threemileislandVOLUMEA REPORT TO THE
COMMISSIONERSAND TO THE PUBLIC

I

VOLUME

A REPORT TO THE
COMMISSIONERSAND TO THE PUBLIC

I

mitchell rogovindirectorgeorge t. frampton,jr.
deputy director
NUCLEAR REGULATORY COMMISSION
SPECIAL INQUIRY GROUP

contents
staff of the special inquiry groupvii

forewordix

three mile island: an introduction
narrative of the accident

1. "Turbine Trip-Reactor Trip"
2. The Relief Valve (PORV) Sticks Open
3. The Core Is Uncovered-Site Emergency
4. General Emergency
5. Hot Legs, Cold Legs, and Incores
6. ' Lynchburg-"We're Just In the Dark"
7. The Federal Presence Could Not Be More Discreet
8. "My God, Who Is Watching the Store?"
9. The Thud
10. Met Ed and the Media
11. The Pump Is Bumped
12. It's Coming Through the Walls
13. Thursday-The Interlude
14. Evacuation-"What Are You People Doing to Us?"
15. The Utmost of Caution
16. The Hydrogen Bubble Scare
17. The President Comes to Middletown

conclusions and recommendations

Summary
1. Systematic evaluation of Operating Experience andI mprovement in the Regulation of Operating Reactors
2. Strengthening the Onsite Technical and Management
Capability of the Utility: Improved Operator Training
and New NRC Requirements for Qualified Engineer
Supervisors on Every Shift
3. Chartering of a National Operating Company or Consortium
4. I mproved NRC Management and Reorganization to aSingle Administrator Agency; Establishment of an
I ndependent Reactor Safety Board
5. Greater Application of Human Factors Engineering,
I ncluding Better Instrumentation Display and Improved Control Room Design

V

1

7

7
14
16
23
30
33
35
39
42
44
46
48
53
59
68
77
85
89

89
94

102
109
112
122

6. More Remote Siting and Improved Emergency Planning, Including Workable Evacuation Planning as a
Condition of Reactor Operation
7. Overhaul of the Licensing Process: One-Stage Licensing, Increased Standardization, Increased Use of Rulemaking, Establishment of an Office of Public Counsel
and Intervenor Funding
8. Improvement in the Bases for Safety Review of Reactor
Design and Increased Use of Quantitative Risk Assessment Techniques
9. Health Effects from Radioactive Releases During the
Accident, and Occupational Health Physics at the Site
10. Information Made Available to the News Media
11. Sabotage, Bribery, and Coverup
12. Disincentives to Safety

epilogue

APPENDIX A: History and Conduct of the Special Inquiry
Group's Investigation
APPENDIX B: A Short History of the Nuclear Industry

vi

129

138
147
153

156
158
161
167
173

179

staff of thespecial inquiry group*Mitchell Rogovin, Esq., Director*George T. Frampton, Jr., Esq., Deputy Director
E. Kevin Cornell, Ph.D., Executive Staff Director
Richard C. DeYoung, Deputy Executive Staff Director
Robert Budnitz, Ph.D., Technical Coordinator
Patricia Norry, Administrative Coordinator

Task Groups

1. Preaccident background
Leader: William Parler, Esq.
Frederick Hebdon
Wayne LanningDavid Gamble

Thomas Cox
Harold Ornstein, Ph.D.
David Evans, Esq.

2. Description of accident sequence-reactor plant performance
Marion Picklesimer, Ph.D.
Leader: William Johnston, Ph.D.
Evangelos Marinos
Mark Cunningham
Gordon Chipman

3. Description of accident sequence-radioactive releases and exposures
Ronald Bellamy, Ph.D.
Leader: Frank Miraglia
Lewis Battist, Ph.D.
Shlomo Yaniv, Ph.D.
Paul Murray
Oliver Lynch
4. Emergency response of the utility
Leader: Ronald Haynes
Dennis Allison
Harry North
James Snell
5. Emergency response of the NRC
Leader: Robert Bernero
Joseph Scinto, Esq.
Ralph G. Page

Hartmut Schierling
William Foster
James Creswell
Jacque Durr
George Rivenbark
Peter Sicilia

6. Emergency response of Federal and State agencies
Robert Schamberger, Ph.D.
Leader: Malcolm Ernst
Lawrence Crocker
Donovan Smith
Frederick Herr
Donald Clearyvii

I nformation Services

Lawrence Vandenberg
Deborah Hodges

Leader: Richard Hartfield
Myrna Steele

Attorneys

Consultants

Legal Assistants

Writing and Editorial*Charles 0. Miller*Bernard C. Doyle*Walter Murfin*Michael Woram*William G. Ballaine, Esq.
*Robert Chin, Esq.
*John Dienelt, Esq.
*Fred Folsom, Esq.

*Russell Sackett*Barry Horvick*Joseph Kuchta*Carla D'Arista*Evan Miller*Mary Ellen Mallonee

Editorial*David R. Boyd, Esq.
*Susan L. Carney, Esq.

Support Staff

Ann Haikalis, Executive Sec.
Patricia LaGrange, Executive Sec.
Margaret Custis (Group 1)
Kathleen Ruifrok (Group 2)
Marjorie Huddleson (Group 3)
Rhea Frazier (Group 4)
Kathryn Motley (Group 5)*Denotes non-NRC staff.

viii

Eileen Haycraft (Group 5)
Eileen Telford (Group 6)
Susan Cavanaugh(Administrative Aide)
Mary Potter (Information
Services)
Deborah Gray (Information
Services)foreword
Within weeks of the March 28, 1979 accident at Three Mile Island, the Nuclear
Regulatory Commission (NRC) decided to institute a Special Inquiry to review andreport on the accident. The principal objectives of the inquiry were to determine what
happened and why, to assess the actions of utility and NRC personnel before andduring the accident, and to identify deficiencies in the system and areas where further
investigation might be warranted.
The work of the Special Inquiry was not intended to duplicate the efforts of the
President's Commission on The Accident at Three Mile Island. It was designed toenable the NRC to fulfill its regulatory responsibilities by achieving the fullest possible
understanding of the accident, both from a technical point of view and from thestandpoint of how the NRC's own regulatory processes functioned.
Recognizing the potential conflict of interest problems involved if the inquiry weredirected and undertaken solely by NRC staff, the Commission in mid-June 1979
contracted with our law firm, Rogovin, Stern & Huge, to conduct the inquiry, specifyingthat it would have full independence in carrying out the work. Neither the law firm nor
any of its members had any prior involvement with nuclear energy issues.

The bulk of the inquiry staff consisted of volunteer NRC professionals chosen for
their expertise in subjects to be pursued by the inquiry. Some of these individuals had
been with the NRC and its predecessor, the Atomic Energy Commission, for many
years; others were relative newcomers to the NRC from congressional staffs oracademia. To ensure the inquiry's competence and independence, we reviewed the
NRC staff members' professional qualifications and any prior involvement they had had
i n the accident or the licensing of the two reactors at Three Mile Island, so that we
could be alert to any possible conflicts of interest.
I n addition to NRC staff members, a number of technical consultants in the areas ofaccident investigation and safety management, and lawyers experienced in the
conduct of investigations were hired to assist the inquiry full time. Work was also
performed for the inquiry in several technical or specialized areas by nationall aboratories, by the National Academy of Public Administration (to convene an expert
Panel on emergency response), and by a firm expert in human factors engineering.

During the investigative stage of the inquiry, we conducted approximately 270 formal
depositions under oath. Those deposed included the five commissioners of the NRC,
dozens of top NRC staff officials, the management of both the utility company that
operates Three Mile Island and the reactor's manufacturer, and the control roomcrews. In addition, we had access to the transcripts of interviews and depositions taken
by other investigations, including the President's Commission and the NRC's own
enforcement investigation, and we conducted hundreds of additional interviews
ourselves.
ix

I n a further effort to improve the quality of our inquiry and to ensure that we would
not be "captured" by the staff, the personal views of some 21 outside consultants
expert in the field of nuclear safety were sought on the intended course of the inquiry
and its final product. These consultants, from universities, national laboratories,
i ndustry, and the public interest sector, were chosen not only for their knowledge andjudgment but also for their wide spectrum of views. They met with us in teams of three
to six early in the inquiry to examine our work plans, and again near the end of the
project to comment on draft sections of our final report; each responded in detail to adraft of our proposed conclusions and recommendations. Our understanding withthese consultants from the beginning was that they would not be solicited to "endorse"
our conclusions, but rather to educate us and to criticize our effort in order to help us
i mprove it.
While our inquiry was specifically focused on the accident at Three Mile Island, wewere asked to reach conclusions and to make recommendations with a broader sweep
than the accident itself. Since "extrapolation" has been recognized to be "the fertile
father of error," we wish to point out at the outset that where we do makegeneralizations about the industry as a whole, there are notable exceptions. We hope
the reader will bear this in mind.

I n any project such as this Special Inquiry, where the combined talents of some 70
nuclear engineers, scientists, lawyers, and investigators have been blended together
with a large number of outside consultants, it is most important to make clear where
responsibility lies for the conclusions and recommendations found in these volumes.

We have had the benefit of a superb technical staff. They have unstintingly given us
an unmatched level of excellence, as have our 21 individual consultants. Without their
hard work and the quality of their contributions-indeed, without the unique interplayof diverse viewpoints to which we have had the good fortune to be exposed during thisi nquiry-this report would not have been possible. While all these talented people haveguided us through the rocks and shoals of an extraordinarily technical inquiry, in theend we must take sole responsibility for the report-and particularly for theconclusions and recommendations, which are ours and ours alone. We hope they areobjective, informed, and clear.

Finally, a note about the organization of this report. For years, the nuclear energy
debate was carried on in this country by a relative handful of people. Three Mile Island
has changed that. The nuclear power issue has become riveted to the American
consciousness. Volume I of this report contains a narrative account of the accident anda discussion of our overall conclusions and recommendations. Volume II contains moredetailed factual and technical material, from which Volume I is drawn in large part.
The narrative account of the accident in Volume I is written in an open, nontechnicalstyle in the hope that it will be widely read and will encourage the reader to examine theconclusions and recommendations that comprise the second portion of this volume.
Mitchell Rogovin
George T. Frampton, Jr.
Washington, D.C.
January 1980

Rogovin, Stern & Hugexthree mile island:
an introduction
As one looks downriver from where the Pennsylvania Turnpike crosses theSusquehanna, the four cooling towers rear out of the trees like an alien campground,
as abrupt and startling in their natural setting as the faces on Easter Island come upon
unexpectedly.
Barely a year ago, these towers were symbols of a still-promising nuclear poweri ndustry-an industry not without its problems, but one that did not despoil the air orland (unlike coal power, that mainstay of Pennsylvanian economies past), and that
exploited a fuel (unlike oil) readily available from domestic sources.
To the American public these towers have now become monuments to an epic
i ndustrial accident, if not, as some would insist, headstones over the grave of thenuclear industry itself, which in the end may become the accident's only victim.

4

r

~.

Shorn of its northeastern geography and certain eerie coincidences of timing, theaccident at Three Mile Island might well have been relegated to 30-second shots on the
network news and inside pages of the metropolitan dailies-a significant disaster inwhich no one died, in an industry few understood. Fortune decreed otherwise. Like
certain other functional structures on the modern American landscape-the bridge at
Selma, Alabama; the Watergate complex; the Texas Schoolbook Depository in
Dallas-the towers at "TMI" have slipped into an unprojected half-life as reminders ofsteep depressions in our national lifeline. Tourists drive by slowly, pan over theircontours with 8-mm movie cameras, or just stand looking at them. Three Mile Island is a
big deal; something important happened here.
From its placid beginnings, the nuclear facility at TMI had seemed an unlikely setting
for any kind of tragedy; partly for this reason, the accident, once it occurred, wasmonumentally conspicuous.

The island itself sits at the center of the historic Susquehanna Basin, breadbasket ofcolonial America. William Penn exulted over its "fast, fat earth;" even today the basin's
farm acreage is among the Nation's most productive. Not far is the heart ofPennsylvania Dutch country. (State emergency authorities, contemplating evacuationof the area in the spring of 1979, would face special problems in getting word to Old
Order Amish farmers, whose resolute disdain for contemporary trappings extends to

From Goldsboro's tree-lined streets, the cooling towers of Three Mile
Island just above the horizon.

telephones and radios, the nervous system of emergency management.) To this day,the region still steeps in the passions of the Founding Fathers; the cities of York and
Lancaster take quiet pride in having served as interim capitals of the American
Confederation during the months in 1776-77 when the British occupied Philadelphia in
the wake of the signing of the Declaration of Independence.
The Susquehanna Basin is, in short, a conservative, self-assured part of the country,
and Metropolitan Edison (Met Ed), the regional power company, had long been a partof it-a low-profile, middle-range utility solicitous of its shareholders and concentrating
its modest public relations efforts, in the manner of wise utility companies through theages, on the State legislature. Since the capital, Harrisburg, is only 10 miles upriver of
TMI, the company's approach augured well.

I n 1946, Met Ed became a subsidiary of General Public Utilities Company (GPU),
whose engineering unit, GPU Service Company, would supervise the construction andpreoperational testing of the nuclear plant at TMI. Another subsidiary of GPU, Jersey
Central Power and Light, had built the first nongovernment subsidized commercial
nuclear powerplant in the country in 1963 at Oyster Creek, New Jersey.

Three Mile Island itself was much a part of the utility's tradition: Met Ed and its
predecessor had owned the island's 814 acres since shortly after the turn of the
century. Shaped like a sort of stretched-out amoeba breasting the river's north-tosouth currents, the island's alluvial soil was leased for farming at various intervals in its
history. It always was favored by fishermen, picnickers, birdwatchers, and collectors ofIndian artifacts. Until Met Ed built a small hydroelectric dam on its eastern side, there
was nothing linking the island to the mainland; it was reachable only by boat and barge.
When the power needs of the region expanded and Met Ed announced it intended tobuild a big nuclear facility on Three Mile Island, the new development came as noshock. Preliminary hearings were virtually devoid of rancor; there were no charges ofl andgrabbing, no residential dislocations. Some farmers and dairymen were apprehensive about the possible effects of radioactive releases from the plant, but this seemed
hardly more ominous than the potential smog and soot from a fossil fuel plant.

The area could use the electricity, and the payroll assuredly was a welcome infusion
i nto the economy. There was little fear of a domineering corporate presence incommunity affairs. The huge plant, when completed, would be run by engineers andtechnicians, mostly young, many of them recent veterans of Admiral Hyman G.
Rickover's "nuclear navy." These people ranked well down the corporate ladder at
Met Ed, whose executives had their offices in company headquarters at Reading. The
superintendents, supervisors, foremen, and operators at the future plant would be
preoccupied with their jobs, not with regional politics. As citizens, they would be fineadditions, tending to mow their lawns, mind their business, pay their taxes, and support
public institutions.
For the neighbors who objected to the plant on esthetic grounds, there was notmuch anyone could do except learn to love the four 350-foot towers. They werebeyond camouflage-huge, skyblocking pots, each seemingly capable of holding asizable arrangement of giant redwoods.
A more practical concern was the hazard implied in situating a nuclear installation ina line 2.5 miles off the south end of the runway at the new Harrisburg International2

Airport, opened after the first nuclear unit for the island, TMI-1, was announced. Yet
the towers were the only real navigation hazard. All the nuclear activity would be taking
place in the squat containment buildings, shaped like concrete pressure cookers. And
these were designed specifically to withstand the direct impact of a 200,000-lb Boeing
727 jet flying at 200 knots.

There were other reassuring features of TMI, quite apart from its being built by a niceold power company and run by nice young men. The TMI reactors themselves would bedesigned and built by Babcock & Wilcox (B&W), a pioneer in the power generation
business. B&W's reactor simulator was available for operator training at its plant in
Lynchburg, Virginia. A B&W representative would be in residence at the TMI facility,
and its staff nuclear experts were always within easy call.

Finally, Harrisburg was close enough to guarantee that State officials would have avery personal interest in seeing to it that TMI was run well within the regulations. Alongthose same lines, there was further assurance in the nearness of the Federal Nuclear
Regulatory Commission: the NRC's Region I office was just 80 miles east on the
Turnpike in the Philadelphia suburb of King of Prussia, Pennsylvania. The NRC's
headquarters offices were scattered around Bethesda, Maryland, a 2 1/2-hour drive;and the offices of the NRC commissioners-for that matter, of the Congress and thePresident of the United States-only another 30 minutes on into Washington.
In short, there was the comfort of knowing that any prudent utility situated this close
to all that surveillance would be running a taut ship. Or so went the conventional
wisdom.

The TMI plant presented a serene picture indeed, when set alongside several of its
beleagured brethren caught up in the boiling environmental concerns of the lateseventies. If the major nuclear accident that opponents of nuclear power freely
predicted, and the industry's own oddsmakers admitted was possible, were going tohappen, it would hardly happen here.

Hindsight, of course, brings reality more clearly into focus. Long before the accident
at Three Mile Island, there was a high bravado quotient widespread throughout thei ndustry and its regulators. Licensing procedures were not entirely adequate, giving
rise to deficiencies in some plant designs. Operator training was totally inadequate for
emergencies, and poorly monitored. Control rooms were often designed with precious
little attention to the operators' needs. The lessons learned from malfunctions andmistakes at nuclear plants both here and abroad were never effectively shared within
the industry.

Preparations for emergency response to a nuclear accident-in the industry, the
NRC, the Commonwealth of Pennysylvania-were incomplete, untried, haphazard, or
nonexistent. Here as elsewhere, nuclear Cassandras, no matter how compelling theirpredictions, were brushed aside with recitations of the industry's 400 reactor-year
safety record, which at that point no one denied was impressive. Early in March 1979,
the York, Pennsylvania Record, a daily newspaper, ran a four-part series citing unsafe
conditions at Three Mile Island's Unit 2. It was summarily dismissed by Met Ed
President Walter Creitz as something less than a patriotic act-comparable inrecklessness, Creitz said, to shouting "Fire!" in a crowded theater.
The accident at TMI-2 began just a few days later at 4 a.m. on March 28. A minor
malfunction, or transient, in the nonnuclear part of the system would evolve a series of3

automated responses in the reactor's coolant system, and during all of this, the relief
valve on top of a piece of equipment called "the pressurizer" would become stuck
open. Owing to continued misreading of the symptoms by the operators over a
2 1 /4-hour period before the relief valve was closed and the turning off of an automatic
emergency cooling system, the reactor core would become partially uncovered andseverely damaged. It would be another 12 hours before the plant crew and theengineers from GPU Service Company would concur in effective corrective action. And
that was but the beginning.

At the same time, as luck would have it, a movie called The China Syndrome, starring
Jane Fonda, was being introduced at theaters all over the country. It was about anaccident at a nuclear powerplant, and the efforts of a venal power company to hide thelikelihood of the reactor core melting through the steel-lined concrete bottom of its
containment and into the earth, possibly releasing enormous quantities of radioactive
matter into the environment. The film, though fictional, was produced with great
attention to technical detail; it was-thanks only in part to the events at Three MileI sland-well and widely reviewed, endlessly promoted and quoted in the media.
The cumulative effect of the film on the public perception of the accident at TMI is
i mmeasurable. That it sensitized many readers and watchers, as well as reporters,
editors, and commentators, to the implications of a nuclear accident and the possibilityof a core melt is a thesis almost beyond argument.

The location of Three Mile Island within easy reach of the New York and Washington
media centers also guaranteed immediate and massive attention from the wire
services, networks, news magazines, the New York Times, the Washington Post, andall the other dailies, as well as the U.S. bureaus of most of the foreign media. TMI was
equally accessible to cities like Philadelphia, Chicago, and Boston, homes of big daily
newspapers whose readers also live within the shadow of nearby nuclear powerplants.
I n short, the threat of a nuclear disaster at a powerplant on the very doorstep of thenortheastern megalopolis, in the teeth of recent energy-environmental arguments overnuclear power generation, almost guaranteed heavy news coverage under any
circumstances. Add a hit movie about a plot to conceal a pending nuclear disaster, with
Jane Fonda as a reporter out to uncover the plot, and the result is a media stampede.
By the third day of the accident, an estimated 400 reporters jockeyed for leads andangles at the TMI site, many if not most of them meanwhile trying desperately to cut
through the jargon and acronyms of the industry for a simple understanding of what
was going on and what might happen-and where everybody would run if it did.
It was not always enlightened journalism, but there was lots of it, and in the midst of it
all, the nuclear industry was abruptly stripped of whatever mystique it had left from theold days of the Manhattan project. When the operators at TMI-2 misread the accident
symptoms; when the plant's designers failed for another whole day to correct thediagnosis; when the NRC regulators came on the scene, floundering as they tried to
discover what had happened, it all took place before a packed house. And in
retrospect that was probably a good thing.
Instances of inadequate research, inaccuracy, factual cornercutting, and overkill
marred the performance of some of the newspeople. But the story that got out was4basically pretty straight: this was a serious and avoidable accident. It could have beenmuch worse. It could have happened in a lot of places.

Barring basic changes in the industry and the way it is regulated, it could happen
again. The fact that it happened here at Three Mile Island, in the glare of media
spotlights, may be the best insurance that it will not recur.

5arrative of theudent
1 "TURBINE TRIP REACTOR TRIP"
I t is approaching 4 a.m., the downhill side of the graveyard shift, and four operators
are moving through the routines of Unit 2 plant on Three Mile Island (TMI-2). This is abillion dollar facility, and just now it is under the complete control of this youthfulquartet, all high school graduates and, coincidentally, all veterans of the nuclear Navy.
Control room operators Craig Faust and Edward Frederick are quietly monitoring andmaking adjustments at the more critical of hundreds of instrument indicators in thebrightly lighted control room.

I n a glass-enclosed office at the rear of the control room, partially obscured from theoperators, William Zewe, Shift Supervisor for both Units 1 and 2 at TMI, is trying toovertake his paperwork. Zewe is a licensed senior operator, qualified to run either unit.
Hardworking and respected, he is most often to be found close by the newer
i nstallation these days: Unit 1 has been shut down for refueling and is preparing forrestart later in the day.
Since it first "went critical" (started up) exactly 1 year before to the hour, Unit 2 hasbeen bedeviled by a series of mishaps-mostly minor, but troublesome. It has beenrunning reasonably well, however, since it went into commercial operation on
December 30, 1978, and is now at 97 percent of maximum power.

Down in the maw of the turbine building, Shift Foreman Fred Scheimann, the fourth
licensed operator on hand at the plant, is toiling with Auxiliary Operators Don Miller andHarold Farst in an effort to unclog a "resin plug" in a pipe leading from an apparatus
known as the "No. 7 condensate polisher." Basically, the polisher is a water-softening
device aimed at removing stray minerals from the feedwater system. The agent foraccomplishing this is a resin that comes in the form of tiny beads about the consistencyof coarse sand. Occasionally, the resin becomes packed and clogs up the pipe. When
this happens, the resin must be "fluffed" back up with blasts of compressed air

Operators and supervisors on duty when the accident began were (fromright) : Craig Faust, Edward Frederick, William Zewe and Fred
Scheimann.

Steam pipes as big around as man-hole covers criss-cross the Unit 2
turbine building.
bubbled through the water into the packed beads. The technique is not infallible; thisparticular plug has been frustrating crews over an 11-hour period.
To the uninitiated, there is something unsettling about any large powerplantparticularly a nuclear plant on a night shift. Scale, for one thing. Media covering the
TMI accident have been taken to task for overuse of foreboding words such as "loom"and "lurk"-and "foreboding." In this setting, they are tough words to avoid. The
massiveness is a special adjustment for naval reactor veterans who are accustomed tocompactness: the reactor plant on a nuclear submarine would just about fit into a small
house. TMI's Unit 2 alone is as big as a medium-sized shopping center with a maze ofpipes as big around as manhole covers and valves the size of fence gates.

Few people work under the 4-acre roof of a nuclear powerplant. By contrast a
nuclear ship teems with people working cheek-by-jowl, their chiefs and officers hardby, and quite literally looking over their shoulders. Out here in the plant, beyond theuncozy confines of the control room, one's first impression might well be that the placeis deserted; to a major extent, the plant runs itself. Perhaps most of the human effort
required to marshal, monitor, and occasionally intrude on the plant systems iscustomarily exerted in the control room, which can be either disconcertingly quiet or
confusingly alive with signals and alarms. Operators in the control room stay in touchwith anyone out in the plant or in the Unit 1 control room by means of a paging system
8that has the tonal quality of a bad bronchial cough. In the control room, the effect isl oud and intrusive; out in the plant, it can make you jump.

For ex-Navy reactor operators, the transition to a commercial plant is not simply oneof size, but also of intensity. Admiral Rickover's Navy is carefully screened, tightly
controlled, and rigorously drilled, as close to an elite as any group to be found intoday's Armed Forces. Its veterans constitute the single large talent pool from which
civilian nuclear operators are drawn. After a hitch or two on nuclear submarines orsurface vessels, Navy operators find a ready market for their skills as new commercial
reactors come on line. At the present time, approximately half of the civilian industry's
operators-like Zewe, Faust, Frederick, and Scheimann-are Rickover alumni,
although it is unusual to find so many of them on a single shift.

There is always a sense of urgency to a Navy technician's watch, a sense that thisreactor is powering a ship of war on a mission, that he is accountable for his part,however small a fragment, of the total operation, and that if he is stumped, his superiors
are close at hand, and they know the equipment better than he does. On a big civilian
reactor installation, as here at TMI, it is very hard to get a feel for what is going on; aperson reports for work and is immediately surrounded and dwarfed by it. This vessel isgrounded in concrete, moving nowhere. It is a difficult thing to look at a winking light ona board, or hear a peeping alarm-let alone several of them-and immediately draw
any sort of rational picture of something happening out in the vast plant, let alone meet
it with anything but a mechanical response.
Here at TMI-2, the control room itself, for all the array of instrumentation, has an
improvised look; it would not be mistaken for the Starship Enterprise. The control
panels nearer at hand are arranged in an arc, effectively fencing off the operators fromannunciator panels that stand at the far side of the room and display banks of alarm
signals. An operator needing quick access to these more distant panels makes achoice between an end run and a vault. Repair tags hang from dozens of the toggles,
some of them obscuring the faces of other instruments.

Almost on the nose at 4 a.m., Bill Zewe's concentration is broken by the sudden
warble of an annunciator alarm out in the control room-a sound as cloyingly
persistent as a continued tugging at a sleeve. The shift supervisor looks out into thecontrol room; several annunciator lights are blinking to life on the control system panel.
He hurries out to join Faust and Frederick in trying to figure out what's going wrong,
and what to do about it.

Down in the turbine building, the quiet has just been destroyed by what Scheimann
will describe as "loud thunderous noises, like a couple of freight trains." What he hears
will later be ascribed to "water hammer," a physical phenomenon familiar to any
householders who have ever had air in their hot water pipes. It can occur in large
pumping systems when the water flow is suddenly interrupted.
The silence is hardly restored when Zewe's voice crackles over the paging system,with what sounds to Scheimann's trained ears like "Turbine trip-reactor trip."
Scheimann drops everything and bolts for the control room....
(Narrative continues on page 14 )9Primer on the Pressurized Water Reactor: From A-Loop to Zircaloy
The coolant system of a pressurized water reactor such as the one at Three Mile
Island Unit 2 (see Color Plate 1) is a circuit, or closed loop of distilled water with a small
amount of boric acid. The water is kept during normal reactor operation at an averagetemperature around 575 degrees Fahrenheit (normal boiling temperature: 212°F) andpressures high enough (around 2200 pounds per square inch) to keep the water fromboiling to steam. (For comparison, sea level pressure is 14.7 psi; the pressure in a large
truck tire around 90-100 psi.) This loop is called the primary reactor coolant system.
The primary coolant water circulates and recirculates through this loop. First it goesfrom the reactor core 10-which might be thought of as a furnace where the coolant
water is heated by the heat of the fission chain reaction in uranium fuel rods sheathedin cladding made of a zirconium alloy called Zircaloy-then through two "hotleg" 2®pipes which are 3 feet in diameter, to a steam generator 3®. Here in thegenerator, the primary coolant system water transfers some of its heat to water inanother, separate loop: the "secondary" or "feedwater loop. " Water in the secondary
loop is heated to steam without ever coming in direct contact with the primary coolant
10water. Having lost some of its heat, the primary coolant water then moves back via fourpipes known as the "cold legs"® to the reactor core®. There it is heated once again
and repeats the cycle.
The primary coolant is normally kept moving at high speed in the loop by enormous"reactor coolant pumps"®5, extraordinary devices (there are four of them), each ofwhich costs several million dollars. Each requires for its own operation enoughelectricity (2700 kilowatts) to light a small town.
One more detail: there are two coolant loops in the TMI-2 reactor (only one is shownin Color Plate 1), called the "A" and "B" loops. Each loop is pretty much like the other.
Each has its own steam generator feeding steam to the turbine that makes electricity.
Each loop contains two out of the four reactor coolant pumps. Again: one reactor, twocoolant loops, four reactor coolant pumps (two in each loop), two steam generators,
one steam turbine, and one electric generator.
At a point between the reactor and the steam generator, there is a pipe leading to
the bottom of a large vessel or tank called a "pressurizer"®. During normal
operation, coolant water does not circulate back and forth through this pipe. The
pressurizer is kept a little more than half full of coolant water. Above the water is abubble, or cushion, of steam. This steam cushion at the top of the pressurizer can bemade larger or smaller by slight heating or cooling of the pressurizer water just beneathit. The whole apparatus is, in fact, a means of keeping the pressure in the reactor
coolant system relatively constant. When the bubble temperature and pressure are
increased, it tends to push water from the pressurizer out into the primary reactor
coolant loop, thus increasing the pressure in the loop. When the temperature andpressure in the pressurizer are lowered, steam condenses and the bubble shrinks.
Water tends to come from the reactor coolant loop up into the pressurizer, and theoverall system pressure is decreased.
In a pipe leading out of the top of the pressurizer, at the top of the space normallyoccupied by the steam bubble, is the "pilot operated relief valve" (PORV)(2, a very
i mportant piece of equipment to anyone who would understand the TMI-2 accident.
This relief valve is designed to open automatically when the system pressure begins
crowding the upper limits of safety. In theory, if the pressure in the coolant system rises
very abruptly, the valve will open, some of the steam will rush out (shrinking the
bubble), more water will move up into the pressurizer from the primary coolant loop,
and system pressure will go down. When the system pressure is back to normal, the
PORV is supposed to close automatically, having returned the system to a safer
pressure. If the PORV fails to close, there is a block valve® between it and thepressurizer that can be closed.® In addition to the PORV there are two other safetyvalves.
The heart of the secondary (or "feedwater') system is the steam generator 11 .
Here, water in the secondary loop is heated to steam by the ultrahot water from theprimary system as it moves through a series of metal tubes that are a part of the primaryloop. The intense heat from the tubes boils the feedwater to steam in the steam
generator, the steam moves through the secondary loop to the steam turbine OO ,which turns the power generator © that produces the electricity. After the steam has
passed through the turbine, it moves through a condenser ® to be cooled and11condensed into water again and recycled back through the steam generators. (Thecondenser itself is cooled by water from still another circuit. Having been warmed in theprocess of condensing steam back into feedwater, the water in the condenser circuit ispumped up to the cooling towers ®, the most visible feature of many reactor stations;
here this water is cooled by exposure to the atmosphere as it tumbles down a steep runof steps and then is pumped back into the condensers. The escaping water vapor is thefamiliar plume or cloud coming out of the cooling tower.)
Back for a moment to the secondary or feedwater loop: at a point in the line
returning water from the condenser back to the steam generator are the "condensate
polishers, " or "demineralizers", the water-softeners mentioned in the narrative.
There are a number of reactor plant systems that played important roles in theaccident; they are all parts of the general safety system common to all reactors called
the "emergency core cooling system" (ECCS), a system that must supply cooling water
to the hot reactor core if there is a loss of water due to a break in the reactor coolant
system. If the break is small, the leakage flow out the break may not be large, so thesystem's internal pressure will stay high, making it harder for the ECCS to pump waterin. In this case the plant relies on "high pressure injection" (HPI) pumps @ to deliver
water from a large standby tank called the "borated water storage tank" (BWST)
If a reactor coolant pipe break is very large-for example, a complete break in a
3-foot-diameter pipe-the HPI pumps could not deliver enough water. The system
therefore is provided with a set of "low pressure injection" (LPI) pumps that can deliver
water to the core much more rapidly when a large pipe break has dropped the system's
internal pressure. The LPI pumps, which are not shown in the diagram, also draw waterfrom the BWST if' .

The LPI pumps have another purpose, too. When a reactor is shut down, theradioactive waste in the fuel continues to produce a considerable, though diminishing,amount of this decay heat in the hours and days following; this heat must be removed if
the core is to be kept from melting. After shutdown, the reactor is cooled first bycontinued normal operation of the steam generators until the reactor coolant system isdown to a temperature of about 300°F and an internal system pressure below 400
pounds per square inch. When it has reached that low pressure, valves are opened tolet one of the LPI pumps circulate coolant through the reactor core and out to a special
heat exchanger to bring the system temperature all the way down to about 120°-140°F.
In this configuration the system is not called the LPI system, but the "decay heatremoval system. " The decay heat removal system can be run continuously to remove
the radioactive decay heat from the core.
There is another ECCS system that needs to be understood in this report: the "coreflood tanks" © . These two tanks are almost filled with water with a medium-pressure(600-pound per square inch) bubble of gas above the water. They stand above thereactor; a check valve prevents the higher reactor system pressure from driving morewater into them. If a large pipe break occurs, it will take a few moments for the HPl and
LPI pumps to deliver a fresh supply of cooling water to the core. To cool the coreduring those first critical moments, the core-flood tanks will spit out their thousands ofgallons of water, driven by the 600-pound pressure of the gas bubble.
Briefly, this is the progression of the accident: it began with a chain of events in thesecondary or feedwater loop, initiated by a failure of the condensate polishers. These
12events culminated in a complete stoppage of water circulation in the secondary loop,
leading to the inability of that loop to remove heat from the primary coolant loop. The
primary coolant loop temperature quickly rose, raising the pressure in that system. The
relief valve (PORV) atop the pressurizer opened automatically to relieve this pressure,but remained stuck in the open position when the pressure dropped, instead of
automatically closing. This permitted the rest of the pressurizer steam bubble, andultimately a lot of reactor coolant, to disappear out through the open valve-a loss of
coolant accident, to be sure, but one for which the TMI operators had never been
trained and which was not described in their written emergency procedures. This lackof preparation led to a misreading of the symptoms and mistaken responses that would
uncover the core.

13

2 THE RELIEF VALVE (PORE
STICKS OPEN

I n the moments just prior to the cascade of system alarms at 4 a.m., operator Ed
Frederick is adjusting the amount of boron in the primary reactor coolant system inorder to compensate for leakage that had been occurring through the pressurizer relief
valve (PORV) or possibly a safety relief valve. Any persistent leakage through one ofthese valves will tend to raise the concentration of boron in the primary coolant
water-just as boiling water on top of a stove concentrates impurities. Frederick isdiluting the solution by adding more water.

Recognizing the inconstant histories of relief valves, plant designers have provided
instrumentation to detect leakage, and also have installed (see Color Plate 1) aremotely operated block valve 9 between the PORV@and the pressurizer which can
be closed from the control room if the PORV sticks open. (This had in fact occurredwith the TMI-2 PORV a year earlier, during prenuclear testing, though with noappreciable damage to the reactor.) It must also be mentioned that there is anothererrant half-measure-short of repair, replacement, redesign-that has been taken toatone for the PORV's undependability. An indicator light has been installed in thecontrol room, connecting to the opening-and-closing mechanism in the relief valve:when electric power is passed to the solenoid, permitting the valve to open, the lightgoes on; when diminished pressure in the pressurizer cuts off power to the solenoid,
permitting the valve to shut, the light goes off.
Unfortunately, the light is proof only that power is reaching the valve-opening
mechanism; it is only circumstantial evidence of the actual state of the valve itself, i.e.,
power has been cut off from the solenoid now, and the light shows it-but the valve
remains open. It is ironic, in a day that will be marked by repeated refusal of theoperators and supervisors to believe ominous readings from the reactor-monitoring
instruments, that they elect to be misled by this bearer of what they perceived to begood tidings.

Operator Craig Faust recalls having just finished instrument readings showing
temperatures downstream of the relief valve to be 180OF-500 higher than the maximum
temperature allowed under plant procedures before the upstream block valve must be
closed, and further evidence of the leaking valve.
The insistent alarm that brings Supervisor Zewe out of his office has been triggeredby a "trip," or automatic shutdown, of the main feed pumps ®. This in turn closes themain turbine steam stop valves, which trip the turbine itself. Now, the water in the
primary coolant system quickly heats and expands because the turbine is no longer
drawing heat away. The pressurizer relief valve (PORV) opens, precisely as it isdesigned to do. As pressure continues to increase, albeit more slowly, the reactor
protection system immediately "scrams''-shuts down-the reactor.
Once down, the reactor continues to put out fractional power due to decay heatenergy released by continued intense radiation from the fuel. But the heat-removing
14

function of the steam generator now overtakes the reactor's reduced heat output; thecoolant water now cools and "shrinks," lowering system pressure and allowing the
PORV automatically to shut-or this is the way it would work in a perfect world.
I nstead, the relief valve sticks in the open position as reactor system pressure drops.
Steam rushes out through the stuck-open valve at a rate of some 110,000 pounds perhour (equivalent to loss of some 220 gallons of water per minute), which it will continue
to do for more than 2 hours before operators realize that the valve has failed to shut.
The result of the stuck-open valve, of course, is to further depressurize the coolant
system.
Most of this takes place within 12 seconds of the first alarm. After about perhaps 2
minutes, coolant system pressure has dropped 25 % from a normal 2155 pounds per
square inch to 1640 psi.

15

3 THE CORE IS UNCOVEREDSITE EMERGENCY

As the reactor coolant system pressure continues to drop and falls below 1640 psi,
the automatic systems once again assert themselves. The high pressure injection (HPI)
pumps start pushing new water into the coolant loop from the borated water storagetank (BWST) at a rate approaching 1000 gallons a minute, aimed at ensuring that thereactor core remains covered with coolant. It is the automatic response of machine toi nstrument readings, nothing more.
I n most reactors, the actuation of the high pressure injection system is a telltale signof a loss-of-coolant accident-a "LOCA," in the jargon of the trade. But the TMI-2
operators have seen the HPI pumps come on a number of times before when there has
been a loss of feedwater flow or when the reactor scrammed, a most undesirable
feature of this reactor design because it tends to mix up "normal" and "emergency"
reactions by the automatic systems.

A more important factor contributing to the operators' failure to recognize that a
LOCA is in progress is the pressurizer water level indicator. Their training on thisparticular equipment has taught the operators that the only credible check on theamount of coolant in the system is the indicator showing water level in the pressurizer.
(In this Babcock & Wilcox reactor, there is no instrument for measuring, as a gas gauge
does in an automobile, the amount of fluid in the reactor core portion of the coolant
l oop-or, stated more simply, the depth of water around the fuel rods.) If thepressurizer level remains high, the operators are not trained to anticipate that coolant
water may be leaking out of the primary system.

I ndeed, the operator training at Met Ed, at B&W, even back in the navy, tells these
men that the condition to avoid at all costs is "going solid"-permitting the pressurizer
to fill with water and thus losing the ability to regulate system pressure through thecontrol of the pressurizer steam bubble.

The training and the written emergency procedures of the operators neverpostulated a loss-of-coolant accident through the top of the pressurizer itself, as ishappening now. With the relief valve stuck open, the steam bubble vanishes like a jinni
out through the valve, and the coolant water right after it. The system pressure
continues to be low-a sign of a loss-of-coolant accident. But the pressurizer waterlevel indicator keeps getting higher. Why is this?
The system pressure has dropped to "saturation," causing coolant to boil andeventually to form steam pockets at high points in the system. The expansion of thesesteam pockets-"voids"-continues to force coolant water up into the pressurizer,
which now is no longer a pressure regulating device but merely a conduit for passing
coolant from the primary system out of the stuck-open valve and into the "reactor
coolant drain tank" in the containment building. It is a depressurizer.

Going by the book as it was taught to them, however, the operators continue to readthe pressurizer indicator in the old mode: The coolant level is rising; the system is going16

solid, for heaven's sake. Convinced by this logic that the system, indeed, is overloadedwith coolant water, the operators override the emergency system and sharply reduce
flow from the HPI pumps. It is a human intervention in the automatic chain of events notinconsistent with the operators' training, but it will have awesome consequences.

At Zewe's direction, Operator Ed Frederick shuts down one HPI pump and throttles
back the other one from a maximum of 400 gallons per minute (gpm) to about half thatflow. Not only does he throttle HPI, Frederick also lifts the plug at the bottom of thereactor coolant system to maximize "letdown" through the normal "makeup and let
down system" that, like a swimming pool filtration system, constantly works to purify
primary reactor coolant water. The effect of these two actions is to reduce to a trickle
the amount of water being added to the system. This miserly flow rate, perhaps 25 gpm,
will continue for the better part of the next 3 hours and is more than offset by theamount of coolant lost every minute through the stuck-open PORV.

Eight minutes into the accident (about 3 minutes after operators throttled back the
HPI), Ken Bryan, who has been asked to come over from Unit 1 to avail himself of theopportunity of experiencing the management of a reactor trip, notes on entering thecontrol room that the emergency feedwater No. 12 block valves, 24 known in operator
parlance as "the 12's," are closed.

Bryan yells out his discovery. Apparently at that moment, Craig Faust, who ishandling the controls on the secondary side, notices one of the control panel lights forthe 12's indicates "closed." He flips up a tag which is hiding the panel light for thesecond 12 valve and exclaims, "They are both closed." Supervisor Bill Zewe yells,"Open them!"

When closed, these valves prevent the supply of emergency water to the steam
generators which at that point have lost regular feedwater flow. This emergency
feedwater is needed for cooldown. The Special Inquiry Group has not been able todetermine how the block valves got to be closed that morning. We have concluded,
however, that the 8-minute delay in restoring emergency flow did not directly affect theoutcome of the accident-though it did serve to divert the attention of the operators,
who patently needed no more distractions at this point.

During the ensuing 3 hours, Shift Supervisor Zewe will dismiss two warnings from atemperature instrument showing relief valve discharge temperatures about 100
degrees above normal range. (These are incorrectly reported to Zewe to be about 50
degrees lower than they really are.) He attributes the discrepancy to the fact that the
PORV had been leaking anyway, and to residual heat from the early discharge of steam
from the PORV when it opened (supposedly) for just a few seconds. (Zewe later
testifies that he has seen higher readings than these under reasonably normal
circumstances and that he felt that if the relief valve were stuck open, readings would
have been much higher-over 300°F.)
At 4:14 a.m., with the accident sequence barely settling in, there are otherconspicuous clues that the relief valve is still open. Continued discharge of coolant into17

the reactor coolant drain tank from the stuck-open relief valve causes the tank's
pressure to increase. When the pressure reaches 192 psi, the rupture disc at the top of
the tank bursts. Zewe takes note of this around 4:20, but again he misinterprets-as do
all hands present.

With the rupture disc open, coolant from the stuck-open valve _running into thereactor coolant drain tank overflows the tank onto the reactor containment building
floor. At 4:38 a.m. an auxiliary building operator reports that the automatic containment
sump (floor drain) pumps are pumping this water into the next-door auxiliary building.
Zewe and Frederick agree to turn these sump pumps off.

By 5:00 a.m., the temperature inside the containment building is up from 120°F to
170°F, and building pressure has increased from 0 to 2.5 psi -still another sign that the
PORV is stuck open.

George Kunder, a young engineer recently named superintendent of technicalsupport at Unit 2, is duty officer on call. He arrives in the control room at 4:50 a.m. He is
not yet that familiar with this reactor, having trained on Unit 1. The same is true for Joe
Logan, the new superintendent of Unit 2, who arrives 55 minutes later. A retired navy
captain and former commander of a squadron of nuclear submarines, Logan lends acertain senior presence to the youthful assemblage, but will play no significant role
during the day, apparently because of his lack of intimate familiarity with the plant.

Shortly after Kunder arrives he is quickly overwhelmed by the strange behavior of theplant. Besides the oddity wherein a "solid" reactor coolant system remains at low
pressure, he is accosted with chemical analyses showing low boron concentration in
the reactor coolant and increasing counts on the neutron monitoring system. On top of
everything else, the reactor's chain reaction appears to be restarting although allcontrol rods are full in. The operators start emergency boration proceedings to stop
the apparent reactor restart, little realizing that the low boron concentration and highneutron count are really telling them that the core is drying out.
There are two pairs of main reactor coolant pumps in the reactor's primary system,
each the size of a small truck. At 5:13 a.m., the operators notice serious vibrations in
the two B loop pumps and turn them off to avoid damage. The water continues tocirculate, though, until the vibrations become serious in the other A loop pair. At 5:41,
the A loop pumps are shut down as well. While the pumps ran, a mixture of steam andwater was being pumped through the core, keeping it cool, but as soon as they aresilenced the flow stops. The steam and water separate, with the steam rising to theupper part of the reactor system like gas in a shaken Diet Pepsi bottle.
The operators, though, do not realize how much steam the system contains: they still
believe it is nearly full of water-since the pressurizer level indicator is still high-andare hoping that a process called "natural circulation" (convection flow of hot and cold
water around the system) will cool the core. However, with all that steam in the system,no natural circulating flow occurs. The system stagnates.
In the next half-hour, serious core damage begins. With no flow, the hot core boils
away the water, making more steam and gradually dropping the water level until the
12-foot fuel bundles are more than half uncovered.
18

At about 6:00 a.m., station manager Gary Miller, who has been in touch from hishome since Zewe notified him of the reactor trip nearly 2 hours earlier, initiates acritical conference phone call to John Herbein, Metropolitan Edison's vice president
for generation, an Annapolis graduate veteran of the navy nuclear program and theprevious TMI station manager. Herbein is in Philadelphia for naval reserve training. On
the line with Miller and Herbein are George Kunder, from the control room, and Leland
Rogers, who has been site manager for B&W here at TMI since 1972 and currently
directs B&W's technical support personnel at the site. Like Miller, Rogers is speaking
from his home, where he has just learned of the accident. Kunder quickly briefs theother three on general plant status, including the plunge in system pressure levels froman initial surge at 2500 psi down to 700 psi (by this time, it actually had dropped as low
as 625). He also tells them that the coolant pumps had to be turned off to avoid damage
from excessive vibration.
Lee Rogers asks the critical question: Is the pressurizer block valve closed? Kunder
replies that he doesn't know; he will check. A few seconds later, Rogers has his
answer: Yes, the block valve is closed.
No one asks the followup question: When was the block valve closed?

The answer is that it has just been closed.

It is Brian Mehler, who has just come in to relieve Bill Zewe as shift supervisor, whogets credit for the day's first major correct move. Mehler checks over the reactor
coolant instruments and quickly concludes there is a steam bubble in the "hot legs"the pipes leading from the reactor to the steam generators-of the reactor coolant
loop. With the coolant system pressure so low, there must be a bubble somewhere else,
expanding and forcing water into the pressurizer. "I went to the computer," he will later
testify, "and punched out the temperatures on both the [safety] valves and theelectromatic relief valves." Based on readings showing the relief valve discharge line
some 30 degrees hotter than the safety valve discharge lines, Mehler dismisses thepressurizer level reading and moves to a fresh conclusion: The PORV is leaking. Mehler
orders the PORV block valve closed. (Later, Frederick, though not disagreeing that
Mehler was the man who did it, offers a somewhat different interpretation of why it was
done: because no one could think of anything else to do to bring the reactor backunder control.)
For whatever reason and by whatever route, Mehler has arrived at exactly the rightdecision just 20 minutes after coming on the scene fresh from the outside.

