meet this technical
* specification. Technical Specification 4.0.5.a, as required by Sec.
II, ASNE Code, states that ASME Code Class 1, 2, and 3 valves in this
system be tested at least quarterly, and that the pumps (EF-P2A,
EF-P28) be tested each month. Valve test 2303-M27A must be performed
at least once during the quarter, and the pump test 2303-N27B, must be
run three times, once each month in order to comply with technical
specification 4.0.5.a.
PAGENO="0697"
693
Requires Surveillance To be p
Technical Specification Test Number period
erformed during this
a total of...
4.7.1.2.a 2303-MJ4A*
1 time
4.7.1.2.a 2303_M14B*
1 time
4.7.1.2.a 2303_M14C*
1 time
4.7.1.2.a 2303-M14D
3 times
4.7.1.2.s 2303-N14E
3 times
4.0.5.a 2303_N27A*
1 time
4.0.5.a 2303_N27B*
3 times
*Require closure of EF-V12 A/B
Test Name Date Performed Results
Reasons Performed
2303-M14A 01-30-79 Performed Satisfactorily
Required by 4.7.1.2.a.
2303-M14B 01-30-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14C 03-09-79 Performed Satisfactorily
Required by 4.7.1.2.s
2303-M14D 01-23-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14D 02-20-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14D 03-19-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14E 01-04-79 Performed Satisfactorily
Required by ~s.7.1.2.a
2303-M14E 02-02-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14E 03-02-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M27A 01-03-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 01-25-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 02-26-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 03-26-79 Performed Satisfactorily
Required by 4.0.5.a
During the period 01-01-79 to 03-28-79, Unit 2 Technical Specifications
required tests of the emergency feedwater system to be performed a
total of 13 times, an equivalent average of once every 6.69 days.
Thirteen tests werein fact performed, each of which met its respective
acceptance criteria for satisfactory performance.
PAGENO="0698"
694
The last test of the system prior to the March 28 accident was conducted
on 03-26-79 from about 1000 to 1230.
Q - 28. Provide details of the "shift overlap" prior to the accident. Provide
a list of the control room operators, supervisors and others in the
--control roam during the accident period and for the 48 hours prior tb
the accident.
Shift overlap or shift relief is accomplished by man to man turnover.
In the control room the turnover consists of each man going over a
written up to date list of normal routine work going on and also any
unusual work or any other circumstances worthy of note. Also discussed
are any events accomplished on previous shift and any events planned on
next shift. -
List of licensed operators in the Control Room 48 hrs prior to accident.
2300-0700 - 3/26/79
CR0: Edward Frederick
CR0: Craig Faust
Shift Foreman: Frederick Scheimann
Shift Supervisor: William Zewe -
0700-1500 - 3/26/79 -
CR0: Martin V. Cooper- -
CR0: Joseph R. Congdon -
CR0: Earl Hemmila
CR0: Hugh McGovern
-Shift Foreman: Carl Guthrie
Shift Supervisor: Brian Mehler
1500-2300 - 3/26/79
CR0: John Kidwell
CR0: Theodore flljes -
PAGENO="0699"
695
CR0: Charles Nell
Shift Foreman: William Conaway
Shift Supervisor: Joseph Chawastyk
2300-0700 - 3/27/79
CR0: Craig Faust
CR0: Edward Frederick
Shift Foreman: Frederick Scheimann
Shift Supervisor: William Zewe
0700-1500 - 3/27/79
CR0: Earl Hemmila
CR0: Hugh McGovern
Shift Foreman: Carl Guthrie
Shift Supervisor: Brian Mehler
1500-2300 - 3/27/79
CR0: Charles Nell
CR0: John Kidwell
CR0: Theodore Illjes
Shift Foreman: William Conaway
Shift Supervisor: Joseph Chawastyk
2300-0700 - 3/28/79
CR0: Edward Frederick
CR0: Craig Faust
Shift Foreman: Frederick Scheimann
Shift Supervisor: William Zewe
In addition to the licensed operators, (others are periodically in
the control room but no record is kept).
PAGENO="0700"
696
Q - 29. Give a detailed description of "changing shifts" * Describe the formal
procedures and provide copies of documentation or reports for the shift
changes prior to the accident.
A - ~anging shifts is addressed in Administrative Procedure 1012 -
Shift Relief and Log Entries, a copy is attached. There.is no formal
documentation other than log books.
The relieving individual will discuss the plant status, operations in
progress and special instructions with on duty personnel so that he is
adequately informed prior to assuming his shift duties.
These reviews are accomplished by going over a written up to date
turnover sheet.
Q - 30. In your testimony you indicate that the control room operator "sent the
control signal" to close the pressurizer relief valve. Does this imply
that the relief valve indicator in the control room only indicates that
the signal has been sent and not that the operation has been performed?
Describe and discuss the control and monitoring of the relief valve.
A - Yes, the relief valve indicator in the control room only indicates that
the signal has been sent and not that the operation has been performed.
The pressurizer relief valve is a DC operated pilot actuated valve.
The only indication available on Control Console is a red lamp that is
* lit when an open command signal is ordered to the valve. The red lamp
goes out when the open command signal is taken away. -
The relief valve can be operated in manual from the panel either open
or shut.
In auto position, the valve is set to open on RCS pressure of 2255 psi
and close when pressure raduces to 2205 psi.
PAGENO="0701"
697
ENC. 1
X~AL LPA.F
SYST~4 DESCRIPTION
(Index No. 43)
-. CONDENSATE POLISHING SYSTEM
* (B&R Dwg. No. 2006, Rev. 13)
JERSEY CENTRAL POWER & LIGI~ COMPANY
THREE MILE ISLAND NUCLEAR STATION
UNIT NO. 2
Issue Date
Septéxr~ér, 1975
Prepared by. A. D. Pullin
Burns and Roe, [nc.
700 Kinderkainack Road
Oradell, N. J.
07649
PAGENO="0702"
698
TABLE OF CONTENT~
FOR
DE~SATE POLISHING SYSTEM
Section
3.0 .P3~R0Dt~T10N
1.1 System Functions
1.2 Summary Description of the Syst~ -
1.3 System Design Requirements
2.0 DETAILED DESCRIPTION OF SYSTEM
2.1 Components
2.2 Instruments,. Controls, Alarms and
Protective Devices
3.0 PRINCIPAL MODES 0P 0PEPATION~
3.1 Startup
3.2 Normal Operation
3.3 Shutdown
3.4 Specialor Infrequent Operatiän
3.5 Emergency
4.0 ~ARDS AND PRECAUTIONS
Page
1
1~
.5.
9
.9
.23
26
* 26
* 27
28
* 28
* 29
29
PAGENO="0703"
699
APPENDIX
Title ~~1e No.
Influent ~Condensate Water Analysis 1
Effluent Condensate Water Quality 2
Condensate Polishing Tanks 3
Mixed Bed Resin 4
Regeneration Tank 5
Mixing and Storage Tank 6
Hot Water Tank 7
Acid Storage Tank 8
Acid Polisher Pumps 9
Caustic Storage Tank 10
- ~
Caustic Polisher Pumps -
Aqueous Ammonia Storage Tank*.* . . 12
Aqueous Ammonia Pumps . 13
Sodium Suiphite Feeder & Storage Tank 14
Sodium Suiphite Pumps 15
Condensate Polisher Regeneration Sump and Pumps 16
Ammonium Hydroxide & Hydrazine Feed and . -. :.
Measuring Tanks** 17
Anunonium Hydroxide and Hydrazine Feed Pumps 18
Ammonium Hydroxide Mix Tank .~ . 19
Ammonium Hydroxide Mix Tank Pump - - * 20
Panel-Mounted Annunciator Inputs 21
PAGENO="0704"
700
CaWENS~TE POLISHING SYST~4
I C ~NTRODUCTI0N
$~$t~Itt FUflCtiOflS
The prLnary function of the Condensate Polishing system .is to reduce
the level of suspended and dissolved impurities in the Peedwater and
Condensate system to acceptable levels, and thereby eliminate im~urit
that could cause corrosion of steam generator tubes. In addition,
the system can regenerate its exhausted resin beds in periodic stages
and transfer the regeneration wastes for treatment and disposal,
The system a.s designed to treat the discharge of the condensate
pumps before it enters the feedwater heaters and steam generators~:
Polishing the condensate minimizes buildup of scale on the heat
transfer . surfaces of the feedwater beaters and steam generator tubes~
which would reduce their heat transferability and result in a lower.
thermal efficiency of the power plant.
In addition the Condensate Polishing System provides axcanonium
hydró~~ and~ hy~razine feed to the Condensate and ~ed~ater Sy
for maintaining feedwater pH and scavenging oxygen respectively.
The Condensate Polishing System has an interface with the following
systems: . I
(Drawing numbers refer to Burns and Roe flow ãiagrams.) ..
a. Peedwater and Càndensate . .. (D4g. No. 2005)
b Makeup Water Treatment (D~4g No 2006)
c. Demineralized Service Water .. (1)4g. No. 2007)
d. Service Air . . .` (mpg. No. 2014)
e. Secondary Plant Sampling (D4g. No. 2015)
f. circulating Water (Deg. No. 2023) -.
g. Radwaste Disposal R.C. Liquid (Dwg. No. 2027)
..l-
PAGENO="0705"
701
h Radwaste Disposal Solid (Dwg No 2039)
~. Radwaste Miscellaneous Liquid (Dwg No 2045)
~ Suxnp Pump Discharge (Dwg No 2496)
k. Radiation Monitoring
1.2 Summary Description of the System (Refer to B&R Dwg. No. 2006,
Rev. 13, and L*A Water Conditioning Co. Dwgs. No. D-4519 D
& D - 4522?)
The Condensate Polishing System norma~ly processes and chemi.
cally feeds the discharge flow of two out of. three condensate
pumps, except for the flow to the turbine exhaust hood sprays.
The condensate pumps discharge flow can bypass the condensate
polishing tanks through valve CO-V12 (reference S.D. No. 4?.,
Feedwater and Condensate, for description of condensate polish-S
ing system bypass
The c 4ense~. passes throegI~ seven polisYtfng tanks operating
in a parallel flow arrangement. An eighth polishing, tank is
in standby to be used when the mixed bed resin in any of the
* other seven polishing tanks is exb~austed. A resin bed is
* exhausted when a predetermined measured total flow has passed
through a polishing tank, a high pressure drop occurs across
t~he system and/or resin trap, or when the conductivity of a
polishing tank effluent exceeds a predetermined allowable
level
Each condensate polishing tank contains a mixed bed of cation
and anion exchange resins. Dissolved impurities in the water
are in the form of positively charged ions called cations and
negatively charged ions called anions. As these ions pass
through the polishing tanks mixed bed resin, the cations are
-2-
48-721 0 - 79 - 45
PAGENO="0706"
702
ionically bonded to the cation resin in exchange for. an
arnmqnium ion (NH~) which had been previously intentionally bonded
to the cation resin during the axrmioniation process in -.
regeneration. The anion-s are ionically bonded to the anion
resin in exchange for a hydroxide ion (OHI which had previously
been intentionally bonded to the anion resin. This
ion exchange is the means by which the dissolved impurities
are removed fron the condensate. -
The resin bead diameter is small, in the range of 20 (0 .84 usa)
to 40 (0.42 nmmi'mesh. As water flows through the bed, suspended
impurities are removed from the condensate by the resin acting
as a filter. - - - - - -
For regeneration when a mixed bed resin is exhausted, the ~xhauste~
xesin frcm the polishing tank is transferred~ to the ~egen-
eration tank and a spare resin bed is transf~rred from the
mining -an~.storage tank t~ the- erupty polisbi task,..
1:.* ~.
Regeneration now begi~us by the induction of ~bemicals. The exhaus
resin is first cleaned with sodium suiphite (f~7a2sa3) from the -
sodium sulphite storage tank. The porpose 4 chemically
cleaning the resin with sodium suiphite is t+ remove from the rest
iron impurities that had been removed from tile conderi
sate. The mixed resin bed is then backwasheá to separate the
cation and anion resins which are of differe~mt densities. The
anion resin bed is then regenerated by injeching the bed with -
diluted caustic (NaOH). The caustic regener4ition pump takes
sodium hydroxide from the caustic storage .ank and.
meters the caustic into a blending tee where1 a controlled -flow
of prenixed hot water from the hot water-tank and sluice water
frbm the demineralized water storage tank is blended with the
caustic fordilutiop, The diluted caustic is then injected into
- the anion resin bed. During anion regeneration, the negative
-3-
PAGENO="0707"
703
impurity ions bonded to the anion resin during the polishing
cycl.e are removed and replaced with hydroxide ions. After re-.
generating the anion resin bed, the cation resin bed is regen-
erated. First the bed is injected with diluted sulphuric acid.
(H2S04). The acid regeneration pump takes sulphuric acid from
the acid storage tank and meters acid into a blending tee where
a controlled flow of sluice water from the demineralizdd water
system is blended with the acid for dilution. The diluted acid
is then injected into the cation `resin bed. During this re-
generation step, the positively charged impurity inon, bonded' to the
tion resin during the polishing cycle, are removed and replaced
with hydrogen ions. Next, the cation resin bed or the'.exltire. bed,
is animoniated by the injection of diluted aqueous ammonia (NH4OR).
The aqueous ammonia pump takes aqueous axumoni~ from the
~ ~mini~,j~ etarage tank and meters ammonia into a blend-
ing tee where a controlled flow of sluice wat~r is blended with
the ammonia for dilution. The diluted ammoni4 is then injected
into the cation resin bed. The amtnonium ions I(NH~) replace the
hydrogen (H+) ions from the previous steps of ~regeneration.
The reason for ainxnoniating the cation resin iE~ so that the
cation resin will not remove ammonia from the ~condensate. The
condensate contains ammonia for the purpose o~ controlling the
condensate pH.
The resins are next rinsed and transferred to ~the mixing and
storage tank where the beds are intermixed. ¶~he regeneration
cycle is then completed and this spare mixed 1ed is ready to
transfer to a polishing tank as required.
-4-
PAGENO="0708"
704
The sluice water and chemical wastes are directed to a drain
pot and then to the condensate polisher regeneration sunip,
to th9 neutralization tank, Or to the miscellaneous waste
* holdup tank depending on chemical concentrations and/or
* radioactivitY levels. Blank tees are provided for resin
removal or refill.
The Condensate and Peedwater chemical feed consists of two
chemical solution `tanks, two chemical solution measuring tanks,
an axrunonium hydroxide mix tank, two chemical hand pumps, arid.
four chemical feed pumps. Chemical addition of ammonia and
bydrazine is injected as determined from stream samples of the
feedwater for pH control and to remove dissolved oxygen in the
feedwater
The system is provided with the Condensate polishing controL
Panel No. 304 in the Turbine Building. The control panel haS.
a dyàtem flOw c?tagram Wh±dr gives e graphic repr.e.mtatiom
the process The action of all the active components of the
system is indicated by lights on the panel to. show the step of
any cycle in progress. The transfer of resin is initiated from
the control panel. The resin regeneration -cycle can be manually
or automatically controlled from the control panel.
The bydrazine and ammonium hydroxide feed is controlled automat-
idally by the Recorder-Analyzer Panel 310: (refer to System De-
scription for Secondary Plant Sampling, Index No. 12) and man-
ually shutdown from Panel 305. - * *
1.3 System Design Requirements -
The condensate polishing system is designed to handle the con-
densate discharge from two out of three condensate pumps to a
niaximun flow rate of 17,400 gpm and maximum shutoff head of
200 psig. This maximum flow rate is to be disttibuted:-through sev
5
PAGENO="0709"
705
polishing tanks arranged in parallel flow with an eighth tank
as standby to be put in operation when the resin in any of
the seven operating polishing tan~s is exhausted The flow
rate to be handled by one polishing tank is 2 487 gpm which
is 50 gpo per square foot of resin bed area in the directiQa of
condensate flow. The design temperature of the polishing tanks
is 1350F The design pressure is 200 psig The maximum
pressure drop across a mixed resin bed is 50 psi Each
polishing tank has an underdrain designed to withstand a
differential pressure of 200 psi~ A resin trap is located
in the outlet of each polishing tank to prevent resin from
entering the feedwater system Based on influent conden.-.
sate water analysis (Table 1) the condensate polishing sys-
tem will deliver effluent condensate water quality as given
in Table 2 for normal operation During in.ttia]. and subse-.
quant. startups~the polishers will reduce all suspended and
dissolved solids to 50% of the irrfltrent concentrati~ o~
60 ppb whichever is greater During periods of condenser
leakage (1 gpo) the polishers will, reduce total dissolved
solids to not more than 50 ppb and wi]]. reduce suspended
matter to 10% of influent concentration or 25 ppb which-..
ever is greater
The minimum condensate volume treated by each continuous oper-.
ating cycle of a polishing tank during normal operation is at
least 160,000 gallons per cubic foot of resin. The capacity
of a unit when handling normal condensate during extended
operation is equivalent to appro~cimate].y 30 days per polish-
ing tank at 2500 gprn. The expedted capacity of a unit during
startup, bnsed on startup condensate water analysis (Table I.)
before cleaning is required will vary with influent quality
LuL ,~1iou1d ~v~r~gc 32 000 g ]lo, per cubic' fo-~ of rec~n
-6-
PAGENO="0710"
706
This will exhaust a mixed resin bed in about 24 hours of
continuous operation at 2500 gpm . Foll~iing periods of ex~
tended shutdown, corrosion product contamination of the de-
mineralizers will be substantially greater, requiring store
frequent sodium sulphite soaking and backwashing but not more*
frequent chemical regeneration. A sodium suiphite soak and
backwashing of each dernineralizer will be required after pro..
cessing at least 32,000 gallons per cubic foot of resin.
Such backwish requirements may extend for a period of u~ to a
month following an. extended shutdown. The cation and anion.
resins are, stable under design requirements. Mechanical de-.
gradation of the resin will occur from transferring the resin
and will require replacement of the resin at a future time.
A hydrogen regeneration cycle, consisting of sFxlium sulphite~
acid, and caustic treatment, used during stari~up takes approxj-.
n&te~y! ~4O~ min~t.... An `~~~oeAate.d regeneration cyoia conaist-~-~
ing of a hydrogen cycle and axnmoniation, used ~uring normel
operation, takes approximately 600 minutes. ~re total amount
of sluice water required for a hydrogen regeneration cycle is -
approximately 20000 gallons. For an aemoniat~d regeneration
cycle, the total amount is approximately 40,000 gallons. The
* peak rate demanded is 200 gpm. The regeneratij~rt sluice water
source comes from the water treatment demineraljzers or from
the 1,000,000 gallon demineralized water stor~ge tank.
The seismic design classification of the eg1ip~nent is Class
11. Equipment is designed for Zone 1 loads.
The condensate main imfluent and effluent head~ers and piping
to each polishing tank are carbon steel. T~te main resin pipe
is rubber.-lined carbon steel. Thm regeneration and mixing
arid storage tanks, the resin pipi:ig, sluice wz,Lcr piping, over-
I]o~;, and drain-line branch piping is rubber-lined carbon
PAGENO="0711"
707
steel. The dilute and strong acid piping is alloy 20. The dilute
and strong caustic piping is stainless steel. The ammonium hy.
dro~ide and hydrazine chemical feed lines are carbon steel. The
piping is designed, fabricated, inspected, and erected in accord-
ance with ANSI Standared Code for Pressure Piping B3l.l.O.
Two positive-displacement, acid-natering pumps and two positive-
displacement, caustic-metering pumps are -furnished. One acid and
one caustic pump are required to operate in a regenerating cycle
and the other acid and caustic pumps are stanmy pumps. The
acid system is specially designed to prevent backflow of dilution
water into the strong acid line and vice versa * This special
design incorporates a program contact which opens the dilution valve
starting flow of dilution water only When this dilution flow is
established to proper amount, the flow switc»=* contact makes, startin,
the acid pump, and at the same time opens the two acid block valves
and closes the acid line bleed valve. The procedure is reversed
darxi~ sbutd~ Bulk ateae~ eC. 93% sulphuric acid W~so4 and
504 sodium hydroxide (Naoa) is provic~ed by two 6400-gallon tanks
Dilution of acid to 8% and caustic to 4% takes place in mixing tees,~
where the chemical and sluice water are blended. The dilution water
for the caustic is temperature regulated by blending sluiàe water
and hot water from the hot water tank. A 5000-gallon capacity - -
storage tank for 28% aqueous ammonia (N54ou), and three metering
pumps are provided for the resin asurioniating regeneration cycle
Two pumps are required to operate during the anunoniation cycle. -
Dilution, of the ammonia to 6/ ta~es place in a blending tee A
dry sodium su-lplTrte feeder with solu.tion chanher provides liquid
sodium ~uphite (Na2S9~) There are twn sodium sulphite centrifugal
pumps of which one must be in operation during, the `regeneration -
cycle. Dilution of the sodiun-sulphite to.4% takes place `in~a..
blending tee Selector switches and indicating lights are provided
PAGENO="0712"
708
pumps and valves controlled from the Condensate Polisher Control
Panel. Interlocks are provided to that resin cannot be transferr~
fr&n a polishing tank to the regenerating tank while a resin bed
is ~eing regenerated. Another interlock prevents the initiation
or terminates a resin regeneration cycle when the neutralizing
tank level is high. The condensate and feedwater chemical additi~
subsystem is designed to add a.'~raonium solution to maintain the
feedwater pH at 9.4 to 9.5 and to add hydräzine to maintain ~
feedwater oxygen level at 0.0 to 0.005 ppm maximum at 8.7 million
p~~S per hour. The hydrazine is effective at a temperature
range of 1800F to 400°F
The air pressure requirements are 80 peig ~nAnumum and 125 psi.g
maximum. The maximum air temperature is 150°F. The service
air requirement per regeneration cycle is approximately 5 000
* standard cubic feet with a peak flow rate of 180 standard cubic
feet per minute. The air lines are provided with pressure gages,~
regulators, and filters for niixing and motive air supplies. Thej
compressed air system provides a 250 cubtc feet aLz~ receiver
process air to the Condensate Polishing System (reference S D 1
No 10 Instrument and Service Air)
The condensate Polishing System is designed to automatically divel
radioactive regeneration wastes to the miscellaneous waste ho1d-.~
tank (refer to Radwaste NiscellaneOus Liquid System Descriptiàn~
Index No. 45A).. The Condensate Polishers~ Regeneration Station,
lO7Unit Cation Sample Columns, and the Regeneration Sump are
shIelded, with a 12-inch thick concreke wall to the top of the
Condensate polishers to reduce the dose level to 0.5 mr/hr (max.
in the Turbine Building when the radiation buildup in these comp
ents exceeds the allowable level from a primary to secondary sys'
leakage of 10 gal. per day with 0.1% failed fuel. Area radiatio:
monitors are providedwithin this shielded area to alarm abnoumat
radiation levels.
DETI\ILED DESCRIPTION OF SYSTE__
Cornoonents
-9--
PAGENO="0713"
709
j.1 Condensate Polishing Tanks, CO-K-lA, lB. 1C.1D~, in, ip, 1G. 111
The eight Condensate Polishing T~nks (Table 3) are vertical
cylindrical tanks skid mounted `~ ith four polishing tanks per
skid, arranged for parallel flow. Each tank is designed for
2,487 gpo and a pressure of 200 psig. Each tank material is carbon
steel-lined with 3/16 inch thick rubber and contains a mixed
bed of resin (Table 4) which is used to remove dissolved and
suspended impurities from the condensate. Seven tanks are
normally in service with a total flow capacity of 17,400 gpo.
One tank is held in stan~y to replace exhausted resin beds. -
The tank internals consist of stainless steel header with lat-
erals for the inlet, a stainless steel line for the resin inlet,
and a steel header with stainless steel 50 mesh screening for the
under-drain, Limes are provided for condensate influent aria sampl-.
ing resin in air in venting condensate effluent and sampl..
a.u,. resin out sluice water addition and bypass to the con-
denser
* A 12-inch diameter carbon steel strainer is provided in the
* discharge piping of. each polishing tank rated for a differen-
tial pressure of 200 psig. The pressure drop across the strain-
* er is less than.5 psig when clean ata flow rate of 2,500 gpo.
Ea~ch tank is alsoprovided with local influent and effluent
pressure gauges. .
The Condensate Polishing tanks are located in the Turbine Build-
ing at elevation 281' - 6". *
2.1.2 Regeneration Tank, CO-T-2
The regeneration tank (Table 5) is a vertical, cylindrica' tank,
~kic1--mountcd. it is used to receive and regenerote the c>thaust-
-10-
PAGENO="0714"
710
`ed mixed bed resin front a polishing tank. The tank is designed
for 100 psig and a temperature of 1200?. The tank material is carbon
steel-lined with 3/16 inch thick rubber and can regenerate one
mixed bed at a time. Lines- are provided for resin in, air in,
sluice water in, diluted chemical addition, venting, draining and
resin out. The tank contents can be sluiced to the mixing and stor-.
age tank. The tank internals consist~, of an alloy 20 header with
laterals for chemical injection and an .underdrain with~ stainless
steel laterals and screens. The tank is provided with two glabs
sight ports with lights and a blank tee for resin refill or~
removal on resin inlet piping.
The Regeneration Tank is located in the Turbine Building at
elevation 281' - 6".
.1. Y ~ &tes~aqs Tank, CQ-T-3
I
The mixing and storage tank (Table 6) is a vez!tical, cylindri-
cal tank, skid-mounted. It is used to receiv~ regenerated
resin, air mix i~t, rinse it, and store the re5~in. The tank
is designed for 100 psig. The tank material S!~s carbon steel-lined
with 3/16 inch thick rubber and can accept on~ regenerated mix-
ed bed at a time. Lines are provided for resi'n in, air in, venting
s3uice water in, draining, and resin transfer1 A spare ninth
mixed resin bed is stored in this tank, to be dluiced to a pol-
ishing tank as required. *The tank internals lonsist of an
underdrain with stainless steel laterals and $0 mesh screens. The
tank is provided with two glass sight ports with lights and
a blank tee for resin removal on the resin tr~nsfer piping.
The mixing and storage tank is located in the Turbine Building -
~ e1cv~tLiurt 281' - t.
-1 1-
PAGENO="0715"
2.1.5 Acid Storage Tank. WT-T-7 . . .
(
The acid storage . tank (Table 8). is a horizonta * cylindrical
tank used for storage of concentrated 93% su1p~turic acid
(H2S04) The tank provides acid in)ection to ~~oth the makeup
water treatment system and the condensate polishing system
The tank capacity is 6 400 gallons and is des4ned for attnos-
pheric pressure The tank material is carbon kteel-lined with
6 mils of Keysite *100 Lines are provided fo!~ external fill-
ing breather with desiccating cylinder vent with check valve
and suction plus relief return for each of four acid pumps
A liquid level indicator with alarm switches .i~ mounted on
the tank with an air connection
The acid storage.tank. is located in the. Coagulator Building.
-12-
711
2 ~ 4 hot Water Tank CO-T-4
The hot water tank (Table 7) is a vertical, cylindrical tank,
`~ skid-i unted. It is used to heat sluice water for caustic
dilution. The tank capacity is approximately 900 gallons and
is designed for a pressure of 100 psig. The tank material is carbon
steel-lined with Apexior. The tank internals include a 480v,
50KW electric immersion heater used to heat the demineralizecl.
water from 400F to 1800F. Lines are provided for demineralized
water inlet, heated water outlet, and relief. The tank is pro-S
vided with local temperature indicator, . level switch, and
thermostat for temperature control.. . . .. .
The hot water tank is located in the Turbine Building at
elevation 281' - 6~. - .. . . . .. .. . .
PAGENO="0716"
712
2.1.S Acid Polisher Pump. WT-P-l4
The acid polisher pump (Table 9) is a simplex diaphragm type
pump w~Lth a capacity of 130 gph at a rated discharge pressure
of 30 psi. It is equipped with an external relief valve set at
40 psi, suction strainer, manual suction and discharge valves,
and a discharge tap with surge chamber and pressure gauge. The
purpose of the fump is to transfer concentrated sulphuric acid
from the acid storage tank either to the regeneration tank
after passing through a mixing and dilation tee or to the neu~
tralization tank. A spare acid pump CWT-P-~3l) is provided
for both the makeup water treatment system and condensate
polishing system (refer to the Make-Up water Treatment System
Description, Index No. 4c). -:
The pump is driven by a 1/2 hp inotor~ Pump control and indica-
tion is from the Condensate Polisher Control Panel * The pump
is pàwered fr~ 14CC 2-311). - The pump La located in tb.e Coagula I
tor Building on top of the acid storage tank*
2.1.7 Caustic Storage Tank, WT-T-8
The caustic storage tank (Table 10) is horizontal, cylindrical
tank used for storage of 50% sodium hydroxide (NaOH). The tank
provides caustic injection to both the makeup water treatment -
system and the condensate polishing system. The tank capacity
is 6,400 gallons and is designed for atmospheric pressure. The
tank material is carbon steel lined with 12 mils of Keysite
#740. Lines are provided for external filling, vent, and suc.
tion plus relief return for each of four caustic pumps. The
tank internals have a 5KW electric heater to maintain the
-13-
PAGENO="0717"
713
caustic:solution heated to ~ Aliquid level: indicator
with alarm switch a temperature indicator and a temperature
controller including a low level cutoff for heater control are
mounted on the tank.
The caustic storage tank is located in the Coagulator Building.
2.1.8 Caustic Polisher Pump, WT-P-13~
The caustic polisher pump (Table 11) is a simplex diaphragm
type pump with a capacity of 160 gph at a rated discharge
pressure of 30 psi. It is equipped with an external relief
valve set at 30 psig suction and discharge isolation valves
and a discharge tap with surge chamber and pressure gauge.
The purpose of the pump is to transfer caustic from the
caustic storage tank either to the regeneration tank after
paSsiag~. t2~romgb~ a. mixing. and ifilution tee or to the neutrali-
zation tank A spare caustic pump (WT-P-.l2) is provided for
both the make up water treatment systen and condensate pol-.
ishing system (refer to the Make-Up Water Treatment System
Description Index No 4C)
The pump is driven by a 1/2 hp motor. Pump control and mdi-.
cation is from the Condensate Polisher Control Panel The
pump is powered from MCC 2-31D. The pump is located in the
Coagulator Building on top of the caustic storage tank
2.1.9 Aqueous Ammonia Storage Tank, AN-T--6
The aqueous ammonia storage tank (Table 12) is a horizontal,
cylindrical tank used for storage of 28% aqueous ammonia.
-14-
PAGENO="0718"
714
* The tank provides ammonium injection for the condensate po].~
ishiz~g system regeneration cycle. The tank capacity is 5,000
gallons and is designed for atmospheric pressure. The tank
material is unlined steel. Lines are provided for ~i1lIng,
vent, and suction plus relief return for each of three aqueous
ammonia pumps. A liquid level indicator with alarm switches
is mounted on the tank with an air connection.
The aqueous ammonia storage tank is located in the yard area
on the south side of the Coagulator Building.
2 * 1.10 Aqueous Ammonia Pumps, AM-P-4A, 43, and 4C
The aqueous ammonia pumps (Table 13) are positive displacanent
type metering pumps with a capacity each of J~9gph at a rated
discharge bead - of 40 fit. They are ecpdpped with exter-
nal relief valves set at 50 psig.,suction strainer, manual suc-
tion ari& discharge isolation valves, aed a diLcharge tap- with ~
surge chamber and pressure gauge. -
The purpose of the pump is to transfer comcen at~d aqueous
ammonia from the aqueous ammonia storage tank to the regenera-
tion tank after passing through a mixing and ~ilution tee.
Two pumps are operated during the regeneratioi cycle with the
third on standby.
The pumps are driven by 1/2 hp. motors. Pmnpt control and in-
dication is from the Condensate Polisher Conti~o]. Panel. The
pumps are powered from MCC 2-31D. The pumps ~re located
in the yard area on top of the aqueous ammonia storage tank
south of the Coagulator Building. *
-15-
PAGENO="0719"
715
2.1.11 Sodium Sulphite.Feeder and Storage Tank, WT-M-l and W~~-T-3.1
The sojlium sulphite feeder and storage tank (Table 14) in-
eludes a dry sodium sulphite storage hopper, a notor driven
dry feeder, and a solution chather with mixer. The dry sodIum-
sulphite is mixed with demineralized water from the demineral-
ized water storage tank into a saturated solution. The sodium
suiphite solution is used to remove iron impurities during the
regeneration cycle. The tank capacity, is 50 gallons and is
designed for atmospheric pressure. The tank is carbon steel~
Lines are provided for denineralized water addition, overflows
drain, and suction to the two sodium suiphite pumps. The tank
internals include a make up water float valve and portable
1/4 hp motor driven mixer.
The sodium sulphite feeder and storage tank are located in the
Coagulatoiz ~u;ld1ng-
2.1.12 Sodium Sulphite Pumps, WT-P-l5A and 153
The sodium ~u±~J~te pumps (Table 15) are centrifugal type pumps
with a capacity each of 6 gpn at a discharge pressure of 30 psig..
They are equipped with manual suction and discharge isolation
valves, discharge check valve and a discharge rotoneter, rate .
setter, and flow gauge.
The purpose of the pumps is to transfer sodium sulphite from
the sodium sulphite storage, tank to the regeneration tank after
passing through a mixing and dilution tee.
-16-.
PAGENO="0720"
716
The pumps are driven by 3/4 hp motors Pump control and inch-
cation is from the Condensate Polisher control Panel. The -
pumps are powered from MCC 2-311). The pumps are located in the
Coagulator Building. -
2.1.13 Condensate Polisher Regeneration Sump end Pumps, WT-P-19A andB
The condensate polisher regeneration sump is a stainless steel
lined concrete vault used to receive the liqaid wastes from
either the Condensate Polisher System (if pH within limits) and/or
from the Control Building Area and/or the Turbine Building flopr
drains (if radioactivity in these sumps exceeds limits). The camp
dimensions are 10' x 10' x 3'-G" deep with, a capacity of 2600 ~allor~
The purpose of the sump is to route radioactive liquid wastes
to the Miscellaneous Waste Hold-Up Tank The two condensate
polisher regeneration sump pumps (Table 16) are vertical duplex
type sump pumps Each pump is rated at 200gpm at a total dis-.
charge head of 80 feet Each pump is driven by a 10 hp motor
Costrol and iadicat.ion is provided locally Pump W~~-P-I9A is
powered from MCC 2-3Th and pump VT-P-19B is powered from MCC2~.71A
2.1.14 Ammonium Hydroxide and Hydrazine Feed and Measuring Tanks,
AM-T-l. 2, 4, 6
The amrnonium h~rdroxide and hydrazine feed and. measuring tanks.
(Table 17) are vertical, cylindrical tanks, skid mounted. The
tanks are used for feedwater chemical treatment.. The feed tanks.
have a capacity'of 150 gallons each and the measuring tanks
approximately 6 gallons. The tank material is 1/8 inch stainless
steel. - Lines are providea for manual pump filling, chemical
pump suction, relief return, venting, overflow, draining, measur-
ing tank interconnection and demineralized water addition. The
amtnônium hydroxide feed tank only has a chemical injection line.
The tanks include local level gauge, and level switches.
-17--
PAGENO="0721"
717
The anusonium hydroxide and hydrazine feed and measuring tanks
are located in the Turbine Building at elevation 281 -6"
2 * 1.35 Ammonium Hydroxide and Hydrazine Feed Pumps * AM-P-lA, 15 and 2
The anmcniuin hydroxide and hydrazine feed pumps (Table 18) are
simplex diaphragm, positive displacement type pumps of cast-iron and
316 S .5. respectfully, with a capacity of 15 gph at 180 psig. Each
pump is equipped with an external relief valve set at 250 psig,
pneumatic stroke adjustor, suction strainer, manual suction and
discharge valves. The hydrazine feed pumps (AM-P-lA and 15),
supply hydrazine. to the Condensate and Peedwater System (refer
to System Description, Index No. 7A) for oxygen control and
the ammoniun hydroxide feed pump (AM-P-2) supplies anmonium
hydroxide for pH control by transferring these chenicals from
their respective feed tanks to the feedwater at the effluent
line of the condensate polishers
The pumps are 5rfven hy Z/4~ ?ip notors~ Pemp controls are auto-
matic from a Recorder Analyzer Panel. 310 (refer to Secondary
Plant Sampling System, Index No. 12). Nanual shutdown control
and indication is provided from the Control Panel 305. The
pumps are powered from MCC 2-31D. The pumps are locá'ted in
the Turbine Building on top of theirrespective feed tanks.
2 1 16 Ammonium Hydroxide Mix Tank ATI-T-7
The axnmonium.hydroxide mix tank (Table 19) is a vertical,, cylin-
drical tank used as a spare source of ammonium hydro,cjde for
feedwater chemical treatment if the ammomium hydroxide feed
tank (AM-T-l) and/or the ammoniurrt hydroxide feed pump (z~1-p..2)
are out of service. The tank has a capacity of 60 gallons and
is designed for atmospheric pressure. The tank material is
:3/16 inch stainlesssteel. Lires are provided for aqueous ammoni
injection, venting, draining, demineralized water for dilution,
samplinc~ and chemical discharge. The t~1~ is provided with local
level cjaugc.
-17a~-
48-721 0 - 79 - 46
PAGENO="0722"
718~
The ammonium hydroxide mix~ tank is located in the Turbine Build-S
ing at elevatiOn 281 - 6"
2 1 17 Amrnonium Hydroxide Mix Tank Penn AM-P-3
The axnmoniUm hydroxice mix tank pump (Table 20) is a simplex
diaphragm, positive displacement type pump with. a capacity of 10
gph at 275 psig. The pump is equipped with manual suction and~
discharge valves and a discharge check valve. The purpose of
the pump is to transfer anmtonium hydroxide from the ammoniun
hydroxide mix tank to the condensate polishers effluent piping.
The pump is driven by a 1/6 hp motor Peep control and indica.
tion is local. The pump is powered frcsa NPT-1A. A local
"ON-OFF" control switch with overcurrent trip is provided. The
pump is located in the turbine Building at elevation 28].'-6~.
2 1 18 Major~$ysten Valves
Condensate Polishing Tanks_Influént Valves M81 and ESiny through--i
N~l and MI1BY for Tanks CO-K-lA through CO-K-fl!
Each condensate polishing tank has a 150#ASA Influent double acting
air motor operated 12" butterfly valve and 1 bypass diaphragm
operated ball valve. The bypass valve is opened first to equalize
the pressure across the larger.valve. These valves are controlled.
locally from the Condensate Polisher Control Panel. Air is
supplied from the Service Air System. The influent valves
fail as-is on loss of power or air and the bypass valves fail
open.
Condensate Polishing Tanks Effluent Valves M82 through Ml2
* For Tanks CO-K-lA through CO-K-1H *..
Each condensate polishing tank has a 150 #ASA effluent pneu-* -.
)t~')! or~ratr~1 12 hutte~fly valve wlt~i positi&~er IndIcation
-1)b-
PAGENO="0723"
719
"used to balance the condensate flow These valves are controlled
locally or from the Condensate P0L.&zer Control Panel Air is
supplied from the Service Air System. These valves faiI~ as-is on
loss ofVpoweror air.
* Condensate Polishing Tank Recyclin~ Valves, 1486 through Ml6
for-Tanks CO-K-lA through C0-K-1H and MC-Z
Each polishing tank has a 150 ~ASA pneumatic motor operated 8" balI.
* valve which is used to recycle high conductivity condensate
flow* through the polishing tanks back to the condenser.
Additionally, a pneumatic motor operated 3" ball valve is
- provided to isolate the condensate polishing system from
the "H condenser These valves are controlled locally or
from the Condensate Polisher Control. Panel. Air is supplied
from the Service hir System. These valves fail as-is on loss
of power or 3.oss of air
Coade~sat~. Eo1ishin~ Tank Resin Transfer Valven, M83, M~5,
1488 hnd 1489 through 1413 1414 MiS 1418 and 1419 for Tanks
CO-K-lA through C0-K-lH
- Each polishing tank has the following pneumatic ball valves to
transfer resins to the regeneraticrt tank (C0-T-2) and receive
resin from the mixing and storage tank (C0-T-3)
* (Typical for Tank CO-K-lA) -
a. Tank Vent - 1483, 2" -
b Transfer air - 1484 2
c. Resin in -. 1485, 2½" - -
d Sluice Water - 1488 2
e. Resin out -1489, 2½" -
Local and Condensate Polisher Co~trol Panel controls are provided
for nanunl or automatic regeneration transfer cycle. Air is sup-
plied from the Servièe -Air Sye~o~-. These va~1ves fail fis-is -on loss
- of power or air.
- -3M-
PAGENO="0724"
720
* Regeneration Tank Resin Regeneration Valves, Cl, C2, C3~ç~,
C6, C~7, C8, C9, dO, Cli, C14, Cl5, C16, and C17
The regeneration tank has t~ following 1254k diaphragm double act-
ing operator to transfer and. regenerate resin:
a resin in - Cl 2½"
b. resin return - C15, 2½"
(from mixing and storage tank)
c air in -CII 1½" andC6 2"
d sluice water - C16 1½ C14, 3" and C5 3"
C7,2'
e ammonia injection - C17 1½" and C2 1½'
f dilute caustic in - C9 2
g dilute acid in - C3 2"
h. resin out C8, 2½"
i sodium sulphite in - ClO 3
I
These valves are controlled from the: Condensate Poifs?iér Con-.
trol Panel and can be manually or autonat3.c~lIy actuated for a
regeneration cycle Air is supplied from the~Service Air
System. These ualves are air toopen and cloE~e~
~ and Storage Tank Resin Transfer Va1vès.~ Si, 55, S7,
SB and S9
The mixing and storage tank has the following 125# diaphragm double
acting operator valves to rinse, mixand tra$fer resin:
a. air in -SI, 1½', S7. 2"
b. siuice water in - S5, 3", S9, 1½"
c. resin out - S8, 2½'
These valves are controlled frort the Condensate Pplisher Control
pnn-j ~`1 nnhe mar~u~tl1y or auto~aticnlly actuated for a final
-19-
PAGENO="0725"
721
rinse cycle AIr is supplied fron the Service Air System
These valves fail closed on loss of power or air. -
Chemical Injection Valves, RiP through R12P
The chemical injection, lines teed to sluice water lines have
125# diaphragm double acting operator control valves either to
dilute and route chemicals to the regeneration tank (Co-T-2)
or to route concentrated chemicals to the neutralization tank'
(wT-T--9). The fo].lowing groups are associated with each chemi-
cal in3ection
a * Acid injection, RiP through R4P, . ..
b. Cai~m tic injection, R5P through R8P
c. Sodium sulphite injection, R9P through RiO?
d. Ammonia injection, Rh? and R12P
These valves are controlled from the Condensate Polisher
Control Panel and can be manually or automatically `actuated
for a regeneration cycle. Air is supplied from the Service
Air System. These valves require air to open' and close except
`for R3P and R7P which are spring to open and `air to close an~
R5P, R6P, and B8P, which are air to open and spring to close.
Liquid Waste Discharge Val~~, C4, Cl2., Cl3, ~, S4, ~
SlO, Xl, and X2 , `. `
The regeneration liquid waste have the following l25~ diaphragm
double acting operator control valves to route these wastes to. -
either the drain pot or to the high conductivity regeneration
waste discharge line:
-`U-
PAGENO="0726"
722
a. air to drain pot C12 2". and S2, 2~
b. regeneration tank wastes - ~l3, 3" and C4, 3"
c. mixing and storage tank wastes S4. 3" and 56, 3"
d. sluice water *. Sb. .2"
e. drain pot transfer valve Xl, 3"
f. regeneration waste transfer valve - X2, 3"
These valves are controlled from the ~ndensate Polisher
Control Panel and can be manually or automatically actuated
for a regeneration cycle. Air is supplied from the Service
Air Systen. These valves require air to open and air to close.
Regeneration Waste Effluent Valves w'r-v-iis and ~qT-v-l1g
* ~ 3:*TT~!,.. }5e.}.~ PINSI, 200PP, diaph*a~ operated- two.-poei-.
tion valves are used to route regeneration waste with high
conductivity * to the neutralization tank (WT-V-llS) or
to the miscellaneous waste hold-up tanks (WT.V-1l9) if radio-
* activity level of the solution is high. These valves are con-
trolled by a radiation detector (WT-R-3894) which monitors
the radioactivity level of the regeneration waste. If the
radioactivity exceeds the set pOint, the radiation monitor
ccntrol will shut valve WV-V-lbS and opes valve ~T-V-fl9.
* A local control switch is provided to~ override the radja-.
tion monitor and open or shut either valve. These valves
fail closed on loss of power or air. *
-21- -
PAGENO="0727"
723
Regenerant Sump Effluent Valves WT-V-115 and WT-V-l2l
Two 4 pinch, 150 lb J~NSI, 2000F, diaphragm operated, two posi-
tion valves are used to route the discharge from the Conden-
sate Polisher Regeneration sunp pumps either to the mechani-
cal draft cooling tower. (WT-V-1l5) or to the miscellaneous
waste hold-up tank (WT-V-l2l), if the radioactivity level of
the solution is high. These valves are controlled by a radia-
tion detector (WT-R-3895) which monitors the radioactivity
level of the regeneration sump pump discharge. If the radio- ~-
activity exceeds. the set point, the radiation monitor con-S
trol will shut valve WT-V-llS and open valve WT-V-l21. A
local control switch is provided to override the radiati on
monitor and open or shut either valve. These valves fail
closed on loss of power or air.
Miscellaneous Valves
Valve I'IC-l is a 2½ inch pneumatic actuated valve used to drain.
the condensate polishing tanks to the condensate polisher re-
generation sump. .
Valve BV-l is a 2 inch pneumatic actuated valve controll~d
by thernostat (CS-TE) and used to regulate the sluice water
temperature @ l200F for dilution of concentrated caustic.
Valves PR-i & 2 are 2 inch pneumatic pressure controlled
valvea used to regulate the air supply lime header pressure
@ 15 psig to pass 140 SCFM to the condensate polishers and
regeneration station.
-27--
PAGENO="0728"
724
Instruments, Controls, Alarms, and Protective Devices
Instri%entation is provided locally and at the Condensate
Polisher Control Panel for monitoring the operation of the
system. Full control of all functions in the condensate
polishing system is possible from the Condensate Polisher Con-
trol Panel, which also contains process control instrumentation
and a graphic representation of the process. Each pump and
pneumatic valve has indication and control from the control
panel
Condensate Pollb u.ng Tames Instrumentation
The condensate polishing tanks flow rate, pressure drop, and
water quality influent and effluent conductivity is continuous-
lyrnonitored with the system in service. Flow orifióes (rn-FE
and O1!-F~, ~low trirnsmittem (lB-PT andOIL-PT~, a.f]~m *~:~
recorders (lB-FR and OR-PR) indicate and integrate the flow
rate of the system. The pressure drop is measured and recorded
with instruments (H-DPT and H-DPR) and local indicator gauges
(H-PIl and 2) provide influent and effluent pressures. Sam-
ples are obtained in the condensate influent and effluent pip-
ing and routed to the cation column (CO-G-l) for conductivity*
measurement. Each condensate polisher is equipped with a
solenoid enclosure which is a local control panel for valve
indication and control. Each valve controlled from the panel
has an "OPEN-AUTO-CLOSE" Control Switch. This allows local
control of each condensate polisher tank.
-23-
PAGENO="0729"
725
A mixed ~bed resin bed, as previously mentioned, is exhausted
when a predetermined measured total flow has passed through
a polishing tank, a high pressure drop occurs across the sys-.
tern, or when the tank effluent coiductivity exceeds a pre-.
determined allowable level. Each condensate polishing tank
has a flow orifice, transmitter, and recorder point to inea-.
sure, indicatie, totalize, and record. the flow rate of each
tank. Each tank has a sample connection, routed to the
cation column (CO-G-l), on its discharge line for conductj-..
vity measurement. Additionally, each tank has local pres-.
sure gauges on influent and effluent piping and differential
pressure gauges across the resin traps to monitor tank and
trap pressure drop. .
Resin Transfer and Regeneration Cycle Control
The mixing and motive air supply is provided with flow mdi-.-
cators (RS-FI l&2) to pass 140 SCFM ® 80 psig, filters, plus
local (RS-PI l&2) and remote pressure gauges (RT-PI & ST-pi).
The sluice water supply is provided with flow orifices and
indicators to monitor locally the flow to the polishing tanks
(RS-FX-6), locally the total flow for the regeneration cycle
(RS.-Fx-3) remotely the flow for dilution of caustic (Cs-FE,
FT & FSIR), and remotely the flow for dilution of acid (AS-FE,
FT, & FSIR).
Local indicators for caustic, acid, and sodium sulphite lines
are provided to monitor flow.
-24-
PAGENO="0730"
726
The two pen conductivity recorder, with three points for each pen, ~`~`
on the Condensate Polisher Control Panel indicated the conductivity:.:
of chemical waste in the regeneration and mix and storage tanks
An identical two pen recorder is provided - for conductivity indication
in the dilute acid and dilute caustic lines. ~. .
The regeneration waste conductivity instrument controls the diversion1
of chemical waste (high conductivity), to the neutralizer tank, and
other waste water (low conductivity) to the water. treatment suap :"
through the, operation of two pneumatically operated valves. *`
The controls of the regenerating station of ~ATC" Timers, re3.aj!s and
pneumatic solenoid valves. The length of each step in the regeneratE
sequonce (which can be fully automatic except for resin exchange)' is
determined by adjustable individual step timers At the end of th~
allotted tine for an individual step the timer energizes the next
timer for the following step
Temperature control of caustic dilution water is mainta~i.ned by a
thermesta.t. pisond. in. the hot water tank and a temperature element ~
(cS-TE) monitoring the dilute caustic and"controlLing the bieni
valve which mixes the hot and cold water to maintain llO°p.
Condensate Polisher SUmP Pumps Control . .
Level control of the suinp pumps is provided by local "OFF-AUTO-STARe
control switches (spring return to ATJrO). In "AUTO", level switches
(WT-LS-3884-l, 2 &3) monitor sump level and start a lead pump on big~
level. A high high level starts the standby pump and alarms on Pane~
* 304. Low sump level stops all running pumps~ Status of lead `and"
stand-by pumps is automatically interchanged for every cycle of `
operation. - ` -
Condensate and Feedwater Chemical Feed - Control - . -.
The automatic controls for the amzrtonium hydroxide and hydrazine
subsystem are provided from the Secondary Sampling System (Refer to
S.D. Index No. 12). A pneumatic to electric converteris
-25-
PAGENO="0731"
727
provided in the Makeup Water Treatment Control Panel and a
`HANL~-OFF-AUTO" control switch for pump controls except for
ammonium hydroxide nix tank pump (AM-P-3) which is locally
controlled with an "ON-OFF" swiich. -.
Radioactive Waste Discharge Control
A radiation monitor is provided in the discharge waste line from
the Condensate Polishing Regeneration Station to the Neutraliza-
tion Tank tWTR-R-3894) and from the Condensate Polisher Regen.
eration Swap discharge line to the Mechanical Draft Cooling
Tower Blowdown (WT-R-3895). The radiation monitors provide
input s3.gnals to the 2.ndlcatlng controllers (WT-Rr & FES-3894
*& 3895) to reposition control valves WT-V-l18/].19 & 115/121
to route the waste effluent to the Miscellaneous Waste Hold-Up
Tank on exceeding 10 mr/hr.
The alarms provided on the Condensate Polishe~ Contràl Panel
are listed in T~ble 21. There is a conason alj~rm "Condensate
Polishing System Trouble" annunciated in the control room on
turbine auxiliaries monitoring Panel 17 that ~.s ~nnuncjated by
the actuation of any alarm on the Condensate k~olisher Control
Panel.. -
Protective Devices
The hot water tank is equipped with a 3/4" high pressure
relief valve PSV-3 set ® 100 psi. A 2" high ~pressure relief
valve (PSV-l) set @ 100 psig is provided for ~the resin outlet
from polishers line and for the resin inlet to polishers line.
The positive displacement chemical pumps are fitted with dis-
charge r~eli.ef valves set at 40 psig.
-2~a-
PAGENO="0732"
728
Area radiation monitors adjacent to the polishers are provided
as an early indication of a radioactive build-up in the p01-
ishers due to primary to secondary leakage in the steam gener-
ator tubes. Radiation mon.itors monitor radioactivity levels in
the regeneration wastes lines to the neutralization tank and
from the condensate polisher regeneration sump discharge line.
3 0 PRINCIPAL MODES OF OPERATION
3 1 Sta~~p
To start up the condensate polishing system chemically charge
the mixing bed resins The regeneration tank is filled with a
resin bed and regenerated twice to bring the resin to full
capacity After all eight polishing tank resin beds and the
spare resin bed in the mixing and storage tank have been mi-
tially charged line up the influent and eff'uent valves on
seven polishing tanks for parallel flow frcea!a condensate
pump die z~e~ to the outlet of the th~r~ etjge feeda~ater ?~
heaters FW-S-6A/6B (reference Feedwater and londensate System
Description Index No. 4A) and recirculate bac{k to the con-
denser
Initially, with the given startup influent co~ndensate water~
analysis (Table 1) a polishing unit will ave~age 32,000 gallons
per cubic foot of resin before chemical cleaning will be re-
quired. The resin transfer will them be inantially initiated
to the regeneration tank and the spare resin ~bed is manually
transferred to the empty polishing tank. Th~ automatic re- -
generation seg~zence may not be initiated for fsodiu~n sulphite
addition, soak, rinse and backwash. At this~point, an alarm
annunciates completion of this portion of the regeneration
cycle. The resin is now transferred to the mixing and
storage tank for air mixing, rir.ting, and storage as a spare
resi.n bc'~.
-26-
PAGENO="0733"
729
The condensate and feedwater chemical feed is àtartec~ up by
turning on a hydrazine and aamoniuxn hydroxide pumps on AUTO.
The chetnical feed tanks are first filled including the measur-
ing tanks. Thepumps are controlled from Recorder-.- Analyzer
Panel 310 (refet to Secondary Plant Sampling System Description
Index No. 12).
3.2 Normal Operation **
During normal operation, the condensate polishing . system de-,
mineralizes the discharger flow from two condensate pumps with
seven polishing units in service. The eighth polishing -unit
is in standby to replace an exhausted resin bed as required.
with the assumed normal influent condensate water analysis
(Table 1) a polishing unit will average 160.000 gallons per
cubic foot of resin before chemical cleaning and chemical
regeneration W±~1 ~be requized~ Manual tr~&fer of the~ rea*u
and sodium sulphite soaking is performed as described in
Section 3.1. After conpletion of the sodium sulphit& portion
of the regeneration cycle, automatic pushbutton selection is
available for caustic injection, rinse, acid - injection, and displace-
* merit. At this point, the operator may select partial or full.
bed ammonia injection and displacement followed by resin
tt~ansfer to the mixing and storage tank for air mixing, - -
rinsing and storage as a spare resin bed
The hydrogen regeneration cycle consisting of sodium sulphite
acid and caustic treatment takes approximately 400 minutes.
