The NRC Office of Inspection and Enforcement (IE) also undertook an intensive investigation of the TMI accident but limited the scope of its inquiry to two sharply defined aspects of it: (1) the operational activities of the licensee from before the initiating event, about 4 a.m. on March 28 up to about 8 p.m. that evening, when primary coolant flow was reestablished by the starting of the reactor coolant pump; and (2) steps taken by the licensee to control the release of radioactive material to off-site environs and to implement its emergency plan, from the initiating event until midnight on March 30. These periods were selected for scrutiny because, in the judgment of IE, they encompassed those licensee actions which most significantly affected the course of the accident and its consequences.

In its report on this investigation, issued August 3, 1979, IE confirmed that the collective radiation dose to the general public resulting from the TMI accident constituted-as reported by the Ad Hoc Dose Assessment Group (made up of various Federal agencies) in its May 10, 1979 report-minimal risk to the health of the off-site population. At the same time, IE reported several inadequacies in the licensee's radiation protection activities inside the plant, as well as in the measuring of off-site radiation levels. These flaws, however, were not such as would cast doubt on or call for alterations in the conclusions of the ad hoc group.

The IE investigation also substantiated earlier conclusions regarding the underlying causes of the TMI accident and the factors that contributed to its severity. The six distinct areas of deficiency earlier identified as causative or complicating elements and confirmed by IE comprised equipment performance; licensee analysis of past transients and accidents; operator training and performance; equipment and systems design; the transmission of information (especially in the early phase of the accident); and the implementation of emergency planning. But what the IE report called "perhaps the most disturbing result" of the investigation was "confirmation of earlier conclusions that the Three Mile Island Unit 2 accident could have been prevented, in spite of the inadequacies" cited. The design, equipment, analyses, and procedures in place and in effect at TMI were, IE concluded, sufficient "to have prevented the serious consequences of the accident" if they had been allowed to function or had been adhered to as intended. For example, had the TMI operators permitted the ECCS to have its full effect, the damage to the core would most likely have been prevented (other examples were adduced in the report where a right action taken or a wrong one avoided could have significantly mitigated the consequences of the accident).

On the other hand, the IE report concedes, had certain equipment been designed differently it too could have prevented or diminished the effects of the accident. The investigation made it "difficult to fault only the actions of the operating staff." An undue preoccupation with the hazards of overfilling the reactor coolant system (that it was to be avoided "at almost any cost") was also evident in the decisions and actions of the operators, leading them to ignore prescribed procedures and to fail to respond to indications that the core was not properly cooled. Retraining of all licensed operators has now been required by NRC as well as an upgrading of procedures.

Causes and Contributing Factors. Soon after the shift came on at TMI-2 at midnight of March 27, 1979, the shift foreman and two auxiliary operators were engaged in transferring resin from a "condensate polisher" tank to a "resin regeneration" tank, on the secondary side of the plant. The chore was a carryover from the previous shift and was one with which plant personnel had encountered some difficulty. The staff thought the problem was a resin blockage in the transfer line and the foreman and auxiliary operators were trying to clear it. The IE report concluded that, "probably as a result of their efforts to clear the line," the plant underwent a total loss of feedwater flow, initiated by a loss of condensate flow and bringing about an almost simultaneous shutdown of the main turbine, at 37 seconds after 4 a.m., on March 28.

Ensuing events were found to be as described earlier in this chapter with certain noteworthy additions and conclusions. Among these was the finding that, about

six minutes after the start of the accident, the pressurizer was completely filled with water and the reactor coolant system was, in fact, "solid," the condition which the control room crew strived to avoid throughout the crucial early hours of the accident by actions which delayed cooling of the core and compounded the consequences of the event. The IE report also indicated that "substantial fractions of the core were uncovered" by about 6:30 a.m. on March 28, although the fact went unrecognized by the operators and officials on the scene, and the high temperature readings in the core and the loops were considered too high to be realistic. The report also found that the operators interpreted the failure of the core flood tanks to inject a substantial portion of their volume into the reactor coolant system to be an indication that the core was covered, even though these tanks cannot be used for that purpose and are designed to supply water in the event of a large loss-of-coolant accident, which was not happening. With respect to the hydrogen explosion in the containment, the report observed that the release of this noncondensible gas from the reactor coolant system may have contributed to the later apparent success of the staff in collapsing the voids in the "A" loop of the reactor. That appearance of success in establishing natural circulation, despite the continued high temperatures in portions of the system, led the operators to believe that they had attained a reasonably stable condition by early afternoon of March 28.

