The entry says that the accident at Three Mile Island had almost happened before, and that the people who knew it wrote to one another and not to the plant. This piece follows the writing. It is taken from the staff report of the President’s Commission’s chief counsel, which deposed the engineers and reproduced their memoranda as appendices; from the Senate investigation’s chapter on the accidents at other plants; and from the chapter of the NRC Special Inquiry’s report on the evaluation of operating experience. The quotations from the memoranda are as the chief counsel’s report prints them.

Oconee, June 1975

On 13 June 1975 Unit 3 of Duke Power’s Oconee station in South Carolina, a Babcock & Wilcox reactor, was at fifteen percent power and shutting down for maintenance when a loss of feedwater tripped the reactor. The pressure rose, the pressuriser relief valve opened, and when the pressure fell again the valve did not close. The position indicator light in the control room malfunctioned and showed it closed. The high pressure injection started. Water went through the open valve into the drain tank until the tank ruptured and about 1,500 gallons of coolant spilled into the containment. The operators diagnosed the leak and closed the block valve before the primary water boiled, and no fuel was damaged. Boron had built up in the valve; it was repaired and the indicator tested. Duke Power told its operators that closing the block valve had been the right thing. The NRC’s regional office reviewed the analysis and found it satisfactory, the event went into the agency’s monthly “Grey Book”, and no other licensee was told. Babcock & Wilcox decided the valve problem might be generic and advised its owners to inspect their relief valves periodically. The Senate’s report, five years later, could not say what had made the Three Mile Island valve stick, because the containment could not yet be entered to remove it.

Davis-Besse, September 1977

On 24 September 1977, Toledo Edison’s Davis-Besse Unit 1 in Ohio, another Babcock & Wilcox plant, was at nine percent power when feedwater problems drove the primary pressure up and lifted the relief valve. A relay was missing from the valve’s control circuit; it opened and closed nine times in forty seconds and then stuck open. The pressure fell and the high pressure injection came on. Water went down to the drain tank until the tank ruptured and some 11,000 gallons were released into the containment.

The level in the pressuriser had dropped with the pressure at first, as it should. Then it rose, and went on rising as the coolant approached the boiling point. The operators, watching the level, turned the injection off after about four minutes. Water was now leaving through a valve nobody knew was open and nothing was replacing it, and the primary coolant began to boil. The containment pressure and the ruptured tank led the operators to the diagnosis, and they closed the block valve after twenty-one minutes, before the core was in danger. On 23 October 1977 the same thing happened at Davis-Besse again.

The Commission’s chief counsel set out the features of the September transient in a list: “total loss of feedwater; failed open PORV; pressurizer level high and reactor coolant pressure low; and premature termination of high pressure injection based on pressurizer level alone.” It was “an almost exact duplication of what would happen 18 months later at Three Mile Island. The significant differences were that the open PORV was identified after 20 minutes at Davis-Besse, but not for 2 hours and 22 minutes at TMI-2 and that Davis-Besse was at 9 percent power, while TMI was at 97 percent power.” The combination of a high level and a low pressure “had not been predicted and was not known by B&W before the Davis-Besse 1977 transient, although all the necessary information for such a predictive analysis was available to B&W.”

Lynchburg, November 1977 to March 1979

The day after the transient Joseph Kelly, of the plant integration unit of Babcock & Wilcox’s plant design section, was sent to Davis-Besse. After two or three days there he returned to Lynchburg and briefed some thirty people, among them a vice president of the company and Bert Dunn, who managed the unit that analysed the emergency core cooling system. At the end of the briefing Dunn and Kelly fell to discussing whether the operators of the company’s plants knew when it was proper to interrupt the injection in a loss of coolant. Then the October transient happened, and Kelly went to the training department and asked its lead instructor, John Lind, what the company taught. Lind assured him that it taught that the injection should not be shut off until the pressuriser level had stabilised and the pressure was rising. Kelly was reassured, and did not look at the training materials, or propose that the transient be run on the simulator, or that it be put into the next course. Lind never put it in. There was, the chief counsel noted, “a clear conflict between what Lind said B&W was teaching and what the operators had actually done at Davis-Besse.”