An anmoniated regeneration cycle, consisting of a hydrogen
cycle and aminoniation, takes approximately 600 minutes. Either
regeneration cycle can be normally Performed automatically as
selected. . .
-27-
PAGENO="0734"
730
The total amouritof sluice water required for a hydrogen re-
generation cycle is approximately 20,000 gallons; for an aminon-
iated regeneration cycle, the total amount is approximately
40,00Q gallons. The peak rate demanded is approximately
-
200 gpo.
The condensate and feedwater chemical addition subsystem is
*
normally in-service with one of two hydrazine pumps on and the
arimonium hydroxide feed pump on with both controlled from
the secondary plant sampling system. A hydrazine and an -
ainmonium hydroxide nix tank pump are available for manual
backup.
3.3
Shutdown
The condensate polishing units are in operation as long as a
condensate pump is in operation. ~Then all condensate/Conden-
sate booster pump pairs have been stopped, th~ influent arid
effluent valves to the condensate polishing t'anks are closed.
The -~a~ are .ã~ne~ incad~sg the rege~e~t~Lon and. ~,j3-~g.:
arid storage tanks plus the system piping.
The condensate and feedwater chemical additio
subsystem is in
operation as long as a condensate pump is in
When all condensate/condensate booster pump p
Formal operation.
sirs, have been
*
stopped, the hydrazine and ammonium hydroxidechenical feed
pumps are stopped.
3.4
Special or Infrequent Operation
3.4.1
Resin Removal and Replacement -
The demineralizing ability of the polisher resin diminishes through,
continuous use and through mechanical abrasidp fran transfer of
the resin during regeneration. When a resin bed is no longer
capable of demineralizing the condensate efficiently, it is re-
moved through a blank tee at the regeneration tank and disposed
of via the TMI I soI~id radwaste disposal system. A new resin
bed ir; eddc~3 Lhrouqli the same tee connection.
-28-
PAGENO="0735"
731
Emerg~y
If an underdrain screen breaks in a condensate polishing tank,
the resin will be trapped in a resin trap which prevents the
resin fx~orn getting into the feedwater and condensate system.
An alarm for high differential pressure across the resin trap
will sound when sufficient resin has been carried into the trap.
The polisher is to be taken out of service immediately and the
underdrain screen must be repaired.
4 * 0 HAZARDS AND PRECAUTIONS .
When the conductivity of the effluent from a condensate polishing
tank or from the condensate polishing system reaches a preset level,
an alarm is actuated. The conductivity of the effluent o~ a conden-
sate polisher, or of the condensate polishing system, must be reduced
to an acceptable operating level immediately because the high conduc.
tivity effluent will contaminate the Condensate and Feedwater System.
Hazards associated with this system are those encountered with
clemrcar sorutions CautiON nt~t be takezr 1.~eit work*zTg~ wit~r eaustie
or acid These chenu.cals cause burns wi.th skin contact Adequate
protection mu~t be provided and any bodily contact must ~e immediately
flushed with fresh water and medically checked.
The nominal heat tracing temperature for 50% caustic lines must remain
below 100°F to preclude caustic stress corrosion cracking of piping.
Th~ maximum caustic concentration in the C~austic Storage Tank (wT-T-.
8) will be about 52%. At such a concentration, caustic soda water
solution starts~ to crystallize at approximately 700?.. Precautions
should be taken so that the temperature of the tank and piping
remains above 75~F and below lO0~F.
-29-
PAGENO="0736"
732
TABLE 1
INFLUENT CONDENSATE WATER ANALYSIS
EXTENDED
NCRNAL OPEBATION (pp~) STARTUP (ppb)
Fe (Soluble) 5 40
Fe (insol.) 20 1000
Cu (Soluble) 5 50
Cu (Insoluble) 10 500
Heavy Metals 0 - - -
Cl 5 5 55; 100
Si02 10 500
pH 9.5 ~* 9~5*
CQ4i~ctL~tt.ty L~hQa1 10 -- - 10
Total Solids 60
- S -~ (Normally 200)
- S 1-~
-30-
PAGENO="0737"
733
TABLE 2
EFFLUENT CONDENSATE V~ATER QUALITY.
Total Dissolved Solids, ppb 25
Total Suspended Matter, ppb * 25
Dissolved Silica,~ppb 5
Total Chloride (As Cl), ppb 5
Total Iron (AS Fe) ppb 10
Total Copper (AS Cu), ppb 2
Total Heavy Metals, ppb 0.0
Sodium, ppb 20
48-721 0 - 79 - 47
PAGENO="0738"
734
Identification
Number installed
Vendor
Design pressure, psig
* Design temperature,
Design flow rate, gpzn
Size, diameter x height
Lining, rubber, in.
Material
Thickness, in.
Manhole, I.D., in~
Design Code
Co~ ~~amp
Number
Size
shell, in;
inlet, in.
outlet, in.
Material
Screen size, mesh
Design Pressure, psig
Design Pressure Drop
Clean, psig
Classification
Code
Cleanliness
Quality Control
* TABLE 3
POLISHING TABKS
CO-K-IA to CO-K--1H
eight
LeA Water Treatment ~oznpany
200
200
2,487.
8*X5s
3/16 -
Carbon Steel
11/16 *
21 ..
Section VIiI, ASME Code for Unfir~
- Pressure V~ssels
18
12
12
Carbon
50
200
5
CONDENSATE
Yes
STRAINER
8
I
Ste~
*1
C
B
4.
11
-32--
PAGENO="0739"
735
* ... ** `I~BLE4
MIXED BED RESIN
No. of Charges
Total Volume/Charge, ft3
Cation Resin
3
Cation Volume, ft
Resin Size, mesh
Regenerants . -
Introduction Strength
Anion Resin.*
3
Anion Volume, ft
Resin Size, mesh
Regénerants
Introduction. &t~tb
Temperature Max.,
Operating Temperature,
Reducing Agent
Introductioh Strength
9-
147 -
200 C Amber].ite
81
40
~2~°4' NH4
~ ~4
.900 C Amberlite
66
40
Na 0~I; H4
~ NaOH; ~ NE4
140
135
Na2SO3
4% Na2Sp3
PAGENO="0740"
736
TABLE 5
REGENERATION ThN1~
Identification
Number Installed
Manufacturer
Design pressure, psig
Design Temperature,
Size, diameter x height
Lining, rubber, in.
Material
Thickness, in.
Manhole, I.D., in~
I~es1~Tr Ca~
Code Stamp
Classification
Code
Cleanliness
Quality Control
S~ismic
C0-~T-2
one-
Calif. Tank & Nfg. corp.
100 .- - -
120
S'6~ x lO'6~ -:
3/16 -
Carbon Steel
57l6~
18
~ect~Lcm.VT.II, ASME Code~~
Icr :~e~~e ~v
Yest
- :1
4
II
.34.
PAGENO="0741"
737
TABLE 6
~XING'AND STORAGE TANK - -.
Identification
Number Installed
Manufacturer
Design Pressure, psig
Size, diameter x height
Lining, Rubber, in.. -
Material
Thickness, in.
Manhole Size, X.D., in.
Design Code
Cot~e- Sta~p~
Glassification
Code
Cleanliness
Quality Control
Seismic
CO-T--3
one
Calif. Tank & Mfg. Corp.
100
5'-6" x lO'-9"
3/16
Carbon Steel
5/16
18
Section VIII, ASME code for
unfrred pressure vessels
Yes~
:1
4 1
II :
PAGENO="0742"
738
TABLE 7
HOT WATER TANK
CO-T-4
one
L*A Water Treatment Co.
936
4'-6 x 7'-3'
* Carbon Steel
~rapbitie Carbon
1/4
180 *
100
* .012
* ASME~ Section VIII & X~;
Yes
Identification
Number Installed
Manufacturer
Capacity gallons
Outside diameter length
Shell Material
Lining Material
ck, mils
Shell thickness, ~ V
Design Temperature, °F.
Design pressure, psi
V Corrosion Allowance,- V~fl~
I~esign Code **V~ V
Code Stamp required
V Heater V
Manufacturer V V V
Type V V
Model No. V V V
V capacity, kw
V Power Requirements
V V Power Source
V Classification V V V
V Code
Quality Control
Seismic
Cleanliness
chrc~alox V
V insertion V
43-SST-854 V V
* 480V, 3~, 6OHz~
V - MCC 2-3lD V
V V V Level V V
4
V * ii:
B
PAGENO="0743"
739
TABLE 8
~ID STORkG~ TANK
Identification
Vendor
Capacity - gallons
Installation
Outside diameter length
Shell Material
Lining, Key site #100, mile
Shell Thickness, ~
0
Design Temperature, F
Design pressure, psig
Corrosion allowance, inc.
r7~s~gTT C~
Code Stamp required
Classification
Code
Quality Control
Seismic
Cleanliness
WT-T-7
L*A Water Trea~trnent Co~
6,400
One
x l51_O~1
Carbon Steel
6
3/8
& Ix
10
ASIiE~ Sections viii
Noj
LeVJ
-37--
PAGENO="0744"
740
TABLE 9
ACID POLISHER PU~
~ Detai~
Identification - WT-P~1
Number Installed one
Manufacturer chen~con
Model No. fl6O-A20~135
Type Simplex, diaphragm
Rated Speed, strokes/mm. 135
Rated Capacity, gph 130
Rated Discharge Pressure, psig 30 -
* Design Pressure, casIng, psig 50
P1es1~9P~ Tes~perat~rQ-,-
Lubricant/Coolant Oi11~'luid
Mm. Plow Requirements. gprn 0
Motor Details
Manufacturer G.E.
Type - Induction
Enclosure DP
Rated Horsepower 1
Speed, rpm * 1,72s
Lubricant/Coolant Oil/Air
Power Requirements 480V,3%, 60Hz, 3 amps (Pu]
Load Current)
Power Source MCC 2-31D
-$8-
PAGENO="0745"
741
*~i~BLEl0
~USTIC STORAGE TANK.
Identification
Vendor
Capacity - gallons
Installation
Outside diameter x length
Shell Material
Thickness, in.
Lining, Keysite #740, mils
Shell Temperature,
Design pressure, psig
Corrosion allowance, in.
Design code
eo~ Stamp req~ire~.
Heater
Manufacturer
Type
Model No.
Capacity, Kw
Power Requirements
Power Source
Classification
Code
Quality Control
Seismic
Cleanliness
WT..T~.8
L*A Water Treataent Co.
6,400
one
8'~0" ,c l5'-~O"
Carbon Steel
3/8
12
10
ASME, Sections VIII & IX
No
Chromalox
* Immersion
TM SS-3O6OSSLT
* 5
480V, 30. 60 Hz
NCC 2-31D
* Le~re1
* C
4.
II
D
PAGENO="0746"
742
* -. TABLE 11
~r~r retr~~
Identification
Numbei~ Installed
Manufacturer -
Motor Details
Manufacturer
Type
Enclosure
Rated Horsepower
Speed, rpm
Lubricant/Coolant
Power Requirements
Power Source
)~T.-P-13
1
Chemcon
1l6O-'3l6S~..13~
Simplex diaphragm
l35~
160
50 -
QilfttIuid:
0-
~PUMP~
Model No.
Type
Rated Speed, strokes/mm.
Rated Capacity, gph
Rated Discharge Pressure, psig
Design Pressure, Casing, psig
Design Temperature, 0F
idt/~ant -~
Mm. Flow Requirements, gpm
G.E..1
Induc!tion
3/2!
1.80q --- *~
Oil/24ir :
480v) 3% 60Hz, 3 Amps- (Fu1~.
]oad current)
?ICC `-31D
-40-
PAGENO="0747"
743
TABLE 12
AQUEOUS AMMONIA STORkGE TANK
Identification
Vendor
* Capacity - gallons
Installation
Outside diameter & length
Shell Material
Shell thickness, in.
*Design temperature, 0p
Design pressure, psig
Corrosion Allowance, in.
Design Code
Code Stamp* required
Classification
Code
Quality Control
Seismic
Cleanliness
AM-T-6
L*A Water Treatment Co~
* 5,000
one
8*Owx l2'-0~
~arbon Steel
3/8
10
ASME, Sf ctions VIII a ~C
No
Level
C
4
II. *
D
-41-
PAGENO="0748"
744
TABLE l3~
AQUEOUS AMMONIA PUMPS
Pump Details
identification AM-P-4A, 4B, and 4C
Number installed 3
Manufacturer . Chemcon
Model No. ll60-~CI-l35
Type Positive displacement
Rated Speed, strokes/mm. 135
Rated Capacity. gph 159
Rated Total Dynamic Head, ft. 40
Design Pressure, Casing, psig 50
0
Design Temperature, F
Oil/fluid
Mm, Flow Requirements, gpm 0
Motor Details
Manufacturer
Type Induction
Enclosure TEFC
Rated Horsepower, hp ¼
Speed, rpm 1,725
Lubricant/Coolant Oil/Air
Power Requirements 480V 3Ø~ 6OHa
Power Source NCC 2-31D
PAGENO="0749"
745
TABLE 14
SODIUM SULPHITE FEED~ AND STORAGE TANK
Identification WT-M-1. & WT-T-.U.
Number installed
Manufacturer Wallace & Tiernon
Model A-728
Capaaity, gallons/tank 50
cubic feet/feeder 13
Size, diameter x height 3'-~O" x 3'.~0" & 2I.~6u x
21..ON x 3S.~8M
Feed rate, cu. ft.fhr.' 18.1
Mixer
Type . Induction.
Rated Horsepower, hp 1/4
EncIoS~N~. ~.. ~ P
Power Requirements 11OV, l~, 60 Hz
Feeder Motor
Type Induction
Rated Horsepower, hp 1/4
Enclosure D.P.
Power Requirements llOv, 1%, 60 --
Speed, rpm 1,725
Classification
Code.. . C
Cleanliness Class D
Quality Control . . level 4
Seismic .. Class II
-43-
PAGENO="0750"
746
TABLE 15
SODIUM SULPHITE PUMPS
~p Detai~
identification WT-P15A, WTP15B
Number Installed 2
Manufacturer . Worthington
Model No. 3/4 CN~-4
Type Centrifugal
Rated Speed, rpm 3500
Rated Capacity, gps 6
Rated Discharge Pressure, psig 30-
Design Pressure casing ps-±g~
Design Temperature, 0F
Lubricant/Coolant . Oil/F1~jd
Mm. Flow Requirements, gpin
Motor Details
Manufacturer
TS,pe Induction
Enclosure DP
Rated Horsepower, hp 3/4
Speed, rpm 3500
Lubricant/Coolant Oil/Air
Power Requirements 480V,3J~, 60Hz
Power Source MCC 2-3lD
-44--
PAGENO="0751"
TABLE 16
CONDENSATE POLISHER REGENERATION SUMP PUMPS
Motor Details
Manufacturer
.Type
Enclosure
Rated `Horsepower
Speed, rpm
Lubricant/Coolant
Power requirements
Classif icat ion
Code
Quality Control
Seismic
Cleanliness
747
* Pump Details
Identification
Number' Installed
Manufacturer
Model No. , ,
Type
Rated speed, rpm
Rated Capacity, gpm
Rated Total Dynamic Head, ft.
Design Pressure, Casing, psig
0
Design Temperature, P
Lubricant/coolant
Minimum Flow Requirements, gpo
WT-P-l9A & B
Two
Crane - Denting
3ND
Vertical, duplex
1745 `` * .
* 200 ,
80
Oil/fluid.
Inducticw~
* DP
10
1800
Oil/Air
* 480v, 3ff, 60 Hz
Level
C
4
II
* D
-4;-
PAGENO="0752"
Identification
- Ammonium Hydroxide
- Hydrazine
Vendor
No. Installed
Capacity, gallons
Installation
Outside diameter & Length
Shell material
Shell thickness, in.
* 0
Des.gn temperature, F
Design pressure, psig
Design Code
"Qde Stamp required
748
Feed
A!1-T-l
AN-T-2
L*A Water
Two
150
Vertical
2'-6 x 4'-3
- 304 S.S
- -
AM-T--4
AM-T-5
L*A Water Cond. Co
Two -
6
Vertical.
l2~xl2~'..
-. 304s.S.
(
TABLE 17
HYDRAZINE FEED AND MEASURD~G TANKS
Corid. Co
Classification.
Code
Quality Control
Seismic
Cleanliness
*.3I8 * --1/8
Atocaspheric
?~SME
No
Level
C
.4
- Ix
- D
-46-
PAGENO="0753"
749
i~n?4o'~Iur1 HYDROXIDL Z~ND IIYD~AZINE FEED PUMPS
flg~1s IWORAZINE ~ HYDROXIDE
Identification . AN-P-lA, B AMP-2
Number Installed
Manufacturer
Model No,
Type
Rated Speed,strokes/injn
Rated Capacity, gph
Rated Total Discharge Pressure, psig
Design Pressure, casing, psig
Design Tcmper~ture, Op
Lubricant/Coolant
Flow RegMirements, ~m.,
Motor Details
Manufacturer
type
Enclosure
Rated Horsepower
Speed, rpm
Lubricant/Coolant
Power Requirements. *
Two One
thiemcoh.. - *
ll3O-316SS-90 l130-cx--90
Simplex.
90
180.
250
91l/Fluid
0
~eliance
* - induction
1/4
1725 *
*O~]1Air..
llOv, 1 0, 60Hz
-47-
48-721 0 - 79 - 48
PAGENO="0754"
Classification
Code
Quality Control
Seismic
Cleanliness
750
Level
C
.4
II
D
-48--
TABLE 19
A ( MIMONItJM HYDROXIDE MIX TANK
~1c1cntification . AM-T-7
~Vo~dor B&W
Number Installed One
~Capacity . 60
Xr.stallation Vertical
Outside diameter and length - * 24~x30
Shell material * - Type 304 5.6.
Shell thickness. in. -- -. 3/16
Manufacturer Buffalo Tank
Des.gn Temperature 150
-iesign pressure, psi~. ..
Design Code - - NOfl Code -.
Stamp Required -
PAGENO="0755"
751
TABLE 20
AMMONIUM HYDROXIDE MIX TANK PUMP
Deta
Identification .
Nun~er Installed One
Vendor B&W
Manufacturer
Model No. -- LS~5
Type . -. ~`ositive displacement
Rated Speed, strokes/rain. 44
Rzited Capacity, gpm 1.0
Rated ~pischarge Press., psig. 275
Design Pressure, casing, psig ~_5OO
Design Temperature, 0F. - 7O-~-120
Lubricant/Coolant Oil/FlUid
Mm. Flow Requirement, gpm ..*. 3
Motor Details
Manufacturer -~ - Baldor Electric Co.
~ype IfldUCt.tOfl
Enclosure - TEFC
Rated horsepower . 1/6
Speed, rpm. . .. . . 1725
~Lubricant/Coolant ,. . . - oil/Air
~?ower Requirements l2Ov~ 3. 0 60 ~z
Po~zer source }~PT 11
-49-
PAGENO="0756"
PANEL-MOUNTED ANN CIATOR flWUTS
C0-G-1 0-5MM/cm
CO-6-1 0-5MM/cm
DPI ~WC O-l5Opsi
C0-G--1 0-5MM/cm
DPI-WC O-l5Opsi
.C0-6--3. 0-5MM/cm
]WX-WC 0-150p13i
C0-G-1 0-5MM/xm
DPI-WC 0-l5Opsi
CR-WC 0-10CM 100)MM/cm.
FR1-WC 0-10% (H2S04)
C0-G-1 0-5MM/cm.
DPZ-'WC 0-l5Opsi
C0-G-1 0-5MM/cm.
DPI-WC 0-l5Opsi
C0-G-1 0-5MM/cm.
DPI-WC 0-lSOpsi
C0-G-1 0-5MM/cm
DPI-WC 0-iSOpsi
C0-G-1 0-5MM/cm
NOTE: AllAlarins are annunciated'o~i the Condensate Polisher
Control Panel No. 304 and ~.~cornmon alarm annunciates
in the Control Room "Conden~pte Polishing System
Trouble" on Turbine Auxili.zLes Panel 17,
Alarm Input Variable
W4*y~-~w M~nured V~riRble. Units ~S~et~ointa Source Range -
1-1
1-2
1-3
1-4
1-5
1-6
1-7
1-0
1-9
1-10
1-11
1~-12
1-13
1-14
1-13
1-16
1-17
1-16
1-19
1-20
Influent High Conductivity Field Set
2A-Polisher High Conductivity, Micromhos 0.12-0.15
2A-P'~1.isher High Pressure Drop Resin Trap1 5+
psig
25-Polisher High Conductivity 0.12-0.15
25-Polisher High Pressure Drop Resin Trap,psig 5+
2C-Polisher High Conductivity 0.12-0.15
2C-PoLi~Thcr High Prcs~urc Drop Rosin Trap,psig 0+
2D-Polishcr High Conductivity 0.12-0.15
2D-Polisher High Pressure Drop Resin Trap,psig 5+
Receiving Tank High Conductiyity, Micrciuhpe 40
Acid Concentration Fault 6%lo-~10%ht.
2E-Polisher High Conductivity, Micrombos 0.12-0.15
2E-Polisher High Pressure Drop Resin Trap,p.ig 5+
2F-Polisher High Conductivity, Micronhos * 0.12-0.15
2F-Polisher High Pressure Drop Resin Trap,psjg 5+
20-Polisher High Conductivity, Micromhos 0.12-0.15
20-Polisher High Pressure Drop Resin TraP,pstg 5+
2H-Polisher High Conductivity, Micrombos 0. 12-0.13
2H-Polisher High Pressure Drop Resin Trap,psig 5+
Effluent High Conductivity Field Set
C)1
PAGENO="0757"
~c~dôw M~sur~d ~7~i~b1~
* Alarm Input Variable
~st~,nint~ ~ôurcs ~
set
DPR-WC
FR1-WC
FT-WC
FR1-WC
FT-WC
FR1-WC
FT-WC
FRI-WC
FT-WC
CR-WC
2-1
High Differential Pressure, psi
45
2-2
.
2A-Polisher Low Flow, gpm
Field
2-3
2A-Polisher Exhausted
2-4
2B-Polisher Low Flow, gpm
2-5
2B-Polisher Exhausted
2-6
2C-Polisher Low Flow, gpm
2-7
2C-PoIisher Exhausted
..
2-8
2D-Polisher Low Flow, gpm
:
*
2-9
2D-Polisher Exhausted
2-10
Mix & Storage Tank High Conductivity,
Micromhos
1.0
.
2-11
Caustic Concentration Fault
2-12
2E-Polisher Low Flow, gpm
*
Li
FR1-WC
1
~
2-13
2-1,4
2E-Polisher Exhausted
2F-Polishor Low Flow, gpm
.
FT,WC
FR1-WC
2-15
2F-Polisher Exhausted
FT-WC
2-16
2G-?ol.isher Low Flow,gpm
*
FR1-WC
2-17
2G-Polisher Exhausted
.
.
FT-WC
*
2-18
2H-Polisher Low Flow ,gprn
*.
FR1-WC
~`
2-19
2-20
2IT-~lisher Exhausted
Condensate Polisher Suinp Level ~High,
top of sump)
S.n.(fro~n
16
FT~WC
WT-LS-3884
0-31"
4% lo-6% hiFfll-WC
fie] 1 set
0-100 psi
0-30 (XlOO) gptt~
0-960 counts
0-30(Xl00)gpm
0-960 counts'
0-30(XldO)gpm
0-960 counts
0-30 (X100) gpm.,
0-960 counts
0-5MM/cm
0-10%(NaOH)
0-30 (XI00) gpm
0-960 counts
0-30(X100) gpm
0-960 counts
0-30 (X10)~)gpm'
0-960 countS
0-30 (X100) gpm
0-960 counts
* Reference L*A Water Conditioning Co. flow dLag~anw P453.9 and D4522.
PAGENO="0758"
PAGENO="0759"
.755
TRAINING & CERTIFICATION OF NDTROPOLITAN EDISON CO~~rPANY
THREE NILE ISLAND UNIT 2 LICENSED PERSONNEL
The following is a summary description of the training and certification
relevant to Three Nile Island Unit II operation for personnel in the following
job classifications:
______________ License Requirement
Reactor Operator CR0)
Senior Reactor Operator (SRO)
Dual Unit Senior Reactor Operator (SRO)
Senior Reactor Operator (SRO)
*Senior Reactor Operator (SRO)
The information provided is based on documentation retained by the ~I Training
Department. The extent of an individual's participation in the various programs
outlined may vary according to the individual's previous experience,prior
academic/technical training, and date of selection or appointment to a particular
job classification.
*Unit Superintendents are not required by regulation to hold SRO Licenses,
however, it is Company Policy for individuals assigned to this position
to obtain an SRO License.
I.
II.
III.
IV.
V.
Classifjcatjbn
Control Room Operator -
Shift Foreman -
Shift Supervisor -
Supervisor of Operations -
Unit Superintendent -
PAGENO="0760"
756
INDEX
I. Control Room Operator (CR0) Training and Certification
l.A Auxiliary Operator Training
I.B "Cold" License Training
I.C `Hot" License (Replecement Operator) Training
I.D Control Room Operator Certification
I.E Reactor Operator Requalification
2
3~
4
8
12
13
IV. Supervisor of Operations - Unit II 26
V. Unit Superintendent
V.A Unit Superintendent: Certification and Training 27
V.B Unit II Superintendent - Technical Support:
Certification and Training 28
Attachment 1 - TMI-2 TSAR, Section 13.2 "Metropolitan Edison Operator Requalifi-
cation Program"
Attachment 2 - 10 CFR 55 `Operators' Licenses"
Reference 1 - ANSI H18.1-1971 "Selection and Training of Nuclear Power Plant
Personnel'
Reference 2 - ANSI/ANS-3.1-1978 "Selection and Training of Nuclear Power Plant
Personnel"
II. Shift Foremsn Training and Certification* 14
II.A Previous TNI-l SRO Licensees 15
11.5 SRO Licensees from Other Reactor Facilities 18
II.C Selectees From Initial TMI-2 CR0 staff 21
III. Shift Supervisor Training and Certification 23
-1-
PAGENO="0761"
757
I. Control Room Operator (CR0) Training and Certification
Certification of CR0 qualification is achieved through NRC examinations,
successful completion of which results in operator licensing by the NRC.
Training to ensure operator qualification prior to application for
operator licensing will include Auxiliary Operator training and either
"Cold' (prior to initial core fuel load) or "Not" (subsequent to initial
criticality) operator licensing programs. Replacement operator training is
also accomplished using the "Hot" license training program.
Operator proficiency and certification are maintained through the
licensed operator requalification program and periodic (annual) requal-
ification examinations.
-2-
PAGENO="0762"
758
l.A Auxiliary Operator Training
With but 1 exception, all of the initial Control Roots Operator staff at
TMI-2 were graduates of the U. S. Navy nuclear training program with
several years of operating experience on naval nuclear propulsion plants.
All were initially employed as Auxiliary Operators-A-Nuclear. In this
classification they participated in a tranining program which typically
included the following:
1. Mathematics (160 hours)
2. General Science (80 hours)
3. Atomic & Nuclear Physics (240 hours)
4. Reactor Physics (200 hours)
5. Radiation Protection (160 hours)
6. Core Performance (80 hours) including:
a. Thermodynamics
b. Fluid Plow
c. ~Core Thermal Performance
d. Reactor Materials
7. Plant Chemistry (80 hours)
8. Instrumentation and Control (40 hours)
9. Plant Operation (80 hours)
This training was conducted using the "Nuclear Power Preparatory Training"
progran developed by NUS Corporation of Rockvill, Nd. Initial Auxiliary
Operator training also included approximately 200 hours of training on
TNI-l systems.
-3-
PAGENO="0763"
759
1.8 "Cold" License Training
The content of a "cold" license training program is defined by ANS 3.1
(formerly ANS 18.1) with additional guidance and classification provided
in section 13.2 of the TNI-2 FSAR. The initial TMI-2 staff "cold" RO
license traning program was reviewed with and approved by the Operator
Licensing branch of the NRC with respect to compliance with the estab-
lished standards. The requirements were met by participation in the
following programs: : -
1. Unit II CR0 Training Program
a. Math Review (24 hours) conducted by TMI Training Department.
b. Reactor Theory (104 hours) conducted by TMI Training Department.
c. TMI-2 Systems (144 hours) conducted by TNI Training Department.
and TNI-2 Shift Foremen.
d. TMI-l Control Room Observation (160 hours)
2. Penn State University Training Program
a. Console experience, startup experience and experimentation at
the PSU TRICA research reactor facility (40 hours).
3. TMI-2 Cross-License Training
a. TMI-2 Systems (75 hours)
4. TMI-2 On-the-Job Training for CR0 Candidates
Guided self-study on TMI-2 systems and their respective sections of:
a. Burns & Roe System Descriptions
b. TMI-2 FSAR
c. TMI-2 Standard Technical Specifications
-4-
PAGENO="0764"
760
d. TMI-2 Procedures
e. Burns & Roe Drawings & Prints
(Totaling 300 hours per individual)
5. Babcock & Wilcox Simulator "COld" License Training
a. Classroom instruction (180 hours)
(1) Plant fluid systems and components
(2) Heat transfer
(3) Reactor physics
(4) Control/protective systems
(5) Instrumentation
(6) Normal and emergency procedures
b. Simulator Operation (100 hours)
(1) Plant startup/shutdOwn
(2) Power operation including load changes
(3) Abnormal and emergency procedures
(4) Plant operation with unannounced casualties
c. Examinations (40 hours)
(1) Start-up exams
(2) Operating and oral exams
(3) Simulated NRC written exam
6. Technical Specification Review Program (40 hours)
a. Review of updated TMI-2 Standard Technical Specifications
b. Abnormal/Emergency procedures
c. Instrument/Control review
d. Case History of other plants
-5-,
PAGENO="0765"
761
Babcock & Wilcox Simulator Refresher Training
a. Classroom instruction (20 hours)
(1) Plant control and response
b. Simulator Operation (20 hours)
(1) Start-up
(2) Turbine/Reactor Trip
(3) Power Operation with unannounced casualties
8. Independent Audit of Operator Qualification
General Physics Corporation, Columbia, Maryland was contracted to
perform an independent audit of potential licensed operator weaknesses
through in-depth oral examination on an individual basis. ~ny weak
areas identified could then be emphasized In the Pre-License Review
Program.
9. Pre-License Review Program (80 hours)
a. Reactor Theory
b. Instrumentation and Control
c. Standard Technical Specifications
d. Fuel Handling
e. Normal/Emergency Procedures
f. Environmental Technical Specifications
g. Safety/Emergency systems
h. RCS chemistry
1. Health Physics review
j. Radiation Emergency Plan
-6-
PAGENO="0766"
762
10. Additional In-Plant Experience
In addition to the formal classroom and On-the-Job training programs
already discussed, TMI-2 operations personnel have received signi-
ficant experience through participation in the following:
a. System testing and turnover to~1atropolitan Edison Company from
General Public Utilities Service Corporation.
b. TMI-2 Hot runctional Testing
c. TMI-2 Low Power Core Physics Testing
d. TMI-2 Escalation to Power
11. COmpany Administration Examinations
These included both oral and written comprehensive examinations
similar in nature to those administered by the NRC. The results of
this final check of operator qualification were used in recommending
individuals to the NRC for examination and licensing.
PAGENO="0767"
763
I.C "Hot" License (Replacement Operator) Training
1. "Hot" license trainIng and experience requirements are also- specified
in ANS 3.1 (formerly ANS 18.1) and the TMI-2 FSAR. Candidates for
"Hot" licensing programs are selected either from the fully qualified
Auxiliary Operators-A-Nuclear at the station or from off-site appli-
cants with the requisite experience and qualifications. In either
case, the "Hot" license replacement operator candidate will have a
minimum of two (2) years of operating experience at a nuclear reactor
facility.
Once designated as a "Hot" license candidate and assigned to the
position of Control Room Operator (CR0), the individual enters
a training program. This program consists of:
a. Specific self-study assignments
b. Oral checkouts in which the Individual actually performs or
simulates performing certain evolutions
c. Written examinations
d. Oral examinations and
e. Classroom sessions
2. The replacement operator program provides in-depth coverage of all
areas specified in ANS 3.1 and the TMI-2 FSAR over a nine (9) month
period. (Note: This program is comparable to the TMI-l Replace-
ment Operator Program). These areas include: -
a. Reactor Theory
b. Features of Facility Design
c. General Operating Characteristics
-8--
PAGENO="0768"
Instrumentation and Control
Safety and Emergency Systems
Standard and Emergency Operating Procedures
Radiation Control and Safety
3. Adminsitrative guidelines for the conduct of this program to ensure
operator proficiency prior to application for NRC licensing are as
follows:
a.
Upon being advanced to CEO, the individual will fall immediately
into the Shift organization as it exists at the time. Two (2)
hours, as a minimum, of each day on shift will be specifically
devoted to training. The individual will be provided with a desk
or other suitable place to study in the Control Room area. The
two (2) hour period will occur at a definite time of each day on
shift insofar as practical.
b. While on shift, the individual receives a series of preprogrammed
written assignments. The individual is administered written and
oral examinations evary 3 and 6 weeks respectively. The written
tests will be corrected and returned. Errors snd weak areas will
be covered with the individual, and reassigned. Weak areas on
written and oral examinations will be covered with the individual.
Failure of a written exam or oral exam will be discussed with the
individual and a retest will be administered on the material.
c. Additionally, the CR0 will be required to complete a Practical
Evolutions Sheet. This sheet will be completed either during
the individuals' daily training period, or during other times
764
d.
e.
f.
g.
- 9~ -
PAGENO="0769"
765
while on shift as situations dictate. Nost of the items involve
performing evolutions, simulating performing evolutions, and
understanding and being able to explain while simulating or
performing. The individual's Shift Supervisor, Shift Foreman,
an SRO Licensed individual, or (in specifically designated
cases) the licensed Training Coordinator may sign the practical
evolution sheet. Assignments detailed in paragraph b. above,
on which written and oral tests will be given, will cone largely
from items on the Practical Evolution Sheet, with some assign-
ments specifically intended to obtain signatures on this form.
Checkouts for items on the Practical Evolution Sheet which must
be simulated will be conducted in front of the Control Room
Consoles and Panels, with the individual being required to point
to specific items and controls. The checkout must be satis-
factory prior to a signature for the evolution. The evolutions
are assigned a point value to track the piogress of an individual
through the nine (9) month program.
d. To aid the individual in the training assignment completion, the
CR0 may come off shift to attend lectures on specific topics,
listed below, as determined by the Supervisor of the Training
Department and the Supervisor of Operations.
(1) Reactor Theory - 1 day - 1 week
(2) ICS Review - 1 day - 1 week
(3) Simulator - 1 week - 2 weeks
(4) Health Physics Review - 1 day - 1 week
(5) Refueling Review - 1 day - 1 week
- 10 -
48-721 0 - 79 - 49
PAGENO="0770"
766
* These off shift lectures should aid the individual in obtaining
signatures on the Practical Evolution Sheet.
e. The first 90 days of the CR0 Training Program are designated
as a Probationary Period during which the individual will be
evaluated. At the end of this 90 day period, the Shift Supervisor,
Supervisor of Operations and the Supervisor of Training will
recommend whether or not the individual should continue in the
program.
f. Prior to the completion of the 9 month tine period for the pro-
gram, the CR0 will be given a comprehensive written examination
approved by the Supervisor of Operations and the Supervisor of
Training. The results will be available for review by the
CR0. Additionally, within the Training Program tine period,
the CR0 will be given a comprehensive oral examination by an
SRO licensed individual designated by the Supervisor of Oper-
ations. ~ny examination failed, written or oral, will be
reviewed with the CEO.
g. If the CR0 has not successfully completed the program within
9 months, and fails either the written and/or the oral examin-
ation, the individual will be returned to the position held
prior to being advanced to CR0. If the individual successfully
completes the training program within 9 months, and fails
either the written or oral examination, a re-exam will be
considered based upon an evaluation by the Supervisor of Oper-
ations and the Supervisor of Training. If the individual
successfully completes the training program within the nine
(9) months and passes the final comprehensive written and
* oral examinations, that individual may be recommended for
examination by the NRC and subsequent RO licensing.
- 11 -
PAGENO="0771"
767
I.D Control Room Operator Certification
The 1~RCs issuing of Reactor Operator Licenses constitutes official
certification of Control Room Operator personnel to operate. the reactor
facility on which the RO license was achieved.
- 12 -
PAGENO="0772"
768
I.E Reactor Operator Requalification
The philosophy, content and conduct of the training program designed to
maintain licensed operator qualification and proficiency is described by
the TMI-2 FSAR, Chapter 13, Section 13.2.2 "Metropolitan Edison Operator
Requalification Program". This is provided as Attachment 1.
- 13 -
PAGENO="0773"
769
II. Shift Foreman Training and Certification
As with the reactor operator level training and certification dis-.
cussed in Section I of this report, certification at the senior reactor
operator (SRO) level is also achieved through satisfactory completion of
NRC examinations. Certification is maintained by participation in the
operator requalification program and satisfactory completion of the annual*
evaluation examination.
Training to ensure SRO qualification prior to application for operator
licensing is accomplished through the administration of programs which
comply with the requirements of ANS 3.1 and the TMI-2 FSAR, and which
have been approved by the NRC.
Personnel selected who currently fill shift foreman positions for
TMI-2 can be classified as having come from any of three slightly different
backgrounds. -
A. Individuals who had achieved and maintained SRO licenses on
TMI-l
B. Individuals who had achieved SRO licenses on other reactor
facilities
C. Individuals selected from the initial group of TMI-2 Control
Room Operator trainee's
The training, qualification and certification of each of these groups
is discussed in this section.
- 14 -
PAGENO="0774"
770
II.A Previous TMI-l SRO Licensees
1. These individuals were typicafly graduates of the U. S. Navy nuclear
program. They had been initially employed by Net-Ed aa Auxiliary
Operators-A--Nuclear and as such had received training as outlined
in section l.A of this report.
2. They had been promoted to shift foremen on TMI-l and had all achieved
and maintained 510 licenses on that unit.
3. Upon assignment to TMI-2, they participated in the following portions
of the "Cold" license training program:
a. Unit II CR0 Training Program (270 hours) (participated as systems
instructors - program as described in section I.B.l of this
report)
b. TMI-2 Cross-License Lectures (75 hours) (as described in section
I.B.3 of this report)
c. TMI-2 On-the-Job Training for SRO Candidates (300 hours) (essen-
tially as described in I.B.4 but modified to SRO level)
d. Technical Specification Review Program (40 hours) (as described
in I.B.6 of this report)
e. Babcock & Wilcox Simulator Refresher Training (40 hours) (as
described in I.B.7 of this report)
f. Pre-Licensed Review Program (98 hours) as described in section
I.B.9 of this report with the following additional training
(18 hours) for SRO candidates:
(1) Departure from Nucleate Boiling (DNB), DNB Ratio (DNBR) and
hot channel factors
(2) Soluble poison control
- 15 -
PAGENO="0775"
771
(3) Liquid and gaseous radioactive releases
(4) Administrative procedures
(5) Standard Technical Specifications
g. Additional In-Plant Experience
(1) Development of TMI-2 normal, abnormal and emergency pro-
cedures
(2) TMI-2 system testing and turnover
(3) TMI-2 hot functional testing
(4) TNI-.2 low power core physics testing
(5) TMI-2 escalection to power
h. Company Administered Examinations
(1) `Both oral and written examinations at the SRO level,
similar in nature to those administered by the NRC but
emphasizing comparisons and differences between THI-l and
TMI-2.
(2) Results of these examinations were used in recommending
individuals for final examination and subsequent cross-licen-
sing by the NRC.
4. Certification
a. Accomplished by Company administered examinations as outlined
below:
(1) Comprehensive written examinations developed, administered
and graded by the Company. These were SRO level examinations
similar to those administered by the NRC which emphasized
comparisons end differences between TMI Units 1 and 2.
(2) The examinations, grading of the exams, and final results
were reviewed end approved by the NRC.
- 16 -
PAGENO="0776"
772
(3) NRC atninended their SRO licenses to include Unit 2
b. Certification is maintained by participation in the licensed
operator requalification program and satisfactory completion
of the annual evaluation examinations as discussed in Attach-
ment 1.
- 17 -
PAGENO="0777"
773
11.8 SRO Licensees from Other Reactor Facilities
1. These individuals were typically graduates of the U. S. Navy nuclear
program.
2. Subsequent to naval service and experience thay had achieved SRO
level certification (licensing) at other commercial power reactors.
3. Upon selection and assignment to TNI-2 they participated in the fol-
lowing training programs:
a. Unit II cold license pre-simulator training (80 hours) including
formal classroom instruction in the following areas:
(1) Integrated Control System
(2) Control Rod Drive
(3) Non-Nuclear Instrumentation
(4) Reactor Theory
(5) Electrical Distribution
(6) Reactor Protection System
(7) Standard and Technical Specifications
(8) TMI-2 Fluid Systems
b. Babcock & Wilcox Simulator Training (80 hours)
(1) Classroom instruction
(a) Reactor Theory
(b) Instrumentation/Control systems
(2) Simulator operation
(a) Plant start-up/shutdown
(b) Power operation with unannounced casualties
(3) Start-up Certification
- 18 -
PAGENO="0778"
774
c. TMI-2 Cross-License Training. (75 hours)
(1) TMI-2 systems classroom instruction
d. TMI-2 On-the-Job Training for SRO Candidates (500 hours)
(1) Essentisily as described in I.B.4 but modified to SRO
level
e. TMI-2 Standardized Technical Specifications (40 hours)
(1) As described in I.B.6 of this report
f. Babcock & Wilcox Simulator Refresher Training (40 hours)
(1) As described in I.B.7 of this report
g. Pre-License Review Program (98 hours)
(1) As described in II.A.3.f. of this report
h. Additional In-Plant Experience
(1) TNI-2 normal, abnormal and emergency procedure development
and review
(2) TMI-2 system testing and turnover
(3) TMI-2 hot functional testing
(4) TMI-2 low power core physics testing
(5) TMI-2 escalation to power
1. Company Administered Examinations
(1) Oral and written examinations at the SRO level similar
to. those administered by the NRC.
(2) Results of these examinations were used in determining
whether individuals would be recommended for NRC licensing
examinations.
4. Certification
a. Certification was achieved through successful completion of
- 19 -
PAGENO="0779"
775
NRC licensing examinations and subsequent issuing of SRO licenses
to operate TMI-2.
b~ Certification is maintained through participation in the
licensed operator requalification program and successful
completion of the annual evaluation examination as described
in Attachment I.
- 20 -
PAGENO="0780"
776
Il.C Selectees Prom Initial TMI-2 CR0 staff
1. These individuals had complet~d the following training previously
outlined in this report:
Section l.A. - Auxiliary Operator Training
b. Section I.B. - "Cold" License Training
2. Typically, they had been certified to operate the plant by successful
completion of NRC licensing examinations at the RO level.
3. They had maintained this certification through participation in the
licensed operation requalification program as described in Attach-
ment 1.
4. These individuals also attended a Senior Operator Review Program
which provided additional training at the SRO level in the following
areas: -
a. Procedure Review (40 hours)
b. Realth Physics Review (40 hours)
c. Plant Characteristics (40 hours)
d. Pland Design Review (40 hours)
e. Reactor Theory Review (40 hours)
This program was administered primarily through guided self-study
augmented by classroon instruction as necessary to achieve SRO
level qualification.
5. SRO level qualification was checked by Company administered examina-
tions as discussed in Section II.B.3.i. of this report.
- 21
PAGENO="0781"
777
6. Certification was achieved through satisfactory completion of
SRO level examinations administered by the NRC and subsequent
issuing of SRO licenses to operate TMI-2.
7. SRO qualification and certification are maintained through parti-
cipation in the licensed operator requalification program as described
in Attachment 1.
- 22 -
PAGENO="0782"
778
III. Shift Supervisor Training and Certification
Shift Supervisor must be certified at.the Senior Reactor Operator (SRO)
level for both TMI-1 and TMI-2. This is achieved through satisfactory
completion of NRC approved examinations. Certification is maintained by
participation in the operator requalification program and satisfactory
completion of the annual evaluation examination (Attachment 1).
Personnel selected for the position of Shift Supervisor held SRO licenses
for Unti I or Unit II or in the case of one individual, held a current
dual SRO license. In addition, many of these individuals had graduated
from the U.S. Navy Nuclear Power Program, and in all cases their experience
met or exceeded the requirements of ~NS 3.1.
For initial dual unit staffing, a cross License Training Program was
administered to obtain Unit II SRO licenses. The Shift Supervisors
received the following training or the equivalent:
1. One hundred (100) hours of Cross License Training
2. One (1) week of Unit II Standardized Technical Specifications Training
3. Twenty (20) hours of Turbine Controls Training given by Westinghouse
Electric Corp.
4. One (1) week of Unit II Simulator Training at B&W's Training Center
in Lynchburg, Virginia.
5. Two (2) weeks of Pre-License Review Training
6. Unit II O.JT Program
7. Unit I Requalification Training Program (67 hours).
Periodic tests were given throughout the program to monitor the students'
level of knowledge. At the conclusion of the program, a mock NRC examina-
tion was administered with emphasis on Unit II Systems and differences
between the Unit I and Unit II Nuclear Steam Supply Systems (NSSS),
Secondary and Balance of Plant Systems. Following successful completion
23 -
PAGENO="0783"
779
of the above program and tests, a final company prepared qualification
exam was administered. The program documentation, exam and exam results
were forwarded to the NRC for approval. -
This culminated in those applicants already SRO licensed in Unit I having
their license amended to include an SRO on Unit It.
Subsequent to "Cold" Licensing, a "Hot" Cross License training program was
developed by the Training Department to cross qualify SRO License holders
from either unit.
This program is approximately 400 hours In length and is predominantly a*
self-study course with periodic written and oral exams to monitor the
individual#s progress. Listed below are the major topics contained in the
program.
2.
Technical Specification Training
Unit Systems with emphasis in unit differences
a) Turbine Generator & Auxiliaries
b) Solid, Liquid & Gaseous Waste System
c) Steam Systems (Ham, Auxiliary, & Bleed)
d) Cooling Water Systems (Primary and Secondary)
e) Electrical Systems (Balance of Plant, Vital Power, and Diesel
Generator).
f) Emergency Safeguards Systems
g) Reactor Coolant System
h) Primary Volume Control Systems
I) Secondary Water Systems
3. On-the-job training (oral checkouts by a Shift Supervisor of various
plant evolutions).
4. Administrative controls.
- 24 -
PAGENO="0784"
780
5. Operator Requalification Program (Attachment 1)
The program culminates with the individual taking a written exam adminis-
tered by the Training Department. The exam and results are reviewed and
approved by the NRC. Approval by the NRC will then result in the mdi-
vidual's SRO license being anmended to include the other unit.
- 25 -
PAGENO="0785"
781
IV. Supervisor of Operations - Unit II
This individual is a graduate of the Navy Nuclear Power School. Following
his service obligation, he graduated from college as a Chemical Engineer.
His commercial power plant experience commenced as a Staff Engineer at the
Saxton Experimental Corporation. During his tenure there he was awarded a
Senior Reactor Operators license.
Mter transfer to TMI, he initially held the position of Nuclear Engineer-
Unit 1. His next appointment was that of Supervisor of Operations Unit 1.
He participated in a Cold License program and achieved an SRO license on
Unit 1. The general outline of this training program was as follows:
1. Presaurized Water Reactor Technology Course by Babcock and Wilcox
Co. - 1969- (320 hrs.)
2. Shift Foremen Review Seminar - 11/24/71 (2 hra/wk)
3. Pressurized Water Reactor Simulator Orientation Course by BabcOck
and Wilcox - 1973 - (32 hra.) -~
4. PWR Simulator Training Program by Babcock and Wilcox Co., - 1973 -
(80 hra.)
5. Pre-licenaing Review Program by Babcock and Wilcox Co., General
Physics and N1JS Corp. - 1973 - (204 hrs.)
6. Various vendor familiarization programs (38 lire.)
He was then appointed to his present position of Supervisor of Operations
Unit II. In this position he participated in the Startup and Test Program
and achieved a "Cold" SRO license on Unit II by participating in training
similar in scope to that detailed in Sections II and III.
This person's total nuclear power plant experience is in excess of fifteen
years.
- 26 -
48-721 0 - 79 - 50
PAGENO="0786"
782
V. A. Unit Superintendent: Certification and Training
This individual's experience greatly exceeds the requirements of ANS
3.1. He is a U.S. Naval Academy graduate with twenty years in the Navy
Nuclear Power Program. This service included command of a nuclear
submarine.
Certification of the Unit Superintendent position was achieved through
successful completion of NRC examinations which culminated in the
receipt of a Senior Reactor Operator License.
This training program was a modified "Hot" License Training Program.
The program was specially tailored to the needs of the individual,
with special emphasis on those areas in which the individual did not
have prior experience, or expertise.
Specific areas of the program included but were not limited to:
a. Specific self-study assignments
1) Systems Training
2) Reactor Theory -
3) Integrated Control Systems
4) Radiation Protection
5) Fuel Handling Training
6) Technical Specifications
b. Simulator Training (280 hrs.)
c. Oral checkouts within the plant performing or simulating
performance of the evolution
d. Written examinations
e. Classroom lectures
Approximately 900 hours were spent in formalized training in the
above program.
- 27 -
S
PAGENO="0787"
783
B. Unit II Superintendent - Technical Support: Certification and Trainin~
This individual has been an employee of Met-Ed for a period of ten
years. He is a graduate Mechanical Engineer and a registered Profes-
sional Engineer. He has ten years power plant experience and has been
involved in various engineering duties at TMI over the past nine
years. Previous positions held at TMI include Operations Engineer,
Supervisor of Operations and Unit 1 Superintendent - Technical Support.
During the period of his assignment as Operations Engineer, he achieved
a `Hot" SRO license in Unit 1. This was accomplished through a
training program similar to that described in Sections I and II of
this document. He has maintained his license current by meeting the
requirements of the Requalification Program (Attachment 1).
During his assignment as Unit I Superintendent - Technical Support
he served as chairman for the Unit 1 Plant Operations Review Committee.
Following his appointment to Unit II Superintendent - Technical
Support, he entered a program to achieve a dual unit SRO license.
- 28 -
PAGENO="0788"
784
AIIAcH2~ENT ~
METROPOLITAN EDISON OPERATOR RE~U~ ICATIOM PROGR~!
13.2.2 The Metropolitan EdiCon reqyialification program, as set forth in
this document, applies to the Three Mile Island. Nuclear Station. All licensed
personnel will participate in the applicable portion of the regualification pro-
gram. The basis of the requalificatioh program is the need to maintain operator
competence and proficiency in the quest for continued sate operation. The
guidelines for the requalification program are found in 1OCFR55 Appendix A~
In addition, the implementation of this program conforms to 1OCFR5O.
I. Program Schedule -
II. Pre-planned Lectures
III. On-the-job training
IT. Annual Evaluation Examination
V. Records
VI. Accelerated Requalification Program
VII. Pour Month Absence Program
VIII. Nevly Licensed Operators
IX. Requalitication Program Administration
13.2.2.1 Program Schedule
The requalification program described herein will be implemented at a
specified date within 90 days after receipt of an operating license. March 1,
and subsequent anniversaries of this date, will be considered to be the start-
ing date of each snnuaj)- cycle of requslification. program operation.
The Metropolitan Edison Requalification Program consists of four inter-
related segm.enta which, run. concurrently. These segnsnts are:
1) Operational Review Lecture Series (OR) -
2) Fundamentals and System Reviev Program CFSR)
3) On-The-Job Training
1~). Annual Evaluation Examinations -
The OR Series is a classroom lecture presentation which provides licensed
personnel with the details of operational information related to the Three Mile
Island Station. As part of the OR Series, selected PSR topics are presented.
FSR topics are selected in areas where annual operator and senior operator
written examinations indicate that emphasis in scope and depth of coverage is
needed. OR lectures are scheduled for a minimum of 60 hours par year for all
single end dual License holders.
On-the-job training is designed to insure that all licensed personnel
operate reactor controls and participate in major unit evolutions. Records of
all on-shift performance are maintained and reriodieslip reviewed by supervisory
personnel. -
The annual evaluation examinations simulate the written and oral exazsination~
administered by the Nuclear Regulatory Commission. Performance on these annual.
evaluation examinations determine the extent of the tSR program during the fol-
lowing twelve month requslification period.
3-Annual, as referred to in the Operator Reaualification Program, is 12
months, not to exceed 15 months, in order to accommodate unit operations.
13.2-6 Am. 6I~ (4-T-T8)
PAGENO="0789"
785
Each license holder will complete all applicableOR and FSR requirements
on an annual cycle. The On-the-job tra~ning is conducted throughout the two
year term o~ the individual's license. All recyired on-the-job training will
be completed prior to license renewal. A statenent of Reaua.lification Program
participation will be submitted with each license renewal application.
The requalification program is designed with fixed performance standards
end specified remedial actions. The program results and. record.s are fully
auditable.
l3.2-6a An. 6~i (1~-T-T8)
PAGENO="0790"
786
13.2.2.2 Pre-Planned Lectures
13.2.2.2.1 Operational Review (OR) Lecture Series
During each year, personnel shall attend the Operational Review (OR)
Lecture Series on the following batis: . -
(a) Licensed station administrative and technical ~ersonne1 will participate
in the OR Lecture Series as either students or instructors, except to
the extent that their normal duties preclude the need for specific re-
training in particular areas. -- -
(b) OR Lecture Series attendance is required of all licensed operators
and senior operators who are normally on shift assignments.
The following top~cs shall be covered as a minimum during the OR Lecture
Series each year:
(a) Reportable Occurrences -
(b) Unit Nodifications
(c) Operating History and Problems
(d) Procedure Changes
(e) Abnormal And ~hergency Procedure Review -
(f) Technical Specifications
(g) Major Operational Evolutions (such as refueling)
(h) Applicable portions of Title 10, Chapter I, Code of
Federal Regulations ;
(i) FSR Program Material
Additional topics which may be presented include: (but are not limited to)
(a) Operational QIA
(b) Standing Orders
(c) Operating -Experiences - Reactor Safety and other pertinent
SEC publications.
Lectures shall be held on a continuing basis and consist of a minimum of 60
scheduled hours per requalification program cycle. Credit for the classroom
portion of the simulator training program relating to either T~tE Unit 1 or II
may be credited toward the 60 hours of OR Lecture.
