ML20151N071
| ML20151N071 | |
| Person / Time | |
|---|---|
| Site: | Oyster Creek |
| Issue date: | 03/31/1988 |
| From: | STIER, E.H. |
| To: | |
| Shared Package | |
| ML20151N032 | List: |
| References | |
| NUDOCS 8804250191 | |
| Download: ML20151N071 (206) | |
Text
{{#Wiki_filter:- - - - I. .. . . . ..
. ~. . 4 '
.- 4 . < .
.iN
'_ _ -f*h y'$
.yq ; ; g*
9} . %yg'{lg, . . .
- e. -L >
,.. . . %. . g,y , .- g - ,
. . . .. i . .
. , i
., p.
' . . ~ . , . ..
=,, i .
y ' '
- .' .. i j i
gx:y i Y Q;n , ..g.[ :
- :~ .n
. , .s .
f f ,; 4[y n#'re
~
*)$' ,
y:.A N ? g,% 0 mhqm%p,,.stk M- M( ; s.
~
n$. y$y, . .c 9,. ~ 'R' , <_ o
.b.f.v
;s~ .
;:, = -
i _ , p p. 4
')
. J f
?
-,.; g ,i . ; -' - ', " -
r .dW." ; f";p , 9s .-- .g , , -, A , i
, ' b.,;d..% $
% s, . l50. - '
,,(.-...'..;,i,..,l
-- .. . .._ ".g
- o. .
', y _ - ' 7 7, . -_,
_ --p .,
;; . ( . y. ~ '
'. : j yx ; ;% ;
{-
-g. _. y;,; -
.7- n. Q
= . - ,
. s .gg w.. .
' .[ ., ; .e.hf- Q f.
,?
. 4 e .
?'
; y ' f '_ j ,
. . . . A. .
. . ,4 h .
' ~
,t .
- h. ' f.pM ' k
~
Wk 6.t &' &j;M W Q('.
^
.. ,' . - '.i M.,.~.bg f.jj,-A 4- . . M ..'c- k','
4
' % 5' *
.I
.-') ?Q
,y..,,* ' .*. '3.
,[ . . ',d h ,f:,'.'.; .-[;, .g)*:I r
;]: _,y .g .. g f
r.
' n% i.(: .
- , g . j,. 1 p *' . #:
} *- , .'
' ' 's,.yf s. g, . >j,/f ~?? - gi .ig ... A # . 9,.*&
. .,, . y v
, , . yr
~
. f. ~C+
s , .-
.a p -- : - .:
4?.
, A -
s . . .
?
-B s .. L . 4,d. ;w['. , _ .- . . . . . v ..
4 . 7. s! c -
*'_ . b : , ;., ..,' iv: f y , - ; ,. .s . . .
. g. -n- t . j 4, .. . y .
' ,4 ,. . %c ;' ; %; ;
.( ,
+ y%.v e
]'lll [e ..<pl,..<;,
l__.' y } .-
. ; ,- \ . ., .
x# y r . .- ..-
- i. . : . .t_
s 4 .3 ~
.., .;# . e,% SVi.,".
..s "\ '
J- - -
, pn.
', ~ - ,
, . ~ ".
?: . n,
.y n4,,.,4l%-44.,, H, '.%. .
.' fM .
j-
~
. '.. , . .u p' . n , .. _ . . .
. , (' q -.g .' p., . y , SJ ;.- : y 3 ; 'k j 4@. 3[,[ b'd.. - Q i
- r. - ,*-
% g.s : ., .
M k' ' ,i'* 'F . *.yc '. ' . *. n, - - :l
. ; A,q v,- . . . . _ _ . . . , .q:. . y. . ' . s _
1 .
. .- - .m; c3 j .s.:..-s wp a
.i a r,d, .,w ,. , : s,::,. -
;$ .d'I.,._h.wK' . .
L' .9.p . ' . i. ggv e
+.
. 8804250191 880411 .k ^. . , ' .
h'.' . . .' ' . ' , . /.. . . ' ' ' . . PDR O ADOCK 0500021? DCD
.t
.; . !,?%(.;f )..+W ."L S E,' / 1 (;k,,[._%; S'k E * (&. -y;: W ; 3 ". .: .':
- . *t:
U m l0 , 7 OYSTER CREEK w r.g SEPTEMBER 11, 1987 d 5AFETY LIMIT VIOLATION I f'
;l. n ?. ;
oi p PREPARED FOR GPU NUCLEAR CORPORATION g U a b J
.3 by b,I STIER, ANDERSON & MALONE l'l L
il IJ MARCH 31, 1988
..i Vt d
9 . II 1 C ', e
)q; VOLUME I , .3 REPORT D
k}
. -l
'4
.a
'd..
p TABLE OF CONTENTS VOLUME I k U REPORT ERER 0 1- I. INTRODUCTION
- p. , A. Origin and Purpose of Investigation 1 B. Organization of Staff 2 7* C. Investigative Process 3 d
D. Organization of this Report 6 3 j NOTES 10 m
.] II.
SUMMARY
OF EVENTS OF SEPTEMBER 11. 1987 _, A. Organization of Operations Management 12 7! and "B" Crew at Oyster Creek g B. Sequence of Events 16 1 NOTES 27 c1
;J II% ,, ISSUES 32 a ,
IV. CONCLUSIONS 1 A. Scope of Findings 33 n .Q B. Summary of Findings 34
,,_ General Findings 34 Findings Concerning Individual Responsibility 42 r NOTES 51 l,g ".1 ~
V. BACKGROUND T"
- ?] A. History of Safety Limit 52
, B. History of the Less-Than-Two-Locps Alarm 54
- [4
'U C. Sequence of Alarms Recorder (SAR) 59 NOTES 64 J
.n Ma U P e
VI. DISCUSSION OF I55UEa , A. The Crew and Management Accounts of the Cause 70 p and Nature of the Safety Limit Violation 1 B. Reporting of Safety Limit Violation Within 86 m GPUN Chain of Command Il C. Reporting Sefety Limit Violation to NRC 106 . w D. Destruction / Concealment of SAR Tape 113 b E. Reporting of Missing SAR Tape Within GPUN 133 ' Chain of Command il F. Reporting of Missing SAR Tape to NRC 158 7 NOTES 165 rn A Q Table 1 List of Exhibits 196 Table 2 List of Witnesses 201 p tr VOLUME II m O INDIVIDUAL REPORTS (4. .i INTRODUCTION 1 d (HH] 5
'ff NOTES 26 f.
M (A) 32 ,' NOTES 50 (VV) 55 i" p
~
NOTES 67
".)
u (II) 70 NOTES 82 1 , 2 o
2&ER (22) 86 NOTES 91 [IJ 93
, NOTES 98
,, (R) 100 ,
.$ NOTES 107 0 110 ., 3 (N) .
,, NOTES 115 (SS) 117 l'.} NOTES 122 (3
f3 J n L VOLUME III r h TAYLOR REPORT
,t -
man ' 4
] VOLUME IV LL r EXHIBITS P
J n b VOLUME V WITNESS STATEMENTS
'j']
L u
OYSTER CREEE
; SEPTEMBER 11, 1987 SAFETY LIMIT VIOI.ATION .
d I. IMIRQDI.lCTI.QN
. A. oricrin and Puroese of Investication This report has been prepared for General Public Utilitics Nuclear corporation (GPUN) concerning a safety e
limit violation that occurred at the Oyster Creek Nuclear Generating Station on September 11, 1987. The report is
- based upon an investigation commissioned by GPUN to be performed independently of the company under the exclusive
(~} control of Edwin H. Stier.
. J
- qe
' This report deals with the events leading up to the safety limit violation, the violation itself, and the conduct of members of the control room shift and higher -
management personnel following the safsty limit violation. U It focuses on the reporting of the safety limit violation q within the GPUN chain of command and to the Nuclear a' . Regulatory Commission (NRC), the removal and disposal of portions of a record of the violation, and the reporting, both internal and external, of the circumstances concerning ,
-j the record that had been removed.
l '3 l 1 on September 11, 1987, Stier was retained by GPUN to ' ly conduct this investigation.1 The company's instructions iJ 1 [J t.,
concerning the scope and purposes of the investigation were r& conveyed to Stier by Philip R. Clark, President and Chief P W
~
Executive Officer of GPUN. Clark's instructions were to conduct a thorough, complete and independent investigation of the response of Oyster Creek personnel to the safety Pl limit violation and its aftermath.2 g At the outset of the investigation, Clark committed the iP; company.to provide complete access to all records and k personnel. GPUN chose to waive any attorney-client ' privilege that might limit the release nf the results of the T li investigation. We were given full authority for any F decisions on "methods, approach, and structure of the [ investigation and findings there'of."3 GPUN has fulfilled ,,
- r
~
all of its commitments. Although we reported our progress 1 to Clark and the GPUN Board of Directors, this investi- C
~
gation, the analysis of the evidence, and the preparation of this report hhve beon solely under our control. B. Orcanization of Staff f.- 2 l Stier is engaged in the private practice of law in New C Jersey.4 The investigative staff consisted of attorneys y also licensed to practice in New Jersey, Howard T. .
,-[j Anderson,5 Mark J. Malene,6 Robert DeGeorge,7 and Mary K.
'f.
3 l Brennan.8
*1 Taylor Associatos, Inc., a New Hampshire-based firu j specializing in technical litigation support, was engaged to .
q a
;1
%)
w . I assist in analyzing the complex technical data.9 Professor
~
Frank J. Landy, a professor in industrial psychology at The Pennsylvania State University,10 provided assistance in
- I
- i j formulating deposition questions and evaluating responses -
l directed toward identifying the causes and motivations d behind certain behavior relating to the safety limit event and its aftermath. s C. Investicative Process The investigation had three basic objectives: first,
- to determine with as much precision as possible what 9 occurred on September 11, 1987, with respect to the safety '1 limit violation, the apparent destruction, concealment, or 9
y disposal of records pertaining to the violation, and the reporting of these events; second, to identify the causes I_ L; snc motivations behind the occurrences of September 11; and ja third, to assemble a comprehensive factual record and d' analysis supporting our findings. d At the beginning of the investigation, we focused much [j of our attention on the six individuals who were on duty in G= the control room cn September 11, 1987, as part of the midnight-to-eight shift. These six comprise what is referred to throughout the report as the "B" crew. (To M Li avoid confusion with time shifts -- e.g., 12 to 8 -- we have p a used the word "crew" instead of "shift.") The crew members L. were (HH), the Group Shift Supervisor (GSS), (A), the Group Operations Supervisor (GOS), Control Room Operators (CRos), S rq m _ _ _ . _ _ _ _ , _ . . _ - _ - . _ _ _ _
l m p*\ (VV), (II), and (ZZ), and ~(I), a control room operator trainee. All of these individuals were questioned Ql 1 i extensively, both informally and under oath, and their T 1 testimony was compared to other evidance. y! The scope of this investigation, however, was not hi E < confined exclusively to the conduct of "B" crew. Management / T personnel in the operations chain of command were also E subjects of the investigation. Additionally, to understend g g the circumstances contributing to the safety limit violation " and its aftermath, it was necessary to question numerous f u. individuals who were neither members of "B" crew nor in the reporting chain of command above the crew. For example, we h. 1; questionad everyone who was in or out of the control room .y during the critice' eriod from 2 a.m. to 7 a.m. We also U { explored the crew's perception of the company's policies m respecting discipline to determine whether such perceptions I could plausibly have motivated an attempf to conceal { evidence. .c t , t.:., The investigation began less than 24 hours after the _
'?
safety limit violation. On the evening of September 11, *1 1987, the investigative staff was briefed on the day's fp
~
events. Early the next morning, the staff inspected physi-cal evidence and was given a tour of the control room. The '.L N remainder of tne day Uss spent in intensive debriefings of
$3 knowledgeable employees, including each member of "B" crew. Zj In an effort to reconstruct critical eventa and thereby .
9
- J b
m 5 test the credibility of Witnesses, we immediately began 7 collecting data from plant records for technical analysis, the results of which are set forth in Volume III of this report, the Taylor Report.
? We later obtained sworn question-and-answer statements i
from the following categories of witnesses:
', 1. All members of the "B" crew on duty on September 11, 1987, including control room operators, supervisors, and the trainee;
- 2. Management personnel outside the control room who r
{g) _ first learned of the safety limit violation and participated
,_, in its initial investigation; ') .
- 3. Plant personnel who at relevant times on September
;, 11, 1987, were present in the control room, including the r, time period encompassed by the safety limit violation and ti the subsequent disposal of documents, or who participated in l the search for the missing documents; J
G 4. Plant personnel knowledgeable about conditions O' which preceded and followed the safety limit violation; and n
- 1. i ~
d 5. Any other witnesses, identified in documents or j testimony, who might possess relevant knowledge concerning t..a the safety limit violation, the disposal of documents, or the reporting of those events. J.j All witnesses cooperated in the investigation. Based IQ lU
]
l on the tes.timony of the witnesses, and all the additional
$l '
evidence that we considered, we are satisfied that a suffi- f a cient record exists to reconstruct the relevant events and I to assist GPUN in assessing responsibility for any improper y conduct that existed. y Volumes III-V of this report include all of the I evidence we determined to be relevant to the issues under E ' investigation. Other evidence, such as our notes of *f
~
interviews, has been retained on file and can be reviewed upon appropriate request. { D. Orcanization of th'is Recort 7 4 This report is divided into five major parts, each 7 contained in a separate volume. Together they contain our analysis of the evidence, the technical analynis performed- I J by Taylor Associates, and the evidence we considered in r reaching our conclu'sions. The following is a briet~ ; description of each of the major parts of our report: 7
?
