ML14167A165
| ML14167A165 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse, Crane  |
| Issue date: | 06/02/2014 |
| From: | Derivan M Public Commenter |
| To: | Macfarlane A NRC/Chairman |
| Wellock, Thomas, SECY | |
| Shared Package | |
| ML14167A167 | List: |
| References | |
| LTR-14-0339 | |
| Download: ML14167A165 (13) | |
Text
June 2, 2014 Honorable Allison M. Macfarlane Chairman of the U.S. Nuclear Regulatory Commission Mail Stop 0-16G4 Washington, DC 20555-0001
Dear Ms. Macfarlane,
As we pass the thirty fifth anniversary of the Three Mile Island accident, I am contacting you, unsolicited and unknown to the TMI operators on duty the night of the accident:
Mr. William Zewe, TMI-1 and TMI-2 Shift Supervisor Mr. Fred Scheimann, TMI-2 Shift Foreman (Deceased)
Mr. Edward Frederick, TMI-2 Control Room Operator Mr. Craig Faust, TMI-2 Control Room Operator I personally have done-significant resean:hon the accident and can speak first hand to the essentially similar event that occurred at Davis Besse :in 1977. *In-my opinion, justice has never been served for these individuals. They have lived a life of professional and personal disgrace and embarrassment for a "crime" they never committed, for which -they never received a full, fair, and complete hearing in a court of law, and basically remain "convicted" in*both the court of public opinion, and some official documents, for being the root cause of the TMI-2 accident.
I think it leaves a terrible black mark on an Industry and also prevents full closure of the event by allowing this injustice to remain open for so long. You are in a position to correct it. These individuals were the victims of an industry breakdown, not the cause of one. I explain the details of my conclusions of the real root cause of the TMI accident at my website:
http:Uwww.nukeknews.com/index.html I firmly believe that operator error was not the root cause of the TMI-2 Accident, but it is the perception/ and even the stated position in some official documentation. The real root cause of the TMI--2 Accidentwas a failure ofthe entire PW.R Jndustry1includingits regulatory body1 to correctly understand the plant response ~o-a.teak in the.st~,~_m space of a P.WR-pressuriz-er; and the failure to heed at least four* pre-TMI-2.event.precursor warnings" Some of the TMI-2 operator errors did contribute to the accident severity1 but are certainly not the root cause that put them outside of the plant design basis understanding of a small break loss of coolant
accident (LOCA) in the pressurizer steam space.
1 urge you to especially consider my discussion of relevant pre-TMI known warning information also at my website:
http://www.nukeknews.com/Precursor%20Events.htmi So what exactly are these TMI-operators guilty of doing or not doing? Not being as insightful as H. Dopchie?, or not understanding the generic implications of Dopchie's concerns, as the AEC people failed to do?, or when an actual PWR event occurred at Beznau in Switzerland, not grasping the generic implications for all PWRs as the AEC people also failed to do? Or are they guilty of ignoring the Michelson warning to the NRC that this misunderstood condition "would lead Operators to (mistakenly) terminate High Pressure Injection flow based on the response of the Pressurizer level"? Or maybe they are just guilty of not being as perceptive as me, when, as a Shift Supervisor, I faced this same industry wide misunderstood event response to a small break LOCA in the pressurizer steam space on September 24, 1977? With all the known pre-cursor events, even I should not have had to face this outside design basis event. What exactly is their "crime", not figuring out something in the heat of battle in the control room that the entire industry and regulators failed to grasp despite all the warnings? I believe it is not even reasonable to expect them to be able to do that, much less designate operator error as the root cause of the TMI accident. Consider their working environment, training, procedures, and control room design flaws at that time; everything that eventually got changed by TMI-2. These Operators were virtually working inside a "trap" through no fault oftheir own; it's my firm belief if it hadn't been them it would have been someone else at a different PWR. Until justice is served for these four TMI-2 Control Room Operators, whose lives were ruined by this event, in my opinion, you still have an open post-TMI-2 Action Item to properly resolve.