Specific actions cited by the IE report as bringing about the extensive core damage that took place included: throttling the high pressure injection (ECCS) to a minimum during the first three and one-half hours of the accident; operating the reactor coolant pumps at pressures below procedural requirements (which led to greater loss of coolant through the stuck-open pressurizer relief valve); failure to isolate the relief valve after pressure continued to fall in the reactor coolant system, the drain tank disc had blown, and the sump pump operation all indicated that a large discharge of water from the system and the building was taking place; and failure to establish the conditions necessary for natural circulation in the system.

The report made note of other licensee actions which, while they did not directly affect the course of the accident as it actually unfolded, could have severely impaired the response of safety-related equipment if that course had taken another direction. Specifically, the disabling of the automatic startup features of the emergency diesel generators and the isolating of the core flood tanks early in the event constituted these kinds of lapses. The report was also critical of the communications provided during the event by the licensee, pointing out that persons assigned to furnish information off-site had concurrent duties related to management of the emergency. At the root of this and other problems, the report concluded, lay the misconception that even major accidents would be short-term events

and that plans for mobilizing and communicating with off-site technical support over time, as an accident progresses, was not warranted as part of the emergency planning.

Enforcement Action Proposed. On October 25, 1979, the Director of Inspection and Enforcement notified the licensee for TMI that the IE investigation had revealed "numerous items of noncompliance" with NRC regulations on the part of the licensee. Six "violations”—the most serious breach of regulatory requirements were alleged by IE, including serious weaknesses in the licensee's health physics program; control of maintenance activities; development and review of procedures; adherence to prescribed procedures; and audit activities. The licensee was cited for failure to operate the facility in accordance with the technical specifications approved and adopted for that particular plant, and for authorizing a surveillance procedure which placed certain valves in

status which rendered emergency feedwater unavailable on three separate occasions-including the last on March 28, when it was needed. Personnel training was also found insufficient, and record maintenance and in-house inspections as well.

The licensee was called upon to correct each of these deficiencies and departures from requirements and was notified that civil penalties were being proposed in the amount of $155,000, the legal maximum (although an assessment of $725,000 was justified for all violations identified).

Task Force Urges Statutory Mandate on Lead Role. The IE task force on leassons learned from TMI urged that IE be assigned, by statutory mandate, the lead role in NRC's emergency response in the future. Such a role flows from IE's de facto activity as the "principal contact with operating licensees," it was argued. It was also recommended that intra-office training be expanded and tightened surveillance of licensees be adopted. In the lead role for NRC emergency response, IE could give assistance to licensees in its response to an incident, as well as coordination to all NRC acitivities. It would also undertake training of other NRC offices regarding emergency preparedness and the respective responsibilities of those offices.

The task force also recommended that NRC create a new office to oversee training programs to upgrade the quality of inspectors and operations personnel, especially in the area of emergency response.

ACRS Comment on IE Findings. In a letter to Chairman Hendrie dated November 14, 1979, the Advisory Committee on Reactor Safeguards (ACRS) registered its view of the IE investigation and conclusions based on that investigation. Taking note of the limitation in scope of the IE study, the ACRS felt that the emphasis put by IE on the licensee's departure from technical specifications prior to the accident and from approved procedures during it resulted in too lit

tle consideration of other relevant factors. Examples of such factors taken from other investigations by NRC and others might be the peculiarities of a nuclear steam supply system that tended to inhibit recovery from interruption of normal operation or to confuse the operators by producing conditions and instrument readings not anticipated in the written procedures and, in general, by failing to convey clear, complete information to those in the control room. The ACRS concluded that the limited scope of the IE report tended to lead to a catalogue of violations and expressed its concern that the rationale behind the IE report would be perceived to be that a licensee's failure to follow accident procedures is automatically a violation. The ACRS noted that the procedures are prepared by the licensee and are not approved by NRC (although the licensee is required by NRC to follow them) and affirmed that such procedures cannot be so detailed as to allow for every accident situation. On the contrary,

the ACRS declared, a deviation from conditions assumed in the framing of procedures may make it necessary to depart from those procedures. There is a question as to whether an operator who, using his best judgment, consciously takes an action at variance with procedures which in themselves may contain confusing or incorrect guidance is guilty of a violation. If this is the case, the ACRS affirmed its belief that it is "the wrong approach to protecting the public health and safety" in an emergency and that an operator, guided by written procedures, should be allowed to use his best judgment to deal with a problem. That judgment would be subject to post-factum appraisal by responsible parties, but it should not necessarily be deemed an error or a violation of regulations.