L6 VOLUME I ,
.1 Introduction. Backaround, Executive Summary and Detailed Discussion of Issues and Conclusions .C L
- A summary of the backgrounds and duties of members of "B" crew and key GPUN Operations managers.
f.! i - A summary of events of September 11, 1987, with empha- ZJ sis on conduct of the "B" crew members and GPUN Operations j SJ a Ei J
, ._. _ _ _ __ _ _____1
l 0
- 4 s managers. -
r L - A listing of the main issues addressed in the ,
- investigation and a summary of the conclusions reached with l v i respect to those issues.
T r: C - A description of the Oyster Creek Nuclear Generating Station Technical Specifications relevant to the safety limit violation and the safety limit's history.
~
- An analysis of the history and technical requirements of the "less than two loops" alarm which signaled the safaty limit violation, as well as an analysis of the sequence of
~1 J alarms recorder (SAR) which produced the computer print-out that was partially disposed of by one of the control room 4:
% operators.
O O An analysis of the crew's responsibilities and actions
, in reporting to higher management both the safety limit vio-
'd lation and the discovery that evidence was missing. ']a - An analysis of the management reporting, both internal p and to the NRC, and the management response to the safety d' limit violation and the disappearance of evidence. 'fl# . Tables
'.] ! - A table listing all documents used as exhibits to this p report (Table 1).
[3
- A table listing all witness statements taken during n
- this investigation (Table 2). - E k. VOLUME II w Individual Assessment of Members of "B" E Crew and Kev Manacement Personnel V 1
- A report on each person who was a member of tla "B" fj crew on September 11, 1987. $P n
6
- Reports on those in key management positions above the h h
crew level. Cu s VOLUME III C Taylor Associates' Recort [ r-
- Taylor Associates' technical evaluation of the safety limit violation event based upon an analysis of technical data from the event itself, additional plant test data, and b other plant records, together with supporting tables, 7;
~
charts, and appendices. N
- Description of key plant equipment, instrumentation and b controls, and other plant features relevant to the event of $
.r2 September 11, 1987.
n 5
- Description of the sources of data utilized, including a detailed description of the recovered sections of the SAR J 1
tape. 9 d
- Detailed documentation relating to the tests that were
?;
conducted on the reactor recirculation system pumps and .j
)l u
Lt_
M:- valves subsequent to September 11, 1987. ' l e t VOLUME IV y
~~
Exhibits T-t
- Any documentary evidence that we relied upon, in addi-tion to that which Taylor Associates has included in its 1
report.
?
r.. y VOLUME V
.h Witness Statements 3
d
- All sworn statements taken during our investigation.
,I
, - Witness statements are arranged alphabetically. Multi-
!1 ple statements of a witness are in chronological order.
U Each statement begins with a page identifying the witness, m M the date of the statement, and by whom the statement was
, taken. ' ah
.' { l=- G, L. R u P t2 kid L' INI _9- !!j i
. o-k" NOTES E
- 1. Letter from Edwin H. Stier to Philip R. Clark, ,
6 President, GPUN (Sept. 21, 1987) (Exhibit 35). T
~ ~ ^
C
~
- 3. Ihid.
3,.
- 4. Edwin H. Stier -- Member of the New Jersey Bar. e Partner, Stier, Anderson & Malone, 11 East Cliff Street, .
Somerville, New Jersey 08876. October 1, 1982, to October 1, 1984, Member of the firm of Kirstein, Friedman & Cherin, 1]. . P.C., Newark, N.J. 1977 to 1982, Director, New Jersey f'3 Division of Criminal Justice (Assistant Attorney General). y 1969 to 1977, held the position of Deputy Attorney General p in charge, Organized Crime and Special Prosecution Section; - Assistant to the Director and Deputy Director in the New Jersey Division of Criminal Justice. 1967 to 1969, chief of ? the Criminal Division, Office of the United States Attorney, t i District of New Jersey. 1965 to 1967, Assistant U.S. Attorney, District of New Jersey. 1964 to'1965, Law Clerk , to the Honorable Arthur W. Lewis, Judge of the Appellate Division, Superior Court of New Jersey. Graduated from - Rutgers University (AB) 1961 and Rutgers Law School (LLB) _ 1964. - i
- 5. Howard T. Anderson -- Member of the New Jersey and p District of Columbia Bars. Partner, Stier, Anderson & y Malone, 11 East Cliff Street, Somerville, New Jersey 08876. 1979 to 1987, Morgan Associates, Chartered, m Washington, D.C.; currently Of Counsel. 1978 to 1979, 7 Consultant, Senate Small Business Committee. 1977 to 1978,
- Investigator / Attorney for Subcommittee to U.S. House of ,,
Representatives Foreign Affairs Committee conducting " investigation of Korean-American relations; 1971 to 1977, "- Deputy Attorney General, Special Prosecutions Section, Division of Criminal Justice, New Jersey Attorney General's q Office. Graduated from Dartmouth College (BA) 1968 and Qj Harvard Law School (JD) 1971. q
- 6. Mark J. Malone -- Member of the New Jersey and New 'J York Bars. Partner, Stier, Anderson & Malone, 11 East Cliff .,
l Street, Somerville, New Jersey 08876. March 1987 to y' December 1987, Law Offices of Mark J. Malone. September d 1982 to February 1987, Partner in Malone & Villere, Esqs. April 1978 to September 1982, Assistant U.S. Attorney and q Deputy Chief, Special Prosecutions Division, U.S. Attorney's ;.3 10 - l} , _ ._._ _ _ _ _ . _ . _ . _ _ . -- d
1 7 Office. September 1974 to April 1978, Deputy Attorney General, Special Prosecutions Section, Division of Criminal p Justice, New Jersey Attorney General's Office. September d 1973 to September 1974, Law Clerk to the Honorable Frederick . W. Hall, New Jersey Supreme Court Justice. Graduated from 7 Rutgers College (BA) 1967, University of Oklahoma (MA) 1972,
] Rutgers Univsrsity School of Law (JD) 1973, and New York l University School of Law (LL.M) 1978. l T l 3 7. Robert DeGeorge -- Member of the New Jersey Bar.
,, January 1988 to present, Senior Partner, DeGeorge & Avolio, Trenton, New Jersey. 1986 to 1988, Senior Partner in Robert DeGeorge & Associates. 1982 to 1986, Senior Partner in
~.- Paglione, Massi & DeGeorge. 1981 to 1982, Partner in q' DeGeorge & Gendzel. 1981 to 1983, Special Counsel to the a New Jersey Division of Motor Vehicles. 1980 to 1981, Deputy J
Attorney General in charge of Organized Crime and Special l Prosecutions Section, New Jersey Division of Criminal l E Justice. 1979 to 1980, Deputy Attorney General in charge of ' b Corruption Investigation Section. 1964 to 1966, Deputy Attorney General in charge of Drug Division Investigations q Section. Intelligence Analyst, U.S. Army Intelligence y Corp. Graduated from Rutgers University (AB) 1960 and Rutgers Law School (JD) 1964. .O b~ 8. Mary K. Brennan -- Member of the New Jersey, New York, and Maine Ears. Formerly a Managing Partner of
.,1 Brennan & Brennan, Portland, Maine. Served as a Board of
'J Director for Maine Lau Enforcement Planning & Assistance Agency. 1985 to 1986, Of Counsel Stryker, Tams & Dill. Was q General Counsel for the Center for Health Affairs,
}"i Princeton, New Jersey. Teaches medical jurisprudence at New Jersey Medical School. Faculty fellow at Princeton University, Butler College. Past President of the New Jersey Society of Hospital Attorneys. Received under-
.]b graduate (1968) and law (1971) degrees from the University of Maine. Graduated from Harvard University (MPH) 1975. d" l; DfJ
!u) ]
a *
'l $
B
b
. 6 II.
SUMMARY
OF EVENTS OF SEPTEMBER 11, 1987 E. . O A. Orcanization of Oeerations Manacement and "B" Crew - at-Ovster Creek P W C On September 11, 1987, "B" crew was one of six operat-C ing crews at the Oyster Creek Nuclear Generating Station. j[ Each crew worked rotating eight-hour shifts on a six week h cycle, and was headed by a Group Shift Supervisor (GSS), who was assisted by the second-in-command, the Group Operations , L Supervisor (GOS) .1 The GSS was required to have a Senior m Reactor Operator (SRO) license from the NRC.2 Each crew { ! also had NRC-licensed Control Room Operators (CRos) and , nonlicensed Equipment Operators (EOs). In addition, the I Oyster Creek Technical Specifications required each on-duty l l shift to include a Shift Technical Advisor (STA), except during cold shutdown and refueling modes.I The STA, how-ever, was not a permanent member of the crew; individual STAS rotated among the various crews.4 - 0 For labor relations purposes, the GSSs and GOSs were s; considered management personnel, while the CRos and EOs were ~ members of the local IBEW bargaining unit.5 is l' il Each GSS reported directly to the Manager , Plant SS Operations.6 While a shift was on duty, however, the GSS P 1~~ was "directly charged with both the responsibility and the n i command authority over all shift operations, and maintenance j l l activities, and implementation of radiological controls ,
'r.]
under normal and abnormal conditions."7 0 l j! 1 1 l 2
m' i
)
a 1. GPUN Ocarations manacers above crew level 3 Id The GPUN Operations chain of cfommand at Oyster Creek g above the Manager-Plant Operations consisted of the Plant
~
Operations Director, the Oyster Creek Deputy Director, and the Vice President-Director.8 Set forth below are brief f profiles of the persons who held these positions on September 11, 1987, together with a general description of their duties. L _ Director and Decuty Director 7 2 Peter B. Fiedler was the Vice President-1 Director, Oyster Creek Nuclear Generating Station. His sphere of responsibility included engineering and operations. Fiedler, however, was
~
on vacation on September 11, 1987, and he did not participate in the events immediately following ,[ the safety limit violation. j.. m Fiedler's second in command, (SS), was the 3;f
- Deputy Director and the highest ranking Oyster
- Creek Operations manager on the site in the j immediate aftermath of the safety limit viola-
,. tion. The Plant and Materials Department reported directly to (SS), and (SS] reported directly to d Fiedler. As Deputy Director, (SS] traditionally in assumed responsibility for maintenance, and
.G l control of outages.9 !b !W f) a
- la - #9 b .. . _ . , , _ _ . . . . , _ . , . _ _ _ _ . - _ . _ . . _ _ . .- - _ _ . - - - - - - . - . , _ . - - . . . _ _ - - - - - - - - - - - - - -- - - -
E Plant Ooerations Director - E The Plant Operations Director was (N), who R had held this. position since approximately 1981. m (N) was responsible for the overall direction of _Ec the Operations department, which included plant m e operations, radwaste operations, and chemistry. C (N) also played a key role in disciplinary policy 'k [n
~
and administration. He reported directly to Fiedler.10 , MARA;fer-Plant Ooerations (R) had been the Manager-Plant Operations ia since July 1987. He had started with GPUN as an m
~
STA, and later served for two years as Operations Control Manager. (R) reported to (N), the Plant Operations Director. (R) was the GPUN Operations manager immediately above the crew level. The s control room shift supervisors reported directly 7 '
. ~.
~
to him, as did the senior engineer and the ; department administrator.11 (' r
- 2. "B" crew )[
t f::1 The members of "B" crew primarily involved in the j,y_, events of September 11 were the two supervisors (GSS and GOS), the three CRos and the CRO trainee. (Unless otherwise d[A specified, when the term "B" crew is used in this report it 9
-l
~~
refers only to these personst EOs and others who worked R during the same shift are excluded.) 3 S d' M#
r Groun Shift Suoervisor - T ~ The GSS was (HH], who reported directly to i ' (R), the Manager-Plant Operations. (HH] had been j , GSS of "B" crew since 1984. He. received his SRO license in 1983.12-U Grouc Ocarations Suoervisor ' FT ' (HH]'s assistant was (A). He had been GOS of L
"B" crew since 1986. Prior to that, he had been a l CRO on the same crew since 1981.13 1 , control Room Ooerators and Trainee j J The most senior CRO on "B" crew was (VV), who
{- had been a CRO on the shift since 1981.14 tu (II) also received his license in 1981. He b. .t. had been a member of "B" crew since 1935.15 (ZZ) was the least experienced CRO, having yt d received his license in 1985. He had been a q member of "B" crew for approximately a year prior to the safety limit violation.16 , -)el (I] was a CRO trainee, who had previously worked on "B" crew as an EO since approximately
- I. 1981.17
].
Within the "L" crew, the Control Room Operators assigned responsibilities among themselves on a rotating basis. On September 11, 1987, (II] was operating as the . r; - [,e "lead" control room operator for the night. He was respon-sible for maintaining the control room log and handling 3 -tJ B - is - e
,n._. . - - - - - - - - --
i. communications. This was a responsibility which he had E shared with (VV) in the past.18 The remaining two control S i Room Operators were designated as a technical specialist and" 9 an extra. (ZZ) was operating as the "Tech Spec man" and -$ (VV) was serving as the extra on September 11, 1987.19 Pi Also assigned to the "B" shift were three Equipment / F Operators: (WW), (AAA), and (D).20 g C-No STA was on duty on September 11, 1987, because the j plant was in a cold shutdown mode and the reactor tempera- , m ture was less than 212 degrees.21 gj
?
