ML19249D933

Rept to Congress on Aos, Jan-Mar 1979

ML19249D933
Person / Time
Issue date:	07/31/1979
From:	NRC OFFICE OF MANAGEMENT AND PROGRAM ANALYSIS (MPA)
To:
Shared Package
ML19249D934	List: ML19249D933
References
NUREG-0090, NUREG-0090-V02-N01, NUREG-90, NUREG-90-V2-N1, NUDOCS 7909250570
Download: ML19249D933 (43)

Text

{{#Wiki_filter:NUREG-0090 Vol. 2, No.1 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES January - March 1979 p'%, .?. Office of Management and Program Analysis U. S. Nuclear Regulatory Commission (1909250 6 70 1019 132

Available from U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Available from National Technical Information Service Springfield, Virginia 22161 1019 l33

NUREG-0090 Vol. 2, No.1 REPORT TO CONGRESS ON ABNORMAL OCCURRENCES January - March 1979 Status as of July 13,1979 Date Published: July 1979 Office of Management and Program Analysis U. S. Nuclear Regulatory Commission Washington, D.C. 20555 1019 134

iii ABSTRACT Section 208 of the Energy Reorganization Act of 1974 identifies an abnormal occurrence as an unscheduled incident or event which the Nuclear Regulatory Commission determines to be significant from the sh ndpoint of public health or safety and requires a quarterly report of such events to be made to Congress. This report, the sixteenth in the series, covers the period from January 1 to March 31, 1979. The following incidents or events, including any submitted by the Agreement States, in that time period were determined by the Commission to be significant and reportable: 1. There were three abnormal occurrences at the 70 liuclear power plants licensed to operate. One was the nuclear accident at Three Mile Island, the second involved deficiencies in piping design (resulting in five plants being shut down), and the third involved degraded engineered safety systems. (Note - Although the formal procedural determinations for the first two items were not completed in the first quarter of calendar 1979, the events are included because of their importance and the extensive publicity they received.) 2. There was one abnormal occurrence at fuel cycle facilities (other than nuclear power plants). The event pertained to an extortion attempt involving alleged theft of licensed material. 3. There were no abnormal occurrences at other licensee facilities. 4. There were no abnormal occurrences reported by the Agreement States. This report also contains information updating a previously reported abnormal occurrence.

iv TABLE OF CONTENTS PAGE ABSTRACT....................................................... iii PREFACE........................................................ v INTRODUCTION.............................................. v THE REGULATORY SYSTEM..................................... Vi REPORTABLE OCCURRENCES.................................... Vii AGREEMENT STATES........... viii REPORT TO CONGRESS ON ABNORMAL OCCURRENCES, JANUARY-MARCH 1979.......................................... 1 NUCLEAR POWER PLANTS...................................... 1 79-1 Degraded Engineered Safety Systems.............. 1 79-2 Deficiencies in Piping Design................... 7 79-3 Nuclear Accident at Three Mile Island........... 11 FUEL CYCLE FACILITIES (OTHER THAN NUCLEAR POWER P LA N T S )................................................. 27 79-4 Extortion Attempt Involving Alleged Theft of Licensed Material.................... 27 OTHER NRC LICENSEES (INDUSTRIAL RADIOGRAPHERS, MEDICAL INSTITUTIONS, INDUSTRIAL USERS, ETC.)........... 29 AGREEMENT STATE LICENSEES................................. 29 APPENDIX A - ABNORMAL OCCURRENCE CRITERIA...................... 30 APPENDIX B - UPDATE OF PREVIOUSLY REPORTED ABNORMAL OCCURRENCES..................................... 33 AGRFEMENT STATE LICENSEES................................. 33 1019 i36

v PREFACE INTRODUCTION The Nuclear Regulatory Commission reports to the Congress each quarter under provisions of Section 208 of the Energy Reorganization Act of 1974 on any abnormal occurrences involving facilities and activities regulated by the NRC. An abnormal occurrence is defined in Section 208 as an unscheduled incident or event which the Commission determines is significant from the standpoint of public health or safety. Events are currently identified as abnormal occurrences for this report by the NRC using the criteria delineated in Appendix A. These criteria were promulgated in an NRC policy statement which was published in the Federal Register (42 FR 10950) on February 24, 1977. In order to provide wide dissemination of informa-tion to the public, a Federal Register notice is issued on each abnormal occurrence with copies distributed to the NRC Public Document Room and all local public document rooms. At a minimum, each such notice contains the date and place of the occurrence and describes its nature and probable consequences. The NRC has reviewed Licensee Event Reports, licensing and enforcement action (e.g., violations, infractions, deficiencies, civil penalties, license modifica-tions, etc.), generic issues, significant inventory differences involving special nuclear material, and other categories of information available to the NRC. The NRC has determined that only those events, including those submitted by the Agreement States, described in this report meet the criteria for abnormal occurrence reporting. This report, the sixteenth in the series, covers the period between January 1 -March 31, 1979. Events which occurred during this quarter and are later determined to be abnormal occurrences will be included in the next quarterly report, unless the importance of the events warrants their inclusion in the earlier report. Some events require considerable time and effort to analyze due to the complexity of situations where actual con-sequences are not readily apparent and additional facts are required. Information reported on each event includes: date and place; nature and probable consequences; cause or causes; and actions taken to prevent recurrence. t 1019 137

vi THE REGULATORY SYSTEM The system of licensing and regulation by which NRC carries out its responsi-bilities is implemented through rules and regulations in Title 10 of the Code of Federal Regulations. To accomplish its objectives, NRC regularly conducts licensing proceedings, inspection and enforcement activities, evaluation of operating experience and confirmatory research, while maintaining programs for establishing standards and issuing technical reviews and studies. The NRC's role in regulating represents a complete cycle, with the NRC establishing standards and rules; issuing licenses and permits; inspecting for compliance; enforcing license requirements; and carrying on continuing evaluations, studies and research projects to improve both the regulatory process and the protection of the public health and safety. Public participation is an element of the regulatory process. In the licensing and regulation of nuclear power plants, the NRC follows the philosophy that the health and safety of the public are best assured through the establishment of multiple levels of protection. These multiple levels can be achieved and maintained through regulations which specify requirements which will assure the safe use of nuclear materials. The regulations include design and quality assurance criteria appropriate for the various activities licensed by NRC. An inspection and enforcement program helps assure compliance with the regulations. Stringent requirements for reporting incidents or events exist which help identify deficiencies early enough to prevent serious consequences and aid in assuring that prompt and effective correctiva action is taken to prevent their recurrence. Most NRC licensee employees who work with radioactive materials are required to utilize personnel monitoring devices such as film badges or TLD (thermo-luminescent dosimeter) badges. These badges are processed periodically and the exposure results normally serve as the official and legal record of the extent of personnel exposure to radiation during the period the badge was If an individual's past exposure history is known and has been suffi-worn. ciently low, NRC regulations permit an individual in a restricted area to receive up to three rems of whole body exposure in a calendar quarter. Higher values are permitted to the extremities or skin of the whole body. For unre-stricted areas, permissible levels of radiation are considerably smaller. Permissible doses for restricted areas and unrestricted areas are stated in 10 CFR Part 20. In any case, the NRC's policy is to maintain radiation exposures to levels as low as reasonably achievable.

i 1019 138

vii REPORTABLE OCCURRENCES Since the NRC is responsible for assuring that regulated nuclear activities are conducted safely, the nuclear industry is required to report incidents or events which involve a variance from the regulations, such as personnel over-exposures, radioactive material releases above prescribed limits, and malfunctions of safety-related equipment. Thus, a reportable occurrence is any incident or event occurring at a licensed facility or related to licensed activities which NRC licensees are required to report to the NRC. The NRC evaluates each reportable occurrence to determine the safety implications involved. Because of the broad scope of regulation and the conservative attitude toward safety, there are a large number of events reported to the NRC. The information provided in these reports is used in the NRC and the industry in their continuing evaluation and improvement of nuclear safety. Most of the reports received from licensed nuclear power facilities describe events that did not directly involve the nuclear reactor itself, but involved equipment and components which are peripheral aspects of the nuclear steam supply system, and are minor in nature with respect to impact on public health and safety. The majority are discovered during routine inspection and surveillance testing and are corrected upon discovery. Typically, they concern single malfunctions of components or parts of systems, with redundant operable components or systems continuing to be available to perform the design function. Information concerning reportable occurrences at facilities licensed or otherwise regulated by the NRC is routinely disseminated by NRC to the nuclear industry, the public, and other interested groups as these events occur. Dissemination includes deposit of incident reports in the NRC's public document rooms, special notifications to licensees and other affected or interested groups, and public announcements. In addition, a biweekly computer printout containing information on reportable events received from NRC licensees is sent to the NRC's more than 120 local public document rooms throughout the United States and to the NRC Public Document Room in Washington, D.C. The Congress is routinely kept informed of reportable events occurring at licensed facilities. 1019 139

viii AGREEMENT STATES Section 274 of the Atomic Energy Act, as amended, authorizes the Commission to enter ir.to agreements with States whereby the Commission relinquishes and the States assume regulatory authority over byproduct, source and special nuclear materials (in quantities not capable of sustaining a chain reaction). Comparable and compatible programs are the basis for agreements. Presently, informatiol on reportable occurrences in Agreement State licensed activities is publicly available at the State level. Certain information is also provided to the NRC under exchange of information provisions in the agreements. NRC prepares a semiannual summary of this and other information in a document entitled, " Licensing Statistics and Other Data," which is publicly available. In early 1977 the Commission determinec: that abnormal occurrences happening at facilities of Agreement State licensees should be included in the quarterly report to Congress. The abnormal occurrence criteria included in Appendix A is applied uniformly to events at NFC and Agreement State licensee facilities. Procedures have been developed and implemented and any abnormal occurrences reported by the Agreement States to the NRC are included in these quarterly reports to Congress. 1019 140

