1.
A purpose of the Energy Reorganization Act of 1974 was to divorce the
newly created NRC from promotion of nuclear power. According to one of
the present NRC commissioners, "I still think it [the NRC] is
fundamentally geared to trying to nurture a growing industry." We find
that the NRC is so preoccupied with the licensing of plants that it has
not given primary consideration to overall safety issues.
2.
NRC labels safety problems that apply to a number of plants as
"generic." Once a problem is labeled "generic," the licensing of an
individual plant can be completed without resolving the problem. NRC has
a history of leaving generic safety problems unresolved for periods of
many years -- for example, the problem of anticipated transients without
scram. In 1976 during the TMI-2 operating license (OL) review, the
Advisory Committee on Reactor Safeguards recommended, as they did in at
least one other OL review, that prior to commercial operation further
evaluations be done of various possible accidents, including
low-probability accidents. NRC staff designated this as a "generic
issue." TMI-2 received its OL 2 years later without the resolution of
the issue.
3.
Although NRC accumulates an enormous amount of information on the
operating experience of plants, there was no systematic method of
evaluating these experiences and looking for danger signals of possible
generic safety problems. In 1978, the General Accounting Office
criticized NRC for this failure, but no corrective action had been taken
as of the TMI-2 accident.
4.
The NRC commissioners have largely isolated themselves from the
licensing process. Although the commissioners have adopted unnecessarily
stringent ex parte rules to preserve their adjudicative impartiality,
they have also delegated most of their adjudicative duties to the Atomic
Safety and Licensing Appeal Board and actually adjudicate approximately
25 percent of all licensing decisions. That figure is misleadingly high,
in part because a number of the decisions do not represent significant
adjudicatory events and include decisions on exports. The commissioners
have also isolated themselves from the overall management of the NRC.
One of the present NRC commissioners, testifying before Congress, j
said, "There has, I think, been too little Commission involvement in j
the setting of safety policy in this agency and too little J
Commission guidance on safety matters to the staff and to the |
board." |
5.
The major offices within the NRC operate independently ' with little
evidence of exchange of information or experience. For . example, the
fact that operators could be confused due to reliance : on pressurizer
level had been raised at various levels within the I NRC organization.
Yet, the matter "fell between the cracks" and s never worked its way
out of the system prior to the TMI-2 accident, j
6.
Licensing of a nuclear plant is a two-step process. First, the company
must obtain a construction permit (CP) and several years later must
obtain an operating license (OL). The CP stage does not require complete
design plans, and therefore the full safety review does not occur until
the OL stage. By then, hundreds of millions of dollars have been spent
or committed in the construction process. Therefore, the ultimate safety
review may be influenced by economic considerations that can lead to a
reluctance to order major changes at the OL stage.
'
7.
The Advisory Committee on Reactor Safeguards (ACRS) ' reviews all
applications for licenses and poses whatever questions it deems
appropriate. The ACRS is the only body independent of the NRC staff
which regularly reviews safety questions. However, it has established no
firm guidelines or procedures, and generally has only monthly meetings
of limited duration. ACRS members are part-time and have a very small
staff, thus they must rely heavily on the NRC staff for follow-up of
their concerns. ACRS members tend to concentrate on their own particular
areas of expertise, thereby resulting in a fragmented licensing review.
8.
There are serious inadequacies in the NRC licensing process.
a. Applicants for licenses are only required to analyze
"single-failure" accidents; they are not required to analyze what
happens when two systems or components fail independently of each
other. The accident at TMI-2 was a multiple-failure accident.
b. NRC's design safety review places primary emphasis on those items
labeled "safety-related." This designation is crucial since items not
labeled "safety-related" need not be reviewed in the licensing
process, are not required to meet NRC design criteria, need not be
testable, do not require redundancy, and are ordinarily not subject to
NRC inspection. There are no precise criteria as to which components
and systems are to be labeled "safety-related;" the utility makes the
initial determination subject to NRC approval. For example, at TMI-2,
the PORV was not a "safety-related" item because it had a block valve
behind it. On the other hand, the block valve was not "safety-related"
because it had a PORV in front of it.
c. NRC's reliance upon artificial categories of "safety-related"
items has caused it to miss important safety issues and has led the
nuclear industry to merely comply with NRC regulations and to equate
that compliance with operational safety. Thus, over-emphasis by the
NRC process on specific categories of items labeled "safety-related"
appears to interfere with the development, throughout the nuclear
industry, of a comprehensive safety consciousness, that is, a dynamic
day-to-day process for operating safely.
d. There is no identifiable office within NRC responsibile for systems
engineering examination of overall plant design and performance,
including interactions between major systems.
e. There is no office within NRC that specifically examines the
interface between machines and human beings. There seems to be a
persistent assumption that plant safety is assured by engineered
equipment, and a concommitant neglect of the human beings who could
defeat it if they do not have adequate training, operating procedures,
information about plant conditions, and manageable monitors and
controls. For example, despite recognition within NRC and various
industrial groups that outdated technology in the control room could
seriously handicap operators during an accident, NRC continues to
license new plants with similarly deficient control rooms. As noted
before, problems with the control room contributed to the confusion
during the TMI accident. (See also finding A.8.)
f. The requirement of additional instrumentation to aid in accident
diagnosis and control was considered by NRC as early as 1975, but its
implementation was delayed by industry opposition as expressed by the
Atomic Industrial Forum (AIF). AIF opposition was based on, among
other things, the belief that the instrumentation required would cover
"Class 9" accidents, and therefore, would extend beyond design-basis
requirements. The lack of instrumentation to display in the control
room the full range of temperatures from the core thermocouples
contributed to the confusion involved in the attempt to rapidly
depressurize the primary system on March 28.