I do not see any down-side risk associated with someone like you, as NRC Chairman, in an official capacity, to acknowledge this injustice to the TMI control room operators. It has been thirty five years since the TMI-2 accident; I'm not asking that blame be assigned anywhere. The two companies originally involved in the "blame" process (via a law suit) do not even exist anymore as the same entities. I just ask that Operator Error be removed as the root cause of the accident so these four operator's reputation can be restored. It is just flat out the right thing to do, both technically and morally and it provides needed closure for this event.
I believe that there is precedent for what needs to be done to correct this injustice. Presidents and State Governors "pardon" actual convicted criminals all the time. The TMI-2 Operators are "guilty" but committed no crime, and in fact never even were provided the opportunity for an unbiased fair hearing. They were assumed to be guilty from the on-set and the official
investigations were out to prove it.
I'm sorry I don't have a specific suggestion for what needs to be done to resolve this from a regulatory perspective, but I trust you and your staff can come up with something appropriate.
I am also willing to discuss my conclusions as stated on my web site with any of your staff members if you feel the need. Thank you for listening.
Respectfully, Michael J Derivan 1/~
J-...0~
Shift Supervisor during the Davis Besse NPP TMI-2 Precursor Event SRO 2869, Retired P.O. Box 1162 Bisbee, AZ 85603
..ll 1"-
fTI CJ 1:(]
.::r
~~~~*~
CJ 1"-
.::r CJ
..=I
..=I CJ
-~
~ -
~ -
=::;:
Joosten, Sandy From:
Sent:
To:
Cc:
Subject:
Attachments:
Honorable Allison M. Macfarlane mjd < mjd@nukeknews.com >
Thursday, July 10, 2014 3:02 PM CHAIRMAN Resource CMRSVINICKI Resource; CMRMAGWOOD Resource; CMROSTENDORFF Resource TMI2 Accident/Operator Error Letter Root Cause.docx Chairman of the U.S. Nuclear Regulatory Commission This email concerns my letter to you, dated June 2, 2014 on the subject of Operator Error and the TMI2 Accident. My original intent for that letter was to keep it short so I did not provide any specific technical details explaining the basis for my position. It was my belief at that time that further communication responding to my concern would occur in some form with NRC Staff assigned to prepare a response, prior to that response being finalized.
Recent communications with NRC personnel, including a verification of receipt of my letter by the Commission Secretary, all indicate "a response is being prepared." One communication even said I might receive it by the end of the month.
A literal interpretation of those statements implies to me that no further clarifying information will be requested from me before the response is finalized.
This is a significant concern to me, as the history trail is old and it is a formidable task for someone to unravel the details of the basis for my concern without hearing that basis.
The attached document provides the high lights of that basis, along with references. I would like for the document to be available to any staff currently preparing a response, prior to the response being finalized.
Thank you very much, Michael J. Derivan 1
J
July XX, 2014 To Whom It May Concern, The purpose of this letter is to provide the basis for my request that the TMI2 control room operators be officially exonerated as being the Root Cause of the TMI2 accident due to their "Operator Errors." I can't possibly condense half a lifetime of research and thought on this issue into a meaningful short letter, so I will just provide the high lights of that process here.
There were two specific areas in the investigations of the TMI2 Accident that were never really considered fully, that bear directly on the consensus opinion of the Root Cause of the accident.
Those were the specifics of the Babcock and Wilcox Company simulator training for Operators in that era, and exactly how all the precursor event warnings broke down and failed to prevent the accident. I don't want to rehash all my suspected reasons for the Investigation Report results, as they are not important to make my point, rather I focus on the effect of it and how it affected the conclusions. My focus here is the precursor warnings. I am willing to provide you more information on the simulator training, and how the TMI2 Operator's voice on their behalf got silenced during the GPU vs. B& W law suit if you care to hear it. That voice was me; and my testimony was not allowed because it was judged to be irrelevant. Very strange ruling indeed considering truck drivers, bus drivers, train engineers, airline pilots, etc. are all trained on simulators. And even the NRC post-TMI actions required all Nuke Plants to have a plant specific simulator.