At Dunn’s urging Kelly wrote, on 1 November 1977, a memorandum headed “Customer Guidance on High Pressure Injection Operation”, to seven managers and engineers across the engineering, customer service and training departments. After describing the incident he asked: “Since there are accidents which require the continuous operation of the high pressure injection system, I wonder what guidance, if any, we should be giving to our customers on when they can safely shut the system down following an accident? . . . I would appreciate your thoughts on this subject.”

The only written reply came on 10 November from James Walters, a supervisory engineer in customer service. “In talking with training personnel and in the opinion of this writer, the operators at Toledo responded in the correct manner considering how they had been trained and the reasons behind this training. My assumption and the training assumes first that RC [Reactor Coolant] Pressure and Pressurizer Level will trend in the same direction under a LOCA [loss-of-coolant accident]. For a small leak, they keep the HPI [high pressure injection] System up to a certain flow to maintain presr. [pressurizer] on Level.” An instruction to keep the injection running, Walters added, might raise questions about the mechanics of the vessel and about the primary system “going solid”.

Nothing went to the customers in the months that followed. On 9 February 1978 Dunn wrote, in an effort he described in his deposition as to “kick . . . tail”, a memorandum headed “Operator Interruption of High Pressure Injection” to James Taylor, the manager of licensing, which was the unit that dealt with safety questions, with copies to eleven engineers.

“The direct concern here rose out of the recent incident at Toledo. During the accident the operator terminated high pressure injection due to an apparent system recovery indicated by high level within the pressurizer. This action would have been acceptable only after the primary system had been in a subcooled state. Analysis of the data from the transient currently indicates that the system was in a two-phase [steam and water] state and as such did not contain sufficient capacity to allow high pressure injection termination. This became evident at some 20 to 30 minutes following termination of injection when the pressurizer level again collapsed and injection had to be reinitiated. During the 20 to 30 minutes of noninjection flow they were continuously losing important fluid inventory even though the pressurizer indicated high level. I believe it fortunate that Toledo was at an extremely low power and extremely low burnup. Had this event occurred in a reactor at full power with other than insignificant burnup it is possible, perhaps probable, that core uncovery and possible fuel damage would have resulted.

“The incident points out that we have not supplied information reactor operators in the area of recovery from LOCA. . . . I believe this is a very serious matter and deserves our prompt attention and correction.”

Dunn never heard from Taylor. In May 1979, after the accident, Taylor told him the memorandum had been “misdirected”: it had not been written on the company’s form for a safety concern, a “PSC”, and so he had taken it to belong to customer service rather than licensing. The chief counsel’s examination of Taylor is short.

“QUESTION: . . . [H]ad the Dunn memorandum been typed . . . on a PSC form and had it arrived on your desk in that form, rather than in memorandum form, in February of 1978, would you still characterize it as having been misdirected?

“TAYLOR: No, because PSCs are supposed to come to my desk according to procedure.

“QUESTION: Is the Dunn memorandum an appropriate subject for inclusion in a PSC?

“TAYLOR: It is a good subject to be addressed on a PSC because the PSC system prevents it from dropping in the crack.”

Customer service did not dispute Dunn’s prediction. The argument between Dunn and customer service was over the remedy, and a week later, on 15 February, Dunn wrote to Taylor again that he concurred in customer service’s wording of an instruction on when the injection could be stopped. He considered the matter closed, and assumed the instruction would go out. Walters kept his doubts: an instruction to keep the injection on might take the system solid, lift the relief valves and send a surge of water through the discharge piping and the drain tank. On 3 August 1978 he drafted, for the signature of his manager Donald Hallman, a memorandum to Bruce Karrasch, the manager of plant integration, asking that these questions be evaluated. It ended: “To date, [Customer Service] has not notified our operating plants to change HPI policy consistent with References 1 and 2 because of our above-stated questions. Yet, the references suggest the possibility of uncovering the core if present HPI policy is continued.”