REPORT TO CONGRESS ON ABNORMAL OCCURRENCES JANUARY-MARCH 1979 NUCLEAR POWER PLANTS The NRC is reviewing events reported at the 70 nuclear power plants licensed to operate during the first quarter of 1979. Through the end of March, the NRC had determined that the following events were abnormal occurrences. 79-1 Degraded Engineered Safety Features Preliminary information pertaining to this incident was reported in the Federal Register (44 FR 15804). Appendix A (the third general abnormal occurrence criterion) of this report notes that major deficiencies in design, construction, use of, or management controls for licensed facilities.... can be considered an abnormal occurrence. Date and Place - The event which raised the safety concerns occurred on September 16, 19/8, at the Arkansas Nuclear One (ANO) site and involved both Unit 1 and Unit 2. Arkansas Power and Light Company (AP&L) provided preliminary information to the NRC by telephone on September 19, 1978. Nature and Probable Consequences - On September 16, 1978, an unusual sequence of events occurred at Arkansas Nuclear One, Units 1 and 2. The events involved the electrical power sources and culminated in the spurious activation and degraded operation of Unit 2 Engineered Safety Features (ESF). Analysis of the course of the incident has identified serious deficiencies in the electrical distribution system operation and design. No radiological consequences occurred and the likelihood of such an occurrence was very low. However, three safety concerns emerged from the analysis of these events: (1) The offsite power supply for ANO Unit 1 Engineered Safety Feature loads was deficient in that degraded voltage could have resulted in the unavail-ability of ESF equipment, if it were to be needed. (2) The design of the ANO site electrical system that provides offsite power to Units 1 and 2 did not fully meet the Comraission's Regulations,10 CFR 50, Appendix A, General Design Criterion 17, because in certain circumstances a failure of one of the two offsite power circuits would also result in a failure of the other such circuit. (3) Deficiencies existed in the operation of the Unit 2 inverters that convert battery power to AC power for certain safety-related equipment. I019 141 The sequence of esents was as follows: Unit 1 was operating at 100 percent power; Unit 2 was in hot standby performing hot functional testing in preparation for initial criticality and power operation.1 Unit 1 auxiliary electrical loads were being supplied from the Unit 1 main generator via the unit auxiliary transformer. Unit 2 auxiliary electrical loads were being fed from an offsite source through Startup Transformer No. 3. The normal operating status was interrupted by the failure of the Unit 1 Loop "A" Main Steam Line Isolation Valve (MSIV) air operator solenoid causing the MSIV to close as designed. The Unit 1 Reactor Protection System properly sensed the conditions requiring reactor shutdown and tripped the reactor. The Unit 1 turbine generator tripped concurrently. Because the Unit 1 generator could no longer supply power for the Unit I auxiliary loads, these loads were automatically transferred to Startup Transformer No.1 to supply this power from offsite. The sequence of events should have ended at this point. The power to Startup Transformer No 3, which was feeding Unit 2, and to Startup Transformer No. 1, now feeding Unit 1, normally passes through a single piece of equipment, t he Bus Tie Auto-Transformer. (Figure 1 shows a simplified block diagram of the principal electrical equipment involved in the sequence of events.) The Autc-Transformer has the capacity to provide power for both units, but due to an error, the protective relays were still adjusted for the operation of Unit 1 only. As a result, when both units drew power concurrently, these protection relays tripped and cut of f power to Startup Transformer Nos. 1 and 3. Startup Transformer No. 2, also shown in Figure 1, thus became the only source of offsite power for both Units 1 and 2. The onsite switching equipment automatically transferred the auxiliary loads for both units to this transformer. However, this transformer is designed as an alternate supply for one unit and is not designed to carry full auxiliary loads for both units. For this reason, Startup Transformer No. 2 became overloaded and the voltage dropped on the station distribution system for offsite power. At this time and during most of the incident, operating personnel at both units were unaware of the degraded voltage condition due to the overloaded Startup Transformer No. 2. 2 The events to this point demonstrated the design deficiency described in safety concern (2) above. That is, for certain combinations of Unit 1 2The Unit 2 Operating License did not permit criticality or power operation at the time of the incident. 2Two other events involving degraded voltage for ESF equipment occurred at Millstor.e Unit 2 in July 1976. These events were reported as an abnormal occurrence (No. 76-9) in NUREG-0900-5, Report to Congress on Abnormal Occurrences, July-September 1976. 1019 142 POWER FROM GRIO r BUS TIE \\ AUTO TRANSFORMER STARTUP STARTUP STARTUP TRANSFORMER TRANSFORMER TRANSFORMER NO.1 NO. 2 N O. 3 ANO UNIT 1 4160V ESF BUS ALTERNATE NORMAL 480V ESF BUS SOURCE SOURCE I AC AC DC l l l BATTERIES i i z77777j 7 INVERTER I INVERTER A I-I l l l ~ ~ ~ ~~~ AUTOMATIC I l SWITCH IN NORMAL l l POSITION l l VITAL VITAL l AC AC l I BUS BUS I I I i AC OUT g g INVERTER UNIT ANO UNIT 2 (TYPICAL OF FOUR) (10F 2 ESF TRAINS SHOWN) 1019 I43 Figure 1. Simplified Block Diagram - Electric Distribution A 3 a loss of the Bus Tie Auto-Transformer, which was caused and Unit 2 operation in this case by personnel error, would automatically lead to the overloading of Startup Transformer No. 2. 4 At Unit 2, 8 seconds after the switch to Startup Transformer No. 2, the relays which act to protect Engineered Safety Feature (ESF) equipment from low (degraded) 5 voltage disconnected and therefore deenergized both Unit 2 ESF buses as designed. At the same time, the Unit 2 Core Protection Calculator (CPC) 'istrumentation registered trips which indicated a loss of AC power to the that supply at least two instrument channels. circuitsG The loss of power on two vital instrument buses, which also caused CPC trips, caused, as designed, a fail-safe actuation of all Unit 2 Engineered Safety Features. Thus, when the two Unit 2 emergency diesel generators started and provided power to the previously deenergized ESF buses, the Engineered Safety Features equipment began to operate. However, due to inverter failures, premature activation of the Recirculation Actuation System (RAS) occurred which momentarily opened a flow path between the Refueling Water Tank (RWT) aThese combinations were: 1. Both units in either startup or shutdown mode, or 2. Trip of one unit while the other is in either the startup or shutdown mode, or 3. Simultaneous trip of both units. 4These relays are the second level of undervoltage protection required as a result of the NRC staff review of the 1976 Millstone 2 degraded voltage event. Corrective design changes (i.e., undervoltage relays and load sequencing to offsite power) had been implemented on Unit 2 for degraded voltage protection. These design changes had only been recently submitted by the licensee for NRC review and had not yet been implemented on Unit 1 at the time of the event. 5The ESF buses supply power to the plant's safety equipment. GEach one of the four CPC instrumentation circuits receives power from a vital AC bus which in turn receives power from a battery through an inverter that converts DC power and AC power. Each inverter normally provides power through a circuit with access to both an ESF bus and the station batteries. Each inverter also has an automatic switch that can cut off this normal supply circuit and shift the loads to an alternate supply circuit, which includes just the ESF bus. (See insert on Figure 1.) With both Unit 2 ESF buses momentarily deenergized, the only source of instrument power was from the station batteries through the normal switch position. However, although the exact cause is unknown, all four inverter automatic switches were found in the alternate position. Three of four inverters had improper settings on time delay relays and one inverter had the undervoltage trip setting too high, which may have in part been the cause. N' 1019 144