I would characterize the handling of these two subjects in both the Kemeny and Rogovin Investigations as similar to a partial AP story writing style; the what, where, when were discussed, but not the who, or why. And therein partially lays the fundamental cause of the breakdown of addressing the Root Cause of the TMI2 Accident.
There is also one astonishing factual omission, especially in the Kemeny Report section "Causes of the Accident." This factual omission is likely the basis for the previously mentioned two specific areas not being investigated fully. The factual omission is that it was never specifically, clearly acknowledged, that the whole PWR Industry did not understand the correct response of the Reactor Coolant System, especially the Pressurizer level response, to a LOCA in the steam space of the Pressurizer. Virtually the whole PWR Industry believed the Pressurizer level would decrease, like a leak in the water space of the Reactor Coolant System for this event.
It is an astonishing omission; because that issue is the whole crux of the relevant technical issue noted and discussed in the Investigation Reports for all the TMI precursor events. It is indisputable that a correct handing of the precursor event warnings would have prevented the TMI2 Accident. So it has to follow that the failure of that process contains the Root Cause of the TMI Accident. Butthat Root Cause of Failure was never determined, or addressed, in the Investigation Reports. Rather the Report focus seemed to shift to fixes, for prevention of another TMI type accident.
The technical cause ofthe TMI2 accident was the failure of the PWR industry as a whole to understand the correct plant response to a leak in the Pressurizer steam space of a PWR. This has been much discussed elsewhere.
The Root Cause of the TMI2 accident was the fact the TMI2 control room operators did not have the benefit of any lessons learned by actual precursor events. These precursor events clearly showed the misunderstanding of this event in two PWR vendors and by extension also the AEC.
Virtually everyone who understands PWRs will agree if the lessons pointed out in the precursor events had made their way into the knowledge base of the industry and also the knowledge base of the TMI2 control room operators, TMI2 would have been prevented. Inherent in that statement is that the Root Cause of the TMI2 accident must therefore inherently lay within the failure to act upon those precursor events.
My contention is that since a Root Cause of that failure was never determined by the "official" investigations, the default opinion has become TMI2 was caused by Operator Error. Plenty of documentation supports this contention to be a fact.
From the Kemeny Commission Report Kemeny Commission Report (from PDF page 15 of 178)
"Other investigations have concluded that, while equipment failures initiated the event, the fundamental cause of the accident was "operator error." It is pointed out that if the operators (or those who supervised them) had kept the emergency cooling systems on through the early stages of the accident, Three Mile Island would have been limited to a relatively insignificant incident. While we agree that this statement is true, we also feel that it does not speak to the fundamental causes of the accident."
The first sentence is the most troubling and it is also the general perception.
It is extremely troubling to me that the Kemeny Commission would recognize this false impression of Operator Error, yet felt no need to correct it.
The Kemeny Commission Report then shifts to "contributing factors" discussion.
It does identify most of the key contributing factors.
But it does not identify a Root Cause.
The default position then becomes Operator Error.
One reason this may have occurred is stated in the charge to the Commission by President Carter (PDF page 12 of 178): "will make recommendations to enab!e us to prevent any future nuclear accidents."
This charge can be somewhat carried out without determining a Root Cause, but it leaves the perception stated in the first sentence as the general default conclusion.
From the Rogovin Investigation Report (from Volume 1, PDF starting page 102 of 196)
This section ofthe report is titled "Conclusions and Recommendations."
Discussion then shifts to a bullet list of needed changes.
No Root Cause is ever identified, thus the perception identified in the Kemeny Report becomes the default Root Cause.
To its credit, the Rogovin Report does state this (PDF page 115 of 196) when discussing each bulleted list needed change:
"Some previous analyses of the Three Mile Island accident have been read to attribute it to "operator error." We reject this conclusion as being incomplete.
While there is no question that operators erred when they interfered with the automatic operation of the high pressure injection (HPI) system even though conditions that had initiated the system (low pressure) persisted, we believe there were a number of important factors not within the operators' control that contributed to this human failure."