Armed with this intelligence, any of the four men could be expected to reason that,with the pressurizer relief valve stuck open more than 2 hours, a loss of coolant
accident had been in progress and full operation of the HPI system was critical.
Instead, never having asked the second question, all will grope in bewilderment foranother whole day before the truth strikes.
Much later, long after the accident has run its course, there will be extensive
technical analysis of the accident, including study of events that did not actually
happen that fateful day at TMI. Perhaps the most interesting of these alternative19

sequences is the one that responds to the question, "What if the PORV block valve
hadn't been closed at 6:18 a.m.?"If the valve had remained open and the TMI operators had done nothing, water andsteam would have continued to escape from the PORV, lowering the water level aroundthe core still further. With less water in the lower part of the core, there would havebeen less boiling and less upward flow of steam cooling the fuel rods, leading to higher
temperatures in the upper part of the core.

Soon the upper portions of the core would have started to melt, liquefying the fuel.
Starting at the top of the fuel bundles (the hottest part), this melting would haveproceeded down to about the middle of the core.

Engineering calculations done for the Special Inquiry Group show that within 30 to
60 minutes, a substantial portion of the fuel in the core-certainly the center of the top
half of the core, and perhaps as much as half of all the fuel-would have melted.

NRC experts believe that portions of the liquefied fuel would probably have fallen
nto
the water pool below, making more steam that could have had the effect ofireversing the meltdown. Whether or not this reversal would have occurred depends inpart on how long beyond 6:18 a.m. the block valve would have stayed open.
Nevertheless, an eventual full core meltdown probably would have occurred, especiallyi f one assumes that the operators cut off all water being pumped into the core.

This meltdown might have stopped or it might have proceeded until the molten fuelhad ruptured the bottom of the steel reactor vessel and dropped onto the basement of
the reactor building. Any analysis of how far it could have gone, or whether the reactor
building would have held it, is speculative and depends on complex analysis with manynecessary assumptions.

One thing the analyses do seem to agree on, though, is that even with a core
meltdown, there is only a small probability that the consequences of TMI would havebeen catastrophic to public health and safety. The most likely probability is that thereactor building would have survived in this accident scenario, and the vast majority of
the radioactive material released from the fuel would have been retained within thebuilding, not released to the surrounding environment.

The dark hours are not without their quiet heroism. During the excitement over theflooding sumpwater and high radioactivity readings in the auxiliary building, diminutive
Juanita Gingrich has been over in the adjoining turbine building, shackled to the sort ofdirty work that usually falls to auxiliary operator trainees; she has only recently become
one. Gingrich, who holds a degree in criminology from Florida State University, had
decided that her job as a plant security guard was not sufficiently challenging, and had
applied to Met Ed for a trainee position.

The task challenging her just now has been a recurrent headache to the
management. Whenever a large turbine is shut down, the turbine shaft must be rotatedperiodically to keep it from warping. There are motorized turning units for just this task,
but one is awaiting repair. Juanita Gingrich has been assigned to manually rotate the20

"B" main feed pump turbine, one-half turn every 2 minutes. Shortly after she takes up
her station in the echoing plant, the evacuation order comes over the page. "But they
told me I should stay down here," she will later tell a company attorney. Stay she does,with only a nearby audible alarm from an atmospheric radiation monitor for company,
and turn she does until someone upstairs in the control room remembers her andrelieves her around 8:00 a.m. Gingrich is subsequently checked and found to be free ofradioactive contamination.
Between 5:41 when the last two pumps are turned off and 6:18 when the block valve
is closed, the principal core damage begins to take place. What happens is that the hot
upper parts of the core, now uncovered, are bathed in steam rising from the boiling
activity around the water-covered lower core region. The steam is, of course, just water
vapor, made of hydrogen and oxygen,H20. A chemical reaction takes place between
the very hot zirconium alloy from which the fuel rod cladding is made, and the steam. At
those temperatures, the zirconium cladding voraciously grabs the oxygen from the H 2 O
steam, becoming zirconium oxide and liberating hydrogen gas.
This weakens the fuel cladding, which ruptures and leads to release of radioactive
material from the fuel rods into the water, and will later result in serious collapse ofparts of the core. For now, the reaction is making hydrogen by the bucketful ... but theoperators do not know it. They still think the core is covered with water, ignoring theevidence that should tell them otherwise.
At about 6:30, while Duty Officer Kunder is about three-quarters of the way throughthe conference call briefing, Brian Mehler asks Richard Dubiel, the radiation protection
supervisor, to arrange an entry into the reactor building. Because of the potential
confusion of the upcoming shift change at 7:00 a.m., it is decided not to attempt thisentry at this time; in hindsight, a very wise decision.

Some 10 minutes later, about the time Kunder is hanging up the phone, a Primarycoolant sample shows a level of radioactivity about 350 times greater than normal.
Down in the auxiliary building, where technicians are picking up steadily elevating
readings, Auxiliary Operator Terry Daughtery looks down through an opening to thebasement and calls out to fellow operator Dale Laudermilch: "Hey, we're getting waterout of the floor drains ... the aux building sump is overflowing!" Shortly after,
Technician Michael Janouski comes running through, barking: "Get the hell out!"
And suddenly, Dubiel breaks in over the plant page: "George Kunder, George
Kunder. Line one!" As Kunder picks up the intercom, Dubiel yells, "George, the sample
li ne has just gone up to 600 millirems an hour.""At that point," Kunder will recall later, "I realized, 'Oh my God, we're failing fuel."'Kunder shouts the news to Logan, "Hey, we're into site emergency; it's the real thing."
Making quick note of the new readings, Zewe declares a site emergency, the first stepi n going public with the accident.

Miller is recontacted at home and leaves immediately for the plant, arriving in thecontrol room to take charge of the emergency at 7:05 a.m. Zewe and others brief
Miller, who forms an emergency command team. Mike Ross, Unit 1 Operations
21Supervisor will be in charge of plant operations, directing Zewe, who by now has
finished his regular shift, and Mehler. Logan will be in charge of verifying compliancewith procedures; Kunder in charge of communications and technical support. Lee
Rogers is asked to provide technical support and liaison with the B&W offices in
Lynchburg, Va. Daniel Shovlin will be in charge of maintenance, Dick Dubiel in chargeof radiological concerns. Jim Seelinger, nominally Unit 1 Superintendent and Logan's
counterpart, is to be in charge of setting up an emergency control center over in the
Unit 1 control room. Seelinger, like Met Ed Vice President Jack Herbein, is a Naval
Academy graduate and also a Rickover alumnus. Miller solicits suggestions from allthese men and sets up his chain of command.
With the time passing for a normal change of shifts, many additional operators are
now available in the control room; Ross stations each at a designated control panel,with shift foremen and supervisors circuit-riding among them and coordinating theiractivities and conveying messages both up and down.
At this point, no one appears to be theorizing about the cause of the increased
radiation levels in the plant. No one postulates an uncovered core. If anyone is thinking
such thoughts, he is keeping them to himself.

22

GENERAL EMERGENCY

Certainly the initial meshing of this emergency machinery in the control room issomething short of symphonic. The people who have been on duty from the start of theaccident are frustrated. There is good reason for them to suspect that their operator
training and years of experience are serving them badly in this event; none of the
buttons they've pushed or the switches they've pulled have produced the needed
magic. Intellect tells them they don't really know what is going on; ego tells them noneof the rest of these guys do either; on the evidence, both are right.

Of the men who have been summoned to the emergency, and those who are simply
reporting on shift expecting another humdrum day, none seems ready to stride forward
and cut the Gordian knot. Brian Mehler, by closing the pressurizer block valve, hasdone a fortunate bit of work when he came on at 6:00, but now he, with everyone else,
seems to have forgotten that the block valve was not closed all along. The possible
outcome of having that PORV open for more than 2 hours is not discussed, nor is thethrottling of high pressure injection. Reality is those ascending radiation readings;
these are tangible, and there are precise guidelines for what to do about them. Nevermind what is causing them. The emergency team is formed and dispatched to duty
posts. And now, at 7:24 a.m., nearly 3-1 /2 hours into the accident, Station Manager
Gary Miller declares a general emergency, which heralds the possibility of offsite
radiological danger.

Just after 7:20 a.m., the crew turns on the high pressure injection pumps for just a
few moments. This puts colder water into the reactor and, we now know, probably
covers the core. Just before 8:00, HPI automatically goes on, again just for a moment,
and after this the core is probably not uncovered again during the day.
I n between, at about 7:45, an unrecognized event occurs inside the reactor. Data
from neutron monitors, obtained subsequent to the accident, show that a portion of thecore probably crumbled or slumped down badly at this time. But nobody at TMI knew
that.

Subsequent analysis suggests that the loosened core elements, whose zirconium
alloy cladding had been weakened by the earlier chemical reaction with hot steam,suddenly fell into a jumbled pile near the middle of the core, forming a solid crustlike
l ayer at the top of the pile that seems to have blocked the upward-moving flow of
coolant water. Without that flow, a steam bubble probably formed just below thehardened crust, allowing still more zirconium to heat up and oxidize, embrittling still
more fuel cladding further down.
The core was to remain in that state for many days, with steam-filled pockets below
the crusty layer and water surrounding and covering the rest of the core structure. But
at the time (7:45 a.m.), the TMI crew is just beginning to cope with the radiation alarms.
Understanding what is happening to the core itself will not come until much, much later.
(Narrative continues on page 27 )23

During several periods early in the accident, plant workers were required
to wear respirators.
Primer on Radiation: From Alpha Particles to X-Rays
And now a quick word about radiation and how it is measured.
The fission chain reaction occurring in the reactor's fuel rods produces not only heatbut also highly radioactive particles and gases. Normally, little of this radioactive
material escapes. It is contained inside the Zircaloy cladding of the fuel rods, and ofcourse there are a number of other barriers to its release outside the plant: the reactor
coolant water; the reactor vessel itself; and finally the containment building.
During the TMI accident, when the cladding of the fuel rods disintegrated, asubstantial amount of the radioactive material and gas inside the fuel rods was dumped
into the reactor coolant system-the primary loop.
Some of the coolant water passed throu h the "makeup and letdown system" (seeColor Plate 1) including the makeup tank J . This system functions like the filtration
and automatic level system in a swimming pool, constantly purifying a small amount of
the coolant water.
24

Since the valves and pipes in the makeup and letdown system are not designed tohandle very highly radioactive coolant water, small amounts of radioactive material
escaped from the system into the auxiliary building. As we will see later, radioactive gas
was also released from the makeup tank by opening the vent valve ® , allowing thegas to pass through the vent header to the waste gas decay tank ® . This route also
resulted in leakage to the auxiliary building, because the vent header ® leaked.

Once radioactive particles and gases were loose in the auxiliary building, some ofthem passed into the building's ventilation system. And while the building's ventilation
filters ® removed the radioactive particles, other radioactive material, especiallynoble gases, escaped up the stack to the atmosphere.

Ionizing radiation can be divided into two basic types: particulate (alpha and beta
particles) and electromagnetic (x-rays and gamma rays).

Alpha particles are comparatively heavy and travel no more than a few inches in air.
They cannot penetrate the skin. However, they can be hazardous if breathed or eaten.
Beta particles are smaller, lighter, and more penetrating than alpha particles. They thus
travel a greater distance and can penetrate the upper layers of the skin.
Although a small amount of radioactive iodine was released during the Three Mile
Island accident, the vast majority of the releases were of "noble" (chemically inert)
gases, xenon and krypton. These gases emit both gamma rays and beta particles.

Several units are commonly used to measure levels of ionizing radiation. One is the
Roentgen, which is a quantity of ionization per unit volume of air produced by x-rays or
gamma radiation. The rad represents the amount of energy from ionizing radiation
absorbed by a specific quantity of tissue or other material. One Roentgen of x-ray or
gamma radiation in air imparts an absorbed dose of about 1 rad in tissue. Roentgens
are therefore units of exposure in air, while rads are units of absorbed dose in material.

The rem reflects the fact that some types of radiation produce more biologicaldamage than others for a given amount of absorbed energy (rad). Thus, a rem is theunit of dose of any ionizing radiation that produces the same biological effect as 1 rad,i. e., one unit of absorbed dose of x-rays. For example, while a 1-rad dose of x-rays
results in a dose equivalent of 1 rem, a 1-rad dose of alpha radiation may cause a dose
equivalent of 10 rem. Because the rem is an inconveniently large unit for many
protection purposes, dose equivalents are often expressed in millirems (mrem). One
rem equals 1,000 mrem.
The measurements used during the accident were usually expressed in terms of dose
rates, that is, so many millirems per hour (abbreviated mrem/hr). Being exposed to a
constant level of 30 mrem/hr, for example, would result in a total dose of 30 millirems
after an hour's time.

The average dose from natural background radiation to the U.S. population is about
100 millirems per year. The annual background dose in Denver, where there is higher
exposure because of the higher elevation (more cosmic rays), is 193 millirems, and theaverage dose in Harrisburg, Pennsylvania, near TMI, is 116 millirems. The averageannual dose of the U.S. population from medical diagnostic activities is about 100
millirems. NRC regulations permit plant workers to receive doses up to 3 rems every 3months.
25

Radiation doses are often measured using thermoluminescent dosimeters (TLDs),
which are small chips of special material that emit light when heated after irradiation(thermoluminescence). The amount of light they emit is proportional to the dose theyreceive from radiation. Plant workers wear TLDs at all times.
Outside the plant, Met Ed had TLDs located in various places to measure any
increase to background radiation from normal operation of the plant. Other TLDs wereplaced during the accident to monitor releases. Their locations are indicated on themap contained in Color Plate 2.

(Foreground, from left): In the Unit 2 control room, Station Manager
Gary Miller (standing) confers with Unit 2 Operations Supervisor Jim
Floyd (seated, with back to camera) and Lead Instrumentation Control
Engineer Ivan Porter. In the background (center) are control room
operator Ed Frederick and Shift Supervisor Bill Zewe.

26

COLOR PLATE II. MAP OF TMI 2 AREA

Until now, this has been entirely a licensee show, all Met Ed with the exception of
Lee Rogers, who is almost "family," reporting here for work even though his employer
i s down in Lynchburg. The forms are well set as to whom to notify: the Commonwealthof Pennsylvania Emergency Management Authority (PEMA); the Region I office of the
Nuclear Regulatory Commission over in King of Prussia; Met Ed's President Walter
Creitz; GPU President Herman Dieckamp and Vice President (Generation) Robert
Arnold; Jack Herbein, of course, once again, and, inevitably, the Met Ed public
information office, whose unsuspecting minions are about to begin the four hardest
working days of their lives.
Amid the milling around and mounting low-grade apprehension is an overcast of
unreality: this isn't really happening-like the classic recurrent school nightmare inwhich you show up for a final exam and discover you have been studying the wrong
textbook for a whole semester. These are confident people, accustomed to reading
and responding to-controlling-this reactor plant. Now the messages are skewed, as
though an old acquaintance has suddenly slipped into doubletalk, sounding reasonable
as ever but making no sense at all. Where is all that radiation coming from over in thecontainment building? From the pressurizer relief valve leak? But the block valve has
been closed, and the readings have kept right on going up....

There is a great deal of anxiety beneath the surface calm of Miller's organization,and it is easy, from safe second-guessing distance, to diagnose. Nuclear physics, as all
science, is logical, and those instruments are speaking the truth to anyone logicalenough to recognize it. Defeat awaits the individual who even subconsciously ascribes
human qualities like crankiness to functioning meters and thermocouples simply
because they are bringing bad news. The answer in science is never to shoot themessenger.
Zewe begins notifying offsite agencies immediately after declaring a site emergency.
The first call, to the Pennsylvania Emergency Management Agency (PEMA), was madeat 7:02; the duty officer, as requested, also notifies the office of the Radiological
Assistance Program (RAP) of the Department of Energy at the Brookhaven National
Laboratory on Long Island, as well as the Emergency Management Agency of Dauphin
County, which contains Three Mile Island as well as the cities of Harrisburg andMiddletown. A call to the NRC Region I office in King of Prussia arouses only theanswering service.

A call from the control room also alerts the Pennsylvania State police, where thedispatcher quickly orders cars to be on hand for traffic control at the points where thebridges to the north and south plant gates take off from the two-lane highway along theeastern shore of the river. It is a bit premature, but inadvertently the State police are
speeding things along: the first news of the emergency is picked up off a police radio
frequency by a radio traffic reporter from a Harrisburg station. Meanwhile, phones are
ringing along the emergency management chain: the PEMA duty officer contacts theduty officer of the State Bureau of Radiation Protection (BRP) and the civil defense
offices in Dauphin and Lancaster Counties. The Lancaster office, in turn, gets on theteletype and notifies the York County civil defense office.
With the declaration of a general emergency, the earlier calls are now repeated. Aline is opened between the control room and the BRP office in Harrisburg; it will remain
27

open for most of the next 2 weeks, serving as the principal, frequently the only, link
between the utility and the State. The Governor's office is notified.
Two more calls to NRC's Region I office again get the answering service. A fourthcall, at 7:45, reaches the switchboard: the duty officers are on their way to work. Their
return call 5 minutes later establishes the first communication link between the
beleaguered plant and the NRC.

Inside the reactor vessel, large quantities of hydrogen from the zirconium-steam
chemical reaction have by now accumulated. Radioactive fission products, released
from the fuel by the failure of the cladding, have contaminated the primary coolant
water and are escaping both into the reactor containment building and, through theletdown system, into the nearby auxiliary building. The radioactive gas continues toaccumulate in the containment building whenever the pressurizer block valve is openedby the operators, releasing heated water and its cargo of entrained and dissolved
gases to the reactor coolant drain tank and from there to the containment building
i tself. The cargo is dangerous on two counts: it contains radioactive gases (mostly
xenon), and potentially explosive hydrogen.
The first intimation of possible radioactive release danger comes at about 7:45. Met
Ed tells BRP that there appears to be enough radioactive gas in the containmentbuilding to produce a serious offsite release if the building leaks significantly; nomeasurements are available yet to determine the leakage rate. BRP relays this to
PEMA, telling them that the wind is blowing toward the town of Goldsboro on the west
shore of the river, and advises that preparations be made for possible evacuation ofGoldsboro and nearby Brunner Island. PEMA relays this admonition to York County.
About a half-hour later, outside radiation level measurements are available; they show
no significant releases, so BRP cancels their advice for evacuation preparations.
Met Ed has begun tentative efforts to shore up against a media event early. Jack
Herbein, having been reassured by his conversation with Kunder and Miller, had placeda call around 7:15 to Blaine Fabian, manager of communications for the utility, in
Reading; his intent was to prepare Fabian for handling any inquiries regarding thereactor trip. The two men drafted a brief statement, which advised that the reactor had
automatically shut down owing to a feedwater malfunction, and will be out of service forabout a week.

Fabian barely has the statement typed when he learns that a general emergency has
been declared at TMI-2; he decides not to clutter the statement with the new
information, which would necessitate getting it cleared again. It is a technicality
anyway, probably raising more questions than it answers.
Fabian's operation, like a lot of utility company information divisions, is hardly geared
for big media events. Normal news contacts are with business and labor reporters, andthe Harrisburg correspondents who cover rate hearings. "Information" includes
responding to consumer queries and preparing brochures. Fabian's own backgroundhardly prepares him for a media avalanche, in which he and the people he works for will
be immediately perceived as the heavies.
Sometime around 8:00 a.m., "Captain Dave," a roving traffic reporter for WKBO inHarrisburg, picks up a State police call on his CB about something going on at the TMI
28

plant. He calls in the tip to the station. News Director Mike Pintek blithely picks up thephone and calls the plant. He may be the only person in the next week to get throughon first try; the phone is answered in the Unit 2 control room, where a beleaguered malevoice advises him to call Met Ed at Reading: "I can't talk now; we've got a
problem . . . " Pintek calls Fabian's office and is given the basic statement. The biggest
story of early 1979 is scooped by WKBO Harrisburg; it is bulletined between "top 40"
records on the 8:25 newsbreak. Things are beginning to move.
Not long after, a reporter for a Waynesboro, Pa. newspaper picks up a tip on aroutine check with State police: something about a general emergency at the TMI
plant-cars are being sent to handle traffic on Route 441. The reporter calls the
Associated Press offices in Philadelphia. AP flashes its Harrisburg bureau, where oneof its reporters, unable to reach a Met Ed spokesman, confirms the tip with State
police. No one knows precisely what a "general emergency" amounts to.

At 9:02 a.m. AP moves a bulletin on its national wire. Basically, it says there has beenan accident at the nuclear power plant on Three Mile Island, Pa., near Harrisburg, that
there have been no radioactive releases, that a general emergency has been declared,that no further details have been obtainable, and that a company spokesman was notavailable.

As bulletins go, this is no earthshaker; under ordinary circumstances it probably
would not have moved on the national wire as a bulletin at all. But there is that big
movie just out about a threatened disaster at a nuclear power plant. It stars Jane Fonda
and has been getting a lot of attention. There is a line in the movie to the effect that athreatened core meltdown could contaminate "an area the size of Pennsylvania." Trusta wire service not to miss a story angle.

The AP bulletin, and the quick local followups in the Northeast, are the first
notification for many public officials who will feel they should have been officiallynotified. Mayor Paul Doutrich of Harrisburg gets his first word of the nuclear accident
at home when he is called for comment by a radio station in Boston.

29

5 HOT LEGS, COLD LEGS, AND INCORES
Once Miller has solidified his emergency organization and taken care of all theprescribed notifications following the declaration of emergency, he calls a conferencewith senior people in the control room, as he will do periodically during the long day.

The plant situation when Miller takes command in the control room, following the
emergency organizing, is still anything but stable. Closing the pressurizer block valve
has stopped the bleeding, but the patient remains in critical condition. Pressure in the
coolant system is still fairly low, and the reactor coolant pumps are still off. Hot leg
temperatures (coming out of the core) are high, about 780°F (normal is about 600°F atfull power). Cold leg temperatures (in the piping returning water from the steam
generator to the core) are low, around 300°F. (In normal operation there is a differenceof about 50° between hot and cold legs.) Natural (convection) circulation is not working
because the hot legs are blocked by steam and gas voids. The HPI pumps are pushingcold water, though at a reduced flow, into the reactor. The severe core damage andmechanical disarrangement of the core resulting from earlier errors is not known to theoperators.

Hot leg temperatures are being read from a digital voltmeter that has been spliced inacross the wires from the temperature measuring device located high up in the hot legsof the reactor. The temperatures clearly signal to anyone knowledgeable about
reactors the existence of a "superheat" condition, meaning that there is steam and nowater flow in the hot leg piping. By any conventional interpretation, this also would
mean that coolant water was boiling extensively in the reactor core, indicating clearly
that the core must be partially uncovered. The persistent failure of the Met Ed
operating crew-and of the monitoring personnel in the control room from B&W and
the NRC-to recognize and react to these symptoms is one of the abiding mysteries ofthe first day of the accident.
The hot leg temperatures are not the only indicators that the reactor core isferociously hot. Temperature-reading devices called "incore thermocouples" locatedjust above the fuel rod assemblies are also consulted, but the computer prints out
question marks-"77"7"-instead of numbers. This means that the devices are either
reading outside the computer printout range or have malfunctioned.

Miller sends Lead Instrumentation Control Engineer Ivan Porter down below thecontrol room to take more instrument readings directly off the wires that lead to thei ncore thermocouples. Porter has his technicians take four or five initial readings.
Several are too low to be believable, but at least two are above 2000°F. The
technicians express concern that the core is uncovered. Porter shrugs them off andreturns upstairs to brief Miller. He tells Miller of the readings, but says he does notbelieve the high ones are accurate-after all, the low ones cannot be right. Miller turns
to something else.

I n the meantime, the technicians are taking dozens of additional readings. Many ofthem are high-far too high for comfort. The technicians jot the readings down in acomputer book, which they leave on a control room console. Porter does not consult it.
30

Soon afterwards, all "non-essential" personnel, including the technicians, are orderedout of the control room when radiation readings increase and those who remain put on
respirators. The additional entries contained in the computer book-strongly
confirming the initial high temperatures related to Porter, and by Porter to Miller-are
not noticed again until weeks later.
Originally, the command team decides to turn off the high pressure injection system.
Five minutes later, Miller reverses the decision. He tells Mike Ross the HPI pumps areto be turned on, and left on, until Miller gives permission to turn them off. The system
will be permitted to function as it would have functioned automatically; it will stay in thismanner at least until plant conditions are better understood. This action returns
operations to "the book"-it is not good practice to defeat safety devices until it isabsolutely clear they are not needed.
About 8:30 a.m., Miller and his team decide to ram as much water back into thereactor coolant system as possible in order to increase system pressure to its normal
operating level. This, they reason, is the best strategy for collapsing the steam bubbles
i n the system and getting a main reactor coolant pump started again.

For nearly 3 hours, system pressure will be kept high by pouring water into thesystem through the makeup pumps and by cycling the PORV block valve open andshut, open and shut to relieve pressure slightly when it gets near upper safety limits.
During this time, several attempts will be made to restart the reactor coolant pumps,
but to no avail. What the plant crew does not know is that the bubbles in the system arecomposed not only of steam but also of hydrogen generated by the high-temperature
reaction of the steam and Zircaloy fuel cladding. Unlike steam, hydrogen is a "noncondensible"-it cannot be made to disappear by increasing system pressure.

31

f

e

Y

if

-1

;

B&W engineer Joseph Kelly, shown here testifying before the President's
Commission, was sent to TMI on Wednesday but could not get on site.

32

V

6 LYNCHBURG "WE'RE JUSTIN
THE DARK"

While all of this is going on at TMI, at 9:00 a.m. a hurriedly summoned task force
convenes in a conference room at the Babcock & Wilcox nuclear engineering
headquarters in Lynchburg, Virginia. Present are perhaps 18-20 engineers andmanagers waiting to hear a speaker-phone report from Lee Rogers, their man at TMI.

I t is, under the circumstances, a surprisingly placid gathering, marked by a dearth ofi nformation from the plant site. "B&W's most prevalent feeling," according to one ofthe people present, "was we're just in the dark."
There is no speculation regarding uncovering of the reactor core, possible fueldamage or oxidation of the Zircaloy fuel cladding, let alone any discussion ofconsequences that might evolve from such damage. The consensus seems to be that
TMI-2 has undergone a routine loss-of-feedwater transient.

The B&W task force decides to send three engineers to the site on a companychartered plane for a closer reading. They are Robert Winks, Joe Kelly, and R. C.
Twilley. Winks and Kelly have been deeply involved in analyzing a similar PORV failurethat occurred in 1977 at a B&W reactor owned by the Toledo Edison Company in Ohio
called Davis Besse. That "transient," as such events are called when they do not resulti n accidents, also featured a misleading pressurizer water level indicator that caused
operators to believe at first that the system was behaving normally. But at Davis Besse,
operators realized in time that the PORV had stuck open and closed the block valve
i solating it. However, Winks and Kelly are not sent to TMI for this reason-nobody at
B&W has yet recognized that the Davis Besse pattern is being repeated.

I ndeed, it is a crowning irony of this incredible Wednesday that neither Kelly nor
Winks, who have studied an event much like that which is taking place at TMI, nor theircolleague, will be able to get near the Unit 2 control room, where the whole event isbrand-new and, for the crew there, quite unreadable. Instead, the three will spend the
day sitting in the living room of Ed Schaedel, a B&W site operations engineer, who has
been unable to get on the site himself that morning and has returned to his home near
Harrisburg to serve as a relay point between Lee Rogers at the plant and B&W in
Lynchburg. Winks, Kelly, Twilley and Schaedel will wait all afternoon for Rogers' calls
and finally give up and go out for a 2-hour dinner. On the evidence, they would havebeen more effective had they remained in Lynchburg, rather than trying to join the
confusion at the island, where no one seems to have the time or the detachment to stepback and add up the evidence-and no one is aware that the "Davis Besse transient"is being repeated with a vengeance.

33

George Kunder (right), Superintendent of Technical Support at TMI-2,
and Gary Miller, Station Manager, left the control room for several
hours on the 28th to brief Lt. Governor Scranton in Harrisburg.

34

7 THE FEDERAL PRESENCE COULD
NOT BE MORE DISCREET

From the moment the start button is pushed on the emergency response apparatus
at the Nuclear Regulatory Commission, it is apparent that this machine also needs a lotof work. Here, too, the people seem dazed by a situation that wasn't covered in the
manuals, torn between logic and standard operating procedures, indecisive in theabsence of a strong executive presence.

A counterpoint to disorganization is the root annoyance that it is damned neari mpossible to put through a phone call to anyone who might have answers. Withoutphones, the NRC would be paralyzed, or so segmented that its parts could never get
together. The agency has no office building of its own, but is housed in a drawer full of
GSA leases. The offices of the five commissioners who head the agency are in
downtown Washington about 2 blocks from the White House. The real headquarters of
the agency-NRC-HQ-are 6 miles away in several buildings out in Bethesda,
Maryland: principally, the Maryland National Bank Building (the "bank building"); thePhillips Building; and the East-West Towers Building, almost 1 mile away from the othertwo. Most of the staffs and administrators of the various NRC divisions work here.
"Bethesda" is agency talk for headquarters.
However, the NRC's research staff, with ready expert contacts in the national
laboratories and in academia, is located in Silver Spring, Maryland, some 4 miles eastof Bethesda. The standards development staff is housed in Rockville, 4 miles north.
While each of the five commissioners has claimed to have spoken up for a single
agency location, it appears that each had the impact of pounding the table with a single
finger; had they formed a fist, the impact might have led to uniting the widely dispersed
agency.

As the first of the onsite evaluation teams are dispatched to TMI from NRC's Region I
offices in King of Prussia, Pennsylvania, there seems to be concurrence on all fronts in
one preponderant theme: this is the licensee's (Met Ed's) accident, not ours. We are
not there to take charge.

Administrators need have no fear about their first wave, which reaches the TMI sitearound 10:00 a.m.-five inspectors headed by Donald Neely. It must be said that thearrival of the Federal presence here could not be more discreet. There is no stormingashore of marines. It is not an invasion, or a takeover; it is more like an infiltration. The
NRC men quietly take up their posts and mostly just watch and listen, rarely raisingquestions or making suggestions, certainly never giving orders.

They report to the emergency center at the Unit 1 control room and are briefed byJames Seelinger, nominally Unit I superintendent but now in charge of the emergency
center. Then they fan out to their assignments: James Higgins and Donald Neely walkover to join the crowd in the Unit 2 control room; Karl Plumlee moves off to monitor
radiation on and off site. Charles ("Chick") Gallina and Ronald Nimitz remain at Unit 1
to man the telephone line that has been opened with the Region I office in King ofPrussia.
35

Two more Region I men arrive an hour later: Ray Smith, a health physicist, andWalter Baunack, a reactor inspector. Baunack is sent over to Unit 2 to give Higgins a
hand, but he cannot get into the control room, where everyone has just been told to put
on respirators because of airborne radioactivity. There are no more respirators. So
Baunack returns to Unit 1 and waits until the alert is called off around 3:00 p.m.
The general confusion in the Unit 2 control room intensifies with the arrival of more
personnel, added to the now-constant ringing of telephones and the shouted phone
conversations superimposed on the incessant system alarms and the squawking of theplant paging system. The scene is hardly made less bizarre-nor communication lessdifficult-by everyone putting on face masks.

Back in Bethesda as the day moves on, the folks could do with just a little
assertiveness up at the site. Their questions are not being answered: Like what's goingon? How about those incore thermocouple temperatures? The job of operations
evaluation in the early hours is being handled on a temporary basis by the people in
Bethesda at the NRC's Incident Response Center (IRC), sometimes via telephone
contact through Region I. Now that the first teams have arrived at the site, however,nothing seems to have changed. Phone lines are established and broken off.
I nformation is requested; sometimes it comes back.
At the plant, NRC inspectors in the Unit 1 and Unit 2 control rooms are besieged byqueries from their supervisors for plant data, only some of which seem sensible. They
have no time to assess the situation themselves. They are errand boys, answering ahost of unrelated questions from a host of different people at Region I or headquarters,
often the same questions they answered an hour before. The NRC's communications
network is not functioning smoothly.

36

Herman Dieckamp, President of GPU Service Company, shown here
addressing TMI personnel, was disinvited to the Wednesday briefing of
Lt. Governor William Scranton by Met Ed officials.

38

8 "MY GOD, WHO IS

WATCHING THE STORE?"

It is more than 7 hours into the accident; nothing that Gary Miller's group has tried
seems to have worked. Hot leg temperatures remain offscale high, and the restarting of
the reactor coolant pumps has been ineffective because of the continued presence ofl arge steam and hydrogen gas voids in the system. The steam bubbles in the highpoints of the hot leg loops-called the "candy canes" because of their tall, hooked
shape-keep the hot water from making that turn. Thus no heat is being taken awayfrom the core by the steam generators. The only heat removal from the system is in theform of hot water and steam passing through that infamous stuck-open pressurizer
relief valve when the PORV block valve is periodically opened in the cycling process.

At 11:30, because no one can think of anything else that has not been tried, thedecision is made to depressurize the system. Later, it will appear that there are several
different perceptions of the precise reasons for depressurizing. In questioning, somewill testify that it was an attempt to bring pressure down to a point -below 400 psi-at
which the decay heat removal system could be turned on. Rogers, among others, will
testify that the prime motivation was fear that the core might be uncovered. By
dropping system pressure low enough, the plant crew could activate the core floodtanks. But in fact they never got the system pressure low enough to let more than asmall percentage of the flood tank water into the core. As the crew runs out the various
theories and comes up with no other untried alternatives, the reactor will stay in a
depressurized state until late in the afternoon. During the interlude, the crew will haveli mited success in collapsing steam in one hot leg, but no success at all in getting any
sustained circulation of reactor coolant.

Since 11:40, shortly after the decision to depressurize, the operators have beendischarging steam into the atmosphere from the secondary side of the steam
generators through the "atmospheric steam dump valves." This is done in the hope ofcooling the steam generators enough to establish convection flow on the primarycoolant system side. The discharge of atmospheric steam dump valves is a high-profile
operation, both visible and audible from the shoreline, a roaring jet of steam rushing up
the side of the reactor building. There is not an awful lot for people to watch during a
nuclear accident: when they hear a roar and see a cloud of steam rising up from theplant, it is easy to understand a certain level of apprehension.

Among those present at the Met Ed observation site on the east shore during thisi nterlude is Vice President Jack Herbein, who has arrived by helicopter at 11:45. At
about 1:00 p.m., Herbein calls the plant and instructs Gary Miller to close the steam
dump valves. Part of Herbein's concern is the possibility that the steam being released
may indeed be slightly radioactive; another concern is the possible response of State
officials to reports of radioactive releases at the plant. The negative side of Herbein'sorder is that it deprives the plant of a potential path that exists at this time for removalof heat from the primary system. Miller mentions this, but Herbein is not persuaded.

39

Around noon, Lieutenant Governor William Scranton's office has asked Met Ed
President Walter Creitz if he can provide a knowledgeable spokesperson to brief the Lt.
Governor at his office. Creitz directs Herbein to brief the Lt. Governor in Harrisburg at
2:30 p.m. Herbein asks for someone to accompany him. Miller is reluctant to leave theplant with so many imponderables, but when Herbein suggests that Kunder accompany
him, Miller decides it will be better for both him and Kunder to make the trip. The plantis thus deprived for several hours of the two most senior utility decision makers on thesite, Herbein and Miller. Miller leaves Joe Logan and Mike Ross in charge with
i nstructions not to make any changes.
Just before Miller leaves for Harrisburg, he hears a heavy thud. Intent on turning overcommand, Miller dismisses the sound as the closing of a ventilator. He and Kunderdrive across the bridge to the Observation Center, where they pick up Herbein andproceed to Scranton's office. No one as yet has figured out that the core has been
badly damaged, but there are troublesome things going on: the core is not being
effectively cooled, there has been no accurate diagnosis of the true plant condition, thegeneral air of bewilderment and confusion continues and, unknown to the departing
men, there has just been a hydrogen burn within the containment. While not an
explosion, it was a flash, a 6- to 8-second burn of hydrogen from the damaged core thathas built up within the containment building. Under the circumstances, the wisdom ofconcurrent departures of the two top officials from the accident scene is, at best,
debatable.

Also in the State capital this afternoon, not altogether by coincidence, is Herman
Dieckamp, President of GPU Service Company, who has got wind of the prospective
briefing. He seems a bit concerned about what is going on at TMI-2, and what the plantcrew is going to be telling Scranton. Dieckamp decides that as long as he is in theneighborhood, "I will sit in on that session." Mr. Dieckamp is no stranger in these
corridors: "I went to the Lieutenant Governor's office ... and stood around for a while
and talked to a few of the guys and told them who I was and what I was there for."Sometime before 2:30, he will ruefully recall later, "I was, in effect, disinvited." Oneof Scranton's advisors approaches and suggests that this is intended to be a "low key
meeting, just among the local folks." Dieckamp later testifies: "I said, 'Ray, do I
understand you are asking me to leave?' He said, "Yes' ... so I left."

Walking out of the capitol, the GPUSC president meets Miller, Herbein and Kundercoming up the steps. His first reaction is chagrin: "I said, 'My God, who is watching thestore?' We had some brief discussion to that effect." After a 90-minute briefing, whichleft the Lt. Governor inadequately apprised of the serious conditions in the reactor, themen from the plant return to Three Mile Island, about a 20-minute ride, at about 4:30
p.m. Miller has carried a telephone beeper, and the three have been within easy
contact of the control room throughout their absence.

I n the meantime, there has been a call to the control room from Bob Arnold,
GPUSC's vice president, expressing concern about whether the core is covered.
Arnold and his engineers in New Jersey first received information about the reactor's
hot leg temperatures around noon, shortly after the depressurization strategy was
i nitiated. Looking at hot leg temperatures in excess of 600° F and falling systempressure, they correctly reasoned that this implied superheated steam and possibly an

40uncovered, or at least inadequately cooled, core. Arnold remembers discussing thematter with B&W's Lee Rogers:
We expressed our concern that the temperatures indicated that the core had been uncovered
and that they had steam bubbles in the loops. I remember Lee Rogers specifically respondingthat he was confident that the core was not uncovered and that they had never uncovered thecore.

B&W engineers at the Lynchburg headquarters have also become concerned by thisti me about the situation at Three Mile Island but, unlike Arnold, they cannot get throughto the plant on the telephone. The B&W task force does not learn of the high hot leg
temperatures until about 1:30 in the afternoon in a telephone call from Greg Schaedel,
who is passing along plant status information from Lee Rogers in the control room.
B&W engineer Bert Dunn remembers hearing the latest data broadcast over a speakerhooked up to the telephone line:
It finally dawned on me that this plant could have been or was perhaps at that time in real
trouble, and then I started preaching high pressure injection.

It was clear to the task force that pressures as low at 495 psi could only mean thatthe high pressure injection pumps were still throttled and not pushing water throughsteam-congested hot legs. As Dunn recalls:
The hot leg temperatures were super-heated. I can describe that almost perfectly. The fellowthat used to work with me and for me was sitting next to me. His name is Lou Carton.
Everybody else was kind of around the table listening to the squawk box. The hot leg
temperature and the system pressure and the cold leg temperature were broadcast on themachine. About sixty seconds later Lou and I both looked at each other, stared at each otherat the same time, and I remember saying to him "That's super-heated; the core's uncovered."At this point, the B&W engineers scramble to communicate a recommendation to theplant that high pressure injection pumps be kept on continuously with a flow rate of atl east 400 gallons per minute. Calls are placed to Arnold in New Jersey and by Jim
Floyd, operations supervisor for Unit 2 who is in Lynchburg for a day of training, to theUnit I control room to relay this message to the Unit 2 control room. By the time themessage is received, however, operators in Unit 2 are already maintaining this flow
rate.

There has been another important phone call to the plant while Miller is in
Harrisburg. NRC's Victor Stello in Bethesda has been fretting about the superheatedplant conditions: they might well be read as a symptom of an uncovered core. Around4:00 or a bit later, Stello has spoken with Greg Hitz in the Unit 1 control room, who has
assured him the message would be delivered to the Unit 2 control room. Apparently themessage is not received; if it is, it goes unheeded. There is no record of Stello having
communicated this message directly to the Unit 2 control room, or of his instructing his
own inspector in the Unit 1 control room to do so.

419 THE THUD

The "thud" that Gary Miller recalls hearing just before leaving for Harrisburg leaves
a somewhat greater impact on others in the control room, whose impressions vary, but
generally concur: a thump, a bump, a whoomp, a sound like the popping shut of aventilator damper. The sound Miller most likely heard was a water hammer in thereactor building spray system piping. This spray system was automatically triggered by
the pressure pulse from the hydrogen combustion in the containment building. In otherwords, Miller probably did not hear the explosion itself, only a secondary effect of it.
The event is clearly sketched on the pen-graph of an instrument recorder monitoring
containment building pressure: a "pressure spike" rising perpendicularly from ahorizontal line near the zero mark up to a point measuring 28 pounds per square inch,
then descending steeply back to near-zero, the whole measurement covering less thana 1-minute interval.
Shift Supervisor Bill Zewe is standing directly in front of the pressure indicator,
preparing to give Fred Scheimann the signal for opening the pressurizer block valve to
reduce pressure. in the coolant system. Zewe's face is perhaps a foot from therecorder. Later, he will recall:
I was watching it the whole time: Up, and down. I stepped back: everybody there did ... I said,"Did you see that ...?" So then we waited a few minutes and then we looked at everything
and everything looked normal. . . . We didn't know what it was (and) no one had any really
good ideas or answers. And we went on with the evolution at hand at that point.
I n shrugging off the pressure spike, the operating crew at TMI-2 adds to al engthening list of missed diagnoses which will make this hapless day memorable forthem. "We hadn't perceived any hydrogen at all in the building," Zewe explained in adeposition. "We didn't perceive we had temperatures to create any hydrogen." Herecalls discussing the phenomenon on the spot with Mike Ross and shift supervisor Joe
Chwastyk, and concluding that it was "some sort of an electrical transient."
Scheimann, Faust, and Frederick, the rest of the original foursome who had begun theaccident day in the control room and were being questioned at the same deposition,agreed that they believed a malfunctioning instrument was the cause of the spike-one
more example of disbelieving the bearer of bad news.
I n the context of a core that had been partially uncovered off and on for quite a longwhile earlier in the accident-a premise no one in the control room had granted up to
the moment-the spike would be as logical as it was ominous. With the hydrogen thathas been vented into the containment building as the block valve is cycled, all it takes is
one spark-perhaps a spark generated when Scheimann activates the block valveand whoomp. The operators perhaps can be forgiven for missing the above logic in thisi nstance: They have not yet accepted the first premise: that the core has been
uncovered and probably badly damaged.
The true nature of the pressure spike (that it was a hydrogen burn) will not be
generally recognized until Thursday evening, when things begin to come clear under42

the guidance of people who are not burdened by what had become the establishedcontrol room mindset.

I n a deposition conducted by the Special Inquiry Group, this colloquy takes place
between Control Room Operator Ed Frederick and Ronald Haynes, a NRC nuclear
engineer heading one of the Special Inquiry Group's task forces (and, incidentally, aformer nuclear reactor station manager and senior operator himself). Frederick begins:
It seemed to everybody in the control room, whether they were NRC or GPU or B&W, they allcame to the same conclusion: that there wasn't anything particularly significant_ about thatspike.

Haynes: That it was not due to a pressure spike? It was due to an electronic signal or ...
electrical transient? That was your evaluation?
F:

H:

Sure . . . What type of transient can cause a two million cubic foot building to pressurize
and depressurize that quickly?
I thought we were talking about the instruments.

F:

That's why none of us considered it plausible. It's impossible to do that.

F:

Based on our training, it was impossible.. ..If you look back through everybody's training
and the FSAR and safety analysis and the building construction, you will not see aparagraph that projects that type of transient. (It) is so particularly foreign andunbelievable that it has absolutely no significance. That's why nobody did anything about
it for two days.

H:

I wouldn't say it was impossible. I thought it actually occurred.

While most of the operators discounted the pressure spike, the Special Inquiry
Group has discovered that at least two men in the control room that afternoon did
recognize that an explosion had occurred. Brian Mehler and Joe Chwastyk, both shift
supervisors, observed that the building spray system is activated by coincident signals
from two out of three independent pressure measuring instruments-in other words,
the pressure spike was no electrical impulse, it was for real.
Mehler has since testified that he did not connect the spike with hydrogen, but rather
feared that some chemical reaction had taken place in the reactor building. Chwastyk,
however, had no doubts, and realized that the situation was a lot worse than he hadthought. Both men, they have since said, were more than a little frightened-but they
did not, it appears, successfully communicate their concern to their supervisors.

There seems to be no doubt that at least one NRC inspector was in the control room
when the spike appeared on the instrument, but neither the existence of the spike nor
i ts ramifications were reported back to Region I or Bethesda HQ that day. Chwastyk
believes he described to an NRC man his reasoning as to why the pressure pulse wasreal. But the Special Inquiry Group has been unable to pinpoint any such person, andChwastyk recalls that the NRC men did not seem to understand what was happening.
Chwastyk also believes, but is not certain, that he alerted Miller. Miller is quite sure hedid not.

43

10 MET ED AND THE MEDIAOver at the Observation Center on the east bank of the Susquehanna, the news
people are beginning to roll up in job lots by early afternoon, almost immediately
overtaxing the power company's somewhat snakebitten efforts to respond. Met Ed's
Herbein is quite unprepared for the 30-odd reporters who have been waiting for him totell them what is going on ever since his 11:45 arrival.

Herbein's burden throughout the first day of the accident will be essentially the sameas that of his operators and supervisors over in Unit 2 control: he doesn't know what isgoing on inside the containment. How do you explain this to a flock of generalassignment reporters facing deadlines, most of them wanting to know how close Three
Mile Island is to the so-called China syndrome? With minimal public relations
experience, Herbein confronts the classic public relations challenge: putting the best
face on a bad situation. His insight and his executive presence might be useful over inthe control room, but he has elected to stay out of Miller's hair, and now he is pinioned
by circumstance to the role of press spokesman.
Herbein will not be helped in these early hours by the official statements coming out
of Met Ed's information offices at Reading. Information Director Blaine Fabian has
l earned shortly before noon that radiation levels above normal had been measured off
site, yet he has issued a carefully worded statement that "there have been norecordings of any significant levels of radiation, and none are expected outside theplant." It is a textbook example of fact-contouring: true, but false. It will come back tohaunt Met Ed throughout and beyond the accident.

Although the Commonwealth of Pennsylvania will set the best example throughout
the week of even-handed public information, it should be noted that Lt. Governor
William Scranton is off to an uneven start. His early criticism of Met Ed for lack of
candor is based on a bad premise. In an afternoon press conference at the capitol,
Scranton sharply criticizes the utility for not informing the State in advance that steam
would be released to the atmosphere-steam that the State authorities believed to beradioactive. Ironically, this will turn out in hindsight to be a bad rap. Met Ed did not
notify the State of the release; but the steam, which was visible from the Observation
Center, came from the plant system that carries it from the steam generators to theturbines, and did not contain any radioactive release.
It is an early-albeit, in this instance, erroneous -confirmation of reporters' darkest
suspicions: that unpleasant facts are being covered up. Herbein and other utility
spokesmen will be struggling to climb out of this credibility hole, none too successfully,
for the next 2 weeks.