_r,_ and the containment sump. ESF operation and premature RAS operation combined to transfer approximately 60,000 gallons of the refueling borated water to the containment sump in about 90 seconds. The normal design sequence calls for the RAS to automatically change the valve lineup only when signals from the level instruments on the Refueling Water Tank (RWT) indicate that the tank is nearly empty, which is expected to occur approximately 30 minutes after the LOCA. During this incident, the RAS acted immediately in response to the failure of the inverters and made the change in lineup while the RWT was nearly full. Initially, the sequence of events on September 16 did not indicate any problem with the electrical distribution system of Unit 1. However, subsequent analysis indicated that in the event of a LOCA at Unit 1 during which Startup Transformer No. 1 received both the auxiliary electrical loads and starting loads of the Engineered Safety Features a voltage reduction would result. The safety loads might not initially transfer to the Unit 1 diesel generators but could remain on the startup transformer with reduced (degraded) voltage. Although there is margin in the sizing of emergency equipment and the conditions of operation of such equipment, this situation could cause fuses to blow in Engineered Safety Feature circuits which could result in disabling the safety equipment. (See safety concern (1) above.) Inverter deficiencies on Unit 2 had remained undetected during preoperational testing and in the course of events led to the premature operation of the RAS valves as previously described. Had the Emergency Core Cooling System and/or the Containment Spray System been needed in the event of a design basis loss-of-coolant accident, it would not have performed as designed because of the premature RAS valve actuation. ESF degradation on Unit 2 did not involve a threat to the health and safety of the public because Unit 2 was preoperational and had no radioactive fission product inventory in the core. However, there was no assurance that the inverter deficiencies which caused the premature operation of the RAS valves would have been corrected prior to Unit 2 power operation. (See safety concern (3) above.) In the event of a LOCA with a fission product inventory, if the RAS.were to initiate at the beginning of the accident, as it did in this incident, the low pressure and high pressure coolant injection subsystems (LPCI and HPCI) of Emergency Core Cooling (ECC) and the Containment Spray System might not function properly. The premature actuation of the RAS has not been completely analyzed. Actuation of RAS causes isolation of the water in the RWT, which is the source of short term cooling water for Emergency Core Cooling and Containment Spray. The premature actuation of RAS also causes these pump suction lines to be connected to the containment sump when there may not be sufficient water available. 1019 145 Cause or Causes - The immediate causes of the undesirable event at Arkansas Nuclear One were: (1) loss of the Bus Tie Auto-Transformer which resulted in degraded power operation through Startup Transformer No. 2, and (2) multiple Unit 2 inverter failures. The loss of the Bus Tie Auto-Transformer was caused by inappropriate setpoints for its protective relays. The operation and maintenance of this piece of equipment is assigned to an AP&L organization outside of Arkansas Nuclear One. No one within AP&L remembered the necessity to reset the relays for operation of two units at the site. The Bus Tie Auto-Transformer failure had not been adequately reviewed prior to this event in that the overloading of the shared Startup Transformer No. 2 had not been identified during the design and review process. The primary cause of the failure of the inverters to perform as a reliable power supply was the lack of adequate preoperational test procedures, inadequate knowledge of inverter operation and lack of maintenance control (maintenance had been performed on the inverters several times prior to this event). The deficiency in the Unit 1 emergency power design had not been previously considered. Actions Taken to Prevent Recurrence Licensee - The Bus Tie Auto-Transformer overcurrent relays were reset to provide for correct operation of both Unit 1 and Unit 2 on September 26, 1978. On October 6, 1978 representatives of Arkansas Power and Light Company and the NRC met at Bethesda, Maryland to discuss the September 16, 1978 incident. At that meeting the licensee committed to the following: (1) Investigate and correct the problems with inverters at Unit 2 prior to initial criticality. (2) Evaluate the adequacy of the inverters at Unit 1. (3) Implement procedures for the protection of plant equipment in the event both Unit 1 and Unit 2 are transferred to Startup Transformer No. 2. The licensee installed an Engineered Safety Feature load sequencer to prevent overloading the startup transformers on October 31, 1978. NRC - The NRC has reviewed and approved corrective actions taken by the licensee. Tiie licenses was cited for an infraction of Unit 2 Technical Specifications because of the lack of written procedures for the surveillance and test activities related to the inverters. 1019 146 The NRC determined that the operation of the offsite electrical system did not fully meet the design criteria and discussed alternatives with the licensee to correct the problems. The NRC approved the licensee actions dealing with the operation of Startup Transformer No. 2 and issued a confirmatory order for the installation of an Engineered safety Feature load sequencing to offsite power on Unit 1 by October 31, 1978. The NRC undertook a telephone survey to determine if other licensees had voltage drop problems, such as those found for Unit 1. The survey results did not reveal any problems. The existing NRC generic review activity regarding Degraded Voltage is being expanded to ensure that adequate voltage will be available at the ESF buses during all electrical starting transients including voltage degradation resulting from overloading due to automatic switching, such as the Arkansas Nuclear One incident with the shared startup transformer (Startup Transformer No. 2). The NRC has issued an IE Circular to inform licensees / applicants of the problems experienced by ANO inverters for vital buses. Included for consideration by the licensees / applicants is the need for proper settings of the relays and time delays and the need for administrative controls that will ensure operability of the safety systems after its subcomponents have been subjected to maintenance or testing. Also, an IE Information Notice was issued to all licensees / applicants to more completely inform them of the detailed circumstances and plant conditions that unfolded during this event. Future reports will be made as appropriate. 79-2 Deficiencies in Piping Design Preliminary information pertaining to this incident was reported in the Federal Register (44 FR 30783). The incident has also been extensively reported by the media. Appendix A (Example 10 of "For All Licensees") of this report notes that a major deficiency in design, construction or operation having safety implications (affecting five plants in this case) requiring immediate remedial action can be considered an abnormal occurrence. Date and Place - During design and construction, an incorrect summation of earthquake loads affected the design of safety related piping systems and associated pipe supports at five nuclear power plants. On December 6, 1978, a Licensee Event Report from Duquesne Light Company mentioned differences between computer codes used in analyses of forced summations, but did not elaborate on them. Then, the NRC learned of an incorrect summing of loads in one of the codes on March 8, 1979, at a meeting in Aethesda, Maryland with Stone and Webster, an architect engineering firm, and the Duquesne Light Company (DLC), the licensee for Beaver Valley Unit 1, a pressurized vater nuclear plant located in Beaver County, Pennsylvania. On March 9, NRC learned that the incorrect summation technique affected four other plants: 1019 i47 Plant Location FitzPatrick Oswego County, New York Maine Yankee Lincoln County, Maine Surry 1 & 2 Surry County, Virginia Nature and Probable Consequences - In October 1978, Duquesne Light Company, the licensee of the Beaver Valley plant, was informed by Stone and Webster that, for loading conditions associated with postulate? earthquakes, pipe supports associated with Safety Injection System piping would be overstressed. Stone and Webster (S&W) was reanalyzing stresses in connection with a system modification required by the NRC staff to correct a design deficiency not related to protection against postulated earthquakes. During this reanalysis effort, the S&W engineers also came across information that had been provided to them by Westinghouse in May 1978 that showed some check valves in these lines were actually heavier than assumed in the earlier analysis. Sometime during this reanalysis, either in connection with the planned modifica-tions or in reexamining the effect of the increased valve weights, S&W discovered a misapplication of a hand calculation method. In correcting this misapplication, S&W found some instances of local overstress. The correction consisted of adding a snubber and modifying one support. In doing the analysis related to making this correction, S&W used two computer programs. A new one, NUPIPE, predicted much higher stresses than the one, PIPESTRESS, used during a 1974 as-built check of these lines. On October 26, 1978, the licensee orally notified the NRC Office of Inspection and Enforcement about the design error (hand calculations method misapplication) which required correction. No explanation was provided for the differences in stresses predicted by the two codes at that time. Repeated NRC contacts with the licensee and S&W to identify the reason for the differences were not effective, since without the actual computer runs to look at there was a communications problem. During a meeting held on March 8, 1979 to discuss these matters, the Beaver Valley licensee informed the NRC staff that the differences in predicted piping stresses between the two computer codes were attributable to the fact that the SHOCK 2 subroutine of the PIPESTRESS code uses an algebraic summation of the loads calculated separately for the horizontal and the vertical component of earthquake motion. The use of algebraic summation is only acceptable if the time phasing of these loads is known. The algebraic technique as used in SH0CK2 is not conservative for response spectrum modal analysis because, in such analyses, time phasing is not considered. The analytical treatment of load combinations becW: significant because horizontal earthquake motions can produce piping movement in both the horizontal viDi 1019 10 u and vertical direction and the vertical earthquake motions can also produce piping movement in both horizontal and vertical directions. For some designs the calculated piping stresses may differ significantly depending on the load sumrnation techniques used in each mode of response. Based on the three piping systems that had been reanalyzed by the newer code on Beaver Valley at the time of the March 8, 1979 meeting, stresses over allowable values were expected to be found primarily in piping supports although significant increases in piping stresses had been observed. NRC staff reviewers were sent to S&W's Boston office to determine the extent of this problem on Beaver Valley 1 and other potentially affected plants. In following the course cf the reanalysis at the S&W offices over the weekend of March 10, 11 and 12, based on the information then available, it became apparent that, when the NUPIPE code was used, a number of piping systems had calculated stresses over the allowable value for the design basis earthquake. Also, for a few of these systems the more probable operating basis earthquake resulted in stresses above the allowable value. In addition, the structural integrity and performance of pumps, valves and other essential equipment could be degraded. Although results were still incomplete on March 12, information available at that time indicated that high stresses were calculated in a number of systems important to safety. Because the overstressing of piping and supports was predicted even for earth-quakes which might occur during the lifetimes of these facilities, the problem took on considerable safety significance. Some of the systems identified at that time as having overstressed conditions under earthquake loadings were part of the reactor coolant pressure boundary, whose failure could cause a loss of coolant accident. In addition, systems which would be needed to shut the plant down safely in the event of a loss of coolant accident were also affected. Thus an earthquake, of not extremely low likelihood, would have the potential both for caus:ng an accident, and for preventing safety systems designed to cope with that accident from operating. A secondary concern was whether or not systems needed to provide adequate long term cooling for the plant in the event of an earthquake without a LOCA could be assured. Concurrent with the NRC Beaver Valley review, NRC staff records were examined to determine whether or not other facilities had used these same analysis techniques. Based on the review of these records and information provided by S&W, the NRC staff concluded that four other facilities used the same techniques. The four facilities were Maine Yankee, FitzPatrick and Surry Units 1 and 2. The NRC staff concluded the potential for serious adverse effects in the event of an earthquake was sufficiently widespread that the basic defense in depth provided by redundant safety systems may be compromised. The NRC Director for Nuclear Reactor Regulation concluded that the public health and safety required 1019 i49 v that the affected facilities be placed in a cold shutdown condition pending further order of the Commission. Orders to this effect were issued to the licensees of the above reactors. The Orders provided that within 20 days each licensee must respond with respect to: (1) why the licensee should not reanalyze the facility piping systems for seismic loads on the piping system and any other affected sefety systems using an appropriate piping analysis computer code which doas not combine loads algebraically, (2) why the licensee should not make any modifications to the facility piping systems indicated by the reanalysis, and (3) why facility operation should not continue to be suspended until completion of the reanalysis and any required modifications. All of the plants were placed in a cold shutdown condition. (Surry Unit 2 was already in an extended outage for steam generator replacement.) Cause or Causes - The uncertainty in the calculated piping stresses and support loadings in safety-related piping systems at the five plants is attributable to the incorrect application of the algebraic summation technique in the SHOCK 2 subroutine of the PIPESTRESS computer code, proprietary to Stone and Webster. Actions Taken to Prevent Recurrence Licensee / Architect Engineer - Identification of all safety-related systems that have been analyzed with a piping computer code involving a program defi-ciency is underway. Computer inputs are being checked to assure that all reanalyzed piping will reflect the as-built condition at each plant. Piping analyses are being rerun and piping and supports exceeding allowable stresses will be identified. Modifications will be made as necessary. NRC - The NRC ordered each of the utilities of the five identified nuclear power plants to shut down their plants within 48 hours. The utilities were to remain shut down pending further order of the Commission. The NRC is in contact with the licensees and the architect engineer on actions being taken. Piping stress computer codes to be used for reanalysis of the piping will be tested with NRC established benchmark problems. Also, an independent audit of selected piping runs will be conducted by NRC consultants to verify the piping stress reanalysis. In addition to reviewing the licensees' corrective actions, the NRC is reviewing \\ any generic implications at other facilities. The NRC's Office of Inspection and Enforcement issued Information Notice (IN) No. 79-06, on March 23, 1979, 1019 150 to all holders of reactor operating licenses and construction permits. On April 14, 1979, the NRC's Office of Inspection and Enforcement issued Bulletin No. 79-07 to applicable licensees which identified actions to be taken. This includes identification of the methods of analyses used, how they were verified, safety systems affected, and a plan of action to assure plant safety. Based on the responses to the Bulletin and NRC investigations, it was found that in addition to the five plants which were shut down by the show cause order, 20 other operating plants and four plants still under construction were identi-fied as having used algebraic summation. Of the 20 operating plants, one (Salem 1) is shut down for refueling and will not be permitted to restart until the problem is resolved, three (Brunswick 1 and 2, Indian Point 3) were allowed to continue operation during reanalysis based upon staff evaluation, one (Indian Point 2) was allowed to operate five weeks until refueling based upon preliminary reanalysis results, 13 have been reviewed by the staff and resolved, and 2 are still under staff review. Of the five plants shut down by the show cause order, Maine Yankee restarted May 24, 1979, based on the satisfactory corrective actions by the licensee. The other four plants are scheduled to restart at various times throughout the remainder of 1979. Recently, an additional issue was identified which can cause seismic analysis of safety-related piping systems to yield nonconservative results. The issue involves the accuracy of the information input for seismic analyses. Several potentially unconservative factors were discussed and subsequently addressed in Bulletin 79-02 (pipe supports) issued March 8, 1979 and Bulletin 79-04 (valve weights) issued March 30, 1979. During resolution of these concerns, inspection by NRC and by licensees of the as-built configuration of several piping systems revealed a number of nonconformances to design documents which would potentially affect the validity of seismic analyses. Eleven power reactors were found to have discrepancies. Therefore, Bulletin 79-14 was issued on July 2, 1979, to all power reactor facilities with an operating license or a construction permit. The Bulletin directs the licensees to perform inspections of their safety-related piping systems and supports and to report the results to the NRC within 120 days. The NRC then will review the results and take action, as appropriate, on a case-by-case basis. Because of the conservative nature of the seismic analysis and design process, and because of the redundancy built into these piping systems, the NRC does not believe that public health and safety considerations require that the facilities be shut down pending completion of the inspections and remedial action if required. Future reports will be made as appropriate. 79-3 Nuclear Accident at Three Mile Island Information pertaining to this accident is also being reported in the Federal Register. The accident has also been extensively reported by the media. Appendix A (the general criteria for abnormal occurrences) of this report 1019 151 notes that events involving a major reduction in the degree of protection of the public health or safety are considered abnormal occurrences. Date and Place - At about 7:09 a.m. on March 28, 1979, the NRC Region I office was notified by the licensee (Metropolitan Edison Company) of an event at the Three Mile Island Unit 2 (TMI-2) plant. At approximately 4:00 a.m. on March 28, 1979, the Three Mile Island Unit 2 nuclear power plant experienced a loss of the feedwater which led to a turbine trip and later a reactor trip. Subsequently, a series of events took place that resulted in off-site releases of radioactivity and significant damage to portions of the reactor core. The sequence of events which led to core damage involved equipment malfunctions, design related problems and operational errors that, to varying degrees, all contributed to the consequences of the accident. Because plant conditions were substantially degraded, improvised operating modes for post-accident recovery were required. Since low but intermittently changing radiation levels were measured off the plant site, and in view of the uncertainty associated with information then available on the evolving events, the Governor of Pennsylvania advised as a precautionary measure that young children and pregnant women within a 5-mile radius of the plant should evacuate this area. Four employees of the licensee received radiation exposures somewhat in excess of the NRC's quarterly occupational exposure limits during primary coolant sampling operations which took place during the early stages of the accident. Nature and Probable Consequences