B. Sequence of Events [ The following is a summary of the sequence of events before, during, and after the September 11, 1987 safety , limit violation. References are to other sections of this report which discuss the events in more detail. r U l 1. Events crior to safety limit violation ., i
.u on September 11, 1987, "B" crew was on the last day of
, G l a midnight to 8 a.m. shift. During the 12-8 shift on the h previous day, September 10, "B" crew had conducted 'g , operations to put the plant in a cold shutdown condition, and the plant was in that condition when "B" crew commenced Ij
- J its shift on September 11.22 ,
a rJ One of the shutdown operations was to remove from q l service all but two of the five recirculation pumps. These j a
]
q ~
E U are the pumps that keep w'ater flowing between the annulus 7 (or downcomer) and core regions of the reactor. Such i communication is essential because it enables operators to ' monitor water levels in the core. Each recirculation "loop," in addition to a pump, consists of a suction valve, a discharge valve, and a two-inch bypass valve.23 m J In the aftermath of an event that occurred on May 2, [- 1979, during which all five recirculation loops were closed , J and an alarm was received indicating low water level in the O core region, the NRC imposed a "safety limit" requiring that a at least two recirculation loops be kept open at all times, 5 j except when the reactor head is off and the reactor flooded to a level above the main steam nozzles. The purpose of the b ftd safety limit was to insure communication between the core a and annulus regions. Violation of a safety limit required j' j shutdown of the reactor pending NRC permission to restart.24 lp ' The practice of running only two pumps while the plant r was in a cold shutdown condition had been instituted lJ approximately a year earlier in order to save wear and tear 1 i< s on the pumps. When pumps were removed from service their 7 associated discharge valves normally were closed. This was 3* done to prevent a condition known as "reverse flow."25 f i b] When "B" crew began its shift on September 11, the "A," lq "D," and "E" recirculation pumps were out of service and their discharge valves were closed. Only the "B" and "C" j pumps were operating with their associated suction, bypass ta LI L_----.-..-----------.-.--------.------
7 lx a and discharge valves open.26 - h Shortly after 2 a.m., a maintenance mechanic began , removing the packing from an isolation valve (V-5-167) on ,[ S the Reactor Building Closed Cooling Water (RBCCW) system in the course of performing a maintenance operation.27 The f RBCCW system provides cooling water to a number of .;y components, including the recirculation pump motors.28 The E valve was located in the area of the reactor building known as the "twenty-three foot level." When the mechanic removed the packing, a leak developed from the valve, spraying the El a mechanic and spilling onto the floor below. The leaking e water was slightly radioactive and contained corrosive ,i chemicals.29
.q t
l A radiological control technician ("Radtech") who was ,,
. 4 in the vicinity heard the mechanic's call for help and saw d the water spraying out. He telephoned the control room for 7 assistance.30
,7 l i:"
In the control room, CRO (II] took the call. He notified GSS (HH] and GOS (A) about the leak on the twenty- ], three foot level, and (A) obtained further details from the - Radtech over the telephone.31 At 2:11 a.m., (A) and an EO, -b (WW), exited the control room and proceeded to the twenty- f. 1 J three foot level to attend to the leak.32 After arriving at the site of the leak, (A) reported to " the control room that its source was the RBCCW system. He j J
.j q
~
~l k also reported that the leak was heavy and was forming a large puddle on the floor that, in (A]'s view, threatened to damage electrical components.33 (HH] decided to attempt to H isolate the leak by closing valves i.n the RBCCW system. One such valve could be closed electronically from the control room. The other was a manually operated valve located on ?~ the fifty-one foot level of the reactor building.34 g .~ Closing these valves would have the effect of stopping RBCCW flow through the drywell. Operating procedures ~
specified that recirculation pumps could not be run without RBCCW flow. (This was to prevent overheating of the pump
]1 and motor generator components.) Accordingly, (HH] ordered the "B" and "C" pumps -- the only ones operating at the time '
i l Ld -- to be "secured," i.e., taken out of service.35 b t! 2. Safety limit event
!?
[; CRO (VV) responded to (HH]'s order to secure the
,,, pumps. Standing in front of the section of the control
-t M panel where the "B" and "C" loop controls are located, he g began what he termed a "normal pump shutdown." Under this g-procedure -- which, because of the safety limit, was not to m(s' s
.. be used'when only two recirculation loops were open -- a pump was shut down after a sequence of steps, one of which b
u was to close the pump's associated discharge valve. Seconds q after (VV) moved the "B" discharge valve control to the UJ closed position, the "less-than-two-loops-open" alarm i2 a appeared, indicating that a safety limit violation had fj Q
l l l G occurred.36 _ [L bg (VV) reacted immediately to the safety limit alarm by . opening the "A" and "D" discharge valves. As a result, the alarzt cleared less than two minutes after it had come in. Analysis of the technical data indicated that the safety fI W limit alarm occurred at 2:17:34 and cleared at 2:19:17.37 m W
-3 After the alarm, the crew completed the operations ,
P necessary to isolate the leak. This isolation did not, Q m however, stop the leak. It was stopped when a maintenance A supervisor manually backseated the leaking valve.38 y n Beginning at approximately 2:45 a.m., the crew - '[.1 performed a series of operations to restore the plant to its ., l pre-leak condition. By approximately 3:15 a.m., RBCCW flow j had been restored to the drywell and two recirculation loops were again open with their pumps operating.39
- 3. Tearina and diseosal of SAR tace ,
T At some point after the alarm had cleared and he had no 1 immediate operations to perform, (VV) went behind the iZ E control panel to the Sequence of Alarms Recorder (SAR). c. This machine recorded sequentially the time and nature of ;y) alarms received, and printad the alarm messages on adding . . , s machine-sized tape.40 (VV) tore tape from the machine, L'I threw some of what he had torn in a wastepaper basket, and v put the rest in his pockets. These actions were completed prior to 3 a.m., and most likely between 2:24 and 2:32 , il U _____,.'n, -
y6 _ _ a.m. Some of the torn tape -- including the portion reflecting the safety limit violation -- was later recovered from trash that had been collected from the control room. The rest, according to (vv), was flushed down a toilet
, outside the control room between 3:35 and 3:44 a.m.41 W
Q
., 4. Renortine of violation to hicher manacement
% and NRC ja All of the members of "B" crew except (A), who was out b of the control room, witnessed the safety limit alarm and understood its significance. None except (VV), however, witnessed the tearing, removal, or disposal of the SAR f7 h -
tape.42 A few minutes after 3 a.m., CRO (ZZ) went to the SAR to obtain the times of the safety limit event for (II) to enter 1 pl W in the control room log. He observed that there was a foot p to a foot and one half of paper hanging out of the top of
E.)
the machine and a few feet piled on the floor. Closer i inspection of the tape revealed a gap in recorded alarms , from 6:48 p.m. on September 10 to 2:32 a.m. on September 11, l1 l} i a period that included the safety limit violation. (ZZ) 'q concluded that someone had taken the missing tape.43 Li-(ZZ) immediately reported this development to (HH), who h,l
" looked "dumbfounded" but otherwise made no response. (ZZ) l[j than asked every member of the crew then in the control room if he had the tape. All said no.44 '
l 'l iU 1 b') lk ' (2.o I
O Between.approximately 3:25 and 3:30 a.m., b~ (HM) telephoned his immediate supervisor, (R), at (R)'s home. Q L (HH] told (R) that there had been a leak on the twenty-three' W foot level and that a worker had been sprayed and was g possibly injured. (HH) did not disclose to (R) either the , safety limit violation or the fact that SAR tape was missing.45 $ J At about the same time that (HH] was calling (R), [ZZ) hN approached (A) (who had been out of the control room during most of the period between the safety limit violation and h c (HH]'s 3:25 - 3:30 a.m. call to (R]) and asked to speak to
??
him outside the control room. They exited together at 3:28 .a a.m., and (ZZ) informed (A) that there had been a safety y limit violation and that SAR tape covering its period of the violation was missing.46 , Shortly after 3:41 a.m., when (HH) returned to the {' control room after a brief discussion with a health and safety representative concerning the worker sprayed by the f leak, (A) asked him whether he had told (R) about the safety . limit violation. (HH) indicated that he had not. (A) urged b l (HH] to report the violation immediately. (HH) agreed and ?) d"i began walking toward his office. Before (HH) reached his office, (R) called back to ask about the status of the recirculation pumps and to remind the crew to keep the valves properly aligned -- i.e., to maintain two open loops. ((R]'s call had been prompted by questions put to ' 1 ! 's
'.j
- a l_ -_ - - _ -_ _ ._- _ . _ _ . . . , _ _
1
w l 1 hC him by Plant Operations Director (N), whom (R) had called
~
[ J after (HH]'s 3:25 - 3:30 a.m. call to (R].) In response to (R), (HH] told (R) about the safety limit violation. (R)
@ told (HH] to make the required NRC and internal -
notifications. (R) then called (N) and reported what he ha'd D b learned from (HH). (N), in turn, notified Oyster Creek
] Deputy Director (SS).47 a
~
q By approximately 4 a.m., all of the key Operations .Q managers at Oyster Creek had been informed of the safety
] limit violation, additional notifications were in progress, a
and plans were being made for briefings and critiques to be OL conducted later in the morning. However, because (N] and g (R) were unsure when the violation had occurrod, (R) called lfi' back to the control room to obtain this information. (HH] E,' answered (R]'s call but, because he was in the process of .Q making his notification to the NRC (which was later recorded
- p pj as having been made at 4:05 a.m.), (HH) handed the telephone r
r, to (A). In response to (R]'s question about the time of the a J event, (A) provided an estimate of 2:24 a.m. that he had El obtained by reviewing plant computer data related to reactor
*) ~
water level. Although (A) conveyed the impression that SAR O jj .'. data were unavailable for the time of the event, he did not g tell (R) that the tape was missing and that someone had T; 4J apparently taken it.48 ,O 'b On the basis of his conversation with (A), (R) formed .i., the impression that SAR data were unavailable because the lH w (? ,; - 23 - r b
machine had run out of paper. (R) conveyed this impression to (N).49 h
- 5. Manacement investication of missina SAR tane f
- 3{1 Between approximately 3:45 a.m. and 4:30 a.m., there p p*
were a series of telephone calls among GPUN managers ,< concerning the safety limit violation. During these f o conversations, plans were made and instructions given for .- E the gathering of information about the event in preparation 'j for briefings and critiques. The NRC was notified of the 7 C violation during this period, both formally through the " Emergency Notification System (ENS), and informally through 2 the NRC site representative.50
'I
^
The first managers arrived at the plant between 4:30 m and 5:00 a.m. (SS), (R), and (MM), (R]'s assistant, went to , i a crew about the the control room and spoke to members of "B"
~
safety limit event. A briefinq for GPUN and NRC personnel had been scheduled for 6 a.m., and (MM) was assigned to 4
!.')
gather detailed information for it. Shortly before 6 a.m., (MM) inspected the SAR and noticed the same gap in recorded alarms earlier observed by (ZZ). (MM) laft the control room El and reported what he had seen to (R), who in turn informed O, (N).51 , ! (MM) reported what he had observed about the condition .,
,d of the SAR tape just as the 6 a.m. briefing was scheduled to a begin. Immediately after the briefing, (N) called a meeting g' fJ
- 24 - ]
, _ - . - _ ~ - - - , - - - , , - ~ . - _ - _ , _ _ _ - _ _ _ . _ , . _ . _ _ _ . . . . _ . , __ ..,_.-,_..,..,..-___,,,-,,______.,,___,____,_.,,.___,___c__. ,
n (k , - - lT y in his office to inquire into the missing SAR data. During this meeting [HH] was questioned, the crew was asked for E additional information, and an experiment was performed to
~
determine whether the SAR's having run out of tape could {*
, explain the missing data. It could not.52 $ The experiment and inquiries led the managers to 4
suspect that the crew was concealing information. Apart from the missing SAR tape, this suspicion was fueled by what 3 the managers regarded as (HH)'s inadequate explanation for his delay in reporting the safety limit violation.53 At approximately 7:30 a.m., just after "B" crew had been informed that it was being relieved of licensed duties t pending the outcome of the safety limit investigation, [VV) n, admitted to (A) and (HH), and later to (R) , that he had torn
.l 4
" the SAR tape. ile claimed, however, that he had simply let the tape drop on the floor and had not done anything further with it.54 2 Within the following hour, [R) and (M) i:egan to m organize a search of the trash in an attempt to locate the L' missing tape. Between approximately 11:30 a.m. and noon,
, three SAR tape fragments containing printed alarm messages were recovered from trash that had been collected from the control room. One of these fragments contained messages evidencing the safety limit event.55 i-
'l A short time after this discovery, NRC site representa-tu U 9 d
11
r T L".:f tives were shown the tape fragments and briefed on the circumstances surrounding the apparent destruction, {a concealment, or disposal of SAR tape. They were also t? briefed on the results of preliminary analyses of plant data (p by GPUN technical personnel. These analyses raised the possibility that both of the open recirculation loops had been closed during the safety limit event, and not just one i as had been reported to management by members of the crew. .. b Both the removal and disposal of the SAR tape and the p [a? analyses indicating the closure of two loops were formally ,, v; reported to the NRC early on the afternoon of September 11, C 1987.56 - i 3 0 m
.u
*\
m
.F.
9.31 4 A
<=9 1
b q D I 9 d 3)i ,
7
- i. NOTES O
.A A. praanization of Ooerations Manacement and "B" Crew at ,
Ovster Creek
~
1., Oyster Creek Nuclear Generating Station Procedure p 101, "Organization and Responsibility," Rev. 16, effective p Feb. 21, 1987, Sections 4.11.1 and 4.11.2, pp. 21.0-22.0 (Exhibit 48) (hereinafter cited as "Station Procedure 101"]; O Sworn Statement of (ZZ) (Oct. 7, 1987) (hereinafter cited as "(ZZ), 10/7/87"), pp. 16-17.
- 2. Station Procedure 101, Section 4.11.1, p. 22.0 (Exhibit 48).
The GOS was also required to have an SRO license in order to be upgraded to GSS. Jhisl., Section 4.11.2, p. 22.0. (" 3. Appendix A to Provisional Operating License DPR-16, y) Techncial Specifications and bases for Oyster Creek Nuclear Power Plant Unit No. 1, Ocean County, New Jersey (herein- "m after cited as Oycter Creek Technical Specifications),
] Section 6.2.2(h) (Exhibit 15). -
.D; 4. Sworn Statement of (R) (Nov. 4, 1987), pp. 7-8 ti (hereinafter cited as "(R)").