Attendance of all licensed personnel will be recorded. Absences will be made
up by reviewing lecture naterials and/or discussions with on-shift supervisory
personnel or the technical staff.
The program for each session will be determined by unit operations or pro-
jected operations. Records of the topics covered in each session will be
maintained by the Training Department.
Periodic evaluation quizzes covering the content of the OR lecture caries
will be administered. The quizzes nay be administered in either the closed
book or open book format, as classroon or on-shift quizzes. If an unsatis-
factory grade (less than 80%) is received, makeup sessions with assigned
instructors will be conducted. The makeup session will conclude when en
oral evaluation is satisfactorily completed. The content of the quiz will
be different for RO and SRO license holders and will reilect the topic areas
and degrees of responsibility needed by the licence holder. Examoles of
2These lectures nay be given on-shift by- Shift Forenen or Shift Supervisors
13. 2-T
Am. 6l~ (k_T-78)
PAGENO="0791"
787
the materials to be used during the OR lecture series are:
(a) Unit records and logs
(b) Pertinent cossunications to and from the NRC
Cc) Unit procedures and changes
Cd) Test results
* (e) Applicable training program materials
13.2.2.2.2 Fundamentals and System Review (FSR)P~p~~
During each year, licensed personnel shall participate in the Pündsmentals
and Systems Review (FSR) Program based on their annual written examination scores
as identified in Section IV - Evaluations.
The FSR Program may consist of preplanned lectures, self-study- assignments,
possible tutorial sessions with designated technical instructors, arid evaluation
quizzes. The study assignments and preplanned lectuims will be in keeping with
the license level of the individual license holder. Individual, study assignments,
films, and video tapes will consist of no more than 50% of the FSR Program.
Preplanned FSR lectures shall be scheduled in those areas where annual
operator and senior operator iiritten examinations indicate that emphasis in
scope and depth of coverage is needed.
Any or all of the following topics may be included in a Particular year's
FSR Program:
(a) Principles of Operation
(b) Features of Facility Design
Cc) General Operating Characteristics
Cd) Instrumentation and Control
Ce) Safety and Duergency Systems including unit/station
protection systems
* (f) Normal and Raergency- Operating Procedures ".
(g) Radiation Control and Safety
For Senior Operators the FSR Program will also include:
* (h) Reactor Theory
* Ci) Radioactive Material Handling, Disposal, and
Hazards
(j) Specific Operating Claracteristics
(k) Fuel Handling and Core Parameters
(1) Administrative Procedures, Conditions and Limitations
Performance of FSR assignments will be determined through written
evaluation cpiizzes. These quizzes will be specifically directed toward RO
and SNO Iniowledge requirements. The quizzes nay be administered in either
the closed book, or open book format, as classroom or on-shift quizzes.
A satisfactory grade on the FSR evaluation quiz villbe 80%. It a grade
below 80% is achieved by a license holder, a deficiency is assigned and the li-
cense holder will be assigned an accelerated recualification program as per
Section VI.
13.2-S Am. 6~, (`i-T-T8)
PAGENO="0792"
788
*13.2.2.3 On-The-Job Training
* During the two-year term of his license, each, licensed operator shall
* participate in on-the-job training which has the following goals:
(a) Each licensed reactor operator or senior operator shall participate
in a ninimum of 10 reactivi~y manipulations as defined in this sec-
tion of the reoualification progrem. Reactor operators or senior
operators licensed on both T~ Units cam perform or supervise these
reactivity manipulations on either unit.
(b) Each licensed reactor operator or senior operatOr shall participate
as appropriate, in applicable surveillance testing, system checkout
and equipment operation based on license level and relevant to the
area of license responsibility.
Cc) Each licensed reactor operator or senior operator shall review
procedure changes, unit notifications, technical specification
changes, reportable occurrences and incidents, either on-the-job or
during sessions of the OR Lecture séries.3
Each licensed reactor operator shall manipulate the unit controls to
effect reasonable reactivity changes. Each licensed senior reactor operator
shall either manipulate or direct the manipulation of the unit controls to
effect reasonable reactivity changes. Reactor operators or senior operators
* licensed on both T~I Units can perform or supervise these manipulations of unit
controls to effect reasonable reactivity changes on either unit.
Reactivity manieulations which demonstrate skill and or familiarity
with reactivity control systems and which are credited to meeting On-the-job
training will include, but are not limited to:
1. Power change of greater than 10% full power with the reactor control
station in manual.
2. Control rod manipulation from subcritical condition to point of
adding nuclear heat. -
3. Boration and deboration maneuvers involving control rod manipulation.
1~. Turbine startuD and shutdown.
5. Reactor trips and subsequent actions. -
The participation of licensed personnel in the on-the-job program
will be reviewed quarterly by appropriate supervisors to insure that opOrators -
participate in ~ variety of evolutions. If diversity of operations is lacking,
specific assignments may be nade to ensure wide operator experience.
Included in the following list are examples of additional operations
which nay be considered in this category. These samples are not to be considered
for reactivity manipulation credit.
1. - Surveillance testing including
a. Containment spray system
b. Safety injection
c. Tuergency Diesel Generators
d. Chemical addition system
2. Makeup and Purification System Operation
3. Decay Heat Reunval System Operaticn
14~ Feedwater System Operation
3Only those changes, incidents, etc., which are selected by the Supervisor of
Operaticns or Supervisor of Training as peroicent to unit operation.
l~.2-9 ~,, ~I n .~
PAGENO="0793"
789
5. Reactor Coolant System
6. Turbine Valve Testing
7. Pressurizer Operation
8. Incore Monitoring System Operation
9. Control Room Calculations including
a. Neat balance
b. Quadrant tilt/imbalance/Rod withdrawal index
c. Reactivity balance
10. Portable HP Instrument use.
Licensed personnel, whose job assignments are not dfrectly related to unit
operations will actively participate in control room operation am average
of ~ hours per month. During this period these licensed personnel will H
participate in whatever activities are in progress.. Reactor operators or-
senior operators licensed on both TMI Units will actively participate in
either unit's control room operation en average of 1~ hours per month.
A simulator may be used in meeting the reciuirements of this section. The -
use of a simulator to meet the on-the-job training section of the program -
also has been previously-reviewed by the NRC. -
The following standards apply to the evaluation of on-the-job performance.
1. Quarterly review of operator participation will be made by the -
appropriate supervisors. The review must indicate a diversity
of experience. If this is not demonstrated, the operator vii]. be
scheduled for additional operating experience.
2. Quarterly review ot reactivity control manipulations CR0) or direction -
(SRO) must show satisfactory progress toward the minimum of 10 oper-
ations as defined in this section. If satisfactory progress is not
indicated, an operator will be assigned additional control room
operations or may accomplish the required reactivity changes on a
simulator. -
3. ~nnual review of licensed personnel whose job assignments are not
directly related to unit operations must show a minimum of 1~8 hours -
of unit operation assignments per year. If this is not complete,
personnel will be assigned to active control room duty until the
time is made up. A simulator may be used to complete control room
time. Reactor operators or senior operators licensed on both TMI
Units 1 and 2 must show a minimum of b8 hours of operations
assignments per year between the two units. -
13.2-10 An. 6~ (`~-7-78)
PAGENO="0794"
790
l3.2.2.~ Annual Evaluation Examination
Evaluations `will be conducted on an. annual basis as follows:
(a) An annual written evaluation exanination will be given to all
licensed oxarators and senior operators prior to th~ completion
of each annual cycle. ~
(b) An annual oral, evaluation will be administered to all licensed
operators and senior operators prior to completion of each annual
* cycle.~-
The annual written evaluation examination will be administered to all
licensed personnel as set forth in the following guidelines:
1. The examination will simulate the. examination normally
administered by the Ituclear Regulatory Commission.
2. Reactor Operators will take Sections A through U of the
examination while the Senior Reactor Operators will take
Sections H through L end answer selected ajiestions in Sac-
tions A through U. .
3. The examination, examination answers and a grading key `will be
prepared in advance.
1~. The examination results will be used to identify specific P55
lecture series topics to be covered by each licensed, individual
during the subseQuent annual reQuelifications program cycle.
5. The examination will be administered and graded by a member of
the station technical staff, station management staff, training
department supervisor; or consultant. .
6. The persons responsible for the preparation of the examinations
and answers will be given credit for passing the examination.
The annual oral evaluation examination, using a checklist, will be
administered to all licensed personnel. The oral examination will cover
the following areas:,
(a) action in event of abnormal conditions
(b) action in event of emergency conditions
Cc) response to unit transients
(d) instrumentation signal interpretation
(e) procedure modification
(f) unit modification
(g) Technical Specifications
(h) Exergency plans
~`Reactor operators or senior operators licensed on both TMI Units will be
given a single ennual'written and oral evaluation examination which covers
both T~'U Units.
l3.2-ll * fin. 6~ (b-i-i8)
PAGENO="0795"
791
The following standards apply to the annual evaluation examination:
1. A license holder who scores higher than 80~ in all sections of the annual
written çvaluation will not be req~iired to participate in the TSR program.
2. If a license holder scores less than 8o5~ o~ any section of the annual
written examination, the license holder will participate in the FSR ~ro-
gram. related to failed sections.
3. If a license holder scored below 80% on two or more sections of the annual
written examination, the license holder will be given an oral examination
and evaluation by the Supervisor of Operations, Supervisor of Training, or
other suitably qualified persons designated by the Unit Superintendent.
This examiner will, based on the results of his examination, make a recoin-
mendation in writing to the Unit Superintendent that the operator either (1)
be relieved of his responsibilities and enter an accelerated training pro- -
gram or (2) be permitted to remain on shift while participating in the
appropriate requalification TSR program with suitable tutorial assistance.
~ An unsatisfactory evaluation on the annual oral examination will require
that discussions of deficienciestake place between the license holder and
either the Supervisor of Operations, Supervisor of Training, or other
suitably qualified parson designated by the Unit Superintendent. A second
oral evaluation examination will be administered. If performance is again
* unsatisfactory, the license holder will be relieved of responsibilities
and placed into an accelerated requalification program.
* 5. If an individual recieves a. grade of less than 70% overall on the annual
examination it will- be mandatory that (1) he be relieved of his licensed
duties and (2) enter an accelerated requalification program. Upon (1) -
successfully passing a second written and oral examination and (2) certif-
ication of satisfactory rating being sent to the ~(RC, the individual will
-. be returned to his licensed duties. .
13.2-ha * ~n. 6l~ (~-T-78)
PAGENO="0796"
792
13.2.2.5 Records -
Records of licensed personnel parformance on all written evaluation
examinations and quizzes shell be available for NRC examination fo.r the
previous two annual reque.lification cycles. These records shall include:
1. Examination and quiz questions
2. P_nswer sheets and grade keys
3. Examination papers and work sheets
Records of participation in all OR lectures and DEE programs will
be available for DEC review for the Drevious two annual requalification
cycles. These records shell include:
1. Attendance records -
2. OR lecture content
3. FSR assignment
1~. Absences end. makeup sessions
5. Assignment check off lists
6. Document review lists.
Records of annual oral evaluation examinations shall be made
available for NRC review for. the previous two annual requalification
cycles.
Records of all on-the-.job activities shall be available for NRC
review for the. two years prior to license renewal application. These
records shall include:
1. Reactivity control manipulation
2. Equipment operation
3. Sinulator participation
Requalification records covering the previous two annual cycles will
be removed from the files following license renewal. -.
A summary record will be maintained on each license holder for the
duration of his employment.
13.2-12 p~ 61~ (!...T.78)
PAGENO="0797"
793
13:2.2.6 Accelerated Reaualifjcatjon Program -
An operator who does not clear de~iciencies assigned due to performance
below standards on either the annual written or oral evaluation will be relieved
of responsibilities and enter a full time accelerated requaljfjcaej~~ program.
The program duration and content will be dictated by the nature of the
deficiency. Program duration will be determined by individual performance.
When the license holder is (1) able to satisfactorily pass en ecuivalent
written or oral examination and(2) certification of his satisfactory rating
is sent to the NRC, he shall resume his on-shift responsibilities. During the
period of accelerated requalification, attendance at the OR lecture series is
required. If the license holder is off-shift for more than 4 months, Section
13.2.2.1 dealing with lengthy absences applies.
13.2.2.1 Pour Nonth Absence ?rogr~
* If a licensed person has not actively carried out the functions of his
license for a period in excess of four months, he shall:
(a) review all material presented or scheduled to have been presented
in the OR lecture series for the period of inactivity
(b) be given am oral examination on the applicable Section of the OR
* lecture series and current unit status
If performance- on the- oral evaluation is unsatisfactory, the individxal
will be placed in an Accelerated Requalification Program in accordance with
Section 13.2.2.6.
Upon receipt of a satisfactory rating, the licensed person shall be
* certified by the Supervisor of Operations, Supervisor of Training or other
suitably qualified person designated by the Unit Superintendent.
* The certification of satisfactory rating will be transmitted to the :.
NRC and only after approval by the NRC shall the operator be returned to normal
licensed duties.
13.2.2.8 !~!~i Licensed Operators
Newly licensed operators shall enter the program and participate in the
annual program cycle upon receipt of their license.
New operators receiving their NRC license less than six months prior to
the nnnual evaluation examination will be required to attend the appropriate
OR and FSR Programs but will be excused from taking the current annual evalua-
tion examination. However, he will be responsible for taking all other annual
evaluation examinations.
13.2-13 An. 61 (!t_7_7~
PAGENO="0798"
794
13.2.2.9 Requalification Program Administration
The Supervisor of Training and his staff are responsible for:
1. Assigning. initructors for the OR lecture series
2. Determining FSR assignments for individual operators
3. Maintaining and revieving all records
1&. Assigning deficiencies, determining appropriate action to clear
deficiencies and clearing deficiencies upon satisfactory con-
pletion of assigned action
5. Arranging accelerated requelification programs as nay be necessary
6. Defining oral evaluation procedures
7. Scheduling necessary simulator tine
8. Prepare license applications forlicense reneval
The Supervisor of Operations, Supervisor of Training, or other suitably
qualified person designated by the Unit Superintendent is responaiblè for~
1. Evaluation of on-the-job ~erformance of all license holdera
2. Meeting vith license holders who recieve unsatisfactor~r annual
evaluation examination grades
3. Certifying operator qualification when returning from a fou±~
month absence from operation
b. Constructing annual written evaluation examination, ansver~
end grade key
5. Grading of the annual written examination
13.2-lb Pm. 6b (14-7-75)
PAGENO="0799"
795
ATTACHMENT 7.1
* UNITED STATES NUCLEAR REGULATORY COMMISSION
* RULES and REGULATIONS
TITLE 10. CHAPTER 1, CODE OP FEDERAI.REGUUflONS-..ENEROY
GENERAL PROVISIONS
SeE
35.1 Psspote.
55.2 ScOpe.
55.3 Liceeuqsene,t,.
55.4 Dunn,.
55.5 ~icutions.
55.6 Intopuet,tinn,.
EXEMPTIONS
55.7 SpeOiROnespflOnL
52.0 Additienst eeqaieveeu.
55.9 Enevptuon, frlicnn,n.
LICENSEAPPI,ICATIOSS
55.10 CnvtevtT3pptiont.
53.11 Reqcisstenet,Tc~th.appentnt.pptics1ino
35.12 Re.uppl~tunvs.
WRITTEN EXAMINATION AND OPERATING
TESTS
35.20 Sscpe of usuixns.
53.21 CoVent efn~,z~,tne shOne
35.22 .CcnteV of seviee opee~tne etittee
55.23 Scope or npee,tae ned snOjOt eperutne
epe.~t1vgtnsts.
35.24 W,ineu of e,,nin,tinn and 1,31 requr,.
55.25 Adeinisnoti 1 cp,tatiel tens ptln?Inln.
itiaIc.ituu,titj~
LICENSES
53.30 I,scsnun uf IscenSel.
55.31 Covditievsnf the licensen.
53.32 Eepieatlnn.
52.35 Rnnrmtortkennen.
MODIFICATION AND REVOCATION OF
LICENSES
55.40 Moditic,tinv cud eeettsatinn niticenses.
55.41 NotiEcation of dss~bit~ty.
ENFORCEMENT
33.30 VMntinnt.
CERTIFICATEOFMEDICALEXAMINATION
33.60 Ec,vtue,tinn Intttt
APPENDICES
Appeedis A-Reqsutsfic*tinn Penleuetu foe
LicesndOpn.utotsnfP.ndontnn~edUtltu.
* AUTHORITY~ The peonlduttiet this Fuel 55
luand sndee sect. 107. 161.61 Stat. 939,940:42
U.S.C. 21 37, 2201. Foe the psrpous nf sea. 223, 65
St,t.95t.u,anendnd:42U.S.C.2275,l55.Sinxnd
504335,0. I6IL6OSt,t.949t42U.S.C.22SI(i).tee.
35.4Oissaedxnd,rcuc,. 116. 107.GOStu'.955;42
U.S.C. 2236. 2237. Seen. 252. 2S6.PobI. I... 93.435,
lISten. 1244, 1246;42 U.S.C. 5842,5146.
thereto.
(b) "Comnsission" means the
Nuclear Regulatory Conunissiots or its
duly authorized representatives..
(c) "Facility" meaps any production
facility or utilization facility as defined
in Part 50 of Ittis chapter.
(d) "Operator'3 is any indivIdual
who manipulates a contrql of a facility.
An individual isdeensedto reanipulatea
control if he directsanother to manipul-
ate a control,
(e) "Senior, operator" is any in-
div~dual designated by a facility licensee
under Part 50 of this chapler to direct
08 the licensed activities of licensed opera-
(f) "Controls" when used with
to respect to a nuclear reactdr means ap..
paratus and mechanisms the manipula-
tion of which directly affect the reac-
tivity or `power level of the reactor.
"Controls" when used with respect to
any other facility means apparatus and
mechanisms the manipulation of which
could affect the chemical, physical.
metallurgical, or nuclear peocessof the
facility in such a manner as to affect the
protection nfhealth and safety against
radiation.
(g) "United States" when used in a
geographical sense, includes all territo-
ries and possessionsof the United States,
the Cunal Zone and Puerto Rico.
fl 55.5 Communics~ions.
Except where otherwise specif~ all
communications and reports concT~ing
the regulations in this pare, and applies-
tions filed under them should be ad.
dressed to the DirectorofNucleat-Reac-
r tor Regulation or the Director of
Nuclear Material Safely and Safegshrds..
as appropriate. U.S. Nuclear Regulatory
Commission, Washington, D.C. 20555.
Communications, reports, and applies-
tions may be delivered in person at the
Commission's offices at 1717 El Street,
N.W., Washington, D.C. orat 7920 Nor-
GENERALPROVISIONS
§ 55.1 Purpose.
The regulations in this part establish
procedures and criteria for the issuance
of licenses to operators, includingsenior
operators, of facilities licensed pursuant
to the Atomic Energy Act of 1954, as
amended, or section 202 of the Energy
Reorganization Act of 1974 and Part 50
ofehischapter; and providefor theterms
and conditions upon which the Commis-
sion will issue these licenses,
1552 Scp.,
The regulations contained in this part
applyto any individunlwho msnipulates
the controls of any facility licensed pur-
suant to Part 50 of this chapter and to
any individual designated by a facility
licensee to be responsible for direc'cing
the licensed activities of licensed opera-
tors.
55.3 License requirenseols.
(a) Noperson may perform the func-
tion of an operator asdefined in thispnrt
`except asauthoeized by a license issued
by the Commission;
(b) No person may perform thefunc- -
lion of a aenior operator as defined in
this part except as authorized by a
license issued by the Commission.
§ 55,4 Definilions,
As used in this part:
(a) "Act" means the Atomic Energy
Act of 1954 including any amendments
I PART OPERATORS' LICENSES * *
F ~
554
April 29. 1976
PAGENO="0800"
796
PART 55 * OPERATORS' LICENSES
Ltotk Avenue. Bethesda, Md. W~~hisgtita, D.C., or 7920 Norfolk
LAvenue, Bethesda Md.
§ 55.6 interpretations.
Except as specifically authorized by Each application
the Commission in writing, no in- e~ for a license shall contain the following
terpretution of the meaning of the information: -.
regulations in this part by any officer or i- - -
employee of the Commission other than (1) The full name, citizenship, age,
a written interpretation by the General address and present employment of the
Counsel will berecognized lobe binding applicant;
upon the Commission. - (2) The education and pertinent ex-
perience of the applicant, including
ExtatPrloss detailed information on the extent and
nature of responsibility;
§ 55.7 Specific exemptions. (3) Serial numbers of any operator
* _. . :. and senior operator licenie issued by the
The Commission may, upon applica. Commission to the applicant and the cx-
lion by an interested person, or upon its piration date of each;
own initiative, grant such exemptions (4) The specific facility for which the
from the requirements of the regulations applicant seeks an operator or senior
in this part as it determines are operator license; -
authorized by law and will not endanger (5) The written request of an
life or property and are otherwise in the authorized representative of the facility
public interest. -license that the operating test be ad-
ministered to the applicant of the
~ § 55.8 Additional requirements, facility.
* - (6) Evidence that the applicant has
a. The Commission may,by rule, regula- learned to operate the controls in a tom-
tion, or order, impose upon any licensee petrol and safe manner and has need for
such requirements in addition to those an operator or a senior operator license-
established in lht regntationsin this part, in the performance of his dseies. The
as it dtdms appropriate or necessary to Commission mayaccept asproofofthisa
protecchealth and to minimize danger to certification of an authorized represnn. i
life or property. Inline of the facility licensee where the
applicant's serviceswill be utilized. This.
§ 55.9 Exemptions from license. ~ certification shall include details on
"courses of instruction administered by
Nothing in thispart shall be deemed to a. the facility licensee, number of course
cequire a license for: hours, number of tapurs of training and
(a) An individual who manipulates nature of training received at the facility.
the controls of a research or training and for reactors, the startup and shut-
reactor aspartofhistraining as astudest down experience received.
in a nuclear engineering cotirse under (7) A report of a medical exasnina-
the direction and is the presence of a don by a licensed medical practitioner.
licensed operator or senior operator; is one copy in the form prescribed in
(b) An individual who munipulates § 55.60.
the controls of a facility as a part of his (b) The Commission may at anytime
training to qualify for an operator after the filing of the original applica-
licensz under this part under the direc- lion, and before the expiration of the
don and in the presence of a licensed license, require further information in
operator or senior operator. order to enable it to determine whether
the application should be granted or
LlcchscAtPLICATIONS denied or whether a license should be
revoked modified or suspended:
55.10 Contents of applications. (c) An applicant whose application
has bred denied because of his physical
(a) Applications for licenses should coxdition orgeneral health maysubmit a
be filed in triplicate, except for the further report of medicnl examination at
report of medtcat examination, with the any time as a supplement to his original
Director of Nuclear Reactor Regulation a lication
it or the Director of Nuclear Mat~riat (d) Each application and statement
~ Safety and Safeguards, as appropriate, shall contain complete and accurate dis-
U.S. Nuclear Regulatory Commission, closure as to alt matters and things re-
Washington, D.C. 2055~5. ~ommunica- -qaired to be disclosed. All applications
lions, reports, and applications may be and statements, other than the matters
delivered in person at the Commission's required by items 5 6 and 7 of
offices at 1717 H Street NW., paragraph (a) of this section shall be
signed by the applicant. .~ -.
§ 55.11 Requirements for the ap-
proval of application.
An application for a license pursuant
to the regulations in this part will be ap.
proved if the Commission finds that:
(a) The physical condition and the
general health of the applicant are not
such as might cause operational errors
endangering public health and safety.
(I) Epilepsy, insanity, diabetes, hb.
pertension, cardiac disease, faintin5
spells, defective bearing or vision or a
other physical or mental condition whic
might cause impaired judgment or moteej
coordination may constitute sufficient
cause for denial of an application. ..
(2) if an applicant's vision, hearing
and general physical condition do not
meet the minimum standards normally
considered necessary, the Commission
may approve the application and include
conditions in the license toaccommo-
date the physical defect. The Commis-
sion will consider the recommendations
of the facility licensee or holder of an
authorization and of the examining
physician on Form NRC-396 in arriv-
ing at its decision.
(b) The applicant has passed a writ-
ten examination and operating test as
rosy be prescribed by the Commission to
determine that he has learned to operate
and, in the case of a senior operator, to
operate and to direct the licensed ac-
tivities of licensed operators in a compe-
tent and safe manner.
(c) The applicant's service as a
licensed operator or senioroperator will
be utilized on the facility for which he -
seeks a license or on a similar facility
within the United States. * - - - -
§ 55.82 Re.applieaiions, - - -
-(a) Any applicant whose application
for a license has been denied because of -
failure to passthewritten examination or
operating test or both may file a new ap-
plication for license two months after the
daleofdenial.Any newapplication shall
be accompanied by a statementsigned b~'
as authorized representative of th~~ -
facility licensee by whom the applicaef
will be employed, stating in detail thd~"
extent of additional training which the..
applicant has received and certifying
that he is ready for re-examination. An
applicant may file a third application six:
months after the dale of denial of his se-
cond application, and may file further
successive applications two years after
the date of denial of each prior applica-
(b) An appticaat who has passed
eithertlse written esamination or operat-.
April 30, 1975
- 55-2
PAGENO="0801"
797 H
ing test and failed the other may request
In a new spplicalioá that he be excused
from re-rumination on the examination
or test which he has pawed. The Cóm.
missios may is its discretion grant the
reqaest if it determines that sufficient
justificAtion is presented ceder all the
Weirrora EXAMINATIoNs AND 000RAT.
INGTE5TS
§ 55.20 Stage of examinaliona,
ThA written coaloiaatioo and operal-
log test for a license as an operator ora
sesior operator are designed to test the
applicant's understanding of the facility
design and his familiarity with the coo-
Irols and operating procedures of ohe -
facility. The written, examination is
based in part on information in the ffmal5
safety analysis report, operating
manuals, and license for the facility,
§ 55,2g Conlenl of operator wrillen
The operator written examination, to
the extent applicable e the facility, will
include questions on:
(a) Faodamrssals of reactor theory,
including fission process, neutron
multiplication, source effects, control
- rod effects, and criticality indications.
I (b) General design features of the
core, including core structure, fuel ele-
ments, control rods, core instrumenta-
tion, and coolant flow.
(c) Mechasital dAsigo fealuresoflhe
reactor primary system.
(d) Auxiliary systems which xffrel
the facility.
(e) General operating charac-
teristics, including causes and effects of
temperature, pressure and reactivity
changes, effects of load chaAgm, and
operating limitations and reasons for
them.
(1) Dmign, components sod fuoc-
lions of reactivity control mechanisms
and instrumentation.
(g) Desigs, components sod fuoo.
F lions of safety systems, including ioslru-
meslatino, signals, isterloeks, automatic
and manual fcolsres.
(h) Compoersts, capacity and fuec-
lions of roseroe asd emergency systems.
(i) Shielding, isolation and coolaio-
merit design features, including access
0) Standard and emergency operal.
log procedures for the fxtilisy and plane.
(k) Purpose and operation of radia-
lion mosiloriog system, including alarm
and survey equipment.
`Avoedrd 33 FR 12774.
(I) Radiological safely principles
qod
§ 55.22 Coolest of senior operalor
wrilles examisation,
The senior operator written exsmisa-
lion to the extent applicable to the
facility, will include qsmeioos 00 the
items specified in § 55.21 and 10 addi-
tion on IhI following:
(a) Conditions and limiextiossin the
facility license.
(b) Design and operating limitations
in the technical spreificaciods for the
facility.
(c) Fatility licensee procedures re-
quired to obtain authority fordesign and
operaliog changes 10 ehl facility.
(d) Radiation hacards which may
arise during the performance of experi-
ments, shielding alterations, mainle-
ounce activities and various costamisa-
lion conditions.
(e) Reactor theory. iecludiog details
of fission process, neutron multiplies-.
tioo, source effects, control rod effects,
ond criticality indications.
(I) Specific operating characteristics,
including coolsse chemistry and causes
and effects of temperature, pressure and
reactivity changes.
(g) Procedures and limitations in-
volved in initial core loadisg,alteratioos
in core configuration, control rod
programming, determination of various F
internal and external effects on core
reaclioily. -
(h) . Puel hsodliog focilities and pro-
(1) Procedures sod equipment
available for handling sod disposal of
radioactive materials and effluents,
§ 55.23 Smpe of operator soil seems'
operator operating tests.
The operating tests sdminiscered to
applicants for operator and senior
operator licenses sregesersltysimilxr in
scope. The operating lest, to the extent
applicable to the fatilily requIresehe up-.
plicast to demonstrate sod understand-.
leg of:
`(a) Pre-slarl-up procedures for the
facility, including associated plant
equipment which could affect resteivity.
(b) Required manipulation of coo-
sole controls to bring the facility from
shutdown to designated power levels.
(c) The source sod significance of
soouocislor signals sod condition-in-
dicating signals sod remedial action
responsive thereto.
(d) The ioslrumeelalion system sod
the source and sigoifienoceofrexceoris.
strument readings.
(e) The behavior ehsracreriseies of
the facility.
(1) The control manipulation re-
quired to obtain desired~ operating
results during oormal, abnormal sod
emergency situations,
(g) The operation of the facility's
heal removal systems, including primary
coolant, emergency coolant, sod decay
heal removal systems,sod the relaeionof
the proptf operation of these systems to
the operation of the facility. ~-
(h) The operation of the ~xcility's
auxiliary systems which coul4,. affect
reactivity.
(I) Thb use sod function_of the
facility's radiation monilbring'bysltms, -
locluding fixed radiation monitors, sod
slarms, portxblesurvey iostrumiitn,sod
personnel monitoring equipment.
0) The signifiesoce elf radiation
hazards, including permissible levels of
radiation, levels in excess of those
authorized and procedures to reduceex-
cessive levels of rsdiation sod to guard
against personnel exposure.
(k) The emergency plan for Ike
facility, including the operator's or
sroior operator'srespontibility todecide
whethernhe plan should be executed sod
the duties assigned under the plan.
(I) The oeeessity for a careful op.
proach to the responsibility associated
with the safe operation of the facility.
§ 55.24 Waiver of examination sod
leol eequiremenls.
* On spplicution, the Commission may
waive soyor all ofeherequiremeotsfors
wiitlenesimiostion sod operating ttsrif
it feds that the spplicsoc:
(a) Has had extensive sctual operac-
log experience at s comparable facility
within two years prior to the dale of op-
plicxeion.
(b) Has discharged his respon-
sibilities comptlenlly sod safely sod is
capable of continuing to do so. The
Commission may sceept as proof of the
spplicsol's past performance s certifies-
lion of so sutborired representative of
the facility licensee or holdeghof so
authorization by which the spplicaocwm
previously employed. The certflQ'stion
shall contain a description of thw.appli-
caot'soperaeiog experience, ioclu3liogsn
approximate number of hours eheappli-
cant operated Ihecootrols of the facility.
the duties performed, sod the extent of
his respoosibility.
(c) Has learned the operating pro-
cedure for sod is quslified to operale
compeeentiy and sofelythe facility desig-
nated in his spplicstion. The Commis-
sion may accept as proof of the appli-
cant's qualifications a certification of so
authorized representative of the futility
licensee or holder of so authorization
55-3
April 30,1975
PART 55 * OPERATORS' LICENSES
49-721 0 - 79 - 51
PAGENO="0802"
798
PART 55~. OPERATORS' LICENSES
where the applicant's services will be cept as evidence, a cerlitfcation by art an application in proper fo 1
t d th d p t I of th I I ty ew I f awl se th t g
§ 55.25 Adm I teat n pe s ~z [mpI~jei~ wh oh th I has beast h xp I Ith ppl
1(f) S h th d as th b f fly d t em colby th Comm
The Commission may administer a - Commission may impose to protect ~ ) Tb r II is dr
mltdp tgttt ppl I `llthotmm dgtlfo~t~~~ fdtht
tS t I t catty f wr tt q est ~ ~ (I) Tb phy 1 d I rid th
by th d p me I I of th § 55.32 E p rat g I Sc t
s.~ ty ~ dth ~ ent lb oh Cons ~a h pe d se op t [0d wIt It mgh d g p bI h
(a) There in an immediate need for license shall expire two years after the `
the app!icant's services.~ -- date of issuance. I'~' (2) (1) Thelicensee has been activ~ly
(b) The applicant has had extensive and extensively engaged as an operat,or -.
actual operating experience at a corn- § 55,33 Renewal of licenses. or asa senior Operator underhisexistink
parable r.vactor. - en license, has discharged his respob,
(c) The applicant has a thorough ~ (a) Application for renewal of a sibilitien competently and safely, and is
knowledge of the reactor control system, ~ licensh shall be signed by the applicant capable of continuing todo so.
instrumentation and operating pro- and shall contain the followine inforena- (ii) The licensee ha~ completed ire-
cedures under normal, abnormal, and lion: qualificalion program or is presently
emergency conditions. (I) The full name, citizenship, ad- erenrolled in a requalification program if
(d) The reactor control mechanism dress and present employment of the ap. ii. the completion of the reqaalification
and instrumextalion are in such condi- plicant program will occur after the expiration
tion as determIned bythe~ommission to (2) The serial number of the license of his license as provided in sub-
permit effective administration of a for whichrenewal is sought; paragraph (a) (4) of this section.
simulated operating test. (3) The experience of the applicant I (iii) Iftherequirementsofparagraph
under his existing license, including the 1(c) (2) (i) and (ii) of this section are not
Ltccssos: . approximate number of hours during I met.theCommission may require the ap-
m which he has operated the facility 1 plicant for renewal to take a written cx-
§ 55.30 lsuaaace of licenses. . Lamination or anoperating text or both..
- (4) Astaternentthat during the effec-
Os deterrnisixg that an application tive term ofhiscurrent license the appli- (3) There is a continued need for a
meets the requirements of the Act and cant has satisfactorily completed the cc- license to operate or direct operators at
the regulations ofthe Commission, the qualification program for the facility fol the facility designated in theapplication.
Commission will issue a license in such which operalor or senior operator
form and containing suchconditions and license renewalis sought. In the case of MODIFICATION At-iD REVOCATION OF
l~rnitations as it deems appropriate and an application foclicense renewal filed LlccNsEZ
ess y w th two y 11 S pt mb 17
1973, if the facility licensee has not im- § 55.40 Modification and revocation
§ 55.31. Condilinna of the lieensest. ~ plemented the requalificatiox program . otlicenses.
-~ a. requirementsin time for the applicant to - - -
Each license shall contain and is sub- complete an approved requalification (a) The terms and conditions of all
ject to the foll&~'ing cosditionn,whether program before the effective term of his licenses shall be subject to amendment,
stated in the lice'lsse or not: current license expires, the applicant revision, or modification by reason of
(a) Neither th~ljcense nor any right shall submit astatement showinghiscur- amendments to the Act, or by reason of
under the license xholl be assigned or I rent enrollment in an approved re- rulesregulations or orders issued in ac-
otherwise eransfered. \ . I qualification program and describing ,, cordance with the Act or any amend-
(b) The license `is `limited to the I those portions of the program which he meats thereto.
fability for which it is issshcl. had completed byehe date of his applica- ~ (b) Any license may berevoked, sos-
(c) The license is limited to those LIon for license renewal. U- pended or modified, in wholeor in part,
controls of the facility specified in the . ~ for any material false statement in tite
license. -. - I(S) Evidence that the licensee has application or any statement of fact cc.
(d) The license is subject to and Ihe discharged his license responsibilities quired under section 182 of the Act, ~4'
licensee shall observe, all applic'able competently and mfely.The Commission because of conditions revealed by such-i'
rules, regulatinesand orders of the Com- may accept as evidence of this a cerlifi-- application or statement of fact or ady
mission cute of an authorized representative of report, record, inspection or othc1~
- xi the facility licensee or holder of an means which would warrant the Corn-
r (e) If a licensee has not been actively ~-.authorization by which the licensee ha~ mission to refuse to grant a license on an
performing the functions of ax operator u. been employed; -. original application, or for violation ofp
or senior operator for a period of four ,.~ ((6) A report by a licensed medical orfailure to observe any oftheterms and
months or longer, he shall, prior to pra~lilioner is the form prescribed in `bonditions of the Act, or the license, or
ec resuming activIties licensed pursuant to 4 55.60. of any rule, regulation or order of the
Ihispart.demoostratetothe Commission (b) In any case in which a licensen Commission.orany conduct determined
that the knowledge and understanding of not less than thirty days prior to the cx- by the Commission to be a hazard to safe
facility operation and administration are piration of his existing licensn has filed, operation of the facility.
- satisfactory. The Commission may cc- ~ ~ 22221. -
April 29, 1975 55~4
PAGENO="0803"
799
PART 55 * OPERATORS' LICENSES
1'~ 55.41 ~otifleattoe of etisabtlity.
The licensee shall notify the Director
or of Nuclear Reactor Regulation or the
Director of Nuclear Material Safety and
Safeguards, as appropriate. U.S. Nuclear
m Regulatory Commission, Washtngton,
°` D.C. 20555. withIn fifteen (15) days after
Its occurrence of any disability referred
I to in I 55.llta) (1) which occurs oIler
I the submission of his medical examirta-
Ltion form.
- EsFoecestENT
§ 55.50 \`inlalionu.
An injunction or other cosirt order
may be obtaioed prohibiting any viola.
lion of any proeision of the Atomic
Eoergy Act of.1954, as amended, or.Ti-
tIe It of the Energy Reorganization Act
of 1974, or any regulation or order
issued thereunder. A court order maybe
obtained far the payment of a civil
a penalty imposed pursuant to section 234
of the Act for violation ofsection 53,57,
62, 63, 81, 82, 101, 103. 104, 107. or 109
of Ike Act, or section 206 of the Energy
Reorganization Act of 1974, or any rule.
regulation, or order issued thereunder.
or any term, condition, or limitation of
any license issued thcreucdcr, or for any
violation for which a license may be
revoked under section 186 of the Act.
Any person who willfully violates any
provision of the Actor any regulation or
order issued thereunder may be guilty of
a crime and, upon conviction, may be
punished by fine or imprisonment or
both, as provided by law.
TCERTIFIC,vTg OF MEDICAL ExAictIsiA.
TION
§ 55.60 Examination form.
(a) An opplicant shall complete and
sign Form NRC-396, `Certificate of
~ Medical Examination."
U. (b) The examining physician shott
complete and sign Form NRC-396 and
shalt mail the completed form to the
Director of Nuclear Reactor Regulation
or Director of Mactear Material Snfety
and Safeguards, as appropriate, U.S.
Nuclear Regulatory Commission.
Washington. D.C., 20555.
NOTE: Cnpirtcf Fear NOC-396 any be nb
t,ioad hyc.eiIirO oAr Diaslv olNaalerr cccclvr
ceyctsrivn or Direcrveof Nccleur t.tolrricl «=cfcly
rod Salrgsardr. cc apywprsclr. 05 Osoloer
RcgaTcl.ry' Czvvricrivv. Wa,h:r~lco. DC.. 21553
§ 55.61 IDetelel 41) FR 1774.1
~a. Inane-The reteocetno oat emard lrteptng
ecqutreavents funtxloed to thIn purt 5,Aae
beets apprnverl by the Deareal AnnouncIng
021cc scoOts' 3-100225 (RntOS), (55359).
rrardnodarxchichdesce,,,....
APPfS0IXA harado.rrtorqs.srhro,acfctersnideaapesundz,'
vds~dsut cady a or us aooapr.rblzsubairucotra
REQIJALIFICATI0N PI105RASIS FOR
LlCE~5SED OPERATORS OF PRODtJC- o...t,.,..y ,,joj,r'. The requstiuicaci..,,
TION AND IJTII.IZATION FACILtT1ES rt'd~~5~a0 valc.I~ rm.rhe.iahrraiute~s.,thur
a. burr tvvsct r.pae.~rocr4 pc'dca~nc,
lrrr.Icc,cn ar'treal'.ot.rclay coaoipulatasrbcptanrrsuor..ts,,nd
arch toocravi scrc.rrpoeav.realxor crursprslacas the
Sconce 50.3Sf IOCFR Pair OOreqsieoxrhur h~. 02tr0,b0,rdhcuot,,itj~5,,t,nd,~ttu5ts,turing
d:oiductrchorsnipalalavonlc.leolpovdac,iosuv,t p?.ctro.oiic.t raspctalomsdcccgrhotcsn,.f rho),.
cAcaOs fasiliies be licoorod opotalorx by ho motor. are ee.l..c .pze.mtoerand se000,.preat,,or,
Coonir,irm aol that iralicidactr cli, direst ha thxonmaopalsc..rr shalt marcia at rt cart It) roar-
liceoreat ccclviii,, of inset cpeouloea by liozocod taOs cartel rmavtpubooceu a any o,cottisari,,e of
uswoo.rr.pershcr iraaavrdascooith ioCFe part rca~r..r c.cc,np%. eaact..c thartleseuteolitotc..nrml
53. Sosti.,c 55.33 cl In CFR Parc 53 ccqciozc thur mamctpstal,..sc ahs~h doot.o,reale ArtS amt!cr
cash licensed ivdiuids:cI dcowrcaate hit ovtivmard f.cntrt,uco tlh macicily ocelot syctemsu.
ovompecarceesccyrcmc years corder fee his morse I'. Each tarried aperacte and sector operator
cmcboermnaemt.Cnmpelnnaecocybrdeomoosirsred,)n hacttoo.,ecrmumod samisfuamory amdmescnrdregisf rho
Imcacteerccroiortioc.hysuoirruoccryocwplcninenfa `qouirt o.e,A oIl upparolus oat emeoleseisoos and
roqucliflnatior progravr ohich ho bert reninoeci kn..c~ 11cc npcmorhr~ peocadueas in eaab ares (ct
sod uppeoned by the Cooocircna. -butt hc a ttcrvcat.
Periodic eeqaatilicalimmc icr alt cpeealort ant ~ ~ arrant opar.aoe ned terdra "preset is
creio operators cf pmt.dcccimcr ned uliliouricet ecgnteuer .1 lusty dnougmt ohannos. (Cranium,.
facilities isreoecuaey ti~~ the perrcvmrol cc nuirtuin changes. nod famIly Icorrachueges.
ommpaterco. purticaterly to carport to, chooeoout sI E.o.t, lcovccct rprrar.te ned can't "pOtato,
neil rmerg000yritaalioec. The acomplecity efrtcsigms e.otOmstlhc corers f all chooenalanIoccergeeuy
rod oporaciog codes of pmo.lacticc sod stiliracitrc percattccecs rca a cc~ataely rutrertaled boris.
facilities eeqaiee that crgcirg conprcheoriarre. a. A smnalulir riry ho xrecl in eceotlvg the
q'.aalitmoctioe progmums ho cmrcluolectfor all mooted qacmrmccomis of par.rgeuplrn Su'aart 3b'iirlrosin,otue
r.paratoes sod senior cporalcrt u,aecuttcr rot sand ropn.dasrs rho ucrarat operarim churastoriarcns of
priociple uod practice. a rho facility nnelcod. and rheaerungocecrr of rho in-
liaersed operarors aod senor operates of pro.. s's
dcccior amid aliliralive tasititiot oho hare lace an-
tiamlyond rrtoeticety000anectascparacorrcras ~
remoerpeercoer shall parlicipare it eeqaatiftnatmce lr.
pocgrstonrmrnlic~rhrerqaieenevlrufchisAppeedin.
todtoidaals aho oulolaimt oporalor Or Sroioc oporu-
ticeores foe the parp.csa nf presiding backup
orpubtiryro hr cpecalivg stul null pcrtioipccr ii,
rhereqcaulmnoal:or p000ravrnerneptrclheeclorc hoc
their contest dalier pooctade rho erect far specilsa
retcaoirg in puccicalac areas. Liarceed opcrcloerrc
scrmocoprrcroetnhocclicorsesrecoeditiomcdra
picnic cturips?cliac 1 rpcailc centrals orly null
partiolpate In hare ptteticvr of rime eeqsulitoatins
progron apprnpciurc a rho dutiotrhey prefarn.
Tho eequati5oalinr po.gravr roqair000enor
o~emcompalcli.orlamc:mmo.mlcomaebvpcrmi.tomndr.v
rho facility fOr chich the postal is liaeorctt.
}tactoee he nsa of a rioalomarottpaciEed Or
Pacagraphs)e ard Sd cf this appendin is pceniuibto
asS sash ccc it ercoamagact.
Requrtincutico PctOcaoc Reqaircmeetts
I. Soimecfmmlc. The toqarliEnomine poonmuoc shutt
be etmrtttasted Inca onrtieammur pctiod Oct tic uunaett
roe coo~r. sod cpncn caratc,ioo shalt he prcnprty cretsim, paragraph ao.rho,totutc,nc,cauaacucstrry
fclh.mocd.partauotroootmvriosmmastchrdate.hysan- ropc.atorocho..poracioucbac.ocoecaicrocthofcc.ti,y
rerriceerqaotilisatit.o prt.g0000s toc'.tcoctaod rheooca~mgemectefrheieaeramcetoties
2. Ltcecrre. Tioc crqautitioolicmc prouroer shalt sod a..rer,mls oF the smnmatutor shalt closely parallel
mestacle preptaroed cocat 000eetatae cod ate- t or.. rho (aattmty ,ccntord.
ciociog basis thecmsghmmsm the ticeono pvoimct in hoe ~ Pctmma,nmtcrs mr aaott Itconoted operator acid
arms oh err ,oocct tqoomoimmr rod sroicr operator semro.rr.peramar to parttccpote Ic an acoeteroceej rr.
moeilleoecaomioalicor iodioaie thscrnphasisio sanyo qmaalmtcoaie.e pommoravt cheer perfoenooor osatau-
crddepmhefctcoeraseisreadodiolheFallooiegsaah. mc5Oooattcm:adPccccomttnp000lcsphsilaths.aOh
Theooyrodprirciylrcoit.yaatioe. I"
bGomreral sod rpaomCc porn 0021ti05 crac. a. ~tt of nbc tctguatlftoatloa PeocTetta
PItol mcii uhalt ho eonlmstslned for a period of two years
Plant pmcmrcm~mc sytlon.; so oars, from the dame of 0cc recorded count to donu-
m~~eut the purtlolpatlon of csnh tieenaed op.
S y pea eq pro'.' rn Tb : lie, ~tl ~
R I d I Etal' nc -s gl bytlu
Tccomoosprammoommmmoc. roalucctloec nod clsnuoceatcttoo of a-- ad
Applicoble pcai.mnc ml Tub 10. Chrprrr 1. ttcoat truleclog odccnl.tstateced las ao~ca tot
Otto cf Fadoost Rctctmticvr wlctnh arc oporatoc or oonlos' operator Inset
Othrc trulctrg mccheqcrr montadteg frtntt, emcoclhleeddmnolectnlcs.
cidcmtnprcand tmmhcc ofiaaticc liriolegaicttnoy oha b. Rerords whIch etcouct bo cnatontstnrd pur-
ha used, scoaect to thIs oppcndlc tncp be ttno ortutnas
tedinidsutsiady mr lhn punt of rash opamamoestrult U repiomluord copy or minuotoccac If xuuns
he cno.tarugod Itcc.oner. uorqcnlifioonico pmogecrr
`Ammmonclad Ti FR 2b354
Oeuarentarittcondcm,occols,tfthrsinalrt,.ri,nmitsr
In' ihuscf the funility irsolord.
.1 Earm!tmccmmmte TlmecequatiOcarimtisprcrgrarr cacati
urea Ic `rhich rrtraieie~ is rcedert Ic apmlcscjo
Oscnced r.pcramnm' nod soeic,r opemolor tase.lrslcle.
h. Wriltee Ot000iesticrcs itlrich drnorominr
tiootccad cqcnrslnms' cod soeitmc cprcslncc'bcot.tcdpo
of suhjmcrr oncrrcct is the eoqnali5curitsc prrgrarc,
redprtroidrabcsicfmoeoatasniogrhcickeasclactge,tf
otmem.cccc,t nod moaefeecyprocedacrn.
Syscaooocic .htrmcotioe seal meulculine, of rhr
prof mom aeoo sed s.mnrpeocrcy of torecact oprrnccmrs
aed tacit rmpcraltrrs by cspcm'oisten oed:co tcsimciem
scarf rmremlcarsiocladmnl ooctusmicte of ootitrcL tnttne
cclmtheraboedcnivgaatuattmcsiotalrtcjuhromocrt
aoslncmaeceooycm,eclimioon.
d SiomsialiootmIcmccgeesyreaheocmnlemcctc;..
ticmcnttmar emay he oconmeptished byarinOrhcaonmecl
psnctt.fshcfacitimyio.olncnj,ccbysnicgasiemxtsr,,,
Omborer Iha ncotnr,l paect of the Fanilirp is scat ftcr
silrslutjmec. the adios takes rtc to he abet far thr
encrgonoot.eobrmmcnutooediciersb,llbedmscstsa.3
actaat couaipstnlimmn mt the pboetoonlcols noes ce.
qaimcd.lfocmnclaormrisnaselircmerlirotheecqaieco.
55.5
May 20,1977
PAGENO="0804"
800
PART 55 * OPERATORS' LICENSES
reproduced copy or microform is duly au-
thenticated by authorIzed peroonnel and the
microform to capable of producing a clear
and legible copy after storage for the period
re specified by Comxritsolon regulations.
c. If there Is a conflict between the Corn-
ee mission's regulations in this part, license
condition, or other written Commission ap-
, provai or authorization pertaInIng to toe
retention period for the same type of record,
w the retention period specified in the regula-
I tlons in this part for such records shah apply
unless the Conunirsloo, pursuant to 55.7,
I has granted a specific exemption from the
I record retention ceoutrements specified in
Lths regulations In this part.
r&Ar~;ni~ser~oiee.
neniscrihisappendia naybeonesbyreqsaialicotkno
prcgcoens credoceed by persoos esleer duo the
raoility lireesee fsssh reqoaiiflcaiioe pregrarns are
shnilor Sc the progeus desor*beoi is paaigropho 1
thrcagh 5.aod iheolteerailee pregrorn boa bees op
~ prcceslbyiheCenmissIfs.
7. Appliroisli'y in rro.nes* ned ens rrcroro end
ci eest.rrtcler foeilirirs. To aocennocdaie specialized
If eooIcscfcpraiicsooddilfereocosioaeoirot.eqsip.
once, nod perolcr skills ood bceoiedge, the en-
~ qosliticaticopergeam foreaohiicensedaperatcrand
~ pe~sle at a researcher test ezoctcr cc afa
I ees.eosctoefaciiiiyshallccoei.rengeeerollybsieeed
cot be idootioal Is the reqsalilieatios psegraro cal.
lineal in paragraphs I Ihreagh 6 ef this appoods.
~ Hcsaecee. sigeilicaoi donistiros Iron the reqsire.
I mcntsctthisappendiashallbepoeotittesleoiyifssy-
and apprenesl by the
May 21. 1976 55-6
PAGENO="0805"
801
UNITED STATES NUCLEAR REGULATORY COMMISSION
RULES and REGULATIONS
TITLE 10, CHAPTER 1. CODE OF FEDERAL REGULATIONS-ENERGY
[~A~i1
1 ~
39 FR 35571
Feblished 10/15/74
Coexeent Period expires 11/29/74
Pseeeenxtio,s ofReco~-d.e;MdxeeesoeceRe-
qott~JorLicexsees eedAppticanex
See Fart 20 Proposed RuleMaking.
OPERATORS'LICENSES
PROPOSED RULE MAKING
55-7
April 30,1975
PAGENO="0806"
Unit 1 Staff Recommends Approval
Approval_______________ Date_______
Cognizant Oept. Head
Unit 2 Staff Recommends Approval
Approval________________ Date
Cognizant Dept. Head
Unit 1 PORC Recommends Approval
Date_____
`
PORC comments of
(date)
Date_________
Unit 2 PORC Recommends Approval
~ ~ Date_____
j/~Chairm~nofP0RC
PORC comments of__~~~ included
(data)
By__________________________ Date_________
Approva1_~~ Date______ Approval 4 2'~ ~ DateL~,//~/177
Hgr., Get. ual 1 Assurance tation Superantenden
UnitSuperinrencfent TM - 11~
(~7 1-: -:»=~-~~~._ ~
802
1012
Revision 8
11/04/77
ENC. 3
THREE MILE ISLAND NUCLEAR STATION MASTER COPY
STATION ADMINISTRATIVE PROCEDURE 1012
SHIFT RELIEF AND LOG ENTRIES DO NOT REMOVE
Table of Effective Pages CONTROLLED COPY
Date
Revision ~ Date Revision ~ Date Revision
1.0
08/11/75
3
2.0
11/04/77
8
2.1
11/04/77
8
3.0
01/12/77
6
4.0
08/11/75
3
5.0
08/11/75
3
6.0
03/11/75
3
7.0
08/11/75
3
8.0
08/11/75
3
9.0
11/16/76
5
10.0
06/20/77
7
11.0
06/20/77
7
PAGENO="0807"
803
08/11/75
Revision 3
THREE MILE ISLAND NUCLEAR STATION
ADMINISTRATIVE PROCEDURE #1012
SHIFT RELIEF AND LOG ENTRIES
Table of Contents
1.0 GENERAL
1.1 Purpose
1.2 Scope
1.3 References
2.0 RESPONSIBILITIES
2.1 Station Superintendent/Unit Superintendent
2.2 Supervisor of Operations
2.3 Shift Supervisor/Shift Foreman
2.4 Control Room Operator
2.5 Supervisor-Quality Control
3.0 REQUIREMENTS
3.1 General
3.2 Hourly Log
3.3 Control Room Log
3.4 Control Room Log Prior to Initial Criticality
3.5 Shift Foreman Log
3.6 Radio Log
3.7 Shift Relief
1.0
PAGENO="0808"
804
1012
Revision 8
11/04/77
1.0 GENERAL
1.1 Purpose
This procedure establishes the requirements for shift relief
and for recording station operating activities in logs or
other controlled documents on a shift basis.
1.2 Scope
This procedure outlines the responsibilities of the on-duty
and the on-coming shift personnel during shift relief. It
also describes the various shift records and logs involved and
the instructions required to maintain these records to conform
to Technical Specifications and to assure the adherence to the
requirements of FSAR.
1.3 References
a. Metropolitan Edison Technical Specification Section 6.5.
b. Appendix A, N.R.C. Safety Guide 33, Section A.
c. F.S.A.R. Volume 4 - 12 - 10 (Unit 1), 11, 12, 13 (Unit 2)
d. Hourly Log (Form 3042379)
e. Control Room Log
f. Shift Foreman Log
g. Radio Log - Form 00:4-ME
h. Met-Ed Co.'s Operating Instructions & Procedures applying
to the use of the Mobile Radio System.