44

Robert Arnold, GPU Service Company vice president, dons an anticontamination suit before inspecting the damaged facility.

45

11 THE PUMP IS BUMPEDEver since Lee Rogers shrugged off Bob Arnold's concern about hot leg temperatures, Arnold's top engineers have continued to worry about what is happening at thesite. Indeed, had they known of the initial set of incore thermocouple readings, theleaking PORV, the throttling of high pressure injection, and the pressure spike, theywould have been a lot more worried. But the hot leg temperatures are cause enough forconcern.
Around 4:00 p.m., when it becomes clear that the high temperatures in the core area
are not decreasing very fast, if at all, Arnold's engineers prevail on him to take stronger
action. When Herbein returns to the Observation Center from the Statehouse in
Harrisburg about 4:30 p.m., Arnold reaches him by telephone. After a short discussion,
they agree that the plant crew should be instructed to repressurize the reactor, fill thecoolant system as full of water as possible, and make all efforts to restart a main
reactor coolant pump.
Herbein phones Miller and passes along Arnold's instructions. Miller and his men are
at first dubious about this new strategy; they think they are making progress with thereactor at low pressure. But after a short discussion with Herbein, Miller concurs in the
new plant, and measures are undertaken to put it into effect.

More high pressure injection water is pumped into the reactor. Pressure is increased.
The B&W task force in Lynchburg is solicited for advice on restarting the coolant
pumps. They develop the pump restart procedure and maintain constant telephone
contact with the control room during the restart effort. The principal question iswhether they should be started full-out, or just "bumped" (a quick run of 15 seconds or
so to measure the effect on the system). At 7:50 p.m., after a successful bump, theoperators put the 1 A coolant pump into normal operation.
This puts the reactor into the forced-cooling mode, at high pressures, and terminates
the major phase of the accident. For the first time since a few minutes after 4:00 a.m.
that morning, the plant has been returned to a relatively stable condition. The reactor
will now remain in this forced-cooling, high-pressure mode for several weeks, graduallycooling down. The crew, of course, still doesn't know how bad things really were, but
for once, their feeling of relief squares with the actual conditions inside the reactor.
Jack Herbein too recalls feeling reassured:I think we felt a lot better because forced circulation had been restored. We had hoped to go
ahead and cool the system down with the reactor coolant pump where we could consider
going over onto the decay heat. I think we recognized we did have fuel damage and that there
might want to be a more in-depth look at the implications of going over onto the decay heat
system before we actually made the switch.

I n spite of his position of responsibility, Herbein does not hold a monopoly on
misperception of the damage that has been done to the reactor core. Those inside theplant don't choose to believe the signs, and those outside aren't told. The whole truth
will elude everyone until late Thursday or early Friday.
46

I n Lynchburg, the B&W task force calls it a day, secure in the thought that everything
i s all right. At GPUSC headquarters in New Jersey, Bob Arnold's engineers too feelsatisfied that they have done a good day's work. They break up and leave for homearound 9:00 p.m., already planning a Thursday they feel will be taken up chiefly withorganizing an investigation and analysis of the accident.

This, however, is the true situation at TMI-2 on Wednesday night: The core is
physically disarranged to such a degree that cooling water flow is impeded and steam
pockets still surround some of the fuel. The reactor coolant system contains significant
amounts of hydrogen, which also tends to block cooling water flow, as well as posing
certain hazards of its own. In short, the situation is markedly different, and substantiallymore ominous, than it would be with the core basically intact and the fuel rod cladding
perforated only to a limited extent. Should the reactor coolant pumps be lost or systempressure drop again, continued core cooling would be endangered. And, although it is
not yet recognized, there already has been a potent demonstration of what can happen
when vented hydrogen collects in the reactor building.
With the failure to understand the continuing risks, there is also a neglect ofmeasures that might be taken to reduce those risks. Procedures could be developed,
for example, to drill the operators in the best means of coping with various malfunctions
that might still occur. Precautionary action could be taken to avert a decrease insystem pressure or a possible hydrogen explosion. Contingency plans need working on
for early warning in the event of a possible need for evacuation.
None of this is done. Things are much more stable than they were, but the accident is
far from ended. The plant is not fully under control. It is a stark fact that will not be fully
appreciated by the management and staff, or by the regulators, until Friday.

In the interim, because critical things that might have gone wrong did not, this lack ofappreciation does not affect the ultimate course of the accident, other than to delay
recovery action. It does increase the ultimate risk, however, because appropriate
contingency planning and mitigating actions are not underway.
Most important, insensitivity to the continuing danger on the part of key people in theutility and the NRC will affect the public perception of the accident and publicconfidence in the people in charge of protecting the public's interests. Early reports
now indicate all is well-things are under control. Later reports will show that they are
not at all.

47

12 I T'S COMING THROUGH THE WALLS
The opening efforts of the NRC information specialists on Wednesday have been
hardly more distinguished than those of Met Ed. Distance and miserable communications from the site are a major early impediment, but hardly an explanation for what
happens.
At 7:00 p.m., Walter Cronkite will begin his newscast for CBS:Good evening. It was the first step in a nuclear nightmare; as far as we know at this hour, noworse than that. But a Government official said that a breakdown in an atomic power plant in
Pennsylvania today is probably the worst nuclear accident to date. . . . But a nuclear safetygroup said that radiation inside the plant is at eight times the deadly level, so strong that after
passing through a three-foot thick concrete wall, it can be measured a mile away.

By the following morning, the ante will be raised on these statistics by NBC's Tom
Brokaw:. . . The Nuclear Regulatory Commission in Washington says radiation penetrated throughwalls that were four feet thick and it spread as far as 10 to 16 miles from the plant....

CBS is correct that radiation above normal levels has been detected a mile from theplant site. NBC is right that the walls of the containment building are 4 feet thick. But
the basic premise-radiation beaming through walls, and being detected at distantlocations-is wrong.

To anyone acquainted with reactor physics, the idea of a containment building so fullof radioactivity that it is penetrating those 4-foot concrete-and-steel walls with enoughintensity to be picked up by monitors more than a mile away-well, it is not only grossly
in error, but ridiculous in retrospect. Without question, the story broadcast that night byCronkite and others (Cronkite's is only the most conspicuous) is wrong; but it is anhonest error based on information from a source everyone presumed to be reliable.
The source is the Nuclear Regulatory Commission.
I n a press release issued at 5:00 p.m., on the first day of the accident, andspecifically tailored for the evening news show, the NRC has stated:. . . Low levels of radiation have been measured off the plant site. The maximum confirmed
radiation reading was about three milliroentgens per hour about one-third mile from the site. At
one mile, a reading of one milliroentgen per hour was measured. It is believed that this isprincipally direct radiation coming from radioactive material within the reactor containmentbuilding, rather than from release of radioactive materials from the containment. (Emphasis
added.)The news release has been cleared with at least three of the five NRC commissioners
by NRC's veteran director of public affairs, Joseph Fouchard. It is read over the phone
by Fouchard, from the Incident Response Center (IRC) in Bethesda, to Commissioners
Victor Gilinsky, Peter Bradford, and Richard Kennedy in their offices in downtown
Washington.
48

Conversations at the IRC are being routinely tape-recorded and a transcript of the
discussion shows that the Commissioners' apparent chief concern is toning down any
language that might contribute to public fear. Commissioner Kennedy seems concerned about overstress of the word "accident": "People think of accidents, you know
. . . i n the context of 'The China Syndrome.' Is this an accident?" he asks Fouchard.
"What is an accident?""I believe it's an accident, Mr. Kennedy," replies Fouchard.

Another concern obviously centers around the use of any language suggesting a"release" of radioactive material. This is where they get into trouble with the press
statement:
KENNEDY: ... do you think they're going to understand what it means? Direct radiationfrom the stuff inside the containment?
GILINSKY:KENNEDY:
GILINSKY:
VOICE:
VOICE:
VOICE:
VOICE:GILINSKY:
VOICE:
VOICE:
VOICE:
VOICE:GILINSKY:

It is useful to say that as opposed to saying-I mean explaining that there isn'tthat a release doesn't seem to be the cause of this; . . . otherwise you getyourself caught up into how much has been released.

Couldn't we say, "There appears to be no airborne release of material," orsomething? Huh?
Well I'm not sure we can ... (a flurry of voices at this point).
I don't think we can say that.
You have to be qualified.
Yeah.

Because they did have-you know, they did vent at some earlier point, and I
think that you couldn't ...

But you could believe that this is principally direct radiation coming fromradioactive, rather than fromRelease ofThat's fine.
Okay.

That will help it.
All right.

The perception that apparently eludes the commissioners is that there are a number of
media people knowledgeable enough to realize how stoutly that containment building isconstructed. If radiation is passing through 4 feet of concrete and structural steel insufficient quantity to be measurable a mile away, that is scary indeed, and worthfeaturing.
Not all reporters covering the story are bedeviled, as are their network colleagues,
by the harassments of working a 5:00 p.m. press release into shape for the evening
news shows. Several of them check with sources at NRC-HQ in Bethesda, and some ofthese conversations are taped at the IRC's message center at East-West Towers. Oneof these transcripts, a revealing colloquy between Stan Benjamin of AP, a knowledgeable reporter, and an unidentified NRC spokesman, provides a working example of ajournalist going after a fact that the source doesn't want him to have. Here are
excerpts.
49

BENJAMIN:
NRC:

What is this business about a report of shine from the building itself?

Yeah. I think that there-low levels of radiation have been measured off theplant site. It looks like the maximum confirmed reading was about three mr(milliroentgens) per hour at about one-third of a mile from the site.

BENJAMIN: (later in the conversation) ... but are the emissions supposed to be comingfrom the plant itself?
NRC:

BENJAMIN:NRC:

BENJAMIN:
NRC:

It's believed that this is principally direct radiation coming from the radioactive
material which was (inaudible)-still within the reactor containment building.
What kind of radioactive material?

Oh, it would be what-you see, they released some primary coolant water to thecontainment and they've got some fairly high levels of activity in the containmentbuilding, andWhat do you mean by fairly high?

Well ... I'm not quite sure, but they've got some fairly-well, they've got a hellof a lot of radioactivity in that containment building.

BENJAMIN: (further in conversation) ... Could the coolant water itself be possibly thatradioactive.. .
NRC:

BENJAMIN:
NRC:

I wouldn't think so. Hold on just a minute. (After conferring with two men in the
background) They say no, there is radioactivity in the building, you know, thecoolant water is part of it, but it's not--it wouldn't be hot enough to give you thatkind ofWhere else could it possibly come from but the fuel?

That's the only place I know, but I don't know what the situation is there.

BENJAMIN: That means the fuel itself is unprotected?
NRC:

No, the water is-the core is covered.

NRC:

With water. I said the emergency core cooling systems are continuing to provide
water to cool the fuel.

BENJAMIN:BENJAMIN:NRC:

BENJAMIN:
NRC:

With what?

Well, in that case how could that much radioactivity-

I don't know and I can't speculate for you right now, Stan.

Well, okay, if you guys have any ideas, if you get ... a milliroentgen a mile
offsite, which is at least a mile from the plant ...
Um-hum.

BENJAMIN: ... and you've got walls that are four feet thick with carbon steel wire ...
NRC:

BENJAMIN:
NRC:

Urn-hum.

How much radioactivity do you have to have inside to get through that kind of
barrier?
You have to have an awful lot.

BENJAMIN: That's right. Will that indicate a runaway reaction?
NRC:

No. No, indeed. No....

The NRC has restructured the facts just a bit to avoid any implication ofcarelessness-or leakage-at the plant. The story finally put out-that radiation was
through the containment walls-must seem innocent enough as it goes out. But when
the newspeople, doing their job, add up the dimensions and substances of those walls,
emphasizing the enormous concentrations of radioactive matter such an offsite reading
would connote, the deviation becomes monstrous. Instead of giving depth to a disasterstory, Cronkite and the others have found themselves innocently embellishing a lessthan truthful statement which they had taken in good faith, as the truth.
50

Reporters and photographers are pouring into the area, now, and few among them
have more than superficial background in nuclear physics. For them, this is a strange
new kind of disaster story-no flames, no twisted wreckage, rising water or funnel
clouds, no dead or injured; quiet; odorless. You have to hope that someone knows
what was going on, and that they will give solid information and straight answers when
they have it all figured out. This is not a very good start.

51

Beginning on the 29th, Met Ed officials Walter Creitz and John Herbein
held daily press conferences near the plant; the briefings ended after
the 31st.

52

13THURSDAY THE INTERLUDE

I n the total context of the accident the second day, Thursday, is a day for thedrawing of deep breaths; a day for Wednesday's crews, many of whom, like Zewe,
Faust, Frederick and Scheimann, have put in more than two shifts, to get some needed
sleep. It is a good time for members of Congress to put in an appearance. A day whenthe media will be jostling for a Second Day story-and diligent reporters striving
desperately to catch up to what was going on during that unheard-of Wednesday. The
most insightful of them from the better-endowed organizations will be beseeching their
Washington bureau offices to send them up a copy of the NRC's A Handbook of
Acronyms and Initialisms, to ease them through briefings and interviews with engineers
spouting things like ECCS, small-break LOCAs, HPI, ACRS, I&E, B&W, NRR.
I n a real sense, the utility and the NRC will spend a great part of the second day
straightening out the tangle of misleading first-day stories which they had been
instrumental in circulating or trying to modify. For example, the first day's radiation
problems, though real, were less severe than originally projected, and came as a resultof gaseous releases from leaking and overflowing plant systems, not from being
beamed through the fortress walls of the reactor building out to the countryside.

The impression is abroad that the accident is over. Many editors are soliciting theirreporters for wrap-ups on TMI-2, and preparing to "take the story inside" the paper on
Friday. The whole scene is reminiscent of the post-shootout setting in a Western movie:
the good guy blows the smoke out of his pistol, picks up his white hat and walks toward
the saloon to partake of one on the house; while off in the corner of the frame andunnoticed, presumably dead, the bad guy pulls himself together and reaches for his
gun lying in the dust, and the low-tone music signals: don't leave, folks.
On Thursday morning the plant operators are still running a reactor coolant pump toforce coolant water through the core. But the core is not cooling down as expected.
There is substantial accumulation of hydrogen and radioactive gases in the system.
Some of this gas is accumulating in the makeup tank as a result of normal operation of
the letdown system, which must be kept on to provide "seal injection" for the running
reactor coolant pump.
Aware of abnormally high amounts of gas in the coolant system, though not yetaware of the hydrogen content, the operators begin at 4:35 a.m. on Thursday to "burp"
the makeup tank, venting gas from it for short periods of time through an exhaust pipe
called a "vent header." Later that day, the operators became aware that the ventheader leaks, and that using it as a conduit for moving gas to waste gas decay hold-up
tanks results in releases of radioactive gases through the auxiliary building exhaustsystem and out to the atmosphere.
NRC-HQ in Bethesda is made aware of this procedure, which is regarded as anecessary evil. Lake Barrett, a member of the HQ technical staff responsible forassessing radiological information, is closely monitoring the buildup in the waste gas
decay tanks. It is less clear that the NRC management in Bethesda is aware that this isbeing done or that the vent header leaks.
53

At the site Jack Herbein has become, virtually by draft, a media figure as spokesman
for Met Ed, and it is these duties that dominate his schedule: taping the morning
network shows at 7:30 a.m.; press conference at 10; briefing for a member of the State
Public Utilities Commission around noon; briefing a congressional delegation at 2:30
p.m.; another congressional delegation later. Herbein checks periodically with Miller
and the GPUSC engineers regarding plant status, authorization for the taking of areactor coolant sample, and the need for resources at the site. In later depositions, hewill discuss the frustrations of his public relations functions, but will say he believes it
was something that had to be done.

Bob Arnold's chief Thursday concentration is on organizing the investigation,
analysis and recovery effort-on the presumption that the accident is about over. He
l earns from GPUSC engineers at the site that high pressure injection was cut backWednesday morning, and discusses this with GPUSC President Dieckamp by phone ataround 11 a.m. It helps to explain the early radiation readings that indicated coredamage; assuming HPI had been functioning normally, the engineers had beensurprised by the signs of core damage. They also discuss their belief that Herbein is not
yet aware of any of this.
Dieckamp and Arnold decide to send Richard Wilson, Manager of TechnicalFunctions, to the site to lead the GPUSC investigation, and to send additional
personnel along with him. The investigation is beginning to shape up as a substantiallyheavier operation than was envisioned last night. Wilson and the others arrive on theisland at about 2 p.m. Thursday.

During this relatively placid interlude, considerable attention is turned to health
implications for the people living near the plant. In a morning phone call, Lt. Gov.
Scranton asks Commissioner Gilinsky in Washington whether it might be wise to advisethat school children in the Goldsboro area over on the west bank of the river should
stay indoors. The call is returned by Harold Denton, who tells a Scranton aide he does
not believe such a measure is necessary. Nor, Denton says, does he feel it advisable atthis time to warn sick and elderly persons not to go outside: radiation readings are well
below EPA guidelines. It is the first time since the accident began that high-level
Federal officials have become involved in the matter of precautionary protective
measures for the public.

Met Ed holds its first formal press conference at the Aztec Room of the convention
center in Hershey, Pennsylvania, at 10 a.m. More than 100 media representatives turnup, an unanticipated response that utility officials call "overwhelming." Met Ed
President Creitz (whose day has begun at 5 a.m. with tapings of the "Today Show" forNBC and "Good Morning, America" for ABC), opens the press conference and turns it
over to Herbein. Herbein repeats in general the optimistic assessment of the plantsituation he gave on CBS's "Thursday Morning" show at 7:30: the plant is stable, theplan is to switch to decay heat removal later in the day, at which point the plant will bein the "cold shutdown" condition. Trace amounts of radioactive materials are still being
released off-site, Herbein continues, and there are high levels of radiation in the reactor
building, although one monitor is believed to be giving an erroneous reading. There are
two to three feet of water on the reactor building floor, and action is being taken to
reduce the trace amounts of radioactive materials escaping from the spill to theauxiliary building; there has been some fuel failure; safety systems have functioned as
designed, Herbein concludes, and hopefully, releases to the environment will beterminated in about two days.
54

I n the questioning that follows, the Met Ed Vice President tries to convey a generally
upbeat tone. He acknowledges that the utility has not ruled out the possibility of humanerror in the accident. He gives a reasonably detailed sequence of the accident andsays that most of the "paths" leaking radioactive materials from the auxiliary building
will be closed off by the day's end. The utility is not certain, he says, just how long thecore was uncovered; he estimates that perhaps 1-1 /2 to 1 % of the fuel rods
experienced some damage.

Confronting this many reporters is a tough routine, even for seasoned press
secretaries, and toward the end of the press conference, civility-both Herbein's andsome of the reporters'-is beginning to wear a bit thin. Under hard questioning
regarding radiation dangers, Herbein snaps: "I can tell you that we didn't injure
anybody in this accident, we didn't overexpose anybody and we certainly didn't kill asingle soul. . . ." Some reporters get the notion that Herbein is dodging their harderquestions. In fairness, he is an engineer, and it is difficult to respond to technicalquestions without resorting to technical jargon that is totally opaque to mostnonengineers.
The press conference lasts about 90 minutes. By afternoon the power company will
have set up a news center in the Hershey convention center to handle day-to-day
inquiries. Henceforth, however, formal press conferences will be held closer to theplant site, at the American Legion hall in Middletown.

Early in the afternoon, the Pennsylvania Secretary of Health, Dr. Gordon K. Macleod,
places a conference call to Dr. Neil Wald, Chairman of the Department of Radiation
Health at the Graduate School of Public Health, University of Pittsburgh, in an effort toreinforce the State's knowledge with respect to radiation. The call is taken in Governor
Thornburgh's ornate 19th Century office on the speaker phone. Present, in addition to
Macleod and the Governor, are Lt. Governor Scranton and several members of theirstaffs. The discussion centers on radiation exposure, particularly at high levels, butthere is no mention whatever of evacuation.
Later in the afternoon, Dr. Macleod receives a phone call from Dr. Anthony Robbins,
director of the National Institute of Occupational Safety and Health (NIOSH) of the
Department of Health, Education and Welfare (HEW). Dr. Robbins is seriously
concerned about the TMI accident, he says, because of the "inability to shut down thereactor." He recommends to Macleod that Pennsylvania officials "consider evacuationof the people around TMI." Robbins says he has consulted with the Bureau ofRadiological Health at the Food and Drug Administration (FDA).
Following the Robbins call, Macleod places a conference call to PEMA Director
Oran Henderson, BRP head Thomas Gerusky, Deputy Health Secretary Emmett Welch
and John Pierce, aide to Gov. Thornburgh-passing on to them Robbins' concern andwhat Macleod deems to be Robbins' recommendation.
The consensus of this group is that radiation levels do not now warrant evacuation,and that there is not enough information about the ability of the power company to shut
down the reactor to justify such a decision. All agree to get back in touch if further
problems arise at the plant.
55

During this conference call, Macleod also has focused attention on the greater
vulnerability of prenatal infants and small children to radiation dangers. In an informal
poll, the group rejects a suggestion that there be an evacuation of pregnant womenand children under the age of two.

By noon Thursday, there are 24 NRC people onsite. Back at NRC Headquarters, astaff delegation is dispatched into Washington to brief the commissioners in theiroffices at 1717 H Street, N.W. Victor Stello and Harold Denton, who have stayedthrough the night at the NRC, are relieved by their deputies, Darrell Eisenhut andEdson Case. Eisenhut goes to give the briefing to the Commission.
The briefing is vague on many counts: it discloses the reality that the NRC-HQ has
only limited knowledge. The NRC staff does not really know what happened to theplant, nor do they know just what condition the plant is in now. There is only the
comfort that it all seems to be over.

Eisenhut, prepared for this briefing by Stello, does not bring up Stello's concern ofthe day before about superheated steam conditions signifying that the core was
uncovered. Commissioner Gilinsky, to whom Stello explained his concern, does notraise the issue either.
Chairman Hendrie, who was away the day before, asks about the large temperature
differences that were seen in the reactor coolant system. Eisenhut acknowledges themto Hendrie and attributes them to "steam binding ... or a bubble somewhere in thesystem. "Eisenhut and the other staff spokesmen, Ed Jordan and Brian Grimes, convey someof the optimism that is being expressed publicly by the utility spokesman. Radiation
measurements are recognized as signs of fuel failure, but the highest levels in the domeof the reactor building are discounted. Switching to the decay heat removal system forfinal cooldown is believed to be imminent. There is discussion of preparations for
postaccident investigation. Continuing releases of radioactive materials from water
previously spilled on the floor of the auxiliary building come in for rather uncertain
discussion, but there is no apparent recognition at all of releases from the reactor
coolant system, which is now showing very high radioactivity levels.
Following the briefing, Chairman Hendrie proceeds with senior staff to Capitol Hill to
update some members of Congress at 11:30. His basic message is a repeat of what hehas just been told: the accident at Three Mile Island is about over. Reflecting theprevalent China Syndrome syndrome, one congressman asks, "How close did we cometo a meltdown, to a Chinese Syndrome?"-"Nowhere near," says Chairman Hendrie.
Hendrie is mistaken; it was closer than anyone at this point even guesses.

At TMI there is another small tempest, involving not danger-in-fact but dangerperceived, on Thursday afternoon. Under normal plant conditions, wastewater fromshowers, laundry facilities, toilets and leakage from buildings (control, turbine,
warehouse, etc.) contains little radioactive material. It is discharged into the Susquehanna River if it is within NRC limits. Nevertheless, as a precautionary measure, Met Ed
has stopped discharging the wastewater on Wednesday, and by midafternoon
Thursday, approximately 400,000 gallons of it have accumulated, threatening to
overflow the tanks.
56

With the concurrence of NRC officials on site, Met Ed notifies the State Bureau of
Radiation Protection that it is discharging the wastewater. It is considered necessary,
has the approval of NRC, and is rationalized as insignificant; for this latter reason there
is no notification of communities downstream, or of the press.

When the Lt. Governor learns of these releases, he is very angry, since he believes
that the State was not informed. Again, this is a bad rap for Met Ed, but no one steps
forward to inform the Lt. Governor that BRP had been made fully aware of theimpending discharge. Chairman Hendrie, also unaware of this agreement reached at
the site, orders these releases stopped as soon as he learns of them. His order isobeyed at around 6 p.m., after some 40,000 gallons of wastewater has joined theSusquehanna. The prospect of overflow persists, of course, but neither the NRC
people onsite nor Governor Thornburgh's staff wants credit for authorizing a further
discharge. After hours of gingerly negotiating, there is a press release crediting theState Department of Environmental Research (DER) with issuing the order, with whosenecessity the DER concurs "reluctantly." The discharging of wastewater is resumed.

Late in the afternoon, there is a striking example of the Commission's failure toappreciate the gravity of the situation at TMI when they return to business as usual.
There is a scheduled public meeting in their Washington office having nothing whatever
to do with the crisis up in Pennsylvania. Its purpose is a continuation of discussion on"SECY-79-154A," a report to Congress on "Means for Improving State Participation in
the Federal Nuclear Waste Management Programs"-not an unworthy endeavor by
any means, but a distraction, under the existing conditions. All five commissioners areon hand for the meeting, as well as eight top NRC staff officials, several from Bethesda.
Meanwhile, more NRC people arrive at the site from the Region I office and a team ofseven under Richard Vollmer arrives from NRC Headquarters in Bethesda. But the newarrivals cannot communicate back to their headquarters any better than could theoriginal NRC teams on the scene. Vollmer recalls crawling under a table in the
Observation Center with a phone to get away from the noise. He finally gives up andgoes back to a motel in Middletown to communicate with Bethesda. Harold Denton
l ater describes the difficulties NRC was having reaching its own people at TMI bysaying that NRC people sent to the site seemed to go up there and fall "into an
Einsteinian black hole."
GPUSC's Wilson has arrived at TMI around 2 p.m. to lead the investigation. After aconference with his own crew and a preliminary look around the plant, he meets at 5p.m. with Miller and some members of the plant crew. One of Wilson's requests is for an
early opportunity to interview operators about the accident. Miller demurs. In later
testimony, Wilson will recall concluding after this meeting that the situation is worse
than he had suspected.
Thereafter, Wilson urges his employers to seek immediately as much help as possible
to bring the plant under control. His feeling is not based on tangible evidence.

At the time Wilson is not yet aware of the in-core thermocouple readings, thehydrogen burn or the non-condensible gas bubble in the reactor coolant system. He is57

made apprehensive by general indications: the need to wear respirators onsite, thelack of progress in cooling down, a request by Kunder for engineering assistance in thecontrol room, some grasp by GPUSC engineers of the inital stages of the transientand now, perhaps, by Miller's feeling that recovery is not far enough along to permit
interviews of operators.
This definitely is not a plant approaching cold shutdown. Wilson recalls conveying
this discomfiture on Thursday evening to Bob Arnold and to Dick Vollmer of the NRC.

Arnold responds quickly by getting back in touch with Dieckamp, who will later recall
that there was a general "awareness of a greater need to provide additional levels oftechnical support to the plant ... Bob (Arnold) said he had thoughts aboutorganization and people and tasks division support ... I said, 'Gee, I'm sure you've got
to do that; just go straight to the site and begin doing it. Don't bother to check with meon that'."Whatever his apprehensions following his talk with Wilson, Arnold does not fully
realize the extent of instability at the plant until his arrival there Friday morning.

Sometime Thursday evening GPU engineers discover the pressure spike from the
Wednesday afternoon monitoring graph, and conclude that it was a hydrogen burn. Itfits in with the present collection of noncondensible gas in the top of the reactor vessel
and contributes to the growing sense of uneasiness in the control room.
Earlier that evening, two of the NRC's onsite investigators, Charles Gallina and Jim
Higgins, drive to Harrisburg to brief Governor Thornburgh and Lt. Governor Scrantonprior to the Governor's 5 p.m. press conference. Their message is that potential danger
to those off site has virtually ended. They are not aware of the high concentration ofradioactive material in the coolant system underlined by a reading at 4:15 p.m. showing
a 1000-R/hr dose rate on contact with a 100-milliliter sample of coolant water. (Anestimated 10% of the radioactive inventory in the core has been released to thecoolant.)

Gallina and Higgins are given these readings when they return from the press
conference and Higgins calls the Governor's office with a revised forecast. But, as theGovernor will later recall, by then he has already lost confidence in the NRC men.
In TMI-2 control, there is growing acceptance of the idea of a non-condensible gas
bubble in the coolant system. The crew begins efforts to determine the bubble's size
and nature.
Around midnight, Wilson receives a phone call telling him of the bubble. It will be ahectic Friday.

58

WHAT ARE YOU
14EVACUATIONPEOPLE DOING TO US?

Friday, March 30, will be the day most vividly remembered by people who live around
Three Mile Island. Wednesday, the day of real danger, had brought a lot of suspense, afair quotient of fear and a good many rumors. But the heavy media interpretation of theaccident made little impact until the evening network news, and by that time the local
stations had the word that the accident was over.

True, there were some disconcerting disclosures in the network stories, someunsubtle suggestions that people at the plant were not quite sure what had happened;but the pressure was off. By Thursday, there was time to gossip and compare notes
and exhale in relief. On Friday, Wednesday's apprehensions and drama will be reborn
and multiply, and Thursday's calm will be shattered.
Friday will bring back the accident like the back-half of a hurricane after the "eye"has passed. On Friday, schools will be closed, and parents and parents-to-be will bescared half out of their wits; thousands of families will scurry to throw belongings into
their cars, unwilling to face the risk entailed in staying in their homes another night.

Understanding the third day of the TMI-2 accident necessitates at least a superficial
mastery of what has been going on in the reactor station auxiliary building, a dull andunimposing structure, normally of interest only to people in the nuclear power industry.
The three most important pieces of auxiliary building equi ment to bear in mind, (see, which is leaking; and theColor Plate 1) are: the makeup tank ®; the vent header
waste gas decay tank ® .
As previously noted, one of the problems facing control room operators as they try tobring Unit 2 to cold shutdown is the presence of abnormal amounts of noncondensible
gas in the coolant system. The mounting long-range concern of the engineers is that a
growing bubble of this gas, which they are beginning to feel sure includes substantial
amounts of hydrogen, will become large enough to push down the water in the reactor
vessel and make coverage of the core impossible.

The gas is also collecting in the top of the makeup tank, which is vital to the balanceof the coolant system. The makeup tank operates at a lower pressure than the rest of
the coolant system, and the operators fear that an increase in gas pressure may raise
the tank pressure to the point (80 psi) at which the relief valve beneath the water in the
makeup tank will open and empty the makeup tank water into the "reactor coolant
bleed tank" (not shown in Color Plate 1). To compensate, the operators would then be
A N
compelled to tap the borated water storage tank (BWST) 116
for makeup system water.
This, in turn, would reduce the inventory of the BWST, which is the major source ofwater for replacing losses of coolant such as occurred in the accident on Wednesday.
I

To remove some of the gas and keep down the makeup tank pressure, the operators,
since 4:35 a.m. Thursday, have been venting the tank for short periods of time by wayof the vent header to the waste gas decay tanks. Because of the leaking vent header,59each "burping" of the makeup tank vent results in a release into the auxiliary building
and through its exhaust system to the atmosphere. The gas from the makeup tankcontains substantial amounts of radioactive material.
To minimize these releases, an auxiliary operator is sent each time into the auxiliarybuilding to turn on the waste gas compressors just before the vent valve is to beopened, in order to suck the gas through the vent header as fast as possible. The
compressors are situated between the vent header and the waste gas tank. The
technique is to run the compressor until pressure in the vent header drops to 3 psi, thenopen the vent valve until vent header pressure reaches 15 psi, then close the vent valve
until vent header pressure drops to 5 psi, then open the vent valve again, over and overuntil the desired reduction in pressure is achieved in the makeup tank.

The process is made no less complicated by the necessity for the auxiliary operator
to suit up with protective clothing before each entry into the highly radioactive auxiliarybuilding. In all, it is a somewhat bizarre operation, but under the circumstances about
the only course the crew can take. It has worked quite well until 4:35 a.m. Friday, just
24 hours after the first effort, when the worst happens: makeup tank pressure climbs to80 psi, the relief valve opens and all of the water from the makeup tank runs out into thereactor coolant bleed tank. The operators are forced to switch over to the BWST for
their source of makeup water and face the possibility of eventual loss of their primarysource of standby emergency coolant.
The four men who will play significant roles in the ensuing decisions are by now
familiar figures in the accident scenario: James Floyd, the operations supervisor of Unit
2, who was at the B&W plant in Lynchburg ror simulator training at the time of thereactor trip on Wednesday; Shift Supervisor Bill Zewe, who was on duty at Unit 2 at thetime of the trip; Operator Craig Faust, who was on with Zewe; and Greg Hitz, who had
come on duty in Unit 2 on the Wednesday day shift.

Today, Hitz arrives on site at 6 a.m., scheduled to relieve Zewe. Upon entering thecontrol room, he is informed by Faust and Ed Frederick (another familiar figure) thatthey are "trying to hold the pressure in the makeup tank but (it is) ... gradually
increasing." One of the operators tells Hitz, "We are not keeping up, and will have to
do something; - an auxiliary operator is suited up and ready to enter the auxiliarybuilding to start the waste gas compressors.
Hitz is watching the situation at this point, and is "pretty sure" he recalls the makeup
tank relief valve cycling open and shut two or three times. Finally, the operators areunable to keep the relief valve from opening; the pressure in the drained makeup tankstays high; the level of water in the BWST keeps dropping, and the level in the reactor
coolant bleed tank keeps rising, threatening to overflow.

Zewe, who has been on-shift since 10:30 p.m. Thursday, is being interviewed by GPU
personnel between 5:45 and 7 a.m. and thus is absent from the control room when thetank levels begin to signal a serious loss of water from the BWST. When he returns tothe control room, Zewe learns of the zero level in the makeup tank, a 2- or 3-foot dropin the BWST level and overflowing bleed tanks. At this point, a decision is made to open
the vent valve on the makeup tank and, ultimately, to leave it open until makeup tankpressure is all the way down.
60Floyd will testify before the President's Commission that he ordered the valve
opened. Zewe, Faust and Hitz will testify before the Special Inquiry Group that Floyd
had no active role in this decision. Floyd, aware of the others' accounts, will later tellthe Special Inquiry Group, "whether the operator (Faust) was looking at Mr. Zewe orl ooking at me at that particular moment in time, who he took his instructions from atthat particular moment, I don't know." It is a diverting but rather pointless discrepancy.
Whichever man gave the order, it was concurred in by everyone in the control room; allfour of the men advocated the action.

A more significant disagreement in testimony arises in the matter of just when it was
decided to leave that vent valve open. Floyd claims that he was thinking in these terms
from the start. But according to both Zewe and Hitz, it was Zewe's intention simply toreseat the relief valve, and to shut the vent valve when makeup tank pressure dropped
to 65 psi. However, when this point was reached, according to testimony, Zewe, after"strong urging" from Operator Faust and a discussion with Hitz, decided to leave thevent open and monitor the radiation release.
Once this was done, Zewe feels any subsequent gas build-up can probably behandled "in small puffs ... instead of a great big release every so often."

From a plant standpoint, the continuous venting is a success: makeup tank pressure
drops, the relief valve reseats and water is restored to the tank. The price, of course, isthat there has been a substantial release of radioactive material to the atmosphere as aresult of that leak from the vent header into the auxiliary building and out the building
stack. The operators expect this, and make preparations to monitor and cope with it.
What they cannot know is that errors, combined with an almost unbelievablecoincidence, will team up in Bethesda to generate an evacuation scare that will comeperilously close to panic in the area around Three Mile Island.
This will be a day marked, even more than its predecessors, by horrendously poor
communications, seemingly everywhere. Indeed, plant management has not even beenaware of this periodic venting up to this time. Station Manager Gary Miller, now alerted
to the venting-and-release problems, has come into the control room and put Zewe(returned from talking with the GPU engineers) in charge of plant operations, with Hitz
in charge of communications. Floyd, apparently unaware of this, is also handlingcommunications, and this causes trouble immediately.

As the venting begins, Floyd calls the emergency control station over in the Unit 1
control room and requests a helicopter to monitor releases over the plant. Floyd does
not discuss this with anyone else in the Unit 2 control room, nor does he know that Hitz
has called Unit 1 on the same matter. Not only that-Hitz also has asked emergency
control to notify PEMA and BRP of the venting and of a "planned but uncontrolled
release."Almost an hour after the venting of the makeup tank is underway, Unit 2 control
receives a reading from the monitoring helicopter: 1200 mr/hr at 130 feet above theexhaust stack (an altitude of 600 feet above mean sea level). This reading is transitory
and is not greatly different from other transitory readings taken the previous afternoonof 3000 mr/hr at 15 feet above the stack during venting of the makeup tank. At thispoint, Floyd, suddenly fearing the possibility that when Faust goes to close the vent61

valve it might not close, decides that he must personally alert PEMA to a possible need"to evacuate people downwind of the plant." Unable to get through to PEMA, Floydcalls Dauphin County civil defense and asks that they have PEMA call him. PEMA's
Carl Kuehn calls back at 8:40 a.m. and is told by Floyd, according to Kuehn's
testimony, that the plant has had an "uncontrolled release," that the plant might
evacuate noncritical personnel, and that PEMA should be prepared to evacuate
people downwind.
To Kuehn, Floyd sounds somewhat overwrought. Floyd will later testify that he wasonly testing PEMA's readiness status, and he will characterize the telephone
conversation as the classic communications mixup of all time.

At virtually the same moment, the plant emergency control station over in Unit 1,
alerted by Hitz, is on another line, calmly telling PEMA's Jim Cassidy about the 1200mr/hr reading 130 feet above the stack, and 14-mr/hr reading at the site boundary.
Earlier BRP had been warned by the Emergency Control Station that the first releasewould result in the highest radiation level, and that levels could be expected todecrease significantly in the next few hours, back down to where they were the day
before.
Thus, when PEMA's Lamison relays Floyd's request to BRP's Margaret Reilly, shealready has received similar information from the plant. She is puzzled, but not alarmed
by the duplications. She sends monitors to the area.

Moving one more step up the escalator, Lamison thereupon reports both Cassidy's
and Kuehn's information to PEMA Director Oran Henderson, noting Kuehn's description of Floyd as being extremely excited. Henderson, a former infantry colonel in
Vietnam, immediately informs Lt. Governor Scranton, who reports the 1200-mr/hr
exposure rate to the Governor's office. Paul Critchlow, the Governor's press secretary,walks all this information next door to check it with Karl Abraham, the NRC Region I
press officer who is quartered here during the accident emergency. Abraham says hewill check it out, and calls the NRC in Bethesda.

At 9 a.m., Reilly tells Lamison that the releases have been contained. The samecannot be said for the reports of the releases, which have developed a life of their own.
And to these, another report has been added. Back in Bethesda at the Incident
Response Center, Lake Barrett is fretting over an 8:45 a.m. telex from regional
headquarters reporting a conversation with Inspector Jim Higgins up at the site. The
telex reads:
The seal return to the makeup tanks was causing excessive gas pressures in the makeup tankwhich was directed to the waste gas decay tanks which were full. The waste gas tanks werebeing released to the stack. Pennsylvania Civil Defense was being notified by Licensee.

Barrett has been deeply concerned about those waste gas decay tanks: once they
are full of concentrated radioactive gases any additional gas will be released directly tothe vent stack.

The factor to keep in mind here is that the report is wrong. The waste gas tanks are
not being vented to the stack; this is not a valid concern at this time. Barrett, of course,
does not know this. He does some quick calculations, based on data he received
Thursday evening, and projects an alarming hypothetical release rate from the waste
gas tank venting.
62

John Davis, a member of the NRC's Executive Management Team (EMT), is standing
nearby as Barrett arrives at these projections, and he urges Barrett to take them nextdoor to brief the EMT. The duty officers on the EMT at around 9 a.m. are Lee Gossick,Executive Director for Operations; Harold Denton, Director of Nuclear Reactor
Regulation; and John Davis, Director of Inspection and Enforcement. Also in the room
are Joe Fouchard, Director of Public Affairs; Harold (Doc) Collins, Assistant Director
for Emergency Preparedness, and Edson Case, Denton's deputy.

Barrett is asked to estimate what the offsite dose rate might be. Based on his roughprojections, Barrett estimates that a member of the public at the site boundary might be
exposed to 1200 mr/hr, a figure so high that exposure for only an hour could exceed
EPA evacuation guidelines for sensitive individuals.
At this precise moment, as though scripted, there is a call into the EMT from Karl
Abraham, calling on the speaker phone from the Governor's offices: there is a report ofa 1200-mr/hr reading from "one of the cooling towers"; is it true? The EMT apparently
panics; they forget that Barrett's 1200 mr/hr is an offsite ground level number andAbraham's is apparently on site, directly over the plant. They forget that Abraham isasking, not telling. The EMT scrambles, amid talk of "moving people," "biting thebullet," and "better safe than sorry." Consensus is quickly reached: evacuation.
Denton asks Barrett for more advice: How far out for evacuation? Barrett has not
given the matter any thought, but suggests 10 miles. A hurried discussion results inshading the recommendation to 5 miles for now: 10 miles would include parts ofHarrisburg, and all manner of extra complications.

Sensing the urgency of the situation, Collins asks the administrators what they wish
him to do, and is told by Denton to "call the State of Pennsylvania and recommend thei mplementation of this precautionary evacuation."

It is 9:15 when Doc Collins reaches Henderson at PEMA with the EMT recommendation. He is reassured when Henderson tells him PEMA has already heard of the 1200
mr/hr reading. (It is logical that their reports are self-corroborative: the information has
traveled full circle from Floyd to PEMA to Critchlow to Abraham to Collins and back to
PEMA's Henderson.) The accelerating factor, unknown to Henderson, is the erroneous
Higgins report regarding the full waste gas tanks.
Henderson tells Collins PEMA is awaiting word from the plant before making any
moves on evacuation advisories, and Collins responds: "We're recommending herethat you go ahead and evacuate people out to 10 miles in the direction of the plume."
Henderson responds: "We'll start with 5 miles."The situation bears striking similarities to Wednesday morning's abortive evacuation
alert. The difference is that the NRC's emergency managers, unlike the BRP earlier,have executed an astonishing list of thou-shalt-nots; chief among these are the failure
to check precisely where the 1200-mr/hr reading was taken (not offsite, but directly
over the plant stack), and what the actual offsite readings were. And once the hip-shot
response is formulated, it is taken not to the Governor's office but to a State civil
defense apparatus that is eager to be tested.
Commenting in a later interview about the need for involvement of the right agencies
before taking emergency action, Governor Thornburgh will say: "In Pennsylvania,
63

PEMA's role is to manage the emergency, not to recommend evacuation. PEMA
mentality (during the TMI-2 accident) was akin to being all dressed up with no place togo-leaning forward in the trenches. We had to be careful about that attitude."Colonel Henderson duly notifies the chain of command-Lt. Governor Scranton's
office and the Bureau of Radiation Protection. At the latter, Gerusky admonishes
Henderson's deputy that BRP has no information to justify an evacuation, but he will
check and call back. A bit testily, he also questions why Collins would first notify PEMA
instead of his organization. It is not an illogical question.
As the Lt. Governor briefs the Governor, Henderson is calling Kevin Molloy, theDauphin County Director of the Office of Emergency Preparedness, advising him to beprepared for a possible evacuation. Molloy is told to expect the order in 5 minutes, as
Henderson is 90% sure the Governor will issue such an order. Molloy moves swiftly into
his emergency plan, alerting all appropriate agencies in the county, including the public
via radio station WHP, the primary emergency broadcast station " . . . that there (is) a
possibility we might have to evacuate, and if we did, this is what the people should takewith them and basically this is where they should go."Around 10:00 a.m. control room operator Ed Frederick, just off-shift at Unit 2, wearily
drives by Augie's Place in Middletown to pick up some sandwiches for the Unit 2
control room crew. He is startled to see construction workers throwing their gear into
their cars and pickups, and early shoppers scurrying away as though being pursued.

I n Augie's, the proprietor himself is getting ready to lock up: there has just been aradio announcement on WHP Harrisburg that there has been some big release over at
the plant, and people should prepare to evacuate from a 5-mile radius. This includes
Middletown.

After trying to calm the proprietor, Frederick goes out to a pay phone and calls an
open line in the Unit 2 control room. "What's going on," he asks Greg Hitz. Hitz hasheard nothing about it. Zewe is in the control room when Hitz takes Frederick's call. He
hears Hitz tell Frederick, "You've got to be kidding." Hitz relates Frederick's startlingnews to Zewe, and both men bolt for the shift supervisor's office where Gary Miller isgoing over some data with NRC Inspector Jim Higgins.
Zewe tells Miller, "Frederick says they're evacuating Middletown and the surrounding area. What's wrong?" Miller turns on Higgins: "What are you people doing to us?"Higgins, taken aback, defensively denies knowing anything about any evacuation, andstarts calling NRC personnel at the Unit 1 control room and the Observation Center.
They know nothing about it either.

In less than 10 minutes, senior NRC officials in Bethesda have made and executed
an incorrect evacuation decision for the Three Mile Island area. It will be countermanded by Governor Thornburgh, but not before letting loose fear that will roll around thearea like a loose cannon, doing incalculable damage to the morale of this placid, stableregion.
64

BRP, meanwhile, has been trying to backcheck the basis for Collins' recommendation. There is no question of Collins' credentials: he is both highly reputable andauthorized to speak for the NRC in this instance. But what was the basis for thisincredible advisory?
Bill Dornsife, a BRP nuclear engineer, talks with NRC Inspector Charles Gallina at
the plant site; Gallina says flatly that no NRC personnel onsite could have provided
information leading to Collins' call-not, completely accurate, of course, for Higgins'
erroneous report of the full waste gas tanks had certainly been a contributing factor.

BRP's Margaret Reilly is on the phone as this is going on, making it clear to Collins
that BRP sees no reason to order an evacuation. Collins says he was following orders,
and that Chairman Hendrie will be calling the Governor shortly. The following is anexcerpt of the conversation:
COLLINS:

Well the decision, I think, was based on the, on the, on the activity levels thatthey were given. You know.

DORNSIFE: I talked to Chick Gallina in the plant. He, he's (inaudible words).
COLLINS:

Huh?

DORNSIFE:

Chick Gallina in the plant, just can't comprehend how, how-

DORNSIFE:

But relay the information that you screwed our situation up so incredibly-

COLLINS:COLLINS:DORNSIFE:

VOICE:
VOICE:COLLINS:REILLY:COLLINS:REILLY:Yeah, I know, but, you know, we got a, we got a lot of big wheels sitting herearound tables; and well you can tell them to go stuff it, sure ... I understandthat, but look it. Look it. You don't work, you know where I am on the totem pole,okay?
Yeah, well anyway, anyway I understand the Chairman is calling the Governor.
And what the Chairman's going to say to the Governor I have no idea.
Well make sure he gets his facts straightYeah.

-before he talks to-Yeah, but folks here that were sitting here recommended that. That we call
Henderson and tell him that.

(Inaudible 2 words). Whoever is at the bottom of this, he better start naming
names and good stuff like that, cause there's going to be pieces of tissue allover the place.

We don't have any pieces of tissue, I don't know. You don't, you don't agreewith the CD Department. Henderson just called me, Margaret, less than 10
minutes ago; and he said that he doesn't agree with the Health Department.
He don't have, he has your information though. He doesn't have our information.