The ACRS found the IE report "less than satisfactory" for these reasons and recommended issuance of a consolidated report on the findings of the several NRC task forces investigating the TMI accident.

The President's Commission

On April 11, 1979, President Carter issued an executive order (#12130) creating the President's Commission on the Accident at Three Mile Island and charging its members to "conduct a comprehensive study and investigation of the recent accident involving the nuclear power facility on Three Mile Island in Pennsylvania" and to include in their study the following elements:

• A technical assessment of the events and their

causes.

• An analysis of the role of the managing utility. • An assessment of the emergency preparedness and response of the NRC and other Federal, State and local authorities.

• An evaluation of the NRC's licensing, inspection, operation and enforcement procedures as applied to this facility.

• An assessment of how the public's right to information concerning the events at Three Mile Island was served and of the steps which should be taken during similar emergencies to provide the public with accurate, comprehensible and timely information.

• Appropriate recommendations based upon the Commission's findings.

The President appointed John G. Kemeny, the President of Dartmouth College and former chairman of the Mathematics Department at that institution, to the chairmanship of the Commission. Eleven other members were appointed, including a State Governor, a resident of Middletown, Pa., a labor union president, an industrialist, the president of a national society, an attorney, and five unversity professors. A fulltime staff was engaged which eventually numbered over 60 persons; more than 30 separate staff reports were prepared and many of them published along with the report of the Commission, which was issued on October 30, 1979. In the course of its investigation, the Commission conducted 12 days of public hearings, and its staff compiled more than 150 separate depositions.

The report of the President's Commission was divided into three major sections: an overview, together with the principal specific findings of the Commission with respect to the causes of the accident; recommendations flowing from the findings and addressed to (1) the NRC, (2) the utility and nuclear industry, (3) the training of nuclear plant personnel, (4) certain technical considerations, and (5) the health and safety of plant workers and the general public; and a chronology of the accident with some further attribution of causality. Highlights of each section are provided below, together with the NRC's response to the Commission's recommendations and the President's statement about them.

Findings and Judgments

The Commission affirmed at the outset of its report its basic conclusion that to prevent accidents as serious as TMI in the future it will be necessary to effect "fundamental changes" in the organization, procedures and practices, and, "above all, in the attitudes of the Nuclear Regulatory Commission and, to the extent that the institutions we investigated are typical, of the nuclear industry." The need for a change in attitude in NRC and in the industry is emphasized throughout the Commission's report. The Commission also declared at the start that its findings do not, "standing alone,” require a conclusion that nuclear power plants are inherently too dangerous to continue in operation or that new ones should not be built, but neither would the Commission propose that the nation "move forward aggressively" in expanding commercial nuclear power

uses.

In its discussion of causality, the Commission identified the root problems as being "people-related," rather than related to deficiencies in plant design or equipment (though these too were present and involved in the accident). The weaknesses identified were not only the "shortcomings of individual human beings," but problems of structure and communication "among key individuals and groups." The Commission asserted outright that the equipment involved at TMI was good enough that, "except for human failures, the major accident. . . would have been a minor incident." There was, the Commission found, a preoccupation with regulations as such, rather than with the safety they are supposed to promote, and that regulations as voluminous and complex as those in current effect were actually a negative factor with respect to safety. A particular distortion cited by the Commission was the concentration on large-scale or "worst case" hazards to the neglect of less consequential but more probable scenarios. Thus "the break of a huge pipe... [is] studied extensively and diligently," reflecting the attitude that if the worst accidents can be controlled there is little to fear from lesser events. The Commission pointed out that TMI was the result of a combination of minor equipment failures which is "likely to occur much more often than the huge accidents," and that successful handling of minor failures is usually going to depend more on quick and appropriate human reaction, in contrast to the necessarily automatic and extremely fast response of equipment to sudden, large-scale accidents. The Commission urged on the NRC and industry a newfound recognition that "human beings who manage and operate the plants constitute an important safety system."