2.0 RESPONSIBILITIES
2.1 The Station/Unit Superintendent shall be responsible for the
implementation of the recording of all data relative to the
testing and operational status of the ThI Nuclear Station.
2.0
PAGENO="0809"
805
1012
Revision 8
11/04/77
2.2 The Supervisor of Operations shall be responsible for the
review, approval and storage of the logs and records; The
supervisor of Operations (or his designee) shall review the
2.1
PAGENO="0810"
806
1012
Revision 6
01/12/77
Control Room Logand the Shift-Foreman's Log a minimum of once
per week and document the-review by initials or signature.
The Supervisor of Operations shall institute action where
necessary to correct any deficiencies in the recording techniques
or significant operating abnormalities adverse to quality and
determine the cause of such significant operating abnormalities
which have occurred since his last review of the shift foreman's
log. Significant abnormalities are defined as plant conditions
which have potential for affecting the health and safety of
the public.
2.3 The Shift Foreman shall be responsible for the review and sign
off of the Shift Foreman's Log at the completion of each
shift. He shall also make all the detailed entries in the
Shift Foreman's Log.
2 4 The Control Room Operator shall be responsible for maintaining
and signing off the Control Room Log. The control room operator
shall be responsible for maintaining the Radio Log. (per par.
3.6).
2.5 The Supervisor-Quality Control shall be responsible for the
surveillance and audit of all the subject documents.
3.0 REQUIREMENTS
3.1 General
3.1.1 Shift records are defined as Hourly Log, Control
Room Log, Shift Foreman Log, Check off Lists, Recorder
Charts and Computer Printouts that .describe or
record operating information and events. *These
records comprise the information that is necessary
for evaluating operations or for analysis of previous
operations. -
3.0
PAGENO="0811"
807
* ~0l2 08/11/75
Revision 3
3.1.2 All log entries, reports, chart notations, etc.,
must be legible, a~curate, understandable and written
in ink.
3.1.3 Upon assuming the duty, the operator(s) will record
the time and date and make the appropriate notation
indicating his knowledge of the plant status, e.g.
a. Hot Shutdown - as before
b. Cold Shutdown - as before
c. At Power - as before
d. Hot Standby - as before
3.1.4 All log entries shall be prefaced (in the left hand
margin) with the time of entry in (24) twenty-four
hour notation (e.g.-0800, 1300, 2400, etc.).
3.1.5, The individual responsible for maintaining logs must
sign and date the portion or portions of the log
which cover their shift assignment.
3.1.6 Upon completion of the duty, the operator will sign
the log.
3.1.7 Each recording instrument shall be checked on the 11
to 7 shift for correct timing and legibility of
marking.
3.1.8 Each chart shall be marked with the date, time, and
instrument recorder name when replacing the chart
paper. In addition, the variable speed recorder
charts shall be marked to indicate any change in the
chart speed.
4.0
PAGENO="0812"
08/11/75
Revision 3
3.1.9 If it becomes necessary to make any corrections
whatsoever in the various logs, erasing is prohibited.
A single line will be drawn through the incorrect
information and the corrected information shall be
recorded adjacent to or in a space available with
reference to the deleted information. The individual
making the entry shall initial the lined out information.
Log
This log will reflect plant parameters on an hourly
basis. It will normally be prepared by the plant
computer but can be manually prepared by the control
room operator in the event that the computer is not
functioning. If manual preparation is necessary it
will be performed by the control room operators and
auxiliary operators.
Room Log
This
a.
b.
log will contain the following types of information:
Information concerning reactivity.
Alarms pertaining to reactor core conditions
with detailed explanation.
c. Any abnormal condition of operation.
d. Releases of radioactive waste, gaseous or
liquid.
This log is an official document required by F.S.A.R.
and cannot be removed from the Control Room unless
authorized by the Supervisor of Operations.
808
3.2 Hourly
3.2.1
3.3 Control
3.3.1
5.0
PAGENO="0813"
809
08/11/75
gp ]012 Revision 3
3.3.2 The 11 to 7 shift shall initiate their Control Room
Operator's Log on a new page. It shall be prefaced
with a brief description of the plant status, e.g.
a. At (80) Eighty Percent Power - MWT-/MWE
b. Rod Positions
c. Statements regarding unusual evolutions or
alignments.
d. The following equipment is out of service
(list).
3.3.3 All alarms that involve reactor core conditions
shall be recorded by the operator along with an
explanation:or reason for the alarm e.g. Tave,
Reactor Coolant System, pressure, flow, or power.
3.3.4 All reactor startups - record time, Tave, rod positions,
primary pressure and boron concentrations (all
normally taken at lO8 amps on the Intermediate
Range).
3.3.5 Reactor Shutdown - Record rod position, Tave, time,
Boron Concentration and reactor power prior to
inserting rods for shutdown.
3.3.6 Plant Startup - Record the major events and time of
occurrence, e.g., starting RCP's, starting turbine
warmup, etc..
3.3.7 Plant Shutdown - Record the major steps in shutdown
and the associated times.
3.3.8 Each system startup, significant status changes, and
shutdowns shall be recorded. Also, record major
6.0
PAGENO="0814"
810
~AP 1012 08/11/75
Revision 3
unit status changes such as opening of primary
system, flooding of fuel transfer canal, etc. and
the time of the event.
3.3.9 Equipment Malfunction - List the equipment and
problem and any restriction placed on the plant.
3.3.10 Abnormal operation - Record any condition that
causes principle primary or secondary parameters
variation from normal.
3.3.11 Reactivity Changes - Reco~-d the addition or dilution
of RCS Boron Concentration, assignment of rods to
different groups, power changes, etc.
3.3.12 Reactor Trip & Turbine Trip - Record the conditions
prior to the trip, cause of trip (if determined),
corrective action taken and time of the events.
3.3.13 All significant power level changes in the power
range shall be recorded.
3.3.14 Start and stop of any radioactive gaseous or liquid
releases shall be recorded in the Control Room Log
along with the release permit number.
3.3.15 Any abnormal valve line ups and equipment out of
service, or returned to service shall be recorded.
3.3.16 Changes of position of any `defeat', or "by-pass"
switches shall be recorded.
3.3.17 Accomplishment of testing - Record title and number
of the test performed, and the start and completion
times or time of suspension of the test. The perfor-
mance of all periodic tests and inspections required
by the Technical Specifications shall be recorded.
7.0
PAGENO="0815"
811
~O8/11/75
AP 1012 Revision 3
3.3.18 The above sections are not meant to.be all inclusive
but merely indicates the type of entries that should
be made. When doubt exists, enter it in the log.
3.4 Control:Room Log Prior to Initial Criticality
The following operations shall be recorded by the control room
operator.
3.4.1 Execution of switching orders - Record order number
and time as indicated on the switching order.
3.4.2 Placing equipment out of service or returning equipment
to service Log the name and alphanumeric designator
of the equipment, time of shutdown or return to
service and reasons for shutdown or nature of work
completed.
3.4.3 Accomplishing Test Function - Record the test number,
title and time the test was started and completed.
3.4.4 Operating systems under direction of startup - List
the system with a brief description, e.g., Jogging
S.R. valves SR-V-2 and SR-V-6 for position indication
checks.
3.4.5 Major Plant Status Changes - e.g., Filled C.W. Basin
for Tower 1A, Filled Borated Water Storage Tank, De-
Energized D.E.S. 4160 Bus, etc., also record the
time of the event.
3.4.6 Completion and Turnover of Systems - e.g., Acceptance
of a system by Met-Ed - Record the date with a
description of the System and Systems' Boundaries.
8.0
PAGENO="0816"
812
1012
Revision 5
11/16/76
3.5 Shift Foreman Log
3.5.1 This log will contain a summary of the station
operation and major events that occur on each shift.
Significant abnormalities which occur will be explained
in greater detail than would be expected in the
control room log.
3.5.2 The left hand side of the log should be reserved for
changes in status of E.S. components, and major
plant status changes at the discretion of the Shift
Foreman.
3.5.3 When equipment covered by Tech Specs. is taken out
of service, the reason, time, Tech. Spec. requirements
and sample results (if applicable) will be noted on
the left hand pageof the Shift Foreman's Log.
Additionally, all requirements for running, sampling
and/or testing will also be noted, delineating
times, when above must be accomplished.
(i.e.)
7/31/75 1100. Ran SP #1303-4.16 on 18 Diesel
generator to prove its operability, removed 1A DG
from service for oil ring inspection and repair. lB
DG must be tested daily until 1A DG is returned to
service.
8/1/75 1100. Tested lA DG in accordance with SP
#1303-4.16. Test satisfactory.
When the equipment is returned to service the time/date
shall also be noted on the left hand page of the
S.F. Log.
9.0
PAGENO="0817"
813
1012
Revision 7
06/20/77
3.5.4 Upon assuming the duty the Shift Foreman shall record in his
log the plant conditions ~hich exist.
a. Temperature (RCS)
b. Pressure (RCS)
c. Boron Concentration (RCS)
d. MWe Net
e. Rx Power
f. Control Rod Positions
3.5.5 Upon being releived the Shift Foreman will, note that fact
along with the time and sign his section of the log.
3.6 Radio Log
3.6.1 This log will contain the data which must be recorded to meet
the requirements of the (FCC) Federal Communications Commissions
Rules and Regulations, such as (1) Log any contact with another
base station and (2) Log entry made and signed by technician
performing maintenance on the radio unit.
3.7 Shift Relief ,
3.7.1 All shift operations personnel shall be responsible for maintaining
their duty station until properly relieved. The Shift Supervisor,
Shift Foreman, Control Room Operators and Auxiliary Operators
shall be relieved by qualified personnel only, e.g. those
personnel who are properly licensed and properly informed of
the plant status, operations in progress, and any special
instructions which may be applicable. The relieving individual
will discuss the plant status, operations in progress and
special instructions with on-duty personnel so that he is
adequately informed prior to assuming his shift duties.
10.0
48-721 0 - 79 - 52
PAGENO="0818"
814
1012
Revision
06/20/77
3~7.2 The Control Room Operator will acknowledge his understanding
and awareness of the changes in the plant status since his own
last entry by signing the Control Room Log prior to assuming
the shift duty.
3.7.3 During his shift the relieving individual shall insure adquate
review of station logs, records, special instructions, etc.,
which have been generated since his last shift. The logs and
records to be reviewed should include:
1. Shift Foreman Log
2. Control Room Log
3. Hourly Computer Log
4. Tagging Application Book
5. Equipment and Fuel Status Boards
6. TCN and SOP Books
7. Standing Order Book
8. Operations Memo Book
9. F~reventative Maintenance Schedule Books
10. Revision Review Book
11.0
PAGENO="0819"
815
Herr#an Dieckanip
PresdeEt AUG 1 U 1919
GENERAL 260 Cherry Hill Road
PUBLIC Parsippany New Jersey 07054
UTIUTIES 201 263-4900 -
CORPORATION
August 7, 1979
The Honorable John W. Wydler
I~oom 2308
Rayburn House Office Building
Wabhington, D. C. 20515
Dear Congressman Wydler:
* In response to your letter of July 31, I am
enclosing a copy of the answers to questions trans-
mitted to us by Congressman McCormack in mid-June.
Your specific questions concerning Control Room
occupancy is addressed in the answer to Question 10
on pages 6, 7 and 8 of the enclosure.
If I can be of any further help, please feel
free to contact me.
mck
Enclosure
Jersey Central Power & Light Company/Metropolitan Edison Company/Pennsylvania Electric Company
PAGENO="0820"
816
ANSWERS TO QUESTIONS BY THE SUBCOMMITTEE
ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
Q - 1. Wou.~ there beany advantages in standardizing the design of
nuclear power plants?
A - While significant NSSS standardization does exist, it is our view
*that further industry-wide efforts to standardize nuclear plants
would be desirable.
Standardization would be beneficial to the maturation of the
technology and to the assessment of reliability and effective-
ness of safety systems. The process of learning through the
feedback of operating experience can be greatly aided if there
exists a minimum of uncertainty about the applicability of the
experience because of equipment and design differences.
However, achievement of this objective requires a discipline in
the licensing process so that changing regulatory requirements
do not eliminate the possibility of design uniformity.
Since experience will always lead. to the need for design
modification for purposes of plant reliability or safety, a
standardization program must be accomplished under a licensing
program which would approve a block of plants. When the
experience is sufficient to justify changes of true net benefit,
the criteria for the next block of plants would be changed.
The SNUPPS plants are certainly evidence, of interest in and
support for plant standardization. -
PAGENO="0821"
817
In the narrower context of the nuclear steam supply (NSS) and critical
safety systess, a significant degree of standardization ha~ already
occurred by each nuclear steas supply vendor. All B&W-177 plants, typi-
fied by TMI-2, have very similar nuclear systess. Nuclear steam supply
systems offered by all vendors offer a considerable degree of standardiza-
tion within each of their' product lines.
It should be noted that many design features of a power plant relate to
the particular site or to the environment in which the plant operates.
The type of heat sink can dictate many features of the plant secondary
system and equipment selection which are critical to many aspects of the
power plant design.
Beyond this, the NRC policy has encouraged standardization and the supply
industry has responded with "standard" designs. The implementation of this
policy has been very difficult by virtue of the tendency to continually
seek "improvements" during regulatory review. Certainly improvements of
significance should not be overlooked. But, there needs to be a more
critical assessment of the true value of intended improvements in relation-
ship to the extra complexity and unstandardization they can also produce.
The movement toward standard designs has, however, been thwarted by the
absence of sales.
It is also my firm belief that future standardization would greatly reduce
the lead time for nuclear plants not only for licensing but also for
construction and that it would significantly reduce construction cost.
PAGENO="0822"
818
3.
Q - 2. Is there any need fot a "Swat Team" composed of people from industry,
the utilities, NRC, etc.?
A - The concept of a "Swat Team" which is assumed to mean a trained and
ava~able pool of resources to assist in a major nuclear incident,
would be desirable. In our view, such a team would not have to represent
a dedicated full-time capability, but rather could be a team rapidly
formed from members of the utility and nuclear industry and the NRC.
The essentials for effective implementation would include:
a. An identification of anticipated skill requirements and the
source of those skills by company and name.
b. A pre-defined and thoroughly understood management structure
including lines of authority and responsibility.
c. A definition of how the team is to be assembled and supported.
d. An inventory of critical materials and equipment.
Q - 3. Should there be a standard design for control rooms and for the layout
of control room instrument and control panels?
A - It is our opinion that significant improvements can be made in overall
control room design. Some of these improvements could take the form of
future standardization for example, of the meaning of red and green
indication lights, etc. However, a much more important aspect of the
overall control room design is the human engineering or instrumentation!
operator interface. Information could be displayed to the operator
in a more meaningful form; the information display systems must have
* priority assignments built in to assure critical data is made available
to the Operator, without the Operator being submerged in information of
secondary or of a relative unimportant nature. The use of more advanced
computer and digital display and control techniques should be expanded.
PAGENO="0823"
819
We believe this general area is probably one of the most critical,
and deserving of overall industry attention. A. higher degree of
standardization could be beneficial in enabling increased and more
effective simulator use.
Q - 4. Should the control room operators or supervisors be employed by the
utility or by some other agency?
A - From the perspective of nuclear power plant safety, the control
room operators cannot be separated from overall plant operations.
An organizational interface would be difficult to unambiguously
define and could be counter productive to safety. The Important
consideration is that the operators have the proper technical and
educational background, that they are thoroughly trained in the
design and operating characteristics of that particular plant and
that they are completely familiar with plant and operating ~roced-
ures and they. perform In a highly disciplined way. To achieve
this high level of performance, there must be properly cotisidered
operator selection criteria, continuous training, and thorough and
effective evaluation.
Q - 5. In your opinion, what was the cause of the onset of the Three Mile
Island accident?
A - The cause of the onset of the TMI-2 accident was unquestionably the
failure of the power operator relief valve (PORV) on the primary system
pressurizer. While the overall turbine and reactor system ~trip" was
triggered by a signal from the feed system, the plant is designed to
handle these trips and would.have done so in this case routinely
except for the failure of the PORV.
PAGENO="0824"
820
Q - 6. It appears that sotneof the events at TMI took place very rapidly. Is
this indicative of inadequate thermal capacity in the cooling and heat -
transfer systems?
A - We do not consider the rate at which the transient developed at TMI-2 to
have been unusually rapid. From studying the incident and the dynamics
of the plant response, we do not believe that any reasonable increase in
the thermal capacity of the cooling systems would have had any bearing on
the end result, given the same equipment failure and operator actions.
Q - 7. Please comment on the following statement from the testimony of another
witness
"From the viewpoint of nuclear power plant-safety design, two principal
technical elements are involved in DII. The most important is that the
plant was configured so that the pressure relief valve on the primary
coolant system opened very often due to events such as a failure of
normal feedwater flow to the reactor."
A - The TMI-2 plant is configured so that on certain plant trips the reactor
primary system pressure does cause the power operated relief valve to
- open. This was originally done in the design to minimize reactor
"scrams" and allow a much more rapid plant recovery from secondary
system trips. While in this case subsequent failure of the power -
operator relief valve was a major ingredient of the incident, from a
much broader perspective the key question is the assurance of satis-
factory performance of all critical equipment within the plant. We
believe a very important part of the plant design be focused on critical
components and that there be adequate engineering, development, and test
programs to verify component performance and reliability.
PAGENO="0825"
821
Q - 8. The testimony indicates that there are emergency procedures to assist
the control room operator in analyzing the instrument readings. Who
produced this analysis? Please send us a copy of this procedure and the
analysis?
A - There is a written response which details the follow-up action for each
of the appro~imately i200 alarms in the Unit 2 control room. Each
alarm has its individual procedure. Additionally, each of the emergency
procedures contains a listing of the anticipated alarms for the condition.
The emergency procedure contains the appropriate corrective action for
the condition. These procedures were prepared by site engineers and
consultants reviewed by the Plant Operation Review Committee and
approved by the Unit Superintendent. We have not included this material.
because of its bulk but it will be supplied if the committee wishes.
Q - 9. Provide a schematic description of the operation of the Condensate
Polishing System including the means of ensuring adequate redundancy.
A - Enclosed is a system description and a schematic diagram of the Conden-
sate Polishing System. Since the Condensate Polishing System is not a
safety system its design does not include complete redundancy.
However, there are eight condensate polishing tanks in the system and
only seven are required for normal operation. This allows one. tank to
be removed from service for maintenance or recharging without affecting
system operation.
- 10. Is it correct that there were about sixty people in the control room
during the early stages of the accident? Are there any operating
procedures which should have prevented this congestion? Provide a list
of those present.
PAGENO="0826"
822
7.
A - During the early stages of the accident the number of people in the
control room changed from hour to hour. The following is a breakdown
for the first few hours of the accident.
a) 0400-0500 - The number of people varied from three (3) people at
0400 to about eight (8) people by 0500. These consisted of the
operating shift in the control room, Auxiliary operators that
came to the control room as needed, and three support people
from Unit I.
1) Bill Zewe - Shift Supervisor
2) Fred Schiemann - Shift Foreman
3) Ed Frederick - ontrol Room Operator
4) Craig Faust - Control Room Operator
5) Ken Bryan - Shift Supervisor
6) George Kunder - Unit 2 Superintendent Technical Support
7) Various aux. operators in and out
8) Scott Wilkeraon - Nuclear Engineer
9) Kevin Narkless - Nuclear Engineer
b) 0500-0600 - The above mentioned people were joined in Control
room by additional personnel.
1) Walter Marshall - Ops Engineer
2) DougWeaver - I&C Foreman
3) Joe Logan - Unit II Superintendent
Total people in Control Room during this time numbered less
than twelve (12).
PAGENO="0827"
823
c) 0600-0645 - During this period more peopie were arriving
including the remainder of the scheduled shift personnel. The
total number of people was about 20.
1) Mike Ross - Supervisor of OPS Unit I
2) Brian Mehler - Shift Supervisor
3) A~ciam Miller - Shift Foreman
4) Carl Cuthrie - Shift Foreman
d) After 0645 - After this period a site emergency was declared
and the total number of people in control room rose to about
25 people.
A number of the people, listed above, thatwere in the control room at
this time were there as a result of being called to provide assistance.
At times later in the day the number of people increased in the control
room to about 60 people largely because of the evacuation of the
Emergency Control Station (ECS) from Unit I Control Room due to air
borne activity, and establishing ECS in Unit II Control Room. Use of
the Control Room as an ECS and the resulting activity was clearly
separate from the plant operations and did not hinder in any way
control of the plant.
* We do not have operating procedures that limit congestion in the
Control Room but we do have clearly defined areas in the Control Room
where personnel may go only with permission o~ the Duty Operations
Group. There are large red signs overhead and yellow lines on the
floor to indicate these areas, and the Shift Supervisor strictly
enforced these areas during and following the accident.
PAGENO="0828"
824
Q - 11. We gather that it was nearly three hours after the accident before the
plant operators recognized that they had a major problem on their
hands. Please explain this.
A - The~perators knew they had an unusual problem early into the event
because of the high pressurizer level and low RCS pressure. During the
periodthe operators were responding to their indications and taking
action to place the plant in a stable condition. Two hours and 45
minutes into the event high radiation alarms were received. At this
time the radiation level began to exceed the pre established level for
the declaration of a "site emergency".
Q - 12. What type of audio device was used to listen to the steam generators?
Would television cameras, at appropriate locations, have been of any
benefit?
A - Audio Monitors used to listen to the steam generators were:
a. Loose Parts Monitor channel ~5 "Steam Generator A Upper tube
sheet East."
b. Main steam relief valve noise monitor.
Television cameras would have been of no use as far as the steam
generators are concerned.
Q - 13. Why did the control room operators put-on protective masks? At what
time did they put on these masks? Why did the masks donned by the
operators make communications difficult? What type of communications
system is used by the operators when they are wearing masks?
A - The control room personnel put on particulate protective masks when the
air borne activity in the control room reached 1 x j~8 uCi/cc. *
PAGENO="0829"
825
10.
Communication is more difficult in masks because they are not equipped
with a speaking diaphram or another means of good clear speech transmis-
sion.
Wh~e wearing masks the personnel communicated with each other - face
to face, and communicated by telephone.
While using masks personnel speak slowly and loudly to insure they are
understood.
Even with the masks, communication was not seriously impeded.
Q - 14. The testimony indicates that the valves .for the auxiliary feedwater
system were both closed about two days prior to the accident; is this
correct? What was the exaci time that they were closed, and what was
the exact reason for closing them?
A - The auxiliary feedwater valves EF-V12A and B were found closed at
about eight (8) minutes into the event. At this time we are unable to
document when these valves were shut.
However, the EF-V12A and B valves were shut about 42 hrs. before the
event during a scheduled surveillance test performed on the emergency
feed system. The operators involved have testified that they returned
these valves to the open position at the completion of the test.
Q - 15. Is closure of both valves supposed to take place only when the plant is
shut down?
A - The closure of both EF-V12A and B in performance of the Surveillance
test was in accordance with an approved- procedure which was not restrict-
ed to periods when the plant was shut down.
PAGENO="0830"
826
11.
Q - 16. The testimony indicates three actions taken by the control operator(s):
a. He Cut back on the high pressure injection to maintain the pressur-
izer level. Was this the right thing to do?
b. He turned off the two pumps in the "B" loop at 73 minutes into the
accident. Was this a reasonable thing to do?
c. At 100 minutes into the accident the operator turned on the two
- pumps in the "A' loop. Was this a reasonable action?
Specify why these actions were taken. Specify who performed each
Specify who authorized each action.
(a) A control room operator cut back on high pressure injection
flow to try and maintain pressurizer level. The operators
were-trained to respond to maintaining pressurizer level, to
insure it does not go empty nor completely full. The operator
was using approved procedures and respónding to the indications
available to him.
The operator under direction of the shift foreman cut back on
high pressure injection. The shift supervisor agreed
to this action.
(b) The control room operator turned off lB and 2B reactor
coolant pumps under the direction of the Shift Supervisor
because of excessive RCP vibratioh, reduced and oscillating
Reactor coolant flow and fluctuating amperes on the running
RCI"S. Securing RCP'S would preclude severe pumps and motor
damage.
PAGENO="0831"
827
12.
(c) Answer is same as (b) above for tripping of IA and 2A RCP.
The plan was to rely on natural circulation to provide flow
through the RCS.
Q - 17. Des~ribe in detail how your company contacted or alerted NRC about the
accident. Provide a detailed chronology of these actions together with
a list of pe~ple involved in the decision to contact NRC. Did you have
difficulty in contacting NRC?
March 28, 1979
0400 Turbine trip followed by a reactor trip.
0445-0705 Senior station personnel are called at home and arrive at
the site.
0650 Radiation monitors in auxiliary building and the reactor
(approx.)
building dome monitor escalated quickly to alert ranges.
* 0655 Senior personnel in the Unit 2 Control Room (J. Logan -
Unit Superintendent, G. Kunder - Unit Superintendent -
Technical Support, W. Zewe - Shift Supervisor) briefly
discussed the situation andreached rapid agreement that a
Site Emergency was in effect.
Mr. Zewe announced the Site Emergency and started the
notifications required by procedure. (See Enclosure
(1)).
0702 Pennsylvania Emergency Management Agency (State Civil
Defense) notified.
* 0704 NRC Region I notified. The answering service was contacted
and directed to get in-touch with the duty officer.
0720 Remaining notification complete,
PAGENO="0832"
828
13.
0724 General' Emergency declared. This decision was made by the
Station Superintendent (Gary Miller) based on the reactor
building dome monitor, reaching 8 Rem/hr., one of the
specific criteria requiring a General Emergency declaration.
* 0750 NRC Region I called the TMI-2 Control Room and established
an open phone line.
* NRC' notification was required by procedure after a Site Emergency declara-
tion. Since NRC notification occurred before normal working hours, the.
NRC duty officer was not in the office and had to be contacted to return
the call.
Q - 18. Provide' a detailed description of the maintenance work being performed
prior to the accident. This should include, but not be limited to, a
description of the ~~ork being done on the condensate polishing unit at
0400 on March 28, 1979. Was all of this work normal maintenance work?
Was the work done in accordance with B&W maintenance instructions?
Provide a chronology of the work and a list of those who did it.
A - Work being done at condensate polishers at 0400 on March 28.
Number 7 polisher resin was being transferred to the regeneration
receiving tank. This is a part of normal operating procedure for
regeneration of the system and is not considered maintenance. Resin was
clogged in the transfer lime and operator Don Miller and Shift Foreman
Fred Schiemann were trying to free the clogged transfer line. This
system is not part of the B & W scope.
The transfer is done with demineralized water. Service air is applied
periodically to keep the resin swirling in the vessel. It is believed
PAGENO="0833"
829
14.
that the water, under higher pressure than the air, backed up through
the service air sys'~em and got into the instrument air system and
causing a loss of signal air to fail closed the condensate polish outlet
valves. This resulted in total loss of feedwater, which caused the
sul.*equent turbine trip.
Other Shift Maintenace work:
Shift Mainten"ance Foreman:
Electrical - `K. Ebersole
- L. Cisney
Q - 19. Provide a detailed description of your operator training programs.
Provide the "Pass-Fail" grades of the operators on duty during the
period of the accident, and for the prior 48 hours.
A - Operators at nuclear power plants are licensed by the NRC as reactor
operators (RO) or as senior reactor operators (SRO) for each individual
reactor. Licensed operators undergo both NRC administered tests and
Company administered tests. Initial licensing as either an RO or SRO
requires NRC examinations. Every TMI-2 operator listed in the table
below passed the NRC examinations for RO and SRO the first time they
were administered. NRC also requires that licensed operators undergo
requalification examinations administered by the Company every two
years. Net-Ed actually administers these requalificatiön exams every
~. No operator listed below has failed an annual requalification
examination.
A number of TNT 5R0's are licensed on both Units 1 and 2. Licensed
SRO'sdenoted in the table byan asterisk, first held SEQ licenses on
Unit 1. In those cases, the NRC approved and audited a cross-license
C. Leakway
Troubleshooting electrical controls of
Unit 2 Condenser Cleaning System.
48-721 0 - 79 - 53
PAGENO="0834"
83O~
15.
training program and Met-Ed administered "cross-license' examination
prior to amsiending the individuals' license to include Unit 2. In one
case (noted by a double asterisk) the individual first held an RO
license on Unit 1. He. then took the NRC SRO examination for Unit 2 and
upon passing, was licensed by NRC as an SRO on both Units 1 and 2.
The detailed description of our operator training program is attached
as Enclosure',(2). The following table gives data on licensing of
operators who were on duty during the period of the accident, and for
the prior 48 hours.
Unit 2
Control Room Operators (RO License) NRC License
E. Frederick 10/19/77
C. Faust 10/20/77
I. Illjes 10/19/77
.7. Kidwell 6/23/78
N. Cooper 7/5/78
.7. Congdon 10/19/77
H. McGovern 12/6/78
E. Hemmila 12/6/78
C. Nell Awaiting results of NRC Exam
L. Germer Not licensed - CR0 in training
1978 (March)
Requal. Exam
Unit 1 / Unit 2
2 3
NA/MR
NA/MR
NA/NR
NA/NA
NA/NA
NA/MR
NA/NA
NA/NA
1979 (February)
Requal. Exam
Unit 1 / Unit 2
NA/Passed
NA/Passed
NA/Passed
NA/Passed
NA/Passed
NA/Passed
NA/HR
NA/HR
Senior Operators (SRO License)
W. Conaway (RO) 10/19/77, (SRO)
~ Guthrie
F. Scheimann (RO) 10/19/77, (SRO)
**B, Nehier
*J. Chwastyk
*%q~ Zewe
*K. Bryan
5/3/78
NA/HR
NA/Passed
11/9/79
Passed/HR
passed/Passed
5/3/78
HA/HR
NA/Passed
10/19/77
Passed/HR
passed/Passed
11/9/77
Passed/MR
passed/Passed
11/9/77
Passed/HR
passed/Passed
11/9/78
Passed/HA
passed/HR
PAGENO="0835"
831
16.
1 Date initially licensed on Unit 2 based either on NRC examination or Company
cross-license examination.
2 Not Applicable - individual does not hold license on this Unit.
3 Not Required - Annual requalification examination by Company not required
when scheduled within first six months following NRC licensing.
Q - 20. What necessitated this maintenance work; that is, was it an emergency,
or routine? ~Tad similar maintenance work been performed on this unit
before? If so, how often?
A - The maintenance being performed prior to the accident other than that
discussed in 18 was routine. Troubleshooting electrical controls of the
Condenser Cleaning System is performed routinely, about once in each,
one/two month period or as required for a specific problem.
Q - 21. How many condensata polishing units are there on Reactor No. 2 at ThI?
If more than one, were they both (all) undergoing maintenance at the
time the accident was initiated?
A - Unit II has 8 condensate polishers. Only one was in the process of
having resin transferred to the receiving tank. Transfer of exhausted
resin is part of the normal operating procedure required for regener-
ation of the units and is not considered maintenance.
Q - 22. How many condensate polishing units are required to sustain normal
plant operation?
A - Normally 7 polishing units are used during operation at full power
while the 8th vessel is in standby.
Q - 23. Specifically, what occurred on or before 0400 on March 28, 1979 that
caused a reduction in net positive suction head to the feedwater pumps?
What human errors were made; what components failed? Was there a pipe
blockage and if so, what blocked the pipe and why did it occur?
PAGENO="0836"
832
17.
A - At 0400 on March 28, 1979, net positive suction head on the feedwater
pumps was lost because the condensate booster pump tripped. The
condensate booster pump trip occurred as a result of the condensate
polisher outlet valves closing, interrupting flow to the condensate
booster pumps. Valve closure was caused by loss of control air
to the condensate polisher outlet valve positioner, which automatically
signals the valve to close.
We cannot at this tine positively identify the cause of the air failure
to the valve positioner. A probable cause may have been water
Induction to the air system while operations were being conducted to
clear a pipe blockage in a resin transfer line. The resin transfer
line is not part of the condensate flow path. Because of the resin
transfer line blockage, both the fluffing valves and the water sluice
valve on the polisher were open for some periods of time which could
have admitted some water to the station and instrument air supply
system through a leaking check valve.
On tests conducted in the plant subsequent to the incident, we have
not been able to reproduce condensate outlet valve closure on flooding
the instrument air supply to the condensate polisher.
Q - 24. Was any other plant equipcent involved in the initIation of the accident
and if so, what equipment and what was the nature of the contribution?
A We do not consider the equipcent identified in answer to question 23 as
being part of the initiation of the incident. As previously mentioned,
the plant is designed to accommodate loss of feedwater flow. The 1111-2
accident was a result of the failure of the P01W to close on low
primary system pressure.
PAGENO="0837"
833
18.
Q - 25. Considering normal operations at Plant No. ~ TNt and assuming 80% power
with no systems (either operating systems or back-up systems) undergoing
maintenance or test or otherwise inactivated, how many lights on the
control panel would be red? If any, what equipment would they relate to
and what would be the significance of the red indication as opposed to
green?
A - Under normal operating conditions there are about five hundred fifty
red lights in the Control Room.
The significance of red vs. green depends upon its use.
a. For a valve - red indicates open and green means closed.
b. For a motor - red means running and green means off.
c. For a breaker - red means closed arid green means open.
d. For lOIS - red light means high alarm.
e. For control rod position - red light means control rod position
is at full out position.
f. On the IC.3 - red means automatic.
The significance of an amber light.
a. For a breaker or motor control - amber light means disagreement
between breaker position and control switch.
b. For lOIS - amber light means alert alarm.
c. For control rod position - amber light means the rod is out of
alignment with its group average.
The significance of a white light.
a. Indication of power available.
b. On the ICS white means manual.
Q - 26. Are there definite written procedures which define specific reasons or
conditions upon which the reactor would be shut down manually. Do
PAGENO="0838"
834
19.
these conditions include maintenance of äertain equipment? If so, what
equipment is included?
A - There is no procedure which defines specific reasons or conditions upon
which the reactor would be shut down manually. However, the technical
specifications list the minimum amount of equipment in various safety
systems that must be operational for continued operation of the reactor
plant. Where these minimums cannot be met within the required time the
reactor is s'nutdown manually in accordance with Procedure 2102-3.1 -
Unit Shutdown. Additionally, Administrative Procedure - Organization
and Chain of Command gives the authority to the Control Room Operator
to manually shut the unit down for any condition he deems necessary.
Q - 27. Why were the auxiliary or emergency feed systems subjected to surveil-
lance tests twelve times in the first quarter of 1979? List the
reasons together with the dates and the result of the tests. Was the
last test on these systems 42 hours before the day shift on the morning
of March 28?
A - Technical Specification 4.7.1.2.a requires that each of Unit 2's 3
emergency feedwater pumps . . . shall be demonstrated operable at least
once per 31 days on a staggered test basis." Surveillance test 2303-
MO4A/E which complies with 4.7.1.2.a, must be performed nine times
during the 3-month period in question, once each month for each emergency
feedwater pump, EF-Pi, EF-P2A, and EF-P21 to meet this technical
specification. Technical Specification 4.O.5.a, as required by Sec.
II, ASME Code, states that ASME Code Class 1, 2, and 3 valves in this
system be tested at least quarterly, and that the pumps (EF-P2A,
EF-P2B) be tested each month. Valve test 2303-M27A must be perfbrmed
at least once during the quarter, and the pump test 2303-M27B, must be
run three times, once each month in order to comply with technical
specification 4.O.5.a.
PAGENO="0839"
835
20.
Requires Surveillance To be
Technical Specification Test Number period
performed during this
a total of...
4.7.1.2.a !303_M14A*
1 time
4.7.1.2.a 2303_M14B*
1 time
4.7.1.2.a 2303_M14C*
1 time
4.7.1.2.~ 2303-N14D
3 times
4.7.1.2.a 2303-M14E
3 times
4.0.5.a . 2303~N27A*
1 time
4.0.5.a 2303_N27B*
3 times
*Require closure of EF-V12 A/B
Test Name Date Performed Results
Reasons Performed
2303-M14A 01-30-79 Performed Satisfactorily
Required by 4.7.l.2.a
2303-N14B 01-30-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14C 03-09-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14D 01-23-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14D 02-20-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14D 03-19-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M14E 01-04-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-N14E 02-02-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-M145. 03-02-79 Performed Satisfactorily
Required by 4.7.1.2.a
2303-N27A 01-03-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 01-25-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 02-26-79 Performed Satisfactorily
Required by 4.0.5.a
2303-M27B 03-26-79 Performed Satisfactorily
Required by 4.0.5.a
During the period 01-01-79 to 03-28-79, Unit 2 Technical Specifications
required tests of the emergency feedwater system to be performed a
total of 13 times, an equivalent average of once every 6.69 days.
Thirteen tests were in fact performed, each of which met its respective
acceptance criteria for satisfactory performance.
PAGENO="0840"
836
21.
The last test of the system prior to the March 28 accident was conducted
on 03-26-79 from about 1000 to 1230.
Q - 28. Provide details of the `shift overlap~ prior to the accident. Provide
a list of the control room operators, supervisors and others in the
control room during the accident period and for the 48 hours prior to
th~accident.
Shift overlap or shift relief is accomplished by man to man turnover.
In the control room the turnover consists of each man going over a
written up to date list of normal routine work going on and also any
unusual work or any other circumstances worthy of note. Also discussed
are any events accomplished on previous shift and any events planned on
next shift.
List of licensed operators in the Control Room 48 hrs prior to accident.
2300-0700 - 3/26/79
CR0: Edward Frederick
CR0: Craig Faust
Shift Foreman: Frederick Scheimann
Shift Supervisor: William Zewe
0700-1500 - 3/26/79
CR0: Martin V. Cooper
CR0: Joseph R. Congdon
CR0: Earl jlernmila
CR0: Hugh McGovern
Shift Foreman: Carl Cuthrie
Shift Supervisor: Brian Mehler
1500-2300 - 3/26/79
CEO: John Kidwell
CEO: Theodore Illjes.
PAGENO="0841"
837
- 22.
CR0: Charles Nell
Shift Foresan: William Conaway
Shift Supervisor; Joseph Chawastyk
2300-0700 - 3/27/79
CR0; Craig Faust
CR0: Edward FredCrick
Shift Foreman: Frederick Scheimann
Shift Supervisor: William Zewe
0700-1500 - 3/27/79
CR0: Earl Hemmila
CR0: Hugh McGovern
Shift Foreman; Carl Guthrie
Shift Supervisor: Brian Mehler
1500-2300 - 3/27/79
CR0: Charles Nell
CR0: John Kidwell
CR0: Theodore Uljes
Shift Foreman: William Conaway
Shift Supervisor: Joseph Chawastyk
2300-0700 - 3/28/79
* CR0: Edward Frederick *
CR0: Craig Faust
Shift Foreman; Frederick Scheitsaun
* Shift Supervisor: William Zewe
In addition to the licensed operators, ~others are periodically in
the control room but no record is kept).
PAGENO="0842"
PAGENO="0843"
NIUCLEARPOWERPLANT SAFETY SYSTEMS
THURSDAY, MAY 24, 1979
HOUSE OF REPRESENTATIVES,
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION,
COMMITTEE ON SCIENCE AND TECHNOLOGY,
Washington, D.C.
The committee met, pursuant to notice, at 9:40 a.m., in room
2318, Rayburn House Office Building, Hon. Mike McCormack
(chairman of the subcommittee) presiding.
Mr. MCCORMACK. Good morning, ladies and gentlemen. Today
the Subcommittee on Energy Research and Production concludes
this series of hearings on the subject of nuclear powerplant safety.
During the first day of these hearings, we discussed the philos-
ophy and technology of nuclear powerplant safety systems, receiv-
ing testimony from a variety of utility, industry, regulatory, and
other witnesses. Yesterday, we discussed the Three Mile Island
accident in detail, and heard from the utility who owns the plant,
the equipment manufacturer, the Nuclear Regulatory Commission,
the Lieutenant Governor of the Commonwealth of Pennsylvania,
and the president of the American Nuclear Energy Council. Yester-
day's hearings provided a close look at the operation of the Three
Mile Island powerplant during the period immediately following
the accident. It drew my attention, and the attention of other
members of the subcommittee, to the need for improved operating
procedures in our nuclear powerplants.
The topic for today's hearings is "Perspectives on Nuclear Power-
plant Safety," and we are very pleased to have a particularly
distinguished group of witnesses from outside the U.S. commercial
reactor program. These people will advise the subcommittee on the
operating philosophies and safety approaches of several organiza-
tions-the U.S. space program, the nuclear submarine program,
and a foreign nuclear operation.
Our first witness is Dr. Ingmar Tirén, manager of nuclear safety
and licensing for the Swedish Reactor Manufacturing Co., ASEA-
ATOM. Dr. Tirén will be introduced by Dr. Lars Larsson, who is
technical and scientific attaché to the Swedish Embassy here in
Washington, D.C. I wish to thank Dr. Tirén for coming from
Sweden to give us his testimony.
After hearing from Dr. Larsson and Dr. Tirén, we will receive
testimony from Dr. George Low, president of Rensselaer Polytech-
nic Institute. Prior to becoming president of Rensselaer, Dr. Low
was Deputy Administrator of the National Aeronautics and Space
Administration, with particular responsibility for the Apollo pro-
gram. Dr. Low's testimony will be of special interest because he
(839)
PAGENO="0844"
840.
was responsible for the design of the flight control room and for
emergency situation programs in Apollo.
Our final witness will be Adm. H. G. Rickover, Deputy Com-
mander for Naval Propulsion of the Naval Sea Systems~ Command.
Admiral Rickover will describe the Navy's reactor operator train-
ing methods, and the means wher.eby the Navy has ensured reactor
safety at sea.
Before I ask the witnesses to come to the witness table I would
like to ask our ranking minority, member, Congressman John
Wydler, if he would like to make an opening statement.
Mr. WYDLER. Yes. As I stated yesterday, I strongly believe that
this accident must become the "Apollo Fire" for the nuclear indus-
try. That tragic incident served as a constructive basis for technol-
ogy development and improved procedures to enhance spacecraft
safety systems. On this theme, Dr. George Low, the former Deputy
Administrator of NASA, is a most appropriate witness for the
subcommittee this morning. I am looking forward to hearing Dr.
Low's philosophy and perspective on safety systems and ways of
improving the man/machine interface. I believe that his testimony
should be particularly valuable for us in developing legislative
initiatives for DOE programs in safety technology.
I am also delighted to see our good friend, Adm. Hyman
Rickover, head of the naval nuclear propulsion program. Admiral
Rickover's single-minded dedication, high standards, and unique
managerial approach have produced an outstanding track record
for naval nuclear power vessels. His methods for selection and
training of nuclear operators is a benchmark of quality at which
the nuclear industry should aim. It is also worthwhile pointing out
the outstanding low occupational radiation exposure levels which
have been achieved in the admiral's program.
I am also pleased that we shall hear from the Swedish atomic
industry and obtain a different national perspective on nuclear
powerplant safety. I have always found on my oversight trips that
dialog with other countries on energy issues is extremely valuable.
Today, Mr. Chairman, we shall obtain three unique perspectives.
I believe we should derive valuable insights from them as to how
operating safety systems and procedures and training programs
should be improved in the civilian nuclear power sector. We can do
nothing short of this since the stakes involved are the future of
nuclear power in this country and our ultimate energy indepen-
dence.
Mr. MCCORMACK. Thank you, Mr. Wydler.
Dr. Tirén, Dr. Larsson, welcome. Would you please come to the
witness table and make yourselves at home.
Without objection, Dr. Tirén, your formal testimony will be in-
serted in the record at this point, and you and Dr. Larsson may
proceed as you wish.
Dr. Larsson, do you wish to start off?
[The prepared statement of Dr. Tirén follows:]
PAGENO="0845"
841
1979-05-21
IDENTIFYING AREAS OF DEVELOPMENT THAT MIGHT
ENHANCE NUCLEAR POWER SAFETY
A Swedish Manufacturer's Perspective
by Ingmar ~Tirén, AB ASEA-ATOM,
VHster&s, Sweden
Introduction
The nuclear program in Sweden is based on light
water reactor power plants. The first unit, Oskars-
hamn 1 (440 MWe), was ordered by a private Swedish
utility, Oskarshamnsverkets Kraftgrupp AB (0KG) in
1965 and began its commercial full power operation
in 1972 (see Figure 1). Since that tine, three
different utilities are building nuclear power
stations in Sweden. At present, there are six units
in operation, corresponding to a net electric rating
of 3750 MWe, and six additional plants are in the
course of construction.
During 1978, nuclear energy contributed about 25%
to Sweden's total generation of electrical energy.
The Swedish supplier, ASEA-ATOM, has manufactured
nine of the twelve plants in Sweden and has also
won the contracts for two 660 MWe units for Finland.
One of these is now in operation and the other one
is in the commissioning phase.
PAGENO="0846"
842
ASEA-ATOM is an independent supplier of boiling water
(BWR) power plants. There have never been any
licensing ties with other pompanies. Two of the
BWR plants delivered by ASEA-ATOM are turnkey
orders.
Figure 2 illustrates the location of the plants in
Sweden and Finland. As you can see, all plants are
sited on the coast. Three of the four units at
Ringhals, built by the Swedish State Power Board,
have been delivered by Westinghouse. Thus, ASEA-ATOM,
the domestic manufacturer, has no monopoly status
in Sweden, but must compete with other companies on
the international scene.
2 Licensing Authorities
The principal nuclear licensing authorities in Sweden
are the Nuclear Power Inspectorate and the Institute
of Radiation Protection. These are relatively small
organizations. Traditionally, the Nuclear Inspectorate
employs the USNRC rules and regulations as a basis
for its licensing requirements. Our designs are
based on the requirements of the U.S. General Design
Criteria as well as the USNRC Regulatory Guides. In
our design work, we also closely study the acceptance
criteria of the USNRC Standard Review Plans. In 1974
the Swedish Nuclear Power Inspectorate and the former
U.S.A.E.C. signed an agreement for the mutual exchange
of technical information and cooperation in develop-
ment of standards. This agreement has facilitated
our understanding of the concerns reflected in many
U.S. documents.
I wish to take this opportunity to say that the
well-documented safety regulations and guides of
the NRC have been a fundamental and invaluable basis
for any serious nuclear program. Today, as a
manufacturer's spokesman .1 might add that we sometimes
wish the documents were not quite as many.
PAGENO="0847"
843
Although the regulatory process has naturally become
more formalized as the number of plants has increased,
a reasonably effective regulatory process still
prevails. From time to time, we have the benefit
of informal and open-minded discussions with the
authorities and the utilities on various safety
issues. There may be a risk, though, that a more
formalized licensing process could, curb the incentive
for innovation, without necessarily resulting in
safer nuclear power plants.
3 European Safety Requirements
During the evolution of nuclear power in Sweden, the
Nuclear Inspectorate has established a few specific
Swedish rules. The most important ones are shown in
Figure 3. The earliest and probably most significant
one is the `30 minute rule". This rule requires that
all actions that have to be taken in the nuclear
power plant in order to avoid excessive release of
radioactive substances after an accident must be
automatic, if the action is needed within 30 minutes
after the postulated initial event.
Another rule has been established to the effect that
a single failure of a passive component in emergency
cooling fluid systems must be assumed to occur
12 hours or more after the postulated initial accident.
A third requirement which `was adopted~ss far
as 1972, in conjunction with the construction permit
for BarsebEck No. 2 unit, concerns the pressure
relief system of the BWR pressure vessel. This rule
sets out that the pressure relief system, i.e. the
safety valves, must be sized so that a pressurization
transient is limited to 110% of the design pressure,
even if reactor scram fails completely. I must add,
however, that the Swedish authorities have not hither-
to pursued other aspects of the ATWS issue that are
so heatedly debated here in the United States.
PAGENO="0848"
844
Some safety-related developments that have had an
appreciable impact on the design of recent Swedish
plants have, to some extent, a European flavor. Two
important items are shown in Figure 3. The first
item is the N-2 criterion. In sonewhat simplified
terms, the N-2 criterion assumes that a safety-
related system is divided into N subsystems or
"trains". Now, after a postulated initial event that
requires this system to operate, the designer must
assume one sub-system to be defective and one sub-
system_to~be unavailable due~ to repair or maintenance.
Hence the N-2 designation. The result of this
criterion is to require enhanced redundancy of
safety-related systems.
The other item deals with the protection of the plant
from external events, particularly man.-induced
hazards. This item, as well as the concern with
regard to fire hazards and other types of common
cause failure, leads to enhanced requirements to
separate physically the redundant safety systems.
In this context, "physical separation" means locating
the safety systems some distance apart and separating
them by means of strong barriers.
As far as the Swedish Institute of Radiation Protection
is concerned, one characteristic of their activities
is their emphasis on the limitation of population
doses and collective doses as a supplement to
individual dose limits.
Current work within the Institute of Radiation
Protection includes the development of collective
occupational dose limits for plant personnel and
emergency planning for post-accident conditions.
With regard to doses, the stated goal is to limit
the annual occupational dose burden to 0.2 nanrem
per MWe. The situation inSwedish plants is, in fact,
quite favourable in this respect, as shown in
PAGENO="0849"
845
Figure 4. The occupational doses expressed in annual
manrems are plotted for each year and are compared
with those reported for U.S. plants. The low values
achieved in Swedish plants can be attributed to a
series of factors, including spacious layout,
conservative shielding design, good water chemistry
conditions and material selection as well as
suitably and carefully selected, work instructions.
4 Safety features of current Swedish BWR5
Now, let me briefly illustrate some of the safety
features of Forsmark 3, the latest ASEA-ATOM 1000 MWe
BWR plant.
The building layout is illustrated in Figure 5. The
reactor building is at the centre, surrounded by the
`control building, the turbine building and auxiliary
buildings. The figure illustrates the division of
the entire plant in separate fire zones. Each fire
zone is divided into a number of separate fire cells.
Figure 6 shows the boiling water reactor located
inside the prestressed concrete containment. The
reactor is characterized by its internal recirculation
pumps (Figure 7).
Another safety-related feature is the use of two
``"`i~ndépendent means for inserting the control rods.
Fast scram is achieved in less than 6 ~
means of a hydraulic system. As a back-up to this
function and for the purpose of normal control rod
adjustments, an electric motor provides the means
for continuous motion of the control rods. By means
of the electric system, which is conpletely independent
of the hydraulic system, the control rods can be
inserted into the reactor core in 4 minutes from
the fully withdrawn position.
48-721 0 - 79 - 54
PAGENO="0850"
846
The emergency core cooling systems (ECCS) include
a high pressure coolant injection system, an autonatic
depressurization system, and .a low pressure injection
and spray system. The emergency shutdown cooling
system, including the entire cooling chain to the
ultimate heat sink, is also regarded as an emergency
cooling system satisfying safety requirements
equivalent to those applicable to the ECCS.
Each of the emergency cooling systems is divided into
four subsystems (Figure 8) Each of the subsystems
A, B, C, and D is independent and physically
separated from the others. On-site power is distributed
from four separate. diesel-generators, each feeding
one set of the four emergency cooling subsystems.
Safety-related control equipment is located in four
separate relay rooms surrounding the control room.
Communication between the control panels and the
relay rooms is arranged by means of fibre optics,
in order to avoid electrical di~sturbances between
the separated control divisions. The control room
can be galvanically isolated from the automatic
control processes actuated in the relay rooms.
The same consistent separation into four trains
also applies to safety-related cables and piping.
5 suggested Areas of Nuclear Power Plant Safety Development
In the presentation so far, I have described some
of the safety and licensing activities in Sweden.
I would now wish to outline some areas of further
work that 1 believe nay help to maintain the high
safety record that is such an outstanding charac~
teristic of nuclear power plants. My comments relate
mainly to measures that may reduce the probability
of serious accidents. This emphasis may be regarded
as reflecting thedesigner's main ambition with
respect to safety which is accident prevention.
PAGENO="0851"
847
The most important item in my mind is to make use
of experience of malfunctions and incidents that
have occurred in nuclear power plants. I am
convinced that if we analyse carefully their causes
and the sequences of events, and if we also take
action to prevent their recurrence, this feedback
process will ensure that the nuclear reactor core
melt probability will decrease as experience is
accumulated.
Secondly, we should focus our attentionon likely
initiating events and related safety precautions.
This is a conclusion based on the USNRC Reactor
Safety Study as well as on experience. I believe
that a period of reflection and digestion is~
desirable, rather than one of introducing further
new safety requirements. We shall then be able
to evaluate the real merits of the requirements now
enforced and implemented in current designs. It is
necessary to concentrate our efforts on the safety
problems of everyday life in the nuclear power plant,
rather than to distract from these realities by
further debating probability levels of 10-6 or lO~.
Thirdly, it is quite clear that the plant crew is
important in the prevention of accidents as well as
in mitigating the consequences of an accident. The
USNRC Reactor Safety Study provided a good starting
point for studies of human error. This work should
continue. In addition, the operating staff should
be highly qualified and be given responsibilities,
training and working conditions that provide a solid
basis for their qualification. On this point, I
believe that the present situation may be different
from one plant to another.
I do not mean to say that the processes and develop-
ments I have suggested are new. It is more a. -
matter of emphasis.
PAGENO="0852"
848
As regards post-accident conditions, environmental
qualification of safety-related ectuipment is an
important item which has also received increased
attention during the last couple of years.
Finally, the Three Nile Island indicent clearly
demonstrates the need for improved in-plant accident
response. Actually, this item was given a high
priority in the 1978 USNRCIp1an for research
to improve the safety of light-water nuclear
power plants.
Thank you.
Attachment: Biography
PAGENO="0853"
849
PAGENO="0854"
850
Figure 2
SWEDEN
NORWAY
land II
PAGENO="0855"
851
Figure 3
SWEDISH SAFETY REQUIREMENTS
30 minute rule
- Passive single failure
in ECCS fluid Eomponents
- Reactor pressure relief
without scram
EUROPEAN SAFETY REQUIREMENTS
(examples)
- N-2 criterion
- External events (man - induced)
PAGENO="0856"
ASEA-ATOM BWR
CS!
P.
m
a
- OCCUPATIONAL RADIATION EXPOSURE
Average exposure per reactor unit and: year
Comparison with US LWR
1969 1970 1971 1972 1973 1974 1975
The average is based on all reactors which have been
in commercial operation for at least one year.