Background

Three Mile Island Unit 2 is a pressurized water nuclear power plant located in Dauphin County, Pennsylvania, about 10 miles southeast of Harrisburg. The operating license (DPR-73) for THI-2 was issued on February 8, 1978; initial criticality was achieved on March 28, 1978 and the facility went into commercial operation on December 30, 1978.* The licensed power level of the facility is 2772 MWt with a design net electrical rating of 906 MWe. The nuclear stead supply system of THI-2 was designed by Babcock & Wilcox Company (B&W). The architect / engineer for the balance of the plant was Burns & Roe.

• The date of commercial operation is the date the facility was declared by the utility owner to be available for the regular production of electricity; it is usually related to satisfactory completion of qualification tests as specified in the purchase contract and to accounting policies and practices of the utility.

Utilities sometimes declare commercial operation prior to the facility achieving full power operation. However, this was not the case with TMI-2; ful; power operation was achieved for a few days during December 1978. fh I t y Figure 2 is a simplified diagram of the THI-2 reactor plant. There are two loops in the primary coolant system. Water is pumped by the primary coolant pumps (2 in each loop) through the core where it absorbs the heat emitted by the fuel rods. The water passes through the primary side inside the tubes of the steam generators (1 in each loop) and flows back to the primary coolant pumps. Pressure in the primary system is controlled by the pressurizer. Instrumentation in the pressurizer gives an indication of the amount of water in the pressurizer. A separate system, the Emergency Core Cooling System (ECCS), is connected to the primary system to inject water while pressurized in the event of a loss-of-ccolant accident. The ECCS consists of the high pressure injection (HPI), the low pressure injection (LPI) and the core flooding systems (CF) collectively. Fol?owing a loss-of-coolant accident (LOCA), the ECCS is automatically actuated. During the initial injection phase either the HPI, the LPI or the CF system will initiate, depending on reactor pressure. HPI and LPI takes suction from the borated water storage tank (BWST) (see dotted portion of Fig. 3). When the BWST is exhausted the LPI/ Decay Heat Removal (DHR) pumps take suction from the reactor building sump and will provide recirculation through the DHR coolers to the reactor vessel (see Fig. 3), thus providing long-term cooling of the core. The decay heat removal system (Figure 3) is operable at low reactor coolant temperatures and pressures. The system can be used both in normal operating modes (plant startup from cold shutdown, plant shutdown, and scheduled refueling / maintenance of the reactor) and in an emergency mode (to supply low pressure injection water into the reacter coolant system). In the secondary system, feedwater pumps supply water to the secondary side of the steam generators. The heat from the primary water is transferred to the secondary water which subsequently becomes steam. The secondary steam travels to the turbine (which turns the electrical generator) and on to a condenser in which the steam condenses back into water. The condensed water returns to the feedwater pumps via the condensate pumps and cleanup system. In the event of a malfunction in the main feedwater system, the auxiliary (emergency) feedwater system is designed to deliver secondary coolant to the plant's two steam generators to remove heat from the reactor core. Nature of Initial Events The following is a preliminary summary of the significant events that occurred at the Three Mile Island No. 2 nuclear facility on March 28, 1979, and in the days that followed. At about 4:00 a.m. on March 28, 1979, the secondary (non-nuclear) cooling system of the Three Mile Island facility suffered a malfunction. The function and flow pattern for this system were discussed previously (see Figure 2). The malfunction was a loss of a condensate pump in the feedwater return system, apparently due to moisture in the control air of a valve. 1019 153 t. e ! i.: :