- 5. Jersey Central Power i Light Co./IREW Agreement and supfle.ne.'ts , Nov. 1, 1985 - Oct. 31, 1987, pp. 1, 51-52 '
q (Exhibit @) ;
-1 (R), pp. 38-39; 'Q Sworn Statement of (N) (Nov. 4, 1987), pp. 7-9
- b- [ hereinafter cited as "(N]").
m. y.. 6. Station Procedure 101, Section 4.11.1, p. 21.0 (Exhibit 48). 1] L 7. Memorandum from P.R. Clark, President, GPUN and P. B. Fiedler, Vice President-Director, Oyster Creek, to Oyster Creek GSSs (March 5, 1987), Attachnent 11 to Oyster Creek
- i {j,7 Generating Station Procedure 106, Rev. 45, effective Aug. 8, 1987, pp. E9 E9-2 (Exhibit 16).
!.1 U
m g B l
( - l Egg Station Procedure 101, pp. 2'1-22 (Exhibit 48).
~
R G l
- 8. Station Procedure 101, Section 7.3, Exhibit 3, p. E3.- a 1 (Exhibit 48).
~
! 9. Ibid., Section 4.2-4.3, pp. 4.0-6.0; r Sworn Statement of (SS) (Oct. 29, 1987), pp. 4-6 ',Si e (hereinafter cited as "(SS)"). . Mi
- 10. [N1, pp. 4-8; Station Procedure 101, Section 4.7, pp. 9.0-13.0 I (Exhibit 48). $
- 11. (R), pp. 4-7; s 1
. Station Procedure 101, Section 4.7.2, p~o . 10.0-11.0 (Exhibit 48). ~
- 12. Sworn Statement of (HH) (Oct. 22, 1987), pp. 5-15
[ hereinafter cited as "(HH]"). 3
- 13. Sworn Statement of (A) '( O ct . 27, 1987), pp. 4-7 /[
[ hereinafter cited as "(A)"). '-
'G
- 14. Sworn Statement of (VV) (Oct. 23, 1987), pp. 5-6 $
(hereinafter cited as "[Vv]"). I m Q
- 15. Sworn Statement of (II) (Oct. 8, 1987), pp. 4-7
[ hereinafter cited as "(II), 10/8/87"). y b 16
- 16. (ZZ), 10/7/87, pp. 5-8.
si
,a
- 17. Sworn Statement of (I) (Oct. 8, 1987), p. 10 (hereinafter cited as "(I), 10/8/87"). p
')
- 18. (II), 10/8/87, pp. 9-12. ..
.}
- 19. (ZZ), 10/7/87, pp. 18, 30-31; 2.1 (VV), p. 28. Il fj
(ZZ], 10/7/87,'p. 14.
~
20. .R
$ 21. Sworn Statement of (NN) (Oct. 16, 1987), p. 42 -
(hereinafter cited as "(NN)"). B. Secuence of Events ~:7 H 22. Section VI(A); a [. Taylor Report, Section D-5. i b.s '
. 23. Taylor Report, Section B-1.
- 24. Ihisi., Section B-6;
-,9 Section V(A); { Oyster Creek Technical Specifications, Section 2.1.E (Exhibit 9A).
- t ]h
- 25. Section VI(A);
Taylor Report, Sections D-7, B-1. 9 b 26. Taylor Report, Section D-6. ['T -{j 27. Ihist. ; I m NRC Augmented Inspection Team Report No. 50-
.') 219/87-29 (Sept. 25, 1987), p. 3 (hareinafter cited as "NRC Augmented Report") (Exhibit 27).
V 28. Taylor Report, Section B-5. M, . ['. . 29. Sworn Statement of (P) (Oct. 7, 1987), pp. 10-11 (hereinafter cited as "(P)");
.h} '4 Sworn Statement of (X) (Oct. 6, 1987), pp. 9, 25-27 (hereinafter cited as "(X]").
- v. ?
!l 6 30. (X), p. 9.
f!u e
;]y ,
n
. e
- 31. (II), 10/8/87, pp. 38-41;
[A), p. 75. '
- 32. (II), 10/8/87, p. 39; (A), pp. 75-77;
?
Sworn Statement of (W) (Oct. 5, 1987), pp. 18-19 g ( h e r e i n a f t e.r c i t e d a s " ( W ) ".) ; , G Control Room Access Records 10:00 p.m.,. Sept. 10, 'd-1987 -- 11:30 n.m., Sept. 11, 1987, "Exits" (Exhibit 14D) * [ hereinafter cited as "Access Records -- Exits"]; [5 Chart showing "B" Crew Control Room Entries and b Exits, Sept. 11, 1987 (Exhibit 14C) (hereinafter cited as "Access Chart"). g.
- 33. (A), pp. 78-80. y 1
s.i l
- 34. Ikid., p. 80; Taylor Report, Section B-5. . ,
I
- 35. Section VI(A). {l
- 36. Ih.id. The alarm is discussed in Volume I, Section Of V(B) of this report and in Volume III (Taylor Report), ;
I Section B-7. ! c . h
- 37. Section V(B). 3,g.g Volume III (Taylor Report),
Section E. g i. 3 8' . Section VI(B). _ Ql
- d
- 39. Taylor Report, Section D-12 and Table E-1. ,,
'b
- 40. Ibid., Sections C-1 B-8; a
Section V(C). .j
- 41. Section VI(D). I}
f a 4 1) I
-l2 i
~
- 42. Sections VI(B) and (D).
- 43. Section VI(D). .
- 44. Ibid.
{ 45. Section VI(B).
- 46. Ihid.
W
- 47. Ihid.
L
', 48. Section VI(E).
.a iJ
- 49. Ihid.
E['1 l
- 50. Sections VI(B), (C), and (E).
q; -
- 51. Section VI(E). '
q . J 52. Ibid. d :. 53. Inla. >
- 54. Ikid.
l} 55. Ibid. o c' 56. Sections VI(E) and (F). ![.
- l.J l G
U
- 13 it.i
.Tl :d a
nA .
G O III. Lt11ZRE - The remaining sections of Volume I of this report will . , address and resolve the fc11owing issues: r-A. Whether the safety limit violation on September 'd 11, 1987, occurred as described by CRO [VV). *
.b u B. Whether the safety limit violation'was properly 7*
reported within the GPUN chain of command.
,7 y
U C. Whether the safety limit violation was properJ.y reported to the NRC. c\
~
D. Whether there was intentional destruction, concealment, or' disposal of SAR records pertaining ) J to the safety limit violation. e i e E. Whether the fr. cts concerning the missing SAR ? 03 records were properly' reported within the GPUN l chain of commar.d. [h ESA F. Whether the facts concerning the missing SAR 52 h records were properly reported to the NRC. 3 0} M
'4 d
/I
.g l
l tj
~ . _ . -
IV. CONCLUSIONS - A. Scone of Findinas 2u This investigation has devoted considerable attention to the performance of the "B" shift crew during and l5; following the safety limit event. We have attempted to identify as precisely as possible the duties created by NRC 1 regulations, technical specifications, company procedures, n and standard operating practices, and to determine whether a the attitude and behavior of individual personnel in E
- L! performing their jobs were consistent with those duties.
Additionally, we have investigated the extent to which }7 4"1 management above the "B" crew level participated in or I) tolerated improper practices. f? Certain issues related to the safety limit violation,
- U however, were not within the scope of this investigation.
We did not attempt to evaluate the safety significance of - i, the violation, except to the extent that the nature of the
). ,
jw violation was relevant to the credibility of witnesses or to i ir an understanding of the actiotis and motives of key person-nel. We also did not attempt to recommend disciplinary or rm g other personnel action, nor did we assess the current fit-ness for duty of any crew member curreittly suspended from
. U_ !J licensed or control room duties.
o [j In preparing this report, we have drawn inferences that n we believe are consistent with the weight of the evidence.
!(
d d D _ _ _ . -._. _ - - - - - - ,
However, we recognize that in some areas the evidence is $1 J less conclusive than in others. Where there are factual CT W conflicts concerning the timing and sequence of events or
. n concerning what actually happened, we have attempted to
{ reralve them. Where we could not resolve conflicts in the evidence, we attempted to indicate the most likely inferencs b to be drawn and to assess the significance of the d conflict. The record contained in this report is presented i,' h not only to show what evidence we believe supports our
~
- i findings, but also to permit the reader to make an independent judgment concerning those findings. L l
'T B. Summarv of Findings ;
Our findings and conclusions are contained in our discussion of each issue in Volume I, Section VI, as well as n in our individual discussions of "B" crew and key management c personnel in Volume II, and the principal findings are set forth at the end of each section. Those findings are
- 4 summarized below: Mi
.-J General Findines f.}
VJ safety Limit violation 1
- 1. (vv) caused v.he safety limit alarm to be actuated when he moved the "B" recirculation discharge valve control jj
- J to the closed position in the course of securing the "B" u
recirculation pump, d
- q
- 2. (VV) made this error because, in a lapse of j
- 34 -
]
..)
._ - - . - _ _ = _. -- .- -
concentration, he reacted to GSS (HH]'s order to secure the pumps by following what (W) termed a "normal shutdown" procedure that was not appropriate for the prevailing plant conditions (i.e., only two loops open) that existed at the
, tim..
- 1
. 3. No one else breached any standard of conduct that contributed to the safety limit violation.
fh.
- 4. (W) immediately corrected his error by opening
., the "A" and "D" discharge valves, restoring the plant to O compliance with the safety limit within two minutes. p LJ 5. The "c" discharge valve remained open throughout the event, and at no time was there a loss of communication U between the core and annulus regions of the reactor vessel. R . U Reeortine of Safety Limit Violation Within GPUN 1 Chain of Commandd
- 1. There was no agreement among the members of "B" crew to conceal, fail to report, or delay reporting the safety limit violation.
{ g, 2. The responsibility for reporting the safety limit
~
n .. violation to higher management belonged to GSS (HH). O. l~ 3. No other member of the crew encouraged (HH) to Q conceal, not report, or delay reporting the safety limit '
.U violation.
LJ FI - as - a [3
?
I;A
- 4. During the nearly one and one-half hour delay between the safety limit alarm and (HH]'s report of it to 3l W
higher management, (HH] was preoccupied with matters requiring his attention, such as the leak on the twenty-three foot level, a pon sibly injured worker, and restoring e D ; the plant to pre-leak conditions. These reasons, however, , do not fully explain or justify his failure to report the @ J violation earlier. .- C
- 5. By delaying his report to higher management, (HH]
m ' risked violating an NRC reporting deadline and created an a appearance that, combined with other events, led to a e generalized suspicion by higher managers that the crew had e been attempting to conceal the safety limit violation. l Rateertine Safety Limit Violation to NRC 3 7 c l i
- 1. GPUN management above the crew level did not know J t
d about the safety limit violation until i.pproximately 3:45 a.m. d,,
- 2. Within twenty minutes after management above the $}
~
crew level learned about the violation, it was reported to I the NRC through the ENS telephone line. a 1
- 3. The report to the NRC made by GSS (HH] at 4:05 a.m. was substantially accurate except for a 13 minute error in the time of the event, which we concluded was i unintentional. ?-
l
]
]
4 3
- 4. The 4:05 a.m. report submitted to the NRC by the GSS was timely using the four-hour reporting category.
Q
- 5. After the 4:05 a.m. ENS report, both (HH) and (N) made informal notifications by telephone to the NRC resident inspector.
- 6. A detailed briefing was held at 6 a.m., which the
. NRC resident as well as various GPUN personnel attended, at p
[ which information about the safety limit violation was disseminated, comprising a substantially complete and J accurate account of what was known about the event at that time. ,
- 7. GPUN management above the crew level acted with speed and diligence -in reporting the safety limit violation to the NRC after learning about it.
c
], Destruction / Concealment of SAR Tate 4 m
,[s 1. After the safety limit violation, (W) tore a l quantity of SAR tape from the machine. He later threw some in the wastapaper basket located in the control room kitchen and put most of the torn tape in his pockets. These actions were probably completed prior to 2:32 a.m. and certainly ' ry
,] completed prior to a few minutes past 3:00 a.m., when (ZZ) discovered that SAR tape was missing.
M O
- 2. (W) carried SAR tape in his pockets until shortly r
!bz i before 3:45 a.m., when he flushed it down a toilet in a h ea g 5
bathroom outside the control room. -
- 3. The tape (Vv'] flushed down the toilet did not ,
pertain to the safety limit violation, with the possible ,y t.) exception of a fragment of tape that recorded the time of
- occurrence of the alarm. Ei b
- 4. A portion of the tape thrown in the kitchen [g '
wastepaper basket and later recovered recorded the entire [ safety limit event, from the alarm to the clearing of the
'e{
alarm less than two minutes later, except for the printed time of the alarm actuation itself, which we were able to G establish from other data. g w
- 5. (VV) acted alone in tearing and disposing of the m m
O, SAR tape. l e
- 6. No one other than (VV) knew what had happened to C the tape (VV) took from the machine until (VV) partially q 8) admitted what he had done shortly before the and of the shift.
[c-
- 7. (VV) tore and disposed of the tape out of anger G D
and frustration and not because he intended to conceal evidence of the safety limit violation. y G Recortina of Missina SAR TaDe Within GPUN Chain of Command 5 [3 R
- 1. CRO (ZZ) was the first person other than (VV) to d notice, between approximately 3:00 and 3:10 a.m., that SAR ..
>l
;d M1
't '. )
h data were missing for the period of the safety limit event. 3 1 2.' Between approximately 3:10 and 3:15 a.m., (ZZ) . reported to GOS (HH] that SAR data were missing, b g 3. A short time later, between 3:28 and 3:30 a.m., b (ZZ) reported to GOS (A) that SAR data were missing. 1
- 4. CRO (ZZ) promptly and accurately reported the 7 condition of the SAR tape to his supervisors, the GSS and
~
the GOS.
]J
$. By 3:30 a.m., every member of "B" crew had been R told about the missing SAR data.