There are two problems here; the first is again acknowledging a "perception" of Root Cause that is wrong but no feeling of a need to correct that perception is addressed. The second is since this information is never stated in any "executive summary" format it becomes lost as critical information.
The real big problem is since neither the Kemeny nor Rogovin Report (the official investigations) stated a Root Cause, because they didn't do that determination, the "perception" becomes the default Root Cause.
Wikipedia article on Three Mile Island Accident "The Kemeny Commission noted that Babcock and Wilcox's PORV valve had previously failed on 11 occasions, nine of them in the open position, allowing coolant to escape. More disturbing, however, was the fact that the initial causal sequence of events at TMI had been duplicated 18 months earlier at another Babcock and Wilcox reactor, the Davis-Besse Nuclear Power Station owned at that time by Toledo Edison. The only difference was that the operators at Davis-Besse identified the valve failure after 20 minutes, where at TMI it took 80 minutes, and the Davis-Besse facility was operating at 9% power, against TMI's 97%.
Although Babcock engineers recognised the problem, the company failed to clearly notify its customers of the valve issue.Lill Upon his return to Dartmouth, Kemeny addressed Dartmouth college students. When asked what caused the meltdown, he replied that the proximate cause would probably never be known."
Therein lays the problem. The proximate cause is in fact known, but it has never been acknowledged by any "official" body, so the incorrect perception of Operator Error prevails in the general opinion.
From Some Current NRC Web Page Information From a link to NRC training index, B&W cross training for NRC personnel Gust an index, details are in the index links):
http://pbadupws.nrc.gov/docs/ML1122/ML11220A282.html From the index, notice two NRC training documents on TMI, a short one and a longer one.
- 1. From the short one here:
pbadupws.nrc.gov/docs/ML1122/ML11221A326.pdf From PDF page 13 of20:
During the accident, there apparently was much concentration on the water level in the pressurizer. This, by the way is natural, because tile operators !<new to never let the prcs.:s.uriz:c:r get cn-.pty (or full). It is, therefore, ut~c:lcrsuu-.d<:.blc thut they would t"'ot be trying to imagine boHing occurring e.lsewhere fn the system.
During tilts transtent, the system pressure and temperature and tllelr relationship to saturated steam conditions were not correlated, at least not in the control room; the operators were much too busy to think about the steam tables. VIle must endeavor to l<eep in mind the fact that if p;essure drops, we can have DNB occur which ultimately will create partial film boiling in the reactor.
These two paragraphs are a misrepresentation with the words "imagine" and "too busy" as they shift the thought process of these operators at that time to require understanding a brand new plant response to an event they had been trained wrong to deal with. They did not "imagine" anything, they used the model they had been taught, and that model was wrong.
- 2. From the long one here:
pbadupws.nrc.gov/docs/ML1122/ML11221A325.pdf from PDF page 8 of 50:
The operatoil' bypassed the ES system and reduced the makeup flow, but the pressurtzer level continued to mcrease rap<dly. Pressure did not rise and even began to rno'<'e st;gl'l!ly downward. Tl">e reason for th.e anon*aly of rising pressunzer level and decreasing pre.ssure was not.-ecognrzed by !he operators. Trained to avoid a solid pressurizer. ~ey stopped mak*eup pump "*1C" and increased f,etdown flow toils h*igh limit.
thereby lemporarHy arresting the rate of pressurizer level increase.
This discussion of "anomaly" here represents the crux of my argument about why these operators never got a fair hearing. It is totally ignored that the four precursor events, which pointed out that "anomaly" in pressurizer response, is the "normal system response" and were all known before TMI. But that ball got dropped by everyone who looked at those events, and because Root Cause of that ball dropping was never looked at, the TMI operators got blamed.
I also can't come up with a PC adjective to describe my feeling about NRC training calling the normal Mother Nature correct response of the plant to this event "the anomaly." While every other thing about the handling of the precursor events was wrong, I guess that is considered the "normal" standard, but the correct response of the plant to the event is considered "the anomaly." It's at least bizarre.
