1. In a number of
important cases, General Public Utilities Corporation (GPU), Met Ed, and
B&W failed to acquire enough information about safety problems, failed
to analyze adequately what information they did acquire, or failed to
act on that information. Thus, there was a serious lack of communication
about several critical safety matters within and among the companies
involved in the building and operation of the TMI-2 plant. A similar
problem existed in the NRC. (See finding G.)
a. The September
1977 incident at Davis-Besse, another plant with a B&W reactor,
foreshadowed several aspects of the TMI-2 accident. A serious warning
by a senior engineer at B&W that more precise instructions be given to
operators "fell between the cracks." This warning, issued 13 months
before the TMI-2 accident, if heeded, could have prevented the
accident. (See also finding A.7.a.)
b. Nine times
before the TMI accident, PORVs stuck open at B&W plants. B&W did not
inform its customers of these failures, nor did it highlight them in
its own training program so that operators would be aware that such a
failure causes a small-break LOCA.
c. A report by an
engineer at TVA questioning how operators might respond to rising
pressurizer level and falling pressure was sent to B&W in April 1978.
B&W took 9 months to respond and never advised its utility customers
of the concern expressed in the report. The concern was similar to the
one which B&W itself had identified from the Davis-Besse incident.
d. TMI-2 had
repeated problems with the condensate polishers. During the 18-month
period before the accident, no effective steps were taken to correct
these problems. These polishers probably initiated the March 28
sequence of events.
e. The TMI-2
operators had never had specific training about the dangers of
saturation conditions in the core, although they were generally
familiar with the concept. Although Met Ed believed saturation had
occurred in an incident a year before the accident that could have led
to core uncovery, its hazards were not emphasized to the operators.
When saturation occurred again on March 28, operators did not
recognize the significance of that fact and take corrective action
promptly.
f. After an
incident at TMI-2 a year earlier during which the PORV stuck open, an
indicator light was installed in the control room. That light showed
only that a signal had been sent to close the valve -- it did not show
whether the valve was actually closed -- and this contributed to the
confusion during the accident. (See finding A.3.) Timely attention to
all of these factors probably would have prevented the accident.
2. The GPU Service
Corporation (GPUSC) had final responsibility for design of the plant.
However, by its own account, it lacked the staff or expertise in certain
areas to discharge that responsibility. Once construction was complete,
GPUSC turned the plant over to Met Ed to run, but Met Ed did not have
sufficient knowledge, expertise, and personnel to operate the plant or
maintain it adequately.
3. Responsibility
for management decisions was divided among the TMI site, Met Ed, and GPU.
GPU recognized in early 1977 that integration of operating
responsibility into one organization was desirable. A management audit
by Booz, Alien, and Hamilton completed in the spring of 1977 recommended
clarifying and reevaluating the roles of GPUSC and Met Ed in the design
and construction of new facilities; strengthening communications between
GPUSC and Met Ed; and establishing minimum standards for the safe
operation of GPU's nuclear plants. However, integration of management
did not occur until after the accident.
4. The Met Ed
management systems, procedures, and practices did not provide Met Ed a
firm understanding of TMI's operations, nor were effective systems of
checks and balances in use.
a. Met Ed had a
plan for a quality assurance program that met NRC requirements. The
NEC requirements, however, were inadequate because they did not
require quality assurance programs to be applied to the plant as a
whole, but rather only to systems classified as "safety-related."
Neither the PORV nor the condensate polishers were classified as
"safety-related." In addition, the NRC did not require the level of
independent review (i.e., outside of line management) normally found
in the quality assurance programs of safety-critical industries.
b. There was no
requirement for an independent (i.e., outside of line management)
safety assessment of operating procedures. Independent audit of the
performance of surveillance procedures was required only every 2
years.
c. Met Ed's
implementation of its own quality assurance plan was found to contain
significant deficiencies by the Commission staff and in an NRC
post-accident audit of TMI-2. For example:
(i) There
were not enough inspectors to do the inspections required under the
Met Ed plan.
(ii) The NRC
audit reported deficiencies in maintaining "as built" drawings and
in the purchasing of "safety-related" equipment without . quality
controls.
(iii) Although
all plant procedures were required to be reviewed every 2 years,
there was no plan for such a review and no review had in fact been
made of those TMI-2 procedures that were more than 2 years old.
(iv) Although
such inspections were required, Met Ed had not scheduled or
conducted any inspections of materials, components, or equipment in
storage.
(v) There
were deficiencies in the reporting, analysis, and resolution of
problems in "safety-related" equipment and other events required to
be reported to the NRC.
(vi)
Independent assessment of general plant operations was minimal.
d. Met Ed did not
go beyond NRC requirements in such areas as:
(i) Requiring
reporting, resolution, and trending of problems in plant equipment
and procedures which were not "safety-related."
(ii) Applying
its quality assurance program to the operation of
non-"safety-related" equipment and systems vital to plant operation,
consistent with the importance of those systems to safety. For
example, no quality assurance review was given to radiation
monitoring equipment, control rod drive mechanisms, hydrogen
recombiners, the PORV, or condensate polishers. In addition, Met
Ed's quality assurance program was not applied to the maintenance or
the procedures associated with such non-"safety-related" equipment.