By about 9:45, BRP has completed its checks with NRC in Bethesda and on site, andis convinced evacuation is not necessary. Now, however, they are unable to getthrough to the PEMA or the Governor's office: the phone system is jammed by calls
triggered by Molloy's broadcast alert.
Dornsife races to the PEMA offices, Gerusky to the Governor's office to present theirpersonal opposition to an evacuation.
65

By this time, NRC-IRC in Bethesda has been in touch with NRC personnel on site,and has learned:• That the 1200-mr/hr was a local exposure rate taken right over the containmentbuilding, not off site.
• That the relief valve that had lifted was on the makeup tank, not the waste gas decaytank.
• That actual offsite monitor readings are not alarming, and there is no reason for an
evacuation alert at the present time.

It is shortly before 10 a.m., and the day is only beginning. The NRC's Executive
Management Team in Bethesda now is able to reach the NRC commissioners in their
downtown offices. Under questioning from Chairman Hendrie, the EMT managers
retreat a bit from their earlier position, but still counsel a precautionary evacuation
recommendation because of the uncertainty of the situation-an uncertainty to which
they have been heavy contributors. Brian Grimes, however (Assistant Director forEngineering and Projects), hardly goes along: the most that should be done, he tells
Hendrie, "is to tell people to stay inside this morning."
Commissioner Bradford suggests that the conservative approach would be toconfirm the staff's evacuation recommendation, but there is no consensus among thecommissioners for any particular position. In the meantime, Hendrie, although plagued
at this point by inadequate and conflicting information, prepares to place a call to
Governor Thornburgh. Hendrie's own phone rings: the Governor has beaten him to it.
Even though the commissioners have made no decision, Hendrie, after a brief
exchange with the Governor on the phone, suggests that "people out in the northeast
quadrant within five miles of the plant stay indoors for the next half hour." It is 10:07
a. m.

The conversation is interrupted as both men are given new information on radiation
readings at the site-the Governor from Gerusky, the Chairman from the IRC in
Bethesda. Gerusky notes that wind is picking up and the plume should be dissipating: itprobably doesn't "make any difference now whether they stay indoors or not." Hendrieaccepts Gerusky's assessment, but thinks NRC's suggestion for people staying indoors
may still be wise. Thornburgh asks if there will be any more of these releases and the
Chairman replies that "we may very well get them again, I think," but that he hopes
NRC will have advance word if and when they do. Finally, Hendrie says they might aswell wait until they know for sure.

I n this somewhat roundabout fashion, the EMT's unequivocal 9:15 a.m. recommendation for evacuation is rescinded.

Meanwhile, at 10:00 a.m. •warning sirens scream eerily in Harrisburg. Later, Molloy
will claim that they were not county civil defense sirens-that they apparently
originated on State property. Regardless of their origin, tensions mount and the
populace is needlessly spooked.

66

At 10:25 a.m., Governor Thornburgh speaks (live) over Station WHP in an effort toreglue the shattered composure of his constituents in the Three Mile Island area.
Almost simultaneously, the Governor's press secretary, Critchlow, is briefing newspeople about the results of Thornburgh's talk with Chairman Hendrie, straightening out thefacts about the offsite radiation readings, the absence of any need for evacuation, andthe advisory for citizens of the area to remain indoors for a while. But instead of the
5-mile radius, Critchlow says 10 miles-inadvertently extending the advisory's coverage from a population of 36,000 to 135,000 persons. The good citizens of the area canbe forgiven by this time for feeling a bit groggy: a little more than an hour ago, they
were being advised by Molloy's broadcast to pack their bags and be ready toevacuate. Then they hear loud sirens. Now they are being told to close their doors andwindows, turn off air conditioners, and stay inside.

67

15 "THE UTMOST OF CAUTION"
In Washington, Chairman Hendrie, who is but one of five members of a collegial
executive, finds himself suddenly being solicited for executive answers and decisions
with very little solid information to draw them from. The best he can do under thecircumstances is give personal opinions and hope for the best. NRC's Edson Case willsummarize Hendrie's plight bleakly but not without sympathy:"The information you will have in the next hour may be as sketchy or less than you had the lastti me; the plant is in a tender state, not really knowing what they are doing and I have no
confidence they will know come the next time."

Until now, the White House has presented a low profile in the TMI-2 crisis. Now, atabout 10:45 a.m., President Carter calls Chairman Hendrie and is brought up to date on
the plant's status insofar as it is known to the chairman, on Hendrie's conversation with
Governor Thornburgh and on the general difficulties of communication with the site.
The President says he will have the White House communications group give every
assistance. He adds that he wants the chairman to suggest a "responsible senior
official to go to take charge at the site on behalf of the Federal Government," and to be
the President's direct contact at the site. Hendrie suggests immediately that Harold
Denton would be "the best person" (he has already planned to send him).
Shortly after talking with Hendrie, the President calls Governor Thornburgh, tells him
Harold Denton is on his way, and concurs that there is no reason for implementing
emergency measures. This is a remarkable recovery for Denton, who only this morning
had given Doc Collins the order that set off the evacuation scramble.

He will prove to be a fortunate choice. A man of easy confidence and a nonabrasive
manner, Denton will succeed in largely disarming a suspicious press contingent, and infocusing both the efforts and the image of the NRC. He will arrive at the scene of theaccident carrying virtually everyone's franchise-the President's, Governor Thornburgh's, the NRC commissioners', the NRC-EMT's-and bring with him a squadron of
NRC technical experts. Denton will project an image of a person who, if he does nothave the answers, will be willing to look for them and to share them once they arefound.
Denton's arrival, though aimed at problem-solving, creates a few logistic complications of its own. Denton and his staff, like Vollmer the day before, find no facilities ortelephones to use at the Observation Center, which now is packed with utility personnel
and alive with roving media people.

Finally a Met Ed employee, who lives across the driveway from the Center, turns over
his home to the NRC contingent. Denton uses the living room as his headquarters
pending arrival of NRC trailers. The kitchen and garage of the home ultimately serve as
the NRC Trailer City mess hall.
Victor Stello, who accompanies Denton as his deputy at the site, turns out to be aresourceful scrounger, drawing on his knowledge and acquaintances in the area (he68grew up in Pennsylvania). He quickly lines up temporary use of a State police
communications trailer parked nearby, and this will be the telephone center until NRC
communications are established later in the day, with a special telephone line directly
to the White House switchboard.
Back in Washington, the NRC commissioners are finding it hard to let go of thepossible need for evacuation. If not a general evacuation advisory, what about anadvisory to those who might be particularly sensitive to radiation exposure, or to those
who simply do not need to be in the area just now? "It boiled down," Hendrie will recall,"to children and pregnant women where they reasonably could leave, had some place
to go, on the basis that those elements of the population are known to be sensitive toradiation exposure."

There is no formal vote, but it appears to be the sense of the commissioners thatsuch an advisory be recommended to Thornburgh. Chairman Hendrie calls theGovernor at 11:40 a.m. and is quickly advised of pressures on Thornburgh forevacuating pregnant women and preschoolers. According to Tom Gerusky, who ispresent as the call comes over the speaker phone, Hendrie responds: "If my wife waspregnant and had small children in the area, I would get them out, because we don't
know what is going to happen."
As Gerusky and Dornsife leave the Statehouse and walk back to their offices after
the telephone conversation, they mark the strange transformation that has taken placearound them. Instead of the usual, bustling Friday morning atmosphere of downtown
Harrisburg, the streets are virtually empty.
At a 12:30 p.m. press conference, Governor Thornburgh announces:
Based on advice of the chairman of NRC, and in the interests of taking every precaution, I am

advising those who may be particularly susceptible to the effects of radiation-that is,pregnant women and pre-school age children-to leave the area within a five-mile radius of theThree Mile Island facility until further notice. We have also ordered the closing of any schools
within this area. I repeat that this and other contingency measures are based on my belief thatan excess of caution is best. Current readings are no higher than they were yesterday.
However, the continued presence of radioactivity in the area and the possibility of further
emissions lead me to exercise the utmost of caution.

Over the course of the morning, the attitude of the media representatives has
become increasingly hostile, particularly toward Met Ed and the hapless Jack Herbein.
Many of the reporters have their bags packed to leave-several have left-when theevacuation scare breaks at about 9:00 a.m. They do not like this story; it is extremely
difficult to understand, and it is, frankly, frightening. All of this surliness is focused on
Herbein as he arrives for an 11:00 a.m. press conference at the Middletown American
Legion Hall. Adding to the generally petulant mood is the presence of some newly
arrived reporters, whose basic, square-one questions irritate the old-timers who havebeen at the scene since Wednesday.
Burdened by the fact that he has not heard the 1200-mr/hr figure for the stackrelease, the Met Ed Vice President grows increasingly testy. At last, when asked why
69

the press was not notified there would be a discharge of waste water into theSusquehanna, Herbein blows up. That was yesterday, after all. "I don't know why weneed to tell you each and everything that we do ... ," he snaps. It is not the responseof a man who looks forward to a future in public relations.
I n spite of all the distractions of the makeup tank venting crisis, the growing focus ofa lot of engineers and technicians during Friday morning has been on that gas bubble
i n the top of the reactor vessel. As knowledge of the Wednesday hydrogen burncirculates (it does not reach NRC-HQ in Bethesda until about 11:00 a.m.) there is little
question that the bubble is hydrogen, generated as the overheated Zircalloy fuelcladding voraciously combined with oxygen from the steam in the reactor core on
Wednesday.

B&W chemist Don Nitti has determined that there is little danger of oxygen being
generated in the core by radiolysis (the effect of radiation splitting water molecules,
H 2 0, into hydrogen and oxygen gas) because the existence of excess hydrogen will
suppress that process.

And without a substantial amount of free oxygen being present, the hydrogen in thereactor coolant system cannot burn or explode. B&W engineer Don Roy predicts it willtake 3 days to get rid of the bubble by using a cycling process he has developed which
employs the letdown, makeup, and pressurizer systems to coax the gas out of thereactor vessel. The NRC's Roger Mattson, Director of the Division of Systems Safety,
believes it will take much longer. Mattson briefs Chairman Hendrie early in theafternoon about the extensive core damage and the now-accepted view of thepresence of hydrogen. He recommends-horrors-evacuation, because of his fearthat Met Ed, in order to stop further releases, may be stampeded into depressurizing
once again, which would risk a meltdown.

Earlier, Hendrie has talked with GPUSC Vice President Robert Arnold to request thatthe utility take no action "like releases or changing the operating mode of the reactor
and the containment essential to safety systems" without consulting NRC. Apparently,
the chairman has been reassured by Arnold's response, for he makes no comment on
Mattson's forebodings.
At 1:30 p.m., Hendrie attends a meeting in the White House Situation Room, chairedby Zbigniew Brzezinski, with participants from the Departments of Defense and Energy,
the Joint Chiefs of Staff and a whole Scrabble set of supporting agencies, plus WhiteHouse aides Jody Powell, Jack Watson and Eugene Eidenberg. A Brzezinski memo to
the President quoting Hendrie gives his assessment of the accident situation:
Potential hazards exist . . . due to a hydrogen bubble about 1,000 cubic feet in size which
could press the cooling water below the core, thereby causing heating and fission material
release within the contaminated plant area; a few percentage probability that this material
could escape into the open air; if this occurred, there would be 6 to 12 hours notice; and that
evacuation of the population in about a 20-mile downwind range could be required.

During this meeting, White House responsibility shifts from Brzezinski to Jack
Watson, and it is decided that all information about the plant will come from or throughHarold Denton, who will be in direct touch with Governor Thornburgh, the NRC and theWhite House. Jody Powell will oversee releases in Washington, the Defense Civil
70

Preparedness Agency (DCPA) will perform as lead agency for contingency evacuation
planning, and the Federal Disaster Assistance Administration (FDAA) will perform as
l ead agency for coordinating all other Federal efforts to support plant activities andprovide resource needs for possible evacuation.

One of the early mysteries of the Three Mile Island crisis centered in speculation over
how Zbigniew Brzezinski, the President's National Security Advisor, came to be
i nvolved in a Pennsylvania powerplant crisis. The answer carries a suggestion that theWhite House, not unlike several other centers of authority, was a bit unstructured when
it came to meeting a domestic nuclear emergency. The White House Situation Room,which was on the NRC's "call list," was notified at 9:00 a.m. on Wednesday.
Commissioner Gilinsky, however, separately called Jessica Tuchman Mathews of theWhite House staff with whom he had been working on some nuclear proliferation
studies for the NSC. Ms. Mathews took down the information from Gilinsky around 9:00
a.m. Wednesday, and walked it in to her boss, Brzezinski. The National Security
Advisor took the information with him and relayed it to President Carter at the morning
briefing at 9:15 a.m.
Jessica Mathews would remain the White House point-person throughout the crisis,
even when the chief responsibility shifted from Brzezinski to Jack Watson; by all
accounts she acquitted herself admirably. As to why the National Security Advisor
headed the White House TMI-2 response for 48 hours, the answer is that he was
Jessica Tuchman Mathews' boss; and in a sense he volunteered.

I n the course of Friday afternoon, the Governor's office, specifically Critchlow and
Jay Waldman, Thornburgh's executive assistant, establish phone contact with Watson,
Mathews and Eidenberg. Mathews fills in Waldman with information on plant status she
has received earlier from Gilinsky, and from Hendrie's briefing at the Situation Room.
This somewhat ominous news is passed on to the Governor, who interrupts a meetingfor his own direct briefing from Mathews. Thornburgh outlines for Mathews the problem
he has in reconciling word from at least two NRC sources-onsite and in Washington-as well as disparate information coming from his own people. Denton's new
portfolio will largely alleviate these difficulties. When Hendrie calls at 3:41 p.m., he finds
the Governor already pretty well briefed on the bubble situation, and the fact of very
extensive core damage.
In response to Thornburgh's query, Hendrie says he feels it might be prudent toevacuate out to 20 miles "if we suspect getting a fairly husky release.""What are the potentials for an explosion that would rupture the core, the vessel?"asks Thornburgh.
The chairman replies: "There isn't any oxygen in there to combine with thathydrogen, so the answer as far as I know is pretty close to zero."

The conversation ends to enable Thornburgh to take a call from Denton, who has
arrived at the site 2 hours earlier with his NRC experts from Bethesda. Denton
71

describes the four task forces he has established to study the situation, and reviews
what is known about fuel damage and the bubble over the core. The day's releases, hesays, were routine noble gases, measuring 1 to 20 mr/hr on site, and are no threat.
Arrangements are made for Denton to visit the Governor's office later that night.
I n Bethesda earlier in the afternoon, an NRC press room has been opened in the
East-West Towers building, on the floor above the IRC. Its aim is to provide media withaccess to NRC briefers who can explain the complexities of plant systems and what inhell is going on up in Pennsylvania.

An interesting pattern has developed in press coverage of the story: most of thepeople up at the site are general assignment and feature writers. Some of the science
writers and specialists are here in Washington, wisely working the agencies and gettingsome of the better stories. A chief frustration until now has been the basic scatter of
NRC sources: the commissioners downtown; the division chiefs strewn around
Bethesda (and now moving up to TMI-2 in many cases); the information office in the
Bank Building; the IRC and EMT in the East-West Towers. Smart reporters are shuttlingfrom one to another in the hope of picking up a fresh angle. The new press center will
hardly end the confusion-indeed, it may well contribute to the two whoppers yet tobreak.
The first story breaks Friday night, right out of the press center opening, wrecking
what comfort Governor Thornburgh might be enjoying in the arrival of Denton, thevastly improved communications facilities, and the boost from the White House.

One of the briefers at the new NRC press center is Dudley Thompson, an IE officer.
He gets credit for getting the center off to a spectacular start simply by acknowledging
what, to most nuclear technicians with any knowledge at all of the TMI-2 situation, is afairly mundane fact: Yes, a core meltdown is always a possibility; remote, but ....

Whomever Thompson was responding to, the person did not stick around to hear thequalifications; this was the first acknowledgement by an official source that the China
Syndrome might be more than a movie. Thompson's response carried no surprises. But
here in the new NRC press center-particularly in contrast to Chairman Hendrie's
reassuring Thursday response to Congressmen that a "Chinese Syndrome" had noteven been close-one of the wire services (UPI) believes it has itself a story: "TMI
Accident Poses the Ultimate Risk of Meltdown." Whatever the story's journalistic
merits, it succeeds in breaking up the brief calm that had settled over the Harrisburgarea, where 4 hours earlier the Governor had reported to the people on his talks with
President Carter and Chairman Hendrie, concluding: "There continues to be no needfor panic or implementation of emergency measures."
I n Washington, the NRC commissioners still seem to perceive their informationalroles somewhat oddly as they struggle-much as they had with the "radiation fromcontainment" press release Wednesday evening-to compose a press statement
downplaying this bubble in the top of the reactor vessel, and its potential for further

72

Pennsylvania's Governor Richard Thornburgh was reluctant to accept
the initial NRC staff recommendation to evacuate without moredefinitive information.

73

mischief. The commissioners are recorded as they craft another press release, this one
to go out at 6:30 p.m.:
KENNEDY: It says that, it says that there's evidence of severe damage to nuclear fuel.
Possibility exists of interrupting coolant flow within the reactor, etc., several
options can be considered, in the meantime a state of .. .

AHEARNE:

The whole flavor is very optimistic and .. .

HENDRIE:

Ok, let me read. I think we ought to stick this paragraph right under the top. The
Chairman of the NRC said this afternoon that contrary to some media reports
there is no imminent danger of a core meltdown at the Three (Mile) Island
nuclear plant. New paragraph. Technical experts from the Commission staff
headed by the Director of Nuclear Reactor Regulation, Harold Denton, reached
the site early this afternoon. At the direction of the President they have been
provided with all granted communication facilities, the NRC team at the site is;working closely with the utility personnel and experts from other Federal
agencies and the State of Pennsylvania. Close contact has been maintained with
Governor Thornburgh. New paragraph. Go to here. There has :,een, ends
up

KENNEDY: I don't think it's optimistic. It just says we're working hard. Which happens to be
the case. The focus, I think, has to be reassuring ... reassure people that atleast we're working on it.

KENNEDY:

Why don't we say close contact is being maintained instmd of "has been"?

At his 5:00 p.m. press briefing, Jody Powell says that the meltdown story is "at thevery least speculative." And Harold Denton checks in by phone with the Governor,
telling him there is no imminent hazard, as there are ways to cool the core. At 10:00
p.m., the Governor, Lt. Governor Scranton and Harold Denton hold a press
conference. Thornburgh, still striving to calm the situation, says that after having spent
an hour and a half with Denton-the man assigned to Pennsylvania for the duration, by
the President-he can announce that "no evacuation order is necessary at this time."
For his part, Denton puts down the core melt story by saying the possibility "was very
remote." It is very close to what Dudley Thompson said to the reporter earlier in theday, but in this context it sounds reassuring.
Although Joe Hendrie has reassured the Governor that there is no danger of thehydrogen bubble exploding-because there is not enough oxygen present-his
associates are aware that this possibility is a continuing concern for the chairman. In
conversations with the other commissioners, he frets about the chances that, over the"next many days, or a week, or weeks, enough oxygen would be produced for the
bubble to be in flammable configuration." He wants to make sure a team is working onradiolytic decomposition calculations.
Despite the distractions Friday evening resulting from the meltdown story, Hendriecalls several staff members, urging them to study radiolysis. Roger Mattson, who says
he never heard of the problem, suggests he will get Denwood Ross and Merrill Taylor,
two NRC staffers now at the site, to work on it. Hendrie urges Mattson to reach out fora "different set of guys," because the men at the site are tired, and he does not want
any slip-ups.
74

On the 30th, NRC's Harold Denton was sent to Three Mile Island as the
President's representative.
He asks Darrell Eisenhut, deputy director of NRC's Operating Reactor Division, to
get a totally independent calculation of oxygen evolution rate and an estimate of
detonation pressure. Eisenhut says he will consult Westinghouse, and will also ask Saul
Levine, NRC Director of Research, to begin working on the problem. This will be thefirst time the experts in Research will be asked to help in the emergency. Another big,
scary story is building.
Friday has been a wild, uneven day, beginning with an evacuation scare and closingwith a meltdown scare-both quite groundless, as it would turn out. In between there isheartening evidence that Met Ed and the NRC are beginning to get their acts together.
75

The media contingent begins to grow again; no one is sure yet just what this is allabout, but any nuclear accident that lasts this long and scares this many people is too
big a story to walk away from now.

This has been the day when GPU President Herman Dieckamp begins calling in help
from the industry-soliciting other utilities, reactor manufacturers, architect-engineer
firms, the Electric Power Research Institute (EPRI), and consultants, not to mention
Government agencies and the national laboratories-NASA, Oak Ridge and Argonne-and such individuals as N. J. Palladino, Dean of Penn State's School ofEngineering, and Sol Levy, a prominent nuclear energy consultant from California andformer head of nuclear engineering at G.E. They will respond by the hundreds,
beginning this weekend. With Denton's arrival, there are now 83 NRC people at the site
who are beginning to take an interest in the plant operations and, parallel to Med Ed'sand GPU's efforts, starting to recruit help from outside sources.

Victor Stello calls from the site and asks NRC-HQ to try to recruit a robot he haslearned may be located at the Oak Ridge National Laboratory's plant in Tennessee. It
could be useful to have a remotely operated device possibly capable of performingsome tasks inside the TMI-2 auxiliary building. The robot, Herman, is located andarrangements are made to ship it to TMI by truck, a 14-hour haul. For more than aweek, the press will clamor for photo opportunities of Herman in action. Late in the day,another, more sophisticated robot is located at Eglin Air Force Base in Floridaoverkill, possibly, but worth checking out ...

76

16THE HYDROGEN BUBBLE SCARE

Through it all, the people around Three Mile Island have been models of admirable
mass behavior under stress. They seem to accept, better than most, the fact ofdisaster, whether natural or manmade. (There have been serious floods in recent years.
In June of 1972, Hurricane Agnes flooded large parts of Harrisburg including thecapitol itself.) They respect public officials, tend to follow sensible directives and above
all, keep their heads. But they have about had it with this nuclear accident.

The first word on Wednesday was cold comfort: the worst nuclear accident in history
at a commercial power plant is happening in their backyard, but everything is all right.
Since then, they have been alternately soothed and scared by relays of experts andspokespersons who are presumed to know what they were talking about, but frequently
come down 180 0 apart as to what's happening. The locals have been instructed toprepare to leave, to stay indoors, to stay off the phones in order to keep the lines clear,
to remain tuned to their local stations for word of what is going on. When the publicannouncements begin to overlap and cancel one another out, and resort to the phone
is necessary, the line is busy. Thousands of people, feeling expendable as weeds in awindstorm, have simply given up waiting to be told what to do-they have drawn down
their bank accounts, dropped the pets off at the animal shelter and taken off to visit
relatives or to check into a motel somewhere out beyond this 20-mile radius that seems
to be the largest zone of danger under discussion.

Wednesday it was a reactor out of control; Thursday everything was fine; Friday
morning, there is a radioactive release scare and an evacuation false alarm; and the
bedtime story Friday night is a possible meltdown. Now NRC Chairman Hendrie is
working on an interpretation that will eclipse them all before the day is out ...
To this day, months after the TMI-2 accident, no one seems quite sure what started
Joe Hendrie worrying about a hydrogen explosion inside the Unit 2 reactor vessel; onlythat it seemed to hit him Friday night. Until then, the unflappable NRC chairman had
been a leader in the reassurance brigade. Perhaps it has something to do with theconfirmation that there had been a hydrogen explosion in the containment building on
Wednesday; word of that had reached NRC headquarters only shortly before noon on
Friday.

The one fact on which there is general concurrence is that Chairman Hendrie is not
someone whose views are taken lightly. Anyone familiar with the NRC knows that here
is one of a bare handful of persons in the NRC structure whom many staffers would
follow over a cliff. Of the five NRC commissioners, only Hendrie has an extensive
nuclear background: he is a physicist; he had been chairman of the NRC's prestigious
Advisory Committee on Reactor Safeguards; he had been a top NRC staff official
before becoming a commissioner (an unheard-of progression, incidentally); and before
that had toiled prominently at the Brookhaven Laboratories. He alone, of allcommission chairmen back through the AEC days, is an expert on nuclear reactors.
77

Pregnant women and pre school children who
evacuated the area on Friday were provided
with food and shelter by Red Cross workers
at the athletic arena in Hershey.
78

F

"If Joe is worried," summarizes one NRC official, "we had better take it seriouslynot because we are scared of him, but because he is that good." And Joe Hendrie, on
this day, will start nuclear analysts up the scariest siding yet ...
The one comforting thing about hydrogen, particularly if you are a newsperson, isthat everyone including yourself has a pretty good idea what you are talking about.
There is nothing exotic or new about hydrogen: it was there at the top of the valence
tables when your grandfather was taking general science. The Hindenburg was filledwith hydrogen when it burned. And the bubble expanding in the top of the reactor
vessel now is identified as hydrogen-no longer "non-condensible gases." Itspresence is stark proof that the reactor core was uncovered for a long time, very badly
damaged and-although no one, including Chairman Hendrie, has yet acknowledged
it-very close to a meltdown on Wednesday.
The concentration until now has been on getting rid of the hydrogen in order to put
the reactor into cold shutdown. No one has been worrying about an explosion because
it has been presumed that there is no oxygen present in the reactor vessel. The
chairman believes now that the intense radioactive level in the system may be inducing
radiolysis, freeing oxygen molecules from the coolant water.

The Met Ed, GPU and B&W people who are controlling the plant do not follow
Hendrie's new line of reasoning for a minute-they are convinced that the excesshydrogen in the system prevents the freeing of oxygen. Nevertheless, such is the stateof their image with the media that they are not eager to take the matter public. Whilethese people proceed with measures for shrinking the hydrogen bubble, perhaps adozen scattered experts and consultants of the NRC, at Hendrie's request, start
digging into their reference files and calling around to test the Hendrie hypothesis.
By now, media people are an accepted part of the scenery-indeed, in places such
as Goldsboro, where an estimated 90 percent of the citizenry has left town by Saturdaynight, there are more reporters around than residents. The total press entouragecovering the accident now easily exceeds 300; they are everywhere. And most of themshow up at the Legion Hall in Middletown this morning to kick around Met Ed's Jack
Herbein one last time: Met Ed has announced it will no longer hold press conferences;
the NRC-i.e., Harold Denton-will henceforth be spokesman for plant status.
Herbein has some news: the hydrogen bubble has been reduced to two-thirds its
Friday dimensions, and the crisis at TMI-2 is over. Herbein, it will turn out, is correct;
but who is paying attention to Herbein these days?

An hour later, Denton says the crisis is not over, gladdening the hearts of a nation of
Sunday headline-writers with a perfect balance of stories: "It's Over"-"It's Not Over."Denton also takes issue with Met Ed's figures on the bubble size. (Later this evening,
Jack Watson will call Herman Dieckamp from the White House to fret over the
conflicting reports; Met Ed will instruct its news center in Hershey to refer all questionsof plant status to NRC, and to limit its responses to background information on Three
Mile Island.)79

From early in the accident, Pennsylvania's Bureau of Radiation Protection had
referred all press queries to the State Department of Environmental Resources. Now,
under a general tightening of information, both DER and PEMA are deferring to theGovernor's press secretary, Paul Critchlow. The White House, specifically Jody Powell,
has assumed responsibility for all press statements concerning Federal emergency
support to Pennsylvania. With Saturday's developments, public sources of information
are streamlined to these: Denton for plant status, Powell for emergency assistance, andGovernor Thornburgh's office for evacuation and emergency response. For now, thepress accepts this limitation of news sources; the wisdom of it will later be questioned.
Thornburgh himself will offer the opinion that "we can't get away with it next time."

On balance, the quality of Met Ed's information has not been that bad -overall at
l east as accurate, if not more so, than the NRC over the course of the accident. Manyof the accusations of misinformation have to do with things the utility has neglected tomention, or on which it has been misinformed by its own people at the plant, or which it
has simply not known. Finally, the reporters' perceptions of Met Ed's information
almost from the beginning has been conditioned by the misfortunes of Jack Herbein.
NRC's continuing refusal to collaborate with the utility on plant status briefings is
consistent with the agency's original fixation on avoiding the appearance of conflict ofi nterest. The NRC has been inordinately touchy about appearing in any way to assume
j oint responsibility for plant operations with Met Ed during the accident. Be all that as it
may, just now seems an unfortunate time for Met Ed to lose its voice, since at the
moment the utility is accurate in its evaluation of the plant status, is making the rightmoves to bring it to cold shutdown, and seems inclined to give more details about it.
After a sorry start, Met Ed has regained its composure.
Hendrie's fears will prove groundless, as he will be the first to admit. The hydrogennever explodes in the reactor vessel; it blows up, instead, in the media.

At a Saturday afternoon press conference, Chairman Hendrie makes the notion of ahydrogen bubble explosion a public concern. Responding to a hypothetical question
about a hydrogen detonation, Hendrie says:
Okay, . . . with regard to the bubble in the vessel . . . that is a problem which is of concern andwhich we are working on very intensively at the moment. As long as the bubble has hydrogensteam fission product as composition, why, it's not flammable. But if enough oxygen over al onger period of time were evolved, why, it could become a flammable mixture. Now, it's a fairly
high pressure, 1000 pound-per-square inch environment, and contained in the vessel dome; infact, at the moment a little too well contained for our purpose; ... there aren't ignition sources
at hand ... staff calculations and other calculations are being done for us by other experts
around the country. This preliminary indication from that is that we are some time from any
possibility of a flammable condition. But that is a preliminary result, and it is a concern, and weare working very hard on that.

The intensity of the chairman's forebodings is obvious to his associates. Earlier in theday, he has called Denton at the site, urging him to be sure Governor Thornburgh is
given a sense of the risk that oxygen generation would present, and to be thinking
along the lines of "what does it mean about our judgment on advising evacuation?"
Following his press conference, Hendrie calls the Governor to report "we've had somereturns from the technical group around the country that are working on the problem,
and it appears that it's at least not near term, not something we have to deal withi mmediately."
80The media explosion is more imminent. Associated Press reporter Stan Benjamin has
written a story out of the Hendrie press conference, and later in the evening he calls tocheck it out with Edson Case and with assistant Public Affairs Officer Frank Ingram.
Benjamin asks how soon the oxygen might accumulate to a state of explosiveness withthe hydrogen. Several days, he is told. Another AP reporter working the story calls
another NRC source, and gets another answer: 2 days.

At around 10:30 p.m., a Benjamin editorial advisory moves on the "A" wire: "Urgent(with Nuclear). The NRC now says gas bubble atop the nuclear reactor at TMI shows
signs of becoming explosive. A story upcoming." In Harrisburg, an aide rips theadvisory off the teletype and takes it to the Governor.
Shortly before 11:00 p.m., NRC's Karl Abraham calls Bethesda to report from his
temporary office in the State capitol: Paul Critchlow has just stormed into his office,shouting: "Karl, you should have told your people in Washington to keep their ---ing
mouths shut, because the Governor is getting sick of it. You're causing a panic!"

Thornburgh asks Critchlow to call Harold Denton, who labels the story hypothetical.
On his way to the Governor's office, Harold Denton swings by the capitol pressroom
and tells reporters there is no danger at this time. The bubble will not be explosive for 9
to 12 days, and there is plenty of time to correct the problem. Denton meets with
Thornburgh for a few minutes, and at about 11:00 p.m. they hold a press conference, atwhich the Governor does his best to be reassuring:Good evening. I have just completed a routine briefing from Mr. Denton . . . There have been anumber of erroneous or distorted reports during the day about occurrences or possible
difficulties at the facility on Three Mile Island . . . Mr. Denton . . . assured me-and will beavailable to answer your questions-that there is no imminent catastrophic event foreseeable
at the Three Mile Island facility, and I appeal to those who may have reacted or overreacted toreports of the contrary today, to listen carefully to his characterization of the current status of
the situation. I appeal to all Pennsylvanians to display an appropriate degree of calm andresolve and patience in dealing with this situation.

Thornburgh adds that President Carter will be coming up for an onsite visit and says,"I think this is an important vote of confidence in the kind of work that is proceeding
there and a further refutation of the kind of alarmist reaction that has set in in somequarters."
Denton, for his part, turns his earlier statement up a notch: There is no risk of
explosion in the reactor vessel. He also says the bubble is going down, which is what
Herbein had said several hours earlier.

In Milwaukee, President Carter says the situation at TMI is stable and improving, andhe will visit the Island as early as Sunday afternoon.
Met Ed, for its part, is seeing an end to the ordeal: The plant degasification system is
i n operation, the volume of gas in the coolant is being reduced, which in turn isdiminishing the bubble. In addition, all the water in the auxiliary building is now in tanks,and excess gas has been piped into the containment building. There are still81

NRC Chairman Joseph Hendrie, the only Commission member withexpertise in reactor engineering, pressed the agency's staff to determine
whether the hydrogen bubble could become explosive.

82

possibilities for releases, but the utility truly feels, as Herbein tried to tell the reporters
this morning, that the crisis is over.

Met Ed, although deferring henceforth to NRC for status evaluations, is keeping its
news center open in Hershey to respond to questions. In response to questions at 1:30
p.m., the utility says the bubble is now at 850 cu. ft.; to a question at 4:30, down to 600
cu. ft. Denton does not publicly accept these figures, although he concedes things are
moving in a positive direction. However, he adds, the crisis will not be over until thecore is in cold shutdown.
During the afternoon, Don Nitti, the B&W chemist who is now working on site, is in
touch with a number of industry consultants around the country, who confirm B&W's
conclusion that "the hydrogen overpressure would have suppressed any radiolytic
oxygen formation."

By late Saturday, 30 people from 10 organizations have arrived in the area to form an
Industry Advisory Group, which will be headed by Milt Levinson of EPRI. Included aresome of the Nation's top experts on nuclear technology. They are divided into four
subgroups to address various phases of the core-cooling problem. One groupspecifically examines the current topic A: "What problems exist in the current primarycooling mode (i.e., with the bubble)?"Before calling it a night, Denton has asked his onsite deputy, Victor Stello, to checkand see whether oxygen is being evolved in the bubble through radiolysis. With the
President of the United States arriving tomorrow and expecting to be shown throughthe plant, this would not be a bad thing to have resolved ...

83

On April 1st, President Carter, accompanied by Harold Denton and
Governor Thornburgh, visited the besieged plant.
84

PRESIDENT COMES TO
17 THEMIDDLETOWN
The people Joe Hendrie has charged with finding answers to the oxygen radiolysis
puzzle, and to what might happen to the reactor if there were a hydrogen explosion,
have been working day and night. By Sunday, they are beginning to produce answers,
and anxieties. If oxygen is accumulating, as some are coming to believe it is, then theti me before flammability is indeed shortening, much as Benjamin's unnamed story
source has said it might be. In the midst of this growing tension, Hendrie and Roger
Mattson have decided to join Denton at the site for the President's visit.
Before departure, Mattson obtains a "worst-case" consensus from the staff that the
bubble could contain 5% oxygen and could be adding 1% a day; that the bubble might
already be at the flammable stage and could be explosive in 6 or 7 days. Vic Stello's
findings have been quite different:. . . no net oxygen would evolve as a result of radiolysis since the back-reaction due to thehydrogen overpressure would force all the oxygen produced to be recombined with thehydrogen to form water. Neglecting the hydrogen overpressure, results of analyses .. .
suggested an oxygen evolution rate of about 30 standard cubic feet per day could occur. At
that evolution rate, it would take many weeks to reach a flammable mixture.

Stello also has asked others to check with various onsite company representatives,and has been told by John Collins of NRC that GPU-and possibly B&W as well (thiswould bear out Nitti's findings )-are not even considering the possibility of a burn or an
explosion as a hazard in handling the bubble. Stello does not relay his views to
Bethesda, since Mattson and Hendrie are due shortly in Middletown. When they arrive,
Mattson and Stello agree that their diametrically opposed views need to be resolved by
the time President Carter arrives.

Until this moment, there is little evidence of what might have been going throughPresident Carter's mind-or the minds of his advisors-regarding the wisdom ofmaking this particular trip. Is it safe? If it turns out to be a risk, will it have a calming
effect on the citizens, or will it be a negative reflection on presidential judgment, making
it more difficult to believe what our leaders are telling us? Carter prides himself on his
past in the nuclear navy, but his background in that field can hardly match that of, say,
Joseph Hendrie, the man he himself appointed, who is not at all sure just now that thereactor vessel is not going to explode. Is this a proper risk for a President to be taking?

The Presidential party arrives at Middletown, where the President is briefed by
Harold Denton and Vic Stello about the hydrogen explosion potential and the ambiguityof staff conclusions about it. The President wants to tour the plant. He and Mrs. Carter
and Governor Thornburgh are accompanied by Denton. They don plastic yellow shoe
guards and are taken through Unit 2 control. At 2:00 p.m. President Carter addresses
the people of Middletown, telling them that the reactor is stable, but that certain actions
may yet have to be taken to bring it to cold shutdown, and in that event, the Governor
might ask the people in the area to take further precautionary steps. If so, the President
85continues, he hopes and expects they will carry out the Governor's instructions,"calmly and exactly."

Back in Washington as the Presidential visit to TMI ends, the NRC commissioners,
minus Chairman Hendrie who has gone to the site, are still looking at the bubble
situation in light of the story in the Sunday papers and what they have learned of
Chairman Hendrie's worries. They have been told that, using a worst-case analysis, thebubble could be near a flammable stage, and could burn if ignited. They ask what thismight do to the reactor vessel. On that subject, Robert Budnitz, NRC Deputy Directorof Research, explains that the burn process might produce a pressure pulse that could
damage the vessel:. . . we might lose that vessel, which we can't afford. Although, by the way, losing it at the top
i s going to be like a LOCA; it's not like losing it at the bottom, but it's still bad. There is going to
be a propagated pulse everywhere in the system. We're going to lose pumps. We just can't

stand that.

Budnitz is one of several NRC experts who have been approached by Roger Mattson
on Saturday on the chairman's behalf. He had been assigned the task of producing, bySunday noon, a good answer to what might happen to the reactor vessel in the event of
a hydrogen bubble ignition. His first calculations indicated that the vessel might survive
with little damage, but "by Sunday noon," recalls Budnitz, "what it added up to wasthat we'd probably lose it."
The commissioners are troubled by this. On the previous night, the NRC staff
prepared for them an emergency decision document that shows that serious offsite
consequences can ensue only hours after a serious turn for the worse in the plant. And
now, adding to the tensions, Harold Collins tells them that the State authorities aredown to "White Alert"; they have told Collins they feel it is important to have at least 4
hours advance notice for a major evacuation. The State police and National Guard areon a 4-hour alert status. PEMA would like to shorten that state of readiness, but theGovernor refuses, not wanting to encourage panic.

Thornburgh's resistance to pressure for evacuation is consistent throughout thecourse of the accident. His recognition of the hazards imposed by stress alone seems
to run counter to much of the advice he is getting-by no means all of this from the
NRC commissioners. The Governor appears to be listening most closely to his BRP
staff, and they seem to be giving him solid evidence that no evacuation is yet
warranted, no matter what anyone else says.

What he most wishes to avoid, Thornburgh will say later, is "a show of helmets"the appearance in the streets and highways of uniformed National Guardsmen whosevery presence would bespeak emergency and arouse unwarranted fear, whatevermight be accomplished in getting an early start on an evacuation. It turns out to be awinning gamble, and a fairly audacious one for a public official in office only a short
ti me.
After hearing staff reports that an explosion might result in a rupture of the reactor
vessel, the commissioners in Washington decide to advise Hendrie at the site thatunless he has something different, the commission should recommend a precautionary
evacuation to Governor Thornburgh. But the chairman has something different in mind.
86At the site Stello has done some more checking with representatives of Westinghouse-Bettis and General Electric-San Jose; both respond that there will be no
oxygen added to the bubble, and Stello passes this along to Chairman Hendrie.
Suddenly, Joe Hendrie is convinced. His doubts are ended: there would be nohydrogen explosion.

Commissioner Kennedy relays to Chairman Hendrie the word that, based upon
Budnitz's report about losing the vessel if the hydrogen exploded, three commissioners(Kennedy, Bradford, Ahearne) recommend that the Governor advise a precautionary
evacuation out to a 2-mile radius. But Hendrie has made his turn and is headed backthe other way. He informs Kennedy that oxygen is not really a problem, as the hydrogenin the water would capture it.
At 7:00 p.m., Hendrie and Mattson meet with the Industry Advisory Group in
Middletown, and EPRI representative Ed Zebroski takes the NRC to task for not quickly
understanding that oxygen could not be evolved by radiolysis in a hydrogen-richenvironment. At this point, the bubble is down to 350 cubic feet and fading fast, due tothe efforts of Met Ed and its outside advisors, particularly B&W, to degas the system.
At 8:45 p.m., Hendrie and Denton meet once more with the Governor to brief him on thequestion that has made the past 24 hours a nightmare.
From Sunday night on, the word that goes out is reassuring: Stop worrying about the
bubble exploding. The bubble is disappearing ... and the bubble problem right alongwith it.

Two days later, on Tuesday, April 3, Denton is able to announce to the world at apress conference, "the bubble has been eliminated, for all practical purposes."
Asked why the bubble had gone away, Denton replied: "I think it was a little bit
because of our actions and maybe a little bit of serendipity." Although probably notintending to do so, Denton seemed to have given credit to the NRC for removing the
bubble. To the contrary, as NRC Inspector Charles Gallina, who had been at the sitefrom the beginning of the accident, observed, "The hydrogen bubble did not
miraculously disappear, it was systematically and professionally eliminated by Met Ed
operators." In fact, studies performed for the Special Inquiry Group show that the
bubble was probably all gone some 2 days before Denton made it official.

In the new week, engineers from Met Ed, GPU, the NRC, and the Industry Advisory
Group begin to work together to bring the plant to a "cold shutdown." Those who
evacuated are beginning to return to their homes. The Governor issues a press
statement directing State offices to conduct business as usual, but neither he nor the
NRC is quite ready yet to lift the formal advisory to pregnant women and preschoolers.
Finally, on April 9 the NRC commissioners vote to recommend lifting all advisories andthe Governor, having received their endorsement, does so.
On April 27, nearly a month after the accident began, Unit 2 is finally put into a"natural circulation" cooling mode to remove the last vestiges of decay heat from thedamaged reactor core. Cold shutdown has at last been reached.
But well before this feat is accomplished, the investigations have begun.
87

Iconclusions andrecommendations
SUMMARY

The one theme that runs through the conclusions we have reached is that the
principal deficiencies in commercial reactor safety today are not hardware problems,
they are management problems. These problems cannot be solved by the addition of afew pipes and valves-or, for that matter, by a resident Federal inspector at every
reactor. Undoubtedly improvements in the design, instrumentation, and control logic ofnuclear plants can be made to reduce the probability of a serious accident, and tobetter protect the public should such an accident occur. Some detailed suggestions forsuch improvements are included here and in the in-depth studies to this report. But themost serious problems will be solved only by fundamental changes in the industry and
the NRC.

What we have found is a regulatory system consisting primarily of an elaborate
apparatus for reviewing the safety of nuclear reactor designs which has served the
public well in the past and produced a good safety record to date, but in the process
has failed to take timely account of the actual operation of existing plants. We havefound that the Nuclear Regulatory Commission itself is not focused, organized, ormanaged to meet today's needs. In our opinion the Commission is incapable, in its
present configuration, of managing a comprehensive national safety program forexisting nuclear powerplants and those scheduled to come online in the next few years
adequate to ensure the public health and safety.
We have found, based upon our study of TMI and our interviews with knowledgeable
people in the industry, that many nuclear plants are probably operated by managementthat has failed to make certain that enough properly trained operators and qualified
engineers are available on site in responsible positions to diagnose and cope with apotentially serious accident. The NRC, for its part, has virtually ignored the criticalareas of operator training, human factors engineering, utility management, andtechnical qualifications.

The consoles in the Unit 2 control room form a horseshoe inside thering of 7 foot high instrument panels.

We have found an industry in which the expertise and responsibility for safety is
fragmented among many parties-the utility company that operates the plant, the plantdesigner, the manufacturer of the reactor system, the contractor, and the suppliers ofcritical components, in addition to the NRC. Coordination among these parties andbetween them and the NRC, as well as within the NRC, is inadequate. As a result, there
are many institutional disincentives to safety, and safety issues that are identified atsome point in the system often fall through the cracks. Prior to Three Mile Island, thei ndustry as a whole had made only feeble attempts to mount any industrywide
affirmative safety program, and many utilities apparently regarded bare compliancewith NRC minimum regulations as more than adequate for safety.

On top of all this, we found that before March 28, 1979, an attitude of complacency
pervaded both the industry and the NRC, an attitude that the engineered design
safeguards built into today's plants were more than adequate, that an accident like thatat Three Mile Island would not occur-in the peculiar jargon of the industry, that suchan accident was not a "credible event."
The kinds of changes needed to cope with these problems and attitudes are
institutional, organizational, and managerial, and include:• An immediate, substantial shift in the balance of existing resources in the NRC fromdesign review to the monitoring of operating reactors, and consolidation of theseresources in one NRC office; new mechanisms to evaluate operating experience andto ensure that necessary changes are implemented in the regulatory program; andan improved inspection and evaluation system for operating reactors.
• Strong measures to strengthen the onsite technical capability and management ofutilities at reactor sites, including a new philosophy and new programs for improved
operator training; and new NRC requirements to ensure that qualified engineer
supervisors with intimate knowledge of the plant will be part of the onsite supervisory
management chain on every reactor operating shift.
• The chartering of an operating consortium with the capability to operate the plants ofa number of utilities on either a contract or "receivership" basis.
• For future reactors, more remote siting. For existing reactors: the promulgation by
the NRC of specific criteria for determining the minimum evacuation planning zone
around each plant; the conditioning of operating licenses on such plans being
approved and workable; and the closing down of existing plants that cannot meetthese new criteria, unless either (1) additional safety systems for mitigation of
accidents are installed, or (2) the President determines that the continued operationof the plant is vital to the national interest.
• In the case of new applications for reactor licenses, a completely overhauledlicensing system that includes one-stage licensing; increased standardization;
increased use of rulemaking proceedings by the NRC to implement safety policy andstandards; establishment of an Office of Public Counsel; and agency funding ofintervenors who make material, substantive contributions to licensing and rulemaking proceedings.
• Substantial changes in the bases used to review the safety of reactor designs,
including the application of quantitative risk assessment methods to potential
accident sequences in order to augment the current "design basis accident"
approach.
The accident at Three Mile Island did not result in radioactive release levels that
posed any threat to public health, even in the long run. Public alarm over radioactivity
90

fueled by the Governor's evacuation advisory to pregnant women and preschool
children 2 days after the accident, and the fear caused by reports the next day andafterwards of a possible hydrogen bubble explosion, turn out to have been vastly
exaggerated by the NRC's disorganized response to the emergency.

But engineering calculations performed during our investigation indicate that on themorning of March 28, before anyone appreciated the seriousness of the situation,
Three Mile Island came close to being the accident we had been told by many in thei ndustry could not happen: a core meltdown. A shift foreman reporting for normal duty
about 2 hours after the accident began undertook to survey some instruments andblocked off the stuck-open pressurizer valve that was leaking reactor coolant into thereactor containment building. If that block valve had remained open, our projections
show that within 30 to 60 minutes a substantial amount of the reactor fuel would havebegun to melt down-requiring at least the precautionary evacuation of thousands ofpeople living near the plant, and potentially serious public health and safety
consequences for the immediate area.
An accident identical to that at Three Mile Island is not going to happen again. Not
only have changes been made to ameliorate the particular problems revealed there, but
the accident has spawned major reexamination by the industry and the NRC of many
aspects of design and operations that contributed to that accident.