CONTROL BUILDING , 6 MAIN STE AM SAFE TY VALVES RUPTURE LINE POWER DIS K Ia. De d OPE R A T E D k / REACTOR \\ STOP j %v VALVEN eT, ], RE LIE F M @ $ h/ d' COOLANT d

r V N

<N VALVE 4 M DRAIN r 'N TANK g THROTTLE ' \\ t E VATER h VALVE TURBINE "-J LINE a, i GENERATOR BYPASS T ,9, d$ HEATERS MAIN LINE I Z / TURBINE d - n ** LEJ h hI TO TE AM \\ d 2 GENERATOR LEVEL wE A 'l B-TRANS-b E MAIN F EED MIT T E RS CON DE NSE R k WATER LINE ~. ~., s s , ~ g 2O [ ze n STE AM di ,909 OU STE AM GENERATOR gpwin ENLRATOR B " WATER A. ~' n LO ,ggy V SSEL r a O 'N4 CON ( j 1, TUHhlN6 OHIV t N Au M e Li AH V I F ' I U*\\ A V E N "' '*,p STOR AGE T ANK CONDE NSAT E HIGH PRES $ "E ,"{ AUXILI ARY BUILDING ) c w y,tCTlOg LINE S CONDENSATE ) c N PUMPS (3) m a 1, ~ d n 3E [ \\;y' : ~ COOLANT ) C [I REACTOR REACTOR n , REACTOR BLOG / rE ) .A f a5 COOLANT b-W PUMPS SUMP (/ M AIN iz MAKEUP F y \\l LINE RE ACTOR BUILDING (CONTAINMENT) l 8 STER S2 O PUMPS (3)

• 8 FROM BORATE D

+ W ATER STOR AGE AA 2E TANK FOR HPI '[ 4 F ROM 51 A K E ' FROM DECAY HE AT AUXILI ARY BLOG LEJ + gLE R DISCH ARGE TURBINE BUILDING -f SUMP gp7gyg gp w Figure 2. Simplified RCS/ Steam / Feed Systems A

A O CORE FLOODINGN p TANK N / = = REACTOR VESSEL V = SODIUM { K HYDROXIDE STORAGE TANK ?; ?; DECAY HEAT G X X REMOVAL COOLER BOR ATED WATER r-- STORAGE TANK f) r + ~ r-COMPONENT COOLING WATER ]m m U + + %J (( DECAY HEAT l -~ -*d REMOVAL PUMP g ~ L. _2 _y h _+ .) ) ~ f 9 I l E g l y cn REACTOR Ln BLDG SUMP 1 1 9,, i The malfunction in the condensate system caused the feedwater pumps to turn off (trip), which in turn caused the turbine generator to turn off and stop generating electricity. Since the steam generators were not removing heat due to the stoppage of feedwater flow, the heat generated in the reactor caused system pressure to increase and the pressurizer relief valve opened to reduce reactor pressure. The reactor turned off by the rapid insertion of the plant's control rods (scrammed) as designed and the nuclear chain reaction stopped leaving behind principally residual, or decay heat. These events all occurred within the first 30 seconds following the initial event. The sequence to this point is normal and plant response was as expected. If the normal sequence were to continue, the auxiliary feedwater system - the pumps of which started within a few seconds of loss of main feedwater - should deliver secondary coolant to the plant's two steam generators to remove heat. In addition, the pressurizer relief valve should close as reactor pressure decreases. However, all three of the auxiliary feedwater pumps which had started were unable to deliver flow to the steam generators because their flow paths were blocked by closed valves. After about 8 minutes, the operator established auxiliary feedwater flow by opening the valves. In addition, the pressurizer relief valve failed to close resulting in a loss of coolant flow path; this also allowed the reactor coolant system pressure to continue to decrease. As the reactor pressure reached a preset value (about 1600 psi), the plant's Emergency Core Cooling System (ECCS) started as designed and began to inject cold water into the reactor. It is at this point that an indication of a rapidly rising pressurizer level apparently led the plant operators to terminate or throttle the ECCS flow. The volume of water in the pressurizer is normally used as an indication of total water inventory in the reactor coolant system. This is based on the entire reactor coolant system being full of sub-cooled water (i.e., below the boiling point for the pressure being maintained in the reactor coolant system) except for a steam volume in the top of the pressurizer. In the pressurizer, the water is heated to the boiling point by electrically powered heaters. During this transient, the pressure in the reactor coolant system was reduced to approximately the saturation pressure for the temperature of the coolant leaving the reactor core. This allowed steam voids, or bubbles, to form within the primary coolant system. Under these conditions the pressurizer level is not a reliable indication of the water inventory within the reactor coolant system. At this point, the Three Mile Island accident had been underway for 11 to 12 minutes. Between about I and 2 hours after the turbine trip, the operators noted an increase in vibration in the four large pumps (Reactor Coolant Pumps) which circulate the reactor coolant through the reactor, and turned them off to prevent any damage to the pumps. The operators thought that natural circulation through the core would ensue. Two of these pumps are located in each of the primary coolant loops. It is following this action that damage to the nuclear 1019 156 xm, i fuel began. (See subsequent discussion for more details.) For the next several hours there was a large temperature difference between the coolant entering and exiting the nuclear core, indicating little or no flow of coolant through the core. The continued discharge of primary coolant through the stuck-open pressurizer relief valve caused the level and pressure in the reactor coolant drain tank to increase. This eventually caused the reactor coolant drain tank relief valve to lift and the rupture disc to fail, as designed, permitting the primary coolant to flow into the reactor building sump. About 8100 gallons of reactor coolant were automatically pumped from the reactor building sump to the auxiliary building sump tank. This transfer was terminated at 4:38 a.m. prior to any major fuel damage and was not resumed. The auxiliary building sump tank overflowed to the auxiliary building sump, causing water containing a relative low concentration of radioactivity to back up through floor drains onto the fuel handling building and auxiliary building floors. Following fuel damage, the concentration of radioactivity in the reactor coolant increased by several orders of magnitude. A flow of this highly contaminated reactor coolant was maintained from the primary coolant system through the letdown system and return to the primary coolant system via the makeup system for several days following the accident. This flow was required to ensure adequate cooling of the reactor coolant pump bearings. Gases evolving from the reactor coolant in the makeup and letdown system were collected in the waste gas system. Small leaks in these systems were of little radiological significance during normal operation. However, following the accident, these leaks caused very high radiation levels inside the auxiliary and fuel handling buildings and resulted in much higher than normal environmental releases via the ventilation exhausts from these buildings. This flow was the principal pathway by which radioactivity passed from the damaged reactor core to the auxiliary building, fuel handling building and to the environment. Between 2 and 3 hours after the turbine trip, substantial increases in radiation levels were being observed at locations both on-and off site. These readings reached values 'of 30 to 36 mrem /hr at the site north gate and 20 to 35 mrem /hr across the Susquehanna River in Goldsboro, Pennsylvania. The dome monitor inside the containment building was indicating radiation levels interpreted to be thousands of R/hr - the readings were scaled up on the basis of the monitors being shielded - while the monitor at the operating deck inside containment was indicating radiation levels at tens of R/hr. About 3 hours aftar the turbine trip, there were many indications of a sudden increase in in plant radiation levels. Based on these increased radiation levels and consistent with the licensee's Emergency Plan, a Site Emergency was declared by the Metropolitan Edison shift supervisor in coordination with the Unit 2 Superintendent, Technical Support. About 30 minutes later a General Emergency was declared by the Station Manager based upon a containment dome monitor reading of greater than 8 R/ hour. This was consistent with the require-ments of the licensee's General Emergency Procedure. it' l 1019

57 About 2.3 hours after turbine trip, the pressurizer relief valve was discovered to be open and a block valve in that same line was closed to stop the release of reactor coolant to the drain tank.

Through the afternoon and early evening of March 28, 1979, the licensee attempted to depressurize the reactor coolant system sufficiently to be able to turn on the decay heat removal system (this system operates at low pressure and temperature). The decay heat removal system is the long-term cooling system. The system can not be activated as long as the pressure in the reactor is high. The pressure in the reactor could not be reduced because there was not enough coolant to cool the core. Without adequate cooling the primary system was repressurized. Loss of sufficient coolant resulted in fuel damage and subsequent release of hydrogen and other gases. The formation of these gases further prevented the circulation of coolant around the core. After repressurization (about 8:00 p.m. on March 28, 1979), one of the main reactor coolant pumps in loop A was restarted and flow through the reactor core was established. Heat was being transferred out of the reactor through one steam generator, through the turbine bypass line, and to the condenser. The primary system was maintained at a pressure of 1000 psi and a temperature of 280 F. Reactor cooling essentially remained in this mode until approximately 2:00 p.m. on April 27, 1979 when the reactor coolant pump was intentionally tripped and reactor core cooling was through natural circulation of the primary coolant initially through two steam generators. After approximately 12 hours, one steam generator was isolated. By early July 1979, core flow was being provided by natural circulation; core cooling was being maintained by steaming the "A" steam generator through the turbine bypass valve to the main condenser. Average coolant temperature was 165 F and the highest incore thermocouple indication was 270 F. Primary pressure was about 275 psi. Preparations are now almost completed for the next phase of th0 cool down process. To accomplish this cool down the piping to the "B" S.G. has been modified. The modification will allow water from the tube side of a new heat exchanger to be circulated through the secondary side of the "B" S.G. to remove the heat of the reactor coolant. The system will be a closed loop and that portion of the system that will remove heat directly from the steam generator has been designed to operate at a higher pressure than the reactor coolant system pressure, thus assuring that if there were any leakage it would be into the reactor coolant system instead of out of that system. NRC Response to Accident At about 7:00 a.m. on March 28, 1979, the licensee notified the State of Pennsylvania. At 7:09 a.m., the licensee reached the NRC Region I office in King of Prussia, Pennsylvania, and by 6:15 a.m. the NRC Incident Response Center in Bethesda, Maryland, was operating. By 10:05 a.m., the first NRC Response Team was on the site, a group of five inspectors from the NRC Region I office. NRC had 11 people and a mobile laboratory van (for radiological i0l9