RFC OY-1,03.1979
AS EA-ATOM
PAGENO="0857"
BWR 75 - VENTILATION 3YSTE' IS
Fire~ zones
121 Reactor building
122 Turbine buiiding
123 Condensate cleanup system building
124 Auxiliary systems buildings A, B
125 Entrance bi~ilding
126 Control building
127 Diesel buildings A, B, C, D
128 Waste building
129 Active wor~5*
1954 508 9 3 5 3 0 528 64
1955 2563 80 25 6 3 2 2679 344
1956 2834 20 5 2 0 1 2862 162
1957 3473 97 31 1 2 4 3608 495
1958 5766 165 46 10 4 7 5998 779
1959 10388 221 133 78 49 23 10892 1864
1960 12047 198 97 22 4 0 12368 1158
1961 13383 198 91 44 14 3 13733 1241
1962 14411 642 366 247 146 108 15920 5222
1963 19164 446 159 71 34 28 19902 2725
1964 24044 804 445 215 144 41 25693 5678
1965 22630 2306 1314 814 618 525 28207 15829
1966 29490 2352 1623 1057 1139 513 36174 18804
1967 29853 2388 1563 1096 733 1 35634 13908
1968 30159 1344 773 496 279 0 33051 8719
1969 25672 1790 1080 753 375 0 29670 11077
1970 21182 2127 1382 740 492 0 25923 13084
1971 20041 1928 1066 650 240 0 23925 10616
1972 17514 1692 849 139 5 0 20199 7002
1973 13036 1403 604 203 6 0 15252 6083
1974 12587 1464 745 311 50 0 15157 7206
1975 12825 1116 598 82 42 0 14663 5285
1976 13042 1268 633 30 0 0 14973 5310
1977 13835 1277 586 25 0 0 15723 5199
1978 13700 1016 268 0 0 0 14984 3680
Note: During 1978,verifications were made of data in a similar table in ref
(9) which had been obtained from summaries rather than directly from original
medical records. Corrected data above differs from that in ref (9).
Exposures from Nuclear Regulatory Commission or State licensed radiation
sources have been excluded as far as practicable. Total man-rem was deter-
mined by adding actual exposures for each individual during the year.
* Limit in the Naval nuclear propulsionprogram was changed to 5 rem
per year in 1967.
PAGENO="1012"
20,000
4
15,000
LU
0~
LU
z
4
~1
4
I-
0
~000
10,000
-J
4
LU
>
0
z
Il)
I
In
LI..
0
LU
D
z
YEAR
~o0
FIGURE 2
TOTAL RADIATION EXPOSURE RECEIVED BY SHIPYARD PERSONNEL
FROM WORK ASSOCIATED WITH NAVAL
NUCLEAR PROPULSION PLANTS
1958-1978
PAGENO="1013"
1009
TABLE 4
SHIPYARD, SHIPS, TENDERS, AND SUBMARINE BASES
DISTRIBUTION OF PERSONNEL RADIATION EXPOSURE
Average Rem Per
Year Person Monitored
Fleet
S
hipyard
1954
.22
.12
1955
.25
.13
1956
.41
.06
1957
.20
.14
1958
.17
.13
1959
.18
.17
1960
.14
.09
1961
.14
.09
1962
.18
.33
1963
.15
.13
1964
.18
.22
1965
.27
.56
1966
.19
.52
1967
.14
.39
1968
.10
.26
1969
.11
.37
1970
.11
.50
1971
.12
.44
1972
.10
.35
1973
.10
.40
1974
.11
.48
1975
.12
.36
1976
.14
.35
1977
.14
.33
1978
.10
.24
Average
.13
.35
NAVYWIDE
.25
AVERAGE
Percent of Personnel
Monitored Who Received
Greater Than 1 Rem
Fleet Shipyard
0 3.8
10.9 4.3
11.5 1.0
2.7 3.7
2.4 3.9
4.7 4.6
7.5 2.6
2.9 2.5
4.3 9.5
2.7 3.7
4.4 6.4
7.5 19.8
4.6 18.5
2.5 16.2
2.0 8.8
2.7 13.5
2.9 18.3
2.7 16.2
2.3 13.3
2.3 14.5
2.0 17.0
2.0 12.5
2.4 12.9
2.3 12.0
1.4 8.5
2.8 12.2
0
0
0
0
0
8
0
0
9
2
3
5
6
3
0
0
0
0
0
0
0
0
0
0
0
Number of Personnel
Who Exceeded 3
Rem/Quarter
8.0
PAGENO="1014"
1010
operate a nuclear propulsion plant is about 1 rem. These radiation
exposures are much less than the exposure the average American receives
from medical diagnostic X-rays during his working lifetime.
Table 5 provides information on the distribution of lifetime
accumulated exposure. This table includes all shipyard employees who
at some time during 1978 were monitored for radiation exposure.
Also shown in this table is the distribution of lifetime accumulated
exposure for every person monitored In one shipyard since radioactive
work started. For ships the data was obtained by sampling selected
ships. Federal radiation exposure limits allow accumulating 100 rem
in twenty years of work, or 200 rem in forty years. The fact that
no one shown in Table 5 comes close to having accumulated this much
radiation exposure is the result of deliberate efforts to keep well
below the lifetime accumulated radiation exposure limit.
- TABLE 5
DISTRIBUTION OF TOTAL LIFETIME OCCUPATIONAL RADIATION EXPOSURE ASSOCI-
ATED WITH NAVAL NUCLEAR PROPULSION PLANTS
Percent of Personnel With Lifetime Accumulated
Radiation Exposure in the Radiation Range
Range of Accumulated Ship Personnel All Shipyard One Shipyard-
Lifetime Radiation Monitored in Personnel Non- All Personnel
Exposure (REM) 1978 itored in 1978 Ever Monitored
0- 5 99 75 87
5-10 1 12 6
10-15 0.1 : 6 3
15-20 .03 3 1
20-25 0 2 1
25 - 30 0 1 Less than 1
30 - 50 0 Less than 1 Less than 1
Greater than 50 0 0 0
Table 6 provides a basis for comparison between the radiation
exposure for light water reactors operated by the Navy and commercial
power reactors licensed by the Nuclear Regulatory Commission. The 1977
data in this Nuclear Regulatory Commission table covers 65 licensees
with a total of 32,731 man-rem (ref 10). The average annual exposure
of each worker at commercial power reactors was 0.46 rem. Licensees of
commercial power reactors reported 141 overexposures to external radia-
tion during the years 1971 through 1977. Numbers in excess of 5 rem
are not necessarily overexposures since Nuclear Regulatory Commission
regulations permit exposures of 3 rem each quarter up to 12 rem per
year within the accumulated total limit of 5 rem for each year of a
person's age beyond eighteen.
PAGENO="1015"
TABLE 6
PERSONNEL RADIATION EXPOSURE FOR LIGHT WATER REACTORS LICENSED
BY U.S. NUCLEAR REGULATORY COMMISSION
SUMMARY OF ANNUAL WHOLE BODY EXPOSURE BY INCREMENT
I.
YEAR
TOTAL
MONITORED
NOT
~ 0-1
1-2
2-3
NUMBER OF INDIVIDUALS NUMBER
EXPOSURE INCREMENT - REM OF OVER-
>10 EXPOSURES
3-4
4-5
5-6
6-7-
7-8
8-9
9-10
1969
2854
2607
144
70
26
5
2
0
0
0
0
1970
7518
6953
184
175
92
102
11
1
0
0
0
1971
10269
9660
328
146
107
17
11
0
0
0
0
2
1972
15730
14783
536
205
114
47
23
10
6
6
0
16
1973
35918
20717
10249
2449
1585
432
237
117
71
38
16
7
0
19
1974
38379
20240
13455
2491
1375
470
226
86
30
6
0
0
0
43
1975
45659
20188
18277
3892
1903
707
426
169
60
24
12
0
1
14
1976
61151
25704
26636
4880
2354
789
487
188
70
26
11
5
1
20
1977
70904
27671
33252
6174
2838
1130
569
141
66
36
21
6
0
27
SOURCES: 1969-1976: NUREG-0323 Occupational Radiation Exposure at Light Water Cooled Power Reactors 1976
1977: NUREG-O463 "Occupational Radiation Exposure" Tenth Annual Report 1977
`7
PAGENO="1016"
1012
INTERNAL RADIOACTIVITY
Policy and Limits
The Navy's policy on internal radioactivity for personnel associated
with the nuclear propulsion program continues to be the same as it was
more than two decades ago, to prevent significant radiation exposure
to personnel from internal radioactivity. The limits invoked to achieve
this objective are one-tenth of the levels allowed by Federal regula-
tions for radiation workers. The results of this program have been
that no one has received more than one-tenth the Federal annual internal
occupational exposure limits from internal radiation exposure caused
by radioactivity associated with Naval nuclear propulsion plants.
The basic Federal limit for radiatiOn exposure to organs of the
body from internal radioactivity has been 15 rem per year. There have
been higher levels applied at various times for thyroid and for bones,
however, use of these specific higher limits has not been necessary
in the Naval nuclear propulsion program.
Fifteen rem per year is the limit recommended for most organs of
the body by the U. S. National Committee on Radiation Protection in
1954 (ref 1), by the U. S. Atomic Energy Comission in the initial
edition of ref 3 applicable in 1957, by the International Commission
on Radiological Protection in 1959 (ref 2), and was adopted for
Federal agencies when President Eisenhower approved recorrinendations of
the Federal Radiation Council May 13, 1960. Although the International
Commission on Radiological Protection revised its recomendations in
1977 (ref8) to raise limits for most organs,the Naval nuclear propulsion
program has not changed its limits.
Source of Radioactivity
Radioactivity can get inside the body through air, through water
or food, and through surface contamination via the mouth or skin or a
wound. The radioactivity of primary concern is the metallic
corrosion products on the inside surfaces of reactor plant piping
systems. These are in the form of insoluble metallic oxides, primarily
iron oxides. Ref (11) contains more details on why cobalt 60 is the radio-
nuclide of most concern for internal radioactivity.
The design conditions for reactor fuel are much more severe for
warships than for cornmerical power reactors. As a result of being
designed to withstand shock, Naval reactor fuel elements retain
fission products including fission gases within the fuel. Sensitive
measurements are made frequently to verify the integrity of reactor
fuel. Consequently, fission products such as strontium 90 and cesium
137 make no measurable contribution to internal exposure of personnel
from radioactivity associated with Naval nuclear propulsion plants.
Similarly alpha emitters such as uranium and plutonium are retained
within the fuel elements and are not accessible to personnel operating
or maintaining a Naval nuclear propulsion plant.
PAGENO="1017"
1013
Because of the high integrity of reactor fuel and because soluble
boron is not used in reactor coolant for normal radioactivity control
in Naval reactors, the amounts of tritium in reactor coolant are
far less than in typical power reactors.. The small amounts that are
present are formed primarily as a result of neutron interaction with the
deuterium naturally present in water. The radiation from tritium is
of such low energy that the Federal limits for breathing or swallowing
tritium are one hundred times higher than for cobalt 60. As a result
radiation exposure to personnel from tritium is far too low to measure.
Similarly the low energy beta radiation from carbon 14 does not add
measurable radiation exposure to personnel operating or maintaining
Naval nuclear propulsion plants.
Control of Airborne Radioactivity
Airborne radioactivity is controlled in maintenance operations such
that masks are not normally required. To prevent exposure of personnel to
airborne radioactivity when work might expose radioactivity to the atmos-
phere,~ contamination containment tents or bags are used. The areas
inside these containments are ventilated to the atmosphere throuqh hicih
efficiency filters which have been tested to remove at least 99.95 percent
of particles of a size comparable to cigarette smoke. The occupied area
outside these containments is required to be ventilated through high
efficiency filters any time work which could cause airborne radioactivity
is in progress inside an area such as a reactor compartment. Airborne
radioactivity surveys are required to be performed regularly in radio-
active work areas. Any time airborne radioactivity above the limit is
detected in occupied areas, work which might be causing airborne radio-
activity is stopped. This conservative action is taken to minimize
internal radioactivity even though the Navy's airborne radioactivity
limit would allow continuous breathing for forty hours per week throughout
the year to reach an annual exposure to the lungs of one-tenth the Federal
limit. Personnel are also trained to use masks when airborne radioactivity
is detected, however, masks are seldom needed and are not relied upon as
the first line of defense against airborne radioactivity.
It is not uncommon for airborne radioactivity above the limit to
be caused by radon naturally present in the air. Atmospheric tempera-
ture inversion conditions can allow this buildup of radioactive
particles from radon. Radon can build up above the limit in sealed
or poorly ventilated rooms in homes or buildings made of stone. Most
cases of airborne radioactivity above the limits in occupied areas in
the Naval nuclear propulsion program have been caused by radioactive
particles from radon, and not from the reactor plant. Procedures have
been developed to allow work to continue after it has been determined
that the elevated airborne radioactivity is from naturally occurring
radon.
PAGENO="1018"
1014,
Radon also is emitted from radium used for making dials luminous.
There have been a number of cases where a single radium dial such as on
a wristwatch has caused the entire atmosphere of a submarine to exceed
the airborne radioactivity limit used for the nuclear propulsion plant.
Radium in any form has been banned from submarines to prevent interfer-
ence with keeping airborne radioactivity from the nuclear propulsion
plant as low as practicable.
Control of Radioactive Surface Contamination
Perhaps the most restrictive regulations in the radiological control
program are established in the requirements for the control of radio-
active contamination. Work operations involving potential for spreading
radioactive contamination are planned using containment to prevent per-
sonnel becoming contaminated. The controls for radioactive contamina-
tion are so strict that precautions sometimes have had to be taken to
prevent tracking contamination from fallout and natural sources into
nuclear areas because the contamination control limits used in the nuclear
areas were below the levels of fallout and natural contamination
occurring outside in the general public areas.
Anticontamination clothing, including coverall, hood to cover the
head, ears and neck, shoe covers, and gloves, is provided when needed.
However, the basic approach is to avoid the need for anticontamination
clothing by containing the radioactivity. As a result, most work on
radioactive materials is performed with hands reaching into gloves
installed in containments, making it unnecessary for the worker to
wear anticontamination clothing. In addition to providing better
control over the spread of radioactivity, this method has reduced
radiation exposure since the worker can usually do his job better
and faster in his normal work clothing. A basic requirement of con-
tamination control is monitoring all personnel leaving any area
where radioactive contamination could possibly occur. Workers are
trained to survey themselves and their performance is checked by
radiological control personnel. Personnel monitor before, not after,
they wash. Therefore, washing or showering at the exit of radioactive
work areas is not required. The basic approach is to prevent contamina-
tion, not wash it away.
Surveys for radioactive contamination are taken frequently by
trained radiological control personnel. Results of these surveys are
reviewed by supervisory personnel to provide a double-check that no
abnormal conditions exist. The instruments used for these surveys are
checked against a radioactive calibration source daily and prior to use
and they are calibrated at least every six months.
Control of Food and Water
Smoking, eating, drinking and chewing are prohibited in radioactive
areas. Aboard ship drinking water is distilled from seawater by using
steam. However, the steam is not radioactive because it is in a
secondary piping system separate from the reactor plant radioactive
water. In the event radioactivity were to leak into the steam system,
sensitive radioactivity detection instruments which operate continuously
would give early warning.
PAGENO="1019"
1015
Wounds
Skin conditions or open wounds which might not readily be
decontaminated are cause for disqualification from doing radioactive
work. Workers are trained to report such conditions to radiological
control or medical personnel, and radiological control technicians
watch for open wounds when workers enter radioactive work areas: In
the initial medical examination prior to radiation work and during
subsequent examinations skin conditions are also checked. If the
medical officer determines a wound is sufficiently healed or
considers the wound adequately protected, he may remove the
disqual ifi cation.
There have been only a few cases of contaminated wounds in the
Naval nuclear propulsion program. In most years, including 1978, none
occurred. Examples of such injuries have included a scratched hand, a
metallic sliver in a hand, a cut finger, and a puncture wound to a
hand. These wounds occurred at the same time the person became con-
-taminated. Insoluble metallic oxides which make up the radioactive
contamination remain primarily at the wound rather than being absorbed
into the blood stream. These radioactively contaminated wounds have
been easily decontaminated. No case of a contaminated wound is known
where the radioactivity initially present in the wound was as much as
one one-thousandth of that permitted for a radiation worker to have in
his body.
Monitoring for Internal Radioactivity
The radioactivity of most concern for internal radiation exposure
from Naval nuclear propulsion plants is cobalt 60. Although most
radiation exposure from cobalt 60 inside the body will be from beta
radiation, the gammas given off make cobalt 60 easy to detect. Corn-
plex whole body counters are not required to detect cobalt 60 at low
levels inside the body. For example, one millionth of a curie of
cobalt 60 inside the lungs or intestines will cause a measurement o~
two times above the background reading with a standard radiation
survey instrument. This amount of internal radioactivity will cause
the instrument used to monitor personnel for radioactive contamination
on their body to reach the alarm level. Every person is required
to monitor his entire body every time he leaves an area with radio-
active surface contamination. Monitoring the entire body is a require-
ment in the Naval nuclear propulsion program; monitoring just hands
and feet is not permitted. Therefore, if ~. person had as little as
a millionth of a curie of cobalt 60 inside him, it would readily
be detected.
Swallowing one millionth of a curie of cobalt 60 will cause
internal radiation exposure of about 0.06 rem. The radioactivity
will pass through the body and be excreted within a period of a
little more than one day.
PAGENO="1020"
1016
One millionth of a curie df cobalt 60 deposited in the lungs as a
result of an inhalation incident is estimated to cause a radiation
exposure of about 3 rem to the lungs over the following year based on
standard calculational techniques recommended by the International Com-
mission on Radiological Protection, (ref 12). These techniques provide
a convenient way to estimate the amount of radiation exposure a
typical individual might be expected to receive from small amounts
of internally deposited radioactivity. These techniques account
for the gradual removal of cobalt 60 from, the lungs through
biological processes and the radioactive decay of cobalt 60 with a
5.3 year half life. However in an actual case, the measured
biological elimination rate is used in determining the amount of
radiation exposure received.
In addition to the control measures to prevent internal radio-
activity and the body monitoring frequently performed on those who
work with radioactive materials, more sensitive monitoring is also
performed during radioactive overhaul work. Shipyard procedures for
monitoring internal radioactivity use the type of scintillation
detectors which will reliably detect an amount of cobalt 60 inside
the body that is more than one hundred times lower than the one
millionth of a curie used in the examples.above. Shipyards typically
monitor for internal radioactivity as part of each radiation medical
examination, performed before an employee initially performs radiation
work, after he terminates radiation work, and periodically in between.
Shipyards also monitor periodically during the year groups of personnel
who did the work most likely to have caused spread of radioactive
contamination. Any person who has radioactive contamination above the
limit anywhere on the skin of his body during regular monitoring at the
exit from a radioactive area is monitored for internal radioactivity
with the sensitive detector. Also any person who might have breathed
airborne radioactivity above limits is monitored with the sensitive
detector.
Results of Internal Monitoring in 1978~
At the nine shipyards performing work associated with Naval
nuclear propulsion plants a total of 11,701 personnel were monitored
for internal radioactivity in 1978 using sensitive scintillation
detectors. Equipment and procedures provide detection level,s at
least one hundred times lower than one millionth of a curie. Two
persons were found with internal radioactivity in their lungs,
above this level. One had 0.05 millionths of a curie. This
person received his internal radioactivity from separate radioactive
work performed outside the Naval nuclear propulsion program.
The other person received internal radioactivity at a support
facility. He had 0.03 millionths curie in hi's gastrointestinal sys-
tem. Based on his actual' biological elimination rate, he received
0.1 rem to the lower large intestine, and he will receive about
0.04 rem to the lungs in the year following this exposure.
PAGENO="1021"
1017
EFFECTS OF RADIATION ON PERSONNEL
Control of radiation exposure in the Naval nuclear propulsion
program has always been based on the assumption that any exposure no
matter how small involves some risk; however, exposure within the accepted
limits represents a risk small compared with normal hazards of life.
The basis for this statement was presented in the previous Navy report
on radiation (ref 9).
More is known about the effects of radiation than almost any industrial
hazard to humans. More money has been spent to learn the effects of
radiation on humans than for any industrial hazard. The effects of
radiation have been put in the form of risk estimates which can be
compared with risks from normal hazards of life. Risk estimates have
been made by the United Nations Scientific Comittee on the Effects of
Atomic Radiation (ref 13), the International Commission on Radiological
Protection (ref 8), and the U. S. National Academy of Sciences Committee
on Biological Effects of Ionizing Radiation (ref 14). All these organizations
have developed comparable risk estimates which can be summarized in the
following; this will be referred to subsequently as the standard risk
estimate:
In a large population group (such as 100,000 people) receiving an
annual total of 10,000 man-rem year after year, the increased risk
from this radiation appears to be in the region of about one fatal
cancer case each year in excess of the normal numbers of cases.
Every fifth year this cancer case will be leukemia.
For comparison the eventual cause of death of about 16,000 of a
typical group of 100,000 people in the U.S. will be cancer from causes
other than this added radiation.
The preceding standard risk estimate can be used to develop risk
estimates for personnel exposed to radiation associated with Naval
nuclear propulsion plants. In all shipyards there have been a total of
about 100,000 personnel monitored for exposure to radiation and their
average exposure rate over twenty five years has been 6100 man-rem per
year. Therefore according to the above standard risk estimate,
* there should be less than one excess fatal cancer per year and less
than one excess leukemia case every five years among the total
100,000 shipyard personnel who have ever been monitored for radiation
associated with Naval nuclear propulsion plants.
Radiation exposure received by Naval personnel assigned to nuclear-
powered ships and their support facilities has averaged one third of the
total exposure to shipyard personnel. Therefore according to the above
standard risk estimate,
* there should be less than one excess fatal cancer every three years
and less than one excess leukemia case every fifteen years among
the approximately 100,000 Naval personnel who have ever been monitored
for occupational *exposure to radiation associated with Naval nuclear
propulsion plants.
PAGENO="1022"
1018
Three highly controversial studies have challenged this standard
risk estimate as being too low (these are briefly summarized in the
previous Navy report on radiation, ref 9). One specifically states the
risk estimates are as much as a factor of ten low. Even if the standard
risk estimates were increased ten times to meet these challenges, the
risks from radiation in the Naval nuclear propulsion program would not
be greater than from other normal hazards of everyday life for this same
group of personnel.
In contrast, large numbers of scientists believe that the standard
risk estimate is too high for gamma radiation at low dose rates under
conditions comparable to those in the Naval nuclear propulsion program
(ref 15). Essentially every radiation study on animals has shown that
damage caused by gamma radiation at low doses is less per rem than from
high doses from which the standard risk estimates above is derived. One
explanation frequently used is that at low dose rates the body has a
chance to heal the damage from gamma radiation more than at high dose
rates.
Other examples may also be used to help put into perspective the
amounts of radiation exposure received by personnel in the Naval nuclear
propulsion program:
* Theaverage radiation exposure of all those monitored in the
last 25 years received from radiation associated with the
Naval nuclear propulsion program is 0.25 rem. This is only
slightly greater than the average radiation exposure received
in the U.S. each year from natural background and medical X-
rays. (Derived from ref 16)
* The average lifetime occupational radiation exposure of 1.5
rem for shipyard personnel is about one tenth the amount of
radiation exposure these same personnel will average over
their lifetimes from natural background and medical X-rays.
(Derived from ref 16).
* This 1.5 rem average lifetime Occupational radiation exposure
can also be compared very roughly to the 5 rem received in a
year from smoking one pack of cigarettes per day. This compari
sion is not exact because it requires more lung exposure from
natural radioactivity in tobacco to cause the same amount of
risk as whole body gamma radiation (ref 17).
* The risk of dying from an automobile accident is 30 or more
times higher than the risk of fatal cancer for the average
worker with 1.5 rem lifetime radiation exposure.
PAGENO="1023"
1019
* The total occupational radiation exposure of 3700 man-rem
received by all shipyard personnel from the Naval nuclear
propulsion program in 1978 can be compared to the many
other sources of radiation exposure received by the U. S.
population. Examples follow:
- 20,000,000 man-rem to the population of the U. S. each
year from natural background radiation (ref 16)
- 17,000,000 man-rem to the population of the U. S. each
year from medical and dental radiation (ref 16)
- 625,000 man-rem to the population of the U. S. from
radioactivity in natural gas used for cooking
(ref 17)
- 100,000 man-rem the one million inhabitants of Denver
could save each year if they moved to a region such as
Washington, D. C. with lower natural background radiation
levels (Derived from ref 16)
- 12,000 man-rem total to passengers in jet airplane flights
in the United States from increased cosmic radiation at
the higher altitudes used by jets (ref 18)
Thus, the total occupational radiation exposure received by all
shipyard personnel in 1978 is less than one ten thousandth of
the total radiation exposure received by the U. S. population
from all sources.
PAGENO="1024"
1020
CLAIMS FOR RADIATION INJURY TO PERSONNEL
Personnel who consider they have or might have had occupational
injury are encouraged to file claims. The compensation systems make
allowance for the long latent period for radiation-induced cancer.
Naval shipyard personnel are employees of the U. S. Government and
therefore file claims with the U. S. Department of Labor's Office of
Workmen's Compensation. Shipyards hold no hearing on injury claims.
They are not handled in an adversary procedure. The Navy has no
rights to present a case to the Labor Department. The claim does
not even have to be filed through the shipyard. The shipyard is not
permitted to appeal a decision but the employee may appeal. The
primary consideration in the Federal laws and procedures set up for
injury compensation is to take care of the Federal employee. The
program to compensate Federal employees is well publicized as shown
by more than 25,000 claims being paid for Navy employees in 1978.
Over half of these claims were filed by shipyard workers. As noted
below, however, only a few were related to radiation exposure.
In private shipyards injury compensation claims *are handled
under the Longeshoreman's and Harbor Workers' Compensation Act.
The claim may be handled through the shipyard's insurance carrier or
by a U. S. Department of Labor claims examiner. Either the employee
or the employer may appeal.
Claims for military personnel concerning prior duty are handled
through the Veterans Administration.
There have been a total of 58 claims filed for injury from
radiation associated with Naval nuclear propulsion plants. Fifty-
five originated from employees of the six Naval shipyards, three from
one private shipyard, and none that the Navy is aware of from Navy
personnel. These claims are summarized in Table 7 and in more detail
in the appendix. A number of claims have previously been listed by
the Navy as radiation-related because radiation was mentioned as
one of a large number of possible causes of an injury. Those which
have been handled by the Department of Labor as other than radiation
claims have been removed from the Navy list. Two suits have been
filed in court alleging injury from radiation. Neither person
claims cancer. They are not summarized in this report since these
cases are in litigation.
Three claims have been awarded to employees, one for leukemia
in 1968 and two for cataracts of the eyes in 1971 and in 1977.
The Navy considers all three of these awards were incorrect:
* The leukemia case developed within two years of the occupational
exposure of 5.38 rem. This is too short a latency period.
The claimant had received hundreds of rem in medical radiation
exposure for adenoids. If radiation were to be selected as
the cause of this leukemia, then the occupational exposure could
not have been more than a tiny part of this total radiation.
PAGENO="1025"
1021
* The two cataract cases each had total lifetime radiation
exposures of about 3 rem, which is hundreds of times
smaller than needed to produce cataracts in the eyes.
From the radiation injury claims filed to date, the Navy has
been unable to draw any conclusions concerning radiation injury to
personnel occupationally exposed to radiation associatedwith
Naval nuclear ~ropulsion plants.
TABLE 7
CLAIMS FOR RADIATION INJURY TO PERSONNEL
Claims
Injury Claims Claims Rejected Claims
Claimed Filed Awarded or Deferred Active
Leukemia 8 1 3 4
Cancer Other 11 0 6 5
Than Leukemia
Other 39 2 26 11
Total 58 3 35 20
48-721 0 - 79 - 65
PAGENO="1026"
1022
AUDITS AND REVIEWS
Checks and cross-checks and audits and inspections of numerous
kinds have been shown to be essential in maintaining high standards
of radiological control. First, each worker is specially trained
in radiological control as it relates to his own job. Second, written
procedures exist which require verbatim compliance. Third, radiological
control technicians and their supervisors oversee radioactive work.
Fourth, personnel independent of radiological control technicians are
responsible for personnel radiation exposure records.
Fifth, a strong independent audit program is required covering
all radiological control requirements. In all shipyards this radio-
logical audit group is independent of the radiological control
organization and its findings are reported regularly to senior ship-
yard management including the shipyard commander. This group performs
continuing surveillance of radioactive work. It conducts in-depth
audits of specific areas of radiological control. This group checks
all radiological control requirements at least annually.
Sixth, the U. S. Department of Energy assigns to each shipyard
a representative who reports to the Director, Division of Naval
Reactors At headquarters. One assistant to this representative is
assigned full time to audit radiological controls, both in nuclear-
powered ships and in the shipyard. And seventh, the Naval Sea Systems
Command also conducts periodic inspections of radiological control
in each shipyard. Similarly, there are multiple levels of audits
and inspections for the other Navy shore facilities, tenders, and
nuclear-powered ships.
PAGENO="1027"
1023
ABNORMAL OCCURRENCES
It is a fact of human nature that people make mistakes. The key to
a good radiological control program is to find the mistakes while they
are small and prevent the combtnations of mistakes that lead to accidents.
The preceding section on inspections supports the contention that more
attention is given to errors and their prevention in the Naval nuclear
propulsion program than to any other single subject. Requiring constant
focus on improving performance of radiological work has proven effective
in reducing errors.
In addition, radiological control technicians are authorized and
required to stop anyone performing work in a manner which could lead to
radiological deficiencies. A deficiency, of course is failure to follow
a written procedure verbatim. However the broadest interpretation of
the term "deficiency" is used in the Navy's radiological control program:
anything involved with radiation or radioactivity which could have been
done better is also a radiological deficiency.
Radiological deficiencies receive management attention. But there
is a higher level of deficiency that is defined as a radiological incident.
Incidents attract a great deal of notice, including the personal attention
of the Director, Division of Naval Reactors at headquarters. Improvement
programs over the years have constantly aimed at reducing the numbers of
radiological incidents. As improvements occurred, the definition of
what constituted an incident was changed to define smaller deficiencies
as incidents. These changes were necessary so that the incident reporting
system would continue to play a key role in upgrading radiological
controls. As a result it is not practicable to measure performance
merely by counting numbers of radiological incidents or deficiencies.
There is a reporting system that has been nearly constant over time
and therefore can be used as a basis for comparison. The Department of
Energy and its predecessors have used these levels of severity to define
radiological occurences (ref 19). Examples of radiation exposure incidents
in each type follow:
* Type A - external radiation exposure over 25 rem in one
incident
* Type B - external radiation exposure over 5 rem in one
incident
* Type C - external whole body radiation exposure over 3
rem in one quarter year
The Nuclear Regulatory Commission also has criteria defining abnormal
occurrences. The Navy regularly evaluates radiological events using
these criteria for comparison; results are reported in Table 8.
PAGENO="1028"
1024
TABLE 8
ABNORMAL OCCURRENCES
IN THE NAVAL NUCLEAR PROPULSION PROGRAM
Year Number of Abnormal Occurences*
1974 0
1975 0
1976 0
1977 0
1978 0
*Abnormal occurrences are reported here if the Navy evaluation
determines they meet either the Department of Energy criteria for
Type A incidents or the Nuclear Regulatory Commission criteria for
quarterly report to Congress as abnormal occurrences
The policy of the Navy is to provide for close cooperation and
effective communication with state radiological officials involving
occurrences that might cause concern because of radiological effects
associated with the ships or shore facilities. The Navy has reviewed
radiological matters with state radiological officials in the states
where Naval nuclear-nuclear powered ships are based or overhauled.
Although there were no occurrences in 1978 which resulted in radio-
logical effects to the public outside these facilities or which resulted
in radiological injury to residents of the states working inside these
facilities, states were notified when inquiries showed public interest
in the possibility such events had occurred.
PAGENO="1029"
1025
REFERENCES
(1) National Council on Radiation Protection and Measurements
Report 17, "Permissible Dose from External Sources of
Ionizing Radiation," including April 15, 1958 Addendum
"Maximum Permissible Radiation Exposures to Man"
(originally published in 1954 as National Bureau of
Standards Handbook 59)
(2) International Commission on Radiological Protection
Publication 1, "Recommendations of the International
Commission on Radiological Protection" (Adopted September 9,
1958), Pergamon Press 1959
(3) Code of Federal Regulations Title 10 (Energy) Part 20,
"Standards for Protection Against Radiation"
(4) Federal Radiation Council, "Radiation Protection Guidance
for Federal Agencies" approved by President Eisenhower
May 13, 1960, printed in Federal Register May 18, 1960
(5) International Commission on Radiological Protection
Publication 9, "Recommendations of the International
Commission on Radiological Protection" (Adopted September 17,
1965), Pergamon Press 1966
(6) National Council on Radiation Protection and Measurements
Report 39, "Basic Radiation Protection Criteria" January
15, 1971
(7) Department of Energy Manual Chapter 0524, "Standards
for Radiation Protection"
(8) International Commission on Radiological Protection
Report 26, "Recommendations of the International
Commission on Radiological Protection" (Adopted January 17,
1977), Pergamon Press 1977
(9) U. S. Navy Report, "Occupational Radiation Exposure from
U. S. Naval Nuclear Propulsion Plants and Their Support
Facilities - 1977," N. E. Miles, NT-78-2, March 1978
(10) U. S. Nuclear Regulatory Commission, "Occupational
Radiation Exposure - Tenth Annual Report 1977," NUREG-O463
October 1978
PAGENO="1030"
1026
(11) U. S. Navy Report, Environmental Monitoring and
Disposal of Radioactive Wastes From U. S. Naval
Nuclear-Powered Ships and Their Support Facilities -
1978," M. E. Miles, G. L. Sioblom, and J. D. Eagles -
NT-79-l January 1979
(12) International Commission on Radiological Protection
Report 10, "Evaluation of Radiation Doses to Body
Tissues from Internal Contamination Due to Occupational
Exposure," Pergamon Press 1968
(13) United Nations Scientific Committee on the Effects of
Atomic Radiation, "Sources and Effects of Ionizing
Radiation," 1977
(14) National Academy of Sciences - National Research Council,
"The Effects on Populations of Exposure to Low Levels of
Ionizing Radiation,' Report of the Advisory Committee on
the Biological Effects of Ionizing Radiations, 1972
(15) National Council on Radiation Protection and Measurements
Report 43, "Review of the Current State of Radiation
Protection Philosophy," January 15, 1975
(16) Environmental Protection Agency,"Estimates of Ionizing
Radiation Doses in the United States 1960 - 2000",
ORP/CSD 72-1 August 1972
(17) National Council on Radiation Protection and Measurements
Report 56, "Radiation Exposure from Consumer Products and
Miscellaneous Sources," November 1, 1977
(18) U. S. Nuclear Regulatory Commission, "Final Environmental
Statement on the Transportation of Radioactive Materials
by Air and Other Modes," NUREG-0170, December 1977
(19) Department of Energy Manual Chapter 0502, "Notification,
Investigation and Reporting of Occurrences"
PAGENO="1031"
* 1027
APPENDIX
SUMMARY OF CLAIMS FROM RADIATION EXPOSURE
ASSOCIATED WITH NAVAL NUCLEAR PROPULSION PLANTS
ALL CLAIMS
FR(~ RADIATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR
PROPULSION PLANTS
Claims Claims Claims Claims
Shipyard Filed Awarded Rejected or Deferred Active
Portsmouth Naval
Shipyard 9 0 3 6
Electric Boat
Division of General
Dynamics 3 Q 2 1.
Norfolk Naval
Shipyard 2 1 * 0
Newport News
Shipbuilding and
Drydock Company 0 0 0 0
Charleston Naval
Shipyard 3 0 2 1
Ingalls Shipbuilding 0 0 0 0
Mare Island Naval
Shipyard 25 2 13 10
Puget Sound Naval
Shipyard 13 0 12 1
Pearl Harbor Naval
Shipyard 3 0 3 0
TOTALS 58 3 * 35 20
PAGENO="1032"
1028
LEUKFI'ILA CLAIMS
FRCIVI RADIATION EXPOSURE ASSOCIATED WITh NAVAL NUCLEAR
PROI~JLSION PLANTS
Claims Claims Claims Claims
Shipyard Filed Awarded Rejected or Deferred Active
Portsmouth
Naval Shipyard 1 0 0 1
Electric Boat
Division of General
Dynamics 0 0 0 0
Norfolk Naval
Shipyard 2 1 0 1
Newport News
Shipbuilding and
Drydock Company 0 0 0 0
Gharleston Naval
Shipyard 0 0 0 0
Ingalls Shipbuilding 0 0 0 0
Mare Island Naval
Shipyard 1 0 0 1
Puget Sound
Naval Shipyard 2 0 1 1
Pearl Harbor
Naval Shipyard 2 0 2 0
TOTALS 8 1 3 4
PAGENO="1033"
1029 * :*..~
CANCER (OTHER THAN LEUKEMIA) CLANS
FRC~~1 RAI)IATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR
PROPULSION PLANTS
Claims Claims Claims Claims
Shipyard Filed Awarded Rejected or Deferred Active
Portsmouth Naval
Shipyard 5 0 2 3
Electric Boat
Division of General
Dynamics 1 0 1 0
Norfolk Naval
Shipyard 0 0 0 0
Newport News
Shipbuilding and
Drydock Company 0 0 0 0
Charleston Naval
Shipyard 1 0 0 1
Ingalls Shipbuilding 0 0 0 0
Mare Island Naval
Shipyard 3 0 2 1
Puget Sound Naval
Shipyard 1 0 1 0
Pearl Harbor
Naval Shipyard 0 0 0 0
TOTALS 11 0 6 5
PAGENO="1034"
1030
CLAIMS OTHER THAN CANCER OR LEUK~vIIA
FRC~V1 RADIATION EXPOSURE ASSOCIATED WITH NAVAL NUCLEAR
PROPULSION PLANTS
Claims Claims Claims Claims
Shipyard Filed Awarded Rejected or Deferred Active
Portsmouth Naval
Shipyard 3 0 1 2
Electric Boat
Division of General
Dynamics 2 0 1
Norfolk Naval
Shipyard 0 0 0 0
Newport News
Shipbuilding and
Drydock Company 0 0 0 0
Charleston Naval
Shipyard 2 0 2 0
Ingalls Shipbuilding 0 0 0 0
Mare Island Naval
Shipyard 21 2 11 8
Puget Sound
Naval Shipyard 10 0 10 0
Pearl Harbor
Naval Shipyard 1 0 1 0
TOTALS 39 2 26 11
PAGENO="1035"
INJURY CLAIMS FRCM RADIATION EXPOSURE ASSOCIATED WITh NAVAL NUCLEAR
PROPULSION PLANTS
PORT~0UTH NAVAL SHIPYARD
Ocç~ip~ation Date Filed -- Status*
Bone Cancer REJECTED
Lynphosarcoma REJECTED
Cryptogenic
epileptic condition
Cancer of Rectum
Lung Cancer
Cancer of Rectum
Leukemia
Polyp on Rectum
Cataract
*AWJtJ?DED means Department of Labor concluded injury was job related and compensation paid.
REJECTED means Department of Labor concluded injury was not job related.
DEFERRED means Department of Labor concluded claimant did not provide sufficient justification
that injury was job related and that claimant has not replied to Department of Labor requests
for more information.
ACTIVE means claim is being evaluated by the Department of Labor.
Lifetime Radiation
Injury Claim Exposure-Rem
Machinist
Shipfitter
Metals Inspector
Welder
Caulker/Chipper
Caulker/Chipper
Welder
Shipfitter
10/60
11/73
11/73
3/78
5/78
6/78
8/78
10/78
1.855
2.326
7.381
0.419
0.544
4.290
1.530
8.258
Marine Mechanic 12/78
REJECTED
ACTIVE
ACTIVE
ACTIVE
ACTIVE
ACTIVE
35.483 ACTIVE
PAGENO="1036"
ELECTRIC BOAT DIVISION OF GENERAL DYNAMICS
Lifetime Radiation
Exposure-Rem Status*
0.010 REJECTED by State Workmen Compensation.
However, State paid for
psychiatric examination.
Overexposure; 0.068 DEFERRED by insurance company. Removal of
Cancer of Lip lip cancer paid by insurance
company.
Loss of Eye 0.234 ACTIVE
Occupation
Welder
Date Filed Injury Claim
2/74 Radiation and
Ilead Injury
Shipping Carpenter 1967
Health Physicist 4/78
Monitor
NORFOLK NAVAL SHIPYARD
Boilermaker
3/67 Acute Myelogenous
5.38
AWARDED
The Navy disagreed with this award.
Leukemia
The basis of the Navy disagreement
was that (1) his occupational
exposure was small compared to his
medical exposure, and (2) the
leukemia occured only 2 years
after his first occupational
exposure which is a too short a
latency period.
Electrician 6/78 Leukemia
0
ACTIVE
NEWPORT NEWS SHIPBUILDING AND DRYDOCK CCMPANY
NC~4E
CHARLESTON NAVAL SHIPYARD
Sheet metal worker 11/66 Impaired Vision
4.173
REJECTED
Shipfitter 9/71 Cataract
10.156
REJECTED
Shipfitter 12/78 Cancer of Colon
3.370
ACTIVE
PAGENO="1037"
Lifetime Radiation
Occuj)atiOfl Date Filed Injury~Cl~ai~ri~* Exposure~Rem Stat~
MARE ISLAND NAVAL SHIPYARD
Machinist 4/63 Skin condition 0 DEFERRED
Helper electrician 4/64 Blackouts 0 REJECTED
Chemistry
Technician 6/65 Cataract 2.961 AWARDED in 1971. The Navy disagrees with
this award because the individual's
- radiation exposure was well below
the level considered necessary to
produce cataracts. Experts gen-
erally agree that many hundreds of
rem are required to cause cataracts.
Crane Operator 6/69 Cataract 0 ACTIVE
Janitor 2/70 Partial vision 0 REJECTED
loss, skin condition
Radiation 4/70 Tumor caused ann 11.760 REJECTED
Technician amputation
Rigger 12/70 Cataract 0.160 REJECTED
Crane Operator 12/70 Cataract 0.080 REJECTED
Crane Operator 1/71 Cataract 0 REJECTED-PRESENTLY IN APPEAL
Marine Machinist 7/71 Cataract 0.580 REJECTED
PAGENO="1038"
MARE ISLAND NAVAL SHIPYARD (Continued)
Lifetime Radiation
Occupation Date Filed Injury Claim Exposure-Rem Status*
Shipfitter 9/71 Cataract from 3.441 AWARDED in 1977. The Navy Disagrees
steam generator with this award because
repair work radiation-caused cataracts
generally start in the
posterior part of the lens.
The claimant's cataracts
started in the anterior
portion of the lens. In
addition the claimant's
radiation exposure was well
below the threshold level
considered necessary to
produce cataracts.
Crane Operator 1/72 Cataract 0 REJECTED
Sand Blaster 3/72 Hearing Loss 0 REJECTED
Rigger 5/73 Eye Trouble 1.015 REJECTED-PRESENTLY IN APPEAL
Electrician 2/74 Skin problem on 0 ACTIVE
hand
Component cleaner 3/74 Radiation face burn 26.213 ACIIVE
Pipefitter 5/75 Eye trouble 0.060 ACTIVE
Industrial cleaner 1/76 Internal injuries, 11.430 REJECTED
blood changes
Laborer 2/76 Heart Condition 0 ACTIVE
Health Physicist 11/76 Chest cancer 2.331 ACTIVE
PAGENO="1039"
MARE ISLAND NAVAL SHIPYARD (Continued)
Occupation
Painter
Lagger 2/77
Security guard 4/77
Insulator 6/78
Optical Instrument 11/78
Technician
PUGET SOUND NAVAL SHIPYARD
Welder 6/71
Radiation monitor 9/71
Metal inspector 9/72
Cement finisher 4/74
Shipfitter
Sheet Metal Worker 12/74
ACTIVE
REJECTED-PRESENTLY IN APPEAL
ACTIVE
ACTIVE
Date Filed
12/76
Lifetime Radiation
Iniurv Claim Exposure-Rem
Status*
ACTIVE
Claustrophobia and 0.330
Mental disorder
Lung disease 7.003
Brain tumor 0.016
Heart Attack 3.671
Leukemia 0
Leukemia
Stomach cancer
Cataract
Emphysema-many
causes including
radiation
0.079
10.566
29.655
0
0
10/74 Lung ailment-many
causes
REJECTED
REJECTED
REJECTED
REJECTED
REJECTED-PRESENTLY IN APPEAL
REJECTED
Bronchitis, emphy- 0
sema-nany causes
Bronchitis-many
causes
Pipefitter 12/74
0.064
REJECTED
PAGENO="1040"
PUGET SC*JND NAVAL SHIPYARD (Continued)
Lifetime Radiation
Occupation Date Filed Injury Claim Exposure-Rem Status*
Pipefitter 12/74 Epilepsy - 9.548 REJECTED
many causes
Machinist 3/75 Cataract 0 REJECTED
Materials Engineer 1/76 Lung injury- 0.037 REJECTED
many causes
Shipfitter 12/75 Stress from radio- 5.247 REJECTED
and logical written
7/76 examinations and
nuclear work
Radiographer 1/77 Lymphocytosis 16.529 REJECTED
Shipfitter 11/77 Leukemia 0.059 ACTIVE
INGALLS SHIPBUILDING
NONE
PEARL HARBOR NAVAL
SHIPYARD
Leukemia
0.020
REJECTED
Pipefitter
2/70
Electronic Mechanic
8/73
Upset metabolism
0.180
DEFERRED
Mechanic
11/74
Leukemia
6.140
REJECTED
PAGENO="1041"
1037
Admiral RICKOVER. As identified in the document, since 1967 no
civilian or military personnel in the Navy's nuclear propulsion
program have exceeded the quarterly Federal limit of 3 rem or an
annual radiation exposure limit of 5 rem. The average annual
exposure of shipyard workers in 1978 was one quarter of a rem.
This document also outlines many of the measures implemented to
achieve the record of occupational radiation exposure we have
attained.
I believe both reports will be of value to the purpose of this
hearing, because they convey something of the kind of care and
attention to detail we have taken in order to maintain a level of
assurance that both the public and the people in the program are
protected.
THREE MILE ISLAND INCIDENT
Since the incident at the Three Mile Island site, I have been
asked by many people to comment. There are several reasons why
I have not done this.
First, all the facts are not in, and it would be presumptuous on
my part to make judgments on such a highly complex subject when
I do not have the facts.
Second, there are significant differences between the design and
operation of naval reactors and plants such as the Three Mile
Island plant.
I want to weigh all aspects of the incident and see if there is
anything from it I can learn and incorporate into the naval pro-
gram. This is the way I have always operated.
Another important aspect is the legal issue involved. It is yet to
be decided who will pay all the various costs for the incident. It
would not be appropriate for a Government employee such as
myself to be issuing pronouncements on the incident when there
may be litigation.
One thing I can assure you of, Mr. Chairman, it is a bonanza for
the lawyers of this country. This is the greatest thing that has
happened to them in a long time.
BASIC PRINCIPLES OF NAVAL REACTORS PROGRAM
There are, however, a number of facts which have been released
by the Nuclear Regulatory Commission regarding Three Mile
Island. These facts seem to me to reinforce many of the underlying
basic principles of the naval reactors program.
Over the years, many people have asked me how I run the naval
reactors program, so that they might find some benefit for their
own work. I am always chagrined at the tendency of people to
expect that I have a simple, easy gimmick that makes my program
function. They are disappointed when they find out there is none.
This reminds me many years ago when the space program was in
full tilt, an Air Force general telephoned me from California and
said he was coming to duty with the space program in the Air
Force in Washington, and he wanted to stop by for a half hour to
talk to me about how I ran my program.
I said what you want is to learn how to be emperor in a half
hour; I think you are just going to waste your time and you already
know more than that anyhow. He never called on me. By the way,
48-721 0 - 79 - 66
PAGENO="1042"
1038
he was put in charge of the Air Force program, without any benefit
from me.
Any successful program functions as an integrated whole of
many factors. Trying to select one aspect as the key one will not
work. Each element depends on all the other elements.
That is a very important factor; you have to consider the whole
ball of wax. It has to be concentrated altogether or it will not work.
You cannot point to any one fact and that is what people are
trying to do. They think there are simple solutions to complex
problems.
There are none. It's like when you first come to Congress and
you go to one of.the older Members and ask him for the secret. The
real secret is to get re-elected. It's not what anyone can tell you.
Mr. MCCORMACK. Admiral, would you excuse me, please?
We have to go vote and I would like to declare about a 10 minute
recess and we will come back.
Admiral RIcK0vER. Yes, sir.
Mr. MCCORMACK. Thank you.
[A short recess was taken.]
Mr. MCCORMACK. We will resume with the testimony of Admiral
Rickover. I believe, Admiral, you were on page 7, were you not, in
your testimony; is that correct?
Admiral RIcK0vER. I am at the bottom of page 6. You stand
corrected, sir.
Mr. MCCORMACK. I stand corrected.
Admiral RICKOVER. May I continue?
Mr. MCCORMACK. Please do.
Admiral RICKOVER. I recall once several years ago an admiral
whose conventionally powered ships were suffering serious engi-
neering problems asked me for a copy of one specific procedure I
used to identify equipment which was not operating properly. He
believed that would solve his problem, but it did not. That admiral
did not have the vaguest understanding of the problem or how to
solve it, he was merely searching for a simple answer, a checkoff
list, like that laundry list, that he hoped would magically solve his
problem.
I cannot overemphasize the importance of this thought in your
current deliberations. The problems you face cannot be solved by
specifying compliance with one or two simple procedures. Reactor
safety requires adherence to a total concept wherein all elements
are recognized as important and each is constantly reinforced day
after day. That is just like the mother who has to get up every
morning and take care of the children every day. She has to feed
them, clothe them, send them off to school. People think there is
some magical aspect of modern technology, all you have to do is
put in a complicated system and it does not require that same daily
care over and over again, and this is the speech I make to all of the
people in my nuclear program regularly. I refer them to what their
wives have to go through. Every day they have to do the same job
over and over again. Then just about the time the children grow up
and go away, they have some new ones. Excuse this homely philos-
ophy. There really is not much difference in nuclear power than
there is in any other aspect of life which is handled properly.
Mr. MCCORMACK. If itheips us understand.
PAGENO="1043"
1039
Admiral RICKOVER. I do not think it helps you understand about
children. [Laughter.] I assume you would already know about what
your wife really does. You are over here getting a lot of credit and
getting in the newspapers and she has to take care of the kids. If
she does not do it right then she will get in the newspapers. I see I
find some favor with one of the female Congresswomen. She just
winked at me, Mr. Chairman. [Laughter.]
TECHNICAL COMPETENCE
One of the elements needed in solving a complex technical prob-
lem is to have the individuals who make the decisions trained in
the technology involved. A concept widely accepted in some circles
is that all you need is to get a college degree in management and
then, regardless of the technical subject, you can apply your man-
agement techniques to run any program, including the Presidency,
Congress, or the Vatican. This has become a tenet of our modern
society, but it is as valid as the once widely held precept that the
world is flat. Properly running a sophisticated technical program
requires a fundamental understanding of and commitment to the
technical aspects of the job and a willingness to pay infinite atten-
tion to the technical details. I might add, infinite personal atten-
tion. This can only be done by one who understands the details and
their implications. The phrase, "The devil is in the details" is
especially true for technical work. If you ignore those details and
attempt to rely on management techniques or gimmicks you will
surely end up with a system that is unmanageable, and problems
will be immensely more difficult to solve. At Naval Reactors, I take
individuals who are good engineers and make them into managers.
They do not manage by gimmicks but rather by knowledge, logic,
commonsense, and hard work and experience.
RESPONSIBILITY
Another essential element is that of responsibility. In the begin-
ning of the naval program it was apparent to me that due to the
uniqueness of nuclear power and its potential effect on public
safety, a new concept of total responsibility had to be established
both within the Navy and the then Atomic Energy Commission-
AEC. It would not work if one person was responsible for nuclear
powerplants in the Navy, and a different person responsible in the
AEC. Similarly, it would not work if there was one person in the
AEC responsible for the naval program with a different person
responsible for the AEC laboratories doing the work for the Naval
Reactor Program. It would not work in the Navy if five or six
different admirals all had charge of different pieces of the pro-
gram, as is often the case in other areas. It would not work if there
was one person responsible for research and development, someone
else responsible for construction, and another responsible for train-
ing and operation, and still another for repair work.
This is all compounded by the way our military works, because
the people who generally get put in these jobs are there to get the
brownie points checked off on their records so they can go up and
be advanced for promotion. So they change every 2 or 3 or 4 years.
You cannot possibly run any technical work, any organization of
PAGENO="1044"
1040
that type, the way our Defelise Department, for example, is being
run today. You cannot do it and have an efficient, reliable outfit.
You cannot do that.
The problem is that these desires and needs of individuals are
given precedence over the desires and needs of the organization. It
would be analogous to having all brandnew Congressmen and
Senators every 2 to 6 years. It could not work very well. There is
no residual experience. I am making a pretty important point. This
is one reason that we have had whatever success we have had. We
have had continuity of personnel. I have several people here, if you
were to ask them how long they have been in the program, I have
them here today, on the average they have been with me over 20
years. That is the only way we can work. If you do not do that you
are not going to have a viable program. I think you can check that
with respect to the civilian program to see how that compares.
Mr. MCCORMACK. May I interrupt you? You seem to be describ-
ing the failure of the Department of Energy. Since you are really
close to it, I would like to ask you, is this what you are saying now
in the Department of Energy, we have one Assistant Secretary for
R. & D., and another one for demonstrations and construction, and
another one for commercial applications, another one for consumer
protection, another one for environmental protection and public
health, and so when you try to get a project going you have to go
through every one of them individually in a totally different orga-
nization rather than having a goal-oriented group such as you
have? It seems to me you are saying this sort of organization will
not work.
Admiral RICKOVER. No, I did not quite say that. You have to
distinguish between the vastness of one organization as com-
pared-you cannot have anything as vast as the Department of
Energy and concentrate it. What you can do there is to split it up
in parts and then concentrate the functions in an individual. You
could not possibly take an organization of that magnitude and use
the same system. What you can do everywhere is to break the
thing up into parts and make long-term individuals responsible,
whether it is in the military or civilian aspect. That is what I am
merely saying.
Mr. MCCORMACK. Thank you.
Admiral RICKOVER. I hope that clears up the point, sir.
Incidentally, you have present in the audience a very distin-
guished man, Congressman Chet Holifield, who was on the original
Joint Committee on Atomic Energy, and who probably knew more
about this game than anyone in the United States at the time he
retired. I must say that without all the help he gave us, without
his thorough understanding and sympathy with the program, we
could not have reached the stage we are in now. I would like
through you to thank him very much.
Mr. MCCORMACK. I must say we also have previously recognized
Chet Holifield earlier this morning, and I very much agree with
what you have said.
Admiral RICKOVER. Thank you, sir.