g. It is common to issue operating licenses to plants when there are
still "open safety items." When a plant is licensed with many open
items, the Division of Operating Reactors, which has the technical
expertise to supervise operating plants, may refuse to accept
jurisdiction from the Division of Project Management. In effect, the
plant then ends up in a regulatory "limbo," receiving insufficient
attention from either division. TMI-2 was in this "limbo" at the time
of the accident, 13 months after its OL had been issued.
h. When NRC issues new guidelines concerning safety, there is usually
no systematic review, on a plant-by-plant basis, of operating plants
and plants under construction for possible "backfitting." For example,
Chairman Hendrie explained to a Congressional committee that stricter
requirements for on- and off-site emergency plans had not been imposed
on any already operating plants because of the need to balance costs
against safety. The committee, however, found no significant cost
burden in requiring utilities to upgrade and implement emergency
plans. Similarly, NRC determined not to backfit the 1975 Standard
Review Plan (SRP) to those plants, such as TMI-2, that received
construction permits prior to September 1, 1975. According to Roger
Mattson, director of the Division of Systems Safety, if individual SRP
requirements had been reviewed for possible backfitting, the SRP
requirement of diverse containment isolation actuation would probably
have been backfitted to plants such as TMI-2. Instead, TMI-2
containment was isolated only when the pressure in the building
exceeded 4 pounds per square inch. Thus, containment isolation did not
occur until several hours after the start of the accident. However,
this delay had little effect on the actual small releases of
radioactive material during the accident.
i. Although decisions of significant public health impact are
considered in the licensing process, NRC has no specific mechanism for
interactions with public health agencies in the licensing process,
other than the U.S. Environmental Protection Agency (EPA) which does
review Environmental Impact Statements filed by applicants for CPs and
OLs.
9.
The Office of Inspection and Enforcement (I&E) is charged with
determining whether licensees are complying with NRC regulations, rules,
and licensing conditions. Some serious deficiences in this office are:
a. A 1978 General Accounting Office report found that I&E inspectors
did little independent testing of construction work, relied heavily on
the utility's self-evaluation, spent little time observing ongoing
construction work, and did not communicate routinely with people who
did the actual construction work. Similar problems exist in I&E
inspections of operating plants. For example, the principal I&E
inspector for TMI-2 completed an inspection shortly before the
accident by examining utility records and interviewing plant
personnel, but without physically examining any equipment.
b. A 1978 survey of I&E commissioned by the NRC determined that the
majority of inspectors felt their procedures were unclear and lacking
in sufficient technical guidance.
c. Of crucial significance to I&E's system of inspection and
enforcement are the Licensee Event Reports (LER) in which utili- ties
report and evaluate important incidents. However, both licensees and
vendors often have a strong financial disincentive to evaluate and
report safety problems that may result in more stringent regulations,
at least in part because it is uncertain which entity will ultimately
bear the cost of increased safety. I&E makes little effort to
systematically review the LERs, has no formal review mechanism for
them, and hence, must rely on individuals to remember events and to
identify generic concerns.
d. I&E inspectors at various times have had difficulties having
safety issues that they have raised seriously considered within the
office. For example, in 1978 one I&E inspector raised the issue of
operator termination of HPI during the September 1977 incident at
Davis-Besse. For some 5 months, none of his efforts produced any
action. He then took advantage of the "open-door policy" of NRC and
went directly to two of the commissioners. These commissioners
considered his complaint serious enough to merit further exploration.
Unfortunately, this meeting with the commissioners did not take place
until one week before the TMI-2 accident.
e. Early this year, the General Accounting Office concluded that NRC
had not made effective use of its authority to assess monetary
penalties for significant violations. The report cited cases where I&E
consolidated continuing violations into one violation, took too long
to impose penalties, and sometimes reduced the penalties to avoid
financial hardship for the licensee.
f. In its investigative report on the TMI-2 accident (NUREG 0600),
I&E came to the unequivocal conclusion that if the operators had
followed their procedures for loss-of-coolant accidents, there would
have been no accident. However, for more than 2 hours on March 28, the
operators at TMI did not recognize that they had a loss-of-coolant
accident and did not consider the LOCA procedure relevant. In any
event, the TMI-2 procedures were inconsistent and misleading in this
regard.
10. There is an absence throughout the NRC of any overall system to
measure and improve the quality of safety regulations. There are
inadequate management and internal quality assurance systems, an
inadequate research program, and the absence of any systematic effort to
obtain and use the public health-related research of such federal
agencies as HEW and EPA.
11. The information and direction issued by NRC to licensees based on
operating experience was, at times, fragmented and misleading. For
example:
a. An NRC publication describing the September 1977 Davis-Besse
incident made no mention of the fact that operators interrupted HPI.
The incident appeared under the heading of "valve malfunction" not
"operator error."
b. In the weeks following the accident, NRC apparently was confused
as to what emergency procedures plant operators should follow. Thus,
within a short span of time, NRC issued and then either modified or
contradicted its post-TMI emergency instructions.
(i) Immediately
after the TMI accident, NRC directed operators not to override
automatic engineered safety features under any circumstances and to
operate high pressure injection without regard for reactor vessel
pressure/temperature limits. NRC modified this directive within a
short time.
(ii) On April 5,
NRC required all licensees operating B&W-designed reactors to revise
their procedures so that in the event of HPI initiation with reactor
coolant pumps (RCP) operating, at least two RCPs would remain
operating. On July 26, NRC took the opposite position and directed
licensees to shut down its pumps when HPI initiated. I&E, in its
August 1979 report on the TMI accident, stated that the failure of
the TMI operators to shut down the RCPs sooner than they did was a
potential item of noncompliance.
12. With its present organization, staff, and attitudes, the NRC is
unable to fullfill its responsibility for providing an acceptable level
of safety for nuclear power plants.