However, the work done by the Special Inquiry Group over the past 7 months has led
us to conclude that unless fundamental changes such as those outlined above are
made in the way commercial nuclear reactors are built, operated, and regulated in thiscountry, similar accidents-perhaps with the potentially serious consequences topublic health and safety that were only narrowly averted at Three Mile Island-are
li kely to recur.
We were not asked, and it is not our place to tell the public, "how safe is safeenough." Indeed, as we make clear in this report, we believe this is a decision that in
the final analysis should not be the exclusive province of the NRC: it is an executive
decision that should be made as a part of our national energy strategy by the Executive
and by Congress. The NRC cannot continue to face, sub silentio, in every policy andli censing determination the question of the future of nuclear power in this country. It is,l est we forget, an inherently dangerous activity that Congress has authorized the NRC
to license.
The generation of nuclear power can never be risk-free. It will inevitably present
certain risks to public health and safety no matter how "safe" plants are made.
Available surveys show, however, that nuclear power is unique in that public
perception of the risk of injury or health consequences-even the risk involved once anaccident occurs-is many, many times greater than the best available estimates ofactual risk -far more so than for any other potentially harmful everyday or industrial
activity. Just as the regulators must change their attitudes to appreciate that thisperception of risk cannot be dealt with by trying to convince the public that it "can't
happen," so renewed efforts must be made to educate the public that the risks andbenefits associated with nuclear powerplants must be weighed against the very real
health and environmental risks associated with other forms of power generation, suchas increased use of coal and synthetic fuels, and against such risks as continued
dependence on foreign oil imports.
91

We considered at great length and rejected a recommendation that there be a
moratorium on operating reactors or on granting new operating licenses for reactors
now under construction and nearing completion. We do believe, however, that the
NRC's management would be wise to suspend processing of applications forconstruction permits and limited work authorizations until it considers the various
recommendations that we have made for reforming the licensing process and forincreased standardization.
In an investigation like this, the very purpose of which is to focus on what went wrong
and what needs changing, it is inevitable that less attention than is deserved will begiven to what "went right"-the strong points in the system. Chief among these is thefact that the "defense in depth" concept worked to protect public health and safety. In
spite of multiple equipment malfunctions, human failures, and the creation of conditionsin the reactor and auxiliary buildings that were never contemplated in the design of theplant's safety systems, the utility and its engineering support staff were able to bring
the system to a stable condition without releases of radioactive materials to theatmosphere that could have resulted in significant health effects to those living near theplant.
Thereafter, a massive response by industry, the national laboratories, and Government greatly assisted Met Ed both in bringing the plant to a safe shutdown and inestablishing recovery operations. Over a thousand people, from reactor operators andhealth physics technicians to top executives from every corner of the industry, dropped
their everyday work and went to the TMI site. Thousands more were active in
performing supporting analyses and experiments, and in procuring and dispatchingneeded supplies.
That there are strengths in the system does not, however, detract from the urgent
need to make changes where important weaknesses have been revealed. Thesechanges will not be easy: they will require new legislation, executive reorganization,and substantial overhaul of the way the NRC is organized and managed, at the veryl east. But the changes are feasible, and they will not require such vast expenditures ofmoney or other resources as to be beyond the bounds of reason.
What the changes require is a firm commitment on the part of the President and thecongressional oversight committees each to play its own role, and a commitment by the
public-if what it wants is safer nuclear powerplants-to keep the pressure on its
elected representatives for major, meaningful reform. For in the polarization of thecurrent public debate over nuclear power, we have found there is precious little
constituency for that course: on the one side are those who do not want reforms anddo not want to put any more resources into nuclear power at all because they believe it
should be shut down; on the other side are those who argue that existing plants and theprogram for operating and regulating them adequately protect the public, and thatmajor reforms are not necessary.

What we are able to conclude confidently, based upon the work of the Special
Inquiry Group, is that while the changes that must be made are major ones, thesechanges will make commercial nuclear power much safer than it is today. In our view, if
a firm commitment is not made promptly to bring about these changes, we will be
exposing the public to a needlessly high level of risk.
92

Finally, we believe a summary comment is called for with respect to the recommendations made by this and other inquiries. Over the years the nuclear industry and its
regulators have identified what have been considered to be serious safety problems
and recommendations whose significance has been underscored by ringing statements
to the effect that unless such problems are resolved "promptly," a license should be
revoked or the industry shut down. Many of these problems are still outstanding. While
we do not undertake to set out deadlines, we do believe that the congressionaloversight committees should hold the NRC accountable with respect to such issues.

93

1 SYSTEMATIC EVALUATION OF

OPERATING EXPERIENCE AND
I MPROVEMENT IN THE REGULATION
OF OPERATING REACTORSThe accident at Three Mile Island on March 28, 1979, had almost happened
before-twice. Virtually identical "transients," as they are called in the industry,occurred in 1974 at a Westinghouse reactor in Beznau, Switzerland, and in 1977 atToledo Edison's Davis Besse plant in Ohio, a Babcock & Wilcox reactor similar indesign to the one at Three Mile Island. Both involved the same failed-open pressurizer
relief valve (PORV), and the same misleading indications to operators that the reactor
coolant system was full of water. In both cases, operators diagnosed and solved the
problem in a matter of minutes before serious damage could be done.

The NRC never learned about the incident at the Beznau reactor until after the TMI-2
accident. At the time, Westinghouse was notified, but in 1974 the manufacturer was not
required to report to the NRC such occurrences at foreign reactors. Westinghouseconcluded that the actions by the Swiss operators proved the validity of an earlier
Westinghouse study showing that, in this kind of incident, operators would haveenough time to react to a stuck-open valve and correct the situation. A brief account of
this earlier study had, in fact, previously been submitted to the NRC. But neither the
Beznau incident nor the earlier study had prompted Westinghouse to notify its
customers or the NRC that operators might well be misled by their instruments if a valve
stuck open.
The Davis Besse accident was intensively analyzed-by Toledo Edison, by Babcock& Wilcox, and by the NRC. Each of these studies identified what should have been
perceived to be a significant safety issue. But because no effective system forevaluating operating experience was in effect, none of the results of these studies wereever communicated to Metropolitan Edison or its operators at the TMI-2 plant.

Toledo Edison, at the insistence of an NRC inspector and his supervisor from theagency's regional office, which is a part of NRC's Office of Inspection and Enforcement(IE), eventually adopted new operator precautions. But they were not communicated to
B&W or to other utilities, and IE's regional office did not flag the issue to NRC
headquarters. At B&W, line engineers and their supervisors drafted new operator
procedures to warn reactor operators that any time the automatic emergency corecooling system came on, it should not be turned off until the cause of low pressure in
the reactor coolant system had been positively identified and the condition corrected.
They recommended that it be sent to all of B&W's customers-including Met Ed. But
an engineer in another section of the company raised a question about some possible
side-effects of the proposed new procedures. The issue was never brought to a headand resolved, so the new instructions never went out.
The story at the NRC was much the same. A team from the NRC's licensing office,the Office of Nuclear Reactor Regulation (NRR), analyzed the Davis Besse accident,
94but was more interested in the behavior of the reactor's engineering subsystems than in
the operators' problems, and found no unresolved safety questions. Coincidentally, a
TVA engineer, Carlyle Michelson, who was also a consultant to the NRC's Advisory
Committee on Reactor Safeguards (ACRS), had undertaken on his own initiative a
study in 1977 of what would happen in a B&W reactor if a small break occurred in the
top of the pressurizer, where the PORV is located. A copy of Michelson's study
eventually found its way from an ACRS member to the NRC.

In January 1978 an NRC reviewer in NRR prepared a memo based on Michelson's
concerns and the Davis Besse incident which noted that in certain circumstances
operators could be misled by their instruments to turn off the emergency core coolingsystem. But the reviewer's memo was not circulated outside NRR and the issue was not
identified as a possible generic safety problem for operating plants; it was simply filed
away. An ACRS query prompted by Michelson's study that was posed in the licensing
proceeding for another B&W plant went unanalyzed by NRR.
In sum, the agency's fragmented bureaucracy, its preoccupation with hardware anddesign questions, and the lack of any clearcut responsibility for identifying significant
operating problems and warning operators about them combined to prevent the real
message of Davis Besse from getting to Three Mile Island.

The failure to heed these warnings and take action cannot be said to be an isolated
example. We found that in the past the NRC and the industry have done almost nothing
to evaluate systematically the operation of existing reactors, pinpoint potential safety
problems, and eliminate them by requiring changes in design, operator procedures, orcontrol logic. The lack of any such comprehensive program constitutes, in our view, an
unacceptable situation that compromises safety and that cannot be allowed tocontinue.
When the current generation of "large" (900-1300 MWe) nuclear plants wasdeveloped some 15 years ago, the safety of their designs had not been (indeed could
not be) verified in some important respects by actual experimentation. Uncertainties inthis new technology therefore had to be analyzed, and the risk of accidents estimated.
Safety reviews by manufacturers and the AEC relied substantially on sophisticatedscientific projections and computer "codes" to predict how safety systems in the plant
would behave and interact during an accident.

Reliance on scientific and engineering predictions was thought to be acceptable asa basis for constructing this new generation of reactors in part because the estimates
were based on very "conservative" assumptions at every stage, and also because ofthe "defense in depth" design philosophy employed: multiple safety systems, redundant equipment, and the ultimate protection of large steel and concrete "containment"
buildings to bottle up radioactivity in case of a serious accident in the reactor. But it
was also assumed that as the number of reactor-years of actual operation increased,
the estimates could be confirmed or modifications made where necessary. As it turns
out, this process of learning from experience has not yet been seriously undertaken by
the NRC or the industry.
I n the first place, the NRC devotes proportionally far more of its talent and a higher
priority to the review and analysis of reactor design than to reactor operations. Thismay have been appropriate a decade ago, when the agency was flooded with newli cense applications. But today, with over 70 commercial nuclear plants operating and95

a like number in the pipeline, and virtually no new plants starting construction, it is nolonger so. Large reactors are now a "maturing" technology. Yet the NRC's emphasis
on design review continues-due perhaps to congressional failure to revise theagency's original statutory mandate that focuses on licensing, but due also, we believe,to inertia and lack of leadership on the part of the NRC.
Second, the structure of the nuclear industry has not been conducive to the effective
sharing and integration of operating data. The utilities that operate the plants havenever mobilized an industrywide effort to concentrate on safety-related operational
problems. As for the four principal U.S. manufacturers of reactors ("vendors")General Electric, Westinghouse, Combustion Engineering, and B&W-we found agreat deal of variation in the extent to which they monitor at their own expense
operating problems in the plants they have built, after those plants are tested andturned over to the utilities that have purchased them. And the relationship between thevendor and its utility customer after operation of a plant begins is largely determined by
the individual utility's choice of how much technical assistance it is willing to buy fromthe vendor on an ongoing, contract basis. Moreover, there is no requirement thatutilities report failure data to the vendors.

Third, although NRC requirements result in a great deal of material on reactor
operations being generated and sent to the NRC by the utilities, this information has
not been systematically reviewed to extract potentially important safety problems ortrends. In part, this is because the reporting system itself is flawed: it does notdistinguish the significant from the trivial, and, as the reporting of the Davis Besse
accident demonstrates, reports often do not clearly identify the real cause of aparticular incident.

The NRC requires prompt reporting by licensees of any one of a number ofcategories of abnormal events in an operating plant. But the reporting threshold is so
low that the agency currently receives 2000 to 3000 of these Licensee Event Reports("LERs") a year, ranging from reports of near-serious accidents in which safetysystems were activated, to insignificant violations of a plant's "technical specifications" (the license conditions that detail the criteria for plant operation). In addition,utilities must submit a host of other, more routine reports.
The situation is made more complex because the reporting requirements differ fromplant to plant: incidents reportable at some plants do not have to be reported at others.
As a result, the NRC is flooded with a mass of undifferentiated data on reactor
operations.

I n order to make effective use of this information, even given an improved reporting
system, someone must separate the wheat from the chaff; then, potential safetyconcerns must be investigated in greater depth. However, before the TMI accident nogroup within the NRC performed this "sort and score" operation on LERs, or on any
other existing data. LERs were sent from the NRC regional offices to NRC
headquarters in Bethesda, summarized in a few sentences for computer listing,
distributed haphazardly to various staff offices, and filed away. Important problems
were followed up on a catch-as-catch-can basis, depending on the interest of aparticular inspector in the field or a headquarters engineer alerted to a particular reportby a fellow employee.
96Perhaps most important of all, there was (and still is) no institutional mechanism
within NRC for developing solutions to potential safety problems and ensuring throughthe regulatory system that these solutions are integrated into reactor operations
through design changes, new procedures or improved training. Many of the areas towhich this feedback might be directed are neglected in the existing regulatory
framework, for example, operator training and plant operating procedures. The
absence of central management of the NRC staff (discussed at some length below) andthe lack of coordination between the agency's licensing office (NRR) and its inspection
office (IE) have also worked to defeat the establishment of any such comprehensive
program.
SYSTEMATIC EVALUATION OF OPERATING EXPERIENCE BY
THE NRC
It is clear to us that the systematic evaluation of operating experience cannot be
undertaken entirely by individual utilities. Of the 41 nuclear utilities, 27 have but one
reactor. GPU, with three nuclear plants, certainly did not have the resources or the
management structure in place to perform such a task. Nor did it receive a great deal ofuseful help from NRC. NRC publishes a computerized listing of LERs, each describedin a few sentences at most, and a periodical called "Current Events-Power Reactors"
containing more detailed descriptions of major problems. The latter described theDavis Besse incident in some detail. But neither publication recognized or identified the
key elements at Davis Besse-the misleading indication to operators that the reactor
coolant system was full, and their resultant decision to throttle back the emergency
core cooling system after it automatically came on.

We have concluded that the systematic evaluation of operating experience must be
undertaken on an industrywide basis, both by the utility industry, which has the greatest
direct stake in safe operations, and by the NRC. The utility industry has already put inmotion plans to establish an Institute for Nuclear Power Operations (INPO), funded by
all the nuclear utilities, that will undertake this task. Whether it will be successful
remains to be seen. We are less sanguine about the steps the NRC has taken to date todeal with this problem.
A history of the AEC/NRC's efforts in this area is instructive. In 1969, an AEC
internal study suggested that a systematic review of operating data be undertaken. In
mid-1972, an AEC Office of Operations Evaluation was formed to summarize
LERs and perform other analyses.
But a staff reorganization in 1975 basicallydismantled this unit as originally intended. Internal proposals in 1976 to reestablish
such an entity received short shrift and were abandoned.

Early in 1979, a GAO study of the NRC concluded that its failure to "sort and score"
LERs prevented it from identifying safety-related problems. Nothing was done,
however, until after Three Mile Island. Then, in mid-April, the Commission reacted tothe accident with a public briefing that led it to establish a Task Force to recommend
new ways to assess operating experience for generic problems. The need for answers
was accorded such a high priority that the Task Force was given only a few weeks tocome up with a report to the Commission.
97

The Task Force reached quick agreement that a new group or management function
should be set up to evaluate LERs and other information. But, as in the past, thedirectors of the NRC staff offices quarreled among themselves about who was going to
get this new unit.

Finally, on July 12, the Commission decided to establish a full-time Office of Analysis
and Evaluation of Operational Data (AEOD) that would be part of none of the program
offices but would report directly to the NRC's Executive Director for Operations (EDO).
This new office would have an oversight function, independent of the NRC's individual
program offices; it would be the focal point for communication with industry and the
ACRS; and it would develop recommendations and provide guidance.
Five months after the July 12 Commission decision and 8 months after the mid-April
briefing, the new office is still staffed only by people on temporary loan from other NRC
offices and is just beginning to lay out a framework for its mission.
This business-as-usual approach suggests that the Commission has not fully
appreciated the importance of the problem or the kinds of changes that will be required
to meet it. Even now the AEOD has no operational authority, no power other than moral
suasion to cause its recommendations to be implemented--or even considered-by
NRC's program offices. In this situation it is hard to see how its effectiveness can be
guaranteed.

Without the authority to mandate changes, or at least to require its recommendations
to be considered and resolved on the record by program offices within a fixed period oftime, the new group may well become another isolated outpost within the staff,
depending for its "clout" entirely on getting the ear of a senior program official. In an
agency staffed largely by specialists who are often protective of their own engineering
j udgments and turf, it is easy to forecast that many of the new office's findings may not
result in the changes desired, simply because the implementation of those changes isreserved as a prerogative of the NRC program office involved.
IMPROVING THE REGULATION OF OPERATING REACTORS

We view the lack of any comprehensive system for evaluating operating experienceand mandating changes as part of larger organizational and management problems
within the agency. At present, after a nuclear plant is licensed and operating, theresponsibility for those staff activities necessary to ensure the plant's safety is notdelegated to a single organizational entity. Current practice at the NRC divides
responsibility for postlicensing monitoring of operating plants between IE and NRR.
The former inspects the plant to determine if NRC regulations and license conditions
are being complied with; the latter rules on proposed changes in the license conditions
necessary to ensure safe operation of the plant, and considers all generic safetyi ssues.
Moreover, the absence of strong central management in the NRC has resulted in aack
of coordination between NRR and IE to identify and resolve operating problemsleffectively. This breakdown may be due in part to the physical and organizational
separation of the two offices, but the differing perspectives held by "design" and"operations" people, and the reluctance of NRC management to cause them to work
together-or resolve their disputes-has also undoubtedly played a significant role.
98We believe it would make more sense to consolidate all the agency's resources
devoted to monitoring the safe operation of existing reactors in a single officeprobably the current Office of Inspection and Enforcement (IE), which would have to berenamed to reflect its broader responsibility. This includes most of the current functionsof NRR's Division of Operating Reactors (DOR).

The basic design approval function should remain in NRR; operations (including
approval of construction and test procedures) should be fully within the province of IE.
But there must be close cooperation between the two offices in the establishment of
testing programs and operating requirements as well as in any future changes in theserequirements or of design. We believe these activities should be supervised by a strong
project team that includes personnel from both offices and draws on the technicalresources available in both areas. However, we recognize that such a reorganization
would not, in itself, bridge the existing gulf between the agency's licensing andoperations functions. Only better management can achieve that goal.
THE ROLE OF THE OFFICE OF ANALYSIS AND EVALUATION
OF OPERATIONAL DATA
To the new Office of Analysis and Evaluation of Operational Data (AEOD) should begiven the task of developing recommendations as to where action to meet operatingproblems it discovers ought to be required-in training, in procedures, in licensing, ori n a number of areas at one time. After comment by appropriate staff units, theserecommendations should in each instance be required to be rejected, modified, or
i mposed as recommended by the appropriate program office of NRC within a fixed
period of time. Unresolved disagreements between AEOD and a program office could
be required to be reviewed by the Commission or, as we recommend later in this report,
the agency's single administrator.
Present NRC staff functions devoted to performing quantitative risk assessment ofreactors should probably be relocated in AEOD. The AEOD Office should be staffed inpart on a rotational basis from all the other offices and branches of the NRC staff, at alevel of no less than 35 to 40 professionals.

To aid AEOD, consideration should be given to a revised comprehensive reporting
system applicable to both utilities and vendors. This system should require more
i n-depth reporting and followup of significant events, and provide for the reporting ofminor incidents in a separate format easily amenable to statistical analysis. Reporting
requirements should be uniform, so that the data have a common base.

Such a reorganization will provide new technical resources to the expanded IE andprovide an opportunity for the headquarters staff to coordinate and manage more
effectively the operations of the field offices. Consistent inspection practices andprocedures in the field and establishment of a respected central organization at
headquarters are essential to a comprehensive safety program for operating reactors.
IMPROVING THE INSPECTION PROGRAM

At present, the NRC's field inspection program for the most part follows an "audit"
approach: inspectors spend the bulk of their time confirming that utility personnel have99followed proper bookkeeping procedures for maintenance, have logged any operatingproblems, and so on. Given the complexity of today's large plants and the resources
available in the agency, it is hard for us to see how this audit system can befundamentally altered.
While we believe that substantially more manpower should be devoted to inspection,
we do not think this alone is likely to have enough of a meaningful impact. Rather, we
propose some specific steps that can be taken within the context of the current
philosophy to improve the effectiveness and impact of the inspection program, in
addition to the need to improve coordination and communication between headquarters and field offices cited above.

First, while the President has asked the NRC to accelerate placement of a resident
Federal inspector at each nuclear plant site, such an approach should not be seen as apanacea. Indeed, the inability of a single inspector to assess all of the different systems
i n a large nuclear plant, and the danger that he may become "captive" to the utility
staff, as well as the difficulty of finding good people and keeping them in these
positions, caution against total reliance on the resident inspector. Instead, moreemphasis should be given to supplementing the resident inspector with a team or"blitz" approach, in which a number of inspectors make unannounced visits fromregional headquarters to conduct in-depth inspections of the overall operation of aplant for at least a week or more, perhaps accompanied by their supervisor or byproject management personnel.

Second, more attention should be given to "reactive" inspections-responding to
notifications, complaints, specific problems, or following up on previous difficulties.
Under the existing system, when an inspector visits a site he spends about 80% of his
ti me inspecting within prescribed "modules" that lay out the scope and procedures forinspection of different systems in the plant. Better application of risk assessment andimproved evaluation of operational data should permit inspection guidelines to bei mproved and sharpened, so that inspectors' visits can be focused on particular
problems anticipated at each plant or with various plant systems.
Third, IE should develop new programs to monitor and evaluate utility management
and technical competence on an ongoing basis. This will require not only thedevelopment of new standards but also acquisition of new skills by NRC to study andevaluate management effectiveness of utilities and to require constructive changes.

Fourth, more effort should be devoted by regional offices to evaluating each utility
across-the-board and vis-a-vis other utilities, in order to identify weak spots andproblem areas. IE's Performance Evaluation Team (PET), which currently performs thiswork, should be expanded.

When a "blitz" inspection group or the PET finishes an inspection or evaluation
project, it might be required-using its new capability to assess the utility's onsite
technical and management team-to make an overall judgment as to whether theentire operation it has reviewed is satisfactory. If the operation is not judged to besatisfactory, then the reactor should be required to be shut down in a given number ofdays unless specific required changes are put in motion. Alternatively this kind of
overall evaluaton might be required to be made periodically (say, once a year) by theregional office, taking into account all inspection and evaluation information gathered
during the previous year.
100

Fifth, the NRC staff as a whole, and particularly IE, should institute new proceduresfor staff rotation so that individuals with field experience get exposure to headquarters
management, and vice versa. Top managers in IE should generally be required to have
had field experience or, in the alternative, to be exposed to field operations throughextensive stints working in regional offices and accompanying inspectors in the field. IEshould conduct regular seminars attended by both NRC management officials andinspectors in order to identify problems the inspectors are encountering that might beameliorated by better inspection procedures or management.

101

2 STRENGTHENING THE ONSITETECHNICAL AND MANAGEMENTCAPABILITY OF THE UTILITY:I MPROVED OPERATOR TRAINING AND
NEW NRC REQUIREMENTS FORQUALIFIED ENGINEER SUPERVISORSON EVERY SHIFT

Some previous analyses of the Three Mile Island accident have been read toattribute it to "operator error." We reject this conclusion as being incomplete.

While there is no question that operators erred when they interfered with theautomatic operation of the high pressure injection (HPI) system even though conditions
that had initiated the system (low pressure) persisted, we believe there were a numberof important factors not within the operators' control that contributed to this humanfailure. These include inadequate training, poor operator procedures, a lack ofdiagnostic skill on the part of the entire site management group, misleading
i nstrumentation, plant deficiencies, and poor control room design. For these failings,
the industry and the NRC must share responsibility with Met Ed.

A TMI-2 operator who had been in the control room during a severe transient in Unit
2 nearly a year earlier, responding to a management analysis of that previous event thatascribed it largely to operator error, wrote a memorandum at the time that might standas an epitaph to the accident on March 28, 1979:
I feel that the mechanical failures, poor system designs, and improperly prepared control
systems were very much more the major cause of this incident than was operator action.
Although training is always essential and welcome-nothing that we study or practice could
have prepared us for this unfortunate chain of events.

You might do well to remember this is only the tip of the iceberg. Incidents like this are easy to
get into-and the best operators in the world can't compensate for multiple casualties which
are complicated by mechanical and control failures.

The operators on duty at TMI-2 early on the morning of March 28 were faced withmisleading instruments, plant parameters they had never been trained to understand,and procedures that offered no useful assistance. Supervisors who were in touch withthe plant and arrived within a few hours of the beginning of the accident at first did not
demand or receive critical information necessary to assess the situation. Later in theday, they apparently disbelieved or discounted important information which they did
receive, and failed to diagnose the situation. While they took some reasonable actions
to improve the situation, the supervisors as well as the operating crew failed to grasp
the true nature of the problem. More important, they demonstrated a lack ofunderstanding of one of the most basic concepts of a pressurized water reactor: thatsystem pressure must be kept above the boiling point for the existing temperature of
the reactor coolant. This pressure is essential to keep the coolant in its liquid phase; if
1 02steam is formed in large quantities, as it was here, it may prevent heat from being
removed from the core.

NRC and B&W engineers did not learn enough to comprehend the seriousness of thereactor's condition until early on the first day, Wednesday, March 28; even then, they
did not recognize the problem or press hard for a proper strategy to restore corecooling to the reactor. It was not until late afternoon on Wednesday that Robert Arnold,
Vice President of GPU Service Company, and his engineers in consultation with John
Herbein, Met Ed's Vice President, decided upon a course of action that restored thereactor's stability a few hours later.
This account suggests two conclusions. First, the operators on duty had notreceived training adequate to ensure that they would be able to recognize and respondto a serious accident during the first hour or two after it occurred. Second, neither theoperating crew nor their supervisors in the site management group possessed thenecessary combination of technical competence and familiarity with the plant todiagnose a totally unanticipated situation and take the appropriate corrective action.

Metropolitan Edison must bear the responsibility for failing to put in place a sitemanagement organization technically competent to respond to the accident. But
everything we have learned in this investigation suggests that the problems in this area
revealed by Three Mile Island-inadequate training, unreasonably scanty manningl evels, lack of any requirements for minimum onsite technical supervisory competence-are common to many, probably most nuclear plants. There is a clear need torestructure and improve operator training, and to upgrade substantially the requirements for technical qualifications of onsite supervisors and management, up throughthe plant or unit superintendent.
TRAINING

The NRC licenses both reactor operators and "senior" reactor operators byadministering written and (in most cases) oral examinations. However, these examinations do not even measure operator ability accurately, much less ensure that an
operator has the knowledge or competence to operate a reactor safely whensomething unexpected occurs. Only adequate training can do that. And the area of
operator training has, as one top staff member put it, been a "backwater" with most of
the utilities and the NRC.

The NRC prescribes requirements for the general subjects that must be taught inclassroom and "hot" (on-the-job) training, or simulator training. Beyond this, it does
not regularly review the substance of the written materials used, or the quality ofi n-plant or simulator training that prospective operators receive. Only a very small staff
within the NRC is devoted to operator qualifications and testing.
The fact that the largest portion of operator training is reading and classroom
training is a weakness of the current program. A more significant problem, however,and one that was crucial to the Three Mile Island accident, is that operators are trained
primarily for normal power operations and for startup and shutdown of the plant, not for
accidents.

I n certain respects, the job of a reactor operator at a large nuclear powerplant is notunlike that of a commercial airline pilot. The vast majority of the pilot's time is spent in103

routine, high-altitude flying-little more than babying the ship through clear skies, often
on automatic pilot. Similarly, the reactor operator's typical 8-hour shift is a study inboredom: the reactor system pretty much runs itself. What does require considerable
specialized skill in flying is takeoffs and landings. Similarly, in a nuclear plant, both
startup to full power and routine shutdown are also relatively complex procedures inwhich a variety of coordinated actions must be taken and instruments closely
monitored. A great deal of reactor operator training is devoted to these manipulations.
However, the public expects a commercial airline pilot to be intensively trained andqualified not only for routine operations but to diagnose and handle emergencies-theloss of an engine, sudden depressurization, hydraulic failure, a fire or whatever. It ishere that reactor operator training has been seriously deficient. Other than being
required to memorize a few emergency procedures, reactor operators are notextensively trained to diagnose and cope with the unexpected-equipment malfunctions, serious transients, events that cannot easily be understood.

To take an example, prior to the TMI accident operators were repeatedly trained totake all measures to avoid "going solid," i.e., losing the steam bubble in the top of thepressurizer. This training prompted the operators on duty during the accident tothrottle back the HPI system-a critical causal factor in the accident. But what if they
did go solid? At the B&W simulator in Lynchburg, Virginia, where these operators weretrained, when the pressurizer "went solid" the simulator program came to a halt; the"game was over." In other words, the simulator itself was not programmed to duplicate
accident conditions and help the operators make decisions about whether and how thesystem could be operated under those conditions.
Similarly, the simulator training available to Met Ed operators, which is not dissimilar
to that throughout the country, was rarely used to require them to respond to simulated
accidents involving more than a "single failure." Nor were operators often required todiagnose the causes of failures given to them on the simulator; often they would be told
i n advance what failure had been programmed for them to respond to.

NRC-prescribed training for regular control room operators involves only a limited
amount of sophisticated engineering and physics necessary to understand the thermalhydraulics of the reactor's primary system. Senior operators are taught somewhat moreof this material. But what the accident made clear is that even senior operator trainingi s insufficient to give operators a basic appreciation of the way safety systems interact
and of what phenomena they can expect to see on their instruments from conditions
that are not "normal" in their previous experience.
These problems were not unique to Metropolitan Edison. Although it is true that Met
Ed's training program was in some respects deficient, it appears that Met Ed afforded
its operators training that, taken as a whole, was typical of the industry and, in certain
respects, was above average. The shift crew on duty when the accident began were all
products of the nuclear Navy training program, and each had had at least 5 years ofNavy experience. Prior to the accident all of them had completed training courses
which met NRC requirements, had passed NRC exams, and had received simulator
training totalling 5 to 9 weeks each. Three had received 1 week's training at Penn State
University's research reactor. Their combined average NRC licensing exam test scores
were above the national average. The inadequate training that played a role in this
accident must be attributed not to one utility but rather to the industry as a whole andto the NRC.
104

After the accident one Met Ed official, in coordination with B&W, initiated a simulator
training program that illustrates the direction we think operator training should take.
First, the simulator was programmed not to deal just with startups or "routine"transients but with various accident sequences. Then, instead of a crew of Met Ed
operators splitting up so that some studied books while others worked on the simulator,
the entire crew was taken through a number of accident sequences and graded on
their responses as a team, not as individuals. Some of these accident sequences were
not limited to a single failure, but were multiple failure accidents. And they were not, asi s customary, "short" accidents. The simulator was programmed to play accidents out
over a long period of time. The goal was not to "beat the game" but to limit thedamage-failure after failure was "sent in" by the programmers to see how well theoperators would diagnose the casualties and react to them.

More of this kind of training is clearly needed. One of the difficulties in expanding it,
however, is hardware-related: many plants have no simulators that closely replicate
their control rooms. B&W's simulator, which members of the Special Inquiry Groupobserved during a replay of the TMI-2 accident, is a fairly accurate mock-up of thecontrol room in a different plant. The TMI-2 system responds somewhat differently fromthe simulator. Moreover, the control room at the simulator simply does not have the feelor "play" of the TMI-2 control room, which is larger, more confusing, and lessorganized.

I n our view, improved training programs for control room operators and senior
operators will not be sufficiently upgraded by the nuclear industry unless the NRC
drastically modifies its own attitude toward this training. We recommend that the NRC
assume a direct role in the training of operators, much as the FAA does in the trainingof pilots: certification of training facilities; establishment of a minimum curriculum; andcertification of instructors. The NRC should promulgate criteria for these facilities andi nstructors, and review and approve the curriculum for the initial and recurring training
programs. It should retain its present authority to test and license operators andsupervisory operators.
NEW REQUIREMENTS FOR AN NRC-QUALIFIED ENGINEER
SUPERVISOR ON EVERY SHIFT

Some have argued that large nuclear powerplants are too sophisticated to be
entrusted to operators who are required to have only a high school degree or
equivalent and a limited general knowledge of physics and engineering-that weshould qualify only Ph.D.'s or graduate engineers as reactor operators. But it might bedifficult to find enough such highly qualified people to fill these positions. The
counterargument has been made that for the kinds of tasks reactor operators routinely
perform, Ph.D.'s would be poorly qualified and perhaps would not perform as well.
In Navy reactors, where more reliance is placed on the operator rather than on
automatic systems in comparison to commercial plants, the technical expertise inoperations is supplied by an "engineer officer of the watch" who constantly stands inthe control room directly behind the operators. This engineer watch officer is acommissioned officer with a technical degree and special training and education ini ntegrated plant operations.

The large commercial nuclear plant is not only more complex than the Navy reactor,
its primary system is also much more sensitive to what happens throughout the rest of105

the plant. Such a plant cannot be operated safely with a small number of operators who
have little more technical expertise than that provided to Navy enlisted men.
Commercial reactor operators must be better trained to respond to emergencies and todiagnose system casualties. But additional expertise in commercial reactor control
rooms should be provided by having graduate engineers in supervisory positions on
every shift to deal with abnormal conditions-not by trying to make reactor operators,
who must stay awake and perform a variety of mundane functions on long shifts with
virtually nothing else to do, into such experts.

On the first day of the Three Mile Island accident a number of supervisory andmanagement personnel in the Unit 2 control room were unable to contribute very muchbecause they lacked familiarity with the plant. Such knowledge is essential for a
supervisory member of the site management team. In order to upgrade the technicalcapabilities of those who will be on site when an accident occurs or arrive shortly
thereafter, we think the NRC should require every licensee to hire a cadre of engineers
knowledgeable in reactor engineering and physics. Each should be provided withtraining in the specific characteristics of the plant at least equivalent to that received bya senior reactor operator, with special emphasis on integrated plant response andtransient behavior. The utility should be required to deploy at least one such engineer
supervisor, whose qualifications have been examined by the NRC, as shift manager on
every shift in direct control of the shift crew.
The "Lessons Learned" Report of NRC's Office of Nuclear Reactor Regulation(NRR) proposes that a qualified engineer be available on each reactor shift as atechnical advisor. Our recommendation is distinctly different: we believe that qualified
engineering personnel must be required in the supervisory chain of command on eachshift, and that these personnel be qualified and examined by the NRC for intimate
knowledge of the systems and behavior of the plant for which they will have
responsibility.

I n addition, we believe minimum manning requirements for each shift need to be
increased by the NRC. For Three Mile Island, Unit 2, the NRC required a minimum of
only two licensed reactor operators, one senior licensed reactor operator, and twoother persons on a shift to run the plant. Moreover, only one licensed operator was
required to be in the control room, and the three-licensed-operators-on-site requirement could be violated for up to 2 hours at a time.
Met Ed, by company policy, maintained a larger shift complement than the NRC's
minimum, including a shift supervisor on the island during all shifts including the backshift and "graveyard" shift. Virtually every Met Ed witness we deposed agreed that the
NRC's minimum manning requirements, which are embodied in standard "technicalspecifications" that apply to many plants, do not ensure that there are enough qualified
personnel on shift to cope with a serious transient or an accident. But even Met Ed
required only a shift supervisor as the top official on site during nighttime hours. Most
shift supervisors at Met Ed, and probably at other plants, are not engineers but haveworked their way up from being reactor operators to shift foremen, and then to shift
supervisors.
I n sum, what we are proposing is a substantially more detailed, upgraded set of
requirements for technically competent supervisory and management officials certified
by the NRC to be present on each shift to direct the operation of the plant. This will
require not just that additional criteria be drafted, but also that new methods of106

certification be developed to ensure the management and technical qualifications ofutility personnel. And in order for the NRC to certify the technical competence of onsite
supervisory personnel, it will have to upgrade the competence of its own staff in theprocess.
THE NEED FOR AN INDUSTRY-RUN OFFSITE DATA CENTER

I n addition to improving the technical competence of the crew that is in direct controlof the plant, the accident at Three Mile Island demonstrated that many of the importantdiagnoses in an emergency can best be made by individuals not embroiled in the hectic
atmosphere of the control room. We think there is an immediate need to provide theonsite crew with prompt, reliable access to offsite expertise to assist them indiagnosing and responding to a potentially serious accident situation.

At TMI, difficulties in communications, management, and logistics contributed to thefailure to bring available expertise to bear. Met Ed's Vice President Herbein, forexample, did not arrive at the site until about 7 hours into the accident, and stayed
across the river from the island at the company's observation center. GPU Service
Company's engineering headquarters, located in New Jersey, was only in sporadic
contact with the Unit 2 control room. There was no direct telephone contact
throughout the day between the site and B&W in Lynchburg, Virginia. Contact between
NRC nuclear engineers in Bethesda and the site was often indirect and appears tohave been largely ineffective in responding to events.

The technology exists today for remotely displaying essential information and forproviding direct, continuous oral communications. We recommend that one or more"data centers" be established to which essential plant parameters would be telemetered automatically from the display computer systems of every nuclear plant. At least
one of these centers would be staffed by experts in reactor operations and reactor
engineering with detailed knowledge of the various plant designs. Simulators,
computers for diagnostic assistance, and other special capabilities could be madeavailable from these data centers.
Under this system, each plant's control room would be connected with the data
center via a telephone or satellite hot line, as well as by the telemetry lines. In the eventof any unexpected occurrence the plant would notify the center; the center would "callup" real-time readouts of essential plant instrumentation on the center's own display
panels, and experts would be available to advise control room operators orally on the
hot line. The data center's computer would also store these readings in its memory fora certain number of hours or days, so that information of the type that was "lost" atThree Mile Island could be played back to determine at what point certain alarms hadgone off or to read trends in plant parameters.

We understand that many or even most existing plants already have instrumentation
display systems that could accommodate such telemetry, and that those that do not
could be altered at small expense. NRC's Office of Inspection and Enforcement has
already asked for an internal NRC feasibility study to see whether such information
could be telemetered to NRC's emergency response center in Bethesda. We think,however, that it would be preferable for a comprehensive data center and support team
to be managed by the industry itself, by the utilities and perhaps by the vendors, not by
the NRC-though the NRC could take advantage of the system by receiving a
duplicate remote readout.
107

NRR's "Lessons Learned" Report proposes that each utility be required to maintain
an offsite emergency data center of its own where important plant parameters could beread. Additional stations such as these for remote readout would be useful, but webelieve it is important to centralize the data center we have in mind so that experts inreactor systems, thermal-hydraulics, and radiation protection can be kept on duty 24
hours a day to respond instantly to emergencies.
We do not view the centralized national (or regional) data center we propose as a
substitute for training better control room operators and improving the onsite technicalexpertise of utility supervisors. The offsite data center would serve as a backup
resource, capable of giving advice and counsel on perplexing instrument readings or
sophisticated projections of how the plant is likely to react under certain severe
conditions. The remote data center is no alternative to technically qualified, competentpeople on site, nor can it "take over" operation of the reactor. It should play a supportrole for engineering management in the control room.

108

3CHARTERING OF A NATIONALOPERATING COMPANY OR
CONSORTIUM

I n discussions we conducted with our consultants, with senior management of anumber of vendors and architect-engineer firms (AEs), and with others in the industry
we repeatedly heard that there is a wide spectrum in the capability of the various
nuclear utilities to operate existing plants in a safe fashion. The reasons for thisvariation appear to be twofold.
First, some utilities have more nuclear experience and a larger group of technicallycompetent nuclear personnel than others. Although the law places sole responsibility
for the safe construction and operation of a nuclear powerplant on the utility company
that owns it-the NRC's "licensee"-the utility typically possesses less nuclear
expertise than any other participant in the enterprise. Most often the real engineering
talent lies primarily with the "vendors" and AEs who design and build the plants, andwith the NRC.

Some of the first commercial nuclear plants were "turnkey" projects designed andbuilt entirely by vendors-General Electric or Westinghouse-for a fixed price andthen turned over to utilities for operation. In this country that pattern has changed. A
utility now hires an architect engineer firm like Bechtel, Stone & Webster, or, in thecase of TMI-2, Burns and Roe, to serve as "general contractor," design the overalllayout of the plant, and serve as the utility's technical advisor in buying a vendor's
reactor system, which in price may amount nowadays to no more than 15 to 20% of thetotal project.
But the distribution of expertise has not changed. Except in the case of the largest
and most experienced nuclear utilities, it is the vendor's and AE's experts as thechampions of the utility who do battle with the NRC's experts to win a license. They
also construct and supervise the testing of the new plant. In the meantime, the vendor
and AE are also helping the utility to build up its operating and engineering
departments, to find and train competent operators and supervisors to run the yet-tobe-completed plant, and to write operating procedures. When testing is complete andthe plant goes into service, the utility is on its own.

Vendors especially are resentful of the suggestion that they are like new car dealers
who "flip the keys" to the car buyer and then walk off the lot. But the fact remains thatany continuing partnership between the operating utility and the vendor depends inlarge part upon the utility's willingness to pay for additional services.
The second reason for the variation in nuclear capability among the various utilities
appears to be that different utility companies accord their nuclear generation units
different priorities and different amounts of resources.

1 09

The electric utility industry has recently established an industrywide Institute of
Nuclear Power Operations (INPO) that will undertake to police and upgrade themanagement and operating competence of its members.

We believe INPO can play an especially important role in providing affirmative
assistance to its members to upgrade the competence of their site crews andmanagement-assistance the NRC cannot easily provide without compromising its
enforcement role.
If INPO is linked to a plan for coinsurance by a pool of utilities of the cost of
replacement power that would have to be purchased by any one utility after a nuclear
accident shut down its plant-so that a utility not receiving a passing grade fromI NPO's inspectors and auditors would be excluded from the coinsurance pool-thisapproach has some chance for success. We urge its rapid implementation. At the
moment, however, it is still a promising possibility, not yet implemented.

The fact remains that nuclear technology is different in kind from the traditional
technology of electric generation by fossil fuel and hydroelectric means-more
dangerous, more sophisticated and more demanding of advanced management,
maintenance, and quality control. It may be that some utilities, because of their limited
size, limited technical staffs or limited capital, simply will not be able to meet theincreased demands we think the Three Mile Island accident demonstrates must be
made upon them by the NRC to provide a technically competent site management teamon every shift, first class operator training programs and other safety improvements. If
that is true, then some alternative must be found to provide for the safe operation ofthese plants.
We suggest that a number of existing plants now owned by different utilities could be
operated (and new plants constructed) by an industrywide consortium or a public
corporation such as COMSAT. This entity would manage the plants; select, train, andemploy operators, supervisors, and engineers; standardize operating conditions andprocedures; and, with the cooperation of vendors, systematically evaluate operating
experience and implement changes in design or operations. Operating budgets could
then be developed on a systemwide basis.

The company or consortium would either acquire the plants and sell electric power
to the utilities for resale to customers, or it would operate existing plants now owned by
the smaller utilities and provide additional technical assistance to these utilities on acontract basis. Under the latter approach the operating company or consortium would
report to each utility its share of operating expenses and capital improvements at
appropriate intervals for the utility to report to its State public utility commission.

The existence of a chartered national operating company or consortium could also
help to resolve the regulatory dilemma in which the NRC may find itself if it determinesthat a particular utility has not put together a technical and management team capableof operating its plant safely. At present, the only weapons in the NRC's regulatory
arsenal are rather trivial fines on the one hand, or the authority to close down a plant on
the other, thus depriving the area of needed electric power and making it even moredifficult for the utility licensee to rehabilitate the situation. With a national consortium or
operating company in existence and licensed by the NRC, the agency could put a
powerplant that is below the acceptable level of safety into "receivership," requiring
11 0

that its operation be undertaken by the national company as a condition of the utility
keeping its operating license.
This suggestion obviously calls for important institutional changes, but they are
hardly revolutionary. A proposal that all nuclear powerplants should be operated by asingle, Government-chartered entity in order to standardize operations and upgrade
safety has been made on more than one occasion by well-known experts in the field of
nuclear power. We think that something short of this proposal-the availability of aconsortium or national operating company to run some plants-can be a usefulsolution to the resource problems of smaller utilities and can be beneficial to the levelof safety throughout the nuclear industry.

11 1

4 I MPROVED NRC MANAGEMENT

AND REORGANIZATION TO A SINGLEADMINISTRATOR AGENCY;ESTABLISHMENT OF ANI NDEPENDENT REACTOR SAFETY
BOARD

We have found in the Nuclear Regulatory Commission an organization that is not somuch badly managed as it is not managed at all. In our opinion, the Commission isincapable, in its present configuration, of managing a comprehensive national safety
program for existing nuclear powerplants adequate to ensure public health and safety.
A radical reorganization of the Commission's structure and management is called for,now.
The roots of this problem are historical, statutory and to some extent personnelrelated. The NRC came into being in 1975 as a result of legislation that dismantled theold Atomic Energy Commission, transferring the AEC's promotional activities to theEnergy Research and Development Administration (now part of DOE) and its
regulatory activities to the new NRC. The NRC was primarily constituted out of the
AEC's former Directorate of Regulation, which had always been headed by a single
director; the AEC commissioners themselves had for years had little interest or direct
i nvolvement in the licensing of nuclear plants.

However, the new NRC was fashioned in the image of the old Commission itself andcarried over a commission structure with five members, appointed by the President for
5-year terms with the advice and consent of the Senate. According to the statute eachof the five commissioners has "equal responsibility and authority in all the decisions
and actions of the Commission."

As a practical matter, most of the functions of the NRC, including licensing of newreactors and inspection of operating plants, are carried out by the NRC staff.
Obviously, one of the Commission's functions is to manage and set policy for its staff.
But in practice the Commission has isolated itself from the NRC staff. The Commission
does not directly supervise the staff's day-to-day work. It is not even officed in thesame State: while the commissioners and their small personal staffs, together withsome other Commission-level offices such as the General Counsel, are located in
downtown Washington, NRC staff are scattered in a half-dozen office buildings insuburban Maryland, nearly an hour away by agency shuttle-bus. A strong "we-they"feeling has developed on both sides. One commissioner characterized relations
between the staff and the Commission as not unlike those between sovereigncountries: cordial, somewhat distant, and conducted for the most part in writing, but
always with the requisite formalities.
As for the Commission, the result of its statutorily prescribed structure is that it must
function as a collegial body: it can make no decisions and take no action without a
11 2

majority of the commissioners in agreement. In 1975, the original NRC legislation wasamended to make the chairman of the Commission the "chief executive officer" withrather vaguely described powers to exercise executive and administrative authority. At
the same time, however, the Act prescribes that the chairman shall be governed by thepolicy of the Commission and gives the commissioners as a whole approval authority
over appointments to the major staff offices and formulation of the agency's budget.
There was also some sentiment that the 1975 amendment was procured by the thenchairman behind the backs of other commissioners, so that subsequent chairmen havebeen reluctant as a political matter to try to exercise whatever additional authority thel aw may confer on them.