Karrasch glanced over it “very quickly” and sent it to a subordinate, who after the accident could not recall receiving it. “I don’t recall ever really feeling the significance of what Mr. Hallman was trying to communicate,” Karrasch said in his deposition. “It seemed to me that it was a routine matter.” Hallman asked him twice in the autumn whether anything had been done, and was told it had been passed on. “All I can remember,” Karrasch said, “is in the fall of ‘78 that things were very, very busy . . . and my attention and the whole group’s attention [was given] to what were perceived to be higher priority matters.” Some time between 15 January and 15 March 1979 the two men met at the soda machine in the company’s building at Lynchburg, and Hallman asked a third time. Karrasch’s recollection is that he then read the memorandum “quite carefully”, agreed with Dunn’s recommendations, and told Hallman to take the action himself. Hallman’s recollection is that Karrasch told him “there was no problem.” “That response was confusing,” Hallman testified. “I did not realize at the time whether he [Karrasch] meant there was no problem with action or there was no problem with operator inaction, and I did not ask him for a clarification at that time.” He waited two weeks for something in writing, tried once or twice to reach Karrasch, and did not. Customer service took no action before the accident.

“Seven days after the TMI-2 accident,” the chief counsel wrote, “an instruction was finally sent by B&W to its utilities. The instruction was essentially what Bert Dunn had proposed 14 months earlier in his memorandum to Taylor.” The NRC’s Bulletin 79-05A said the same thing to every operator of a Babcock & Wilcox plant. On 25 September 1979 a transient at Virginia Electric’s North Anna Unit 1 started the high pressure injection; the operators, as the bulletin required, left it on for twenty minutes, and the system repressurised.

The Michelson report, 1977 to 1979

At about the time of the Davis-Besse transient Carlyle Michelson, an engineer of the Tennessee Valley Authority who was also a consultant to the NRC’s Advisory Committee on Reactor Safeguards, took it on himself to analyse what a very small break would do in a Babcock & Wilcox plant, including one at the top of the pressuriser, where the relief valve is. His draft was dated September 1977 and a revision January 1978. On the pressuriser he concluded: “A full pressurizer is not considered a reliable indication for prescribing certain operator actions such as HPI pump trip.” The level, he wrote, would not necessarily reflect the water in the vessel; the main coolant pumps should be turned off in such a case; and emergency procedures and operator training should cover very small breaks.

In the early autumn of 1977 Michelson gave a handwritten draft to Jesse Ebersole, a member of the advisory committee. In or around October Ebersole sent a copy to Sanford Israel of the reactor systems branch in the NRC’s Office of Nuclear Reactor Regulation, who passed it to a colleague, Gerald Mazetis. They were the only two people in the office who had it, and neither saw anything in it that was “new or different.” In January 1978 Israel nevertheless wrote a note on the report’s chief concern, that in certain circumstances the pressuriser level would not show the level in the vessel and operators could be misled into turning off the emergency cooling. He could not afterwards say whether he wrote it because of the report, because of Davis-Besse, because of questions Ebersole had put to an applicant for a licence, or all three. The note, dated 10 January 1978, was signed by his supervisor, Thomas Novak, and went to about fifteen people in the office. It produced no technical interest. A question based on it was drafted for a Westinghouse plant whose licence was then cancelled, and never sent. The Special Inquiry put it in a sentence: the memo “was not circulated outside NRR and the issue was not identified as a possible generic safety problem for operating plants; it was simply filed away.”

Ebersole received Michelson’s typed revision in January 1978 and did not distribute it in the NRC until after the accident. On 27 April 1978 the TVA sent the report to Babcock & Wilcox with a letter asking it to respond. The company’s reviewer saw no substantive safety issue and gave it a low priority; Dunn, briefed on it by his deputy, recognised his own concern of three months before and did not check whether the customers had been told. The reply reached the TVA nine months later, dated 23 January 1979, and did not satisfy Michelson, who wrote again on 8 February 1979. The company had not answered the second letter when the valve stuck at Three Mile Island on 28 March. After the accident Michelson was made director of the NRC’s new Office for Analysis and Evaluation of Operational Data, the office whose absence the Senate’s report had spent a chapter describing.