Mr. WYDLER. Could I add to that? Although he made a great
contribution, no question about it, in the nuclear field, I had the
additional great honor of serving under him on the Government
PAGENO="1045"
1041
Operations Committee. I can say I never saw a more constructive
committee chairman or Member of Congress in all, the years I have
served here. He did just remarkable work for the country in get-
ting legislation put together out of the committee in a way and
fashion that I have never seen the like of. So he was good in all
fields.
Admiral RICKOVER. I will top you on that. I called him one of the
people who was a Renaissance man, a man who is familiar with
many things, who knows human nature, who knows what the
problems are, and puts all of the weight of his learning and con-
science to the job. That is what Chet is.
Do you agree with that?
Mr. WYDLER. I do indeed.
Admiral RICKOVER. You second the motion, he is a Renaissance
man. I hope the chairman does, too.
This kind of compartmentalization of responsibility is typical in
government work, but the practice of having shared responsibility
really means that no one is responsible. It reminds me of the figure
in Nast's cartoon of the Tweed Ring, where all of the characters
stand in a circle, each one pointing his thumb at his neighbor as
the responsible person. Unless you can point your finger at the one
person who is responsible when something goes wrong, then you
have never had anyone really responsible. That is the crucial test
of responsibility. Something goes wrong, can you find who is the
responsible person? If you cannot do that, then no one has ever
been responsible.
For these reasons, I did all I could to gain support for my concept
of total responsibility. It required that a single position be estab-
lished to handle both the Navy and the AEC parts of the job. The
reason we had to have it in both organizations is because the Navy
did not want nuclear-powered submarines. The Atomic Energy
Commission did back it, and we got nearly all of our support and
most of our money from the Atomic Energy Commission. That was
the reason for having a joint organization, it was forced on us by
the U.S. Navy. Particularly the submarine people in the Navy were
against atomic power. If you are interested why, I will give you the
logic. The logic was that they thought that an atomic submarine
would cost 1½ times as much as a conventional submarine. There-
fore, we would only get two instead of three submarines and there
would only be places for two captains instead of one. That was the
main reason behind their opposition, and they continued that oppo-
sition for many years until Senator Jackson stepped in and the
Senate unilaterally put more submarines into the program. That
was the vast cooperation we had from the U.S. Navy in the begin-
ning.
Mr. MCCORMACK. The Senate owes much to Senator Jackson for
this program. The country owes much to Senator Jackson.
Admiral RICKOVER. He was there. We certainly do owe him a
great deal for his wisdom, for his great intelligence and under-
standing not only of things but mostly of people. I am glad that you
agree with me on that.
I think it might be of value to this subcommittee to outline how
this designation of responsibility was derived from the `Atomic
Energy Act of 1954, and how it is carried out all the way down to
PAGENO="1046"
1042
the ships, whether in construction, operation, or overhaul. I have
such an outline and with your permission I would like to include it
in the record with my statement.
Mr. MCCORMACK. Without objection it will be included at this
point.
Admiral RICKOVER. I can assure you that having only one indi-
vidual responsible for a total program is a unique concept within
the Department of Defense. I want to emphasize that throughout
this entire period of over 30 years I have had full support from the
Congress, mainly through the former Joint Committee on Atomic
Energy and the Armed Services and Appropriations Committees,
and from the Atomic Energy Commission and its successors, the
Energy Research and Development Administration and now the
Department of Energy. I have not had such consistent support
from the Navy or the Department of Defense.
FACING THE FACTS
Another principle for successful application of a sophisticated
technology is to resist the human inclination to hope that things
will work out, despite evidence or suspicions to the contrary. This
may seem obvious, but it is a human factor you must be conscious
of and actively guard against. It can affect you in subtle ways,
particularly when you have spent a lot of time and energy on a
project and feel personally responsible for it, and thus somewhat
possessive. It is a common human problem and it is not easy to
admit what you thought was correct did not turn out that way.
If conditions require it, you must face the facts and brutally
make needed changes despite significant costs and schedule delays.
There have been a number of times during the course of my work,
not only in the atomic energy work but in charge of the electrical
section of the Navy during the war, that I have made decisions to
stop work and redesign or rebuild equipment to provide the needed
high degree of assurance or satisfactory performance. The person
in charge must personally set the example in this area and require
his subordinates to do likewise. Briefly I will say what it is like in
a figurative sense. You have to have the guts to kill your own
children, if necessary. That is exactly what it amounts to.
PRINCIPLES OF DESIGN AND ENGINEERING
I will now discuss in detail the underlying basic principles of the
naval reactors program.
From the very beginning of the naval nuclear propulsion pro-
gram I recognized that there were a large number of engineering
problems in putting a naval reactor into a submarine. Some prob-
lems were unique to submarine application, and some to the gener-
al problem of making a reactor plant work. I realized at the time
that the use of nuclear power, as with any new sophisticated tech-
nology, would require the institution of novel requirements and
standards. I realized that these requirements would necessarily be
difficult to meet, and the standards would need to be more strin-
gent than those which had been used in power plants up to that
time. But when you are at the frontiers of science you must be
prepared to accept the discipline this requires in order to proceed.
PAGENO="1047"
1043
The fact that the application of nuclear power was almost entirely
an engineering problem-not a problem of nuclear physics, as
nearly all of the experts then believed-was clear to me. The
emphasis I have placed on sound, conservative engineering has
been a major factor in the performance of our plants.
I should point out that in the late 1940's and early 1950's, when
the original naval nuclear propulsion plant design studies began,
there were no standards, design guides, or codes available. They
had to be developed. Due to the military application, these design
criteria included considerations of reliability, battle damage, high
shock, and the close proximity of the crew to the reactor plant~ The
propulsion plant design had to be readily maintainable so possible
equipment failures at sea could be repaired. The fact that major
maintenance operations would be infrequent and refueling possibly
as seldom as once in a ship's lifetime required that standards for
materials and systems be very rigorous and that only premium
products which had a proven pedigree could be considered for use.
My design objective is and has been to provide a warship that
can be relied upon to perform its mission and return. You may be
interested in knowing practically all the standards used in the
entire nuclear program originally were developed in the naval
program. That is even true of the manufacturers. At the height of
the naval program, many years ago, I deliberately had at least
three separate companies competing for the same job. That indus-
try was established for the naval program and part of it is still left
for the civilian program. So I had a problem there of not only
building the ship, I had to set the standards and create an industry
to support the work.
I would like to add here an interesting point, which perhaps is
not known to you. When I started out with a company, let us take
Westinghouse, which is the first one, I held a series of 20 lectures
for all the top officials of the Westinghouse Co., including the
president and chairman of the board. I did the same for General
Electric and for many other companies, and that way I got the top
people in the company to understand what the naval effort was all
about.
I think it would be worthwhile your checking into the civilian
program to see whether the people who operate these plants and
the top officials have had any kind of similar training to under-
stand what it is all about. This is one suggestion I can give you
that may be worthwhile.
CONSERVATISM OF DESIGN
I will explain some of the elements of good engineering as I have
applied them to the reactor plants for which I am responsible.
First, in any engineering endeavor, and particularly in an ad-
vanced field such as nuclear power, conservatism is necessary, so
as to allow for possible unknown and unforeseen effects. This con-
servatism must be built into the design from the very beginning. If
the basic design is not conservative, it quickly becomes impractica-
ble to provide the needed conservatism. Here is an important point.
It then becomes necessary to add complexities to the system in an
attempt to compensate for the inadequacies of the basic design.
PAGENO="1048"
1044
These complexities, in turn, serve to reduce conservatism and reli-
ability.
I have called that the elephant system. You see carvings, 1 big
elephant followed by 20 increasingly smaller elephants. In a lot of
designs, they get into a problem and instead of trying to change
the top elephant they add other elephants. That means you have
more elephants to feed, more to take care of, and so on. That is an
analogy that I think is worth your considering, the elephant
system.
I must make it clear that the military requirements which must
be met by naval propulsion reactors are far more exacting than
those which central station plants must endure. For example, the
shock loadings for which naval plants are designed are far greater
than the earthquake shock loadings for civilian plants. In addition,
naval plants must be able to accommodate power transients much
more rapidly than civilian plants. We are faced with this all the
time. A ship is steaming along and you ring up a bell and it has to
be answered immediately. They are not faced with that problem,
because you have got plenty of time to change your power in
commercial plants. Generally it is scheduled. Ours are all com-
pletely unscheduled and must be answered immediately if the ship
is to remain safely submerged.
Each naval vessel depends entirely on its own reactor plant for
the capability to perform its mission. For a ship there is no inter-
connected grid to pick up the load and allow the ship to continue
functioning. The stringent requirements of operating a ship at sea
are reflected in a conservative design with a large overall design
margin in almost every element of the plant.
Some specific examples of the conservatism in design which I
have used are:
Use of ordinary water of high purity as the reactor coolant.
Water has been widely used in industrial applications; its proper-
ties are well-known, and when irradiated, has short-lived radioac-
tivity.
Use of conservative limits for systems and equipment. Design is
based on the worst credible set of circumstances, rather than rely-
ing on a statistical approach which deals in average or probable
conditions.
Provision in the design for redundancy so that failure of one
component, or one portion of a system, will not result in shutting
the plant down, or in damage to the reactor.
Design of the reactor plant to enable it to accommodate expected
transients, without the need for immediate operator action. This
means the plant is inherently stable, and helps the operator when
there is an unusual transient.
Simple system design, so that minimum reliance must be placed
on automatic control. Reliance is primarily placed on direct opera-
tor control.
Selection of materials with which there is known experience for
the type of application intended and which, insofar as practicable,
do not require special controls for procurement, fabrication, and
maintenance which could lead to problems if not properly accom-
plished.
PAGENO="1049"
1045
Use of a land-based prototype of the same design as the ship-
board plant, and that is extremely important. This prototype plant
can be tested and subjected to the potential transients a shipboard
plant will experience prior to operation of the shipboard plant.
I made that decision at the very beginning in the 1940's that I
would not put a ship to sea, I would first build a real, honest-to-God
identical plant onshore. Meanwhile, we started building the Nauti-
lus while we were building and operating the prototype and we
learned many lessons on the prototype which were incorporated
into the Nautilus. I think that was a farsighted and essential
decision I made.
Use of extensive analyses, full scale mockups, and tests to con-
firm the design. We do that for the entire ship, and it never used to
be done in the Navy, that is to have a full scale model of the
machinery part of ships. We have had a complete, full scale,
wooden mockup of every machinery plant in any nuclear powered
ship, whether it's a submarine, aircraft carrier, or cruiser, or any-
thing else, we have always done that because scale mockups are
very deceptive.
I have seen mockups of factories and they are very deceptive.
The human eye is not capable, even in a quarter scale mockup, of
seeing things properly. It's a very interesting thing, and so we have
always used full scale mockups, with the slightest thing, every nut,
every piece of cable, everything exactly the way it is on the ship.
The people who are building the ship can go right in there and see
how it is supposed to be.
It's expensive, but it's essential.
Strict control of manufacture of all equipment, including exten-
sive inspections by specially trained inspectors. We have our own
corps of inspectors. We have taken people from the regular Depart-
ment of Defense inspection system. They have been assigned to us
and we have given them special training in our work. This means
that at many points during the manufacture an independent check
is required, with signed certification that the step has been com-
pleted properly.
That is an absolute essential in any part of the program, wheth-
er it's an inspection system or whether it's an operating system.
We have a legal form which has been approved by the Federal
courts. When a man signs the statement on the bottom it says
words to this effect-I don't know the exact words-, but, "I hereby
certify by my signature that I have actually carried out the thing I
have signed for", and he can be legally held accountable for it.
I don't know whether that is used anywhere else. We use it even
on board ship in our valve checkoff lists. We have a legal document
on which a man who does something has to sign his name.
Mr. MCCORMACK. Do you do this for routine maintenance, Admi-
ral?
Admiral RICKOVER. No; that is not a maintenance problem. That
is used in inspection, any kind of an inspection, no matter what it
is. It is not in maintenance, that is a different thing. But we do
have other systems that take care of that. We have checkoff lists in
maintenance, and we also have the work supervised and it has to
be checked after a job is finished.
We find mistakes and we have a system that finds the mistakes.
PAGENO="1050"
1046
I am not implying that there are no eyesores in this program, no
problems and everything runs all right. It can't anywhere in the
world. Any human endeavor is bound to have its problems. But we
take precautions to the maximum extent that we can, recognizing
you have to deal with human beings and you know what a tough
job that is.
Providing extensive detailed operating procedures and manuals, I
think also is something we excel in. Our manuals and operating
procedures are done by experts and it's very carefull.y checked to
see that they can be done on board ships. One of the most frequent
issues I have in dealing with my own engineers when they write
changes in the manual or create something, I say is this sailor-
proof. That is, I have to figure if we are getting young men in on
these ships who have had very little experience and when you issue
an operating instruction are the words such that can be understood
by ordinary human beings.
I go over every one of these procedures myself and I think you
can ask any one of my people in this room and you will find out
that is one of the most frequent things I call them on. Can this be
understood by a sailor? It's very tempting for engineers and scien-
tists to write things which cannot be understood by ordinary
human beings, and that is something you have to watch all of the
time, and you have to know.
I know from my considerable shipboard operating experience
what you can really get a young sailor to do, and you have to bear
that in mind.
I mention I provide extensive detailed operating procedures and
manuals prepared and approved by technical people knowledgeable
of the plant design. For example, Mr. Wegner; who handles person-
nel, has in his office several ex-captains of submarines who look
over these things too to see if they are suitable for us onboard ship
with the kind of people they have.
We don't just arbitrarily issue instructions. They must be
checked by responsible people. These manuals are constantly up-
dated as we learn from the operations of the many other reactors.
What we learn on one plant is incorporated into all our plants, and
we have a system for that, for anything that comes in.
By the way, I read everything, every report. I require formal
reports of anything that goes wrong on any ship. They come to me
directly and I read each one of them, and I route them out to other
people who are responsible with a system that makes absolutely
sure that they will be handled and not forgotten.
We keep records on every one of these, so everything that goes
wrong is taken care of, not only on that ship but we see if there is
any application to any other part of our system.
I don't know whether you have that in the civilian program
where these things are looked at by people at a central place and
effective correction, changes in manuals or changes in equipment is
required. This is one thing you could do in a civilian industry,
make them responsible to have some system of this kind.
I think this may come up in questioning. I am almost through
now.
PAGENO="1051"
1047
Use of frequent, thorough, and detailed audits of all aspects of
the program by individuals who are specifically selected and
trained.
We regularly send our most competent people from headquarters
for a week to a Navy yard or shipyard to make a very thorough
inspection of those who build and repair the ships. We have inspec-
tion boards out in the fleet whose sole duty is to go on board ships,
and spend several days on any ships to inspect all of the elements
of the operation of the propulsion plant. After they do it they
report to the fleet commander and to me.
I call almost every captain of every ship when the report comes
in. If he does not do well I ask him why not and what is he doing
about it. As I said I get regular reports from them anyway on their
training and everything else that is wrong.
Use of formal documentation for design decisions, manufacturing
procedures, inspection requirements, and inspection results.
In addition to the detailed technical review and approval by my
office, the safety aspects of operation of naval nuclear powered
ships are independently reviewed by the Nuclear Regulatory Com-
mission and the Advisory Committee on Reactor Safeguards.
APPROACH TO NEW REACTORS
Now, the last part of my testimony will be the approach to new
reactors.
The kind of engineering approach I have just outlined is, in my
opinion, why the naval reactors program has resulted in safe,
reliable nuclear power. To the casual reader much of what I have
said may appear obvious. But I assure you it is not when you try to
carry out these concepts in every day work.
I have encountered many cases where these ideas are ignored or
not understood. I have, on many occasions, reviewed proposals for
smaller, lighter, and cheaper reactors. This is a very frequent thing
coming in all of the time from the Navy and system analysts-they
advocate smaller, lighter, and cheaper reactors.
While such proposals have covered a wide variety of concepts,
they have been completely consistent in one respect; they have all
involved the sacrifice of sound, conservative engineering to achieve
a design theoretically having better performance. They each violat-
ed most if not all of the engineering principles I have just dis-
cussed.
If there has been one consistent thing in the program from some
line officers in the Navy, it is this. I once saw a cartoon about a lot
of admirals sitting around the table and saying, "If he only wanted
to, he could design a small, cheaper one." In other words, they
believe it's an obstinacy on my part not to do it. Instead it is an
absolute certainty because I am responsible for the safety of the
ships and the people.
They don't know enough about it. The idea stems from electron-
ics. Over a period of many years now they have finally gotten down
to little diodes and they have an idea you can do that with machin-
ery too. You cannot; they do not understand one fundamental of
engineering-in an engineering plant you have to dissipate heat.
So you have condensers and if you put out a smaller, more power-
PAGENO="1052"
1048
ful plant, you still have to dissipate the same amount of heat. You
cannot avoid it.
But they also avoid all of the safety aspects, the idea being they
will be designed later or excluded but, the more difficult the design
the more safety will be necessary.
Now, you can understand it but I cannot get people in the Navy
to understand it. So every 2 years or so we are bombarded with
this and a lot of money is spent and it wastes our time fighting the
idea of getting little plants that put out the same power as the big
ones and would be more reliable.
We just don't understand how people can believe this but yet this
is not true in the Energy Department or the AEC. They have never
done it; they are far more realistic. But in the Navy we get these 2
and 3 year people in who say this is a good thing, therefore, you
ought to have it.
This is a very important point because if you didn't have a long
time organization with people who know the facts we would have
attempted all kinds of things and they would all have been fail-
ures.
There is no question in my mind about that. But we are con-
stantly bombarded on this issue and I don't know how to get
around it. This is the only forum I have. I cannot find the people in
the Navy that will believe this because they are used to believing
in magic, and you have to in 2 or 3 year jobs; it's the only way you
can make your name.
These cheap ones all violate most, if not all, of the engineering
principles I have just discussed. They would all have been in my
opinion unsafe and unsatisfactory for naval warship application.
How often have you known of cases where in the fervor of winning
contracts, firms will promise all kinds of performance, only to be
found incapable of delivering it when they try to make the equip-
ment work.
By this, I do not mean we should not make improvements. We
have. But at all stages you must proceed in accordance with sound,
conservative engineering practices if you are to produce something
that will work instead of something that is just an expensive piece
of unreliable and unsafe junk.
As an example, I have often been pressed to reduce radiation
shielding-that's a good one-to make new ships smaller and light-
er. However, if I removed 100 tons of radiation shielding from a
typical submarine, the ship would be only 2 percent lighter. But
the radiation exposures to ship personnel would increase to 10
times the current levels. I have not agreed to reducing shielding
because I believe radiation exposure to personnel should be as low
as I can reasonably obtain.
In fact, I am telling you informally, there was one Chief of the
Bureau that wanted me to reduce the shielding, and his reason
was, "People will learn to live with radiation." That's right. Now,
don't think I am making a statement that I cannot verify. If
necessary, I can supply it for the record.
NAVAL NUCLEAR TRAINING
Another element in my approach to safe operation of naval
reactor plants involves the selection and training of the. operators.
PAGENO="1053"
1049
I consider the training of officers and men to be at least as impor-
tant as any other element of the Navy nuclear power program. I
think now I am beginning to hit on what you are mostly interested
in.
I consider it of the greatest importance that the mental abilities,
qualities of judgment, and level of training, be commensurate with
the responsibility involved in operating a nuclear reactor. The
selection of personnel and their training in the Naval nuclear
power program are carried out with these considerations in mind.
Academic ability, personal character as demonstrated by any
acts reflecting unreliability and honest desire for the nuclear pro-
gram are all taken into account in selection of personnel. Once
selected for the Naval nuclear power program, the individual is
continually subject to review.
To accomplish these objectives, I require a one year training
period prior to an operator going on board his first nuclear ship.
The first 6 months of nuclear power training are spent at nuclear
power school in Orlando, Fla., where the curriculum concentrates
on the theoretical basis for shipboard systems. You might wonder
why it was Orlando. It was because one Congressman on a commit-
tee, a very senior one, came from there.
What are you laughing at?
Mr. MCCORMACK. I am just wondering if you enjoy it anyway. Is
it a good site anyway?
Admiral RICKOVER. The first 6 months are at Orlando. Upon
graduation from nuclear power school the student reports to one of
our land-based prototype plants where he learns to actually oper-
ate the propulsion plant. There the student must demonstrate that
he can operate the plant under normal and casualty conditions,
and he is taught to operate in strict compliance with detailed
operating and casualty procedures.
I established the naval nuclear power training program on a
base of rigid high standards. My staff at Naval Reactors Headquar-
ters approves the curriculum at nuclear power school and the
qualification guides used to develop the prototype and shipboard
operator qualification programs. This insures that the standards
are not reduced by someone who does not understand the overall
goals of the program, and that the individuals responsible for the
design and construction of the reactor plant systems are involved
in the training considerations on that system.
The methods we use in training involve lectures, seminars,
homework assignments and both oral and written examinations.
We also require operators to be able to demonstrate their practical
knowledge in order to become qualified at the land-based proto-
type, which, as you know, is completely identical with the one on
the ship. These individuals must subsequently qualify on board
ship.
I am not satisfied with bringing an operator to a qualified level
once and then forgetting about him. Therefore, we continually
reinforce theoretical and practical training with a continuing train-
ing program on board ship. We have it on board ship but, of course,
at the prototype it goes on all day long. But we do it at the ship
also. This includes frequent practice in plant evolutions and casual-
ty drills.
PAGENO="1054"
1050
The examinations given must be tough and must be approved by
a competent person in authority. Instructors are trained so that
they are capable of correctly instructing the student. Instructors,
as well as students, are monitored. We monitor the instructors too.
InspectiOns of personnel in the fleet are conducted by members
of my staff, both those in the field and from headquarters, by the
Fleet Nuclear Propulsion Examining Boards established by the
Chief of Naval Operations and by nuclear trained personnel on
various other naval staffs. I review the results of all their inspec-
tions.
When I say, "I", my organization reviews the results too. But
when I say, "I" that means me, personally. I want to tell you that
word "I" is not used loosely or in any figurative manner.
I have established a formal system of reporting propulsion plant
problems which identifies areas which need improvement in the
training program. I also require the Commanding Officer of each
nuclear powered ship to write me periodically concerning propul-
sion plant problems. These letters contain a summary of the
training he has conducted and allow me to personally check the
adequacy.
The frequency of these letters is every 2 weeks for ships in
overhaul; for ships operating like Polaris submarines, it's every 3
months, and the report outlines in detail everything that has hap-
pened on the ship, all of the problems. I get individual copies of
reports, and a complete list of the training; it includes each day's
training, the number of people who were given training, what the
subject was, who did the training and who monitored and how long
it lasted.
There is a standard form so I can judge how much training we
are doing. Because training is so important I want to provide a
much more detailed description of what we do for your record. I
know you don't have time now to read it, but I hope you do read it
finally.
MISTAKES MUST BE TAKEN INTO ACCOUNT
Now, mistakes must be taken into account. What I have present-
ed at this point represents the main substance of my statement. In
it I have outlined what I do in running the naval reactors program.
Even when these measures are carried out it is important to recog-
nize that mistakes will be made, because we are dealing with
machines and they cannot be made perfect.
The human body is God's finest creation and yet we get sick. If
we cannot have perfect human beings then why should we expect,
philosophically, that machines designed by human beings will be
more perfect than their creators? That is a great fallacy today in
modern technology, with all of the articles written and with un-
knowledgeable newspaper reporters we are being given the impres-
sion that a machine can do a job better than a man.
Now, some things it can do better, like doing computations, but
for all practical work the machine cannot be better than a human
being; it's impossible because the human being made it.
This is what many unthinking people demand even though the
Lord himself did not reach this height. I believe if you follow the
practices of conservative engineering and personnel training I have
outlined and if you carry them out with steadfast commitment,
PAGENO="1055"
1051
nuclear power can be safely used, even taking into account mis-
takes that will inevitably occur.
That is the basis on which I have conducted all my work in this
field and I believe it true just as strongly today as I ever have.
DECISION ON NUCLEAR POWER
As well as anyone in this room, I recognize that nuclear power is
a very difficult subject for anyone to deal with. It involves energy,
a vital element in our Nation's future; it involves individuals'
concerns for themselves and their families, and it is a highly
technical, sophisticated technology.
Ultimately, the decision as to whether we will have nuclear
power is a political one, in the true sense of the word, that is, one
made by the people through their elected representatives, and that
means all of you.
It is vital that the decision be made on the basis of fact, not
rhetoric, not conjecture or hope, or as a result of the widespread
tendency to sensationalize the current topic and ignore the real
limits or risks of the alternative.
NUCL~AR POWER SENSATIONALIZED
The press is avid for sensationalizing everything that happens,
and you also know about many of these people who call themselves
Ph. D.'s who have never gotten recognition in their fields, but who
can seize on radiation and make a lot of political hay out of it.
They are doing a great deal of harm. They are making exagger-
ated statements. For the first time in their lives they are getting
publicity and that is what they want. They are not really interest-
ed in health; they are really interested in getting publicity for
themselves and becoming spokesmen.
This is one thing I am sure you and your members are aware of,
Mr. Chairman, and you have got to be very careful about it and I
accuse the press of over-sensationalizing everything connected with
atomic power.
It's a favorite thing for them to do, and I would urge the editors
of the papers to act in a more responsible manner.
For example, in Norfolk somebody sees a sailor dump a bucket of
water off the stern of an aircraft carrier and immediately there is
a headline, "Radioactive water poured into Norfolk Harbor." The
guy had washed his socks in it and he poured the water overboard;
yet that is immediately reported as nuclear water. And we have
that sort of nonsense happening all of the time.
You might think, well, that's funny. But it really is not funny.
You, in all your wisdom, have created a Freedom of Information
Act. What you have created is a monster. I hope you would apply it
to Congress and then you would change the law. It takes all of the
time of our top people; we have become essentially information
agencies. Our time is taken up with answering these questions that
anyone can ask. We are required by law to answer them within 10
days, and that has become the biggest preoccupation of people in
Government.
PAGENO="1056"
1052
First, we are all known to be dishonest; that is accepted by the
press and by the people, that all government servants are dishon-
est. Next we have to answer any questions that are asked.
For example, supposing a fraud case is lodged against a compa-
ny. That company has a way -to get many of the Government
documents before it even goes on trial. They try, through the
Freedom of Information Act, to get the Government's case, but that
is only a detail.
The worst is we are constantly flooded with these requests for
information that ties up all of our people, and I can assure you
from personal experience that it's almost impossible to do any
constructive work anymore. The Government has now become an
information handout agency and I strongly urge, based on what-
ever experience I have derived in my job, that you really ought to
do something about that.
I am not saying that Government agencies should not be respon-
sible, but there should be a formal way and you should treat us the
same way you treat Congress, which you are not doing.
If you had to be faced with that in Congress you never could
work, and you never would work. On top of the Freedom of Infor-
mation Act we have the vast proliferation of congressional staffs
and every new member on a staff, has to make his way. So he gets
it by taking on the executive branch. Fine; you can have your way,
but what are you ending up with?
Now, I am probably the only one who can talk as frankly as that
to you, but I think you have got a real problem and you ought to
face it.
Mr. MCCORMACK. Admiral Rickover, we want to thank you for
your testimony.
Admiral RICKOVER. I have not finished yet.
I may take some other cracks at you.
Mr. MCCORMACK. Please proceed.
JUDGMENT ON NUCLEAR POWER
Admiral RICKOVER. I am not an expert or even particularly
knowledgeable in the areas of environmental effects of other forms
of power generation. However, I am aware that a good many
knowledgeable people conclude that the total risk involved in the
use of nuclear power is no greater than is involved in the use of
any alternate source which can be tapped in the next 50 years.
I also remember the optimistic projections made for nuclear
power when it was first being developed. These sprang from hope
and from ignorance of the real engineering problems that would be
encountered in using nuclear power.
There is no reason to believe that current projections for alter-
nate means of providing large amounts of power are any more
precise. In fact, the more you study power from the Sun and other
sources you will find you can run into exactly the same problems.
Any large scale generation of power involves major engineering
difficulties and potential environmental impacts.
The job of this committee and the Congress in the days ahead
will not be easy. I hope and pray you will find the strength and
wisdom to make the right decisions.
PAGENO="1057"
1053
I also hope that my testimony will in some way contribute to
your difficult deliberations.
This is a point you want to remember. Anything that you don't
have yet is touted as safe. Yet if you get into the environmental
aspects of coal, and of other things, you are going to have the same
or similar problems as nuclear power.
So, you have to make up your mind, do you want advantages. If
you do want an easier way of life, you are going to pay for it in one
form or another. You have to make up your mind.
PERSPECTIVE ON RADIATION
For example, right here in the Capitol you have one place where
the radiation is greater on account of the stone you have here than
we allow the navy yard people to have. If you don't like anybody,
stand them up in that place.
Mr. MCCORMACK. Now, Admiral, I want to say thank you again. I
want to say, by the way--
Admiral RICKOVER. Thank you for listening to all my comments,
particularly on Congress.
Mr. MCCORMACK. We appreciate them.
I might say that I have had a survey done of the radiation levels
in the Capitol Building. The radiation levels in a number of places
around Capitol Hill, because of stone construction, are higher than
those at the gates of nuclear powerplants. I am sure that they are
higher than the radiation levels in the operating rooms of the
naval nuclear powerplants, too.
This is a point that is not generally understood by the public,
background radiation in many areas, just because of stone build-
ings, is higher than nuclear powerplants. As a matter of fact, you
mentioned the stone in this building.
At the Vanderbilt entrance at Grand Central Station in New
York City the radiation level is 500 times higher than it is at the
gate of a nuclear powerplant.
Admiral RICKOVER. There is a political impact of this, too. I once
told a Member of the Congressional Delegation of New Hampshire
that they talked too much about this. If the tourists found out that
radiation was given off by all the stone up in that State, that it
might deter tourists, and he never said much after that.
APPROACH TO TRAINING
Mr. MCCORMACK. Admiral, I would like to ask you a couple of
questions about this basic approach to training nuclear powerplant
operators.
You have talked in your presentation today about your programs
in the nuclear Navy. By inference you have drawn a contrast
between the high standards of disciplines and rigid programs for
training and qualification and requalification that you have always
maintained and what may not be those high standards in the
commercial world.
The testimony that we have received so far indicates that those
high standards are not maintained, at least in some instances, in
nuclear powerplants, and indeed this may have been a significant
contributing factor to the accident at the Three Mile Island plant.
48-721 0 - 79 - 67
PAGENO="1058"
1054
I would like to ask you if you believe that it is realistic or
possible or practical to establish these kinds of standards for com-
mercial nuclear powerplant operation?
Do you believe that it is practical for us-I hope you say yes, I
would like to have your honest appraisal-do you believe it is
practical for us to have, for instance, high academic qualifications
and achievement for nuclear powerplant operators?
Can we establish the same kind of rigid training programs, the
high degree of intellectual discipline, the same standards for past
conduct, the same standards for substantive evaluation of the atti-
tudes, and the same programs for continual reevaluation and the
same programs for removal of a license to operate if they do not
meet these qualifications?
This seems to us to be a critical element in the nuclear power
program in this country today. I would like to ask you if you
believe we could establish these within the commercial nuclear
power program?
Admiral RICKOVER. I assume you have read the 70 or 80 addition-
al pages of my statement which goes in vast detail into the train-
ing detail. Again, I suggest if any members have not read it you
should because that is the guts of the. whole thing. All I have done
this moring is outline it.
Yes, I think it can be done, but here in this program we have
central personalized control. In the utility program you don't.
UTILITY ACTIONS
First, as most or nearly all utilities are operated, the top man is
either a banker, a lawyer or an accountant. He doesn't have the
technical expertise.
Step one, I mentioned I would take steps to get them to have
some detailed knowledge of what their product is and how it is
achieved. I think that is essential for any business.
On the other hand, most people today in large conglomerates are
interested in the bottom line, how do you make money. If you start
anything that costs more money they generally will object to it.
Therefore, whatever standards you set up must be the same
throughout. Ultimately, the people are going to have to pay for it
one way or the other. If you want nuclear safety you have to have
this kind of training.
Now, naturally, over a period of many, many years I have given
a lot of thought to this same question and I have made suggestions
at various times. One, the obvious thing, why not let the Govern-
ment train all the people? That is wrong.
The Government has already undertaken so many things which
it shouldn't and which should be done by the people in private
industry. I have advocated we stop all the nonsense and that each
child at birth be given a welfare certificate, a pension certificate
and diploma from an Ivy League college, and stop all the nonsense
that we are doing.
If we keep on the way we are going, I don't know where we are
going to get all the money.
Take all the radiation injury claims. Anyone can apply now for
any type of disease. We might as well stop the nonsense and give
everybody a pension at birth.
PAGENO="1059"
1055
Now, here is what I would do. I don't believe in a government
doing it. I would have the utility industry set up a group of their
own people, charged with this responsibility of seeing to it that
they get the proper people, that they are trained properly and to
conduct their own inspections.
I am not saying inspections should not also be conducted by a
Government agency, but I would have the utility industry police it.
They had the origin of the idea in the National Electric Light
Association-it was an old organization which was generally a
trade promotion agency-which was to educate people in how to
use more electricity. That is what its primary function was.
I would change that around to take on this job and that could be
done. Make the utilities responsible. At the same time, you have a
regulatory commission, have them check into it. But for the Gov-
ernment to take on this function is dead wrong.
I think the Government should stay out of it as much as it can in
order to carry out our basic political principles and not ultimately
become like the Russians. It can be done.
So what I would do, to be specific, you could do that very well,
your committee, you could have a meeting of the top people in the
utility industry, tell them the problems you see and ask them what
they are going to do about it.
That is a simple answer, but it carries in it the idea which will
help solve this problem. As far as training is concerned, if they
wish to find out how to do it, they can, we will tell them what we
do, it is part of the United States and we would be glad to show
them what we do.
Mr. MCCORMACK. Thank you.
Mr. Wydler?
Admiral RICKOVER. I haven't given you a detailed answer.
Mr. MCCORMACK. Yes, I think you have answered it. Fundamen-
tally you are saying we have to establish some sort of program for
the--
Admiral RICKOVER. For the industry.
NRC ACTIONS
Mr. MCCORMACK. Let me ask you one very quick question.
Would you believe that it would be a good idea for the NRC then
to appoint some sort of a Hyman Rickover within the NRC family
to see to it that these programs are carried out, be responsible for
approving qualifications, approving examinations and this sort of
thing?
Admiral RICKOVER. One Hyman Rickover is enough for the
United States. You have to let them work that out themselves. The
graveyards are full of indispensable people. There is no one person
that you have to have do it.
The idea is very simple. You cannot afford to have transient
management. That is why the utility industry has to do it and they
can set up standards and pay their people properly that they will
get some permanent people.
If they are going to have a guy come in and out every year or so,
it will never work. It will not work as a technical and administra-
tive outfit. That is what they are going to do if you let them alone.
PAGENO="1060"
1056
Therefore, there must be a form of inspection by somebody and,
yes, you could turn that over as a function of the regulatory agency
to see that this is complied with.
It is certainly within their power tO do it, let them set it up, they
have some permanent people. But it must basically be done by the
industry itself.
Mr. MCCORMACK. Thank you.
Mr. Wydler?
Mr. WYDLER. Admiral, the testimony you gave here today was
excellent, and frankly, I think the facts you have given us about
the existence of your program is proof positive to the American
public that we can handle atomic power and live with atomic
power in a safe and reasonable fashion, if we go about it in a very
deliberate way, as you have done in the naval program.
I get letters from people in this area, not many, but some, and
they are all upset. They found out they are living within 50 miles
of a nuclear reactor and they seem very uptight about that, like
some part of their life is going to be changed as a result.
When I think about the fact that your personnel have to go down
in a rather small containment vessel and right in the vessel, under-
neath the waters off the ocean, and live with the reactor--
Admiral RICKOVER. They nearly always get less radiation than
they get if they are ashore.
Mr. WYDLER [continuing]. And live with it for long periods under-
water and yet you don't seem to be hysterical about it. As far as I
can find out, there have been no adverse effects. That is th~ first
question I have to ask you.
Admiral RICKOVER. We have had none.
Mr. WYDLER. What are, if any, the adverse effects in the sense of
unusual sickness of any kind to the Naval personnel who are
aboard the atomic submarines of our country, or who have been on
duty and continued to be on duty right to this time?
Admiral RICKOVER. We have had none.
We have had publicists that have talked about cancer deaths
from the original crew of the Nautilus. This is where I get back to
the media. I think that they have taken a very irresponsible atti-
tude toward the public and I suggest that this committee address
the editors and tell them what they are doing to the public.
They are scaring the hell out of the public unnecessarily and also
the pseudo Ph. D.'s that are running around and getting their
names in the paper, they are doing a great deal of harm.
MISTAKES AT THREE MILE ISLAND
Mr. WYDLER. We were told to get specific about Three Mile
Island. One of the things that happened-and there was a long
sequence of mistakes that were made-was that a couple of valves
had been shut. We were told that these were on the auxiliary feed
pumps of the water system.
We were further told that when valves were shut there was a
dial of some kind, or an indicator lamp or gage of some kind in the
control room which indicated the fact that the valves were shut.
We were further told that about four or five shifts of control
room personnel came on and went off duty while these indicator
lights were in the wrong position. We were further told the posi-
PAGENO="1061"
1057
tion they were on was green. That meant danger. I didn't quite
understand that.
Admiral RICKOVER. What was the last part? They were green?
Mr. WYDLER. The lights were green when they should have been
red. Apparently, if the system is in the wrong position on this
particular system, the light is green. Anyway, that is what they
told us.
Admiral RICKOVER. Can I interrupt you to tell you a story about
the girl who went in the drugstore and asked for some green
lipstick. The druggist looked around and said, "Lady, I am sorry,
we don't have any. We only have red. Do you mind if I ask you
why?" "My boyfriend is a taxi driver and he stops when he sees
red."
Apparently they changed. I see even your lady member is smil-
ing. They had their gages. The universal: thing on gages is green is
a sort of go ahead.
Mr. WYDLER. It has always been to me. In this case, apparently
the trained personnel should know it should be red instead of
green, I guess, but the fact of the matter is these shifts came on
and went off and came on and went off, came on and went off, and
nobody even noticed it.
Could that happen on a Navy ship?
NAVY DIFFERENCES
Admiral RICKOVER. I don't want to create the impression that the
U.S. Navy and particularly the nuclear powered Navy is the per-
fect creation of the Lord. It is not. Even I am not infallible.
Now, in the first place, we have some differences between civil-
ian plants. We have a trained officer supervisor, an officer in
charge of each watch. The only sailors who are allowed to stand
watch are those who have been trained.
If we are teaching somebody, he stands along with the trained
man. We do not have any unqualified people standing watch.
We keep logs. When a new officer goes on watch and relieves the
first one, he finds out all that is going on, he assures himself it is
all right, and then he says I relieve you. He doesn't relieve him
while there is anything wrong unless he accepts it.
There is a constant transfer of that information. We require it.
We furthermore require everything to be entered in the log.
Mr. WYDLER. When a shift comes on, do they check all the
instruments to see that everything is normal or as it should be?
Admiral RICKOVER. No, they don't check everything but what we
do, we don't depend on a remote operation. We have people sta-
tioned in the engineroom. We have several people on watch who
check things as they go on duty.
But you can't take every one of thousands of valves and check it.
After all, the ship is operating. Before you get underway you have
a checkoff list where you check every valve that is going to be used
and it is checked by two people and each one of them must sign his
initial on each valve.
Sometimes they don't do that. Sometimes they just look at the
other guy and they think the valve is open. We have that happen,
too. But before we get underway we try out the plant, and this sort
of thing shows up.
PAGENO="1062"
1058
We have things happen, too. I do not want you to think that we
have a perfect operation. It would be a wrong concept, but we do
train our people to check things and they quickly find out if
something is wrong.
For example, take the case of the water level in the reactor. I
thought you might ask me that question so I will come to it right
now.
There is no direct indication of reactor water level but we have
gages which show temperature and pressure, and if the man is
trained he can tell what the level is. That is what we do.
We do it through people training. We have cases where you can't
get the answer directly from a gage, we train them, and further-
more, we generally have duplicate gages on most things so if one
goes wrong, we have another.
We have a lot of duplication that way. But the basic thing we
depend on is training of people.
After a man gets trained on a prototype, he then, as I men-
tioned-you may not have the import of what I said-he gets to a
ship and has to spend several weeks qualifying all over again on
that ship even if the plant is the same.
What I am getting at is I don't believe you have what I would
call the infinite attention to detail which we do and we require. We
require keeping records. We require reporting. We have our own
inspection system.
You cannot guarantee this modern technology is going to work
by itself; that is the biggest heresy there is-to think the more
complex technology is, the less trouble you have.
COMPLEXITY DOES NOT MEAN SAFETY
There is an interesting thing I notice when I go onboard ships. I
started out my submarine duty in a 1,500-ton submarine. I hope I
am not boring you because I am trying to give you some concept of
where I get my philosophy in operation.
You could see every system. It was a single-hulled ship. Every
cable, every line was right there in front of you. It was easy to
trace out.
Now you go on a modern submarine, with thousands of things
and you have a vast amount. It gives people a false sense of
security. They think by having more equipment that it is safer. It
is exactly the opposite.
Therefore, the more complex it is the far better trained the
people have to be or they are going to get in trouble.
Do you get the point? This is the fallacy and it comes about from
the press and the science writers. They are always talking about
the wonders of science and new technology, and they don't know
enough to point out the pitfalls.
Therefore, they neglect training because when you read all these
wonderful articles on science, science will save the world, God is no
longer necessary, training is no longer necessary. You get the
point?
Mr. WYDLER. Yes.
Admiral RICKOVER. That is the real lesson I am trying to get
across here today. You have to depend on people. If you have to
depend on people then they must know what they are doing. That
PAGENO="1063"
1059
means training not only once but constantly. That is why people
are required to go to church every week. The ordinary human
being does not remember anything longer than a week. [Laughter.]
Mr. WYDLER. Thank you, Mr. Chairman.
Mr. MCCORMACK. Thank you.
Admiral RICKOVER. That does not necessarily apply to Congress-
men because you people are smarter.
Mr. WYDLER. We have to go more often.
Mr. MCCORMACK. Mrs. Bouquárd.
NUCLEAR POWER AS ENERGY SOURCE
Mrs. BOUQUARD. Thank you very much, Mr. Chairman.
Admiral, it is always a delight when you come before this com-
mi~tee. We appreciate your knowledge, your humor, but one of the
things that I--
Admiral RICKOVER. You like my humor?
Mrs. BOUQUARD. I certainly do.
Admiral RICKOVER. I wish you would put that in the record.
Some people do not.
Mrs. BOUQUARD. We also appreciate the confidence that we feel,
when you come before us, that we have been in good hands with
you as head of our naval nuclear reactor program. I hope that you
will agree with me that, since the Three Mile Island incident, more
and more Americans have come to realize that nuclear power is a
very vital source of energy. Also, that we really have no alterna-
tives, whereas before we have had something. Some people have
been sitting on the fence, one side or the other, but all of a sudden
they have to focus on what it really mean to them? This is some-
thing I have seen happen.
Admiral RICKOVER. Well, I cannot say that you have no alterna-
tive but you must remember you can mine for coal, but that
creates problems, too. That has radioactivity which the amount can
be greater than---
Mrs. BOUQUARD. Yes. Let me preface my remark, we have no
alternative percentage of energy that is produced by--
Admiral RICKOVER. Yes.
Mrs. BOUQUARD. I think that it has in its own way strengthened
our resolve, as a nation, to go forward and build better and safer
nuclear plants, as a result of what has happened. I think that we
once again will reach the place we will solve our problems and we
know that we have one.
TRAINING CONCEPTS
Admiral RICKOVER. I think we can solve the problems.
Mrs. BOUQUARD. Another thing I think we recognize is that we
know a little bit more about the unknown as a result of the Three
Mile Island incident. I was wondering if you feel that we should
perhaps have new training concepts for those who are responsible
for our nuclear-- ~
Admiral RICKOVER. Training of those responsible?
Mrs. BOUQUARD. Those that are responsible for the operation.
Admiral RICKOVER. You mean like the leaders of the utility?
Mrs. BOUQUARD. Yes.
PAGENO="1064"
1060
Admiral RICKOVER. I told you how I did it and I think that same
concept could be used, at least they could get a modicum of under-
standing of what it is they are running and making their money
from.
Now, the problem in the United States, all over, as I see it, is
that many people are in charge of technical organizations that are
only interested in making money. Take conglomerates, where a
man takes over a lot of companies, he is not taking over for other
than to make money. By the way, it's no longer B. & W., it's the
McDermott Co. They own the thing. They should be given all the
credit for it now. That illustrates the point I am making.
Here you had a pretty good company, from our experience. Now
it is taken over by a conglomerate, so, whatever responsiblity they
may have, whatever they may have done now it may never get to
the top people.
COST OF TRAINING
Mrs. BOUQUARD. One final question, sir. What is the average cost
of training a nuclear operator in your Navy nuclear propulsion
program?
Admiral RICKOVER. That is a good question. I think the best way
I can do that first is timewise it is considerable. I will ask Mr.
Wegner. What do you guess it is?
Mr. WEGNER. Well, that question has been asked many times and
the answer depends upon how you count. Do you count the pay; do
you count the recruiting to go out and get the individuals, do you
count all the losses along the way?
Mrs. BOUQUARD. Actual training for their--
Mr. WEGNER. The number to use in an overall sense probably is
around $30,000 to $40,000 as far as the cost to the Government is
concerned.
Admiral RICKOVER. Let me amplify that. We run our prototypes.
If we did not have sailors run them we would have to hire civil-
ians. It would cost a lot more.
Furthermore, we supply a lot of trained people to the nuclear
industry. Dr. Schlesinger at one time when he was chairman of the
Atomic Energy Commission estimated we had actually contributed
somewhere between $2 and $3 billion with our training to the
national economy. So when you start in talking about cost, there
are a lot of ramifications to this thing.
Now, it costs somewhere, it costs over $100,000 for a utility to
train a man. If they can get a man who is fairly well trained by the
Navy, that cost is significantly reduced. So what you are interested
in is the overall economy, and I would say this, that probably we
do not cost anything from that standpoint.
Mrs. BOUQUARD. That is great, I am happy to know we have
something that is not costing us anything, too. I do not say that
lightly.
Admiral RICKOVER. I am not getting paid extra for being here.
Mrs. BOUQUARD. We sure are glad you are here. Thank you very
much.
Thank you, Mr. Chairman.
Mr. MCCORMACK. Mr. Walker.
Mr. WALKER. Thank you, Mr. Chairman.
PAGENO="1065"
1061
LIVING WITH RADIATION
Admiral Rickover, I was fascinated by your story about the
fellow from the Department of Defense who told you, the line when
you were going to decrease the radiation shielding, that people
would have to learn to live with radiation. It fascinated me because
to some extent I get the impression that the commercial industry
in nuclear power is telling us the same thing.
Insofar as the public goes, we hear from them as to a certain
level of radiation that you have to accept as a part of this kind of
generation of power. What I am wondering is, whether or not in
light of your work with ship personnel and so on, whether you
have some feeling for the kinds of risks that nuclear generation
will produce for the public? What is the public going to have to
accept in terms of risks for the receiving of electricity from nuclear
energy?
Admiral RICKOVER. Well, to be quite up to date, I see that the
estimate is that the extra cancer deaths in the paper from Three
Mile Island is perhaps one or two. We have been accused of overra-
diating. People cite the Portsmouth Navy Yard as an example. We
have been made aware of a study where a young doctor attributed
cancer deaths at Portsmouth Navy Yard to radiation. Then we
checked the death statistics and we found out that normally out of
every 10,000 people employed there, there would be 1,600 who will
die of cancer whether there was radiation or not. There might
possibly be 1,601 deaths if each of the 10,000 was exposed to one
rem each. There is some more radiation, but if you take into
account all the other radiation a person gets from natural sources,
and particularly from medical sources, it is very minor.
Mr. WALKER. Do you see as the principal risk then that the
public has to accept with this the radiation possibility and the
possibilty of cancer deaths from that radiation?
Admiral RICKOVER. I think the number of cancer deaths you get
from radiation from the atomic energy is a sort of thing that is
being played around with by a lot of people whQ are making
headlines. I think the amount is so small that it's insignificant.
Mr. WALKER. In your opinion that is not a real risk?
Admiral RICKOVER. No; it could be if you had an accident where
people directly were involved and there would be a few people. But
let's take the injuries and deaths you get in the coal mines. The
other day there was one involving about 20 or 30 people and that is
passed off. Let's take all of the automobile accidents you get. But
this word radiation is one that inspires fear and people are taking
advantage of it.
I think from the standpoint of the energy you get, if we wish to
maintain our present standard of living or increase it, you are
going to get more deaths from many other sources. More people get
X-rays, more get medical treatment, and these are used as diagnos-
tic devices. The amount of radiation you get from nuclear power is
insignificant in comparison. But it's something you can play up
because that is the word, when you go to a doctor or a dentist no
one says, radiation.
You get a chest X-ray or you get a tooth X-ray but when it comes
to nuclear power it's radiation.
PAGENO="1066"
1062
Mr. WALKER. I appreciate your comments and I think they are
very helpful. But we all know and you have said yourself in your
testimony no energy source is risk free.
Admiral RICKOVER. That's right.
Mr. WALKER. Now, I guess my question is what are the risks, if
the radiation risk is not realistic? What are the real risks that
might be associated with the nuclear industry and should we be
looking at them in terms of the safety of the plant?
Admiral RICKOVER. I think you have to be far more careful in
operating a nuclear plant just as much as you had to be more
careful in operating a coal-fired plant than operating a windmill.
It's a difference in degree, but I think if it's properly handled I
don't see where radiation is really the issue. It has been made the
issue, and the plants can be designed properly and operated proper-
ly, and if they are you won't get significant amounts of it.
I have tried to demonstrate that in the naval program. What is
the average level we expose our sailors, people on the ship? It's
mild; a tenth of a rem a year, last year.
Mr. WALKER. So if we contain the radiation problem we really
don't have any additional risk?
Admiral RICKOVER. Yes, and we have a particular problem in the
Navy on that because we have a confined atmosphere, a small
place. We have lots of people and they live right around the reac-
tor, they eat around it and live near it. It's all self-contained, and I
will give you an example how safe it can be.
When an atomic bomb is burst somewhere, say the Chinese
explode one over there and our submarine is in the shipyard and
we can measure the fallout, we can measure the radiation, from
the fallout.
When you go down into the submarine, you cannot detect the
radiation from the fallout. In fact, we have had to require people
not to wear radium dial wristwatches in nuclear submarines be-
cause the radioactivity in them interferes with the readings of the
instruments.
When a man inadvertently brings one on board we seal it up in a
box while the ship is underway. My opinion is that radiation has
now been overplayed by the press, and I think it's time we call a
halt and look at it realistically, and I think this is something this
committee can do.
You have heard many witnesses and you can form your own
opinions, but the attitude I would take on it is many years agO
when we were building our first pressure vessel and the industry
wanted to bolt the pressure vessel I was very much afraid of
radiation and I said, no, we will weld it.
The standard I would have to use is this one:
"Would I want my son to serve on that submarine?" and I would
be perfectly willing to serve on these ships, that is all there is to it.
So when I talk this way I am not talking because I am in nuclear
power. I think I am old enough and have learned enough to take
the same kind of attitude the Members of Congress take, you have
to think about the country and the people and they have been
scared too much.
This is why I keep on getting back at the media. They are doing
a great deal of harm.
PAGENO="1067"
1063
MEDIA IMPACT
Mr. MCCORMACK. I want to thank you for these comments, Admi-
ral Rickover.
I think they are so very important. I think it's important, Con-
gressman Walker has a legitimate concern for his constituents and
their concern about Three Mile Island. This is a very difficult thing
for him to handle because of the emotionalism that has been
generated by the press and media. A great to-do has been made in
the press because the background radiation in that populated area
has been increased by about 1 ~/2 milli-rem total dose.
This is the HEW and NRC figure. In fact, the background in the
area is 100 times as great every year. If we assume, for instance,
there is one additional cancer death in that area sometime from
that incident then we have to assume that there are 100 times
that, the 100 cancer deaths every year in that area from normal
background. The same thing applies to normal radiation back-
ground across the country.
The entire nuclear industry combined is only one part in 6,000 of
the normal background that we get from the cosmic radiation,
from the sky and normal background, from the soil and all other
sources other than the nuclear industry. Consequently, the poten-
tial for a cancer death from other than nuclear energy causes is
6,000 times greater than from nuclear energy, just from the radi-
ation, to say nothing of all of the other causes like cigarette smok-
ing.
Admiral RICKOVER. You have the combination of two words, radi-
ation and energy. These are very fearsome words so you combine
those two and you have something.
Now, people want all of the advantages they get from modern
technology; they don't see how much better off they are than their
forefathers; they live longer and they live healthier lives and more
productive lives, but they want to pick out one thing, and that is, I
keep on harping back to the responsibility of the press.
They are creating this. From a factual standpoint, the people
who get cancer or are otherwise hurt by radiation are a very small
number compared to the benefits you get from it.
Now, that is what I said at the beginning. It's a political decision.
It's your committee and Congress who have to decide. You get
cancer deaths from all kinds of things. You ought to eliminate all
kinds of things, and pretty soon the only man who won't get cancer
is the guy who stays in a nonradioactive cave and never gets out of
it all of his life.
Mr. MCCORMACK. Or never eats.
Mr. AMBRO. Would the gentleman yield on just that point?
Mr. MCCORMACK. Certainly.
PUBLIC ISSUE
Mr. AMBRO. I hate to take issue with you, Admiral Rickover, but
radiation is not the issue by itself. In my opinion, whether it's
press-generated, moving picture generated or just an attitude as
the result of sensational reading matter, the threat of huge
amounts of radiation carried by, let's say radioactive steam, as a
result of, if there is such a thing, a meltdown or an explosion, that
PAGENO="1068"
1064
is what is in the minds of the public, in the public perception, and
that is where the difficulty comes, not the radiation that one might
be subjected to when a plant is in operation and functioning safely.
It's the unsafe aspects of it that you very well have dealt with in
your testimony to assure safety. But the other part of it is that if
we have an incident that comes to a catastrophe, tens of thousands
and millions of people will be affected. That is what is in the public
perception, not the radiation that one is subjected to when you
walk in the gate.
Admiral RICKOVER. I don't know how to discuss this from a
philosophical standpoint or intellectual standpoint. You made the
statements of tens of thousands or millions of people.
Now, how do I answer a question like that? That is a figment of
your mind.
I cannot answer every question that anyone asks, but so far
there has been no evidence of this thing.
Mr. AMBRO. Let's say it's a political question. That's the politics
or the essence of the political question that we must deal with. The
public perception with respect to this kind of accident, that is what
we are talking about.