NRC Chairman Joseph Hendrie and licensing director Harold Denton
tour the TMI site.
11 3

Below the Commission there is no general manager or chief executive officer withsingular authority over the staff. The staff is divided into five major offices, three of
which are independently chartered by the statute, and each of which is headed by an
office director. Between the office directors and the Commission is an Executive
Director for Operations (EDO). According to NRC regulations, the EDO is authorized to"discharge the operational and administrative functions of the Commission" and to"perform such functions as the Commission may direct." But the statute itself limits the
EDO's power to restrict the office directors beneath him, each of whom can by law
report directly to the Commission rather than to him. Indeed, until 1978 the officedirectors were able to bypass the EDO altogether; a statutory amendment that year
required them at least to keep the EDO informed of their communications with thecommissioners. As a practical matter the EDO does not currently have the authority to
manage the staff. Although the Commission arguably could confer such de facto
authority on the EDO, it has not done so in the past few years, and the individual who
has been serving in that position (who is retiring in the next month) has not sought toexercise such authority or to serve as a manager.
Thus, the EDO has served primarily as a conduit between the five equally powerfulcommissioners above him, and the five office directors, each with his own independent
jurisdiction, below. The result has variously been described as "nonmanagement," a"mess," and a situation where "nobody is running the store." As for the staff offices,
they have been characterized as "feudal" baronies and "independent fiefdoms."
It is not uncommon at public meetings of the Commission to see a majority of thesenior staff of the agency-office directors, their deputies and their senior technicalexperts-filling the front rows of the meeting room (after nearly an hour trip todowntown Washington from Maryland) waiting in case a commissioner should raise aquestion about a particular staff office's "position" on some question. This practicedemonstrates a complete lack of coordination of the agency's resources and atremendous waste of time for the staff and for the Commission.
One industry manager analogized the NRC's conduct of its business to the play of anamateur soccer team: "Everybody runs to where the ball is."The effects of the NRC's structure in impeding the effective exercise of management
authority in the agency have been exacerbated in the past several years by the varietyof viewpoints among the commissioners and their inability to work together. Sometimes
there has not been a majority of three for any course, and often when there has been,
the chairman of the Commission, until recently Joseph Hendrie, has been in theminority, further complicating effective leadership. The net effect of structure andpersonnel has often been paralysis.

More surprising than that the Commission spends very little time managing or setting
goals for the NRC staff is the fact that until recently it has spent very little time as aCommission deliberating or deciding any of the broad or important issues relating toreactor safety-the subject the public no doubt believes is the Commission's highest
priority and certainly its raison d'etre. I nstead, it appears that the Commission has
traditionally spent the bulk of its meeting time on dozens of specific, isolated, safetyrelated matters, on personnel and budgetary matters, administrative chores, and such
issues as export licensing.
In sum, the Nuclear Regulatory Commission has provided neither leadership nor
management of the Nation's safety program for commercial nuclear plants. The
question is how this problem can be remedied.
11 4

REORGANIZATION TO A SINGLE ADMINISTRATOR AGENCY

The central and overwhelming need is for legislative and executive reorganization toestablish a single chief executive with the clear authority to supervise and direct theentire NRC staff. An effective reactor safety program absolutely requires strong andeffective management of this kind.

The NRC is virtually the only agency in the Federal Government charged withprotecting public health and safety that is headed by a commission. Regulatorycommissions such as the Federal Communications Commission, the Interstate Commerce Commission, the Securities and Exchange Commission, and the Civil Aeronautics Board basically regulate economic behavior, not safety. For the most part, theprotection of the public safety and health has been committed to single-administrator
agencies: the Food and Drug Administration, the Environmental Protection Agency, theOccupational Safety and Health Administration, and the Mine Safety and HealthAdministration. In the airline safety area, where the CAB regulates economics, theFederal Aviation Administration regulates safety. Indeed, considering the old AEC's
lack of interest in regulation, the management of reactor safety was for all practical
purposes a single-administrator agency within the AEC until 1975.

Two main arguments have been advanced for retaining the Commission: (1) that thecommission form enhances public visibility of the policymaking process; and (2) that
because public opinion about nuclear power is divided and uncertain, and because
quantitative assessment of its risks is imperfect, the Commission helps ensure that adiversity of views will be represented in that policymaking process. Along with thesearguments is another, perhaps stronger concern that apparently prompts somemembers of Congress and anti-nuclear critics to be suspicious of the single
administrator proposal. They fear that if the single administrator were "pro-nuclear,"he might ride roughshod over legitimate concerns about safety, compared with several
present commissioners who are sometimes identified as being dissatisfied with pastsafety efforts. Some legislators may also be concerned that the effectiveness ofcongressional oversight of a single administrator directly responsible to the executive
branch would be reduced.
We do not believe any of these considerations is a valid reason for retention of thepresent commission structure. With respect to public visibility of the licensing process,the present Commission does not involve itself in that process anyway, and under asingle administrator the independent Licensing and Appeal Boards would be retained.

With respect to rulemaking and policymaking on important safety issues, as we havepointed out, the Commission has not in the past spent a substantial amount of its time inthis area either. The rulemaking and policymaking proceedings in which the Commission engages would be conducted in front of a single administrator in the same public,
on-the-record fashion. Realistically, the opportunity for public scrutiny of the policymaking process depends not on whether there is a single administrator or fivecommissioners, but on the effectiveness of the avenues available for public participation. Most issues important to safety will be pursued not by the general public but by
i ntervenor, public interest and scientific groups. We propose later in this report a seriesof steps (including more deliberate, open policymaking at the top level of the agency;
i ntervenor funding; and establishment of an Office of Public Counsel) that would
altogether increase public visibility of and participation in the policymaking process far
above what it is today, even if the agency were run by a single administrator.
11 5

There is not an agency in Government that would not better provide for a "diversityof views" if it were headed by a commission. It is not likely, however, that any of theseagencies would be as well managed. As the NRC's own history of nonmanagement andl ack of leadership amply demonstrates, reflection of diverse views must be weighedagainst effective management, which in this case means effective management of acoordinated safety program.
The disadvantages of the commission form have been pointed out again and again
over the past two decades by various prestigious study groups. For example, thePresident's Council on Executive Organization, which involved a study of a number of
independent Federal regulatory commissions culminating in the so-called "AshReport" in 1971, made a number of observations about the weaknesses of thecommission structure in general. The Council concluded that collegial bodies are
inefficient mechanisms for formulating and implementing policy in a timely manner; theytend to disagree on major policy issues and therefore wait for individual cases in which
to decide such issues; they fail to coordinate policy with other agencies; they tend toconcentrate on details and create backlogs in dealing with important issues; they do
not adapt easily to new technology and industry innovations; they create a legalistic
environment that contributes to a passive, overly judicial approach to regulation; they
allocate resources poorly within their own agencies; and, ironically, they tend to defeat
the political accountability required for public responsibility.
The desire for "diversity" in part mistakes what we believe to be the proper roles forthe regulatory agency, the Executive and Congress in our nuclear safety program. We
do not believe the proper function of the Commission or administrator should be toconsider and resolve competing public attitudes about nuclear power in every
i ndividual safety decision that is made. It is precisely this hidden pressure that has
played an important role in paralyzing the Commission in the past few years. Decisions
about the ultimate safety objective in the regulatory program, and about the expansion
or reduction of our country's reliance on nuclear power-decisions which inevitably
i nvolve a balancing of the risks against the benefits of this technology-should
ultimately be made by the Executive and Congress, as a part of the Nation's overall
strategic energy policy.
The role of the Commission or administrator should be to formulate such a standard
in the first instance for review and approval by the President and Congress, and thenwhen a standard is approved to apply it. No independent regulatory commission
determines the extent to which any other component of our Nation's energy mix (oil,gas, coal, etc.) will contribute to overall energy production. For this reason, we think it
i s appropriate that a single administrator be responsible directly to the executive
branch, and to Congress through strong congressional oversight.
Finally, we do not believe that the expression of an appropriate diversity ofviewpoints will be hampered by abolishing the Commission. It is precisely this range ofviews that Congress itself is supposed to reflect in its legislative capacity and in its
oversight of the level of safety being provided by the regulatory body. Further, wesuggest below the establishment of an independent Nuclear Safety Board that will add
to the expression of such viewpoints and will provide a separate assessment of how
well the regulatory body is fulfilling its functions. The establishment of this Board andbetter management and coordination of the agency, we think, will improve, rather thandetract from, the opportunity for effective congressional oversight.
11 6

The fears of those who worry that the regulatory body might be put into the hands ofa single administrator who is insufficiently concerned about safety will be vitiated, in
our view, by congressional confirmation and oversight authority, by establishment of
the proposed Nuclear Safety Board, and by increased accountability of the administrator in the political process.

I n the final analysis, we have found that the greatest single improvements in safety
can be made by better management of the NRC's regulatory program and by increased
requirements for onsite supervisory technical expertise at nuclear powerplants. Bothwill require an overhaul of the NRC's structure and management. Mounting anaffirmative, comprehensive safety program is not a task that requires diversity ofopinion. It is a task that absolutely requires strong central management controls andunified policymaking.

We do not believe that the current Administration's proposal to "strengthen" theNRC chairman's executive authority goes far enough to reach the heart of the problem
involved here. In our view, a far-reaching management reorganization is required inwhich all of the Commission's offices report directly to a single chief executive, whopossesses the authority to establish policy, hire and fire top staff, allocate andredistribute resources within the agency, and supervise the day-to-day operations of
the staff. This can be accomplished only by new legislation.
I n addition to the centralization of management under a single chief executive
officer, we recommend the following organization and management reforms andi mprovements.
CONSOLIDATION OF RESOURCES DEVOTED TO OPERATINGREACTORSAs described above, we recommend that all the agency's resources relating tomonitoring operating reactors be consolidated in a single office, and that mechanisms
for better coordination between the licensing and operational offices of the NRC beestablished, including strong project management teams that have ties to both offices
to monitor construction and testing of new reactors.
SINGLE LOCATION

The physical separation of the Commission from the staff, and of staff offices andbranches from one another, is not only time-wasting but also encourages a poor
working relationship and fragmentation in the staff. We recommend that high priority begiven to locating the entire agency in a single location. The fact that the location may
not be in downtown Washington, D.C., should not slow down the agency's unification.
In the interim, we believe the offices of the commissioners and their personal staff
should be promptly relocated in Bethesda, Maryland, adjacent to most NRC staff
offices.
ESTABLISHMENT OF AN INDEPENDENT NUCLEAR SAFETY
BOARD

The substance of the agency's licensing and regulatory functions is carried out
almost exclusively by a technical staff trained in the various engineering and scientific
11 7

disciplines relevant to nuclear power reactors. These individuals are the ones who
review license applications, establish safety requirements and recommendations,conduct inspections, take enforcement actions, develop standards, and administer
research programs. The safety recommendations and analyses that come from thesesources shape and, realistically, control most licensing and regulatory actions. The
staff is where the safety die is cast.

We have found that there is really no existing organization within the agency that haseither the responsibility for or the capability of monitoring the effectiveness of theregulatory staff and of making recommendations for actions needed to establish andmaintain a safety review process of the requisite level of quality. It is a paradox thatwhile the agency has long insisted on quality assurance programs for industry entities
associated with nuclear powerplants, it has never imposed a similar requirement for its
own regulatory staff or for the safety review and inspection process. With the vast
amount of unsupervised discretion that exists in the process, it is not surprising that
senior managers readily accept the status quo and that few, if any, have spoken out
and demanded agencywide organizational reforms. The momentum for that must comefrom outside of the staff.

Moreover, we have been surprised to find that NRC management was notconversant with modern safety engineering and management techniques in use in otherhighly complex technologies, particularly those associated with aerospace andnational defense programs. Both NASA and the Department of Defense have had
affirmative safety programs for years, if not decades, in which accident prevention
technology has been applied beyond safety merely being "everybody's job."
Similarly, in other fields project management on a system life cycle basis has been away of life in directing development, testing, and operation of complex vehicles,
facilities, and equipment. Yet relatively little of this systems management philosophy
exists at the NRC. Instead, the NRC's role has been oriented more toward prescriptive
li censing of a utility-putting a "Good Housekeeping Seal of Approval" on a proposed
product-as distinguished from regulation which must include careful monitoring andcontrol of hazards during the entire life of a facility.

We believe there is a clear and pressing need for an organizational entity within theagency to be responsible for observing, evaluating, and making recommendations toi mprove the quality of the overall performance of the regulatory staff. This need canbest be satisfied by the establishment of an independent Nuclear Safety Board. This
Board would be outside of and independent of all other offices in the agency. The
Board should be composed of a number of persons who are trained in technicaldisciplines associated with nuclear safety and radiation protection and who arethoroughly experienced with the licensing and regulatory process. The Board would be
provided with a technical staff appropriate to its functions, and with necessary support
personnel. It would not duplicate the functions of any office or provide another layer inthe review process, but would instead:• Exercise oversight on the effectiveness of the licensing review process and theregulation of existing plants.
• Advise the administrator on regulatory goals and important issues for rulemaking.
• Act as an ombudsman group to receive complaints and technical dissents.
11 8

• Enhance reactor safety by monitoring the effectiveness of the Office for Analysis and
Evaluation of Operational Data's review of operating experience and of all otheroperational feedback.
• Monitor the staff's use of the latest analytical and design tools, and ensure thatmodern safety technology is applied throughout the agency's activities.

• Develop and maintain a capacity to investigate accidents and important safetyrelated incidents, independent of all other offices of the NRC and the Commission oradministrator.
The independent Board we envision has an analog in the National Transportation
Safety Board (NTSB), which investigates aviation accidents independent of the FAA.
But we envision a much larger role for the Nuclear Safety Board in providing a quality
assurance function for the agency's regulatory process as a whole.

Some thought will have to be devoted to the relationship between this proposed new
Board and the existing statutorily prescribed Advisory Committee on Reactor
Safeguards (ACRS). As discussed later in this report, we believe the ACRS has adistinct role to play in the regulatory process and that that role should be strengthened.
However, the ACRS is composed of part-time members expert primarily in technicalfields relating to reactor safety; we do not believe that the ACRS as presently
constituted can perform the broader functions of the proposed Nuclear Safety Board.
We suggest that the Nuclear Safety Board might be composed of five full-timemembers who would also be members of the ACRS. Thus the ACRS would becomposed of ten part-time members and five full-time members; the latter would voteas ACRS members on licensing proceedings and would also serve as full-time Nuclear
Safety Board members. Our recommendation that additional staff be provided to the
ACRS could then be met by having the Nuclear Safety Board's staff provide support for
the ACRS as well as for the Board.
STRONGER PROJECT MANAGEMENT

The licensing project management organization was at one time the strongest
technical group in the regulatory staff. With the development of the center-of-technicalexcellence concept, in which experts in common or closely related technical disciplines
were grouped together, the importance of the project managers was reduced. Indeed,
the centers-of-excellence approach itself has been diluted in recent years, with several
staff offices each having its own group of experts-a configuration that central
management will hopefully correct. Even though some redirection of the all-powerfulproject manager was needed, subsequent studies have periodically concluded that the
reduction in the role of the project manager went too far. A strong project management
organization provided a method for obtaining an overall balance in the staff's safety
evaluations. That is not available in the present organization.
In addition, one of the obvious lessons learned from the Three Mile Island accident is
the critical need for overall plant and systems analysis. There is as much or more of achance that safety matters will "fall in the cracks" between two or more highly
proficient technical groups as there is for a safety error to be made in any of thespecific groups. The need for this form of analysis has been clearly recognized by NRR,
and should be coordinated through a strong project manager.
11 9

PERIODIC REASSIGNMENT OF SENIOR MANAGERS

The NRC has never had a planned program for the rotation, exchange, or periodic
reassignment of senior staff managers. Some senior managers do move to new
assignments but in most cases it is the result of a promotion. Management steps must
be taken to insure that the agency performs as a team and not as an uncoordinatedgroup of competing offices, each unfamiliar with the others' personnel functions andcapabilities. One such step is the exchange or rotation of senior level managers on amore preplanned basis. We recommend that such a program be developed andi mplemented promptly.
STAFF TRAINING

One of the most glaring deficiencies in the NRC is the lack of a program for its staff
to acquire experience in the actual design, construction, and operation of nuclear
powerplants and of the problems of radiation protection. To regulate the safety of suchplants effectively, the regulators should have a clear appreciation of the techniques
and procedures used for design, construction, and operation. For example, if a person
has never operated a large powerplant for a period of time sufficient to encounter the
spectrum of operational problems that are likely to occur, it is unlikely that that person
can develop an effective program to test and license other individuals for operator andoperations management positions.

The staff has in the past considered possible ways in which it might obtain andperiodically update a reasonable level of actual design, construction, and operating
experience. Some individuals joining the staff have related industry experience; evenfor those, however, the experience is often not closely related. Many join the staff uponcompletion of their university programs and with little or no experience in industry. Withti me, many of these individuals achieve prominent managerial positions within the NRC
staff where their lack of practical knowledge can have a significant adverse impact on
the staff's overall performance and its stature in the eyes both of the regulated industry
and the public.

The staff has suggested that an exchange program be set up between the agency
and the Tennessee Valley Authority so as to mutually benefit key staff personnel.
Similar suggestions have been made involving national laboratories and military
programs. To date, all such suggestions have been quickly rejected on the basis ofpotential conflicts of interest or for other unspecified reasons.
We have concluded that the need for practical experience for staff personnel
outweighs potential concerns about conflicts of interest. We recommend that theagency establish a policy that practical experience is a requisite for key staff
personnel, and arrange an effective program to obtain this experience for theappropriate individuals.
TRANSFER OF NONREACTOR SAFETY RESPONSIBILITIESThe NRC currently has responsibility for a variety of matters that do not relate to its
central goal of promoting the safety of nuclear reactors and handling of nuclear
12 0

materials. Consideration should be given to transferring these functions to otheragencies. For example, the NRC's antitrust responsibilities should be transferred to the
Department of Justice or the Federal Energy Regulatory Commission. Its jurisdiction
over export licenses should be transferred to the Department of State, or the Arms
Control and Disarmament Agency, which should then consult with the NRC on safetyrelated matters.

12 1

5GREATER APPLICATION OF
HUMAN FACTORS ENGINEERING,I NCLUDING BETTERI NSTRUMENTATION DISPLAY AND
I MPROVED CONTROL ROOM DESIGNIn 1975 one of the NRC staff's leading safety experts, Stephen Hanauer, in amemorandum to Commissioner Victor Gilinsky setting forth the major problems insafety that should be addressed by the new NRC, said: "Present designs do not makeadequate provision for limitations of people." The President's Commission found thatboth the industry and the NRC have "failed to recognize sufficiently ... that the humanbeings who manage and operate the plants constitute an important safety system." A
senior B&W official put it a different way: he told us that the industry had done a fine job
i n engineering safety equipment, but that good engineering also meant designing forpeople-that the industry had fallen down in "bringing operators within the designenvelope."

During the period in which most large nuclear plants have been designed, thenuclear industry has paid remarkably little attention to one of the best tools available
for integrating the reactor operator into the system: the relatively new discipline of"human factors." Human factors engineering was born of military needs during WorldWar II and has since blossomed in the aerospace, defense and aircraft industries. But
nuclear utilities, vendors and architect-engineer firms have done very little toi ncorporate such learning into their designs, and the NRC has done virtually nothing torequire them to do so.
This failure reflects the preoccupation of the industry and the regulatory agency withhardware systems. The NRC gives short shrift in the design safety review process todetermining how well operators will be able to diagnose abnormal events, based onwhat they see on their instruments, and respond to them. In part, the failure is also due
to a lack of expertise. The agency has no office or staff members charged withexamining the interaction between operators and design systems. Before the Three
Mile Island accident, virtually no one in the agency was knowledgeable about suchmatters, and the agency was making no effort to seek out such people.

The pernicious effects of this attitude on the safety review of design are clear. Ourinvestigation found that the TMI-2 plant was substantially more dependent than otherdesigns upon operator action to prevent a routine loss-of-feedwater transient fromturning into a possible accident under circumstances such as a stuck-open valve. The
specific "operator sensitivities" of plants similar to TMI-2 revealed by the accident
have since been ameliorated by changes in control logic and by the setting of different"setpoints" for automatic operation of certain equipment. The point is that thissensitivity-and undoubtedly the sensitivity of other designs to operator action in othertypes of "transients"-has never received much attention from the industry or the
NRC.
1 22

CONTROL ROOM DESIGN
Control room design and instrumentation is another example. Useful human factors
criteria for these designs have never been developed by the nuclear industry. The NRC
i mposes only the most general criteria on control room design and instrumentation, andthus there are virtually no human factors requirements for the design and layout ofreactor control rooms, the readability or grouping of instruments, or what plantparameters and alarms must be displayed and how.
I n the past few years a number of excellent studies have found significant flaws incontrol room design of operating nuclear plants: instruments that are difficult to makeout and do not distinguish between normal and dangerous readings; controls located
far from the instrument displays that show the condition of the controlled system; failure
to display important plant parameters in a prominent position; lack of functional
instrument grouping, so that identical knobs with widely differing functions are placed
together, thereby inviting confusion; lack of "mimicking" to identify related controls on
consoles; lack of consistent color coding and labeling (a red light, for example, may
mean that a valve is in an "open" position, which could be its normal operating
position, or it may mean that the valve is in an "abnormal" position).
The studies also found physical hindrances had to be endured by operators. Glareand reflection on instruments, compounded by poor lighting, made meters difficult toread. Instruments were placed too high or too low. Far too many alarms, both audible
and visual, inundated the operators with a numbing amount of information in any
abnormal occurrence in the plant, and alarms were seldom prioritized. But the NRC did
nothing to require improvements even in future control rooms, despite the existence of
this excellent work by outside experts.
The Three Mile Island Unit 2 control room exhibits many of these weaknesses-anda detailed study done by one of our contractors, as well as other studies, shows that it
is not atypical of plants of its vintage. For example, the Unit 2 control room is far toolarge and lacks orderly grouping of instruments by function, especially the grouping of
emergency controls and instruments in a common location. There is insufficient use of
mimicking on main panels. Many of the instruments are virtually impossible to readgiven the poor lighting, the plastic shields in front of them and the quality of the pengraphs. There are line-of-sight and parallax problems with some instruments for
operators standing at functional control stations. The control room has over 750
alarms, significantly more than the Babcock & Wilcox simulator on which Met Ed
operators practice. On the morning of the accident, the alarms were of little use due tothe number that were flashing and their almost random location. Instruments importantto the accident, though they may have appeared to be of secondary importance to thedesigners, were located on back panels or consoles.

Control room design played more than a minor role in contributing to the accident atThree Mile Island. Important alarms that might have told operators the pressurizer relief
valve was stuck open, even though the control panel light showed it was closed, were
the alarms keyed to temperature and pressure in the reactor coolant drain tank, into
which hot water from the stuck-open valve was pouring for over 2 hours after theaccident started. However, these alarms are on a panel remote from the central
console that faces away from the operator!
1 23

The size and layout of the Unit 2 control room may have contributed
to the operators' difficulties in responding to the accident.

124When the alarms for these indicators went off, the alarm lights could not be seenfrom the main console or main panels. An audible alarm went off but the audible signal
is the same for all alarms so there was no reason for operators to single out the reactor
coolant drain tank alarms. And pushing the single button on the central console that"acknowledges" alarms caused the drain tank alarm to stop buzzing and theannunciator light to stop flashing. Without up-to-date computer printout, it is theni mpossible to tell when the alarm came on. During the accident the computer kept
running behind in printing alarms, and operators "dumped" the computer memory
several times to get back up to date.

Since the accident, operators have taken matters into their own hands. Affixed to theback wall of the control room is a large, round, convex rearview mirror-like thoseused in stores to watch for shoplifters-so that operators can see when lights areflashing on this backward-facing console.
In other respects, control room design also detracted from the operators' ability todiagnose the accident. A number of the operators told us that the constant buzzing of
the audible alarm system and the flashing of alarm lights was distracting at importantti mes during the accident and made it more difficult to try to identify the true causes ofthe problems they were encountering. One of the operators on duty in the early hoursof March 28 had written his management nearly a year earlier:
The alarm system in the control room is so poorly designed that it contributes little in theanalysis of a casualty. The other operators and myself have several suggestions on how toi mprove our alarm system-perhaps we can discuss them sometime-preferably before thesystem as it is causes severe problems.

Met Ed undertook a study of the control room in Unit 1 to try to eliminate some of theless significant alarms, but nothing had been done in Unit 2 at the time of the accident.

The actual design of the Unit 2 control room was a product of the fragmented design
process already discussed above. Principal responsibility for control room layout andinstrumentation lay with the architect-engineer, Burns and Roe. That company, in turn,consulted with B&W, but only on specific primary system instrumentation. Further
complicating matters was the fact that the TMI-2 plant and its control room wereoriginally designed for GPU to construct a second unit at Oyster Creek, New Jersey,
for Jersey Central Power and Light. Only after the preliminary design work wascompleted was the decision made to locate the plant at Three Mile Island.

In the absence of any NRC criteria, Burns and Roe was primarily sensitive toconstruction costs and to what its new customer, Met Ed, wanted. What Met Ed
wanted was a control room like TMI-1. But the expense of completely altering thedesign was considerable, and the cost factor prevailed.
In the end, only minimal human factors considerations came into play. Experienced
control room operators, for example, were never consulted about the positioning of
consoles or about instrument grouping. Indeed the engineer from Burns and Roe wholaid out the original placement of panels for the control room, was not even aware of
how many people would be required to operate the plant. Imagine riding in an airplane
whose cockpit was designed by someone who did not know how many people weregoing to be flying it! The result was a control room, manned on back shifts by two or
three individuals at the most, which was far more complicated than the control rooms of125

Navy reactors that are constantly manned by three operators and an engineersupervisor.
INSTRUMENTATION DISPLAY

We found that the information readily available to operators of Unit 2 about plantstatus and important plant parameters was far below what one would suppose to be an
acceptable minimum for such a sophisticated technology demanding quick action in
the case of potential accidents. Any list of instrumentation problems that occurred
during the accident would have to include at least the following:• No visual alarm signaled that the emergency feedwater system was completely
blocked off. This was not discovered for some 8 minutes into the accident,
apparently because poor panel layout makes systems misalignment difficult to spot,
and because a paper tag hanging from a handle on the control panel obscured ani ndicator light that would have shown the operators the position of one of the block
valves shutting out this system. In newer plants, NRC requires an alarm that would
have signaled this problem.
• The indicator light on the control panel for the stuck-open pressurizer relief valve
was wired to show only what the valve had been "instructed" by the electricalsystem to do, not the valve's actual position. Operators were misled for over 2 hours
by this indicator light.
• The plant did not have instrumentation showing the level of reactor coolant in themain reactor vessel. The only level indicator showed water level in the pressurizer.
This indicator showed the pressurizer to be full of water. In fact, early in the accident
coolant was passing through the pressurizer and out the stuck-open valve. Later,water was being forced up into the pressurizer by steam voids and gas in the reactor
coolant system. Operators were therefore misled into thinking the primary coolant
system was full of water when it was not.
• During the accident, incore thermocouples showing temperatures just above thereactor core had to be read with a hand-held electrical meter snapped onto wires ina cabinet located on the floor below the control room, because the thermocouples
were reading off the top end of the computer's display scale. Because of this, only a
few readings were reported to the station manager, and he discounted them, in part
because they were not regularly "required" instrumentation. Today, a large panelboard set up in the TMI-2 control room displays constant digital readouts for each of
the fifty or so thermocouples, giving operators an easy-to-read, instant temperature
profile of the reactor core.
• Operators should have detected the stuck-open PORV from high temperature
readings in the piping through which coolant was leaking after it passed through thevalve. These readings were requested several times by operators but were
misinterpreted, in part because, without the benefit of a strip chart showing thereadings over time, they were thought to be "trending down."• Soon after the accident began, the read-out and display computer got so far behindi n printing out alarms that operators had to "dump" its memory in order to get up to
date. Information about events and trends that might have helped them diagnose theaccident was consequently lost.

126

"I attribute it to human error. But then I attribute
everything to human error."
Drawing by Lorenz-- © The New Yorker, Inc. 1979

What this list demonstrates is not so much that the instrumentation did not exist in
the reactor (though the lack of a water level indicator was a critical omission), as that
instrument readings were not capable of being obtained and displayed in a usefulfashion. The principal need we have identified is for new standards for instrumentation
computers, printout devices, and CRT and other digital displays.
That a considerable amount of accurate data are now available about what
happened during the Three Mile Island accident is due to pure luck. Still connected to
the reactor was a "reactimeter" installed by B&W to monitor plant performance during
its startup testing. The reactimeter constantly measures and keeps in its memory
several dozen important plant parameters, some of which are not displayed in thecontrol room or are not recorded elsewhere over time. The reactimeter does not"display" its information; it has to be "delogged," a task which was begun on March 29
by B&W engineers and others. Data from the reactimeter helped engineers toreconstruct the accident that Thursday and Friday, and afterwards.
We see no reason why every nuclear plant should not be required to install theequivalent of a reactimeter that constantly monitors important plant parameters and istied to an information and display computer that can call up these parameters on an
i nstantaneous or trend basis in the control room. We have suggested above that suchi nstrumentation not only be installed in every plant, but also that the information betelemetered to industry-run data centers and the NRC, where additional technicalassistance would be available in case of an accident. We also see the strong need fordevelopment and implementation of disturbance analysis systems to provide operatorswith a clearer picture of reactor conditions.

127

A significant problem during the Three Mile Island accident was that much of the
instrumentation was designed for normal, not accident, conditions. When things began
to go wrong, instruments quickly went off scale. This was particularly true for many
radiation-monitoring instruments. The ACRS has been conducting a running, but
unsuccessful, battle with the NRC staff for some time to require every plant to install
instrumentation sufficient to monitor the course of an accident. Only after the accident
occurred-more than 3 years from the time a new regulatory guide providing for such
instrumentation was first proposed by the staff in December 1975-has the NRC
decided to expedite implementation of such a requirement.

We think that in addition to specifying what parameters must be monitored with theonline reactimeter, the NRC should move promptly to establish other requirements forparameters that must be displayed in the control room and their required ranges.
Moreover, using human factors engineering, the NRC should move forward to develop
criteria for control room design such as functional grouping of instruments andcontrols, panel layout, and alarm systems that will define the overall outline of astandardized control room design. Experience has shown that the industry will likely beslow to move on this front unless the regulatory agency itself lays out minimum
requirements and a deadline for implementation of these requirements.

128

6MORE REMOTE SITING AND
I MPROVED EMERGENCY PLANNING,I NCLUDING WORKABLE EVACUATIONPLANNING AS A CONDITION OF
REACTOR OPERATIONThe Three Mile Island accident demonstrated that the evacuation of people living
within a 10-mile radius of a commercial nuclear powerplant, or beyond, needs to beconsidered a realistic precautionary measure, even when observed levels of radioactive release are well below previously formulated Federal "protective action guideli nes."
The accident also demonstrated that evacuation may have to be considered orordered in a variety of situations where the evacuation decision is far from clearcut. In
the future, one of the more likely bases for evacuation may be fear or uncertainty about
the course an accident will take. This was illustrated by the evacuation recommendation made by the NRC staff and commissioners on Sunday, April 1, one based largelyon their anxiety about the hydrogen bubble problem.

The NRC's own lack of preparedness to exercise this kind of decisionmaking was
illustrated by the events of Friday morning, March 30. During a 3-hour period,
Pennsylvania officials received three completely different "authoritative recommendations" from the NRC: the first, from the NRC's Executive Management Team to thePennsylvania Emergency Management (civil defense) Agency, was to evacuate; thesecond, from the NRC's chairman to the Governor, was to direct people to stayi ndoors; and the third, again from the chairman of the NRC to the Governor less than anhour later, agreed that pregnant women and preschool children should be advised toconsider leaving the area within 5 miles of the plant.
SITINGFor some years the NRC has been moving informally toward requiring new reactors
to be sited further away from large population clusters. However, the formal siting
requirements used by the agency do not adequately reflect this concern: they providethat reactors be sited within a "low population zone," a very small area dependent
upon the design features of a plant, with a radius of only a few miles or less around theplant. The low population zone at Three Mile Island was an area within 2 miles of thereactor itself. During the accident, as we have seen, both State authorities and the
NRC talked of the need for evacuations encompassing areas 5, 10, and possibly even20 miles from the Island.
I n the past, the NRC has consistently regarded "engineered safeguards," i.e.,
automatic emergency safety systems within the plant, as a permissible tradeoff
permitting the location of a plant near a heavily populated area. That is, the plant's
129

safety equipment, combined with the containment structure and the ability to evacuate
the low population zone, was deemed sufficient to protect public health and safety. Our
analysis of how close the accident at Three Mile Island came to a situation in which
evacuation might have been required on a precautionary basis, at least, leads us toconclude that this philosophy simply is not valid. Evacuation must be considered as anindependent means of protection for citizens living near a nuclear plant, over andabove the engineered safety systems designed to mitigate an accident and to prevent
releases. In the case of siting, "distance" should be regarded as the ultimate defensei n-depth barrier protecting those who live near nuclear plants.

With respect to the question of "how much distance," we have found generalagreement that the present "low population zone" planning area and past siting
policies have been inadequate, but considerable disagreement about the appropriate
standard that should be adopted in new emergency planning and siting policy.

At Three Mile Island, State and county planning provided for evacuation only to a
distance of 5 miles from the plant. The latest NRC/EPA study concludes that anevacuation planning zone of about 10 miles is a reasonable starting point for thedevelopment of plans adequate to protect the nearby populace from the effects of aserious accident. Based upon this study, the NRC has just issued for public comment
proposed new rules that would require NRC approval of State or local plans providing
for evacuation within a 10-mile radius and monitoring of food within a 50-mile radius.

However, it has been suggested by public interest groups and others interested innuclear safety that evacuation planning should be required at a further distance from
nuclear plants. While analyses done for our inquiry show that there was a low
probability of the TMI-2 containment rupturing even in a core meltdown, hypotheticalstudies of a "worst case" accident at TMI done by others that do assume a total
breach of containment contend that evacuation would have been necessary wellbeyond 10 miles. Other estimates of the effect of an accident involving a breach ofcontainment and release of a substantial amount of a reactor's fission products, suchas those made by the NRC's own "Rasmussen Report," albeit also based upon nearlyworst case assumptions, have predicted significant health effects at distances inexcess of 10 miles.
During the accident, 10 miles was the maximum radius contemplated for actual
evacuation, but the realization that substantial numbers of people living further from theplant would also leave if a 10-mile evacuation were ordered led the Commonwealth tocontinue to plan for the consequences of a 20-mile evacuation. A study done for theSpecial Inquiry Group estimated that about 76,000 people evacuated the area within 10
miles of Three Mile Island during the accident-partly as a result of a precautionary
warning to pregnant women and preschool children within 5 miles of the plant to leave,and partly due to confusing reports and fear of the hydrogen bubble. Nearly an equal
number of people, about 67,000, living between 10 and 15 miles of the plant also
evacuated, some 32% of those living in this area.

All of this leads us to conclude that, out of an abundance of caution, future reactors
should be located only at sites that are at least 10 miles and perhaps more from any
significant center of population. In developing criteria for future siting, we believe the
NRC will have to give consideration to the specific characteristics of the area thati nfluence the effectiveness of evacuation: population density; population centers
130beyond the minimum distance of 10 or more miles from the plant (within which should
reside only a relatively small population capable of being quickly evacuated);
evacuation routes; and the possibility that land use controls or other measures can beused to maximize the chances that over the lifetime of the reactor large numbers ofpeople are not likely to move into the area near the plant.
Specific criteria should be developed promptly by the NRC in conjunction with other
Federal and State agencies with experience in emergency evacuations. In this regard,
it should be noted that both the Federal Government and the States have substantial
land holdings that could provide locations for future remote siting.
EVACUATION PLANNING

Until March 28, 1979, planning for evacuation around nuclear plants by Federal,
State, and local authorities was uneven, at best. The NRC itself did little to encouragesuch planning, in large part because of a prevailing attitude that a serious accident withreleases beyond containment simply would not happen. The NRC has required utility
company licensees to plan only for protective measures within the low population zone,
and to show that they have their own emergency plans which include notification to andcoordination with local and State authorities. The existence of an effective Stateemergency or evacuation plan in case of accident has not been a condition for grantinga reactor operating license. Under current regulations, States may submit plans to the
NRC for approval, but at the time of the accident only a few States had NRC-approvedplans in place, and Pennsylvania was not one of them.

The President's Commission recommended that Federal emergency planning
functions for accidents at nuclear reactors should be consolidated into a single Federal
agency. We agree. The new Federal Emergency Management Agency (FEMA), rather
than the NRC or the Department of Energy, appears to us to be the appropriate agency
for such planning. FEMA's principal mission is to help States plan for the logistics andcommunications involved in protective action, including evacuation, made necessary
by any one of a variety of natural disasters or accidents. FEMA is in a better position tocoordinate planning and action by State and local authorities, with whom it deals
regularly, than the NRC.

However, FEMA and the NRC must coordinate closely in this venture, and FEMA
should make maximum use of the work that the NRC has already done and is presently
doing. Because FEMA is still in the process of being organized, and lacks the expertisei n the particular aspects of protective action that may be appropriate in a radiologicalemergency, NRC has an important role to play in defining the criteria for effectiveplanning around each site.
The principal planning responsibility for protective action including evacuation lies
with the State, with FEMA's assistance. However, the ability to carry out an evacuation
plan in the area of a nuclear plant depends much more on the existence of adequate
county and local emergency plans than on a FEMA-approved or NRC-approved Stateplan. We believe that too little attention has been devoted to this aspect of emergency
planning. Although the State plan must provide for effective notification and communications between the decisionmakers (the Governor and State agencies) and thel ocalities, for back-up support, and often for planning out beyond a 10-mile zone, the
13 1

county and local levels are where the action is and where the specific details of theplan must be worked out. As Oran Henderson, the Director of Pennsylvania's
Emergency Management Agency, told us:
I could prepare you the most beautiful State plan that I assure you NRC would approve, but ifthat plan isn't disseminated and the subordinate county and local municipal plans preparedthat dovetail [with the State plan] and take the guidance in the State plan, you still don't haveanything. It's the local government and the county government that are going to have thecapability to execute any evacuation, if evacuation were necessary.

The local municipalities around Three Mile Island had no emergency plans for an
accident at the plant and, as it turned out, elected officials in those communities got
little or no accurate information about the accident to assist them in making decisions.
If this is common elsewhere, the main reason may be lack of money. Most localities in
Pennsylvania provided no funds for emergency planning. Many counties near nuclear
plants are rural in nature, with a small tax base. The probability of an accident
occurring at a nuclear plant is probably considered to be so low that emergency
planning does not command top funding priority. Furthermore, local response to such
emergencies requires more detailed advanced planning than for other types ofdisasters.
We believe that consideration must be given by the NRC and FEMA to the method bywhich funds can be made available to local communities near nuclear plants. One
suggestion has been that specific Federal grants be provided for such activity. Anotheris that the NRC should require utilities to pay for local planning efforts. The arguments
i n favor of the utilities footing the bill are that such a requirement would encourage theutility to coordinate its own site-area planning and notification activities with local
plans; that such detailed planning would probably not be required for other types of
emergencies; and that those who benefit from the plant should help defray the costs
associated with it, which include emergency planning costs.
Because we believe that protective action-ranging from staying indoors to partial
evacuation to general evacuation-must be considered an independent form ofsafeguard, we believe that workable evacuation plans are a prerequisite to continued
operation of existing and future reactors. The President's Commission recommended
that operating licenses be conditioned upon the State or locality within which the planti s located having in effect an emergency plan approved by the Federal Government.
The NRC has recently proposed new regulations that would impose such a requirement
beginning no earlier than July 1, 1981, (with approval to be granted not by FEMA but by
the NRC). However, the NRC could grant an exception to the requirement for a numberof broadly phrased reasons including a determination that deficiencies in the plan were"not significant" for a particular plant or "other compelling reasons."

I n general, we believe this is the right approach, though we think FEMA should
approve the plans rather than the NRC, and that plant operation should not be madeabsolutely contingent on approved local plans, since this would in effect give local
municipal governments the power to close a plant. But the success of this approach
depends largely upon what is regarded as an "adequate" plan. We think the
emergency plan should not be just an abstract document. It should make realistic
provisions for such seasonal or other variations as snowstorms, large summer
populations, and so on.
132I n our view, the emergency plan, as a condition of the operating license, should beviewed in the same fashion as an engineered safety system in the plant. The typicalplant's technical specifications provide that when engineered safety systems become"degraded" or inoperable, the plant may have to be shut down if the situation cannot
be remedied within a short period of time. Whether an evacuation plan can realisticallybe executed at a particular time should be treated in the same fashion. Thus, if a 5-footblizzard makes roads in the area of the plant impassable, the utility should be required
to notify the NRC immediately. The NRC will then, after consultation with FEMA andState authorities, make the decision whether the plant should be shut down (or someother measure instituted, such as a decrease in power level) until the evacuation plan
once again becomes workable.
I n the case of existing plants, we have not studied in detail and we do not undertake
to quantify in this report the minimum distance from any plant within which workableevacuation must be a condition of continued operation. However, we believe the NRC's
proposed 10-mile planning zone is, by itself, inadequate as an arbitrary cutoff point.
Wider evacuation may clearly be necessary in some unlikely accident situations. And,
as Three Mile Island demonstrated, an ordered evacuation out to 10 miles would
undoubtedly have effects to 20 miles and more. Therefore, at the very least, significant
centers of population beyond 10 miles from the plant must be considered in theplanning as well.
The selection of a 10-mile emergency planning zone by the NRC/EPA study as aballpark figure, and the adoption of this number by the NRC in its proposed new
regulations, appear to us to have been relatively arbitrary. This should be regarded only
as a starting point. The NRC/EPA study developed estimates of probable maximum
radiation doses from various projected accidents at different distances from a plant.
This work should be carried forward by the Commission into specific criteria thatincorporate maximum dose levels, probability factors and associated time limits.
Once the Commission has established criteria that define the level of risk, each site
can then be examined to develop a minimum evacuation planning zone, within which
evacuation must be capable of being carried out in a safe fashion within the prescribedti me period to protect those threatened by a serious accident in a nearby plant. This
zone will have to be determined by taking into account the same factors discussed
above in connection with siting, including population density, evacuation routes,
prevailing wind patterns, and so on.
Where an existing reactor, for example, one located near a large urban area, cannot
meet these criteria, logic and prudence dictate that it should be shut down, unlessadditional safety systems for mitigation of accidents-such as the vented, filteredcontainment system we discuss later in this report-can be installed either to reduce
the area of likely accident consequences or to increase the permissible time for
evacuation.
We recommend that once criteria for minimum workable evacuation areas are
established by the NRC, plants that cannot meet these criteria should be allowed tocontinue to operate only upon a determination by the President that the temporary
continued operation of the plant is certified to be vital to the national interest.
133

CHANGES IN NRC'S OWN EMERGENCY RESPONSE
FUNCTION

Within the NRC, we found that decisionmaking about protective action was confusedand ineffective throughout the accident, and that NRC disorganization contributed
unnecessarily to public alarm over radiation levels and the possibility that the hydrogen
bubble in the reactor might become explosive. Some of this confusion was due to poor
communications, a situation which the Commission has improved somewhat since
Three Mile Island by the installation of "hot lines" from each reactor control room to
the NRC's Incident Response Center in Bethesda, Maryland. A system for telemetering
i mportant plant data from each plant to remote, industry-run data centers and to the
NRC, such as we have suggested above, would also go a long way toward resolving
this deficiency.

But a good measure of the NRC's poor performance during the accident must be laid
to poor planning and poor management of the emergency response. As we havepreviously written in a preliminary memorandum to the commissioners, we found that
the NRC's Executive Management Team (EMT) did not function as a single executive
to coordinate the agency's action during the accident but as a collection of individuals,
each of whom represented the office of the NRC staff with which he was affiliated in
day-to-day NRC operations.

While the NRC's Emergency Plan specified that the commissioners themselves
would "make policy," they were in fact isolated from the flow of events and informationfor 2 days. When they did get involved, on Friday, March 30, the recommendations
made by Chairman Hendrie to Governor Thornburgh reflected little deliberation by thecommissioners and were based on a paucity of information. Only when Harold Denton
was sent by Chairman Hendrie to Three Mile Island as the NRC's lead official, and at
the request of the President became the President's own "representative" at the site,
was NRC's emergency response coordinated into one single executive-by thephysical process of moving a knowledgeable top staff official to the site.
We recommend that while the Executive Management Team (EMT) should be
retained, it should have a single director. The director of the EMT should exercise theauthority of the entire agency during an emergency. A nuclear reactor accident is notime for collegial decisionmaking either by the EMT or by the Commission itself. Any
decision by NRC headquarters to recommend evacuation should be made by the
director of the EMT with appropriate advice from those on site and thereafter (in order
to avoid confusion) should be communicated to State authorities by the highest officialof the NRC available if possible. To ensure better Government-wide coordination,
FEMA and other Federal agencies involved should have senior representatives present
at the NRC's Incident Response Center.
I n our view, the role of the EMT should be to mobilize the resources of the agency, toget a technically qualified group headed by a senior NRC official to the reactor site assoon as possible, to coordinate the agency's response until that team arrives, andthereafter to turn over the lead role to the site team and to serve as a backup andcommunications link to the team. TMI demonstrated that an effective NRC response to
the accident based upon up-to-date, reliable information was not begun until such asenior official, Harold Denton, reached the site and was clearly perceived to be "incharge" of NRC's own activities in the emergency. This did not happen until more than
1 34

2 days after the accident started. We recommend that NRC emergency response plans
be revised to shift the management of the NRC's overall response to the site as quickly
as possible.
Such an approach will require changes in the agency's emergency response
procedures and logistics. Since the onsite NRC official must have enough "clout" toassume control of the agency's overall response, he would have to be an official at theregional office director level (or be designated as "duty officer" by the regional officedirector, to substitute for him) at the least. Plans should also be made to send a highl evel headquarters official to the site as fast as possible. In either case, the senior NRC
official should be supported not just by NRC inspectors from the Regional Office but by
a technical team of experts who should also be rushed to the site. All of this will require
preplanning and coordination with other Government agencies, including the military
services, for transportation; the drawing up of duty lists for Regional Offices andheadquarters; and training and drills for those designated as emergency response
personnel. We believe such planning is well within the NRC's capabilities and should beundertaken immediately.

During early stages of the accident even top NRC officials displayed a good deal of
reluctance to demand specific items of information from Met Ed or to make strong
recommendations to the company about what operators should do next. The
philosophy that "the licensee is in charge," and a fear that NRC would be perceived tohave "taken over" control of the plant, provided very strong deterrents to active
i ntervention by the agency at any level. From the NRC inspectors who arrived on site
about 10 a.m. on the first day of the accident through top officials in Washington, theagency placed itself in a position of merely "monitoring" what was happening, andbeing available to give advice.
The NRC must not be constrained by its own attitudes to take such a passive role
during an accident if circumstances demand more direct intervention. It appears that
the NRC has the authority, under the existing licensing scheme, to require a utility
li censee to undertake a particular action on the spot, if necessary to protect publichealth and safety. If there is any doubt on this score, legislation should be enacted toclarify the agency's responsibility.
The NRC is far from equipped to "take over" any large commercial nuclear plant inan emergency. Hands-on manipulation of the controls in such plants requires familiarity
with a particular reactor's unique design and idiosyncracies. Such familiarity is likely to
be possessed only by licensed operators and supervisors of the utility. Plants like thesecannot be "run" by outsiders in an emergency. And although the public may bereassured by knowing that NRC representatives are on site during an emergency, thefact is that NRC inspectors do not have the working knowledge of the plant or, in mostcases, the expertise to assume command over reactor operations.
This is one of the reasons we recommend that a senior NRC official knowledgeable
about reactor operations and reactor engineering, and a technical team capable ofbacking him up, be sent to the site as soon as possible. Even he and his team, however,will not be qualified to assume command of the plant.
Nonetheless, there may arise situations in which important strategies for dealing withan accident, such as decisions about the method of core cooling or about venting
13 5

radioactive gas to the atmosphere in order to protect the stability of the coolingsystem, must be made by the NRC senior official on site-or, before he arrives, by NRC
engineers or other top officials of the agency from a remote location. In these kinds ofsituations, the NRC's own regulations should make it clear that the NRC has theauthority to demand information and, in the extreme case, to impose its own decision
on a licensee if there is an ultimate difference of opinion.