53

_ analysis of air and other environmental samples) from the Regico I office on-site by evening; radiological assistance teams from Brookhaven National Laboratory were monitoring the site vicinity from mid-afternoon of March 28, 1979. NRC strength at the site increased to 29 on Thursday and 83 on Friday, March 30, 1979. On March 31, NRC placed thermoluminescent dosimeters at 37 locations of f-site to supplement those already placed by the licensee, in accordance with its license, and those of other agencies that were monitoring the site and its environs. Initial Consequences From March 28, 1979 on, there were continuing releases of radioactive gas evolving from the reactor coolant and being released from the letdown and makeup systems. Efforts to halt these releases were unsuccessful and the releases increased. On Friday morning, March 30, 1979, this situation led to a decision by Governor Thornburgh to recommend a precautionary evacuation of preschool children and pregnant women from within the 5-mile zone nearest the reactor. NRC received the cooperation of Pennsylvania State government officials as well as other Federal agencies. Nowhere was this cooperation more apparent than in the vitally important area of radiological monitoring. In addition to the licensee's of f-site monitoring stations and surveys on-and off-site, the Department of Energy's Aerial Monitoring Survey airplane was on station over the site within a few hours. Personnel from the Pennsylvania State Bureau of Radiological Health were making measurements from Thursday afternoon onward. Radiological monitoring efforts were also carried out by NRC, DOE, HEW, and EPA monitoring teams. The assessment of off-site releases of radioactivity is discussed in more detail in a subsequent section. On Friday, March 30, 1979, it was recognized that the early overheating of the reactor had resulted in the formation of a substantial quantity of hydrogen gas, some of which was thought to have collected in the reactor pressure vessel above the core. Reaction of overheated zirconium with steam or water results in formation of zirconium oxide and hydrogen (the reaction starts at about 1800 F). One concern was that if the reactor pressure was decreased, the hydrogen bubble would expand and thus interfere with the flow of cooling water through the core. Another was that if oxygen (0 ) generated by radiolysis 2 of water accumulated, there would be the potential for forming an explosive mixture of hydrogen and oxygen. This latter concern was later determined to be unwarranted since further analysis indicated that the 02 generated by radiolysis of primary water would recombine in the hydrogen-rich conditions of the reactor system, and little, if any, free oxygen could be evolved to collect in the bubble. Over the following few days, the bubble was reduced to negligible size by degassing with the pressurizer spray and letdown flow (see Figure 4) and by gas dissolving in the reactor coolant water. Some degassing takes place when I019 I59

LETDOWN ORIFICET %.-,49,- REACTOR p o { - --C>4--- I LETDOWN h g q~ ~ %, l COOLERS f ! l l I E E g U ~ ~ DEN 1N IZER ~ U SYSTEM Q ~ A s l ENE ATOR kV TER I { -{ -(--- q~ J LETDOWN 4 / Ii l LINE ~ n.L n d i FROM NITROGEN 'l u I SUPPLY l TO g WASTE j I f q \\ dh I h ,_q GAS l MAKEUP i / i ua RV / TANK e ir \\ d u REACTOR COOLANT ,7 a a eUMeS j I " 0e"i '" m 'A = = S l (

5 6

Eh = 2 f l vi u-w[ m = m m y ~ x N x i e = N x C = N x s MAKEUP '/ ] p eUMeS M g = FIGURE 4. SIMPLIFIED M AKEUP & PURIFICATION SYSTEM CD the coolant is sprayed into the pressurizer. The spray condenses some of the steam lowering the pressure and increasing the surface area of the coolant in the pressurizer which releases some hydrogen and other non-condensible gases. These gases collect at the top of the pressurizer and are vented to the pres-surizer relief tank. Apparently because the rupture disc on the relief tank had ruptured, the pressurizer was being vented into containment periodically. Degassing can also take place in the letdown flow, which is one of the functions of the makeup, purification and chemical aadition systems. The letdown flow first passes through the letdown coolers where it is cooled and reduced in pressure (see dotted lines of Fig. 4). The pressure is further reduced by passing through the letdown orifices. This reduction in pressure releases hydrogen and other gases. The flow can then either go directly through the filters or through the demineralizer system and into the makeup tank. The makeup tank contains a layer of hydrogen. The hydrogen blanket is established by raising the tank water level and purging with nitrogen gas. The hydrogen introduced in the makeup tank is dissolved in the coolant by combining with any free oxygen while the fission gases present are removed by continuous venting of the makeup tank to the waste gas processing system. The pressurizer was vented to the containment periodically. Subsequently, a hydrogen recombiner was made operational to reduce the hydrogen concentration in the containment building atmosphere. A hydrogen recombiner is part of the gas waste processing system. The contaminated hydrogen gas in the makeup tank mixes with the nitrogen present and is pumped to the reccmbiner where oxygen is added to reduce the hydrogen content by oxidizing it to water vapor. Thus, the period of immediate crisis passed and the reactor cooldown process could proceed without the hydrogen bubble posing any safety problems. Preliminary Evaluation of TMI-2 Fuel Damage Examinations of data from core thermocouples, incore and excore ion chambers, and analyses of core parameters such as primary coolant pressure for the first dozen hours of the transient show three time periods where a significant fraction of the core was uncovered; that is, three time periods during which portions of the fuel assemblies were cooled by steam rather than by pressurized water (which is the normal cooling method). It was during these periods of deficient cooling that extensive damage to the fuel is thought to have occurred. This damage occurred primarily by oxidation of zirconium alloy components of the fuel assemblies which were embrittled and lost structural integrity in the affected regions of the core. Estimates of the extent of damage were calculated from fission product and hydrogen releases inside the plant and radiochemical analysis of the reactor coolant water. These analyses indicated that severe cladding oxidation occurred and that most, if not all, fuel rods sustained some damage. The preliminary conclusion

• is that there is a region of extensive structural damage, probably concentrated
• Firm, final conclusions as to the condition of the fuel cannot be reached until the fuel is removed from the reactor.

It may be quite some time before that can be accomplished. 1019 161 f' V, in the upper 40% of the core with greater damage toward the center region of the core. However, the lower and peripheral portions of the core are believed to have retained their basic structural integrity. The highest fuel temperature during the transient is estimated to be well below the 5100 F fuel melting point. Preliminary Assessment of Consequences of Off-Site Releases The primary radioactive materials released from TMI-2 to the environment appear to have been xenon-133 (half-life 5.3 days) and xenon-135 (half-life 9.2 hours) and traces of radioactive iodine, primarily iodine-131. This is substantiated by consideration of the known course of events, knowledge that the effluents were released through particulate and iodine filters, and from subsequent environmental measurements in the diffusing radioactive plume. Particulate radionuclides, such as strontium-90 and alpha emitters, should either have been retained in the fuel or if released from the fuel should have remained in the coolant water. EPA has been designated by the White House as the lead agency for coordinating the collection and documentation of the environmental radiation data obtained by all the Federal agencies involved in monitoring in the vicinity of Three Mile Island. The NRC plans to request that they ensure appropriate measurements are made to confirm this position on stroritium and alpha-emitter levels. These elements have not been detected in the environment in the vicinity of TMI nor in the reactor containment or gas decay tanks. Based on the physical and chemical nature of these radionuclides, they would not be released from the plant under the conditions of the TMI accident. Some of the radioactive krypton isotopes such as krypton-87, krypton-65m and krypton-88 may have been released with the radioactive xenons. However, these are all relatively short-lived radionuclides and none of the reported gamma-ray spectral analyses detected any measurable quantities of these krypton isotopes. An interagency team from the NRC, the Department of Health, Education and Welfare (HEW), and the Environmental Protection Agency (EPA) has estimated the collective radiation dose received by the approximately 2 million people residing within 50 miles of the Three Mile Island Nuclear Station resulting from the accident of March 28, 1979 (see NUREG-0558). The estimates are for the period from March 28 through Aoril 7, 1979, during which releases occurred that resulted in increased exposure to the offsite population. The principal dose estimate is based upon ground level radiation measurements from integrating thermoluminescent dosimeters located within 15 miles of the site. These estimates assume that all the exposure recorded by the dosimeters.was from gamma radiation. This assumption would overestimate the total body dose in a situation where beta radiation was contributing to the dosimeter response. The collective dose to the total population within a 50-mile radius of the plant has been estimated to be 3300 person-rem. This is the mean of four separate estimates that range between 1600 and 5300 person-rem. The range of the collective dose values is due to different methods of extrapolating from 1019 162

.-- the limited number of dosimeter measurements. An estimate provided Dy the Department of Energy (2000 person-rem) also falls within this range. The maximum hypothetical individual dose off-site was less than 100 mrem due to the accident, as compared to the natural background radiation dose of about 100 to 125 mrem per year for the area. The projected number of excess fatal concers due to the accident that could occur over the remaining lifetime of the population within 50 miles is approxi-mately one. The number of fatal cancers that would be normally expected in a population of this size over its remaining lifetime had the accident not occurred is estimated to be 325,000. The projected total number of excess health effects, including all caser of cancer (fatal and non-fatal) and genetic ill health to all future generations, is approximately two.* These health effects estimates were derived from intermediate risk estimates within the ranges presented in the 1972 report of the Advisory Committee on the Biological Effects of Ionizing Radiation (BEIR) of the National Academy of Sciences. Preliminary information on the recently updated version of this report indicates that these estimates will not be significantly changed. It should be noted that thare exists a small minority of the scientific community that believes the risk factors may be as much as two to ten times greater than the estimates of the 1972 BEIR report. There also exists a larger minority of the scientific community that believes that the estimates in the 1972 BEIR report are two to ten times larger than they should be for low doses of gamma and beta radiation. Cause or Causes - The details of the accident continue to be extensively investigated. However, based on the partial investigations to date, there are six.ain factors that appear to have caused or increased the severity of the accident. The apparent factors include combinations of personnel error, design deficiencies, and component failures. Specifically, they are: 1. At the time of the initiating event, loss of feedwater, both of the auxiliary feedwater systems, a total of three separate valves, were valved out of service. This was a violation of the plant Technical Specifications which are part of the facility's Operating License.