Admiral RICKOVER. Well, Mr. Leighton came up and whispered
the thing you have to have is to operate them safely and you can
make them operate safely. Therefore, it seems to me, and I under-
stand this to be the position of the Chairman, you want to find out
what can be done to make them operate safely. Is that correct, sir?
Mr. MCCORMACK. That is correct, Admiral.
Admiral RICKOVER. That is what you have to do.
Mr. MCCORMACK. And we believe it can be done.
Admiral RICKOVER. I don't know where you come from, but I can
see where there could be some chemical factory in your district
that does not operate safely and there are analogous things that
can happen there, too.
Mr. MCCORMACK. Let's go to Mr. Ertel of Pennsylvania.
UTILITY TRAINING
Mr. ERTEL. Thank you, Mr. Chairman.
Admiral, I have a couple of questions.
I was curious about your statement that we ought to have the
utilities get together and set up a training program. Then you also
indicated that most of the people in charge of the utilities are
interested in the bottom line or the manufacturers, I guess.
For instance, McDermott took over Babcock and Wilcox and they
are interested in the bottom line. They are a conglomerate. Do
these not fly in the face of each other, going to set up an expensive
training facility themselves without Government intervention and
requiring them to do so?
Will they do that if they are interested in the bottom line,
expecially when all utilities don't have nuclear powerplants.
Admiral RICKOVER. Yes, sir; they will, if this committee comes
out with a report they have to.
Mr. ERTEL. In other words, we have to legislate them to do so?
Admiral RICKOVER. No; it affects their bottom line. They have a
large investment in nuclear power and presumably they are going
to have even a much larger investment. If they realize that in
PAGENO="1069"
1065
order to run these plants they have to operate them safely, and the
amount of money they have to spend for training is minimal com-
pared to the cost of the electric power, they will do it. They have
not been educated properly.
Mr. ERTEL. Well, it's taking a long time to educate them proper-
ly, to doing it safely. and we have not encountered that. Obviously,
your program is a lot superior to the civilian training programs; do
you not agree?
Admiral RICKOVER. I cannot talk about superiority. I don't want
to get into that. I have done what I felt was necessary to conduct a
safe program for the Navy. It's easy for me to take off at any one
who does not do things the way I do, but I cannot do that because I
am not in their shoes.
Mr. ERTEL. I want to interrupt you, Admiral. Do yOu think you
have the best program in the Nation or in the world?
Admiral RICKOVER. I don't know about the rest of the world. I
think I have a pretty good program. I am doing the best I can with
my knowledge. That's all I can say. I think my program can be
improved.
Mr. ERTEL. Do you think you are better than-I am sure you are
familiar with the utilities' training programs-do you think your
program is better?
Admiral RICKOVER. Yes; I think it's better.
Mr. ERTEL. In other words, they could use your program as at
least an example and they could improve on your program maybe.
Admiral RIcK0vER. Sure, but nothing has ever stopped them
from doing it up to now.
Mr. ERTEL. They have not, have they?
RECOMMENDATIONS ON ATOMIC POWERPLANTS
Admiral RICKOVER~ Apparently not. But nothing has stopped
them.
I will tell you what happened in 1966; I was in Greece and I
knew the King and the Queen. The Queen told me, it was Queen
Frederika, they were intending to build atomic powerplants, so
they asked my advice on how to go about it. When I got back to the
United States I sent her some advice and I will read you off some
of the things I told her: May I read it, Mr. Chairman?
Here's the answer: "In purchasing a central station nuclear
powerplant consideration should be given to the following sugges-
tions: "Have one company, the seller", I call him the seller, "re-
sponsible for design, construction and test of the entire plant so
that the purchaser does not have to coordinate technical schedule
and cost items among several organizations." You get that point,
the several organizations.
"Require the seller to guarantee the following, that the plant
will perform reliably." We don't do any of these things. "Specifical-
ly, it should be available for unrestricted full power operation at
least 95 percent of the time for at least 2 years after initial full
power operation and completion of the testing program agreed to
by the seller and the purchaser.
"Minimum power and energy outputs;" specify that; "Satisfac-
tory equipment performance"; this is a guarantee now by whatever
company is supplying it "for a period of at least 1 year after initial
PAGENO="1070"
1066
full power operation of the plant and completion of the testing
program agreed to by the seller and purchaser."
I am trying to answer your question here.
"Design and construction; require that all aspects of the job,
including the design, manufacture, construction and test be subject
to the purchaser's approval."
That is the power company. They don't do that.
"And that the purchaser's representatives have full and free
access to all plans and* reports and to all factories in which equip-
ment or parts for the plant are manufactured."
I am describing the naval program here; that is what I am really
doing.
"Require that the standards to be used in all aspects of the job
design, materials, fabrication, and so on, are defined by the seller
in writing before placing the order." That requires them to have
knowledgeable people before they decide to buy a powerplant.
"All deviations from these standards should be documented and
approved by purchaser. The purchaser should retain an independ-
ent organization to check and audit all phases of design and con-
struction. This organization should, for example, review design cal-
culations and verify nondestructive tests for conformance to stand-
ards." I will put, with the permission of the Chairman, I will put
this document in the record.
Mr. MCCORMACK. Without objection, we will insert the entire
document in the record.
[The document follows:]
In purchasing a central station nuclear power plant consideration should be given
to the following suggestions:
GENERAL
1. Have one company (the "seller") responsible for design, construction and test of
the entire plant so that the "purchaser" does not have to coordinate technical,
schedule and cost items among several organizations.
2. Require the "seller" to guarantee:
a. That the plant will perform reliably. Specifically, it should be available for
unrestricted full power operation at least 95 percent of the time for at least two years
after the initial full power operation and completion of the test program agreed to
by the "seller" and "purchaser".
b. Minimum power and energy outputs.
c. That the fuel elements will perform satisfactorily throughout the full life of the
reactor core.
d. Satisfactory equipment performance for a period of at least one year after
initial full power operation of the plant and completion of the test program agreed
to by the "seller" and "purchaser".
DE5IGN AND CONSTRUCTION
1. Require that all aspects of the job including the design, manufacture, construc-
tion and test be subject to the "purchaser's" approval and that the "Purchaser's"
representatives have full and free access to all plans and reports and to all factories
in which equipment or parts for the plant are manufactured.
2. Require that the standards to be used in all aspects of the job (design, materi-
als, fabrication, etc.) are defined by the "seller" in writing before placing the order.
All deviations from these standards should be documented and approved by the
"purchaser".
3. The "purchaser" should retain an independent organization to check and audit
all phases of design and construction. This organization should, for example, review
design calculations and verify non-destructive tests for conformance to standards.
4. The "purchaser" should perform audits of manufacturing and construction
operations. The right to do this should be specified in the contract and required to
be included in all subcontracts.
PAGENO="1071"
1067
5. Require that detailed written procedures be provided by the "seller" for instal-
lation, operation and maintenance of all equipment and that these procedures be
verified by use during plant construction and testing and corrected as necessary.
6. Require that detailed written procedures be provided by the "seller" for all
aspects of plant operation. These procedures should be verified by the "seller"
during the plant test program and corrected as necessary.
7. Require that technical manuals be provided by the "seller" for all equipment
and for the plant. These manuals should describe the equipment, discuss its func-
tion, performance and limits, and provide the basis for these limits.
8. Require that all equipment and operations required to replace nuclear fuel be
checked out by the "seller" before the plant is radioactive.
9. Require the "seller" to provide a complete set of plans showing the equipment
and plant as actually delivered, i.e., including all changes made during fabrication,
installation and test.
10. The "seller" should have full time representatives at the plant during con-
struction and test.
11. The "purchaser" should have full time representative at the plant site during
construction and test. These representatives should have authority to stop the work
if there is reason to believe it is not in accordance with all approved requirements.
12. The plant and equipment should be designed and constructed in accordance
with the latest safety requirements of the "seller's" country in addition to any
safety requirements specified by the "purchaser".
13. Adequate spare equipment and parts should be provided by the "seller". The
number and type to be provided should be approved by the "purchaser".
14. Sufficient information should be provided by the "seller" to permit the "pur-
chaser" to procure additional equipment and parts.
OPERATION
1. All plant operations including tests, normal operation refueling and mainte-
nance should be carried out in strict compliance with detailed written procedures
provided by the "seller" and approved by the "purchaser".
2. Detailed records should be kept of all changes to the plant or machinery and
the drawings and manuals should be modified to show the current situation.
3. All difficulties or unusual situations encountered should be documented and
the disposition (i.e., changes in design or operating procedures) approved by the
"purchaser"and "seller".
4. Formal qualification should be required for all plant operators. This should
include written and oral examinations and periodic re-examinations.
5. The "purchaser" should have full time qualified representatives at the plant at
all times with the authority to stop operations if there is reason to believe they are
unsafe or not in accordance with all approved requirements.
Admiral RICKOVER. "The `purchaser' should perform audits of
manufacturing and construction operations. The right to do this
should be specified in the contract and required to be included in
all subcontracts."
I am probably giving you one of the most valuable parts of this
testimony right here:
Require the detailed procedures be provided by the seller for installation, oper-
ation, and maintenance of all equipment and that these procedures be verified by
use during plant construction and testing and corrected as necessary.
I am really reading the charter you can come up with on this
committee right here.
Require that the detailed written procedures be provided by the "seller" for all
aspects of plant operation. These procedures should be verified by the "seller"
during the plant test program and corrected as necessary.
Require that the technical manuals be provided by the "seller" for all equipment
and for the plant. These manuals should describe the equipment, discuss its func-
tion, performance, limits, and provide the basis for these limits.
Require that all equipment and operations required to replace nuclear fuel be
checked out by the "seller" before the plant becomes radioactive.
Require the "seller" to provide a complete set of plans showing the equipment
and plant as actually delivered that is including all changes made during fabrica-
tion, installation and tests.
PAGENO="1072"
1068~
The "seller" should have full time representatives at the plant during construc-
tion and testing.
The "purchaser" should have full time representatives at the plant site during
construction and testing. These representatives should have authority to stop the
work if there is reason to believe it is not in accordance with all approved require-
ments.
The plant and equipment should be designed and constructed in accordance with
the latest safety requirements of the "seller's" country in addition to any safety
requirements specified by the "purchaser".
Adequate spare equipment and parts should be provided by the "seller". The
number and type to be provided should be approved by the purchaser.
Sufficient information should be provided by the "seller" to permit the "purchas-
er" to procure additional equipment and parts.
All plant operations, including tests, normal operation refueling and maintenance
should be carried out in strict compliance with detailed written procedures provided
by the "seller" and approved by the "purchaser".
Detailed records should be kept of all changes to the plant or machinery and the
drawings and manuals should be modified to show the current situation.
All difficulties or unusual situations encountered should be documented and the
disposition (i.e., changes in design or operating procedure) approved by the "pur-
chaser" and "seller".
Formal qualification should be required for all plant operators. This should in-
clude written and oral examinations and periodic reexaminations.
The "purchaser" should have full time qualified representatives at the plant at all
times with the authority to stop operations if there is reason to believe they are
unsafe or not in accordance with all approved requirements.
Now, you see, this is 1966, but this is what I have been using
since the late 1940's. Now, as you may know, I am responsible for
Shippingport, which is the only central station I am responsible
for, and I have one of my representatives in the control room,
present at all times that plant is operating, with authority to shut
the plant down if he believes they are operating the plant unsafely.
If he points to anything and they don't do it, he orders the plant
shut down and we have had to do that twice.
Now, does that answer your question?
You are not satisfied? I think what you want is some way to
guarantee there will be no radiation.
HOW TO GET THE BEST TRAINING PROGRAM
Mr. ERTEL. No, Admiral; I am not indicating that at all. I am
trying to establish a training program for operators, and how we go
about getting the best one.
I happen to agree with you, you have the best in the Nation, and
maybe in the world. I think that is a good prototype that we ought
to go after and to try and emulate and improve on, and you don't
seem to want to agree with me on that.
Admiral RICKOVER. No; I am sorry; I didn't understand your
question. 1 think the big thrust of my statement was training. I
thought you gathered that, Mr. Chairman.
Mr. ERTEL. I am sorry, but you went further and said now the
utilities ought to do this training program, but then you came back
and said the utilities or the people who really run the companies
are only interested in the bottom line. I suggest to you the Govern-
ment ii going to have to have a role in guaranteeing the training
program, that we have a very substantial stake in it.
Admiral RICKOVER. That is right, but it's not up to the Govern-
ment to actually train these people. Now we are getting on
common ground. I say the Government should see to it that they do
PAGENO="1073"
1069
this, but not have the Government responsible for doing the job and
training all of these people.
That is what I am saying.
Mr. ERTEL. I guess you agree with the amendment I put on the
DOE authorization act which basically mandates that DOE look at
your program and tell the industry, come on fellows, let's get with
it, and let's do like Admiral Rickover does, or a little bit better.
Admiral RICKOVER. The industry knows what we do because most
of their operators come from the Navy. But that does not answer it
either, because having unsupervised people won't do the job. You
have got to have the top people who have to know what it is they
are operating and what the dangers are. That's the point I am
making.
Mr. ERTEL. Well, I think that's true, and I think if the man is
ruining that operation then the company ought to know, if he is a
nuclear operator, what is going on. I would agree 100 percent. But I
would suggest to you we can't put Admiral Rickover over in every
nuclear powerplant. Therefore, we have to train the supervisors in
that powerplant to have as much experience as does your watch
officer in the Navy on duty when you are the captain.
Admiral RICKOVER. Well, I think we really agree, but I would
suggest you have the Nuclear Regulatory Commission be responsi-
ble instead of the Department of Energy. They are outside of the.
Department of Energy. They are deliberately set up as an inde-
pendent organization because then you would have an in-house
capability.
Mr. ERTEL. I just wondered, Admiral, who was in charge of your
nuclear reactor safety program ultimately within the civilian struc-
ture, DOE?
Admiral RIcK0vER. The Nuclear Regulatory Commission.
Mr. ERTEL. Do you report to DOE?
Admiral RICKOVER. I report to DOE, yes.
Mr. ERTEL. That's what I thought.
Admiral RICKOVER. I thought you were referring to civilian
plants, with them it's the Nuclear Regulatory Commission.
Mr. ERTEL. Maybe we can go to another question.
Admiral RICKOVER. Have I answered your question?
SIMULATORS OR PROTOTYPES
Mr. ERTEL. Well, I think we have gotten the same answer by
circuitous routes, and we have both come from different ways, but I
think we have agreed generally. Yes, I think you have answered
my question.
I have heard you testify here that you used prototypes in your
training program and run people through on prototypes. What is
your analysis, can you give me a comparison between a simulator
and prototype in operator training and which do you think is the
most viable system?
Admiral RICKOVER. The practice I have used is not using simula-
tors. I can understand there are some phases of things, some cer-
tain exotic accidents that you can simulate that you might want to
use a simulator. I have from the beginning been opposed to simula-
tors for training because the problem is if you have a simulator
and you make a mistake all you have to do is put the switch back.
48-721 0 - 79 - 68
PAGENO="1074"
1070
Actually, the way we train we have actual casualty conditions
and the man has to work his way put of them on a real, honest-to-
God plant. That might take 1 or 2 hours, and he has to know the
theory in the plant. We train our people in theory because you can
never postulate every accident that might happen.
Therefore, the only real safety you have is each operator having
a theoretical and practical knowledge of the plant so he can react
in any emergency. That is what we have found.
PERSONNEL SCREENING
Mr. ERTEL. One last question, if I may.
I am wondering in your selection process, and .1 am interested in
your training program, do you use a psychological screening as
well as an educational or intellectual training program?
Admiral RICKOVER. Psychological?
Mr. ERTEL. Yes.
Admiral RICKOVER. What is that?
Mr. ERTEL. Well, I suppose it means is a man equipped to handle
emergencies; does he have the proper makeup, the ability to handle
emergencies. There are certain psychological factors we find with
policemen, for instance; they may have a very low tolerance of
aggravation and, therefore, they react unreasonably.
Admiral RICKOVER. The reason I. don't believe in a psychological
approach is because I once took a graduate course in psychology
and I learned the pitfalls.
When I saw the professor who was teaching it I swore off psy-
chology. Now here's what we do for officers.
Mr. ERTEL. Maybe we are not worried about that particular
professor.
Admiral RICKOVER. I will tell you how I do it so you will know.
Any officer that aspires to get in this program is interviewed in
my headquarters office by three separate individuals. Then I inter-
view him and I make the final decision. I judge the man all
around.
For example, the other day I did something I never have done
before. There was a member of a minority who had a SAT score of
800. Mind you, they wouldn't take him in the Naval Academy even
if he had a score of 1,200, and there is a geometrical difference. But
I sized up this man, he had been deprived and had not had enough
adequate education that it would appear he could make it. So I
used judgment, and accepted him. On the other hand when I see
some lad who 1 tKs like he is queasy and might succumb, and this
is judged by the other people too, I will not take him in the
program.
But then with that rigid screening we get about 20 percent of
those I select who will not make the final year's training. We have
an attrition rate of about 20 percent. Sailors are selected with
special requirements by the recruiters. They come to our schools
and your attrition rate there is about 20 percent.
But I can use my own psychology. You can very quickly in
ordinary circumstances tell by the way he talks, and acts, and I
worry about that because I don't like to turn a man down. So I will
have him interviewed perhaps by two oth~i people, and there will
PAGENO="1075"
1071
be a total of six interviews to make sure-we don't like to turn
them down.
Some people it's very obvious they ara not the type who should
be admitted anywhere near atomic power. That is a matter of
judgment. But I don't see how you can define it with any rules or
any classical psychology rules. I am leery as hell about these
psychologists.
Mr. ERTEL. Well, I guess maybe a lot of people are leery about
psychologists, I guess, having tried a lot of cases with a lot of
psychologists involved. But the point being you want somebody who
has the capability psychologically to cope with an emergency. Some
people can't, and that is what you are doing, only you are calling it
a different name.
Admiral RICKOVER. Well, I have to judge from my experience and
then when he goes through our practical training for 6 months he
has to operate plants and react and if he cannot no matter how
smart he is, we get rid of him. So we have practical psychology.
Mr. ERTEL. Thank you very much, Admiral.
Mr. MCCORMACK. With that we will take a recess while we go to
vote and come right back.
Admiral RICKOVER. It is more effective psychological than theo-
retical; we get rid of the man. The psychologist tries to cure him.
Mr. MCCORMACK. May we take about a 7-minute recess and then
we will come back.
[A short recess was taken.]
Mr. MCCORMACK. We will reconvene our hearing. I would like to
ask Congressman Anthony if he has any questions?
HYDROGEN EXPLOSION
Mr. ANTHONY. Thank you, Mr. Chairman.
Admiral Rickover, we have discussed press and press coverage
and the bias that it does sometimes create in the public perception.
During the press coverage on Three Mile Island there was great
coverage given to the possibility of a hydrogen explosion. I would
like to know if you ever considered that such an explosion was a
credible threat?
Admiral RICKOVER. I have considered it, sir, I don't think that
was a credible threat. I can see where you can have a lot of
radioactivity possibly come out. A reactor is not like a bomb. A
bomb is designed to explode. A reactor is not. You are talking
about a hydrogen explosion?
Mr. ANTHONY. This would be the hydrogen explosion because of
the buildup of the hydrogen with the possibility that it may mix
with oxygen as it would rise to the top.
Admiral RICKOVER. Well, we have never considered, certainly
have not considered it to be likely. My experts tell me under the
proper circumstances you could get-we don't know enough about
the Three Mile Island, I said at the beginning about that particular
plant, to talk about it.
Mr. ANTHONY. Going back to your own personal operation, what
has been the naval experience with a hydrogen bubble that would
create the possibility of a hydrogen gas explosion?
Admiral RICKOVER. We have never had anything like it. The next
question would be what if we did? That is a good question. I can
PAGENO="1076"
1072
anticipate that but our system is such that the hydrogen would not
have formed. That is the way we operate.
Mr. ANTHONY. You feel that your safety and your training would
have been such that you would not have had the water contamina-
tion that apparently is existing at Three Mile Island?
Admiral RICKOVER. Yes, sir; I do firmly feel that. Again, it gets
back to the kind of training you have that you have to depend on
the knowledge, and we talked about water in the reactor and I
mentioned we have two instruments, one is temperature and one is
pressure, which gives us an indication of what is going on. That is
what we use, and a man has to understand what is happening all
the time.
PLANT DESIGN
Mr. ANTHONY. The two followup questions I had to that was,
what is the Navy experience with water level indicators, which
seems to be one of the causes of the manmade errors?
Admiral RICKOVER. We have had occasional trouble with it but
our steam generators were designed to take care of it. There was a
difference. There is a difference in the design of the steam gener-
ators in the Three Mile plant than ours. They only had a very
small amount of time, about 30 seconds, ours we would have min-
utes to act on that rather than a few seconds.
Mr. ANTHONY. A followup question to that.
Based on the time frame and the design of instrumentation of
the naval-operated plant versus the civilian~~operated plant, would
you suggest any drastic engineering changes in the civilian reac-
tors and, if so, what would they be?
Admiral RICKOVER. You are now asking me a question which I
would like to stay out of because it starts in making me an expert
on civilian plants.
The type of design they have I am not familiar with, and I would
like to stay out of that. I think there will certainly be reports and
lessons to come out of the Three Mile thing and I believe that, in
fact, I know they are considering this very issue.
Mr. ANTHONY. Going on to the area of responsibility of NRC, as I
understand it from your testimony, on page 16, NRC does review
the design of the naval plant.
Admiral RICKOVER. Yes, sir.
Mr. ANTHONY. They issue some type of authorization or permit
based on their approval of the design?
Admiral RICKOVER. Yes, sir. They issue a formal report not actu-
ally a permit or a license.
Mr. ANTHONY. What has been your experience with the NRC in
reviewing the extensive training programs that you have indicated
by your testimony that you have instituted in the naval program
and do they monitor it on a continuing basis?
Admiral RICKOVER. Well, the NRC conducts reviews, they do not
monitor on a continuous basis.
Mr. ANTHONY. So NRC does not monitor your training program
on a continual basis, so it is really left up to you--
Admiral RICKOVER. They pretty well know, they are quite famil-
iar with our training program and they know over a period of
years how we operate and we certainly need no urging to continue
this.
PAGENO="1077"
1073
TRAINING INPUT
Mr. ANTHONY. Well, knowing that the whole purpose of the
hearing before this Subcommittee on Energy Research and Produc-
tion, the whole idea and issue being the perspectives on nuclear
powerplant safety, knowing that this is a great concern to the
American public, be it through an inflammatory press, or be it
through their own perceptions, he they real or be they false, I
would like to know more positively how you feel the Navy could or
would be willing to participate in a program to support a selection
and training program for the operation of the personnel of civilian
nuclear powerplants or whether or not you think the Navy should
even participate whatsoever?
Admiral RICKOVER. I think the extent of the Navy participation
would be to give information to the civilian industry, if they care to
have it. They know what we do anyway because many of their
people have come out of the naval program. So there is no secret
about it.
Mr. ANTHONY. That also brings, I think, a very strong followup
question, one that I heard back in my district prior to attending
these hearings. The question is that in view of the fact that many
of the plant operators are Navy trained, what do you think about
the responsibility of the Three Mile Island plant operators?
Admiral RICKOVER. Well, you can't blame individuals. We use a
different system. We have constant retraining. We also have people
in charge who are specially trained. We have an officer in charge
of the watch and we do a lot of inspections. For example, when a
ship is in port I have my own representatives who are stationed at
that place go around at various times of the night, and day to see
how they even stand watches on a shutdown plant and report to
me.
We find things that are wrong. We find them all the time. But
we take action. We try to improve it. But we know.
Mr. ANTHONY. Would you--
Admiral RICKOVER. The basic question you asked me whether I
would be willing to participate. I don't have the people or the time
and I have my own responsibility, a great many responsibilities. I
am willing to let them see what we do at any time. I don't know
what more I can do than that. I cannot become responsible for
their training.
Mr. MCCORMACK. We have to cut off your questions at this point.
Mr. ANTHONY. Thank you very much.
Mr. MCCORMACK. We have to move along. Mr. Ambro.
Mr. AMBRO. Thank you, Mr. Chairman. Admiral Rickover, I want
to say at the outset that I am a fan, I think without your pioneer-
ing and foresight the kind of deterrent that this Nation has would
never be in place. I must tell you the American people owe you a
tremendous debt. You are one of the great treasures and resources
of this country.
I do not know if you like to be characterized that way, but indeed
I think you are.
Admiral RICKOVER. That is what my wife thinks, too. [Laughter.]
Mr. AMBRO. How long ago?
Admiral RICKOVER. Recently.
PAGENO="1078"
1074
APPROACH TO NAVY TRAINING
Mr. AMBRO. You said that in your training program YOU not only
provide your people with land-based prototype training, but then
give them shipboard or onboard training as well. You teach them
the operations and the functions of all of the equipment, and you
tell them as well what the dangers are. What are the dangers?
Admiral RICKOVER. Well, the dangers are anything that might
happen and the plant shuts down, equipment goes out of order,
how it would affect the plant. Now our system of training is such
that for every trainee, each one of them has an experienced man
with him. It is a very expensive and difficult system. A man, he is
not just off there by himself, he is always training with some
person right at his elbow, guiding him. So he learns what might
happen. We don't do anything, we can't train them if a shell hits
the plant and blows it up, we cannot tell him what to do because
he wouldn't be there to do it.
NAVAL PLANT DESIGN
Mr. AMBRO. OK.
You said the American people are inflamed by two words, radio-
activity and cancer. That may be, and I am sure that the two are
juxtaposed in people's minds. What about the word "meltdown"; is
there such a thing? Can it happen, aside from computer simula-
tions?
Admiral RICKOVER. It could happen but our plants, the plants
that I am responsible for are so designed there is much more time
to take action. We have never `experienced anything of the sort. We
also have emergency sytems for taking care of that situation. Also,
we have an emergency system and the ordinary system. If it
doesn't work, the emergency system goes into effect.
Mr. AMBRO. Do you feel comfortable about commenting as to
whether or not a commercial plant could experience meltdown?
Admiral RICKOVER. No, sir. As you can gather, I have tried to
avoid making judgments on commercial plants. I am not entirely
familiar with their problems. I do think they might be able to
learn from some of the things we do and we can learn something
from Three Mile Island, too. I am not saying we cannot learn any
lessons and we will, and if we find things we should do we will do
it, and no doubt we will. But they can also learn from what we do
and I have made some suggestions here which they in my opinion
can adopt in order to have a more reliable system in a commercial
plant.
USE OF COMPUTERS
Mr. AMBRO. We had testimony before the full committee from
Dr. Teller and his entourage about a variety of things with respect
to this accident and nuclear power in general. They said, of course,
we could build better reactors, we could build into them a redun-
dant sytem, we could do better with respect to training. What else
they said was that we could use sophisticated computers to scale
down the information that was being provided at the plants, in
order to provide operators of plants with more simple but more
effective kinds of information to quickly take action in the event of
an incident.
PAGENO="1079"
1075
Do you agree with the use of computers, let's say?
Admiral RICKOVER. You know, one of the things that was said
here was that they even painted the dial wrong on the real instru-
ments. When you start in depending too much on computers,
maybe a fuse blows out. Furthermore, this is my opinion-and Dr.
Teller and entourage are experienced people, and I do not want to
take issue with them, they have had more experience with weap-
ons than they have with reactors. But I am deadly afraid of having
some computer relied on to give the answer to a real generating
problem. I would feel very, very uncomfortable with that because
the man is going to start depending on that machine rather than
on his own judgment and his own knowledge. That is what worries
me. Throughout this presentation I have stressed the importance of
people. I am deadly afraid of all these gadgets, and insofar as I
have been able to, I have kept that out of our system.
Mr. AMBRO. Well, you see this kind of a time constraint makes it
difficult to explore some of the things that one has to do, especial-
ly, for example, the fragmentation of the private sector process vis-
a-vis what you do and how the military handles it.
But I do want to get to just one specific and last question. Do you
have experience with B. & W. in your program?
Admiral RICKOVER. They manufacture various types of equip-
ment. Of course whether it's B. & W. or any other outfit, we, in my
organization at headquarters are responsible for the design. The
man who manufactures it is not and B. & W. has done a good job
in the manufacture of things, but the design is my responsibility,
the inspection is my responsibility and the installation is my re-
sponsibility. So B. & W. just does what we approve. I do not believe
that is the case in the civilian industry. This is the point I made in
the letter I sent to the Queen of Greece about how to approach
obtaining reactors. That is the difference.
Mr. AMBRO. Well, of course, in terms of the fragmentation in the
private sector, why that is indeed the difference and it is very
difficult for us to deal with here. We may have to have a series of
communications from this committee to Admiral Rickover so that
we can get a better handle on how to reconcile those differences.
We must not only assure policing by the private sector, but over-
view from the governments and the kind of specifications that we
should have had, modular interests for incorporation in all reactors
in the United States. You can see the complexity of that kind of
problem as opposed to the way you are able through your office
and your authority to deal with it.
Admiral RICKOVER. They can set up, they can have an analogous
system if they care to. Why not?
Mr. MCCORMACK. Admiral Rickover, would you be willing to
answer some questions presented to you in writing subsequently by
the staff?
Admiral RICKOVER. I would be very happy to.
CONCLUSION
Mr. MCCORMACK. We promised to be out of this room at 2 o'clock
and it is now 1 minute after 2. There is another meeting scheduled.
We are going to be forced to adjourn even though we would like to
go on. I want to thank you, Admiral Rickover, and your staff for
PAGENO="1080"
1076
the extraordinarily valuable presentation you have presented to us
today and the information you have provided. I can assure you that
your testimony is going to have an impact on this committee, on
this Congress, and I believe on the nuclear industry, and it is going
to be an impact for good and I appreciate what you have done.
I want to say in general that I think these hearings have been
good hearings, the witnesses have been outstanding, the whole idea
of hearings has been to collect relevant information, to get true
facts, and to try. to exercise commonsense with respect to all the
questions associated with nuclear energy and nuclear safety. To the
extent that we have succeeded, I think we will make a contribution
and I want to thank Drs. Tirén, Larsson, Low, and you, Admiral
Rickover, for your contribution today, and again our appreciation
for all the time you have put in, and our congratulations on the
wonderful program you have established and we will be looking
forward to working with you in the future.
Admiral RICKOVER. I would like to thank you and the members
of your committee for the cogent questions you asked, for your
obvious knowledge and understanding of the problems, and the
way you handled this thing. I think you will get something out of it
because you elicit confidence, you and your members, in the
manner of your questioning. Some of the questions I perhaps have
not understood thoroughly, but I think I have performed some
service in answer to what you have sought, so I give you the full
credit.
Mr. MCCORMACK. Thank you very much.
Admiral RICKOVER. Of course if it does not work it is your fault.
[Laughter.]
Mr. MCCORMACK. Thank you very much, Admiral.
[The information follows:]
CLOSING REMARKS OF HON. MIKE MCCORMACK, CHAIRMAN, SUBCOMMITTEE ON
ENERGY RESEARCH AND PRODUCTION
I would like to thank all of the witnesses for coming and for presenting their
views on nuclear power plant safety to our Subcommittee. Certainly, obtaining the
most accurate information on this subject is of great importance to our country.
These three days of hearings have been very worthwhile to us all. We have
obtained rather different views on each of the three days, both on the general
approach to nuclear safety and on the significance of the accident at Three Mile
Island. The first day provided details of the philosophy and technology of nuclear
power plant safety systems, and showed that there are a number of ways in which
present safety equipment and procedures can be improved.
The second day of the hearings, which emphasized the Three Mile Island accident,
gave us valuable insight to the operations of the Three Mile Island plant both
during and immediately after the event. It demonstrated the part that plant design,
equipment performance and operator action played in the accident, and especially
highlighted the need for operators to be able to take prompt and effective action.
Today, we heard from witnesses outside the commercial U.S. reactor industry.
The Subcommittee was particularly pleased to have the benefit of the Swedish views
on licensing and safety, and I wish to especially thank Dr. Tirén for coming from
Sweden for these hearings. Today's session was particularly valuable in putting the
preceding sessions in perspective, and in laying the groundwork for further action
by the Subcommittee.
The hearings have shown that despite the extensive efforts to date, there are
several areas in which the safety of nuclear power plants can be improved. These
range from the training and selection of operators, to the need for more stringent
operating procedures, and to the obvious need for improvements in the man-ma-
chine interface. Clearly, adequate funds must be made available to implement these
improvements. This is important because it will allow us to move ahead with
confidence to build the nuclear power plants which we must have to reduce our
PAGENO="1081"
1077
dependence on imported energy. At the same time, the hearings have shown that
reactor safety systems do work, and that despite the serious nature of the accident
that occurred, no fatalities resulted. The record of the civilian nuclear power indus-
try remains intact in this regard.
We thank the participants for their work and their fine presentations. We thank
you all for your attention. The Subcommittee will continue to be receptive to
suggestions and help in this important area. The record of these hearings shall be
open for some time, so that anyone wishing to submit a statement or material for
the record may do so.
Again, my thanks to all involved. This hearing is adjourned.
Mr. MCCORMACK. The meeting stands adjourned.
[Whereupon, at 2:03 p.m., the subcommittee adjourned.]
PAGENO="1082"
1078
APPENDIX I
ADDITIONAL MATERIAL FOR THE RECORD
SWEDISH EMBASSY ADDRESS ~I~~4~REAVE,N
OFFICE OF SCIENCE AND TECHNOLOGY TELEPHONE
June 15, 1979
~
Congressman Mike NcCorrrtack
Chairman, Subcommittee on Energy
Research and Production
Committee on Science and Technology
U.S. House of Representatives
Suite 2321
Rayburn House Office Building
Washington, D.C. 20515
Dear Congressman McCormack: TJ-9172
It was an honour for Dr. Tir~n and myself to appear before
your subcommittee on April 24, on your hearings about
Nuclear Reactor Safety.
Dr. Tirén has asked me to transmit the attached supplemen-
tary responses to questions raised by members of your
subcommittee. These clarifications may, if you so wish
be included for the record into the testimony.
Sincerely yours,
CL~
Lars G Larsson
Attaché
Science and Technology
LGL/ms
end.
PAGENO="1083"
1079
Re Testimony before US House of Representatives, Committee
on Science and Technology, Subcommittee on Ener~y Researq~
and Production, May 24, 1979 by Dr. Ingmar Tirdn,
AB ASEA-ATOM, Sweden
In response to questions during the testimony, please
supplement Dr. Tirdn's verbal presentation by the following
comments.
~p~ly to Congressman Wydler on question regarding the use
of check lists in Swedish nuclear plant operation:
Swedish utility representative confirms that no formal
check list is used at dayly take-over from one shift to
another. The shift engineer keeps record of notable items.
He passes on this information to the next shift together
with an oral and informal exchange of information. The
list of notable items is kept up to date by the shift
engineer in charge.
to Congressman Ertel on question regarding the
possibility of a release of contaminated water from the
reactor containment to an auxiliary building in Swedish
p~lants, assuming accident conditions similar to those
that occured in TMI unit No.2:
This is a question related to design details. The design
principle of any plant is to provide containment isolation
whenever there is an indication of a risk for radioactive
contamination of the athmosphere or the water inside
containment. With regard to.details, I can only reply with
respect to the ASEA-ATOM boiling water reactor (BWR) plants.
In these plants no transfer of water from the containment
to an auxiliary building takes place during abnormal
conditions. There are situations in which water is extracted
from the containment pool by means of pumps located outside
containment. However, in such situations the water is fed
back into the reactor containment in a closed loop.
In ASEA-ATOM plants the reactor containment is isolated
upon the automatic actuation of signals indicating high
pressure or high temperature inside containment. Thus we
do not rely on a high pressure condition only.
PAGENO="1084"
1080
Dr. Ingemar Tiren
Manager
Nuclear Safety and Licensing
(ASEA-ATOM)
P. 0. Box 53; 5-72104
Vasteras, SWEDEN
Dear Dr. Tiren:
Thank you very much for attending our Subcommittee hearings on Nuclear
Power Plant Safety. Your testimony was indeed very valuable and it was
awfully kind of you to come all the way from Sweden to give the Sub-
committee the benefit of your experience.
During the hearings on May 24, lg7g, you indicated that you may be able
to provide the Subcommittee with responses to a number of questions, to-
gether with other additional information. I have.enclosed a list of
questions and I would be grateful if you could find the time to respond
to them. by July 13, 1g79.
On behalf of the Subcormnittee, I want to thank you again for coning to
Washington and for providing an invaluable contribution to our under-
standing of nuclear power plant safety in terms of your own unique
rational perspective.
~
MIKE McCORMACK
Chairman, Subcommittee on
Energy Research and Production
MM/we
COMMITTEE ON SCIENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
5U1TE2321 navnuna HOU5EOTFICE BUILDING
WASHINGTON. D.C. 205j5
June 19, 1979
Enclosure
PAGENO="1085"
1081
AS EA-ATO M
Deettwtth by Ow Data Oat refetence
I Tirén August 8, 1979
Forthe attentlono? Voar Date Yourreterence
Congressman Mike McCormack
Chairman, Subcommittee on Energy
Research and Production
Committee on Science and
Technology
U.S. House of Representatives
Suite 2321 Rayburn House Office
Building
WASHINGTON, D.C. 20515
USA
Dear Congressman McCormack,
Thank you for your letter of June 19 with guestions
relating to my testimony during your May 24 hearing.
I have tried to respond to most of the questions in
the attached papers. Some of the questions, however,
require the attention of my colleagues and will there-
fore need some more time to be answered.
It was a great honour for me to appear before your
committee, and I enjoyed the occation very much. If
there are additional questions or enquiries relating
to European nuclear safety considerations that you
may have, I shall be glad to respond to the best of
my knowledge. If I can help with facts and viewpoints
on nuclear safety in a more comprehensive and
independent way I should also be happy to do so on
a consultantTh basis.
I hope the responses given here will be of some use
to you and your fellow Congressmen.
Yours sincerely,
/~j4L~L4(A~ It'Wt~
Ingm~r Tirén
Attached: Response to questionnaire
Description of SECURE reactor (3 copies)
Postal address Telephone Telex Telegraphic cddroes
ASEA-ATOM VOeteSs 40629
Sos 53 51-tOoccO
S-POt 54 VASTERAS t Sweden Cadet Wetters Scion end PAste
PAGENO="1086"
1082
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
Questions from Ilay 24, 1979, Hearings on Nuclear Power Plant Safety
for Dr. Ingemar Tiren, Manager, Nuclear Safety and Licensing, ASEA -
Atom, Vasteras, Sweden.
1. Please describe the "30 minute rule" that you mentioned in your
testimony.
2. How does your N-2 rule differ from present U.S. practice. Can it
be applied to U.S. nuclear power plants presently in operation?
3. Describe the "SECURE" reactor system in which a core melt is an
"not a possible event."
4. Please send us a description of the "Shift Change Procedure" which
is representative of present Swedish practice.
5. Please expand upon your comments regarding Sweden's plans for the
future use of coal.
6. Describe the Swedish program for training nuclear power çlant operators.
7. Would there be any benefit in having the assistance of experienced power
plant operators during the design stages of control rooms and control
panels? Is this done in Sweden?
8. Do you believe that it is reasonable for a utility to be entirely
responsible for the design, construction and operation of nuclear
power plants? -
9. Describe any significant differences in the control, instrumentation
and monitoring systems of Sweden and the U.S. regarding power plants.
10. Are there any significant differences in the educational requirements of
Swedish and U.S. power plant operators?
PAGENO="1087"
1083
~ ~- Oc~
Responses to questions from May 24, 1979,
Hearing on Nuclear Power Plant Safety
by Ingmar Tirén, ASEA-ATOM, Sweden
`30 minute rule"
The safety analysis report (SAR) that is submitted
to the Nuclear Inspectorate for approval before plant
operation contains a comprehensive "Accident Analysis".
This is similar to what is required by the USNRC.
The accident analysis is based on the assumption
that a set of mishaps and accidents might occur in
the power plant. These occurrences can be labeled
as "postulated events" required by the NRC or the
Swedish Inspectorste to be analysed. One must demon-
strate that the consequences of each of these events
in. terms of radioactive release are acceptable, and
in this context acceptability has been defined by
the licensing authority in their rules, regulations
and guidelines.
Now, in the Swedish case, we must assume in evaluating
the consequences of each accident or mishap, that no
operator action is made during the first 30 minutes
after *the initiating event, that is to say he takes no
action in order to mitigate the harmful consequence
of the event. In this context "harmful consequence'
means excessive release of radioactive substances
off-site.
The design related effect of this 30 minute rule is
that necessary actions have to be performed by auto-
matic means, i.e. by the automatic actuation and
operation of safety related systems, if these actions
have to be made during the first half-hour in order
to maintain the release of radioactivity within the
acceptable limits. The rule thus leads to a design
in which automatic devices are used somewhat more
extensively than they would be if no 30 minute rule
had been established. These automatic devices have
to be tested periodically.
The purpose of the 30 minute rule is to relieve the
operator from the requirement to perform a (large)
number of actions shortly after an abnormal occurence,
i.e. during a time period in which he might be under
considerable stress.
It should be stressed that the 30 minute rule does not
prohibit the operator to take manual action.
2 N-2 rule
The "N-2 rule" applies to important safety related
systems. Such systems are identified by classification
schemes accepted by the regulatory body.
PAGENO="1088"
1084
page 2
International safety criteria require that, when a
safety related system is called upon to operate, one
must assume that one component within that system
fails (single failure criterion). In order to comply
with this criterion, designers traditionally have
chosen to split up a safety related system into two
independent subsystems, each with adequate capability
to fulfil the required safety function.
Now, the N-2 rule goes further along these lines.
In simplified terms this rule requires the designer
to assume that not only does one component fail to
operate but, in addition, another component or sub-
system is unavailable due to repair. So two subsystems
might not suffice, you have to introduce 3 or 4 sub-
systems, or in general terms, N subsystems~ Of
the "N" subsystems one is assumed to fail on account
of the single failure criterion, and one fails to
operate due to its being subject to repair or main-
tenance. So the designer may employ three (N=3) sub-
systems each with full capacity for the intended
safety function or four (N=4) subsystems, each with
50% of full capacity.
Now I must point out that I believe that, in Europe,
the N-2 rule has not been established primarily by
a regulating process but rather by `practice" or as
a result of the utilities' desire to run the plant
with one subsystem out of order for a considerable
time. The utility wishes to be able to get the autho-
rities' permission to allow generous time intervals
for repair without the requirement to shut down the
plant.
It is my belief, that most plants now in operation,
in Europe as well as in the U.S., do not comply with
the N-2 rule. However, I also believe that most plants
now under construction in West Germany and some other
West European countries do fulfil the N-2 requirement
in the case of principal safety systems. Swedish BWR
plants under construction or in the commissioning
stage are designed according to the N-2 rule in the
case of emergency cooling systems and some other
important safety systems.
For older plants, American as well as European, it
would probably be very costly to adapt them to the
N-2 rule. In certain cases this should,however, be
possible by introducing additional pumps (in parallel
with an existing pump), or additional valves etc.
I should also like to point out again that the N-2
rule is a "utility" rule established in order to
enhance plant availibity (being able to repair without
shut-down) at least as much as it is a "safety" rule.
The splitt~,ing up of a safety system into several (N)
subsystems achieves its full safety oriented merit
only if the subsystems are properly ~gp~rated physically
(by adequate distance or by barriers) in su~ a way
that no occurrence (a fire, a missile) can result in
the damage of more than one of the subsystems at a
PAGENO="1089"
1085
page 3
time. By this means systematic failure of the entire
system due to a single event is avoided, i.e. a class
of Common Cause Failures of the system is prevented.
In conclusion I believe it is generally difficult and
safety-wise ineffective to apply the N-2 rule to
plants presently in operation.
3 The SECURE reactor system
A description of SECURE is attached in a separate
document (3 copies).
4 Shift Change Procedure typical of present
Swedish practice
The shift change procedure at a Swedish nuclear power
plant is typically fairly informal.
Swedish utility representatives confirm that no formal
check list is used at the dayly take-over from one
shift to another. The shift engineer keeps record of
notable items. He passes on this information to the
next shift together with an oral and informal exchange
of information. The list of notable items is kept up
to date by the shift engineer in charge.
The introduction of a formal procedure involving a
check list has been discussed in Sweden. A comment
on this question by a utility chief operator is that
the informal take-over has merits because it involves
a two-sided exchange of information between the shift
engineers. In a formalized procedure the information
might become one-sided and stereotyped.
This item addresses itself to the general problem of
man-machine interfaces at a nuclear power plant
Research projects within this field are in progress
in Sweden under the direction of the Swedish Nuclear
Power Inspectorate. Oetailed information about this
work may be obtained from the NRC under the current
U. S.-Swedish agreement.
5 Sweden's plans for ~the future use of coal
I have passed on this question to experts in the field
and will submit an answer as soon as possible.
6 Swedish program for training nuclear power
plant operators
I have passed on this question to experts in the field
and will submit an answer as soon as possible.
7 Assistance of power plant operators during the design stages
of control~rooms and control panels
There is certainly great benefit in having the assist-
ance of experienced power plant operators during the
design stages of control rooms and control panels.
Their experience from the operation of previous plants
48-721 0 - 79 - 69
PAGENO="1090"
1086
page 4
is needed to obtain improved designs for new control
rooms. These experienced operators can provide most
valid arguments for modifications regarding the arrange-
ment of panels for easy access, visibility of instru-
ments, operability of switches etc. They can distinguish
between items important to the operator and things
less important, and this is necessary because of the
multitude of information available in the control room.
They can give valid view-points on the practical design,
lay-out and arrangement of all sorts of equipment.
This experience is utilized in the design of control
rooms and control panels for Swedish plants. ASEA-
ATOM, the manufacturer, have within their own ranks
many experienced operators whose knowledge is utilized.
These are persons who have conducted the commissioning
runs of our early plants before take-over of plant
operation by the utility. In addition, ASEA-ATOM has
to leave considerable room for the ideas and require-
ments of the customer in the arrangement of the control
room and control panels. The customers, i.e. the
utilities, have their own experienced operators who
have strong views about how things should be arranged
and presented, and these views must be taken into
account to a very great extent. So there is a con-
tinuous and strong cooperation between the utility
and the designer in these matters.
A couple of photographs of the control room in the
TVO I plant are attached. TVO I was taken into commer-
cial operation around New Year 1979 and is the first
BWR plant delivered by ASEA-ATOM in Finland.
8 Is it reasonable- fora utility to be entirely responsible
for the design, construction and operation of nuclear
pquer plants?
Iknowofno
case in which a utility has designed a commercial
nuclear power plant entirely on their own. This is
done by the manufacturer, normally. Most manufacturers
or architect engineers also have a good deal of responsi-
bility in the construction phase, together with the
utility.
I can only say that I em convinced the Swedish
utilities have resources and qualifications sufficient
for their share of responsibility during all stages
of the design, construction and operation of our
nuclear plants.
Perhaps your question about-responsibility refers to
~ responsibility? If so, I can give no opinion.
9 Significant differences in the control, instrumentation
and monitoring systems in Sweden and the U.S. regarding
power plants
I have passed this question on to our experts and
I shall submit an answer as soon as possible.
10 Significant differences in the educational requirements
of Swedish and U.S. power plant operators
This question will be dealt with in conjunction
with our reply to question No. 6.
PAGENO="1091"
1087
PAGENO="1092"
~r~ñLh CFIT
PAGENO="1093"
1089
SECURE
NUCLEAR DISTRICT HEATING PLANT
In the budget for energy R & D, approved
by Swedish Parliament in 1975, funds were
made available for the initial development of a
low temperature district heating reactor.
In 1976, the Finnish Government allocated
money for the same purpose. A joint Finnish-
Swedish design effort was started in January
1976 and concluded in July 1977.
The aim of the study was to clarify the
technical and economic aspects of a low
temperature nuclear district heating plant in
sufficient detail to allow decisions to be made
for the possible use of nuclear district heating.
The organizations responsible for the work
are:
AB ASEA-ATOM
Västerâs, Sweden
AB ATOMENERGI
Studsvik, Sweden
OY FINNATOM AB
Helsinki, Finland
TECHNICAL RESEARCH CENTRE
OF FINLAND
Espoo, Finland
PAGENO="1094"
Domestic heating today in Scandinavia is
to a large extent based on fossil fuel, mainly oil.
There are many reasons for reducing the use of
oil for such elementary purposes: environment,
balance of trade, security of supply and
economy. To the extent this is possible, the
demand for heating in the Scandinavian
countries should be met by using other forms
of energy.
Waste heat from large nuclear power plants
can be used for this purpose, but this depends on
the location of such plants in relation to urban
centres, low temperature distribution
technigues, the total electricity demands etc. In
any case, the use of such heat is confined to a
restricted number of areas with large population
concentrations. One way of avoiding the use of
oil or other fossil fuels in the smaller urban
centres spread over the country would be to
adopt small low-cost reactors with properties
allowing location near urban centres.
The present concept SECURE (Safe
Environmentally Clean Urban REactor) is
designed to cater for the needs of such a
programme. The rationale of this reactor is
that simplicity in design and inherent safety
features due to the low temperature and
pressure should make such reactors
economically feasible in much smaller unit
sizes than nuclear power reactors and should
make possible their urban location.
1090
NUCLEAR DISTRICT HEATING
I n'~~t/ l~fl
(,,,il'i,i-I l~~~il lull aulc//'(uu~'l
.\uIea,- ll('Lll
4
PAGENO="1095"
21X)0 401K) (4K))) ))0)K)
t;llifuiion inic 0
Project SECURE encompasses the
preliminary design and safety analysis of a 200
MW(th) nuclear district heating plant for the
municipal space heating of a city of about
100 000 inhabitants. This power level
represents a compromise between the
improved economics for a larger output and
the increased potential market for a smaller
unit. The present work does not refer to any
specific site.
District heating systems in Scandinavia
usually operate at a 120°C maximum
temperature, reached only on the coldest
winter day. The cost characteristics make the
district heating reactor most suitable for
catering to the thermal base load requirements.
The annual distribution of district heating
temperatures and thermal load show that it is
sufficient to design the reactor for 95°C
outgoing temperature to the district heating
system and for about half the maximum load.
Under these conditions an annual heat
generation corresponding to 4000-5000
effective full power hours can be expected.
Fossil-fuelled heaters are used to cope with
the peak load. Only about 15% of the total
annual energy need has to be met in this
manner.
ilii.ti itilt Ii ii
1091
Finland
CuTe/h Ihiel seiuieet I~n
dint/el Iiealin~
~tjiniiiiiiiit 1t~itl it jilt
iii) I itt)
/ 1lin~ Iii ii) ii lIt dine
lilt) ii) Citol
K))) lit el lietct
itii~ 01(111
~ .ltutdin a
~t \
120
110
1(111)
is))
(ii)
4))
30
21)
1 enipet 1)111 net etini tim
n p.111k load tout
i~ itoh loittpui flute
ii ii slot tittijierilure
Duration curves for district heating load and temperatures
5
PAGENO="1096"
1092
SECURE CONCEPT
SAFETY PHILOSOPHY
For economic reasons, a space-heating
reactor must be located close to the load centre
of the district heating grid being served.
SECURE is therefore designed to eliminate
the requirement of geographic separation
between urban high-density population centres
and reactor sites.
At present, there are no specific
governmental criteria regarding the design of
nuclear plants for urban siting. Nor is there any
defined risk philosophy on which to base such a
design. Current light water reactors achieve the
required high degree of safety by the use of
engineered safety systems containing active
components such as pumps and valves. By rigid
quality assurance, redundancy, diversity,
physical separation and in-service functional
testing the probability of an accident with
major impact on the environment is made
acceptably small. However, this leads to high
investment and maintenance costs and the
resulting plant design complexity virtually
prevents comprehension of the safety problems
by the concerned layman. Thus, both
economics and public acceptance suggest
another approach.
For SECURE the most essential safety
features can be characterized as follows:
- Shut down and core cooling assured in all
accident conditions as inherent feature of
design - no engineered safety systems
necessary.
- No requirement of operator action
subsequent to accident - i.e. a "walk away"
situation exists at all times.
- Low power density - favourable operating
conditions for fuel results in very low fission
product release.
- Underground siting - favourable from
environmental and containment
viewpoints.
REACTOR DESIGN
The reactor core is located at the bottom
of a large pool, containing about 1000 m3 of
cold highly borated water. The pool is enclosed
in a cylindrical prestressed concrete vessel,
covered with a prestressed concrete lid and is
slightly pressurized.
The whole reactor installation is located in
an underground cavity. The prestressed
concrete vessel is located below the floor level
of the reactor hall. This ensures that the core
always remains under water and is safely
cooled in case of accidents. The concrete
vessel design permits inspection of all
prestressing tendons from the reactor hall.
The reactor vessel itself has no pressure
retaining function, but serves as a flow baffle
between the highly borated pool water and the
low-boron reactor water.
The main coolant circuits along with
pumps and heat exchangers are located outside
the concrete pool.
The reactor coolant water is heated from
90°C to 115°C in its passage through the core.
The reactor core consists of conventional
uranium dioxide fuel rods with Zircaloy
cladding, arranged in a square lattice in
Zircaloy fuel boxes. The rod diameter is the
same and the fuel length is about half that for
the ASEA-ATOM BWR. The four central fuel
rods in each fuel assembly are replaced by a
square tube for the boron steel spheres used for
long term shut down.
The fuel power density is less than two
thirds that of a modern BWR and about half
that of a modern PWR. This low power density
results in very low fuel and cladding -
temperatures, thereby reducing the frequency
of cladding defects as well as the release of
fission products in case of their occurrence.
Core flux distribution control and burn up
compensation are achieved by means of
gadolinium in the fuel and by shuffling of fuel
regions similar to PWR practice.
Reactivity control is by means of boric acid
concentration adjustment only and there are no
mechanical control roth However, for long
term shut down boron steel spheres can be
dropped by means of gravity to a position
inside the core.
6
PAGENO="1097"
1093
REACTOR POOL AND INTERNALS
it!!! /1 lint:
I u/ni liii
ten! .iphere.c
/ hitnal IV!!!! lilT/U!
P,sun.seil CuIUI! I/il .....
:`Iagi!:ttte./ IT/V
lIT/TO!! it!.!! yl/lere! .
P!CSt!('T!tt! (OULI!u tint!.
Pres!1esvi!!!/ tendoni
/ /
I? noel/i, iei 01
J/~ liii 1!!
`11111 eli Clt/!lti(!ll /l(!!t (/1(1/1
I Ott!.! gui mi!'