13 p 6. No member of the crew considered the possibility ~ l'J* that the SAR machine had run out of tape to be a plausible -f explanation for the missing data. _1 7. GSS (HH], who had the primary responsibility for 'J reporting to higher management, did not make a timely and - t ' {, accurate repo'rt concerning the condition of the SAR tape. -t 8. The first GPUN manager above the crew level to r: learn about the missing SAR data was Operations Manager (R),
- d. who became aware that SAR data were unavailable for the time t, of the safety limit event during a telephone conversation G
with GOS (A) between approximately 4:00 and 4:05 a.m. te b 9. During his telephone conversation with (R], (A) p omitted relevant details concerning the condition of the SAR d
]3s
tape. As a result, (R) formed the impression that the reason SAR data were unavailable was that the machine had run out of paper. n! El
- 10. (R) conveyed both the information that SAR data were nissing and the "ran out of paper" explanation to his F{
immediate superior in the GPUN chain of command, (N). -[
@}
- 11. In later conversations with management .-
I representatives, neither (HH] nor (A) corrected the I impression that the data were missing because the machine <3 l1 had run out of tape. As a result, when a management d investigation revealed that explanation to be implausible, d the entire crev Jame under suspicion. 7
- 12. The first management representative to see the condition of the SAR tape was (MM), who inspected it shortly <
before 6 a.m. and, like (ZZ),' noticed a gap in the tape. z)
- 13. (R) and (N) did not begin to suspect that anyonel had destroyed or tampered with the SAR tape until they {y received (MM]'s report on the condition of the tape just ,,
f before the 6 a.m. meeting that had been called to discuss M the safety limit event. O E
- 14. Following the 6 a.m. meeting, between approxi- r i b-mately 6:30 and 7:30 a.m., (R), (N), (MM), and others met in (N]'s office to discuss the missing SAR data; (SS), the highest-ranking GPUN official then on the site, was also ,,
l made aware of the circumstances surrounding the missing data i) l
^
.~l
. ,j O
_. - 1
p- . t ,- during this time. '
- 15. Between approximately 6:30 a.m. and noon, the managers above the crew level and various technical, maint-
.A enance, and staff personnel were actively investigating the h!
w missing SAR tape as well as other aspects of the safety
. limit event, an investigation which included attempts to l
J .- reconstruct the event with other data, an experiment to
~
, determine whether the machine ran out of paper, questioning
( of members of the crew, and a search of the trash. n , b 16. Between approximately 11:30 a.m. and noon, three f r' fragments of the missing SAR tape were found as a result of
' i' '
the trash search, one of which evidenced the safety limit 1s
'l violation.
is . _
- 17. Within a short time after the discovery of the tape fragments, the news was conveyed to the top management m
(j , levels of GPUN and to the local NRC representatives.
- 18. Management personnel above the crew level acted with reasonable speed and diligence in verifying and
.l) [j' reporting possible tampering with the SAR tape. Q. ,.. - Recortinc of Missinc SAR Tace to NRC6 ')?
!2 1. Between approximately 11:30 a.m. and noon, the o apparent destruction and/or concealment of SAR tape was f$
reported to NRC site representatives. This report was n l) accurate within the limits of the information available. It l__ l
. l I i r;, i was made shortly after tha recovery of tape fragments during ,
1 a management-ordered search of the trash. { j 2. A formal report was submitted to the NRC at % approximately 1:20 p.m., which contained information that
.T was accurate within the limits of the information available 'g
[ at the time. 4 s,~;
- 3. The timing of the GPUN reports to the NRC was .
l A i prompted by the recovary of the SAR tape fragments, which k, , confirmed earlier management suspicions that there had been p D an intentional concealment or destruction of records.
- 4. The management investigation of the missing SAR tape was conducted diligently, with the goal of uncovering l and reporting the reason for the missing SAR data.
l 't b Findings Concerning Individual Responsibility k g 7 ! hI D (HH] did not contribute to the error that caused the safety limit violation. Having witnessed that violation, , however, it was his responsibility as GSS to determine the
,,,]
+
appropriate reporting category for the event and then to :b , make the required notifications. He did not carry out that T responsibility when he waited nearly one and one-half hours before reporting the safety limit violation to his immediate superior in the GPUN chain of command. Fortuitously, this ,, delay did not result in a violation of an NRC reporting a
- }
- 1 a
_ rcquireccnt. (HH)'O VCporto conccrning tha ocfoty linit , m violation were accurate within the limits of the information available to him. . Although (HM) did not act in accordance with his "w responsibilitics as a GSS with respect to reporting the w' safety limit violation, we concluded that he was not motivated by an intention to conceal the violation or J
. evidence of it. Essentially, (HH] did not deal with the 3
L safety limit violation during a critical period, while m carrying out his other duties in a competent and responsible d manner. This pattern of behavior was influenced at least in part by a severe psychological reaction to stress. (HH] did not take part in the destruction, disposal, or
;q p
concealment of the SAR tape. Although (HH) claimed not to have heard anything, he was told about the missing SAR tape 3 y u shortly after 3:00 a.m. He did not make any effort to locate it until after 4:30 a.m., when he asked the crew members if anyone had it, and did not report to higher a
) management personnel that SAR tape was missing until they had independently learned of the tape's condition. (HH)'s lh failure to report the missing tape appears to have been j ,g motivated by a desire to find or reconstruct the missing data before his superiors became aware of the possibility lC that someone had taken the tape. The result of (HH]'s
.a failure to report the condition of the tape, however, was 'P
- gj that his superiors in the GPUN chain of command learned 4 c, about it themselves. Consequently, they felt that they had lO r
,. i_.
been misled about the SAR tape and became increasingly suspicious of the crew. , n
.[,A18 .g (A) did not contribute to the error that caused the safety limit violation and did not know that there had been ..;
one until more than an hour after it occurred. When CRO (ZZ) told him about the violation, (A) reacted in a timely and appropriate manner. After learning that the safety limit violation had not been reported to higher management, @g (A) insisted to GSS [HH) that it be reported immediately, (A)'s later descriptions of the safety limit violation were accurate within the limits of the information available to him.
. e (A) did not take part in the removal, destruction, a concealment, or disposal of the SAR tape. He first learned p
~
about the missing tape at the same time that he learned about the safety limit violation. (A) did not report what he knew about the missing tape to higher management in a L, timely manner. He did not, however, intend to conceal the 3 missing tape indefinitely. Instead, he hoped that the 7 reason for the tape's absence would be explained before it cast an unwarranted suspicion on the crew. rW1 9 y a (W) caused the safety limit violation when, in a lapse q
.-)
of concentration, he commenced a "normal shutdown" procedure
':/
3 F9 ,
- 1
, . ~ for taking the "B" and "C" recirculation pumps out of service. This procedure, which involved closing the ,
-. discharge valves before tripping the pumps, was inappropri-
{;p ate'for the existing plant conditions because only two i {
- recirculation loops were open, the minimum required by the safety limit. (VV) realized his mistake when, seconds after r moving the "B" discharge valve control to the closed q position, he saw the green safety limit alarm. He immedi-d ately corrected his error by opening the "D" and "A" dis-charge valves, and the alarm cleared less than two minutes after it had been actuated. The "C" valve remained open C
c _. throughout the event. F1
! Because the safety limit alarm was witnessed by the GSS and other members of the crew, (W) did not have to report 3 i J. that it occurred. Later, however, he was called upon to q _ describe how it occurred, and the sequence of events he 15 -
described was for the most part consistent with the tech- ; fi} nical analyses and other evidence. To the extent that
.s (W)'s account could not be reconciled with the technical data, we concluded that (W) erred in his recollection.
The evidence did not support a conclusion that the inaccuracies
~
in his description were intentional. M Ji At some point after the safety limit alarm cleared, and p probably between 2:24 and 2:32 a.m., (W) went to the SAR d ' machine and tore tape away from it, including the portions of tape reflecting the safety limit violation. He threw n d Il }
9 some of this tape -- including the portion relevant to the _ iS violation -- into a wastapaper basket, and later flushed the . rest down a toilet. We concluded that (W)'s tearing and g disposal of the tape resulted from self-directed anger and
~G frustration, and not from an intention to conceal evidence. Et. ,
(W) did not report to (HH] or anyone else what he had
.]J done with the tape until approximately 7:30 a.m., when he .-
admitted tearing it from the machine but denied doing 7 anything further with it. He did not admit that he also disposed of the tape until late afternoon on September 11. d We concluded that (W) delayed reporting what he had done with the tape because of embarrassment and the possibility of additional punishment, and not because he hoped to f. conceal the safety limit violation or data pertaining to it. ,_ r g lo 9 (II) did not contribute to the operator error that caused the safety limit violation. Because GSS (HH] wit-nessed the safety limit alarm, (II) was not responsible for reporting its occurrence to higher management or to the p NRC. As the designated "lead" CRO, however, he was my
.?
~
responsible for making an appropriate log entry concerning the violation. The entry he made, styled a "late entry" because it was out of sequence with other entries in the log book, contained internal inconsistencies and factual !f errors. These, we concluded, were inadvertent, resulting -
~
from carelessness, reliance on assumptions, and lack of l U h,
. . . . ~ . . . - - - _. . _ . .- . . _
9 '
'O -
assistance from other members of the crew. E 'l'~: (II) took no part in the destruction, concealment, or - disposal of the SAR tape. He learned about the missing tape l when, in (II)'s presence, (ZZ) reported it to (MH). Because a
'A (HH), and shortly thereafter (A), knew about the missing m tape, (II) incurred no immediate responsibility to report it to higher management or the NRC. Later, when asked about 3 the tape by a critique panel, he rendered an accurate "2
account of wnat he knew. He did not make an entry in the m j, control room log about the tape because he believed that it was not the kind of event that should be entered on the log. r7 I bl
,, un 22 Y~
(ZZ) did not contribute to the operator error that n . 'j caused the safety limit violation and, under the circum-stances, was not responsible for reporting that violation. 'd He nevertheless took the initiative of reporting it to (A), !] resulting in (A)'s insistence that (HH] report the violation a immediately to higher management. (ZZ) took no part in the
- p
[m destruction, concealment, or disposal of the SAR tape, and
- ,7 acted in a timely and appropriate manner when he learned U*
that tape was missing. Apart from (VV), he was the first i
- p member of the crew to notice that tape was missing, which he u
immediately reported to (HM) and, shortly thereafter, to ,it [j (A). i ! r; 'U iq i Li 1 l!) - _ - _ - _ _ .
G _ D m 12 u 5 (I) did not contribute to the operator error that caused the safety limit violation. Because higher-ranking crew members, including the GSS, witnessed the violation, 7 (I) was not responsible for reporting it to higher b management or to the NRC. [I] did not take part in the
.J destruction, concealment, or disposal of the SAR tape, and, ,.
.?
under the circumstances', had no reporting responsibilities jg with respect to the missing SAR tape, q N 13 3 7
.2 (R) did not contribute to the operator error that caused the safety limit violation. He reacted quickly and appropriately when he learned about the. violation, reporting ,'l it immediately to his superior in the GPUN chain of command .J and ordering the GSS to notify the NRC. His reports were n
;J accurate within the limits of the information available to him. (R) had no role in the destruction, concealment, or 7(g disposal of the SAR tape. (R) did not receive a complete ,
! >,l and accurate report from the crew about the condition of the a SAR tape and, as a result, formed the impression that the .,'(
SAR had run out of tape. When information was brought to (R)'s attention casting doubt on the "ran out of tape" explanation for the missing SAR data, (R) helped conduct a ,
- i management investigation of the missing tape. He was a diligent in conducting this investigation, the results of q which were disclosed in a timely manner to upper GPUN
~,
.)'
1
G - management and the NRC. DU.14 (N) had no role in the commission of the safety limit
;{ violation. His alert questioning about plant conditions and
. the details of crew actions in response to the leak prompted (R)'s call to the control room at approximately 3:45 a.m.
During that call, (R) learned about the safety limit df.) violation for the first time and immediately reported the event to (N) who, in turn, immediately reported it to (SS). A short time later, (N) also reported the incident to [I the NRC resident inspector. L1 (N]'s reporting of the safety p limit violation was timely and appropriate, and was accurate i" ' within the limits of the information available to him. He
\
M had no role in the destruction, concealment or disposal of
.:4 the SAR tape. When he learned that SAR tape was missing, he supervised an investigation into the matter, the results'of r, which he reported to (SS] and the NRC.
UUU.15 , L. (SS) did not contribute to the operator error that Il y caused the safety limit violation. He reacted in a timely
, and appropriate manner after the violation was brought to his attention, by which time (R) and (N) had sat in motion f} the required notification procedures. (GS) not2.fied his bl superiors in the GPUN chain of command and presided over a ii d 6:00 a.m. briefing at which he described the safety limit D ,
m
.E q
event to GPUN and NRC personnel. The briefing he provided m was accurate within the limits of the information available , b to.him. (SS) had no role in the destructien, concealment, r E
~
or disposal of the SAR tape. He had only a limited role in the investigation of the missing SAR tape, but he lent his support and authority to that investigation and reported its ,; L'. results to his superior in the GPUN chain of command. L P R r I' u. m J,1 l-
- ,H
+ r e
R L
.- aw
[I
.c l
w
) I
'd-l1
?
C 1. Volume I, Section VI(A). , Ed , ,
- 2. Volume I, Section VI(B).
9 g 3. Volume I, Section VI(C). '] a
- 4. Volume I, Section VI(D). l R 5. Volume I, Section VI(E).
a
- q 6. Volume I, Section VI(F).
d o 7. Volume II, individual section pertaining to (NH).
- t
. a
- 8. Volume II, individuki section pertaining to (A).
O
- 9. Volume II, individual section pertaining to (VV).
n a
'l
- 10. Volume II, individual section pertaining to (II).
,19 .
lI!j 11. Volume II, individual section pertaining to (ZZ).
- f. 12. Volume II, individual section pertaining to (I).
J[j- 13. Volume II, individual section pertaining to (R). ,7, 14. Volume II, individual section pertaining to (N). lul-
- a 15. Volume II, individual section pertaining to (SS).