We suggest that emergency response procedures might be rewritten to provide thatthe director of the EMT or the onsite senior NRC official directing the NRC's
emergency response may direct that (1) particular information be provided immediately
to the NRC, or (2) a particular action be taken in the plant, where necessary in his
judgment to protect public health and safety.
LEAD MONITORING RESPONSIBILITY AND ONLINEMONITORING SYSTEMS

Recognizing the likelihood of evacuation or other protective measures in the future,
we are convinced that it is essential to make certain that accurate and up-to-date
i nformation is available on which to make such decisions. The Three Mile Island
accident indicated, and our investigation confirmed, that no one-no Federal agency,
State agency, or the utility-has primary responsibility in an accident to monitor
radioactive releases away from the plant, evaluate this information, and communicate itto those who must make decisions about protective measures.
At Three Mile Island, the utility, the NRC, the Department of Energy (DOE), and State
officials all participated in monitoring beginning within hours of the accident; HEW andEPA followed later on. As it happened, the work of teams from these various agencies
was fairly, well coordinated during the accident, and those at the plant and local level
who needed the information received it in timely fashion. Our investigation showed thatutility and NRC personnel at the site, the State's Bureau of Radiological Health (which
set up a command center that was in contact with the plant and with monitoring teams),
the NRC's regional office near Philadelphia, and DOE's local command post
maintained good communications and generally shared accurate data and evaluationsof that data, as soon as they were generated. However, the lack of any designated lead
responsibility for radiological monitoring and assessment gives us no confidence thatsuch coordination near the site could be achieved in a more serious, fast-moving
accident.

There is a Federal coordinating document for radiological emergency monitoring
called the "Interagency Radiological Assistance Plan" (IRAP). But this title is amisnomer, for the document is not a "plan" at all; it is a list of resources possessed byvarious agencies that can be called upon in an emergency. DOE, which inherited fromthe AEC among other things a sophisticated nuclear emergency command center inGermantown, Maryland, intended primarily for weapons tests and accidents, has more
emergency monitoring equipment and other resources than any other agency. These
include teams that can be transported by plane or van, monitoring helicopters withhighly sensitive equipment, and backup facilities for analyzing samples. NRC also has
several mobile monitoring and laboratory vans, as well as equipment and emergency
vehicles at each regional office.
136

We recommend that DOE be formally designated by executive order as the lead andcoordinating Federal agency to call upon and organize the emergency resources of allother Federal agencies in case of an accident at a commercial nuclear plant requiring
monitoring. EPA should be assigned long-term monitoring responsibilities after an
accident, and HEW should be given the lead responsibility for population dose
assessments and calculations of health impacts.

We also recommend that serious consideration be given to installation of real-time,
online monitoring devices around every nuclear plant in concentric circles at various
distances from the plant site (for example, from the site boundary out to perhaps a few
miles) that can be read from the plant control room or some other remote site. Such asystem would be expensive but not prohibitively so, and the technology poses noproblem. We understand that such devices are currently being installed by requirementof the State of Illinois in the Chicago area to cover potential releases during any
accident that might occur at any of the plants located in the vicinity.

137

70VERHAUL OF THE LICENSINGPROCESS: ONE-STAGE LICENSING,I NCREASED STANDARDIZATION,
I NCREASED USE OF RULEMAKING,ESTABLISHMENT OF AN OFFICE OF
PUBLIC COUNSEL, AND INTERVENORFUNDING

From its inception, the process of licensing a new commercial nuclear plant has
nvolveda two-step procedure. Prior to construction, the utility company submits aniapplication for a construction permit (CP) in which it commits to meet certain design
criteria acceptable to the NRC staff and describes preliminary designs it proposes tofollow in order to do so. NRC's licensing staff then reviews the application andprepares a Safety Evaluation Report, preparatory to a mandatory public hearing before
an independent Atomic Safety and Licensing Board.

The Board considers not only the safety of the design but also such issues as thesiting of the proposed reactor. Any person who wishes may petition to intervene in theproceedings (usually well before the hearing is held) to question or contest some
aspect of the application. The Commission's Advisory Committee on Reactor Safeguards (ACRS), a group of distinguished expert consultants in various areas related toreactor safety and environmental issues, also reviews the application and the staff's
report, and often calls for additional evaluation or explanation.

I f the Licensing Board votes to grant the CP, a party may appeal its decision to the
Atomic Safety and Licensing Appeal Board, another independent panel to which the
Nuclear Regulatory Commission itself has delegated most of its final statutory authority
over licensing. From an Appeal Board decision, any party may seek review by the fullCommission, which is discretionary with the Commission. The Commission may also
review a case on its own initiative. But as a practical matter the NRC, like the AEC
before it, has seldom become involved in licensing actions.

At a time when the utility believes the plant will be finished in about 3 years, it submits
a second application for an operating license (OL). The same procedures are thenfollowed again-including a staff review, preparation of a safety evaluation report,
ACRS review, and a hearing if requested by any party-but a second public hearing is
not mandatory if no party or intervenor requests one. If a hearing is held, there is once
again a right of appeal to the Appeal Board and a discretionary appeal available to theCommission itself. If there is no second hearing, the director of NRR may issue the OL
when he and his staff are satisfied that the case warrants it.

The two-step process reflects the state of the nuclear power industry in its
conceptual and developmental years, when there were many first-time applicants,
designers, and builders, and many unproven designs. But the situation has changed138

drastically in the intervening years. Final designs for most plant systems can be
described in much greater detail at the preconstruction stage, and there is a muchhigher degree of assurance that they will be consummated satisfactorily, where only
preliminary designs are now submitted.
I nsofar as the licensing process is supposed to provide a publicly accessible forum
for the resolution of all safety issues relevant to the construction and operation of a
nuclear plant, it is a sham. We reach this conclusion for a number of reasons.

First, the vast majority of safety issues are resolved during negotiations between the
NRC staff and representatives of the utility and vendor which take place while the staff
i s performing its design review. Although the meetings that take place and thecorrespondence back and forth is a matter of public record, in fact the public andi ntervenor groups seldom play any meaningful role at this stage of the process.

By the time of the public hearing, the NRC's licensing staff has typically won theacquiescence of the utility applicant for most or all of the changes the staff deems
necessary and has therefore satisfied itself of the adequacy of the design. At this point,
the NRC staff appears as an advocate of the final design; in other words, the staff andthe applicant are on the same side at the hearing because their differences havealready been resolved.
Intervenor groups, which have become more vocal and better funded in recent
years, can seldom bring to the hearings either the technical expertise or the resources
to make an effective challenge on technical safety issues to the combined front
presented by the NRC staff and the applicant's and vendor's experts. Thus, intervenors
have tended to focus primarily on environmental, seismic, siting, and emergency
planning issues that can be more readily understood and debated by those who are notreactor safety engineers.

Even if intervenors were able to contest safety issues effectively, they would find it
difficult to reach an array of licensing actions important to safety that are taken by the
NRC staff outside of or peripheral to the formal license authorization process. These
include the following: granting or denying amendments to CPs and OLs; determiningthat proposed changes in designs or procedures do not involve an "unreviewed safety
question" and therefore do not require any license amendment; making decisions
whether to increase safety requirements at a particular plant or apply new regulatory
requirements on a plant-specific basis; and resolving whether certain equipment is"safety-related."
The separation of licensing into two stages, a CP and an OL, also frustrates effective
challenge to design features of a plant from outside the NRC staff, and to some extent
from the staff as well. At the CP stage only rough design plans are furnished. By thetime the utility submits an application for an OL, the plant may be substantiallyconstructed, and systems are either in place or committed to. Thus, one lengthy safety
review is conducted too early to be useful, and the other is too late to be fully effective.
In between times, the sketchiness of the original design makes the task of the Office ofI nspection and Enforcement that much more difficult during the construction period.
Moreover, consideration of "generic safety issues," such as the adequacy of astandard design feature to mitigate certain not-yet-analyzed accidents, generally is noti ncluded in the licensing proceedings. Theoretically, these issues are dealt with139

administratively by the NRC staff and the ACRS, or by policy decisions implemented inrulemaking or elsewhere in the NRC. In practice, it appears that many of these issues
do not get meaningful attention anywhere.

The Appeal Board, which was originally intended to help coordinate consideration ofgeneric issues, has for a good many years spent a substantial amount of its time andeffort on procedural issues and in trying to interpret the Commission's substantive
regulations and apply them to the facts in particular cases. The Board (and others)
have pointed out that many of these regulations are vague, inartfully drafted, and eveni n some instances totally incomprehensible. Other regulations have significant gaps.
We believe that the Appeal Board should not, by default of the Commission, have tocontinue to interpret, "improve" and apply ambiguous standards.
The role of the ACRS, which once constituted the main repository of wisdom on
difficult reactor safety problems and was supposed to help deal with generic safetyissues, has been gradually reduced in the past decade. The regulatory staff, which has
grown tremendously in that time period, no longer needs to rely on the ACRS. Because
the ACRS is merely an advisory committee, its concerns and recommendations neednot be followed; it is only required that they be made a part of the record in a licensing
proceeding. For its part, the ACRS considers the NRC staff's analyses in licensing
proceedings to be formalistic and unhelpful.

Despite these problems, the ACRS comes closest to performing the function that the
public probably thinks the Commission itself performs: an independent, high-level
review of the safety implications of nuclear plant design by distinguished experts invarious fields of reactor safety. We believe the ACRS should be retained and its role
strengthened by relieving the requirement that it advise the Commission on every
li cense application, by encouraging it to play a more formal role as a party in licensing
and rulemaking proceedings, and by upgrading its staff. We also believe theCommittee's independence should be enhanced, perhaps by decreasing the tremendous time commitment required so that membership can be offered to some individuals
who cannot afford to devote half or more of their time to the ACRS.
We have suggested earlier in this report that if an independent Nuclear Safety Board
were established to oversee the effectiveness of the regulatory process, some of its(full-time) members could comprise part of the membership of the ACRS, and theBoard's staff could be used to support the ACRS in the Advisory Committee's ownfunctions.
Practically all those who are familiar with the licensing process, including mostLicensing Board members who responded to a questionnaire sent out by the Special
Inquiry Group, agree that the formal hearing process does little to enhance the qualityof reactor safety. Some of those who answered the questionnaire even stated, as doesa recent ACRS report, that these formal proceedings discourage applicants and the
NRC staff from dealing candidly with all sides of controversial safety issues in theiranalyses and evaluations. NRC staff safety analysis presentations, some say, havebecome legalistic tracts that repeatedly recite the same assurances in case after case.
Contrary to what the public probably perceives, the commissioners themselves play
no role in licensing decisions except on rare occasions. In fact, the old AEC createdthe multiple levels that exist today for licensing decisions-hearing board, appeal
board, ACRS-in large part to insulate itself from the licensing process. Not only was
1 40

the AEC reluctant to become involved for reasons of conflict of interest, it was also
simply less interested in reactor licensing than in other matters within its jurisdiction.
The 1974 reorganization creating the NRC, which stripped promotional activities fromthe new regulatory body, might have given the NRC the opportunity to become more
i nvolved in the final decision to grant a license-one of the most important functions
that it performs. But the statutory and regulatory framework was kept intact and, prior
to the Three Mile Island accident, the NRC took only modest steps to change priorpractices.

At the same time that the Commission holds itself out as the "Supreme Court oflicensing," but hardly ever grants certiorari to review a case; it isolates its members
from detailed consideration of case-related safety issues by the so-called "ex parterule." This rule provides in effect that after a case has been noticed for hearing, nocommissioner or member of a commissioner's personal staff may consult the NRC staff
about an issue in the case.

This rule was originally adopted by the AEC, which had by law been given bothpromotional responsibilities for nuclear energy and quasijudicial functions in ruling on
licenses. The NRC no longer suffers from this legal handicap. The ex parte rule as it isused by the NRC goes far beyond the statutory requirements that govern the way
independent regulatory bodies must conduct their business, including the Administrative Procedure Act. Its main effect today is to isolate needlessly the decisionmakers
who have final authority to rule on reactor safety questions from those within their own
agency who have the most knowledge and expertise about those questions, and who
presumably have been hired to help the decisionmakers carry out their statutory
responsibilities.

We think that, if the Commission is retained, the ex parte rule should be verysignificantly limited and applied more rationally. We see no reason why commissioners
should not become involved in safety issues pending in particular cases as long as theirinvolvement is on the record. If changes in the rule cannot be accomplished by agency
action, as we believe they can, this should be done by new legislation.

ONE-STAGE LICENSING
We have come to the conclusion that the two-step licensing process should be
abolished for nuclear plants of conventional design. Instead, a single licensing
proceeding should be held prior to construction in which design plans that are as
detailed as possible should be considered and approved. Once a license is granted,
jurisdiction to oversee construction and confirm that the plant is constructedconsistently with the design plans should be placed in the NRC staff.
In our view, it is completely unnecessary to subject license applications to threelevels of appellate review. If the Commission is replaced with a single administrator, as
we have strongly recommended, the Licensing Appeal Board's decision on granting alicense should be final and any appeal from the Appeal Board should be directly toFederal court. It would be the responsibility of the administrator to assure that acomprehensive and unambiguous set of regulations was in place for the Appeal Board
to apply.
14 1

If the Commission is retained, consideration should be given to abolishing the
Licensing Appeal Board and to requiring the Commission to consider and approve
finally every new reactor license. To carry out this task the Commission would probably
require talented experts to assist it. We suggest that Appeal Board members could betransferred to a support office to assist the Commission in this work, which would
permit the outstanding quality reflected in past Appeal Board decisions to beperpetuated in the decisions of the Commission.

It has been suggested that the Appeal Board plays an important function in thelicensing process, that the Commission itself would never be able to handle theworkload of the Appeal Board, and that the Appeal Board's best members would notwant to serve as technical advisors to the Commission. If this is indeed the case, if theCommission itself cannot perform the important quasijudicial function of making final
licensing decisions as well as the existing Licensing Appeal Board, this demonstrates
another reason why the Commission should be replaced with a single administrator.
INCREASED USE OF RULEMAKING

Generic safety issues and other important policy issues should be handled by thehead of the agency or the Commission directly, through rulemaking and policy
directives, with the direct input of the staff, the ACRS, and intervenors. In particular,
basic policy decisions having a primary impact on the level of safety provided to the
public against the risks associated with nuclear powerplants, which are now made atvarious agency management levels, should be implemented through the rulemaking
process.
These decisions are often made without the input or knowledge of important parties.
For example, the Standard Review Plan was developed and approved by the Office of
Nuclear Reactor Regulation. The decision that a nuclear plant that conformed to therequirements of the Plan is "safe enough" from a licensing viewpoint was made by that
office with little or no effective input from other offices within the NRC, from the ACRS,
from the Commission, or from the public. Similarly, many generic issues are currently
handled administratively by the NRC staff. Important decisions that lead to theestablishment of required safety levels for the nuclear industry in this country should be
promulgated as agency policy through a more open and definitive procedure.

The standard argument against the rulemaking process is the potential cost in timeand resources that may result from possible protracted public hearings on individual
rules. However, we believe that steps can be taken to guard against abuse of theprocess and to insure that the amount of public input is appropriate to the substantive
issues involved. For example, rulemaking can often be carried out by consideration of
written comments, rather than through holding public hearings; and strict ground rules
for hearings can be used to control unnecessary waste of time in a variety of ways. We
have concluded that, in any event, the rulemaking process is a necessary ingredient tofair and open regulation and that it must be followed even though the costs andimpacts are substantial.
OFFICE OF PUBLIC COUNSELAt present, there is very little public participation in the determination of individual
technical issues relating to reactor safety, whether in licensing cases or in broader
142policymaking by NRC staff. We propose two steps, in addition to the recommendation
above that more rulemaking be conducted to implement major decisions in safety
policy, to involve the public earlier and more effectively in safety issues.

First, we recommend that an Office of Public Counsel be established which shouldreport to the head of the agency. The primary function of the office should be to:• Provide a source of legal and technical counsel to potential or actual intervenors andto public interest groups, whether opposed to or supportive of nuclear power ingeneral or a specific application in particular.
• Intervene directly as a party in agency rulemaking or licensing proceedings, whenappropriate, to assure that all necessary safety issues are fully considered.
• Fund and monitor, where appropriate, independent technical peer review by
i ndependent outside experts.
• Handle details of the intervenor financing suggested below.
This office, removed from licensing, enforcement, and standards setting, should
consist of a number of people whose expertise would encompass the technicaldisciplines and legal talents essential to the regulatory process. The office itself would
be empowered to intervene in any proceeding where it perceived that neither the NRC
staff nor any intervenor was adequately raising important issues relating to safety.
Given adequate staffing and the clear support of the highest level of the agency, theOffice of Public Counsel would enhance the Commission's credibility with both theindustry and the public.
I NTERVENOR FUNDING

Second, the problem of providing for increased public involvement in the decisionmaking process cannot be separated from the question of providing public funding forsuch activity. If citizens or groups contribute materially to rulemaking or licensing
efforts by pressing significant concerns that are not being urged by other parties, theyshould be reimbursed for their expense. Other agencies have programs to fund citizen
participation and even, as under the Clean Air Act and Federal Water Act, citizen
lawsuits.
We recommend that a program of such citizen or interest group funding be adopted,
for both licensing and rulemaking proceedings, that would permit intervenors whomake substantive contributions that would otherwise not have been made to becompensated for the expenses involved. This program could be administered throughthe Office of Public Counsel, with the final decision as to reimbursement being madeeither by that office, the Licensing Board or, in rulemaking proceedings, by theCommission or Administrator.

We have no illusions about the fact that the "hidden agenda" of many intervenors
who ostensibly press numerous technical points is really to stop the plant from being
built by causing protracted delay in the licensing process. We recognize that citizen
and public interest groups generally have not been and will not be interested in very
many genuine technical reactor safety issues, particularly in individual licensing
proceedings.

Nonetheless, intervenors have made an important impact on safety in somei nstances-sometimes as a catalyst in the prehearing stage of proceedings, sometimes
143

by forcing more thorough review of an issue or improved review procedures on areluctant agency. More important, the promotion of effective citizen participation is anecessary goal of the regulatory system, appropriately demanded by the public. We
think the risk of providing grants of public money to those who actually seek only delay
can be very substantially reduced by strict requirements that (1) funding be conditioned
upon the intervenor propounding nonfrivolous issues that are not being effectively
advanced by others, (2) funding be appropriate to the effort necessary to raise thosei ssues, and (3) advance funding be provided only in part and only where necessary forthe intervenor to begin the process.
I NCREASED USE OF STANDARDIZATION

A one-step licensing process as recommended above should encourage the use ofstandard designs. The advantages and disadvantages of standardized nuclear plants
with respect to licensing, design, operational efficiency, and safety effectiveness havereceived wide attention in the past several years. Since the late 1960's the NRC has
evidenced a strong interest in standard designs. In April 1972, the AEC issued a policy
statement on standardization and since then both the AEC and the NRC have actively
supported a standardization program through additional policy statements andapprovals of staff actions.
Despite these pronouncements, however, and despite regulations that make various
standardization options available to license applicants, the agency has never reallymade its policy work because it has never made the use of those options mandatory.
We think this should be changed. Standardization was originally promoted by the AEC
to facilitate and cut down on the time for processing license applications. Our concern
i s different. We believe that standard designs for reactor systems, for the "balance ofplant" and for control rooms should in the long run substantially improve plant safety
and reliability. In our view, use of the NRC's standardization options should be requiredof all future applicants unless the Commission or Administrator grants an exception forgood cause.
The goal of the standardization policy should be a licensing system (already possible
under existing NRC regulations) in which the NRC would license one or two standard
designs by each vendor and architect-engineer, after an exhaustive review of these
designs, and then require a utility to purchase some combination of standard primaryand secondary system designs unless an exemption were granted. Any deviations
necessary because of unusual seismic or other features of the site would then bereviewed separately in the license review process.
From time to time new standard "models" would be submitted by vendors andarchitect-engineers, incorporating progressive improvements in design. During theperiod when a "standard model" plant was under construction, it would be treated by
the NRC as if it were already an operating plant for purposes of deciding whether new
design changes should be required. If a change were clearly needed to make operating
reactors safe, then the change would also be required to be made on those "standard
models" under construction. If a change were not serious enough to warrant
backfitting in operating plants, then it would not be made in "standard models" underconstruction either.
144

During the course of this investigation we have heard numerous arguments about thedifficulties and potential dangers of standardization, some of which are clearly valid.
But we do not think these arguments detract from the overall desirability of moving
ahead forcefully in this direction. Some argue that standard models might not be welltried designs. We are conscious of the controversy about the rapid growth of nuclear
plant size, but we feel that the standard designs reviewed by the NRC in the last few
years do represent an acceptable starting point. These designs are, for the most part,well-tried. New subsystems are usually refinements as well as enlargements of thedesign and operating experience we already possess.
We do not consider the antitrust argument a difficult one. We believe NRC can
restrict application to standard designs of a relatively small group of competitors if it iscareful to avoid tacit restriction of the suppliers of major components used in those
designs. The NRC may have to review its current practices for review and acceptanceof safety analyses in "component topical reports." Site problems and customer (utility)
choice also pose problems for standardization, but we think the benefits of such a
policy justify limiting this choice to a substantial extent.

One of the most powerful forces working against standardization in the past may
have been the differing attitudes of various segments of the industry toward theconcept. Vendors (reactor manufacturers) have generally favored the licensing of afew standard designs and have moved in that direction in their own engineering andmarketing. The enthusiasm of architect-engineer firms, which are commonly paid on atime-and-materials basis for designing each plant, has been more mixed, with somefavoring aggressive standardization and others more reluctant. It is the architectengineers who ultimately design and often construct the secondary side of the plant,
where the greatest variation in plant design and configuration occurs.
The United States is the only major nuclear country in the world in which eachnuclear plant is virtually custom-built. In most other countries standardization is more
the rule; some nations, like France and Great Britain, have one design or a few
standard national designs. If, as we believe, there are substantial benefits to be reaped
from standardization, the simple mandatory enforcement of already existing options in
the NRC's licensing repertoire can result in a useful first step in that direction.
THE RATCHET COMMITTEE

Pursuit of a mandatory standardization policy and the use of improved quantitativerisk assessment methodology (which we recommend later in this report) should help tofocus and rationalize the decisions the agency makes about "backfitting." In 1974 the
AEC, in an effort to stabilize the safety review process, established a Regulatory
Requirements Review Committee (RRRC). The Committee makes the recommendation
whether or not to impose a particular new regulatory requirement and, if so, whether itshould be backfitted to existing plants, required on plants under construction, or
required only in future plants. The decision to require changes in plants underconstruction is called "ratcheting"; the RRRC is popularly known as the "Ratchet
Committee."In the past, the Ratchet Committee's decisions have often been made on an ad hoc
basis, with little explanation or documentation of its reasoning, and the Commission
145

itself has hardly ever reviewed these decisions. We perceive that a number of changes
are needed. First, the Committee's function is of sufficient importance to warrant its
deliberations to be reported in some depth, if not actually transcribed completely. The
Committee's decisions and the bases for them would be fully documented. Second, thevoting members of the Committee should be lower than office or division level directors
and they should be provided with a preliminary review and screening task groupcomposed of one member from each of the organizations providing a voting member tothe Committee. Third, additional steps should be taken to increase the opportunity fori ndustry and public involvement, and for the early and formal involvement of theAdvisory Committee on Reactor Safeguards. Review by the Commission or the
Administrator of the bases for the Ratchet Committee's determinations on the record
would then be available where appropriate.
MORATORIUM; ADDITIONAL NRC REVIEW OF FOUR AREAS
BEFORE ISSUING NEW OPERATING LICENSES

Although, as we stated earlier in the introduction to these conclusions andrecommendations, we do not propose any moratorium on new operating licenses, wedo think that additional steps must be taken before any new operating license (OL) isissued, to respond to the more serious problems identified by this report and by othergroups including the NRC's own staff. While new plants may be as safe or even safer,from an engineered safeguards point of view, than old plants, the "shakedown cruise"of any complicated new ship inevitably involves a somewhat greater risk of unexpectedmalfunctions turning into major problems before the management team is in place andfunctioning smoothly.

To anticipate this problem, we believe the NRC should satisfy itself that every
applicant for an OL has evaluated:

1. The management and technical qualifications of its site crews and site management,
and their familiarity with the new plant.
2. Emergency operator procedures, which should be examined thoroughly to identify
whether they may be conflicting or could in some other fashion mislead theoperators.
3. The control room, which should be examined to identify outstanding human factors
deficiencies and any instrumentation problems.
4. The training program for the new operators.
Prior to issuing a new OL, the agency should independently assess the utility's
readiness in these areas by conducting field inspections to determine whether theapplicant's self-examination was adequate in each instance.

Finally, while not proposing a moratorium on operating reactors or on granting new
operating licenses for reactors now under construction and nearing completion, we dobelieve that the NRC's management would be wise to suspend processing of
applications for construction permits and limited work authorizations until it considers
the various recommendations that we have made for reform of the licensing process
and for increased standardization.

1 46

I MPROVEMENT IN THE BASIS
8 FOR
SAFETY REVIEW OF REACTORDESIGN AND INCREASED USE OF
QUANTITATIVE RISK ASSESSMENTTECHNIQUESThe NRC's statutory mandate in licensing nuclear plants, unchanged from that of the
AEC before it, is very general: to ensure that the plants will "provide adequate
protection to the health and safety of the public." Later interpretation of the word
"adequate" makes clear that it does not mean absolute protection, or zero risk, andconsiderable discretion has been given by the courts to the NRC to define this concept
itself. In the agency's regulations and practices, the standard usually appears as"reasonable assurance" of safety, or as "no undue risk" to the public.

In the developmental period of the industry, when many untried designs were being
submitted for licensing approval, the AEC developed a safety review process based on
the so-called "design basis accident" concept. A design was considered to be
acceptable if its emergency systems could be shown to mitigate a group of specificpostulated accidents which were classified into eight categories of severity. (A ninth
category of major disasters, called "Class Nine" accidents, was assumed to include
calamities so unlikely-and often so difficult to mitigate-that designs were notrequired to withstand their hypothetical occurrence.)

In reviewing a particular design, the staff does not examine all of the systems andcomponents in the plant, but only those deemed to be "safety related" (ie., thosethought to be essential to accident mitigation, or those whose failure could immediately
cause or aggravate a design basis accident).
In judging the reliability of these systems, the staff has employed a concept called
the "single failure criterion." This criterion is a requirement that a system designed tocarry out a specific safety function must be able to fulfill its mission in spite of the failureof any single component within the system, or failure in an associated system that
supports its operation. (In reality, the single failure criterion is a double failure criterion:
it requires that the design must be able to bring the plant to a safe shutdown despite
occurrence of an accident plus the failure of any one additional safety component or
system.) The purpose of the single failure criterion is to promote reliability by requiring
redundancy and diversity in systems that must mitigate accidents: either two separate
and independent systems of each kind, or a backup system capable of saving thereactor if the primary system fails.
The NRC inherited and has continued to apply this system of determining whether
designs are acceptable for licensing, despite the fact that we now have accumulated
concrete experience with these designs and a far better basis for estimating failure
rates and pinpointing weaknesses, and despite the fact that our techniques of risk
assessment with this technology have improved substantially in the past decade. The
147

licensing approach incorporating these concepts has produced reactor designs thathave compiled an excellent safety record. But the Three Mile Island accident suggeststhat this stylized process should now be amalgamated with, and ultimately supplanted
by, a more sophisticated and comprehensive approach to "hazard control" that takes
advantage of human factors techniques as well as the significant advances inquantitative risk analyses.

The design basis accidents against which a reactor design is judged are, for themost part, large-scale failures. Analysis in the review process assumes that, if a design
can handle a big accident, it will a fortiori be able to handle a spectrum of smaller ones.
The smaller accidents are regarded as being "within the design envelope," to use thejargon of the trade.

Yet the NRC has been on notice for some time of the results of the "Rasmussen
Report," a study of reactor safety commissioned by the agency in 1973 which applied
quantitative analysis in a comprehensive fashion to determine the overall hazards from
accidents in nuclear plants. The Rasmussen team used "event tree/fault tree" analysis
in which postulated failures were followed out with a host of different possibilities todetermine the likeliest outcomes.

Their study shows that the greatest risk of an accident comes not from the designbasis accidents, such as the large loss-of-coolant accident, but from small loss-ofcoolant accidents and relatively routine transients compounded by multiple failures orhuman error, having a higher probability of occurring than a large pipe break. Thesetypes of potential accident sources have, however, been all but ignored by the NRC in
the regulatory review process. The Three Mile Island accident involved, of course, all of
the four elements mentioned: a routine loss-of-feedwater transient, which should havebeen easily handled by plant safety systems; a stuck-open valve, causing a small lossof-coolant accident at a confusing time and in an unexpected place, the top of thepressurizer; misleading instrumentation; and operator error in cutting down theeffectiveness of the emergency core cooling system.
The Rasmussen study also showed that up to 90% of the risk of an accident at the
two nuclear plants it studied was associated with the prospect of human error.
Although the NRC has made some efforts to factor this possibility into the design
review process, it has not succeeded on an across-the-board basis. Certainly, there islittle consideration given in the process to what operators are likely to see on theiri nstruments during various transients and accident sequences, and how they are likely
to respond based on their training and procedures. This was shown by theWestinghouse analysis of the Beznau accident and the studies of the 1977 Davis Besse
accident.
The current classification of systems and equipment into "safety related" and"nonsafety related" is especially unsatisfactory. The distinction is linked to the designbasis accident/single failure approach. Systems or equipment outside the scope of thedesign basis accident analysis are considered to be not "important to safety" and are
not reviewed by NRC to see whether they will perform as intended or meet various
dependability criteria. They do not require redundancy. And they do not receive
continuing regulatory supervision or surveillance to see that they are properly
maintained or that their design is not changed in some way that might interact
negatively with other systems.
1 48

Historically, the utility rather than the NRC has designated, in its own design analysis,
which systems were "safety related." Where the NRC disagreed, the final determination was, in the past, often made on an ad hoc basis. The arbitrary nature of the
distinction as a boundary of NRC's attention can be seen in the Three Mile Island
accident, in which supposedly "nonsafety related" systems played critical roles.

For example, the accident was triggered by a failure in the condensate polisher unitsof the "secondary" or "feedwater" system-in essence, eight parallel resin demineralizers that constantly remove impurities from the feedwater, just as a water softener
removes harsh chemicals from drinking water. The inlet and outlet valves on all eight
units closed, thereby causing a total interruption of feedwater flow, which then resulted
in the automatic shutdown of the feedwater pumps, a turbine trip, the heating up of the(independent) primary or reactor coolant system when the turbine stopped removing
energy from it, and the opening of the pressurizer relief valve when rising temperaturesin the primary system created additional pressure in that system.
Virtually the entire feedwater system, including the condensate polishers, wasregarded as "nonsafety related" in the Three Mile Island Unit 2 plant. Had any scrutiny
been given to the polishers, design flaws and failure to make design changes might wellhave been identified as potential safety problems.

The inlet and outlet valves of the polisher units were originally designed to "fail as is"on any malfunction or loss of power. That is, these valves would "freeze" in whatever
position they had been in prior to the malfunction, whether open or closed. But during
or after the installation of the system, wiring was altered so that the valves all failed
closed in an accident. This same phenomenon occurred on at least one prior occasion
during "hot testing" (testing with heat generated by the pump motors, but without
nuclear fuel), and Met Ed plant employees had recommended that an automatic bypass
valve be installed to meet the problem; but this was not done.

The pressurizer relief valve that stuck open was also not categorized as "safety
related," even though its failure caused a leak in the all-important primary reactor
coolant system. In the design process nonsafety systems are assumed to perform inwhatever way is least helpful to mitigate the accident. Because the pressurizer relief
valve had a block valve behind it that could be closed, it was assumed that operators
would shut the block valve if necessary.

The fact that the design and instrumentation of the relief valve was not subjected to
NRC scrutiny meant that there was no NRC evaluation of a 1978 decision by Met Ed toinstall an indicator light showing only whether the relief valve had been electrically
instructed to close, not whether it had actually closed. Thus, the possibility that theoperators would be misled and would not close the block valve was never consideredin the design process-nor was the possibility that this error could in turn cause thepressurizer water level indicator to imply to operators that the reactor coolant system
was full when in fact it was steadily emptying. To complete the picture, control roomdesign and most instrumentation and operator procedures were also regarded as"nonsafety related" and were therefore never reviewed by the NRC.
Once the main reactor coolant pumps were shut off, natural circulation of thecoolant was blocked by steam bubbles, and the reactor core was damaged. The
operators then had no systems or procedures specifically intended for cooling thecore, because such capabilities went beyond the design basis.
149

After reactor core cooling was stabilized on the evening of March 28, the principal
threat to the public came from releases of radioactive gases from leaking or
overloaded systems in the "auxiliary building" next to the reactor containment building.
These systems were never designed to handle the quantities of radioactive materials
produced in a serious accident involving substantial damage to the reactor core
because such an accident was considered to be a Class Nine "event"-in effect, it
was supposed to be too unlikely for any serious design effort. Filters, waste gas decay
tanks, pump seals, and other components in this area, like some equipment in thereactor system itself, in fact did much more than expected in the design analysis, yetreleases still occurred.

What these examples demonstrate is that we have come far beyond the point at
which the existing, stylized design basis accident review approach is sufficient. The
process is not good enough to pinpoint many important design weaknesses or toaddress all the relevant design issues. Some important accidents are outside or are notadequately assessed within the "design envelope"; key systems are not "safety
related"; and integration of human factors into the design review is grossly inadequate.
More rigorous and quantitative methods of risk analysis have been developed andshould be employed to assess the safety of design and operation. But the Commission
and the staff have been slow to adopt these methods, even though they have beenused in other disciplines and technologies for some years.

The Rasmussen Report, although viewed by many critics primarily as an attempt by
the Commission to "reassure" the public about the negligible risk of nuclear accidents,
represented from a scientific point of view a prodigious effort to apply quantitative risk
assessment to reactor safety. An NRC-sponsored group, the "Lewis Committee,"formed in 1977 to review the accuracy of the Rasmussen Report's conclusions, agreed
that the methodology used was fundamentally sound and should be utilized by the
NRC, even though the Lewis group heavily criticized the Executive Summary to the
Rasmussen Report (the only portion read by the vast majority of the public) andconcluded that the Report's ultimate quantitative position about the low risk ofaccidents had too many uncertainties to be accepted.
The NRC commissioners, seeming not to understand these conclusions, thenadopted a policy statement and press release that was read as if the commissioners
intended to discredit the entire Rasmussen effort.
The best way to improve the existing design review process is by relying in a major
way upon quantitative risk analyses, and by emphasizing those accident sequencesthat contribute significantly to risk. The design review can then focus on those plantsystems that contribute to risk, identify weak points, and upgrade various requirements(maintenance, for example) to eliminate them.

The present system has been criticized for relying too heavily on "engineering
judgment," which is the term often used to hide an inadequate analytical capability. In
our view, there is no way to eliminate such judgments, in part because risk assessment
techniques are not now well enough developed, and also because there will always be
judgments that go beyond whatever results are produced by those techniques. What
the use of these methods will do is to put the judgments into the safety review process
at a better point, judging which accident sequences are important, and why.
150

We do not suggest here that the existing safety review process be immediately
supplanted by a more probabilistic review. What we are suggesting is that it beaugmented, and that quantitative methods be used as the best available guide to which
accidents are the important ones, and which approaches are best for reducing theirprobability or their consequences.
We believe that the advantages of such an approach far outweigh the difficulties. We
strongly urge that NRC begin the long and perhaps painful process of converting as
much as is feasible of the present review process to a more accident-sequenceoriented approach. This conversion process may be difficult. It could easily take asmuch as a decade to accomplish. The time to begin is now.

A hybrid approach to the transition might be appropriate. Some of the aspects ofsuch a transitional approach could include the following:• Expand the spectrum of design basis accidents used for safety assessment
purposes by using operational experience, research results, lessons learned from
accidents, and advice from the ACRS, all studied through quantitative risk analysis.
• I nclude the effects of multiple equipment and human failures where the risk ofoccurrence is significantly high.
• Provide a risk-related scheme for classifying equipment on the basis of safetysignificance.
• I nclude human factors considerations and operational procedures in the review
process.
• On a selective basis, determine whether some design features to mitigate the effects
of some Class Nine accidents should be required.
Modification is definitely needed in the current philosophy that there are some
accidents ("Class Nine accidents") so unlikely that reactor designs need not provide
for mitigating their consequences. At Three Mile Island, a great deal of radioactive
material generated by the damaged core had to be handled by filtering and waste gas
systems designed not for an accident but for everyday processing of coolant watercontaining only small amounts of radioactive materials. Severe damage to the core was
supposed to be prevented by engineered safety systems, and therefore was assumed
to be too unlikely to design against.
We recommend a thorough review of this approach. Should loss of core cooling andresultant core damage occur in a nuclear plant, there are certain predictableconsequences that might be substantially mitigated, and the risk of severe public healthdanger thereby substantially reduced, by design improvements of less than staggering
cost or complexity. Such improvements should be specifically evaluated in the normal
design review basis.

I n particular, it appears that expedited consideration should be given to the use ofvented, filtered containment systems to guard against the high-pressure rupture ofexisting containments, and to the redesign of some of the waste gas and filteringsystems that will inevitably be exposed to water and gas coming from the primarysystem during an accident containing high concentrations of radioactive materials.

Finally, we think it is time for the NRC to strive to establish a substantive risk
objective for nuclear powerplants, a clear guideline as to "how safe is safe enough." In
15 1

the early years of the commercial nuclear program, we did not have enough experienceto estimate risk accurately. There are still large uncertainties involved in applying risk
assessment methods. But today, with more evidence from actual operations and fromresearch, and with more sophisticated risk analysis methods, it may be possible toenvision establishing quantitative risk standards with at least a reasonable chance ofanalyzing reactor design and operation against them.

As we have said elsewhere in this report, we believe the ultimate judgment of how
safe is safe enough is a judgment for the Executive and Congress. The Commission
should probably undertake in the first instance to articulate a proposed standard fortheir consideration and for public discussion, so that the value judgment about how
much risk is acceptable from commercial nuclear plants can be thoroughly and publicly
aired.
The establishment of a substantive, quantitative standard would permit the fashioni ng of a more consistent regulatory program; some existing regulatory activities could
be dropped, others intensified. Designs could be analyzed on a more comparativebasis, aiding in a rational standardization policy and in the one-step licensing process
we have proposed. Backfit decisions could be made in the context of a more specificcost-benefit analysis.
The ACRS has recently endorsed a proposal to move toward establishment of such astandard. We think the Commission should make the establishment of such guidelines ahigh priority.

152

9 HEALTH EFFECTS FROM

RADIOACTIVE RELEASES DURING THE
ACCIDENT, AND OCCUPATIONALHEALTH PHYSICS AT THE SITE

The effects on the population in the vicinity of Three Mile Island from radioactive
releases measured during the accident, if any, will certainly be nonmeasurable andnondetectable. During the course of the accident, approximately 2.5 million curies ofradioactive noble gases and 15 curies of radioiodines were released. These releases
resulted in an average dose of 1.4 mrem to the approximately two million people in thesite area.
This average dose is less than 1 % of the annual dose from both natural backgroundradiation and medical practice. The 1.4-mrem dose may also be compared todifferences in annual doses in background radiation from living in a brick versus aframe house, an additional 14 mrem/yr; or living in the high altitude of Denver rather
than in Harrisburg, an additional 80 mrem/yr.
The effect of this total dose, averaged over the population in the site area, will be to
produce between none and one additional fatal cancer, and between none and one anda half total (fatal and nonfatal) cancers, over the lifetime of the population. In
comparison, approximately a half million cancers are expected to develop from allother sources during this same lifetime.

I n assessing the health effects from radioactive releases, we also estimated the
maximum probable dose received by any one person located off site. To calculate thisfigure, we assumed that an individual had been standing on the east bank of theSusquehanna across the river from the plant, near the North Gate to the site (thedirection in which the maximum exposure was most likely to occur), 24 hours a day for
6 days, with no clothes on, and in the open. Our calculations estimated that such aperson would have received a dose below 100 mrem. The additional lifetime fatal
cancer risk to such an individual would have been about 1 in 1 00,000-compared to arisk of fatal cancer from all other sources that the individual would incur during his
lifetime of about one in seven. (The additional lifetime fatal cancer risk to the individual
receiving the average offsite dose, 1.4 mrem, is about one in five million.)

We studied the monitoring efforts by Met Ed, the NRC, and others in response to theaccident to determine whether it was possible or likely that the average, or maximum
probable, dose was underestimated because of inadequacies in monitoring. We foundthat, although the monitoring efforts could have been better and monitoring capabilities
should be improved, the monitoring of releases during the accident was adequate toensure that the estimates of dose to the population are adequate.

In our view, the fact that there will be no adverse radiation health effects, or veryminimal effects, from the Three Mile Island accident has not been clearly understood by
the public. It is clear to us that the public misconception about the risks associated with
153

Hand-held "friskers" were used by TMI personnel to check plant
workers for radiation.

the actual releases measured during the accident, as well as about the risks associatedwith nuclear powerplants generally, has been due to a failure to convey credible
i nformation regarding the actual risks in an understandable fashion to the public. We
believe substantial efforts are necessary to provide such information and that the NRC
should play an effective role in this task.

We have also determined that plant personnel are unlikely to suffer adverse healtheffects from radiation exposure during the accident, although some workers received
doses of approximately 4 rem, which was in excess of the quarterly limit of 3 rem
1 54

allowed by NRC. We have concluded, however, that during the first several days after
March 28, the potential for severe overexposures existed, principally because of theinadequacy of the radiation protection, or health physics, program at Three Mile Island.

The purpose of a radiation protection program is to maintain the inevitable exposureof plant personnel who must work in radiation areas to levels which are as low asreasonably achievable. The essence of such a program is to establish careful work
practices to minimize exposure and to ensure that the plant is designed so that highradiation areas are properly shielded and controlled.
Our investigation found deficiencies in the radiation protection program at Three
Mile Island that were both pervasive and serious. The utility had identified these
deficiences itself prior to the accident, but its efforts to improve the program before
March 28 were slow and weak. NRC also was or should have been aware of the
deficiencies and should have taken meaningful action to remedy the problems.

There appear to have been two primary reasons why an inadequate radiation
protection program existed. First, the attitude of both Met Ed and the NRC was that the
program was of secondary importance and, accordingly, warranted much lessattention than operational aspects of the plant and hardware. Second, both the NRC
and Met Ed shared the assumption that the engineered safety features incorporated in
the plant would mitigate or prevent any serious accidents.
Under anticipated conditions, the existing radiation protection program would haveprovided sufficient protection. Under the conditions of the TMI accident, however, theradiation protection program did not. Instead, it was virtually abandoned, at least
during the first several days. Thus, for example, the radiation work permit procedure,
which is designed to ensure careful planning for tasks in high radiation areas, was not
used. And, no control was exercised over entries into the Unit 2 Auxiliary Building,where radiation levels were, in some places, greater than 1000 R/hour, which could
result in a lethal dose.

The accident has shown that radiation protection, which has always been considered a "necessary evil" and secondary in importance to reactor operations and reactor
safety, must be given a higher priority. At reactor sites, the radiation protection function
should be made independent of operations and be elevated to equal importance. And
the NRC should give greater emphasis in both its safety review and inspections toradiation protection. To do so, the NRC will have to acquire more expertise in this area.
Although we did not study the radiation protection or health physics programs atother commercial nuclear plants in detail, the scope and nature of the problems at
Three Mile Island raise a question whether similar deficiencies, and the need for similarchanges, exist at other plants. Specific suggestions for changes are contained in the
backup volume to this report, but it is worth noting that effective management of theutility's program and of the NRC's oversight appears to be the primary need.

155

10 I NFORMATION MADE AVAILABLE
TO THE NEWS MEDIAThe TMI accident was a first of a kind for the nuclear power industry. Neither theutility nor the NRC was prepared to cope with the public's need for information. As aresult, the residents around TMI were unduly confused and alarmed, and the level ofanxiety nationwide about the safety of nuclear plants was unnecessarily raised.

The information Met Ed and NRC provided to the news media during the course of
the TMI accident was often inaccurate, incomplete, overly optimistic, or ultraconservative. Errors in judgment by Met Ed and NRC officials were major contributors to theinadequate public information effort at TMI. For the first 2 days, Met Ed consistently
portrayed an overly optimistic picture of the accident. The utility's spokesmen simply
were not up to the undertaking.
At the same time, the NRC failed to coordinate its internal flow of public information,
resulting in speculative reports from Washington which conflicted with statements
made by NRC to officials in Harrisburg. The NRC made the problem of conflicting
reports even worse by refusing to participate in joint press conferences with the utility.

The State's public information effort, which relied almost entirely on information fromMet Ed and later the NRC, suffered accordingly. While both the public information
performance of Met Ed and the NRC can be faulted in many instances, we found noevidence that officials from either the utility or the regulatory agency willfully provided
false information to the press or public. We have also concluded that the Commonwealth's action, with the assistance of the White House, to centralize the flow of
information to the public was justified in this instance. Unfortunately, this also resulted
in a lack of official information flowing from the State to county and local jurisdictions,which should not have occurred.

The decision of the utility to silence its press center, however, was unfortunate as its
statements during the third through the fifth days of the accident were more accurate
than the NRC's. It would be highly speculative, however, on our part, to conclude that
this seriously deprived the public of Met Ed's assessment of the impossibility of ahydrogen explosion, since by the time the hydrogen bubble was an issue, Met Ed had
lost much of its credibility.

With respect to their stated public information policies, it was Met Ed's policy toinform the public in conjunction with the State, and it was NRC's policy to assure itself
that the utility informed the public of actual and potential hazards. Only the
Commonwealth of Pennsylvania, however, had a plan for dealing with emergency
public information in accident disaster situations. The plan called for continuous flow of
information and instructions to the public about the accident, actions taken byauthorities, and actions to be taken by the public. It also centralized the information
process in the Governor's office to minimize confusion and panic and to maximize theeffectiveness of instructions to the public.
156

It was not so much the public information performance of Met Ed and NRC, but the
failure to adhere to their stated policies and the lack of planning that resulted in thedissemination of confusing and speculative information to the public. To that end, werecommend the following:• That a provision for public information be incorporated in the emergency responseplans of both the NRC and the utility and that they be coordinated with State, county,
or local plans.
• That a senior NRC official should be the principal spokesperson at onsite or nearsite
press conferences during an accident at a nuclear plant. A utility spokesperson
should be present at such press conferences to provide simultaneously any differing
views or additional information the utility feels is necessary to keep the public
properly informed. An appropriate State official should also be present at thesepress conferences and should have sole jurisdiction for public information concerni ng evacuation and related emergency planning. The utility should maintainresponsibility for initial public statements until the NRC establishes an onsite ornearsite capability. Press briefings should be held three times a day or more
frequently if dictated by the situation.