MU//i ClTi1!lallOt! I/O!! inlet
7
PAGENO="1098"
312 Reactivity control system
313 Main circulation system
314 Pressure relief system
315 Reactor water clean up system
317 Boric acid and clean water make up system
318 Gas lock system
324 Concrete vessel water clean up system
326 Controlled drainage system
329 Hydraulic system for mechanical absorbers
342 Active waste system
345 Controlled area floor drainage system
348 Recombination system
411 Divtrict heating system
421 Intermediate cfrculation system
711 Cooling tower
721 Residual heat removal system
724 Component cooling system
742 Reactor cavern ventilation system
766 Process heating system
767 Ground water drainage system
1094
MAIN FLOW DIAGRAM
8
PAGENO="1099"
1095
9
PAGENO="1100"
1096
SAFETY FEATURES
Fast shut doivn by main circulation pump trio
Inherent shut down by venturi tube cavitation
REACTOR SHUT DOWN
Reactor shut down can be accomplished in
four different ways.
During normal operation, mixing of the
cold highly borated pool water and the warm
low-boron coolant is prevented by a gas bubble
in the reactor vessel above the core. Reactor
power controland normal shut down is by
means of adjustment of boric acid
concentration in the coolant.
The gas bubble is kept in place by the
pressure drop across the core existing as a
result of the coolant circulation. A decrease in
circulation rate, e.g. due to run down of the
pumps upon loss of power supply, will decrease
the core pressure drop as well as the height of
the gas bubble. The corresponding displaced
gas volume is replaced by cold highly borated
pool water and the reactor is shut down.
Depressurization, loss of heat sink, or
excess reactor power which also may endanger
the adequate cooling of the core, will initiate
reactor shut down in the same way as pump run
down. A flow limiter has been included in the
primary circuit for this purpose. This consists
of a set of parallel venturi tubes, where steam
formation accompanied by increased pressure
drop and decreased flow occurs before steam
formation starts in the core. Thus there is
inherent safety built into the system against the
consequences of incidents that could
potentially endanger core cooling.
Automatic long term shut down is
achieved by dropping boron steel spheres by
gravity to positions inside the fuel assemblies.
Normal shut down by boric acid injection
Long term shut down by boron steel spheres
10
PAGENO="1101"
1097
REACTOR CORE COOLING
The core is permanently connected to
three separate coolant circuits, namely the two
primary circuits, through which heat is
extracted to the district heating grid during
normal operation as well as a natural
circulation circuit connecting it to the concrete
pool of borated cold water. There are no valves
or other mechanical structures in any of the
circuits.
During normal operation the reactor
coolant is separated from the pool water by a
gas bubble above the core.
Following normal reactor shut down, the
residual heat is continuously absorbed by the
district heating grid through the primary
coolant circuits.
If the reactor coolant pumps trip, the gas
bubble disappears altogether from above the
core and the core is shut down and cooled
ultimately via natural circulation to the pool
water. Loss of cooling water from the pooi is
impossible because the reactor is situated in the
lowest region of a leak tight rock chamber.
Long term cooling of the pool water after
shut down is by means of a closed natural
circulation cooling system that dissipates decay
heat to ambient air via a cooling tower. The
pool will be kept at 95°C or below for an
unlimited time without further action.
Emergency power is not needed nor is there
need for any operator action.
Long term residual heat removal to cooling
tower
Normal residual heat removal to district
heating grid
Inherent residual heat removal to pool water
11
PAGENO="1102"
=
1. Tunnel entrance
2. Ventilation stack
3. Main entrance
4. Administration building,
md. control room and
conventional equipment
The reactor, the primary cooling circuit
and the reactor auxiliary systems are located in
an underground rock cavern.
The secondary heat exchangers connected
to the district heating grid and all conventional
plant auxiliary systems are placed in a surface
building~
In the general case, a concrete building
could serve as an underground reactor
containment. In the special case of good
Scandinavian rock a blasted chamber
subsequently injected with cement is
sufficiently leak tight to serve as reactor
containment without further sealing
arrangements.
The underground ventilation system needs
no emergency filters. In case of an emergency
it is simply shut down and the system is closed
by means of automatic valves in the inlet and
outlet ducts. Activity release to the
environment will be extremely low.
1098
STATION LAYOUT
5. Cooling tower
6. Communication shaft
7. Reactor hail
8. Primary heat exchangers
9. Reactor pool
10. Vessel lid during refuelling
11. Fuel cask pool
12. Fuel handling machine
13. Air lock
14. Transport tunnel
15. Auxiliary system cavern
16. Electrical system cavern
12
PAGENO="1103"
1099
ENVIRONMENTAL EFFECTS
The SECURE system represents a liquid radwaste. Radioactive drainage and
municipal heat supply plant with negligible leakage water from the reactor systems are
pollution. Waste heat is insignificant, there is collected, treated and reused as make up water
no smoke, gaseous radioactivity release causes to the reactor again. Spent ion exchange resins
less than one thousandth of the dose due to etc. are taken to a central plant at a nuclear
natural backgroundradiation, and there is no power plant facility.
1 rui~prttt iii 1 ft ~h tnt! punt In.!. nc! Irtiupt rt~
pLtil tn ~ Iutnr'e rc~tn. nt a-tn a t~tc RtIcasc. tm ii
fr )tfl . ~ttt Itt tUfl tack cs
I ttttttrtI ltt-Itrtttttttl tttI_~ttttt it. (a t'IStfl flit fl, )~I~' (t)
I ~ ~ ~`t,1ttcii listI 2~(ftiliit ~~(ili(t
Sttlphttt \it!c~ 11)')....! l~~' 2ihh
`llrtt'rn t'~ttk',
tt't
llttt~ nlt'tttl'. Itt .5)
~ EII7~7~
SECURE nuclear district heating plant Fossil -fitelled district heating jilant
13
PAGENO="1104"
1100
MAIN DATA
GENERAL
Reactor power MW(th) 200
Reactor outlet temperature °C 115
Reactor inlet temperature °C 90
Reactor pressure MPa 0.7
Core circulation flow kg/s 1 900
District heating outlet temp °C 95
District heating inlet temp °C 60
District heating circ. flow kg/s 1 360
CORE
Number of fuel assemblies 144
Fuel weight total tons U 13
Active core height mm 1 970
Power density in fuel W/g U 15
Average heat flux W/cm2 30
Max heat flux W/cm2 70
Max linear heat rating W/cm 270
Mm margin subcooled boiling °C 25
Number of orifice zones 4
Enrichment, equilibrium % 2.58
Burn up. equilibrium MWd/ton U 22 000
Number of control rods 0
FUEL
Number of fuel rods 60
Fuel length mm 1 970
Fuel rod outer diameter mm 12.25
Cladding thickness mm 0.8
Fuel rod pitch mm 15.0
* cladding material Zr'2
Average fuel temperature oC 370
BUILDINGS
Underground caverns m3 84 000
Surface building m3 28 000
14
PAGENO="1105"
1101
1185C1236)(1~121737G219)PD 0~/07/79 1234
Telegram
IWABIO
ICS IPMIIH~ IISS
CY IISS~M ITT 07 1234
PMS FFICE BUILDING WASHINGTON DC
AWN699 VIA ITT ITB167 1GT6532 DU 532
USWA Co SWSM 085
C VAESTERAS 85/81 7 1657 PAGE 1/50
COMMITTEE ON SCIENCE AND TECHNOLOGY
C U.S. HOUSE OF REPRESENTATIVES SUITE 2321 RAYBURN
HOUSE OFFICE BUILDING
WASHINGTON/DC(20525)
CONGRESSMAN MIKE MCCORMACK CHAIRMAN SUBCOMMITTEE ON
ENERGY RE EARCH AND PRODUCTION THANK YOU FOR YOUR LETTER OF
JUNE 19 WITH QUESTIONS RELATING TO YOUR MAY 24 HEARING.
* I DIT NOT RECEIVE THIS LETTER UNTIL YESTERDAY
COL WASHINGTONDC(20515) 2321 19 24
SF-1201 (R5-6~)
~rn ~ Telegram
C TGT6532 COMMITTEE ON SCIENCE PAGE 2/31
AUGUST 6, DUE TO VACATIONS. I AM SORRY FOR THE DELAY HOWEVER
I SHALL SEND RESPONSES TO YGURQiJEST IONS BY AIR MAIL AS SOON AS
POSSIBLE
C SINCERELY INGMAR TIREN ASEAATOM SWEDEN
R~CE1VED
AUG 71979
S COMMITTEE ON SCIENCE
AND TECHNOLOGY
48-721 0 - 79 - 70
(S
CS
C.
C
C
PAGENO="1106"
1102
AS EA-ATOM
Mr I Tirén, (021) 106013 1979-08-17 T/lT
Congressman Mike McCormack
Chairman, Subcommittee on
Energy Research and Production
U.S. House of Representatives
WASHINGTON, D.C.
Dear Congressman McCormack:
Please, find enclosed my responses to questions
No 5, 6, 9, and 10 addressed to me upon your
May 24 hearing. I hope they will be of some use
to your Committee. If you have additional
questions with respect to my responses I shall
be glad to try to furnish explanations and
details.
Yours sincerely,
AKTIEBOLAGET ASEA-ATOM
Technical Department
Special Assignments
~A,t G~4
Ing*r Tirén
End.: Response to questionnaire
Description of BWR simulator (3 copies)
Description of activities of the Nuclear
Power Training Center (1 copy)
S
PAGENO="1107"
1103
Responses to questions from May 24, 1979
Hearing on Nuclear Power Plant Safety
by Ingmar Tirén, ASEA-ATOM, Sweden
~Swede~~g~thefuture use of coal
There are no firm projects for the future extended
use of coal in Sweden. These plans depend on the
outcome of the referendum on nuclear power which
is going to take place next year and which was
triggered by the TMI incident.
However, there are many speculations and preliminary
plans for the extended use of coal, for heating
purposes as well as for the generation of electricity.
Such preliminary plans are made within the big
utilities such as the Swedish State Power Board
and the South Swedish Power Co Ltd as well as by
local communities.
In several cases, when utilities have made public
their plans for the localization of a coal plant
at a specific site, there have been local protests
and misgivings about the environmbntal effects of
the plant.
Utilities, however, look at coal as a means of
obtaining an alternative source of energy by the end
of the 1980's for the purpose of diversification.
The question is: Alternative to what?
Sweden possesses no significant coal doposits of
her own. - An industry group has proposed the
formation of an organization for the centralized
import of coal to Sweden. An interesting question
on our part in this conjunction is whether the U.S.
will he willing and roady to export coal to Sweden.
A kind of tentative answer to your cuestiun can
be given by reference to the Energy Proposition
by the Swedish Government of March, 1979.
According to this official government policy
document the Minister of Industry finds the increased
use of coal to be an urgent means to reduce our
dependence on oil. The Minister believes that it is
possible to increase the present coal-based genera-
tion capacity of about 20 TWh to a level of 45-70
TWh by the year 1990.
With regard to the generation of electricity the
Minister indicates an aim of employing coal as
a fuel together with the introduction of new sources
such as wind (!), chip and peat. Today, coal makes
no significant contribution to electric energy
generation in Sweden. By the year 1990, according
to the aim indicated by the Government, 3-7 TWh
should be ~enerated by coal. However, in this figure
some contributions from chip and peat are included.
This range of figures should be compared with the
projected figure of some 140 TWh of totally ~nerated
electric energy in 1990, today's figure being about
90 TWh.
I believe additional questions in this matter
could best be handled by the Swedish Embassy
in Washington.
PAGENO="1108"
1104
6 Swedish program for training nuclear
pp~r plant operators
This question is somewhat difficult to respond to
for several reasons. The Swedish Nuclear Inspecto-
rate have delegated much of the responsibility for
operator training to the utilities, and somewhat
different procedures and practices are used by the
three Swedish utilities. There is, today, no formal
"operator's license" required by the Inspectorate.
Furthermore, the matters of operator training is
in a state of development, and a good deal of
modification, in principle as well as in practice,
may be expected as a result of the TMI incident.
The Inspectorate is expected to surveil and follow
up more closely the competence of the personnel
engaged.
There are several items covered by the term "operator
training". An important item is training of operators
and other personnel during plant commissioning and
start-up in order for the utility to take over
operations from the supplier. In this phase ASEA-
ATOM's personnel play an important role as instruc-
tors. However, this item will not be further
discussed here.
There are several categories of personnel involved
in the operation of a nuclear power plant. The
persons who are in the most close contact with the
process form, in a Swedish plant, a "shift toam".
This team normally consists of
- the shift engineer immediately responsible for
operations,
- the control room engineer acting as reactor
operator,
- the control room technician acting as turbo-
generator operator,
- two plant technicians.
These are the categories of persons whose training
will be described briefly in the subsequence. Upon
the occurrence of an abnormal situation which the
shift engineer feels he cannot handle conclusively
by himself he shall call the attention of an
"engineer in charge" who shall be available (on
telephone) around the clock and shall be able to
reach the plant within half an hour. This is a
senior person in managing position, whose education
and training is not described here. Neither will
the education and status of the plant management
be dealt with.
PAGENO="1109"
1105
The following account is divided in three sections
dealing with
- recruitment of personnel,
- training of personnel,
- tho Nuclear Power Training Center at
Studevik.
Such of the information covered by the first two
of these sections has been obtained from a
consultant firm which i.s presently engaged by the
Swedish Nuclear Power Inspectorate in a review and
assessment of the recruitment and education of
nuclear plant operators. Further details, especially
with regard to further modifications of the items
involved, may he obtained via the NRC under the
current NRC--Swedish Inspectorate Agreement.
Recruitment of Noel ear Powar Plant Personnel
The three Swadish nuclear utilities have set up
similar requircoonts on persons to be recruited for
duties within a nuclear power plant in general, and
in the control room in particular. Differences in
emphasis and practices exist, however.
The following account of required qualifications
applies to the Rinyhals plant operated by the
Swedish State Power Board. This site includes one
BWR and one PBR plant in operation, and two more
PWRs yet to be taken into operation.
For the employment of a shift engineer naval
engineers or college-graduated mechanical engineers
are often recruited. These persons are required to
have substantial practical experience such as seven
years of practice of the operation of a power plant
or a similar industrial process. They must have some
experience in superv~s1ng capacities and shall also
have practical experience from employnent as a
control room engineer.
The control room engineer is required to have a
similar education as the shift engineer. With
PAGENO="1110"
1106
respect to practical capon enco a five year
record free the ooorat.ion of a power plant or
similar process is considered necessary. He
should also have some experience in a supervising
capacity.
The control room technic n, who is to be responsible
Per the operation of the tu:-ho--uenerator should
have an education of a technician or an engine
operator. Yore teportant is his practical
oxperieece that ahcnld he adapted to his duties
end nheeld ce:priso a period of 3-5 years. Similar
recruitment qoide] inns exist for the plant technician
although Toss exp~rionco is rejuired.
The internal education and training of these
persons, once osplcyed by the utility, is adapted
to their backgrounds. The in-plant training and
other further courses given to the technicians and
op ators is stressed by the utilities as an essential
portion of the efforts race To strengthen and
cintain their cc:npctence.
The South Swedish Power Co observes that,
in practice, most technici ens actually employed
hove in fact a college degree in engineering.
Also, the nuloynent of the core qualified categories
of person ci, i.e. cpnrators and shift engineers,
is To a nat eLect ha sod on the internal promotion
of eapnnicnced Technicians, ahnr than the
recruiting of nw c-eployees free the outside.
Furthereorf, west censors recruited for control
room duties fun the outside have a] ready provious
experience from the eperateon of a nuclear rector.
In this respect tha comparat ively I argo numhnr of
research reactors operated at Stu]evi k during the
1960's have established a qeon t~is for the
recru itmnnt of nuclear power ci ent operators.
ci hurl ear Power Plant Personnel
ho mining tnrocedore of plant operators and other
p1 ant personnel differs socket among the various
utilities. The follcwing short description refers
to conditions at the ilereetlick site involving tao
units oeratod by the South Swedish Power Ce Ltd.
However, the other utilities employ similar training
proidirns.
Newly recruited plant technicians receive basic
training and cocat~on involving scvnral different
items After two days of inC:roductory information
the technician works with a shift team for 1-3
months and is then given a five weeks' basic course
involving two weeks on nuclear reactor physics
and radiation physics end Three weeks en nuclear
~ow0r engineering.
The newly recruited techn reran is alne made famil far
with other activities within the plant by way of
PAGENO="1111"
1107
participating as observer of work done in thor
groups during two weeks.
Upon the completion of the basic course a 16 weeks'
course in plant enignooring follows. This course
involves the famil:iarization of the technician with
plant systems hasod on simplified systems descrip-
tions and drawings. During 12 of the 16 weeks this
training is based on self-tuition as an essential
moans of training and is conducted in parallel with
the technician's normal work on a shift basis.
During this course there are four written examinations
Further education of diant technicians is organized
in the form of two courses. This education is given
to four technicians at a time who, during the
courses, continue to participate in the normal
activities of their shift teams. Approximately `50%
of the course is based on self-tuition with one or
two reviews conducted by a teacher each week.
The first of these courses comprises mathematics
and physics, nuclear reactor physics, radiation
physics and nuclear engineering. The course appears
to involve a 6 weeks' period.
The other course involves plant engineering and
comprises 12 weeks, the course being conducted by
a teacher during one third of the time. The content
of this course comprises syst:eas descriptions,
process drawings and descriptions of integrated
plant function. The purpose of this course is to
give the technician a comprehensive eccount of
these iteds that are necessary to comprehend and
he familiar with for a person working in the plant
control room.
Technic ices to be~pre~notod tocontrol room duties
are given additional basic education comprising
- service in the control room for 2-4 weeks,
- basic 5 weeks' course at the BWR simulator at
Studsvik,
- a practice-oriented one week course in electric
engineering.
The simulator course at Studsvik is worthy of some
comments. During the first three weeks of this
course there are lessons conducted by teachers,
working groups, exercises, and demonstrations in
the control room of the simulator conducted by
instructors. The `two last weeks of the course
are devoted to exercises in the control room of
the simulator and follow-ups of accomplished
simulator runs.
PAGENO="1112"
1108
A written examination is given at the end of the
third week of the course.
The goal of this course is that the trainee shall
be able to perform the following tasks on the BWR
simulator:
- Nuclear heating of the reactor from cold shut-
down, synchronizing and loading of the turbo-
generator,
Power operation and pcwer reduction and cooling
to a cold shut-down condition,
- Relevant and correct checks and actions in a
number of simulated abnormal situations.
Some 30 instructor-conducted lessons are included
in the course. A scope of 100 hours of simulator
time is shared between demonstrations, criticality
runs by the trainee, steady power operation, and
training with regard to malfunctions.
Re~Lra4g4p~ is given by annual retraining coursos
comprising one week's training at the Nuclear Power
Training Center at Studsvik including simulator
training. These courses are given to the control
room personnel jointly, i.e. to the shift engineer,
the control room engineer, and the control room
technician who normally cooperate in a shift teen.
Other courses given end conducted by the utilities
for the training of various categories of plant
personnel include:
- Training in rescue-duties, including fire
protect ion,
- Reviews of Technical Specifications for Plant
Operation,
- Review of reactor core operation and surveillance,
- Supervisor courses,
- Training in the operation of the fuel loading
machine,
- ENR technology courses,
- etc.
Nuclear oa'er Ta~ nmng Center
In close association with the Studsvik nuclear
research centre the Nuclear Power Training Center
AKU, was established in 1972. This center is jointly
owned by the three Swedish nuclear utilities, the
Swedish State Power Board, Oskarshaens Power Group,
and the South Sac-dish Power Co Ltd.
PAGENO="1113"
1109
The key facility of AKU is the BWR/PWR simulator
which comprises faithful replicas of the control
rooms of the llarsehUck 1 BWR plant and the
Ringhals 3 PKR plant. As a supplement to this most
important training facility AKU, often in cooperation
with the Studsvik Research Centre, offers courses
in a variety of subjects such as mathematics,
physics, nuclear reactor- and health physics,
and nuclear power technology.
Separate descriptions of the simulator and AKU
activities are given in the attached brochures.
PAGENO="1114"
1110
9 Significant differences in the control, instrumentation
and monitoring systems in Sweden and the U.S. regarding
ppwer plants _______________________________ ______
A review of control, instrumentation and monitoring
systems for nuclear power plants reveals few
principal or other more general differences between
U.S. and Swedish practices in this area. This
review has been focused on safety-related systems.
In the area of equipment identified as having no
bearing on safety there may be differences not
discovered in this review.
The fact that the safety-related systems are designed
similarly in the U.S. and in Sweden is based on
the extensive use, in Sweden, of U.S. rules,
regulatiuns and guidelines for the design of safety-
related systems.
Furthermore, the standards established by the U.S.
Institute of Electrical and Electronics Engineers
(IEEE) are also employed to a great extent in
Swedish nuclear plants, in the case of safety-
related equipment.
It is believed that the Swedish 30-minute rule
described in response to your question No 1 has
resulted in a somewhat more extensive use of
automatic actuation of safety-related systems in
Swedish plants than in U.S. plants.
There are also several differences in detail. For
example differences exist between U.S. and Swedish
EWE plants with regard to automatic means for the
isolation of the reactor containment. A significant
difference with a possible hearing on the Three
Nile Island incident is that, in Swedish tWR plants,
the reactor containment is isolated upon the
automatic actuation of signals indicating high
tc-mserature inside containment, as well as upon
high pressure signals. Thus we do not rely on a
high pressure condition alone.
In Swedish BWR plants there are permanently installed
systems for the rece~nhination of hydrogen formed
within containment in abnormal situation. These
recombination systems are installed at each unit
and are thus not shared between several units. In
the Forsnork 1 plant (contracted in 1972) and later
Swedish EWE plants the recoi~bination system is made
up of two redundant subsystems in accordance with
the requirements of the USNRC Regulatory Guide 1.7
(first issued by the USAEC as a Safety Guide in
1971). - From accounts relating to the TEl incident
it appears that the same previsions may not have been
made in some U.S. plants.
PAGENO="1115"
1111
10
In conjunction with the TMI incident our experts
are somewhat puzzled on the question of the closed
valves in the auxiliary feed water system. From
accounts given it appears that these valves could
he opened or closed by remote actuation, i.e. by
the maneuvering of switches (or similar devices)
in the control room. Assuming this to be true, a
significantly different situation would apply to
Swedish OUR plants: Upon the automatic actuation of
the auxiliary feed water system to start ~.utor tic
and ever-riding si9nal would aisobe_given to the
valves 1oppen.
So these valves would be opened even if they had
previously boon closed by maneuvering in the
control room.
The only instance in which valves in a safety-
related system (such as the auxiliary feed water
system) would not be automatically geared to the
required position for safety action would apply
to such service valvesthat can only be maneuvered
locally by a hand wheel. Such valves are avoided
as such as possible, however. If they have to be
used, they are required to he locked in the safe
position.
PAGENO="1116"
1112
11
10 Differences in the educational reuuirc-ments of
d~ J2pwer 21ant_g~erator~~~
An accurate response to this question requires
a thorough analysis of the educational require-
ments of the nuclear authorities and utilities
in both countries. To my knowledge, no such analysis
has been undertaken in Sweden.
A person within the Swedish Nuclear Power Inspecto-
rate staff who is engaged in educational matters
has expressed the opinion that the requirements
in the U.S. and in Sweden are roughly equivalent,
although it is believed that these requirements
are sore formalized in the U.S.A. As a basis for
this opinion he refers to statements given by
Swedish PNR operators who have been trained in
the United States.
A description of educational requirements and
practices in Sweden is given in response to item 6
of your questionnaire. On the basis of this
information I hope that your own experts may be
able to draw some conclusions with regard to the
present item.
PAGENO="1117"
1113
Kämkraftskolán
Nuclear PowerTraining Center
--~ai~J ~
__ ~t7~
PAGENO="1118"
AKU svarar for vidareutbildning av kSrnkraftverkens
driftpersonai. Det tIter vid Klrnkraftskolan I Studsvik,
strax utanfOr Nykoping. HIs harman byggt upp en
simulatoranllggning for att under realistiska fOrhAlian-
den trIna och utbilda driftpersonal.
AKU utarbetar Iven laromedelapaket fOr sjalvstudier
vid de olika karnkraftverken.
Klrnkraftskolan har ett tiotal anstIflda, vilka utformar
kurasnaterialet, instruerar eleverna och skOter simula-
torn.
Nuclear Power Training Center
with simulators
AB Karnkraftutbildning, AKIJ was established in 1972
by Vattenfail (the Swedish State Power Board), 0KG
(Oskarshamns Power Group) and Sydkraft (the South
Swedish Power Co Ltd.).
AKU offers services in training of the operating per-
sonnel at nuclear power plants. The company has
built the Nuclear Power Training Center at Studsvik,
about 90 kilometers south of Stockholm. The main
feature of the Training Center is a large simulator
plant for training and education of operating personnel
during realistic circumstances.
AKU also produces training materials for use at nuclear
power stations.
The training center has twelve employees who com-
pose the training packages, instruct the trainees and
operate the simulator.
1114
Kärnkraftskola med simulator
AB Karnkraftutbildning, AKU, bildades 1972 av
Vattenfall, Oskarshamnsverkets Kraftgrupp och Syd.
kraft.
PAGENO="1119"
1115
Kompletterande utbildning
Bakgrunden till satsningen pA ett simulerat kraftverk
är att tiden fOr idrifttagning av karnkraftverk blir allt
kortare fOr varje nyu aggregat. Korta prov- och av-
stallningstider betyder att traningsmOjligheterna fOr-
samras fOr personalen. DärfOr blir kärnkraftverks-
simulatorn ett viktigt komplement till den standiga
utbildning och Atertraning som driftpersonalen genom-
gAr.
Supplementary training
The motives for building a power plant simulator are
that the time for start up of power plants tends to be
shorter for each new unite. Short commissioning
periods as well as short shut down times give the per-
sosnel small possibilities for training. Therefore the
nuclear power training simulator will be an important
complement to the continuous instruction and retrain-
ing which the shift personnel receive on the job.
1. Kontrollrum BWR (Barseback 1)
Control room BWR
2. Kontrollrum PWR (Ringhals 3)
Control room PWR
3. Instruktorsrum
Instructor's room
4. Dator
Computer
PAGENO="1120"
Tvá stags kdrnkraftverk, BWR och PWR
Simulatorn bestIr av tvl kompletta kontroUrum med
instrumenteringarna kopplade till en gemensam dator-
anldggning.
Det ena lr en kopia av kontrolirummet i Barsebacks-
verkets fOrsta aggregat, vilket Ir en BWR (kokarreaktor)
med en turbin. Det andra är en kopia av kontrollrum-
met i Ringhalsverkets tredje aggregat, en PWR (tryck-
vattenreaktor) med tvl turbiner. Kontrollrummen
kan dock inte vera inkopplade samtidigt utan mIste an-
vIndas var for sig.
De kIrnkraftverk som nu finns eller planeras i Sverige
är antinges av typen BWR eller PWR. All driftpersonal
vid vIra kdrnkraftverk kan ddrfOr trdnas i simulatorn.
BWR-stimulatorn anvandes första gIngen 1974. PWR-
simulatorn beraknas bli fardig 1977.
Unika traningsmOjligheter
Berakningsdelen av simulatorn utgOrs av en dator. Den
her programmerats med matematiska modeller av BWR-
resp PWR-stationen. En mindre dator skOter hante-
ringen av signalerna mellan kontrollrummet och berak-
ningsdatorn. Vane kontrollutrustning omfattar mer In
600 visarinstrument, 5 000 lampindikeringar och 2 500
tryckknappar.
PS instrumenten och indikeringarna visas det aktuella
tillstlndet i det simulerade kraftverket. Eleven kan
silly styra forloppen p1 samma sltt som i kraftverket.
Realismen her drivits 51 llngt att eleven upplever simu-
latorn sons en verklig station. Aven ljudeffekter finns
med. FOr att Ova formtgan att uppfatta olika tänkbara
driftsituationer efterliknas mInga driftstorningar med
simulatorn. Forloppen ken kOras lSngsamt och stannas
helt. Det ger eleven tid att studera tilistlnden. När
simulatorn sedan körs normalt ken eleven llttare fOlja
upp handelseutvecklingen.
1116
; ~
PAGENO="1121"
48-721 0 - 79 - 71
1117
Two kinds of power plants, BWR and PWR
The simulator cossists of two complete control rooms
with the instruments connected to a central computer
system.
One control room is a copy of the control room in the
first unit at Barseback, which is a BWR (Boiling Water
Reactor) with one turbine. The other control room
will be a copy of the third unit at Ringhals, a PWR
(Pressurized Water Reactor) with two turbises. The
control rooms can only be used one at a time.
The power plants which are built or are planned in
Sweden are either of the BWR- or PWR-type. The
operating personnel at our power plants will be trained
at the simulator.
The BWR-simulator was used for the first time in
November 1974. The PWR-simulator is calculated to
be ready in 1977.
Unique possibilities for training
The plant process simulation is made by a medium
size digital computer. It has been programmed with
mathematical models from both the BWR- and the
PWR-stations. A smaller computer takes care of the
handling of signals between the control room and
the central computer. Each control equipment con-
sists of more than 600 isstrumentn, 5.000 lamps and
2.500 pushbuttoms.
The actual status of the simulated power plant is shown
on the instruments and the lamp signals. The trainee
can himself operate the simulator in the name way an
the power plant. The realism has been driven no far
that the trainee experiences the simulator as a real
plant. Even sound effects are simulated.
In order to make the trainee understand different
possible operating situations, many malfunctions are
imitated with the simulator. The sequences can be
simulated very slowly and be stopped completely.
That given the trainee time to study what has happened.
When the simulator then in operated at normal speed
the trainee can batter follow what han actually
happened.
PAGENO="1122"
C
cc
PAGENO="1123"
1119
btandlga Ovnlngar
Simulatorutbildning av driftpersonal sker i grupper om
2-4 personer. Vane grupp besOker Kärnkraftskolan
atskilliga gAnger fOr att repetera tidigare Ovningar och
fOr att trSnas i nya stOrningssituationer. Det gor att
personalen kan hAlla zig i topptnim i den rutinniassiga
dniften av karnkraftstationerna.
Training and retraining
The training of operating personnel at the simulator
takes place in groups of 2-4 persons. Each group
visits the Training Center many times to repeat what
they have learnt before and to be trained with new
malfunctions. That aids the personnel in maintaining
high ability and knowledge during the routine operating
of the power plants.
Data om datorn
RANK XEROX SIGMA 8
- ordlangd 32 bitar
- cykeltid 0.9 ps
- ktrnminne 64 k
- trumminne 1.5 M
PDP 11/05
- ordlangd 16 bitar
- cykeltid 1 ps
- karnminne 24 k
Facts of the computers
RANK XEROX SIGMA 8
- word length 32 bits
- cycle time 0.9 Ps
- core memory 64k
- drum memory 1.5 M
PDP 11/05
- word length 16 bits
- cycle time 1 ps
- core memory 24 k
Laromedeispaket
Driftpersonalens teoretiska grundutbildning sker vid
kraftstationerna med hjalp av AKUs sjalvinstruerande
lAromedel. Genom omsorgsfull utformning av text,
ijud och bild har erforderlig l8raninsats reducerats till
ett minimum.
Kursen omfattar: * Matematik * Fysik * Reaktor-
och StrAlningsfysik * Kärnkraftteknik
Dc tvA sistnämnda delarna finns Even i fOrkortade
versioner.
LEromedlet har producerats av AKU p8 faktaunderlag
frAn experter mom kraftindustrin. Flera hundra lEro-
medeispaket Er utplacerade vid kErnkraftstationerna.
Genom AKU frasntas aven andra lEromedel for anvgnd-
sing av kErnkraftindustrin i olika sammasthang.
Training package
The theoretic fundamental education of the operating
personnel takes place at the power plants with help of
AKU's self instructive training package. Through care-
ful arrangement of text, sound and pictures, it has been
possible to reduce the need of teachers to a minimum.
The training package contains four volumes:
* Mathematics * Physics * Reactor. and Health
Physics * Nuclear Power Technology
The two last mentioned are also produced in shorter
versions.
The training package has been produced by AKU based
on materials presented by experts in the power industry.
Hundreds of these packages have been distributed to the
power stations.
AKU also produces other programs for use by the
nuclear power industry.
PAGENO="1124"
1120
AS KARNXRAFFUTBILDNIMG
Studsvik
Fack
S-611 01 NYKOPING
SWEDEN
Te10155-60470
Telex 640 l3atergs
Iay~t~~LAI ~ ~
PAGENO="1125"
1121
Full-scale nuclear power plant training
simulator Bi
Reprint from ASEA JOURNAL 1978 VOLUME 51 NO. 5
PAGENO="1126"
1122
Full-scale nuclear power plant training
simulator Bi
Kenneth Randén, ABASEA-ATOM
Abe RulIgIrd, ASEA AB Plant Engineering Division
tJ.D.C. 621311.25 :621.039 :371693.4
ASEA Org. 7211, 973
An account is given of the full-scale
nuclear power plant training simulator
supplied by ASEA to AB KSrokraftut-
bildning (AKU Nuclear Posver Training
Center), with special reference en the
scope of the simulator, the hardsvare,
modelling techniques, genera) softsvare
principles and project implementation.
cold shutdown condition, heat the
systems to the operating temperatures,
start the turbine, syocheonise the
generator to the netsvork, in crease
the output to 100 per cent and return
the posver station to the cold shoe-
doom condition. For all these routines
the trainees follosv the same detailed
operating procedures as used in the
real nuclear power station.
* During training sessions with the
normal operating routines, the in-
structor can introduce malfunctions
of different degrees of complexity to
give the trainee the opportunity both
to reveal that a malfunction has nc-
This article on the nuclear poorer plaot
training simulator El discusses certain
special technical questions in conjunction
ss'ith the design and installation of the
simulator. For a more general descrip-
tion, reference should be made to the
article "Nuclear posver plant training
simulator" published in ASEA Journal
1977:1, pp. 20-21 and a p reseotalion of
the project in the article "Nuclear poster
plant training simulator for Swedish.
ittilities" published in Nuclear Engineer.
ing International, 1973:5, pp. 414-415.
Scope of the simulator
The simulator B1 is modelled on an
actoal plant, the BarsebAck 1 Nuclear
Poster Plane, svhich has an ASEA-
ATOM BWR with an electrical output
of 600 MW. For a simulator to be full.
scale, it is necessary that:
* Al) main systems in the nuclear power
plant, i.e., reactor, turbine, generator
ss-ith associated buses as svrll as plant
auxiliary syste mu monitored and con-
trolled front the control room are
simulated (see Fig. 2) by means of
mathematical ntodrls, svhich calculate
chains of events in the different sys.
* The simulator includes a replica of
the control room of the poster plant
represented in the simulator.
* The working range of thr simulator
is such that the operators from the
control room in ehe simulator can
stare up the "power station" from the
Fig. 1. Hardware conliguralias ol the Bi simulator.
Main compatet Sigma 8
PAGENO="1127"
1123
1-Lu
I
LJTLIJ'LLJ LIII
_ Lu1- L Lu
LJLE
_ L~L
Fig. 2. Systems simulated in the Bi simulator.
curred and to take suitable measnees The architecture of the computer system
to eliminate or reduce the effect of allocation of consmonication sigisals,
tlte nralfunction on the operatiots of program functions, etc.) and detailed
the power station, principles )svoed letsgth, floating arith.
* The B! simitlaror incitrporates for mrtic, etc.) have proved to be highly
this purpose about 100 niajor nual- suited for the tasks of the simulator.
futtctions coveringass'idesprctrunt The calcuilatiuins nsade its advance of the
such as cotstroller failitres, pipe leaks, necessary capacity of the systeiss turned
pump failures, etc. In addition, it in- our to be valid doting the isoplrmen-
corporatesa thousand or so simple tation of the peoject.
plant failures such as stuck instru-. From the operational point of viess'
metses, false alarm signals, etc., svhich the simulator is designed for a total life
may be introduced at any time and of 80,000 ho ties ssith p reveti tise mainten-
in different combinations during the ance of 4 hours per svcek. The simulator
training sessions. cas be utsed cotsuiusueosly, except during
the p reveit tive maintenatsce, and has
been tutu in this matinee since the begin-
ning of 1976 svith good experience of
the availability. Up to nose this has been
- I close to 100 p er cent. The design MTBF
mu a or ar ware Mean Time Betsveen Failures) of 80
Fig. 1 shows the configuration of the hours has been achieved by a good
simulator hardware, where the main margin.
perfurmance figures of the equipment Very great importance has been at-
have also been given. Figs. 3 to 5 illus- tached to the develupnuetst of efficirnt
trate the actual hardware, namely the troubleshooting progrants as svell as to
control room, I/O system and instructor' s ease of maintenance with good access
cuesole, for servicing. A very high plant engineer-
ing standard also contributes to the good
results obtained.
Mudriling techniques
By niodelhing technique is meant the
methud used for the mathematical de-
scription of the posver station systems
to be reproduced by the simulator. These
mathematical descriptions subsequently
form the basis of the programming of
the simulator's computer equipment.
The modelling techniques used for a
few typical and important subsystems
will be briefly described in the follosving.
Core model
The core model comprises four major
building blocks,
* The hydraulics model, which rep-
resents the water/steam flow through
the cute, upper plenum, downcomer,
eecirculation pumps and lower pie.
LIlil LII~Th :-~. 4
~-LI]
PAGENO="1128"
also includes diesel-generator srts and
gas turbines for emergency pusver, svhilr
thr frequency and voltage of the external
nrtsvork are represented by a simple
model.
A `dynamic model, based on a full
a.c. load solution, is used. Individual
loads, primarily pomp loads, are summed
for each bus. The 30-bus nrtsvork is
reduced to a 6-bus admittance matrix,
svhich involves only the six generator
General softsvare design principles
The simulator softssare system com-
prises three major blocks:
* Plant models, svhich simulate the
functioning of the various subsystems
of the nuclear posver station, such
as core, turbine and electrical system.
* Instructor's system, ss-hich isasprcifio
simstlator function and svhich enables
the instructor easily to control and
supervise the training in the simulator.
* Front-end computer programs, vs-hich
ensure that signals from the control
room are fed to the model programs
and that computed values are trans-
mitted to the control-room instru-
mentation and indicators.
A goal daring the design of the soft-
svare has been to apply as far as possible
standard system softss'are (operating sys-
Fig. 3. Conlrol room br lhn Bi simulalor.
1124
num, is based on conventional thermo- these~strms, e.g., valves, pumps, heat
dynamic and hydraulic equations, exchangers, filters, arc individually rep-
* The fuel model, which represents is resented so that the simulator represen-
typical furl rod, svhere the rod is tation still be isomorphic svith the systems
dis'ided into tsvu circular regions, is in the real plant. Pipe flo:v resistance is
based on standard heat conduction, lumped svith the fluu~ rrsis~ncr in some
equations for calculating the fuel suitably selected valve, `The model en-
temperature. crises us inputs buundary p restore, in-
* The nuclear model cunsists of tss'o , coming flosv and flu svrrsistance for
parts: a point `kinetics model with each component. It then calculates the
tsvo groups of delayed neutrons for pressure and flosv distribution in each
calculating the nuclear power and a system. Pressure losses are generally as-
three-dimensional "nodal model with tamed no be proportional to the square
120: nudes for simulating the posver of the flow. Temperature distributions
distribution in three dimensions in in th essstems are obtained by using gen-
the cure. The point kinetics modrl is real routines for heat evch angers and cal-
used to calculate fast power changes culation of floss' miving in pipe branches.
in conjunction svith, for example,
reactor scram. During such `transients
the posver distribution in the core
isassc med to be constant during 1
intervals, which are the updating fee- Turbine nude!
quency for the poster dsstrubutson
in the there-dimensional nodal model. The tssrb:ne is represented by a three-
This division of the model is a com- time-constant model (HP turbine, re-
promise brtsvrrn the computing time heater and LP turbine). The model is
assd the computing accsseac, svhich similar no that normally esed in posvrr
gives the necessary rca lism in the system stability studies.
simulator, also during manual control
Anxili.ur'v electrical goner model
Hydraulic ovatems strudel is ~e~t~?n g:rat derail on the con-
A general hydraulic model is used to trol boards of the Bl simulator. About
simulate a large no mber of hydraulic 30 buses on the 400 V level and above
systems in the plant. The components in are individually modelled. The model
------`l ~-:::::::~:---:
n
I
I
PAGENO="1129"
tems, compilers, etc.) and to perform as
much as possible the programming in
a high-level language (FORTRAN IV).
It also proved possible to achieve this
to a great extent, which has been one
of the contributory reasons why the soft-
ware design could take place within the
given resource frameworks and only a
few problems were encountered with the
system software.
In general all dynamic models, except
for the electrical auxiliary power system,
have been written in FORTRAN IV,
which facilitates modification of the
models in the future. All nsodels for the
plant logic and the front-end computer
programs have been written in assembly
language.
Anothtr design goal has been to rep-
resent, whenever possible, plant func-
tions by software rather than by tied-
ware, i.e., all functional relationships
have been calculated instead of, as in
certain other simulators, being represented
by components identical to those in the
power station. Consequently, in the B1
simulator only the front of the control
boards is identical with corresponding
equipment in the power station. This
principle has naturally resulted in a
rather heavy load on the computer system
On the other hand, a high degree of
flexibility has been achieved with regard
to modifications, which will be necessary
to a certain extent in the future to adapt
the simulator to modifications in the
simulated nuclear power plant as well
as to modifications required foe training
reasons. This "software before hardware"
principle has made it possible to represent
a vast amount of simple plant failures,
as mentioned earlier.
The models calculating the responses
of the plant systems to actions executed
in the control room are divided into tsvo
groups, svhich are eon through five times
and once pee second, respectively. The
software of the "fast group" remains
resident in the core memory, svhile the
other programs are stored on a disc
memory and read into the core memory
during execution. All such model pro-
grams are processed in the central com-
puter (type Sigma 8). The task of the
frost-end computer (type POP-Il) is to
administer the transfer of signals betsveen
the control room and the centeal com-
The front-end computer programs scan
at a rate of about 10 cycles pee second
the signals from pushbuttons and other
controls in the control room and period-
ically feed signals to instruments and
indicators in the control room. The data
transferred by the front-end computer in
this way are stored in the data area of
the Sigma 8 core memory, This data area
constitutes the central data interface be-
tween the plant models, the instructor's
system and the front-end computer. In
addition to its basic I/O functions, the
front-rod computer programs handle cer-
tutu alarm pattern modes, sorb as fast
and slow flashing in the control room,
ceetain simple plant failures and
smoothing of signals prior to pteseo-
tation on instruments in the control room.
All these functions ssould otherwise has-c
to be performed svith tome kind of hard-
svare, e.g., loss-pass filters in each instro-
most for the sigital sttsoothing fonction.
Apart from the difficulties associated
svith the designing of these filters, this
woold have made the system less flexible.
In addition to the plant models, the
Sigma 0 corn potee contains the necessary
softsvaee foe the instructor's system, svhich
enables sIte instructor effectisely to con-
trol and supervise the traioiog in the
simulator. The insttrictoe communicates
svith the simulator via a graphic display
unit, svltich has a special input to the
central computer, kept separara frotn the
connection to the front-end computer.
This ~~rrangrwent has proved to be prac-
tical and efficient bath for the sofia-are
develupmeot and for the running ef the
simulator. Among the approximately 20
basic ft,uctions included in the itsstroc-
tot's menu cats be meittiotsed the fol-
losviag:
* Initial condition, svhich allow-s the
simulator to be started from any of
20 suitably selected standard initial
conditions within the normal svorkiog
range of the posver station.
* Start of the simulation.
* Freezing of the dynamic state ob-
tained until a start or ness initial
cundition is ordered.
1125
Fig. 4. Computer equipment and I/O system.
PAGENO="1130"
* Snapshot,. which means that an in-
stantaneous picture of th estatus of
the simulation is stored for later pre-
sentation during the following up of
the training session between the in-
structor and she trainees.
* Startlstop of simulated malfunctions.
* Logging on line printer or magnetic
tape of up to 20 parameters of in-
Project implementation
A full-scale simulator like the one
desmibed in this article is an extremely
complex and comprehensive system and
the project implementation has also been
affected by numerous problems, which
could not he foreseen and eliminated
in advance. Thanks to the system design
and the flexibility of the hardsvare, bose-
ever, the problems occurring could be
overcome. The delivery, even though it
n-as affected by some delays, enabled
she customer, AB Kiirnkraftusbildning
(AKU Nuclear Poster Training Center)
so utilise the equipment for the planned
training. This proved possible thanks to
~ the testing and commissioning in stages
of rIse functions required for the training
A special problem was the testing of
certain malfunctions, sshich can be rep-
resented in the simulator, because com-
paratise data from nuclear poster stations
in operation were not available.
Another problem stan experieneed when
modificarinns were introauced in the
nuclear poster station after the simulator
functions had been specified. Such modi-
fications can naturally be introduced in
the simulator software, but take their
time. This has resulted in some delays
in the original delivery schedule.
Conclusion
Finally, it should be stressed that a
project of this size and complexity is
specially helped by close co-operation
betsveen the customer and the supplier
during the development and delivery of
the simulator. Such continuous co-oper-
ation helps the customer during the
take-over of the simulator since know-
ledge of the system, its structure and
functions is gradually and systematically
built up within his orgunisotinn.
1126
Fig. 5. Inslruclors console for the Bi simulator.
6
PAGENO="1131"
rn ~ D ~
CD
--~.-~ -C ~CDCD-~
~ -~ CD CD -1 ~ CD CD
CD -~-OCD CD CD (*CDCD
CD CD (~) DC -~ 0. 0 CD -~- 0 CD CD
CD 0~ 1 CD
-~
~CJ)Z
9
~:~h!~ j~
~ ~ ~
PAGENO="1151"
1147
SUBCOUMITTEE ON ENERGY RESEARCH AND PRODUCTION
QUESTIONS FROM MAY 24, 1979, HEARINGS ON NUCLEAR POWER PLANT SAFETY FOR ADMIRAL H.G.
RICKOVER, USN, DIRECTOR OF NAVAL NUCLEAR PROPULSION PROGRAM.
1. In the testimony, both you and Dr. Low stressed the need for personal respon-
sibility in the design, construction and operation of your systems. How can
this be achieved in commercial nuclear power plants?
2. Should the control room operators be employed by the utility or by some other
agsncy?
3. Discuss the need for a nuclear safety Czar" and the scope of his responsibility.
4. Discuss the benefits of standardizing the design of nuclear power plant control
rooms and their instrumentation and display systems.
5. Describe how.the experience and approach of the Naval training programs can be
applied to improving the training of commercial power plant operators.
6. Should there be a new and independent agency responsible for training nuclear
power plant operators? What can DOE contribute?
7. In your testimony, you mentioned that naval reactors are designed to be in-
herently stable under all "normal transient" conditions. Should this be a
basic requirement for all commercial reactors?
8. Are there any reasons for not having direct reading instruments for all the
most important parameters? Discuss the merits of a direct reading instrument
for indicating the level in pressurizers.
9. Should all monitoring systems be such that they indicate that the control
function has been performed, rather than that the command signal has been
sent to the device in question?
10. How can a utility ensure that it retains a "long term or permanent staff"?
How important is it to have permanent staff? .
11. Discuss the need for redundent systems in nuclear power plants.
12. What are the costs for training the various types of Navy nuclear propulsion
operators and supervisors?
13. How can computers and microprocessors be used to assist in the normal opera-
tion of nuclear power plants, and in operations under emergency conditions?
PAGENO="1152"
;~ ~
DC ~~D( DC
~ ~-pLfl~-pCD~
~< -4~OOCD~< -S
~
-C~ CD OC-P4C 0
o VCC+CD 0
-S +O~Cfl1
~< OCD -1)0
o 0C*~0CDS
CD (fl~~-1-P0
5 -CD0~<<
-5<
o
0 ~C+ CD(CD
CD -0CD CD
C~ 0~-~ 1\)VC
o D(CDC.
CD 050 CD
CD 0 CD ~J 0
15C (1(5
CD 0 D o 0
CD(-P0 rP
CD
CDCD (fl5
CD-~ ~CD
000(0
Q CD CD
CD0CD
-J or)CD
(0 DC -Cs DC 0
(~ o~.
01USD)
~+ CD CD
~ -~ 0
~ Si) DC (0
C+ -s CD
-<-1
o CD -or-
5CD0~
N) 05
01 OUS
o C+
rP
C~
cx
A
0
C
US
11(1
P1
P1>
~D `~flflJ~~J II
PAGENO="1153"
1149
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
HEARINGS ON NUCLEAR POWER PLANT SAFETY
ADDITIONAL QUESTIONS FOR DR. G. M. LOW
1. Expand upon your comment that experienced control room operators should
be used to assist in the design of the control room and the control room
instrumentation.
2. In your testimony you mentioned that NASA did their own reviews and that
there was "nobody looking over your shoulder". How could this be applied
to the design, construction and operation of commercial nuclear power
plants?
3. In the testimony, both you and Admiral Rickover stressed the need for
personal responsibility in the design, construction and operation of
your systems. How can this be achieved in commercial, nuclear power plants?
4. Expand upon your comment that in the NASA programs experienced operators
assisted in writing the training programs. How would this be applied to
commercial, nuclear power plants?
5. Should the control room operators be employed by the utility or by some
other agency?
6. Should there be a Nuclear Safety Czar?
7. Would there be any benefit in standardizing the design of nuclear power
plant control rooms, and their instrumentation and display systems?
8. Would it be reasonable to require that a utility be entirely responsible
for the design, construction and operation of nuclear power plants?
9. Should there be a new and independent agency responsible for the training
of nuclear power plant operators?
10. List your recommendations for the educational qualifications of nuclear
power plant operators.
PAGENO="1154"
COMMITTEE ON SCIENCE AND TECHNOLOGY
U.S. HOUSE OF REPRESENTATIVES
SWTEZ3Z1 RAY URNHOAJ$EorncEeJI~NG
WASHINGTON, DC. 20515
June 19, 1979
Dr. Ingemar Ti ren
Manager
Nuclear Safety and Licensing
(ASEA-ATOM)
P. 0. Box 53; S-72104
Vasteras, SWEDEN
Dear Dr. Tiren:
Thank you very much for attending our Subcommittee hearings on Nuclear
Power Plant Safety. Your testimony was indeed very valuable and it was
awfully kind of you to come all the way from Sweden to give the Sub-
committee the benefit of your experience.
During the hearings on May 24, 1979, you indicated that you may be able
to provide the Subcomittee with responses to a number of questions, to-
gether with other additional information. I have enclosed a list of
questions and I would be grateful if you could find the time to respond
to them. by July 13, 1979.
On behalf of the Subcommittee, I want to thank you again for coming to
Washington and for providing an invaluable contribution to our under-
standing of nuclear power plant safety in terms of your own unique
rational perspective.
MM/wm
MIKE McCORMAC
Chairman, Subcommittee on
Energy Research and Production
1150
Enclosure
PAGENO="1155"
1151
SUBCOMMITTEE ON ENERGY RESEARCH AND PRODUCTION
Questions from May 24, 1979, Hearings on Nuclear Power Plant Safety
for Dr. Ingemar Tiren, Manager, Nuclear Safety and Licensing, ASEA -
Atom, Vasteras, Sweden.
1. Please describe the `3D minute. rule that you mentioned in your
testimony.
2. How does your N-2 rule jiffer from present U.S. practice. Can it
be applied to U.S. nuclear power plants presently in operation?
3. Describe the `SECURE' reactor system in which a core melt is an
"not a possible event."
4. Please send us a description of the "Shift Change Procedure" which
is representative of present Swedish practice.
5. Please expand upon your comments regarding Sweden's plans for the
future use of coal.
6. Describe the Swedish program for training nuclear power plant operators.
7. Would there be any benefit in having the assistance of experienced power
plant operators during the design stages of control rooms and control
panels? Is this done in Sweden?
8. Do you believe that it is reasonable for a utility to be entirely
responsible for the design, construction and operation of nuclear
power plants?
9. Describe any significant differences in the control, instrumentation
and monitoring systems of Sweden and the U.S. regarding power plants.
10. Are there any significant differences in the educational requirements of
Swedish and U.S. power plant operators?
PAGENO="1156"
1152
SWEDISH EMBASSY ~~ESS :~:~~::~PE AVE N
OFFICE OF SCIENCE AND TECHNOLOGY USA298
TELEPHONE (2oz~C.~I~C
June 15, 1979
Congressman Mike NcCormack
Chairman, Subcommittee on Energy
Research and Production
Committee on Science and Technology
U.S. House of Representatives~
Suite 2321
Rayburn House Office Building
Washington, D.C. 20515
Dear Congressman HcCormack: 13-9172
It was an honour for Dr. Tirén and myself to appear before
your subcommittee on~prt~l 24, on your hearings about
Nuclear Reactor SafetyY~~l_~
Dr. Tirén has asked me to transmit the attached supplemen-
tary responses to questions raised by members of your
subcommittee. These clarifications may, if you so wish
be included for the record into the testimony.
Sincerely yours,
Q~L~
Lars G Larsson
Attaché
Science and Technology
LGL/ms
end.
PAGENO="1157"
1153
Swedish Embassy
Re Testimony before US House of Representatives, Committee
on Science and Technology, Subcommittee on Energy Research
and Production, May 24, 1979 by Dr. Ingmar Tirén,
ABASEA-ATOM, Sweden
tn response to questions during the testimony, please
supplement Dr. Tirén's verbal presentation by the following
comments.
to Congressman Wydler on question regarding the use
of check lists in Swedish nuclear plant operation:
Swedish utIlity representative confirms that no formal
check list is used at dayly take-over from one shift to
another. The shift engineer keeps record of notable items.
He passes on this information to the next shift together
with an oral and informal exchange of information. The
list of notable items is kept up to date by the shift
engineer in charge.
~p~y to CongressmanErtel on question regarding the
possibility of a release of contaminated water from the
reactor containment to an auxiliary building in Swedish
plants, assuming accident conditions similar to those
that occured in TMI unit No. 2:
This is a question related to design details. The design
principle of any plant is to provide containment isolation
whenever there is an indication of a risk for radioactive
contamination of the athmosphere or the water inside
containment. With regard to details, I can only reply with
respect to the ASEA-ATOM boiling water reactor (BWR) plants.
In these plants no transfer of water from the containment
to an auxiliary building takes place during abnormal
conditions. There are situations in which water is extracted
from the containment pool by means of pumps located outside
containment. However, in such situations the water is fed
back into the reactor containment in a closed loop.
In ASEA-ATOM plants the reactor containment is isolated
upon the automatic actuation of signals indicating high
pressure `or high temperature inside containment. Thus we
do not rely on a high pressure condition only.
PAGENO="1158"
0
CD
CD `(