. .i.
r% I J. ] .se 1;i_. . . - - . -
.G W
V. BACKGROUND m h.? D A. History of Safety Limit
.T 5
The safety limit that was violated on September 11, 1987, was defined as follows:1 . During all modes of operation except when the ,f reactor head is off and the reactor is C flooded to a' level above the main steam
- nozzles, at least two (2) recirculation loop
- 7 .
suction valves and their associated discharge ,-- valves will be in the full open position. & i.r This safety limit was incorporated into the station's technical specifications because of an event that occurred ic on May 2, 1979. On that date, all five reactor recircula-tion pumps -- the pumps that keep water flowing between the annulus region of the reactor 2 and the core -- were shut [] down ("tripped").3 The pumps were part of the five recircu-l lation "loops" that maintain communication between the core $j and annulus. Such communication is essential because it i enables the operators to monitor water levels in the l core.4 Each recirculation loop, in addition to a pump, has [.[ u a suction valve, a discharge valve, and a smaller (two-inch) discharge bypass valve.5 N In the May 2, 1979 avant, all five discharge valves g,l were closed after the pumps tripped, with only the bypass _, valves left open.6 It was believed then that keeping these e i smaller valves open was enough to maintain adequate communi- '. } l cation between the core and annulus regions.7 The communi-t cation was not adequate, however, and water began boiling ] 1
) ;, off above the core faster than it was flowing back through i 'k ;u the bypass valves. At the same time, because of the ,
inadequate communication, the operators' instruments which "u{ measure water level in the annulus region were indicating that the core water level was high, when in fact it was becoming dangerously low, resulting in a triple low level
) alarm in the core region. The event ended when discharge valves were reopened and the water levels in the two regions were equalized.8 L A later analysis of the May 2, 1979 avant showed that ,
'1 the core had not been uncovered. The low water level, how-i
~~
ever, had violated a safety limit. Accordingly, the plant lfl iLL was shut down and needed NRC permission to start up again. Plant management was r,equired to submit an acceptable plan ,j u, . 1 of corrective action to the NRC, stating what steps would be i
; .;q taken to prevent a repetition of the May 2 incident. One of y' those steps was a proposal to require that two RBCCW loops, 1
I be kept fully open at all times.9
.p In discussions with the NRC concerning the proposed y' ,.
- corrective actions, plant management argued that the two
, loops requirement should be a Limiting condition for Opera- l l tion (LCO), rather than a safety limit. One open loop was lij sufficient to maintain adequate communication, it was 'g argued, so a two-loop requirement would not be a true safety so i~ limit; instead, it would be a warning that a safety limit i .,
l] l was being approached. The NRC, however, rejected these l O) . iJ ,
arguments nnd took the position-that the two-loop require- 7 ment had to be designated a safety limit before the plant . b could restart.10 The result was the safety limit that.was [ 3 violated -- apparently for the first time -- on September I 11, 1987. g Unlike other safety limits, the requirement that at least two loops be kept open was not based upon a quanti- .-, fiable point, such as a water level, beyond which there i existed a threat to plant safety. Rather, it was designed to prevent operators from taking an additional step that, if taken, might create a safety problem.11 As discussed below, 7
'.s this unique aspect of the less-than-two-loops safety limit ,
affected the design of the alarm system that was eventually' u installed. B. Hinterv of the Less-Than-Two-Looes Alarm As explained in Section V(A), safety limit 2.1.E was t - , , added by the NRC to the oyster Creek Technical } Specifications following the May 2, 1975 event to ensure .. y that there would always be an adequate flow path between the *- core and downcomer regions of the reactor, so that the C 5 downcomer level instrumentation could be relied upon as an indication of the water level in the core region.12 This , safety limit was basically an administrative technical ,_ specification, and was unique in that violation of the limit 1 (i.e., closing a fourth loop) did not in itself pose any q t safety question,13 but simply raised the possibility that a l
- 3
.__ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ - - - - _ _ _ _ 1
~
7 fifth loop might be isolated, thereby rendering the J downcomer level instrumentation unreliable. , L Whan the safety limit was first imposed in 1979, there m was no instrumentation installed to ensure that the requirements of the safety limit would always be satisfied, and there was no alarm installed to warn the operators either that the safety limit was being approached or that it a j had been violated. Instead, various administrative steps were taken in an attempt to ensure that the safety limit was 7 not violated. "Caution" statements were added to those
] p2'nt procedures dealing with recirculation pump and valve J
~
operation,14 and operator training was updated to include
; the new safety limit.15 Hinged plastic covers were q installed over the pump suction and discharge valve control switches to discourage inadvertent operation,16 and warning B labels were added to these covers.17 1,;l , During the Oyster Creek 1979/1980 refueling outage, the .f ~~
low-low-low-level alarm instrumentation in the core region
]
t)- of the reactor vessel was greatly enhanced by the addition of level indication and recording capabilities. This "fuel zone level monitoring systeui" was designed to be activated p whenever all five recirculation pumps were shut down.16 i] During 1980, as a direct result of the Three Mile I.,; La Island accident during which the core was uncoverad and fuel n damage occurred, the NRC promulgated requirements for l: boiling water reactor (BWR) plants such as Oyster Creek for n ,\ m
e +
. ~
interlocks to be installed to positively ensure that at least two recirculation loops would always be open.19 This , I would have effectively replaced the administrative safety r tr limit with an instrumented one. GPUN began engineering work " . for this interlock modification in 1981,20 but internal il k review of this proposal by the GPUN Human Factors Section . , resulted in the interlock scheme being changed to an "alarm only" installation,21 and a "Preliminary Engineering Design M~ Review" (PEDR) meeting to review the alarm system design was scheduled for August 8, 1985.22 , Despite some disagreement with the idea of an alarm {"
~
from some members of the Oyster Creek Operations Group,23 design of the alarm system continued,24 and it was decided I at the PEDR meeting to add a "reflasn" capability to the _ l alarm to cause a second alarm upon isolation of the fifth 1 loop.25 Burns and Roe performed the detailed system design, rj which is embodied in the GPUN "System Design Description for the Recirculation Valve Interlock Modification." This U design document describes the essential function of the alarm:26 I The occurrence of an alarm will alert the q operator that the plant is operating below the requirements of the Plant Technical g Specifications. ... l Thus, the alarm was not designed to warn operators of an -- imponding safety limit violation, but instead tc; >.tvise them ' - -
~
that one had already occurred. This feature of the "Less Than Two Loops Open" alarm made it unique, since other R
. b)
alarms were designed to annunciate before a violation or unsafe condition occurred. For this reason, many of the i operators, supervisors and others at the oyster Creek a Station opposed it, labeling it the "death alarm."27 l However, as noted above, it was decided to install the
~
alarm as designed despite the opposition. The alternative of activating the alarm when the third loop was closed, i.e., before a safety limit violation had occurred, was rejected because it was not uncommon for three loops to be f closed when the reactor was in shutdown condition, in which 1 case the alarm would be continuously lit and therefore I n 3 ineffective as a warning.28 lf, The unique "death alarm" feature of P.he "Less Than Two 7 Loops open" alarm is closely related to the peculiarity of [ s the safety limit itself. In essence, the alarm was designed f to prevent the threat to plant safety that could result from ! {a loss of communication between the core and annulus regions i 1: : h of the reacter vessel -- i.e., all recirculation loops L closed -- but was nnt designed either to prevent or warn of l an impending safety limit violation.29 This seemingly
. anomalous feature of the alarm was made possible only f
because the unique definition of the safety limit itself allowed it to be violated by a condition, i.e., only one
, loop open, that did not in itself constitute a threat to plant safety.30 ?
d Between September 1985 and July 1986, the downgrading
.? ; 't I m
5 2. of the recirculation valve interlock originally mandated by e the NRC to an "alarm only" installation was the subject of k.) discussions and correspondence between GPUN and the NRC.31 W These discussions eventually resulted in the NRC approving the alarm installation, largely on the basis that the fuel E t zone level monitoring system had already been installed and E that the proposed intrarlock system with its attendant ; i . indication and bypass requiremenus would be unnecessarily y complicated.32 Although the reduction in scope from an b interlock system to an alarm only installation reduced the 7 l costs of the project from $2,500,000 to $586,000,33 cost :4as l apparently not a factor in the decision, at least at the plant level.34 y J
.a The alarm system design was finally completed in October 1985, and the system was installed during the 1986 , , ,
1 refueling outage, The initial intention had been to remove 7 the hinged covers over the recirculation vcive controls as,
~
part of the alarm installation because'the warning labels on L the covers tended to obscure the valve position indicating l lights.35 Later, it was decided to leave the covers in place,36 and to relocate the warning labels to a position ;7 b adjacent to each set. of recirculation valve controls.37 The alarm system was finally turned over to plant operations in i r; July 1986.38 [
.q "71
.)
-d
.]
_ . c
(or from an alarm back to a normal state), the SAR prints a three line message consisting of the alarm point identifi- , cation and time of occurrence (hour: minute:second: milli-
]' '
second), an "alarm" or "normal" message, and a brief h description of the alarm itself.48 If no further alarms a _. have occurred, a time and date message is then printed.49 However, if further alarms occur while the first alarm is p being printed out, the time and date message will not be ( ~ printed until after all of the alarm r.esaages have been printed and the SAR memory has been emptied.50 l once an alarm has been printed out, it is cleared from .J the SAR memory, and the printed paper output is therefore f7 {j the only record produced or retained by the SAR of a par-ticular alarm occurrence. Despite the fact that many alarm 4 a points are also separately monitored and recorded by the n plant computer, the "Less Than Two Loops open" alarm is not (5 one of them. Although the SAR is equipped with an interface Si for transmittal of alarm information to a remote device such J as a recorder or printer,51 this option was not utilized at
.. oyster creek.
i C[j ,* The vendor's manual lists the printing time for a g single three line alarm message as six seconds;52 however, an analysis conducted as part of this invest.igation showed { that for the Oyster Creek SAR, this printing time is closer to four seconds.53 once every 24 hours, the SAR automati-q g cally scans all of the inputs and prints out a summary of q Il O
*s, A
. E points, with the ability to discriminate between alarms occurring within two milliseconds of each other, and to print out a message consisting of the alarm point number, 7 k'
time of occurrence, and a brief description. It was to have 1 a memory capacity sufficient to handle a backlog of at least I G 341 alarms, together with their times of occurrence.43 .o
?:;
The SAR installed at Oyster Creek was specified to meet [ e these functional requirements. It was supplied by Dranetz Technologies, Inc., and consists of a microprocessor-based G nolid state event processor capable of monitoring the status [ I l of up to 1024 devices such as electromechanical or solid state relays, with a time resolution of one millisecond.44 l The SAR memory is capable of storing a maximum of 1052 - i individual events, or a lesser number (but at least 398) depending en whether optional software functions are pro-grammed.45 Should the events being monitored exceed the I memory capacity, the SAR ceases monitoring further changes' _ i in input signal status until all of the events stored in the - l l memory have been printed out, at which point normal monitor- Jg ing is resumed.46 This may occur, for example, if the SAR
' l' printer runs out of paper. This condition causes a "Printer l' l
Paper Low" message to be printed, and inhibits further alarm l printing (but not event monitoring or storage in the SAR U l memory up to the memory capacity) until the paper is .g J replaced.47 ( When an input changes from a normal to an alarm state J s
7 L - alarm that had been lost by the paper being torn and i discarded could be printed out from the memory.63 (HH) did , 7 not know the capacity of the SAR memory,64 but felt that it would hold everything in its memory for at least a limited 'I period of time.65
.u l
Il . "B" crew personnel also had different views as to the d e, SAR's reliability. (A) felt that it functioned properly l T 1 most of the time, but on occasion ran out of paper during a ] _ shift.66 (II] did not consider the SAR reliable in terms of
- printing out alarms.67 (ZZ) felt that the machine had given the crew a lot of g problems in the past, particularly with respect to the I takeup reel malfunctioning.68 on September 11, 1987,
']IJ however, (ZZ) observed the machine to be working properly when he saw it between midnight and 2:00 a.m.69 s ., Ib-Among the operators, there was some resentment towards i the SAR machine. It was often referred to as the "white e rat." Many of the operators had Navy backgrounds, and the fi - term "white rat" was a term used in the navy to describe a jm listening device by which officers could listen to 1 !"" engineers. The control room operators viewed the SAR as a
$,) similar device which permitted management to monitor their J
activities.70 {S lC l blu C $2 l..; , 'r b . , - -- - - - - - . - - - - -
5
- b those inputs which are in an alarm state at the time of the r
. scan.54 {;
The alarm information is printed out on a roll of tape which exits the machine at the top right-hand corner.55 g motor-driven paper takaup real (which can acccmmodate sev-eral rolls of output paper) is provided to collect the paper -!q 7 output from the SAR, and is located on the floor near the ',[ foot of the SAR.56 The SAR itself is installed between 5 a panels 16R and 11XR at the rear of the control room behind T the main panel, out of sight of the normal operating area.57 ,j F
- 2. Q23rator understandinas of SAR canabilities and coeration Il1
.a The members of "B" crew understood that the SAR had a
,.n memory, but their individual perceptions differed as to its d capacity. (A) felt that the SAR had a limited capacity for m
. .L alarms and that the machine did not print the alarms fast , '
enough. He believed that alarms were lost on an average of 7 E once a week because they exceeded the SAR's memory capacity.58 (A) also believed (correctly) that once the SAR printed an alarm there would be no memory of that alarm.59 Id (VV) was also aware that the SAR had a memory. He had no "2J
?'
idea, however, whether the SAR would retain the memory of an , alarm if the paper was removed. 0 [ZZ) had heard that the SAR only had a memory of approximately thirty minutes.61 g7r) was also aware that the SAR machine had a memory,62 and was
,1 unaware of any time limitation on it. He thought that the J, ua
l i R ~ 1 3 . i 1
- 3. History of Less-Than-Two-Locos Alarm I
- 12. Letter from D.L. Ziemann (NRC) to I.R. Finfrock, Jr.'