As a result of
these deficiencies, the safe operation of the TMI-2 plant was
impaired.
5. Utility
management did not require attention to detail as a way of life at Three Mile
Island. For
example:
a. Management
permitted operation of the plant with a number of poor control room
practices:
(i) A shift
supervisor testified that there had never been less than 52 alarms
lit in the control room.
(ii) TMI
Commission staff and NRC inspections noted a large number of control
room instruments out of calibration and tags hanging on the
instrument panel indicating equipment out of service. Operators
testified that one of these tags obscured one of the emergency
feedwater block control valve indicator lights.
(iii) When
shifts changed in the control room, there was no systematic check on
the status of the plant and the line-up of valves.
b. There were
deficiencies in the review, approval, and implementation of TMI-2
plant procedures.
(i) Although
Met Ed procedures required closing the PORV block valve when
temperatures in the tailpipe exceeded 130°F, the block valve had not
been closed at the time of the accident even though temperatures had
been well above 130°F in the tailpipe for weeks.
(ii) Operators
were not given adequate information about temperatures to be
expected in the PORV tailpipe after the PORV opened.
(iii) A 1978 B&W
analysis of a certain kind of small-break LOCA was misinterpreted by
Met Ed. That misinterpretation was incorporated by Met Ed into the
LOCA emergency procedure available at the time of the accident.
(iv) Operating
and emergency procedures that had been approved by Met Ed and were
in use at the time of the accident contained many minor substantive
errors, typographical errors, and imprecise or sloppy terminology.
Some were inadequate. (See finding A.6.)
(v) A 1978
revision in the TMI-2 surveillance procedure for the emergency
feedwater block valves violated TMI-2's technical specifications,
but no one realized it at the time. The approval of the revision in
the surveillance procedure was not done according to Met Ed's own
administrative procedures.
(vi) Performance
of surveillance tests was not adequately verified to be sure that
the procedures were followed correctly. On the day of the accident,
emergency feedwater block valves which should have been open were
closed. They may have been left closed during a surveillance test 2
days earlier.
c. There were
deficiencies in maintenance:
(i) After the
accident, valves in the TMI-1 containment building exhibited
long-term lack of maintenance. Boron stalactites more than a foot
long hung from the valves and stalagmites had built up from the
floor.
(ii) Review of
equipment history for the 6 months prior to the accident showed that
a number of equipment items that figured in the accident had had a
poor maintenance history without adequate corrective action. These
included the pressurizer level transmitter, the hydrogen recombiner,
pressurizer heaters, make-up pump switches, and the condensate
polishers.
(iii) Despite a
history of problems with the condensate polishers, procedures were
not changed to ensure that operators would bypass the polishers
during maintenance operations to protect the plant from a possible
malfunction of the polisher.
d. After the
accident, radiological control practices were observed to be
deficient. Contaminated and potentially contaminated equipment was
found in uncontrolled areas of the auxiliary building.
e. Training of
operators and supervisors did not give sufficient emphasis to a
fundamental understanding of the reactor. There was no comprehensive
evaluation of operator performance on the job to meet the
requalification requirements of 10 CFR 55. (See finding F.)
f. Reports of
operating experience at other plants were screened by technical
analysts who did not have nuclear backgrounds. They were given no
instruction in how to screen such operating reports, according to
Station Manager Gary Miller. The technical analysts routed experience
summaries to designated people at TMI. The routing sometimes took
several months. The person in the training department who was assigned
to review these summaries often did not get to them for several months
after he received them because of the press of other work. The
training department held only one 2-hour class per year on operating
experience at other plants.
g. There was no
group with special responsibility for receiving and acting upon
potential safety concerns raised by employees.
h. Management did
not assure adequate identification of piping and valves throughout the
plant. The Commission staff noted that pipe and valve identification
practices were significantly below standard industrial practices.
Eight hours into the accident, Met Ed personnel spent 10 minutes
trying unsuccessfully to locate three decay heat valves in a high
radiation field in the auxiliary building.
i. Management did
not assure that Licensee Event Reports (LER) met basic NEC
requirements. A review of TMI-2's LERs disclosed repeated omissions,
inadequate failure analyses, and inadequate corrective actions.
j. Met Ed did not
correct deficiencies in radiation monitoring equipment, although the
deficiencies were pointed out by an NRC audit months before the
accident.
k. On November 3,
1978, a mechanic caused a complete shutdown of the plant, including
exercising of emergency systems, when he tripped a switch on the
polisher electrical panel, thinking he was turning on a light. The
only corrective action was to put a guard on the switch.
l. Sensitive
areas of the plant were accessible to large numbers of people. On the
day before the accident, as many as 750 people had access to the
auxiliary building.
m. The manual
control station of the polisher bypass valve was nearly inaccessible
and took great effort, in a physically awkward position, to operate.
n. Iodine filters
were left in continuous use rather than being preserved to filter air
in the event of radioactive contamination. As a result, they did not
have full capacity on the day of the accident. (See finding A.11.).