The inspector, 1978

Inside the NRC the Davis-Besse transient was analysed by the licensing office, which was interested, the Special Inquiry found, “in the behavior of the reactor’s engineering subsystems than in the operators’ problems”, and found no unresolved safety question. The licensing office suggested to the inspection office that Toledo Edison be asked to address the shutting off of the injection in its formal report; “no significant action resulted from this effort.” The event went into the Grey Book. Some months later James Creswell, an inspector in the agency’s Region III office in Illinois, raised the point that the operators might have been wrong to turn the injection off, and pressed it until Davis-Besse’s emergency procedures were changed to caution operators against doing so in the event of a leak in the pressuriser. Toledo Edison adopted the new precautions at the insistence of Creswell and his supervisor. They were not communicated to Babcock & Wilcox, or to other utilities, and the regional office did not flag the issue to headquarters. The Special Inquiry’s sentence on the whole chain is the one the entry quotes in part: “the agency’s fragmented bureaucracy, its preoccupation with hardware and design questions, and the lack of any clearcut responsibility for identifying significant operating problems and warning operators about them combined to prevent the real message of Davis Besse from getting to Three Mile Island.”

Beznau, 1974

There was an earlier case still. In 1974 a Westinghouse reactor at Beznau in Switzerland had the same failed-open relief valve and the same misleading indication that the primary system was full of water, and the Swiss operators diagnosed and corrected it in minutes. Westinghouse took the event as confirming its own earlier study that operators would have time to react to a stuck valve, and told neither its customers nor the NRC that operators might be misled by their instruments. The NRC learnt of Beznau after Three Mile Island.

What the trail shows

The chief counsel counted five incidents that foreshadowed the accident and three organisations that analysed them. Each found the lesson; each kept it. At Lynchburg the question was asked in November 1977, answered correctly in February 1978, and then handed from one department to another on the ground that it was on the wrong form, until a conversation at a soda machine that the two parties remember differently. At the NRC it was read by two men, written up by one, and filed. In Illinois an inspector got it into one plant’s procedures and no further. None of the people in this piece were in the control room at Three Mile Island. None of the people in the control room had read a word of it.

Sources

• Stanley M. Gorinson and Kevin P. Kane, Report of the Office of Chief Counsel on the Role of the Managing Utility and Its Suppliers, President’s Commission on the Accident at Three Mile Island, October 1979, pages 129 to 136 and appendices J to N. The Davis-Besse features and “almost exact duplication”; Kelly’s briefing and memorandum; Lind; the Walters reply; the Dunn memoranda; Taylor’s deposition; the Hallman memorandum; Karrasch’s and Hallman’s depositions; the instruction of seven days after; Bulletin 79-05A and North Anna. Read in the Idaho National Laboratory’s TMI-2 archive copy, through the Wayback Machine. web.archive.org
• Subcommittee on Nuclear Regulation, Committee on Environment and Public Works, US Senate, Nuclear Accident and Recovery at Three Mile Island: A Report, Serial No. 96-14, June 1980, chapter 6, “Related Accidents at Other Plants”. Oconee, Davis-Besse, the Grey Book, Creswell, Michelson’s conclusions, Ebersole, Israel, Mazetis, Novak, the TVA’s letter and B&W’s reply. archive.org
• Mitchell Rogovin and George T. Frampton, Jr., Three Mile Island: A Report to the Commissioners and to the Public, NUREG/CR-1250, Volume I, January 1980, part II chapter 1, “Systematic Evaluation of Operating Experience”. Beznau, the draft B&W procedure, the NRC memo “simply filed away”, and the sentence on the fragmented bureaucracy. Read in the INL archive copy, through the Wayback Machine. web.archive.org