(JCP&L) (May 30, 1979), enclosing Amendment 36 to Operating i License DPR-16, revised Technical Specification, page 2.1-4a (Exhibit 36).
] 13. (N), p. 31. )
l O 14. Egg, 32g2, Oyster Creek Generating Station Procedure
. 301, "Nuclear Steam Supply System," Rev. 39, 3/29/87 (hereinafter cited as "Station Procedure 301"), Sections y 4.2.2, 5.2.5, 7.2.2, 7.3.4, 12.2.1 pp. 16.0, 22.0, 31.0, 35.0, and 43.0 (Exhibit 17);
Oyster Creek Generating Station Procedure 2000-I ABN-3200.02, "Recirculation Pump Trip," Rev. 3, 9/1/86 (hereinafter cited as "Station Procedure 2000-ABN-3200.02"),
- p. 8.0 (Exhibit 32).
[ t. T} 15. (N), p. 32. J
, 16. Letter from I. R. Finfrock, Jr. (JCP&L) , to the NRC j (May, 12, 1979), attached report on 5/2/79 incident, p. 3.D-J 1 (Exhibit 31).
3, d 17. [N), p. 32. G lj 18. Letter from R. F. Wilson (GPUN) to J. A. Zwolinski (NRC) (Sept. 19, 1985), p. 2 (Exhibit 39). O' 19. NUREG-0737, "Clarification of TMI Action Plan Requirements," Item II.K.3.19, Nov. 1980 (Exhibit 46). y .'.
- 20. GPUN Budget Activity Authorization No. 402207, Rev. 1 q (Aug. 19, 1981), Rev. 2 (Dec. 17, 1981), and Rev. 3 (Feb.
N 17, 1982) (Exhibit 42). 3 21. Memorandum from GGGGGG to 117.tLI (Mar. 21, [J 1985) (Exhibit 51). r3 [] 22. Memorandum from EEEEEEEE to Distribution (July 23, 1985) (Exhibit 52). G. _ - .
. _ = - - .
2 e NOTES A. History of Safety Limit
!T r4
- 1. Oyster Creek Technical Specifications, Section 2.1.E (Exhibit 9A). m i
u
- 2. The annulus is the region immediately surrounding .-
but physically separated from the core. Egg Volume III @ (Taylor Report), Section B-1 and Figure B-1; (ZZ), 10/7/87, C}
- p. 53; Diagram of dry well cooling system (Exhibit 2A) and .
Diagram of typical recirc loop (Exhibit 2B). m
- 3. (N), pp. 27-26. ,
- 4. (ZZ], 10/7/87, pp. 52-55. _
i'
- 5. Ibid.,'p. 52; Diagram of a typical recirc loop (Exhibit 2B).
Volume III (Taylor Report), Section B-1. ,
- 6. [N], pp. 27-28; Sworn Statement of [0) (Oct. 15, 1987), pp. 6-9 E
[ hereinafter cited as "(O]"). c
- 7. [N), p. 28.
L /
- 8. Ikid. For a detailed description of the May 2, 1979 '2-event, gag Letter from I. R. Finfrock to NRC, 5/12/79, with attachment (JCP&L Report on the May 1979 Transient at the "}
Oyster Creek Nuclear Generating System) (Exhibit 31). .]
- 9. (N], pp. 28-30,
- 10. Ibid., pp. 30-32. j J
- 11. Ibid., pp. 31-32. Egg Section V(A) of this report. ~i
_j
'1 e
64 - U s
3 . d
- 32. Letter from J. N. Donohaw, Jr. (NRC), to P. B.
Fiedler (GPUN) (July 15, 1986), Attached Safety Evaluation, j{ p. 2 (Exhibit 41).
- 33. GPUN "Request for Project Approval," for "Racirc Valve Interlock Modification," Rev. 4 (Feb. 14, 1986) B/A 402207 (Exhibit 42).
. 3 4. . (N), p. 35. ~., 35. Memorandum from GGGGGG to 1L1112. (Mar. 21, 1905) (Exhibit 51) .
Division I Interlock Modification (Aug. 30, 1985),
- p. 4 (Exhibit 36).
i J
- 36. Memorandum from G44GGG to L. t.1 t. L 2 , "Hinged Covers Removal (B/A 402207)" (Jan. 28, 1986) (Exhibit 57).
- 37. Letter from R. F. Wilson (GPUN) to J. A. Zwolinski (NRC) (Jan. 30, 1986), p. 2 (Exhibit 39).
'l 38. GPUN "Turnover Notification" for the Recirculation j Valve Interlock (July 17, 1986) (Exhibit 43).
C. Secuence of Alarms Recorder (SAR) 3 39. JCP&L Modification Proposal 224-7-3, "Oyster Creek d Control Room Alarms," Rev. 6, 7/10/84, Section 2, p. 1 (hereinafter cited as "Modification Proposal"-] (Exhibit 33).
- 40. Iki.d., Section 2, pp. 1, 2.
- 1 .
~
- 41. Ihid., Section 1, p. 1.
hl u 42. (R), p. 55. ' f'j 43. Modification Proposal, Section 3.11, p. 4 (Exhibit ! 33). l U., l m b - 67 - p
E N
- 23. Memorandum from mpT to CGGGGG (July e 25, 1985) (Exhibit 53). ,
h
- 24. Memorandum from CG40,C 4 to rnm (Aug. 7 1, 1985) (Exhibit 54). -@
W
- 25. Preliminary Engineering Design Review of the y Recirculation Valve Interlock Modification, Conference Notes (Aug. 8, 1985), p. 3 (Exhibit 55). j7 .
R l L I
- 26. GPUN Division I System Design Description for the .-
oyster Creek Nuclear Generating Station Recirculation Valve T, Interlock Modification, Rev 0 (Aug. 30, 1985), p. 6 (Exhibit [l
- 38) (hereinafter cited as "Division I Interlock j Modification"). pj
- 27. (HH), pp. 75-76;
[. (R), pp. 52-55; J (VV), p. 85. g d
- 28. [N), p. 39; .,
l . N Letter from P. R. Clark (GPUN) to Dr. T. E. Murley - (NRC) (Sept. 20, 1987), Attachment II, p. 5 (Exhibit 47). _ t.
- 29. Letter from P. R. Clark (GPUN) to Dr. T. E. Murley 1 (NRC) (Sept. 20, 1987), Attachment II, p. 5 (Exhibit 47), g)
R
- 30. Ibid., Attachment II, pp. 7-9 (Exhibit 47). g y
Letter from R. F. Wilson (GPUN) to J. A. Zwolinski (NRC) (Jan. 30, 1986), p. 1 (Exhibit 39).
- 31. Letter from R. F. Wilson (GPUN) to J. A. Zwolinsk'i "
! (NRC) (Sept. 19, 1985) (Exhibit 37); b Letter from R. F. Wilson (GPUN) to J. A. Zwolinski i (NRC) (Jan. 30, 1986) (Exhibit 39); _; , H" Letter from J. A. Zwolinski (NRC) to P. B. Fiedler (GPUN) (April 16, 1986) (Exhibit 40). 1
'l1
.:3 3j ci
)
i
- 1 ,
~
3 60. (VV), p. 184. 4 . n 61. (ZZ), 10/7/87, p. 190. b]
- 62. (II), 10/8/87, p. 137.
i
., 63. Ibid., pp. 137-38.
P U
, , 64. (HH), p. 265.
- 65. Ibid., p. 81.
P 'l) 66. (A), pp. 50-52.
- 67. (II), 10/8/87, pp. 33-34.
c {}y 68. (ZZ), 10/7/87, p. 114.
]) 69. Ibid., p. 113. ;d q 70. (HH), pp. 78-79; d
(II), 10/8/87, pp. 30-36;
.I Sworn Statement of (QQ) (Oct. 16, 1987), pp. 29-31 J [ hereinafter cited as "(QQ)");
Sworn Statement of (TT) (Oct. 2, 1987), pp. 24-25
- f. (hereinafter cited as "(TT)");
73 (ZZ), 10/7/87, p. 117.
!b '-
r lj ra O M rq Li
.. j is - - - - .
- 44. Dranetz Technologies, Inc., System 22 Sequence of Events Recorder, TM-103700, Operation Manual, 3/1/84, Section 1.1, p. 1-1 (Exhibit 45) (hereinafter cited as g; L"I "Dranetz SER Manual") .
?
- 45. Ikid., Section 1.6.1, pp. 1-9. b r
- 46. Ibid. , Se:: tion 1. 6. 2, pp. 1-10. E
- 47. Ibid., Section 2.9, pp. 2-16; Table 1-6, pp. 1-23. {;
T:'l
- i
- 48. Hig , g, g.,,,, Fragments of SAR Tape Found 9/11/87 g (Exhibit 13) L 1
1 tr
- 49. Ibid. c n
- 50. Dranetz SER Manual, Section 2.9, pp. 2-16 (Exhibit 45).
}
~
- 51. Dranetz SER Manual, Volume I, 3/1/84, Section 1.2, p.
1-1; Section 1.6.11, pp. 1-12 (Exhibit 45). u m
- 52. Ikid., Section 1.6.13, pp. 1-13. L
- 53. Volume III (Taylor Report), Appendix 6. j C
- 54. Dranetz SER Manual, Volume I, 3/1/84, Section 1.2, pp. 1-1 (Exhibit 45). i
- 55. Ibid. Figure 2-8, pp. 2-17; a
h
. Photograph of SAR (Exnibit SD) .
i fl' "N
- 56. Photograph of SAR (Exhibit SE).
e
- 57. Sig Diagram of Control Room (Exhibit 1).
i l #
- 58. (A), p. 51.
71
- 59. Ikid., p. 126. d Il
,j
a
- 1. Standards of conduct The requirement that two recirculation loops be kept l r
, fully open at all times was clearly set forth in the oyster ,,, Creek Technical Specifications (Section II.B), and was well known to the operators and supervisors of "B" crew.
1 Reminders of this safety limit were prominently displayed l
.., next to the controls for each recirculation loop,3 and plastic covers were placed over the valve controls 2 . themselves as a further reminder to operators to pause and - think before closing a valve.4 Additionally, the safety g limit was covered in operator training and "cautions" against closing more than three loops were conspicuously F
ll u placed in written procedures.5 l.] The licensed members of "B" crew, including the CRo a whose actions caused the alarm, confirmed in their testimony kj that they understood prior to the September 11 violation
,, what conduct was required to avoid violating the less-than- 'l J two-loops safety limit.6 1
13 . It was also clear from training, vritten procedures, y and commonly understood operating practices that the proper
. :4 sequence of steps for taking recirculation pumps out of "l service varied according to plant conditions. Station a
i Procedure 301, for example, contains a section (7.0) that 'p , L; specifies the sequence of steps for what (VV) termed a , r. ; "normal shutdown."7 It was this sequence, as discussed l\ ! j" below, that (VV) testifded he was following when the safety p1 IJ 'I] , -
.. . . ... . .n . .
I
~
b VI. DISCUSSION OF ISSUES [ S A. The Crew and Manacement Accounts of the Cause and w Nature of the Safety Limit Violation -y n Apart from whether the safety limit violation was t a reported in a timely fashion, there is an issue as to ..- whether it was reported accurately. In order to evaluate .1 this issue, it is necessary to discuss certain aspects of I; the violaticn itself.
- r CRO (VV), who actuated the safety limit alarm and who later, according to his testimony, tore and disposed of the $
u SAR tape, described in detail what he did both before and g after the alarm. The credibility of his testimony concern-ing his post-alarm actions depends in part on how accurately ., he described what he did to actuate the alarm. This is a particularly true because what (VV) did prior to the alarm J
. E can suggest either the presence or absence of a motive to i conceal evidence. ,
For example, certain log entries and technical analyses ( suggested that possibly two discharge valves rather than one c were closed during the safety limit event.1 If this were sj true it would contradict the testimony of (VV], who said he ,. closed only one valve, and, as discussed in detail below, ' would suggest a possible motive for destroying or concealing j' L evidence -- i.e., to conceal the fact that all five recirculation loops had been closed.2 .] j I J 1)
Q - L - assisted (HH) and (ZZ) in attempting to determine the source of the leak.13 (A), who was at the site of the spill, - f reported back through the intercom that the water was d purple, confirming that the leak was in the RBCCW system.14 (W) , (HH] and (I) then examined diagrams of the
~ ~ - RBCCW system to identify the valves that needed to be closed in order to isolate the leak.15 The, isolation was to be 3 accomplished by closing valves upstream and downstream from a
the leaking valve; one valve could be closed electronically m from the control rooni while the other had to be closed manually. Closing the valves would ha're the effect of J stopping RBCCW flow through the drywell.16 c' U:- [W) and (HH] then discussed whether the recirculation
, pumps could be run without RBCCW flow through the J }U drywell.17 Written operating procedures specified that the pumps could not be run under those conditions, but they had been run without RBCCW under a special procedure during a previous outage.18 (W) showed (HH] the current procedure, which indicated that the special procedure allowing the f,f U' recirculation pumps to run without RBCCW flow through the b-b" drywell had apparently expired.19 [HH] agreed that the pumps would have to be "secured" -- i.e., taken out of service -- and he ordered this done.20 l
An order to "secure" a pump meant taking the pump out h)) t of service in a manner appropriate to plant conditions, b,, lLl which might or might not involve shutting a discharge rj q _ 73 - h k- - - , _ . . - - - . - - - , - - . . - . - - - - - - - - - .
l r
~
limit alarm occurred. In that same section, however, there b, is the following highlighted warning:8 , fS CAUTION U E1 The' suction and main discharge valves of at least two (2) recirculation loops must remain - open. { A similar caution appeared at the beginning of the section ./ 1 5 on removing recirculation pumps from service, and elsewhera i3 in Procedure 301.9 : t i A station procedure designed for abnormal operating g conditions entitled "RBCCW Failure Response n10 provides C instructions for dealing with various types of failures in C s l the RBCCW system, including leaks in the system, the j l situation confronting the crew on September 11, 1987. ^ 1 Section 3.1.2 of that procedure states: , i Trip all operating recirculation pumps, and " confirm that all recirculation gump suction and discharge valves are open.