On the subject of operator error at TMI, the Commission noted that the training of TMI operators (and that of reactor operators in general) was "greatly deficient" in that it did not prepare them for dealing with the extraordinary, with "something as confusing" as

the conditions created by multiple equipment failures. Moreover, the TMI- 2 control room design was lacking in many ways, "the control panel is huge, with hundreds of alarms, and... some key indicators placed.. . where the operators cannot see them." (More than 100 alarms were in fact activated in the early stages of the accident, and, while the pressure and temperature in the reactor coolant registered in the control room, there was no indication to the operators that the combination of the two meant steam was forming.) Altogether the design of the room and its gauges and equipment gave little attention to "the interaction between human beings and machines" and "ignored the needs of operators during a slowly developing small break accident." Some members of the Commission favored a complete modernization of the control rooms of a TMI design, and all of them agreed that "a relatively few and not very expensive improvements in the control room could have significantly facilitated management of the accident." Thus the Commission found that, while inappropriate operator action was a major factor in the TMI accident, a number of deficiencies on the part of the utility, its suppliers, and the NRC-in training, in procedures, in control room design-and the failure to recognize these deficiencies and to learn from previous experience were among major contributing causes. Despite its findings as to the proximate and contributing causes of the TMI accident, and its judgment that the potential for such lapses could and should have been anticipated by various principals involved, the Commission expressed its conviction that, given all the deficiencies cited, “an accident like Three Mile Island was eventually inevitable."

Regarding the severity of the accident's impact on public health, the President's Commission determined that actual releases of radiation at TMI "will have a negligible effect on the physical health of individuals," and that the major health effect of the accident was mental stress. As to the possibility of an eventual TMIradiation-induced cancer occurring among the exposed population, it found that there will be "either no case of cancer or the number of cases will be so small that it will never be possible to detect them." The mental stress experienced by people near the facility was "quite severe," however. The Commission ascribed this to several factors, especially the extensive speculation by public officals during the first week of the accident on how serious it could become and whether evacuation of the population should or would take place. Concerning the effect of news media coverage during this time-its speculations, selections of items to cover, and general tone-the Commission decided that there was "overall, a larger proportion of reassuring than alarming statements in the coverage," and the news media "did not present only 'alarming' views, but rather views on both sides," although a "few newspapers . . . did present a more frightening

and misleading impression of the accident." The severe stress was short-lived, the Commission concluded, and was worst among people living within five miles of the plant and in families with young children.

The damage to the facility itself was very extensive and, in the words of the report, the "ongoing cleanup operation at TMI demonstrates that the plant was inadequately designed to cope with the cleanup of a damaged plant. The direct financial cost of the accident is enormous. Our best estimate puts it in a range of $1 to $2 billion, even if TMI- 2 can be put back into operation. (The largest portion of this is for replacement power estimated for the next few years.) And since it may not be possible to put it back into operation, the cost could be much larger."

The Commission felt it an important part of their task to ascertain not only how bad the TMI accident was but how bad it might have been. It posed the question to itself, "What if one more thing had gone wrong?" Among the possibilities considered was whether a hydrogen or steam explosion could have breached the reactor vessel and also the containment. (That a nuclear explosion might have done so was not considered because, with the slightly enriched fuel used in a reactor, such an explosion is not a possibility.) Several scenarios potentially leading to the rupture of containment and release of massive amounts of radiation from the plant were studied. Of particular concern was the potential release of radioactive iodine which might enter the food chain. (There was only a trace off-site release of iodine from the actual TMI accident.) Some scenarios led to a better outcome than the actuality, and two or three would have resulted in more severe core damage than occurred and even a melting of the core. However, the Commission reported that-within the limits of current engineering knowledge of the interaction of molten reactor fuel with concrete, steel and water-its calculations show "that even if a meltdown occurred, there is a high probability that the containment building and the hard rock on which the TMI- 2 containment building is built would have been able to prevent the escape of a large amount of radioactivity." Being less than absolutely sure of this conclusion, the Commission urged more research into this vital but murky area of severe core damage and its worst plausible effects. The Commission averred that, whether or not TMI came close to becoming catastrophic, "accidents as serious as TMI should not be allowed to occur in the future," although "we must not assume that an accident of this or greater seriousness cannot happen again, even if the changes we recommend are made." The latter fact argues strongly for the need to be prepared to deal with the aftermath of such accidents.

The next focus of Commission scrutiny, closely related to its last cited observation, was the matter of emergency preparedness among the various govern