From the NRC Backgrounder here "Summary of Events", second paragraph:
http://www.nrc. gov /reading-rml doc-collections/fact -sheets/3 mile-isle. html "As a result, plant staff assumed (emphasis added) that as long as the pressurizer water level was high, the core was properly covered with water."
This is a false statement in the NRC Backgrounder, it was the assumption from the start of the investigations, still is, and the whole point of my argument. We Operators did not "assume" anything, we used the wrong information we were given in our training, and confusing single event Emergency Operating Procedures. This is our legal responsibility and why we are licensed.
Then all four TMI precursor event warnings failed to correct the "plant response understanding" mistake. Since a Root Cause determination of that failure was never done, the TMI Operators are the only folks to get specific blame.
From the Professional Reactor Operator Society (PROS) Web Page I strongly suggest you read this description on the PROS History Page http:/ /www.nucpros.com/history It is an accurate representation of what Licensed Operators think and feel about this issue. It was the basis for the founding of PROS, and clearly points out the perception caused by the failure to do a Root Cause analysis on the TMI2 accident.
From a Recent NRC Blog Post, June 26, 2014 The link is here: http://public-blog.nrc-gateway.gov/20 14/06/26/failed-bolts-bedevil-a-nuclear-plant/
A quote:
"PSEG, the owner and operator of the Salem and Hope Creek plants, will have to not only repair the Salem Unit 2 pumps but evaluate what went wrong. For now, the plant remains out of service while this work is taking place. NRC inspectors and specialists will closely follow these activities.
One area for consideration will be whether the problem could have been avoided based on previously available information." (Emphasis added)
At this point it is just too tempting to go snarky. What exactly is this, a Root Cause determination? The most significant event in US Nuke Power history never had one, but this event needs one, why is that? Or just empty words, or double standard, or "what's good for the goose, is not good for the gander." A response to these questions is unnecessary but hopefully you get the point.
Summary of Indisputable Facts: (taken from the Kemeny and Rogovin Reports)
In 1971 H. Dopchie postulated a TMI type PWR event, at a two-loop Westinghouse European PWR, and reported it to AEC In 197 4 H. Dopchie's postulated event actually happened at the Beznau, Switzerland NOK 1 plant and it was reported to AEC In 1977 Michelson postulated a TMI type event at a US B& W PWR and reported it to AEC In 1977 Michelson's postulated event actually happened at Davis Besse and we reported it to AEC
At this point no corrective action was taken to get the word out to all US PWRs This point represents a Double/Double failure (2 postulated events, 2 actual events) of the whole process 18 months before TMI; virtually everybody who understands the TMI event agrees some very simple corrective actions, directly to PWR Operators, would have prevented TMI Virtually everybody who understands PWRs will agree TMI was 1 00% preventable, by a few words of actual system response training for this SBLOCA, a few system response pictures, and a one-sentence change to HPI guidance on system sub-cooled margin. All 18 months before TMI Yet it didn't happen for various reasons, none of which can be blamed on the TMI Operators The result ofthose failures is a junked 4 billion dollar plant and four lives ruined The Dopchie letter provided enough information to point out a significant design deficiency in Westinghouse two-loop PWR High Pressure Injection actuation and his description of the actual plant response to the event provided enough information to point out this problem was generic to all PWRs at that time. This happened because virtually all PWRs of that time misunderstood the correct plant response to this event.
The Beznau event confirmed Dopchie' s claims, and provided the second opportunity to understand this issue was generic to all PWRs. It also proved the "designed for" response was wrong.
Michelson's Report again postulated the same event in a US PWR design, because of the same misunderstanding, even to the point of saying Operators would mistakenly terminate HPI. The on-going discussions about Michelson's Report provided more than ample opportunity for a Regulatory agency to understand the generic seriousness and implications for all US PWRs and initiate corrective action. It again proved the event understanding was wrong.
So then the Davis Besse event occurs and we Operators respond, exactly as Michelson predicted, and terminate HPI based solely on our misunderstanding of the correct Pressurizer level response for the event.
It is still eighteen months before TMI occurs.
Now to the Present Day Virtually all nuke organizations today brag about how everything is improved post.:. TMI.