1 57

BRIBERY, AND
11 SABOTAGE,
COVERUPDuring the course of the inquiry, we remained alert for any evidence that theaccident might have been caused or complicated by an intentional, malicious action, orthat any safety defects may have resulted from corruption of construction or operating
personnel or management. These matters had previously been examined by the NRC's
Office of Inspection and Enforcement in its enforcement investigation, and by theFederal Bureau of Investigation. Like those organizations, we developed no such
evidence in the course of our work.
Like IE and the President's Commission, we were unable to determine when or how
the emergency feedwater block valves-which prevented emergency feedwater frombeing automatically supplied to the steam generators during the first 8 minutes of theaccident-came to be closed. It has been established that these valves were closed
during a routine maintenance procedure 2 days before the accident occurred, but the
Met Ed personnel involved gave sworn testimony that they recalled reopening thevalves after the maintenance was completed, as required by plant and NRC
procedures. A checklist that would have recorded whether that was in fact done wasroutinely thrown away after the maintenance procedure was finished.

Our analyses of the accident showed that the interruption of emergency feedwaterflow for 8 minutes had little impact on the sequence of the accident itself and was notdirectly related to the core damage that ensued several hours later. However, itappears that the failure to identify the closed block valves did contribute somewhat tooperator confusion in the first stage of the accident.
We believe it is possible that the block valves were not closed prior to the accident
but rather were closed just after the accident began by a control room operator who
then, in the rush of events, overlooked the necessity to reopen them. This procedure,
which is a violation of NRC regulations, would have been intended to enhance theprimary coolant system's stability during the first few minutes of a normal loss-offeedwater transient by preventing cold emergency feedwater from rushing into thesteam generator, thus causing the primary system to "shrink" when the reactor
scrammed, the pressure to fall, and the emergency core cooling system to activate onl ow pressure.
Such a procedure could have been developed by operators as a "corner-cutting"device to compensate for the B&W reactor's oversensitivity to such transients and has
been rumored to have been used at other B&W plants.

However, the operators on duty at TMI-2 on March 28 denied that such action had
been taken during the accident, and we developed no firm evidence to show that it had
been done during prior transients, which would have provided a basis for inferring thatsuch action was a common practice.

15 8

A maze of electrical cables leads to the reactor's control rods.
During the first 10 hours of the accident there were a number of indications available
i n the control room to show that the core had been uncovered and that severe coredamage might be occurring, or had occurred. These included hot leg temperatures well
above the saturation point for existing system pressure and temperature, incore
thermocouple readings over 2000°F, and the sharp increase in reactor building
pressure at about 1:50 p.m. on March 28 caused by a hydrogen burn. In spite of thesei ndicators it was late Thrusday night or Friday morning before the true dimensions of
the accident began to be appreciated.
We undertook to determine if there was evidence of any willful failure on the part ofutility personnel to provide accurate information to the NRC in order to cover up theseriousness of the accident. A detailed account of the results of that investigation arecontained in Volume II of this report.

I n sum, we concluded that the evidence failed to establish that Met Ed management
or other personnel willfully withheld information from the NRC. There is no question thatplant information conveyed from the control room to offsite organizations throughout
the day was incomplete, in some instances delayed, and often colored by individual

1 59interpretations of plant status. Indeed, information conveyed by Met Ed, NRC, andB&W employees in the control room to their own managements and offsite organizations was in many cases incomplete and even inaccurate.

However, based on the evidence, we could not conclude that the causes of thisbreakdown in information flow went beyond confusion, poor communications, and a
failure by those in the control room, including NRC and B&W employees, tocomprehend or interpret the available information, a failing shared to some extent by
offsite organizations as well.
A number of factors other than deliberate attempts to downgrade the seriousness ofthe situation could have accounted for the failure of the control room crew tocommunicate critical information. These include the inability to recognize andcomprehend the full significance of the information, and certain psychological factors:
the difficulty of accepting a completely unexpected situation, the fear of believing thatthe situation was as bad as the instruments suggested, and a strong desire to focus on
getting the reactor stable again rather than dwelling on the severity of the accident.

The failure to recognize and act on significant data in our view demonstrates a lackof technical competency by site employees to diagnose and cope with an accident.
Moreover, the inability of the utility's management to comprehend the severity of theaccident and communicate it to the NRC and the public was a serious failure of thecompany's management. But neither lack of such a capability nor the psychologicalfactors mentioned above amount, in our view, to an intentional withholding of
information.
Moreover, NRC and B&W employees in the control room also did not recognize orcommunicate critical information. And their offsite organizations did no better, andperhaps worse, than the utility's offsite engineers at GPU in New Jersey in demanding
reporting of important information and in recognizing the significance of the informationthat they did receive. The fact that NRC and B&W did no better than Met Ed/GPU inreporting critical information up the management chain and acting upon it tends tosupport our conclusion that there is no evidence to show willful withholding ofi nformation by Met Ed from NRC.

160

12DISINCENTIVES TO SAFETY

One of our charges was to investigate allegations that Met Ed rushed TMI Unit 2 into
commercial operation at the end of 1978 in order to realize tax or other financial
advantages, thereby compromising safety in the process. Although we uncovered noevidence to support these particular allegations, our investigation did reveal the extent
to which any utility in the latter stages of constructing a nuclear plant (and afterwards)
comes under diverse and often competing financial pressures from a variety of
directions-the IRS, the State's public utility commission (PUC), the Federal Energy
Regulatory Commission, (FERC), local ratepayers' organizations, the company's own
shareholders, and of course the NRC. Few of these pressures arise from safetyconcerns; indeed, many may be counterproductive to safety. Yet there is no
coordination between the various agencies involved, and little appreciation by any ofthem of the pressures generated by the regulatory programs of the others.
During our inquiry, we also found a variety of other factors--regulatory andcontractual, as well as financial-that may work as unintended disincentives to safety.
The common characteristic of these factors is that they do not appear, at first blush, tohave any adverse effect on safety, nor are they supposed to have such an effect. Their
impact is more subtle.
The length of time consumed by the NRC's license review process may in itself
create disincentives to innovation in safety. From initial application to plant startup may
take 10 years or more. The more time an applicant must spend in the administrative
process, beyond that which is necessary to build a plant, the greater the applicant's
cost. There is, therefore, a recognized incentive for the applicant, if he cannot shorten
the process, at least not to contribute to lengthening it.

One way an applicant may cause delay in the review process and thus increase its
cost is to make design changes or other innovations, including those that would ensure
greater safety. By injecting these new elements into the license review process in
midcourse, the applicant runs the very real risk that the NRC will lengthen the process
as it undertakes to review the innovations. The same is true with respect to any
i ncremental safety changes the vendor may consider making, as we mention below.

NRC reporting requirements also appear to have created disincentives to safety.
When a licensee, supplier, or architect-engineer identifies a "substantial safety
hazard," NRC regulations require that he report it. The NRC has provided little
guidance on the definition of "substantial." But when a report is made, NRC usuallyconducts a lengthy examination, sometimes including a hearing, and may ultimately
i mpose civil penalties. On occasion, a number of plants have been ordered closed
down pending the resolution of the problem raised.

The time consumed by this administrative activity, in addition to the prospect of afine, may cause those who have a legal reporting obligation to conclude that identifying
and dealing with safety issues, particularly those that seem relatively unimportant, is"more trouble than it is worth." In addition, these parties know that filing a report will
16 1

© 1979 by Herblock in The Washington Post

16 2

li kely cause others with whom they do business to become enmeshed in theadministrative process. Thus, those in the best position to identify safety concerns may
simply stop looking for them and raise them only when they feel it is absolutely
necessary to do so.

Within the NRC, complacency has created a climate in which the pursuit by ani ndividual employee of concerns regarding the safety of systems or hardware that thestaff has previously concluded was safe is discouraged. Indeed, it appears wellunderstood by the staff that assertion of safety concerns, particularly those that may becontroversial, is most unlikely to advance one's career and is far more likely to result instigmatization. In short, at the NRC "whistle blowing" and "rocking the boat" are likely
to lead to "career paralysis." NRC appears to have taken some measures to ensurethat expression of concern about safety from within the agency's ranks is not stifled.
We believe, however, that increased and sustained effort is necessary to encourage
expressions of legitimate dissent.
Financial disincentives to safety, probably not apparent to the casual observer, canarise both from Government regulation and the relations between private parties in thei ndustry. Actions by commissions that regulate rates can create important financial
disincentives. (State PUCs regulate retail rates, and FERC regulates wholesale rates.)
For example, utilities are permitted to include interest costs prior to operation among
capital costs in their rate base. However, part of those costs may be disallowed by
FERC if it concludes that the construction and preoperational period took too long.
Thus, utilities, to minimize financial risk, may rush through preoperational testing at therisk of safety.

Rate commission policies may also discourage a utility from adding safety features
which are not "required by NRC." Such "extras" may be regarded as "goldplating"and their cost may not be permitted as part of the rate base on the theory that, because
the NRC did not require them, they are unnecessary. A utility may also be reluctant toi nstall a "safer" subsystem than the existing one in a plant already in operation
because of a concern that the cost will not be approved by the commissions fori nclusion in the rate base. The theory of excluding such costs is that the licensee
should have made the change during the construction phase when the incremental cost
would have been much less. Similarly, when a utility makes a safety improvement whichcauses temporary shutdown or reduction in power production at the plant, it faces
another cost-for replacement power-that it may not be able either to pass on
directly to consumers or to recover by addition to its rate base.
I ncome tax regulations may also create disincentives to safety. It is in the financial
nterestof the utility to place a plant in operation by the end of a taxable year (possiblyiby taking shortcuts that could affect safety) because it will be able to claim
depreciation for the last 6 months of that year even if it only began operation on the last
day of its taxable year. Until recently, the utility was also able to claim an investment tax
credit on the cost of all qualifying equipment in the year it was placed in operation,
regardless of whether it was placed in operation on the last day. This policy provided
an even greater incentive to begin operations by yearend. (The regulation now has
been changed to permit investment tax credit on expenditures actually made during acalendar year, even though the equipment has not yet been placed in operation.)163

I n the contractual relationship between vendors and utilities, there is a disincentive
for a vendor to stress the importance of an improvement during construction, lest it berequired under a fixed-price contract with the utility to pay for the change as part of a"licensable plant." Similarly, after construction is complete, the vendor may shrink fromi dentifying design deficiencies for fear that the NRC will require a "fix" to be backfitted
i nto existing plants of the same design, either costing the vendor additional money or, if
the utilities end up paying, the antagonism of its customers. Similarly, a utility may risk
the antagonism of its vendor if it identifies a deficiency and NRC ultimately requires thevendor to backf it other plants it has sold previously.
The financial aspects of nuclear safety are ordinarily discussed as if there were asimple tradeoff between dollars and safety. We certainly do not mean to suggest that
there is no such relationship or tension, but we have found that the situation isconsiderably more complex than it might seem to be. Certain policies or actions thatare not explicitly recognized as affecting the balance of cost and safety neverthelesshave that effect.
To deal with some of the financial disincentives to safety, the NRC will have to
become more aware of the relationship between the business and technical sides of
the utility. Once again, it will have to be more conscious of utility management. We
suggest that consideration should be given to an expanded financial analysis of utility
li censees so that the NRC might be alerted when financial pressures combine to affectsafety. At the same time, the agency needs to improve its method of notifying otherregulatory bodies of the effect their regulatory programs have on the overall safety of
nuclear plants.

164epilogue
The Three Mile Island accident that began at 4:00 a.m. on March 28, 1979, ended
about a week later. The 9 months since the accident have passed with surprisingly littlechange.

The TMI-2 reactor sits almost as its harassed crew finally stabilized it on the eveningof March 28. Water is circulating through and around the devastated core by natural
circulation; the reactor coolant pump has been turned off. The radioactive decay heati s carried away to the tall steam generators by the slow flow. In the secondary system,
gentle boiling in the steam generator sends that heat to the condenser in steam so low
i n pressure that it is almost cool.

Cleanup plans and efforts are mired in prolonged debate. The auxiliary building isslowly being cleaned up; the wastewater outside containment is finally being purified. A
camera has been introduced to the inside of the reactor containment building. This long
unseen space, where fiercely radioactive gas billowed and hydrogen burned during thecourse of the accident, appears on the video screen, still, shiny, dripping with humidity
like a robot rain forest. TMI-2 seems suspended in time, still waiting to be opened, to becleaned, or repaired, or torn down.

Since March the agency that licensed TMI-2, the NRC, has been almost totallyabsorbed by this event. Special inquiries have been conducted in the agency, for theagency, and of the agency to discover the causes and the meaning of the TMI
accident. The NRC's inspection staff investigated the accident and published a report
i n August. The NRC licensing staff has sought lessons to be learned from these eventsand published two reports, one in July and one in October. President Carter appointed
a special Presidential Commission to investigate the accident, which published its
report in October. The NRC published its views and analysis of the KemenyCommission recommendations in November. The NRC inspection staff developed its
own lessons to be learned and made another separate report in December. The
nuclear power industry has responded to the TMI accident as well. The Electric Power
Research Institute (EPRI) has investigated the TMI accident and made its report. The
Congress and the Commonwealth have investigated. President Carter has evaluatedthe report of the Kemeny Commission and announced his intentions.
This special inquiry into the TMI accident has now drawn to an end too. Like theothers, it is focused on the last week of March 1979 and the years of experience innuclear power that preceded it. But we would be shortsighted if we treated the matter
as if nothing had changed since the accident. Let us examine the events since then tolook for change.

In this view looking northeast over the island, the cooling towers andcontainment building of Unit 2 are nearest the camera.

HAVE METROPOLITAN EDISON AND GENERAL PUBLIC
UTILITIES CHANGED?

A recovery organization was established on April 3 by GPU to direct and oversee the
shutdown and cleanup activities at TMI. This organization draws heavily on the Met Ed
staff at Reading, Pennsylvania, and the GPUSC staff at Mountain Lakes, New Jersey.
The recovery organization is located at the site; Robert Arnold, Vice President of
GPUSC, was named to head this recovery group. John Herbein, Vice President of Met
Ed, now reports to Arnold and is in charge of the restart organization for TMI-1. Gary
Miller, the TMI Station Manager, is working for Herbein.

In the aftermath of the TMI accident, Walter Creitz, the President of Met Ed, has
resigned. James Seelinger and Joseph Logan, the unit superintendents of Unit 1 andUnit 2 respectively, have also left.
Unit 1 at TMI had just been refueled and was getting ready for startup on March 28.
It has not been run since; it is being kept out of service by the NRC until changes arecompleted in hardware, procedures, and operator training. In addition, a public hearing
will be held on the TMI-1 restart. Met Ed projects completion of the changes needed byJune 1, 1980. The hearing process is expected to be the controlling factor for the
future of the unit.
The NRC has proposed to fine Met Ed $155,000 for violations of regulatory
requirements; Met Ed is appealing. The cost of cleanup and repair of Unit 2 has been
estimated to be about $400 million over a 4- or 5-year period. The cost of replacement
power for Unit 2 alone will probably approach $1 billion during that period. The New
York Stock Exchange price for GPU common stock dropped by more than half after
the accident to a low of $7; it is now trading at about $8 a share.
There have obviously been substantial changes in GPU and Met Ed. It is still too
early to judge the impact of these changes.
HAS THE INDUSTRY CHANGED?

The industry evaluation of the TMI accident has been fairly rapid. The EPRI reportfound the same causes for the accident that were found by other investigators. The
human failures have been recognized and the approach being developed to deal withthem is a pooling of industry expertise. Four industry groups announced plans on June
28, 1979, for a national institute to establish benchmarks for excellence in nuclear
power programs-the Institute for Nuclear Power Operations (INPO). In August a
discussion paper by the Electric Power Research Institute (EPRI) further delineated thecharter for INPO. From that paper, confirmed by subsequent discussions, it appears
that INPO will:• Establish industrywide benchmarks for excellence in the management andoperation of nuclear powerplants.
• Conduct independent evaluations to determine that the benchmarks are being met.
• Review nuclear power operating experience for analysis and feedback to theutilities. Incorporate lessons learned into training programs. Coordinate information
reporting and analysis with other organizations.
168• Establish educational and training requirements for operations and maintenancepersonnel and develop screening and performance measurement systems.
• Accredit training programs and certify instructors.
• Conduct seminars and generic training for various utility employees, including
i nstructors, utility executives, and upper management, to ensure quality in theoperation of nuclear power programs.
• Perform studies and analyses to support development of criteria for operation, fortraining, and for the human factors aspects of design and operation.
• Provide emergency preparedness coordination for the nuclear utility industry.
• Exchange information and experience with operators of nuclear powerplants in othercountries.

All of these activities combined can go to the root of the utility part of the problem fornuclear powerplant operations. They promise a degree of self-policing in the industry
that alone might ensure the protection of the health and safety of the public. But they
promise; they do not ensure.
HAS THE NRC CHANGED?

The NRC stands shaken by the events of these 9 months. The chairman of theCommission has been moved aside and the executive director for operations hasannounced his resignation. All of the preceding investigations, reports, and resulting
and related actions have wrought change in the NRC and the way it operates. Most
recently, the NRC staff has presented to the Commission a massive Draft Action Planfor implementing recommendations of the President's Commission and other studies of
the TMI-2 accident.
IE'S INVESTIGATION OF TMI

The initial NRC investigation into the TMI accident was prompted and driven by therequirement imposed on the Office of Inspection and Enforcement (IE) to enforce the
NRC's regulations. The inspection staff recognized that an enforcement investigationsuch as this would necessarily be of much narrower scope than the overall review this
accident merited. The IE staff tried to separate actions where Met Ed could be heldclearly responsible from those where NRC influence was significant. They did this byconfining their enforcement investigation to the early phase of the accident. Theirinvestigation chronicled the detailed sequence of events over the first 16 hours andconcluded that the proximate cause of the accident was operator error. Because of theli mitations placed on it, it did not explore the deeper reasons for the accident.
When the report was published under the title "Investigation into the March 28 1979
Three Mile Island Accident by Office of Inspection and Enforcement," many thought it
was the definitive report on the accident and were disturbed to find such a narrow
report.
NRR LESSONS LEARNED REPORTS

The two reports by the "Lessons Learned" task force represent what appears to us
to be the first measured attempt by the NRC staff to look for the lessons from the TMI
169

accident. In the first of these Lessons Learned reports, the NRC staff came up withtwenty-three specific short-term recommendations, all related to specific aspects of the
TMI accident. They. addressed such matters as improved plant staffing, better
operating procedures, better instrumentation, and so on. As constructive as these
individual recommendations were, they did not go to the root of the problem.

The report took note of this and outlined further indepth work for the Lessons
Learned group with respect to the licensing process itself, the general safety criteria
and design requirements used for plants, and the role of the operators and the NRC in
accident response. Even so, it is noteworthy that this Lessons Learned group clearly
limited its attentions to specific reactor licensing problems. No one apparently evenconsidered issues broader than reactor licensing specifics-issues such as the safetyphilosophy of the agency and its management problems.

Nevertheless, the second Lessons Learned report went beyond the narrow definitionof its charter. The Lessons Learned group recognized the need for a clear policy basis
for reactor regulation and recommended "the exposition by the Commission of clear
subjective criteria defining the safety goal of nuclear power plant regulation [and] tosupplement [these] with quantitative criteria where possible...." The reactor licensing
staff does not suggest proposing these needed criteria to the Commission for adoption,
but looks to have them handed down.
NRC RESPONSE TO THE PRESIDENT'S COMMISSION

When the President's Commission made its report at the end of October, the NRC
was stung by some of the most severe criticism of a Government agency ever leveledby a Presidential Commission. At the request of the President, the NRC furnished theagency's response to these criticisms in a letter to Dr. Frank Press, the President's
Science Advisor, on November 9, 1979. In that letter and its attachments, the NRC
enumerated many things it was doing or planning to do to respond to the criticisms of
the President's Commission. In its response, the NRC provided many reassurances
based on its recent activities in licensing reform and expressed hope based on
developing industry actions.
The NRC's reassurances sounded the least persuasive when they dealt with the
management problems of the agency itself. By a 4-to-1 margin, the Commission
rejected the idea of a single administrator and proposed that management
effectiveness could be achieved by modest legislative action and modification ofinternal NRC practices and procedures. The Commission went on to name the many
specific actions the Commission has under consideration. The management structure
which hadn't worked well before TMI would now police itself.
IE'S LESSONS LEARNED
A third report of lessons learned, this time by the IE office of NRC, was published in
mid-December of 1979. It evaluated, in some detail, TMI-related issues from two
aspects: how the accident could have been prevented and how the office response to
the accident could have been improved. This report expressed the belief "thatmaximum technical competence should be readily available at all levels in theli censee's organization and in all levels of contractor organizations." The report "also170

sees the need for the highest level of technical competence at all levels within NRC andwithin IE." The report thus sets a standard for the industry and for the NRC measured
only by superlatives.

This same report found that "the IE inspection program was ineffective in certain
preventive areas" and could say no better than that they "did not find that the IE
response to the TMI accident was ineffective." This mismatch between a superlative
standard and a mediocre performance culminated in the following statement: "[wehave] performed this review and made [a] relatively large number of recommendations
with candor. [We] believe with equal candor that the IE program is, in general, soundly
based and has been, to a large extent, adequately implemented." The NRC group thatbrought us the term "mind set" in the context of TMI betrays it here.
THE TMI ACTION PLAN

The NRC staff and the Commission are now immersed in the development of theagency-wide action plan referred to earlier. In this process, we do not see a closely knit
team forging plans for action. We see instead a task force of staff members drawn fromdifferent off ices-detailed to work for a lame duck executive director for operationsthat is trying to negotiate with each NRC program office and periodically leads a masspilgrimage to the Commission offices to discuss the action plan with the Commission.

I f ever an argument is needed to convince someone of the lack of management in the
NRC, one need only attend one of these Commission meetings. The Commission
repeatedly insists that it is not deciding, but only taking every matter under advisement.
The staff flounders to find a format for the plan that might be acceptable to thisenigmatic collegium that is supposed to lead the agency. This is not management inany conventional sense. It appears that the structural problems in the NRC's
management persist in the wake of TMI.
THE PRESIDENT'S ACTIONOn December 7, 1979, President Carter outlined his response to the advice of thespecial commission he appointed to investigate TMI. He announced his intention tosend a reorganization plan for NRC to Congress. He transferred the chairmanship of
the NRC from Dr. Joseph Hendrie to Dr. John Ahearne as an interim measure. He
announced that he would appoint a new chairman for the NRC, someone from outside
the NRC, as soon as a vacancy occurred. But the President went on to urge the NRC to
put its house in order and to complete its work for renewed licensing "as quickly as
possible, and in any event no later than six months from today." Apparently the newchairman from the outside is to arrive to preside over a house already in order.
THE PROGNOSISWith every passing day, TMI draws less attention. The crisis in Iran and everncreasing
oil prices push the nuclear safety question into eclipse. Just as the lastimajor reactor accident, the Brown's Ferry fire, slipped beneath the surface of the seaof daily concerns 4 years ago, so can Three Mile Island join it in the coming years. It willtake dogged perseverance in the nuclear industry and in the Government to truly learn
the lessons of TMI. We are not reassured by what we see so far.
171

appendix a
HISTORY AND CONDUCT OF THE SPECIALINQUIRY GROUP'S INVESTIGATIONOn June 13, 1979, a contract was entered into between the NRC and the
Washington, D.C., law firm of Rogovin, Stern & Huge to direct the agency's special
inquiry into the March 28, 1979, accident at the Three Mile Island nuclear powerplant in
Pennsylvania. The contract provided that the firm would be accorded full independence in supervising the inquiry, and that the scope of the work should include:
1. The sequence of events during the accident, including, where feasible, anassessment of important alternative sequences; the response of the operating
personnel; radioactive releases and exposures; and events at the plant before theaccident that might be related to the accident.

2. The history of the NRC review of the utility's application for a license to operate
Three Mile Island No. 2; NRC license conditions on TMI-2 operations, including
technical specifications; the operating and inspection history at TMI-2; theoperating inspection histories of other Babcock & Wilcox plants, focused on any
indications of the types of problems that arise in the TMI-2 accident; a summary of
NRC past considerations of such problems; the extent to which financial or tax
considerations influenced conditions in the plant in any way that might havecontributed to the accident; and any other precursor events or analyses relevant tothe accident.
3. The susceptibility of Babcock & Wilcox plants to accidents; unique features of
TMI-2 that may have increased or decreased the severity of the accident; and otherdesign effects related to the TMI-2 accident.

4. TMI-2 operations, including training and qualifications of personnel, operating
personnel, operating procedures and management overview, and technical support
to operating personnel and management.

5. Emergency planning and response to the TMI-2 accident by the utility, other utilities
and utility groups, and industrial organizations, including coordination with NRC andother Federal, State, and local officials, and assessment and dissemination of
information.

6. Emergency planning by, and emergency response plans approved by, the NRC;
actual emergency response to the accident by NRC, including staff, ACRS andcommissioners, on site and at headquarters; NRC coordination with Federal, State,
and local officials, the utility, industry sources, and the national laboratories; NRC
assessment and dissemination of information; and communications and chain ofcommand within NRC.
The Special Inquiry Group was also charged in the contract to assess theimplications of the accident (including design of the facility, operations, regulatory173

actions, and emergency preparedness) for other nuclear powerplants and to identify
areas where further study is recommended.
I n order to carry out this work, the Special Inquiry Group was divided into thefollowing separate Task Groups:
Special Inquiry Staff*Mitchell Rogovin, Esq., Director*George T. Frampton, Jr., Esq., Deputy Director

E. Kevin Cornell, Ph.D., Executive Staff Director
Richard C. DeYoung, Deputy Executive Staff Director
Robert Budnitz, Ph.D., Technical Coordinator
Patricia Norry, Administrative Coordinator
Task Groups

1. Preaccident backgroundThomas Cox
Leader: William Parler, Esq.
Harold Ornstein, Ph.D.
Frederick Hebdon
Wayne LanningDavid Evans, Esq.
David Gamble
2. Description of accident sequence-reactor plant performance
Marion Picklesimer, Ph.D.
Leader: William Johnston, Ph.D.
Evangelos Marinos
Mark Cunningham
Gordon Chipman

3. Description of accident sequence-radioactive releases and exposures
Ronald Bellamy, Ph.D.
Leader: Frank Miraglia
Lewis Battist, Ph.D.
Shlomo Yaniv, Ph.D.
Paul Murray
Oliver Lynch
4. Emergency response of the utility
Leader: Ronald Haynes
Dennis Allison
Harry North
James Snell

5. Emergency response of the NRC

Hartmut Schierling
William Foster
James Creswell
Jacque Durr

George Rivenbark
Leader: Robert Bernero
Peter Sicilia
Joseph Scinto, Esq.
Ralph G. Page
6. Emergency response of Federal and State agencies
Leader: Malcolm Ernst
Lawrence Crocker
Frederick Herr
Information Services

Leader: Richard Hartfield
Myrna Steele

Robert Schamberger, Ph.D.
Donovan Smith
Donald Cleary
Lawrence Vandenberg
Deborah Hodges

174

Attorneys

Consultants

Legal Assistants

Writing and Editorial*William G. Ballaine, Esq.
*Robert Chin, Esq.
*John Dienelt, Esq.
*Fred Folsom, Esq.

*Barry Horvick*Joseph Kuchta*Carla D'Arista*Evan Miller*Mary Ellen Mallonee

Support Staff

Ann Haikalis, Executive Sec.
Patricia LaGrange, Executive Sec.
Margaret Custis (Group 1)
Kathleen Ruifrok (Group 2)
Marjorie Huddleson (Group 3)
Rhea Frazier (Group 4)
Kathryn Motley (Group 5)
Eileen Haycraft (Group 5)*Charles O. Miller*Bernard C. Doyle*Walter Murfin*Michael Woram*Russell Sackett

Editorial*David R. Boyd, Esq.
*Susan L. Carney, Esq.

Eileen Telford (Group 6)
Susan Cavanaugh(Administrative Aide)
Mary Potter (Information
Services)
Deborah Gray (Information
Services)*Denotes non-NRC staff.
Outside Consultants

Early in the course of the inquiry, a decision was made to arrange for a number ofoutside experts to serve on review panels in each of the principal areas ofi nvestigation, reporting directly to Mr. Rogovin. These panels were assembled for two
reasons: (1) to ensure that the inquiry would have the benefit of as much expert advice
and perspective as possible; and (2) to provide a further measure of credibility to thei nquiry's independence.

Each of the panels met with the director, deputy director, and inquiry staff for several
days early in the inquiry to examine our work plans, and again near the end of the
project, in 2-day sessions each, to comment on draft sections of the final report.
Typically, the meetings were not limited to the designated substantive areas of thei ndividual panels but ranged over substantial portions of the work of the inquiry. Eachconsultant also reviewed and responded in detail to a draft of our conclusions andrecommendations.
The five panels and their memberships are as follows:
Panel
Accident Sequenceand Severity

Members
G. Minor, MHB Associates
W. Owen, Duke Power Co.
M. Levenson, EPRI
G. Brockett, Intermountain Tech.

175

H. Parker, Battelle Northwest Labs
R. Kathren, Battelle Northwest Labs
C. Palmiter, Consultant
J. Shapiro, Harvard University

Health Physics

C. Walske, Atomic Industrial Forum
B. McClelland, Washington Department ofEmergency Services
J. Primack, University of California
D. Abrahamson, University of Minnesota

Emergency Response

F. Finlayson, Aerospace Corp.
D. Dorfan, University of California
J. Seminara, Lockheed Corp.

Human Factors

A. Roisman, Department of Justice
L. M. Muntzing, Attorney
A. Murphy, Columbia University
Law School
D. Berick, Attorney
W. R. Johnson, University of Virginia
S. Bolten, Political Scientist

Regulatory Process& Philosophy

SUPPORTING TECHNICAL ANALYSES
To supplement the work of the Special Inquiry Group itself, several contracts werel et by the Group to outside research organizations. Additional work was also done for
the Group by the NRC's Office of Nuclear Reactor Research (RES), and through RES
by national laboratories.

Support from RES consisted mainly of technical analyses using advanced, computer-based engineering models of the TMI-2 reactor system, and performed by nationall aboratory and contractor personnel. The efforts were as follows:

Sandia Laboratories-analyses of the early parts of the accident, emphasizing thesequence of events, thermal-hydraulics behavior and chemical properties of the core,and interpretation of the events in terms of scenarios.

Battelle Columbus Laboratories--analyses of chemical properties and thermalhydraulics of the reactor extending through the first 16 hours, covering alternative
scenarios as well as the actual sequence of events.

Idaho
National
Engineering
ScientificLaboratory andLaboratory-thermal-hydraulic analyses using advanced engineering codes to study
behavior of the reactor system during the early phases of the accident.
Los

AlamosMembers of the RES staff-analyses of the behavior of the TMI-2 core during thecritical boiloff period.

The contracts monitored directly by the special inquiry staff, or followed closely by it,
were the following:176

National Academy of Public Administration-evaluation of alternatives for Government organizational situations or actions in crisis management.

Essex Corporation-studies and analyses of the human factors aspects of the TMI-2

accident, including operator procedures and training, control room design, and otherhuman factors issues.

Mountain West Research, Inc.---study evaluating the accident's socioeconomic
i mpact on the population in the TMI area. The results of this study and those of otherorganizations were incorporated into the Special Inquiry Group's report.

CONDUCT OF INQUIRYConcurrently with the Special Inquiry Group's investigation, two major efforts werebeing pursued by the NRC staff. The first was the enforcement investigation conductedby the NRC's Office of Inspection and Enforcement (IE), which was intended:• To establish, in a comprehensive manner, the facts covering the events of the TMI
accident during the first 16 hours of the accident (first 2-1 /2 days in the case ofradiation protection actions); and• To evaluate the performance of the licensee in connection with the TMI accident as
a basis for corrective action or enforcement action as appropriate.

The investigation culminated in a comprehensive report (NUREG 0600) dated August
1979.
I n addition, the office of Nuclear Reactor Regulation (NRR) produced reports on
Lessons Learned, both short- and long-term. The former dealt with short-term actions
to be taken on operating plants and on pending licensing applications-actions thatare now being implemented. The latter report focuses on safety questions of a more
fundamental policy nature concerning plant operations, design, and the regulatory
process.
The work of these groups was analyzed and in some parts utilized by the Special
Inquiry Group in conducting its own investigation.

In addition, the Group had a cooperative relationship with the staff of the President's
Commission, who were focusing on many of the same areas of investigation. With theirpermission, and by arrangement with Metropolitan Edison, Babcock & Wilcox, and the
NRC, the Special Inquiry Group obtained copies of transcripts of all the depositions
taken by the President's Commission of employees of these three organizations assoon as the transcripts were prepared. Both the Special Inquiry Group and thePresident's Commission, however, recognized the value of producing independent
reports.

I n the original planning of the inquiry, it was contemplated that about 100 people
would be formally deposed under oath, and that information from others could beobtained either by using their statements to other investigators or by conducting
informal interviews. However, as the inquiry progressed, it was decided that formal
depositions would be required of many more witnesses, and a total of more than 270
sworn depositions were conducted. The use of informal interviews was limited to thosepeople whose role did not have a direct bearing on the accident or its aftermath.
177

INFORMAL VISITS AND MEETINGS

Utilities, reactor manufacturers, and architect-engineer firms have special insights
and perspectives that were of interest to the Special Inquiry Group. Although time andmanpower limitations prohibited indepth interviews of a large number of suchorganizations, day-long meetings were held with senior management representatives
from the three light-water reactor manufacturers not directly associated with the TMI-2
plant, representatives from two architect-engineer firms with extensive experience inthe nuclear field, and with representatives of the Electric Power Research Institute.
Their informal, off-the-record views were most helpful.
I n addition, interviews were arranged with the members of the Advisory Committee
on Reactor Safeguards, with a group of representatives from several utilities, and withrepresentatives of several public interest groups.

178

appendix b
A SHORT HISTORY OF THE NUCLEAR INDUSTRY
To call the nuclear power industry the "stepchild" of the Federal Government
recognizes the continuing relationship between the two. They are almost blood
relatives. The Government played an important role in the development of the industry,
nurtured it to commercial usage, occasionally attempted to discipline it, and is now
faced with a classic dilemma of adolescence: Is the industry-child too "grown-up" tobe parented; or too critically dangerous to be left to its own devices?

Even today, most people equate nuclear energy with the atomic bomb. The U.S.
nuclear industry can directly trace its development back to 1942, when the Manhattan
Engineering District (MED)-the Manhattan Project-was formed. One of its firstendeavors was to demonstrate a controlled chain reaction, which a group led by Enrico
Fermi accomplished on a squash court at the University of Chicago on December 2,
1942.

Fermi said that the scientists involved in the Manhattan Project were all anxious to
see the development of the "peaceful aspects of atomic energy" upon the war's end.
I ndeed, 2 years before Hiroshima, the MED scientists had produced five concepts forreactors (a term borrowed, incidentally, from the chemical industry; the original wordwas "pile").

By 1946, MED had built the first peacetime reactor at Oak Ridge National
Laboratory. A team of Navy experts assigned to study the potential of a nuclear
propulsion system for submarines included, and would later be propelled by, acantankerous captain named Hyman G. Rickover. The drive for development of thesubmarine system that would enable submarines to travel submerged would play amajor role in the development of the nuclear industry.
With the war's end, the future of nuclear energy became a concern of Congress.
Although many people were talking of "peaceful" uses of the atom, the Atomic Energy
Act of 1946 struck its lot with military development under civilian control. The Act
looked toward peaceful applications of atomic power, but for the immediate future, theAct continued the Federal Government's monopoly on nuclear material and know-how.
The Act also converted the Manhattan Engineering District into the Atomic Energy
Commission (AEC).

The new AEC continued the work being done in reactor development behind highfences in remote places at the national laboratories. Although the AEC was busy
concentrating the Nation's nuclear stockpile through the Cold War, in 1951 an
experimental "breeder reactor" (so-called because it actually creates more nuclear
fuel than it consumes) was connected to a generator on the southern Idaho desert,
and, for the first time, produced kilowatt levels of electricity from a nuclear reactor.
179

Meanwhile, under the adamant prodding of Captain Rickover, the Navy wasproceeding rapidly toward a nuclear propulsion program. In 1948, Rickover set alaunch date-January 1, 1955-for a nuclear-powered submarine, the USS Nautilus,
and missed only by 17 days with the launching of the USS Nautilus on January 17,
1955. Insistent on the need for a smaller power unit for his underwater vessels,
Rickover drove the scientists to develop a workable pressurized-water reactor (PWR).
Beyond this, the admiral had Westinghouse-the builder of the PWR for thesubmarines-begin work on a larger version for surface ships, such as aircraft carriers,
in 1952.

The ability of the Navy to translate theory into working reality encouraged the
traditionally conservative electric utility industry to test the waters. In 1950, thepresidents of the Detroit Edison electric utility and Dow Chemical, as well as thepresident of Monsanto Chemical Company, proposed to the AEC that Americanindustry "design, construct and operate ... atomic power plants with its own capital."
The AEC agreed and 25 companies joined in a study of the feasibility of suchdevelopment. Their report pointedly concluded that the capital costs were prohibitivefor industry alone to assume the burden.

The chief hurdle to major nonmilitary applications of nuclear energy at that time was
not technology, but one of economics and law-the bottom line. That is, utilities wereunlikely to risk capital in financing nuclear plants without subsidies from theGovernment and greater access to nuclear material than the Act of 1946 allowed.
In 1953, the Eisenhower Administration canceled Rickover's large surface vessel
reactor program for budgetary reasons. And then the AEC (as structured by the
Eisenhower Administration) instructed that the large PWR project be rechanneledtoward development of a "central generation station"-a powerplant.
Concurrently, the AEC also began a 5-year demonstration project to coax private
industry into involvement in the construction of reactors. Five different types ofreactors were tested, including the Navy-directed PWR and a boiling-water reactor(BWR) developed at Argonne National Laboratory. The General Electric Company,
which had been working for Rickover's nuclear Navy program, was looking for a way to
become involved in the commercial side of the industry. GE discarded its liquid-metal
reactor and adopted the BWR concept.

Goaded by industry's growing impatience with the Government monopoly of nuclear
energy and the slowness of the AEC to promote industrial development, Congress
moved to change the 1946 act. The Atomic Energy Act of 1954 drastically shifted thefocus of Government involvement in nuclear energy. Although national security
implications remained important, they were no longer paramount. The stated goal of
the 1954 Act was to "encourage widespread participation in development andutilization of atomic energy."

The shift from the 1946 to 1954 Act might be described as the replacement of aGovernment monopoly system (where industry was involved only as a management toolof Government) to a regulatory system where industry was enabled and encouraged todevelop the new technology subject to a licensing system. In giving industry theauthority to "use and possess" nuclear material for the first time, the Government at
first did not give up its grip on the package. Under a legal restriction written into the1801954 Act, the Government retained title to enriched nuclear material for 10 years and,to this day, retains total control over the complex enrichment facilities that arenecessary to produce the fuel crucial to the operation of light-water reactors (LWRs).
The Government also has retained the responsibility-which no one else covets at the
moment-for solving the problems of high-level radioactive waste disposal.
The revised Atomic Energy Act provided a legal basis for industrial participation, but
it did not solve the financial problems of non-Government involvement in nuclear
energy. Perceiving this situation, the AEC established a system of subsidies in the
1955-1963 Power Reactor Demonstration Project, in which the utilities assumed therisks of building and operating the plants, while the Government assumed many of theresearch and development costs for the varying designs.

Proof of the feasibility of centralized commercial generation of electricity from
nuclear power came in 1957, when the Shippingport, Pennsylvania, unit of Duquesne
Light Company went into operation. Duquesne had won the AEC's 1953 competition
for a contract to construct a generating plant centered around the large pressurizedwater reactor orphaned by Eisenhower's cut in the Navy budget. This was ademonstration project, the AEC emphasized, and had Admiral Rickover spearhead its
development. The cost of electricity from Shippingport was not expected to becompetitive with other sources, but only to illustrate the practicality of nuclear
electricity generation.

During this time period, the AEC was absorbed with promoting and developing newreactors. The perspective of the industry and AEC was that accidents with these small
reactors would be limited and could be dealt with if they happened. Safety designconcentrated on protection systems to prevent accidents from happening and wasaccompanied by a philosophy of placing small LWRs in remote sites and surrounding
some of them with a containment so that, in the event of an accident, any fission
products would be isolated from the environment.
This view of postaccident mitigation was reflected in the Price-Anderson Act in 1957,
which provided insurance for utilities operating nuclear units. The industry had argued,
and continues to argue, that this type of Government sharing of risks was necessary to
encourage development of the new, dangerous technology. Still, safety as such was
not adequately emphasized. The hearings provided for in the 1954 Atomic Energy Act
rarely involved intervention or the raising of safety concerns. Nuclear energy was still
an arcane pursuit, with a legacy of awe and mystique from World War II. Most of the
public seemed content to leave it that way. By the end of the Power Reactor
Demonstration Program, the workability of both PWR's and BWR's (the LWR family)
had been shown to the industry's satisfaction.

I n December, 1963, Jersey Central Power & Light Company (JCPL; part of thepresent General Public Utilities system that includes Metropolitan Edison) announced
that it had entered into a contract with General Electric for the construction of a 515
MWe boiling-water reactor at Oyster Creek, New Jersey. This reactor was the firstnuclear unit to be built without a Government subsidy. More significantly, JCPL issued
a report justifying its selection of a nuclear unit for the site, claiming that it was
economically superior to other forms of generation.
The JCPL decision got things moving. Oyster Creek was the first of 13 "turnkey"
projects built by GE and Westinghouse for various utilities. The vendors (as GE and1 81

Westinghouse were called) agreed under these contracts to complete an entire
operating nuclear powerplant for a utility at a fixed cost, to be adjusted only for theeffects of inflation. Besides reflecting the optimism of the vendor side of the industry,
this turnkey approach removed some of the burden of initial risk from the utilities, andeased their entry into the new technology.
Twenty-seven other plants were ordered in approximately the same time period;
these plants would not be contracted on the turnkey principle. There were numerous
vendors in the nuclear equipment field in addition to Westinghouse and GE (althoughthose two were, and remain, the largest); among these were Combustion Engineering,
Babcock & Wilcox, Allis Chalmers, and several smaller manufacturers.

Beginning in 1963, the rapid expansion in orders for nuclear plants placed
considerable strain on the AEC. The development of the boom was due to theincreased size of light-water reactors. While LWRs had always been relatively small (ascompared to units that did not use enriched fuel, such as in the Canadian system), thatcompactness was tailored largely to the early needs of the Navy. Submarine-sized
reactors are not practical for central generating stations. Now they were rolling withbigger and bigger reactors. What had been 175-MW reactors in 1960 (Yankee Rowe),grew to 575 MW in 1962 (Connecticut Yankee) and 1,000 MW in 1966 (Brown's Ferry).
Although that swift progression may have made the units more economical, it also
raised safety issues that had not been important when dealing with smaller reactors.
At the same time, utilities were pressing the AEC to allow siting closer to major load
centers (such as cities and factories) to minimize transmission costs and power losses.
The industry wanted a "streamlined" licensing process to reduce the lengthening lag
ti me between application for permits and licensing, and actual issuance. All of theseindustry demands were made in the name of keeping nuclear energy competitive withgeneration from other fuel sources. In the promotional atmosphere of the AEC, sucharguments had appeal. The AEC accepted proposals to site close to cities, such as at
I ndian Point, above New York City, but gagged at a proposal for a large plant in the
middle of that city's borough of Queens.
By 1966-1967, however, some major reassessments were taking place within the
AEC. A 1967 report on the proposed 1,000-MW units concluded convincingly that acontainment system alone would not prevent the emission of radioactive material in theevent of a core meltdown-the most serious accident postulated in a reactor. The
result was a drastic shift in AEC regulation-away from only preventing accidents andtoward complex ways to mitigate the consequences of accidents as well. The AEC
began requiring that the new, larger units include quality assurance programs,
redundancy of critical equipment, the addition of an Emergency Core Cooling System(ECCS), and other measures-as well as retaining the existing containment approach.
There was a tradeoff in the new requirements: closer siting would be allowed, on thedemonstration that engineering fixes had been installed to ensure the safety of thelarger population.
Nonetheless, with 30 units ordered, 1967 was a boom year for the industry. Nor did
the new safety requirements deter orders. As the 1963 units came on line and utilities
studied the low-cost power available from a nuclear unit, the demand for them jumped.
Ninety-one units were ordered in 1969 and 160 by the end of 1972.
182

But the easy, nonabrasive days of Government-industry relationships began to draw
to a close as the activism generated by the Vietnam War began to seep into the nuclear
energy issue. Aided by the 1971 Calvert Cliffs decision, which imposed environmental
responsibilities on the AEC, and by the Government's liberal intervention policies,
i ntervenors began challenging the ability of utilities to build safe, environmentally soundnuclear plants. This challenge perhaps reached its peak in the heavily publicizeddebate over the Midland, Michigan, nuclear powerplant, which applied for its
construction permit in 1968 and in 1979 remained in early stages of construction.
The old issue of a "conflict of interest" between the AEC's promotional andregulatory roles finally impressed both the Nixon Administration and Congress. In 1974,
the Energy Reorganization Act split the AEC into the Energy Research and Development Administration (the promotional side) and the Nuclear Regulatory Commission(NRC). The Joint Committee on Atomic Energy (JCAE), an old friend of the industry
and AEC in Congress, was also disbanded.
The stepchild relationship of the Government and industry was somewhat altered by
all of this. Although it inherited many AEC regulatory personnel, the NRC wasdedicated to an increasingly strict system of regulation of the industry. The days ofriding point for the industry were virtually over, except for an informal legacy ofpartnership which persisted at the staff level.
The 1970's have not held up to the promise for the industry that prevailed in the
1960's and, to an extent, the 1950's. Although the industry believes the technology issound, legal and economic constraints are once again limiting its development. Thei ncreasing regulatory demands of the NRC and the various State governments areforcing utilities and vendors to add costly new equipment and procedures. Further, it isalleged that intervenors have lengthened the time necessary to obtain a license byraising costly court challenges. Economically, tight capital markets and construction
cost overruns have made the larger, more expensive nuclear plant less competitive withother types of generation. A decline in electric consumption growth followed the 1973
oil embargo, sometimes invalidating the huge baseload capacity of many planned
nuclear units. Scores of orders have been canceled.
I t was this environment of deep uncertainty throughout the industry in which theaccident at TMI-2 occurred.

183

PHOTOGRAPH CREDITSWorld Wide Photos: pages ii, 6, 24, 32, 34, 52, 75, 82, 113, 159, 166
Courtesy of U. S. Department of Energy/EG&G: cover, pages xii, 10
Courtesy of Metropolitan Edison Company: pages 26, 38, 45, 88, 124
Keith Myers/Woodfin Camp and Associates:

page 8Dirck Halstead/LIASON: page 84
Robin Moyer/BLACK STAR: page 154
Oliver Rebbot/BLACK STAR: page 78
Institute of Electrical and Electronics Engineers, Inc.: Color Plate 1
Bill Pierce/CONTACT-CAMP: page 73

NUREG/CR-1250, Vol. I