• Comparable numbers for the population within a 5-mile radius of the plant are as follows:

The avarage individual dose was 17 mrem to the about 28,820 people in the area, resulting in about 490 person rems. The normally expected number of fatal cancers (exclusive of the accident) would be about 4300. The projected number of excess fatal cancers due to the accident is about 0.1 and the projected total number of excess health effects is about 0.2 to 0.3. 1019 163 2. The pressurizer relief valve, which opened during the initial pressure surge, failed to close when the pressure decreased below the actuation revel. It was over 2 hours before the operators discovered that the valve did not reseat. 3. Following rapid depressurization of the pressurizer, the pressurizer level indication may have led to erroneous inferences of high level in the reactor coolant system. The pressurizer level indication apparently led the operators to prematurely terminate high pressure injection flow, even though substantial voids existed in the reactor coolant system. 4. Gases continued to be evolved from the primary coolant via the letdown system. Leaks in the waste gas system allowed this hignly radioactive gas to enter the auxiliary building and fuel handling building atmosphere. Ultimately the gases were discharged to the environment via the ventilation systems after being filtered. This was the principal source of the offsite release of radioactive noble gases. 5. Subsequently, the high pressure injection system was intermittently operated attempting to control primary coolant inventory losses through the pressurizer relief valve, apparently based on pressurizer level indication. Due to the presence of steam and/or noncondensible voids elsewhere in the reactor coolant system, this led to a further reduction in primary coolant inventory. 6. Tripping of all reactor coolant pumps during the course of the transient to protect against pump damage due to pump vibration led to fuel damage since voids in the reactor coolant system prevented effective core cooling by natural circulation. Actions Taken to Prevent Recurrence Licensee / Vendor - Both the licensee and the nuclear steam supply system supplier (B&W) continue to actively investigate the accident to achieve a full understanding of the incident and to take appropriate corrective actions. B&W is studying changes necessary both at this plant and the other plants it has designed. Licensees with B&W plants have been shut down (as described below) and have been directed to make changes in operator training, procedures, and equipment design. The licensee of TMI-2 is also investigating procedures for cleanup of radioactive contamination within the plant, removal of the damaged core, and recovery operations. NRC - An extensive investigation of the accident is being conducted by the NRC, not only to determine the design and procedural changes required of the licensees / vendors, but also to reexamine NRC's current regulations and nuclear power plant review procedures, NRC's incident response procedures, evacuation procedures for the populations around nuclear sites, etc. 1019 164

M __ _ However, certain actions have been determined appropriate with regard to nuclear plants similar to Three Mile Island to prevent recurrence of this accident and NRC has taken or is taking the following specific steps: By April 2, an inspector was assigned full time at each operatin[, plant having a B&W reactor. An NRC Inspection and Enforcement (IE) Bulletin (79-05) was transmitted or April 1 directing licensees operating B&W reactors to perform a series of specific reviews and actions. NRC onsite inspectors are monitoring compliance with this Bulletin. The NRC headquarters staff is reviewing the responses and are acting on them accordingly. A second IE Bulletin (79-05A) was transmitted to all B&W reactor operators on April 5 to provide specific operating instructions based on our present understanding of the events cc Three Mile Island. To assure that the Bulletins are fully understood and followed, the full-time inspector at each of the operating plants having B&W reactors will receive or have received additional assistance from the NRC regional offices to absure that some inspection activities will occur during each shift. The assigned inspector at each plant will thus be in a position to assJre that plant operations on all shifts reflect a clear awareness of the factors which contributed to the situation at Three Mile Island. The NRC regional and headquarters staffs will stay in close touch with the NRC inspectors ont,ite to ensure that the NRC instructions to the licensees are unde stood and are being followed. The Commission has sent a telegram to each of the licensees with B&W reactors to underscore the seriousness with which the Comnission views this situation. Additional IE Bulletins (79-06, 79-06A, 79-068) were transmitted on April 11 and April 13 to all operators of Westinghouse and Combustion Engineering designed pressurized water power reactors (FWRs), relating aspects of the accident having general applicability to PWRs and identifying certain actions to be taken. An additional IE Bulletin (79-08) was transmitted on April 14 to all operators of boiling water reactors (BWRs) relating aspects of the accident having cuplicability to BWRs and identifying certain actions to be taken. An additional IE Bulletin (79-058) was transnitted on April 2 to all B&W plants with operating licenses for action and all other plants with operating licenses or construction permit; for information. lf} >t Additionally, an NRC Task Force on Generic Rei'ew of Feedwater Transients in B&W Reactors was formed in early April to examine the reactor and plant systems at these plants that provide protection against feedwater transients. The Task Force issued its report (NUREG-0560) with finding and recommendation on May 11, 1979. The recommendations for longer term study are being reviewed at this time. An NRC status report on feedwater transients in B&W plants was issued on April 25, 1979. Since early April and continuing into May, the NRC staff has conducted a series of meetings with licensees and vendors to discuss the licensee response to the I&E Bulletins. The staff has initiated its review of response to the I&E Bulletins. Based upon the NRC status report on feedwater transients in 3&W plants and initial review of the I&E Bulletin responses for the operating B&W plants, further procedural, training and design changes appeared to L,e required. As a result, the licensees of the operating B&W facilities indicated that they would voluntarily shut down. Those plants that were already shut down for maintenance or refueling indicated that they would remain down, until these changes were made in their facility's design and procedures. Confirmatory shutdown orders were issued by the NRC to Duke Power Company operating Oconee Units 1-3 and the Sacramento Municipal Utility District operating Rancho Seco on May 7, 1979. On May 18, 1979, a letter was sent to Duke Power Company which allowed for the continued operation of Oconee Unit 1 and restart of Oconee Units 2 and 3. Confirmatory shutdown orders were issued to Arkansas Power and Light (Arkansas Unit 1) on May 18, 1979, Florida Power Company (Crystal River Unit 3) and Toledo Edison (Davis Besse Unit 1) on May 17, 1979. Appropriate action will be taken with respect to Metropolitan Edison (TMI-l and 2). Plant restarts are being or have been approsed on a case-by-case basis. The NRC is continuing to have on-site staff at TMI to assure that: (1) TMI-2 achieves a safe cold shutdown condition, and (2) radwaste cleanup and recovery operations are conducted in a safe manner such that occupational exposures and releases off-site are as low as reasonably achievable. As indicated, there are continuing investigations of this accident underway. In addition, the NRC staff is reviewing the implications of this accident to all licensed power reactors. Further actions will be considered and implemented as necessary Fased on the ongoing staff studies, and the ongoing Presidential, Congressional and NRC investigations. An interim sequence of events developed by NRC's Office of Inspection and Enforcement investigation team for operating events which occurred at TMI-2 on March 28, 1979 was presented to the Commission on May 17, 1979. A further briefing, which included radiological monitoring at TMI-2, was given to the Commission on June 21, 1979 by NRC's Office of Inspection and Enforcement. Updates on TMI-2 and its impacts on operating reactors and the reactor licensing process will be provided in subsequent quarterly Abnormal Occurrence Reports to Congress. 1019 166 FUEL CYCLE FACILITIES (Other Than Nuclear Power Plants) The NRC is reviewing events reported by these licensees during the first quarter of 1979. During the reporting period, the NRC determined that the following event was an abnormal occurrence. 79-4 Extortion Attempt Involving Alleged Theft of Licensed Material Preliminary information pertaining to this incident was reported in the Federal Register (44 FR 24654). Appendix A (Example 6 of "For All Licensees") of this report notes that a substantiated case of actual or

• tempted theft or diversion of licensed material.... can bc considered an abnormal occurrence.

Date and Place - On January 29, 1979, the General Electric (GE) Company's fuel fabrication facility at Wilmington, North Carolina, reported to NRC's Region II office (Atlanta, Georgia) the receipt of an anonymous extortion letter. Nature and Probable Consequences - An alleged theft of low-enriched uranium oxide and an attempted extortion occurred. An individual was arrested on criminal charges and the material was recovered. The amount of material involved was too small for any nuclear reaction, and was not the type that could be used to make a nuclear bomb. It also represented a minimal health hazard, and was less hazardous than many industrial chemicals. The details of the event are described oelow. On January 29, 1979, the Plant Manager of General Electric's fuel fabrication facility in Wilmington, North Carolina received a letter in which the author claimed possession of two five gallon cans of low-enriched uranium dioxide powder; a small vial containing a sample of the material accompanied the letter. The anonyt.aus letter contained a threat to mail samples of the mate-rial to various perso.3 and to spread the material in major American cities if payment of $100,000 was i,st received by February 1, 1979. Prior to the receipt of the extortion letter and vial of m;terial, the licensce's material control system had detected that two cans, containing about 62 kilograms of the material, were missing and the licensee had already commenced a search for the material. GE reported the matter to NRC's Region II uffice in Atlanta, Georgia. The NRC, in turn, notified the Atlanta, Georgia office of the Federal Bureau of Investigation (FBI), and the FBI immediately began an investigation. Two NRC inspectors were sent to Wilmington, North Carolina to provide technical assistance. On February 1, 1979, the FBI arrested an employee of a subcontractor of the GE plant on Federal criminal charges. The two cans of uranium dioxide powder were recovered on the same day in a field a few miles from the GE facility. The employee was later tried and sentenced to prison. 1019 767

i 4 If:

- Storage or use of the material only within a controlled access area which is monitored to detect unauthorized intrusions.