Virtually all licensed Operator candidates and current licensed Operators must prove proficiency in dealing with the TMI2 type event during Simulator training sessions on a periodic basis.
Virtually all nuke plants are required to exercise their "improved" Emergency Plans, full blown effort, every few years.
To fully exercise all the off-site agencies, obviously all protection (fission product) barriers have to fail.
I can read and evaluate the results of those drills in Public Documents providing reassurance that things have improved.
NRC also is fond of saying how all their processes have improved post-TMI.
Prove it to me, here's your drill scenario, walk it through your current process and provide me your in-house process and procedure references, check lists, documentation, etc:
- 1. You receive the H. Dopchie letter today; run it through your new process, provide your results and conclusions There obviously was a serious design deficiency identified here Provide documentation to show your improved process can see this is also a generic PWR problem (perhaps a checklist question?)
- 2. That barrier fails, so next comes the Beznau incident info Again, run it through your new in-house process Prove your review process can identify a design error and take corrective action for US Westinghouse PWRs With the added insight of the Dopchie letter, prove your improved process can identify a generic PWR problem Since a warning was missed (a barrier failure), show me your Root Cause of Failure determination for why the Dopchie letter didn't result in this being a non-issue for US Westinghouse operating PWRs (before the 3 year delay to Beznau) and this issue is also generic to all US PWRs Identify who failed or made an error, as in Root Cause determination
- 3. That barrier also fails, so now the Michelson Report comes to the AEC Again, run it through your new in-house process Prove with the insight of the Dopchie letter, the Beznau incident, and the Michelson Report, using your new process, somebody grasps you have a serious PWR generic issue Again, show me your Root Cause of Failure determination for why the failure to recognize the generic PWR issue occurred after the Dopchie and Beznau warnings Identify who failed or made an error, including everyone/department who touched the ISSUe
- 4. That barrier also fails, so now comes the Davis Besse September 24, 1977 event Again, run it through your new in-house process Prove with the insight of the three TMI precursor events coupled with the Davis Besse event someone finally grasps a serious PWR generic problem Provide your corrective actions to prevent recurrence Congratulations, if your new process works, you just prevented TMI, but your work is not done Again, show me your Root Cause of Failure determination for why the failure to recognize the generic PWR issue occurred after the Dopchie, Beznau, Michelson, and Davis Besse warnings, such that corrective action was not initiated for all US PWRs
Identify who failed or made an error, including everyone who touched the issue up to this point
- 5. But of course, as history shows, that barrier also failed, thus comes TMI eighteen months after the Davis Besse event At this time most of your Root Cause of Failure determination process (to prevent a TMI) is already completed above in this drill exercise, and hopefully documented as part of this drill, using your new and improved procedures Of course, I'm stopping the drill after Davis Besse but a month before the TMI2 accident At this point how many TMI Operators are on your Root Cause of Failure list? Please explain to me how they are the Root Cause of the TMI2 Accident when TMI has not yet even occurred All your drill analysis, Root Cause determinations, etc. for the precursor events in this drill are valid, TMI Accident or no TMI Accident; because these events actually happened so a Root Cause can be determined. Or your new process is crap.
Again, how many TMI Operators are on your list?
Sorry to be a nuisance, but seems like all organizations would want to exercise their in-house capabilities occasionally. And it seems especially appropriate for a drill of this type, to have actual factual case information to work with, not the hypothetical non-realistic barrier failures that Nuke Plant drill scenario writers have to assume. Because something similar, but a completely different issue might pop up in the future, and I know everyone wants to have proven confidence in their process. These drills provide that confidence.
What I have asked in this exercise drill obviously has a different purpose. For a lot of reasons it was never done after the TMI Accident. It needs to be done, not only for closure, but also to correct an injustice. It also needs to be done for your own assurance that all the Corrective Actions to prevent recurrence of a TMI2 type accident have been identified. Without an identified Root Cause, you have no basis to claim all the needed Corrective Actions have been identified. So you are depending on either blind faith or dumb luck. I strongly feel this needed exercise drill will clearly prove Operator Error was not the Root Cause of the TMI2 Accident.