- Use of watchmen or an offsite response force to respond to unauthorized intrusion or activities. - Establishment of response procedures for dealing with threats or thefts of special nuclear materials. In addition, as a result of this incident, the proposed rule is being reexamined in regard to specific requirements for establishing exit controls for areas that process or store low-enriched uranium. This incident is c.losed for purposes of this report. OTHER NRC LICENSEES (Industrial Radiograpf:ers, Medical Institutions, Industrial dsers, etc.) There are currently more than 8,000 NRC nuclear material licenses in effect in the United States, principally for use of radioisotopes in the medical, indus-trial and academic fields. Incidents were reported in this category from licensees such as radiographers, medical institutions, and byproduct matarial users. The NRC is reviewing events reported by these licensees during the first quarter of 1979. Through the end of March, the NRC had not determined that any events were abnormal occurrences. AGREEMENT STATE LICENSEES Procedures have been developed for the Agreement States to screen unscheduled incidents or events using the same criteria as the NRC (see Appendix A) and report the events to the NRC for inclusion in this report. During the first quarter of 1979, the Agreement States reported no abnormal occurrences to the NRC. 1019 169 !I APPENDIX A ABNORMAL OCCURRENCE CRITERIA The following criteria for this report's abnormal occurrence determinations were set forth in an NRC policy statement published in the Federal Register (42 FR 10950) on February 24, 1977. Events involving a major reduction in the degree of protection of the public health or safety. Such an event would involve a moderate or more severe impact on the public health or safety and could include but need not be limited to: 1. Moderate exposure to, or release of, radioactive material licensed by or otherwise regulated by the Commission; 2. Major degradation of essential safety-related equipment; or 3. Major deficiencies in design, construction, use of, or manage-ment controls for licensed facilities or material. Examples of the types of events that are evaluated in detail using these criteria are: For All Licensees 1. Exposure of the whole body of any individual to 25 rems or more of radiation; exposure of the skin of the whole body of any individual to 150 rems or more of radiation; or exposure of the feet, ankles, hands or forearms of any individual to 375 rems or more of ra6iation (10 CFR Part 20.403(a)(1)), or equivalent exposures from internal sources. 2. An exposure to an individual in an unrestricted area such that the whole body dose received exceeds 0.5 rem in one calendar year (10 CFR Part 20.105(a)). 3. The release of radioactive material to an unrestricted area in concentrations w'iich, if averaged over a period of 24 hours, exceed 500 times the regulatory limit of Appendix B, Table II, 10 CFR Part 20 (10 CFR Part 20.403(b)). 4. Radiation or contamination levels in excess of design values on packages, or loss of confinement of radioactive material such as: (a) a radiation dose rate of 1,000 mrem per hour three feet from the 1019 170

_. surface of a package containing the radioactive material, or (b) release of radioactive material from a package in amounts greater than the regulatory limit (10 CFR Part 71.36(a)). 5. Any loss of licensed material in such quantities and under such circumstances that substantial hazard may result to persons in unrestricted areas. 6. A substantiated case of actual or attempted theft or diversion of licensed material or sabotage of a facility. 7. Any substantiated loss of special nuclear material or any substantiated inventory discrepancy which is judged to be significant relative to normally expected performance and which is judged to be caused by theft or diversion or by substantial breakdown of the accountability system. 8. Any substantial breakdown of physical security or material control (i.e., access control, containment, or accountability systems) that significantly weakened the protection against theft, diversion or sabotage. 9. An accidental criticality (10 CFR Part 70.52(a)). 10. A major deficiency in design, construction or operation having safety implications requiring immediate remedial action. 11. Serious deficiency in management or procedural controls in major areas. 12. Series of events (where individual events are not of major importance), recurring incidents, and incidents with implications for similar facilities (generic incidents), which create major safety concern. For Commercial Nuclear Power Plants 1. Exceeding a safety limit of license Technical Specifications (10 CFR Part 50.36(c)). 2. Major degradation of fuel integrity, primary coolant pressure boundary, or primary containment boundary. 3. Loss of plant capability to perform essential safety functions such that a potential release of radioactivity in excess of 10 CFR Part 100 guidelines could result from a postulated transient or accident (e.g., loss of emergency core cooling system, loss of control rod system). 1019 171 4. Discovery of a major condition not specifically considered in the Safety Analysis Report (SAR) or Technical Specifications that require immediate remedial action. 5. Personnel error or proceaural deficiencies which result in loss of plant capability to perform essential safety functions such that a potential release of radioactivity in excess of 10 CFR Part 100 guidelines could result from a postulated transient or accident (e.g., loss of einergency core cooling system, loss of control rod systems). For Fuel Cycle Licensees 1. A safety limit of license Technical Specifications is exceeded and a plant shutdown is required (10 CFR Part 50.36(c)). 2. A major condition not specifically considered in the Safety Analysis Report or Technical Specifications that requires immediate remedial action. 3. An event which seriously compromised the ability of a confinement system to perform its designated function. 1019 172

.... _ APPENDIX B UPDATE OF PREVIOUSLY REPORTED ABNORMAL OCCURRENCES During the January through March 1979 period, the NRC, NRC licensees, Agreement States, Agreement State licensees, and other involved parties, such as reactor vendors and architects and engineers, continued with the implementation of actions necessary to prevent recurrence of previously reported abnormal occur-rences. The referenced Congressional abnormal occurrence report below provides the initial information on the abnormal occurrence discussed. Those occurrences not now considered closed will be discussed in subsequent reports in the series. AGREEMENT STATE LICENSEES The following abnormal occurrence was originally reported in NUREG-0090, Vol.1, No. 3, " Report to Congress on Abnormal Occurrences: July-September 1978." It is further updated as follows: AS78-4 Theft of Two Radiography Devices The two devices have not yet been recovered. As discussed previously, civil authorities were notified of the theft and source manufacturers in the area were provided with the serial numbers of the devices and were requested to notify the State and/or the police if the devices were seen. A press release was made and regulatory agencies in adjacent States were notified. The matter is under police investigation and the Louisiana Nuclear Energy Division plans no further action. This incident is closed for purposes of this report. 1019 173

U.S. NUCLE AR REGULATORY COMMISSION ' " 73 NUREG-0090 BIBLIOGRAPHIC DATA SHEET Vol. 2. No. 1 . TITLE AND SL 3 TITLE (Add Votume No., s/ aopropreafel

2. (Le*~e ble'*/

Report ' Congress on Abnormal Occurrences Janua'j March 1979

3. RECIPIENT'S ACCESSION NO.

7. AUTHOR (S)

5. DATE REPORT COMPLETED l YEAR MON TH July 1979

9. PERFORMING Or.GANIZATION N AME AND MAILING ADDRESS (Inctuae 2,p Code /

DATE REPORT ISSUED M*TH IYEAR U. S. Nuc~. ear Regulatory Commission July 1979 Office of Management and Program Analysis Washington, D. C. 20555

6. It**

• 6'*a * )

8. (Leove blank)

12. SPONSORING ORG ANIZATION NAME AND MAILING ADDRESS (include Zep Codel

10. PROJECT / TASK / WORK UNIT NO.

V. S. Nuclear Regulatory Commission Office of Management and Program Analysis

11. CONTRACT NO.

Washington, D. C. 20555

13. TYPE OF REPORT PE RIOD COVE RED //nclusive dates)

Quarterly January-March 1979

15. SUPPLEMENTARY NOTES

14. (Leave bla k)

16. ABSTRACT 000 words or less)

Section 208 of the Energy Reorganization Act of 1974 identifies an abnormal occurrence as an unscheduled incident or event which the Nuclear Regulatory Commission determines to be significant from the standpoint of public health or safety and requires a cuarterly report of such events to be made to Congress. This report, the sixteenth in the series, covers the period January 1 to March 31, 1979. During this period, there were four abnormal occurrences. Three occurred at the 70 nuclear power plants licensed to operate; one was the nuclear accident at Three Mile Island, the second involved deficiencies in piping design, and the third involved degraded engineered safety systems. The fourth occurred at a fuel cycl.e facility and pertained.to an extortion attempt involving alleged theft of licensed material. This report also contains information updating a previously reported abnormal occurrence.

17. KEY WORDS AND DOCUMENT ANALYSIS 17a. DESCRIPToRS 17b. IDENTIFIE RS/OPEN-ENDED TERMS T

18. AV AILABILITY STATEMENT

19. SE CURITY CLASS (Th,s report)

21. NO OF PAGES Unclassified No restriction on availability.

20. SECURITY CLASS /This pegel

22. P RICE Unclassified s

RC PORM 33G 17 77) 1019 174

UNIT ( O ST ATE S f ] NUCLIAH AtGULATORY COMutssion W ASHING TON. D. C. 205S5 POST A T.E AND F E E % P AID US MUCLE AM REGUL A TOR T OF F ICI A L BUSIN E SS C OM M '55 8 0 M PE N AL T Y F OR PMIV AT E USE, $300 tJ 5 MAal L J 1019 175}}