!q
?J The crew members testified that this procedure was the proper one for securing the pumps after it was decided to isolate RBCCW flow from the drywell.12 e
's
- 2. TVV1's account of how the safety limit
'- violation occurred , -] l
~2 l (VV) gave the following account of his actions during -
l the events leading up to and immediately following the I safety limit violation: i.} 3 When news of the spill on the twenty-three foot level
]
I ') reached the control room at approximately 2:10 a.m., (VV) . q l s
.3 - speed of the pump and reduce flow;
- )u ,
- 4. shut the discharge valve; and 3
- 5. switch off 'the ptimp's motor generator (MG) set, thereby shutting off ("tripping") the pump.
(W) testified that, in accordance with this "normal u
.. shutdown" procedure, he positioned himself in front of panel 3F where the controls for the five recirculation loops are y located, and began the sequence of events to secure "B" w pump. He intended to secure the "B" pump first, then the "C" pump.26 (W) said that his first step was either to u~
balance the "B" potentiometer (the control that adjusts the j . manual speed setting) to make it equal to the master control f setting by placing it in a neutral position or to check to see that it was already balanced; he was not sure, but he
":) thought it was already in neutral.27 Next, according to
- .b (W), he switched the "B" pump control to manual and turned n
j the potentiometer to decrease pump speed -- and therefore recirculation flow -- to the point where he would begin to I- get reverse flow.28 He estimated that this procedura may have taken 10-30 seconds.29 He did not recall doing p[# #, anything with the "C" loop controls during this period, but [] u said it was possible that he balanced "C" pump (or checked to see that it was already balanced) and took it to manual before proceeding to the next step in the shutdown procedure n for "B" pump.30 p d p li S __ _ _ _
E _ b valve.21 [VV) was aware from the turnover briefing he had p e' received at the beginning of the shift that only the pumps on the "B" and "C" recirculation loops were running. Indeed, "B" crew had reduced the number of operating loops E. to two the previous day, when they initiated the reactor E shutdown process.22 The "A," "D," and "E" pumps were out of $ t; service, and [VV] knew that their corresponding discharge f valves would be closed.23 Thus, [HH]'s order to secure the f a pumps applied only to "B" and "C" pumps, the only ones in y service at the time. Securing these pumps in a manner } appropriate to plant conditions meant tripping the pumps , is without closing any discharge valves, because only two loops a were open, the minimum permitted by the safety limit. Ej
.)
(Alternatively, [VV) could have opened two of the closed *
~
discharge valves before closing the two open ones, "B" and ,j "C.") ,_, t [VV), however, interpreted the order to secure the C pumps as if [HH] had said "do a normal shutdown of the 2 pumps."24 A "normal shutdown" in this context meant taking ,
-L the following steps in the sequence indicated:25 e:
- 1. balance the pump speed master and local controller ~ *1l signals using the deviation meter en the local speed T 4
.3 controller; q e
~
- 2. switch the controller to manual;
- 3. lower the speed set point in manual to decrease the a 3
. L:
3 - 5 - 7 discharge valve to move to the fully open or fully closed
; position after the control switch activates the process. As ,
q explained in Volume III of this report,37 the stroke times 2 for the five discharge valves varied.) (VV] said that he knew "D" valve, not "A," reached the fully open position
., when he heard the bell indicating that the safety limit t
L. alarm had cleared. He heard this bell before the "B" valve
~
reached the fully closed position.38
.m a
y (vv] testified that when the alarm cleared and the b valve strokes on all three discharge valves (i.e., "B," "A," q and "D") were complete, he tripped the "B" pump MG set and b ~ then, 15-20 seconds later, tripped the "C" pump.39 This completed the securing of the "B" and "C" pumps, as ordered by (HH]. , J [VV] could not explain why he forgot that only two loops were open when he commenced what he described as a "normal shutdown" procedure -- which involves closing the _,l 3 discharge valve -- rather than simply tripping the pumps ,C without closing valves which, as he acknowledged, was the appropriate procedure given the plant conditions that )),*, existed on September 11.40 He stated that the safety limit "never crossed my mind" until the alarm came in,41 and B. '!j concluded that it was "my lapse of recollection that caused !q me to violate the safety limit'."42 (". U M .i!J .O,. _ __ l
After reducing the flow on "B" loop, (W) flipped up 7 w~ the p'astic cover on the "B" discharge valve control and . moved the switch to the "closed" position.31 He held the switch bi that position until he got a double light
.5 indication (confirming that the valve was responding to the g swi.tch and was closing),32 at which point the alarm :
i signifying the safety limit violation occurred. (As [ explained in Volume III (Taylor Report), Section D-10.1, the f
. 2 time it would have taken to get the double light indication r
after (W) first moved the valve control to the closed { position was approximately seven seconds.) Seeing that the y alarm was green, (W) instantly knew that it was the less- d j , than-two-loops alarm and realized that he had erred by ] .; closing the "B" discharge valve. He immediately reached l m over with his right hand and moved the "D" loop discharge ]' valve control switch to the open position; a second or two n b later he reached the "A" loop discharge valve control switch b with his left hand and opened that valve as well.33 " l d (W) was certain that he did not close the "C" r discharge valve.34 He explained that, although he had closed only one discharge valve ("B") to bring in the alarm, he opened two ("A" and "D") "to be conservative":35 I opened two knowing that having two valves 3 going open would, or should, compensate for the one discharge valve going closed.
.)
After opening "A" and "D" valves, (W) watched to see "which ones cycled first."36 (He was referring to the ] approximately two minute stroke cycle required for a 1 2J 7.'
y 4 control panel and did not actually see (W) handle the controls.48 (ZZ) stated that he was at another part of the . I m control panel preparing to raise reactor water level and he L.]' did not see what (W) did 'to cause the alarm.49 only (I)
.$u was watching (W) directly, but he was behind him and could
, only see arm and shoulder movements.50 (I) had the e
impression that (W) was handling the "B" loop controls y because he was using his left hand, the one nearest those
" controls.51 9
i.
'J . After the alarm, when their attention was drawn to what (W) was doing, (HH), [II), (ZZ), and (I] all saw him attempt to compensate for his error by opening two discharge i valves.52 ] Thus, (W)'s testimony that he reacted to the alarm by la l immediately opening two discharge valves is strongly l '~1 -
ld corroborated by the other crew members who witnessed his lq actions. The specifics of what he did prior to the alarm, lJq however, were not observed by the others. Il
@ Certain technical data and entries in the control room l m, log appeared to conflict with (W)'s account of his p,re-ly-alarm actions. The most important of these conflicts
) concerned (W)'s testimony that he closed only the "B" discharge valve, meaning that the "C" loop remained open at all times. The control room log maintained by CRO (II) l <,, contained the following "late" entry about the safety limit
- sy l'~"
violation:53 0 0 1.m (N . . - . . . - - . . . . - - _ _ - - - _ -
i
- 3. Comearison of TVV1's account with other evidence F G"
In addition to (VV], five persons were in the control .g room when the safety limit alarm came in. Four -- (HH], " (II), (ZZ) and (I) -- were members of "B" crew. The fifth, [C (PP], was an instrument technician who had entered the ,e c. g control room at 1:30 a.m.'to do preventive maintenance 1 work.43 Just prior to (PP]'s exit from the control room at 2:17 a.m., he observed the green safety limit alarm h
. flash.44 . The alarm had not cleared when (PP) left the 7 control room.45 m
l'.; All of the crew members were in the immediate vicinity of the control pan.el at the time of the alarm and all of them confirmed that the alarm came in immediately after (VV) performed certain operations at the controls following ]1 (EH]'s order to secure the pumps. . [PP] was not aware of y; [HH]'s order, but he also observed (VV) standing in front o'f ! panel 3F, where the recirculation controls are located, and noticed that he was manipulating the controls.46 (J None of the witnesses to the event, however, observed m (VV) closely enough to determine either the specific fj
~
l controls he was handling or the exact sequence of his . actions . Until the alarm, most of the crew's attention was O l directed elsewhere. (HH] testified that he was looking at a i diagram of the RBCCW system until the alarm drew his attention.47 (II] was seated at the desk in front of the j n
-b
7 r J - testimony was based upon an' assumption by its author, CRO j [II), who conceded that he did not know whether one valve or. two had been. closed.57 [W) explained a key basis for (II)'s assumption; i.e. , F5 Id why he opened two discharge valves even though he had only [~ closed one. He wanted the total area of open valves to equal or exceed the area that was going closed.58 (w) related this action to the theory behind the safety limit, a which was to maintain communication between the core and d annulus regions:59 m While (the "A" and "D" valves) were stroking y open, they would be getting more and more flow and communication from the annulus to _ the core while the one was going closed and f . they should more than compensate for it. c1 We found this. explanation to be a plausible rebuttal to It ' {.] [II]'s inference that (W) had closed two valves because he q later opened two. Indeed, (W]'s idea of creating a "total
~
open area" that would equal or exceed the area of two fully
] open discharge valves later oca.urred independently to (NN],
L.; the Oyster Creek Licensing Manager. (NN) briefly considered s the possibility that having a total "effective area" open g that equaled or exceeded two open valves might mean that the O' safety limit had not been violated.60 (A later review of the technical specifications convinced (NN] that this was ] not a viable interpretation of the safety limit.)61 Q [~1 (II]'s log entry, however, was not the only evidence in apparent conflict with (W)'s testimony that he closed only n LJ l:0 _
E: Nl During the leak incident on 23' R.B., while . tripping off B&D RCP's due to isolating the F RBCCW to the drywell, discharge vv's were , C closed on these pumps. At this time A, D, E pp's were off w/ discharge vv's closed. The q alarm E-4-B came in, less than 2 loops open, P "J which violates tech spec safety limit. While B&D RCP's disch. vv's were going close, two , other loops disch vv's were being opened. t The time with less than 2 loops open was very b short. .-
?
The statement in this entry that "discharge vv's 1 (valves) were closing on these pumps" appears.to contradict Thera is, 2 (VV)'s statement that he closed only one valve. ! however, an obvious error in the statement that the valves @ L were closed while "B&D" pumps were being tripped. (VV) was preparing to trip "B" and "C" pumps, not "B" and "D." As @ reflected elsewhere in the same log entry, the "D" pump had been shut down since the beginning of the shift. (II) acknowledged this error 54 and explained the basis for his I]
.:J statement that moro than one valve was closed during the F-safety limit event. He did not see (VV) close two discharge p valves, nor did [VV) or anyone else inform him that two 77 D
valves had been closed.55 (II) simply assumed that two C valves were closed because (a) he knew the intention had 4; [ been to trip both "B" and "C" pumps; (b) the alarm made it n obvious that (Vv] had made the mistake of closing the .:; discharge valve on at least one pump and the procedure he t,;s was following would be the same for both loops; and (c) (VV)'s post-alarm reaction of oceninq two discharge valves D suggested to [.'I) that he had closed two valves.56
] .
In short, the log entry's apparent conflict with (Vv]'s
.i U
l
resolve some of the major questions regarcking the sequence 7 y of events. We attempted to reconstruct from those data the ,
.. sequence of events surrounding the safety limit violation.
As explained more fully in Volume III of this report, the technical data analysis confirmed (W)'s testimony that he
., closed only the "B" discharge valve, and that the "C" loop
.p.
, remained open throughout the event. The flow reduction to zero in the "B" and "C" loops, which management and NRC J investigators believed resulted in part from the closure of 7 both the "B" and "C" discharge valves, actuallf resulted a
solely from the tripping of "B" and "C" pumps. This was fa confirmed by our detailed technical analysis which relied in
, part on test data not available during the earlier management and NRC analyses.66 i The data analysis also confirmed the immediate opening
-., of the "A" and "D" valves in response to the alarm, and the I l U
fact that the alarm cleared when "D" valve reached the fully open positien, which was two seconds before "B" valve went fully closed.67
,)
& We examined all of the evidence carefully in an attempt to resolve whether (W) closed one valve or two in the course of activating the safety limit alarm. Apart from
'n
.d (W)'s testimony and the technical analysis set forth in
- ,q Volume III, the evidence was inconclusive. We concluded that the technical analysis was the best available evidence l u o n t h i s 3 .4 s u o a n d t h a t i t e s t a b l i s h e d t h e a c c u r a c y o f ( W ] ' s
- t'}
- U) il . _ _ _ _ _ _
E W the "B" discharge valve. During the management , investigation of the event, which began early on the morning. .i of September 11, recirculation flow data were retrieved from i the computer which showed the flow through the "B" and "C" 4.7 loops decreasing at approximately the same time, at nearly { identical rates.62 This suggested to the management .
,; 1 investigators that two loops had been closed, instead of one '
as reporta1 by the crew,63 and helped fuel their suspicion - that the missing SAR tape was part of a coverup effort by the crew.64 Plant Operations Manager (R) explained a ')a possible motivation to destroy evidence or otherwise conceal the closure of a fifth loop, even though the safety limit b y violation was complete upon closure of the fourth loop:65
. . . (M)y hypothesis at the time was that they possibly isolated all five loops, which,. ..,
as I said, was a little more significant. a The one loop remaining open actually satis- d fled the basis of the safety limit itself. q lii I thought maybe that they had done that, , isolated all loops and were, although they a felt it would give notice, they had to report 'g the safety limit violation, it would look a lot better for them to say they got the alarm ., and acted responsibly and properly by opening other loops up and recovering the situation. U Because the issue of whether (VV) closed one or two ';) d discharge valves had important implications both for the accuracy of his testimony and the existence of a motive to destroy or conceal evidence, we conducted an extensive 4 analysis not only of the available technical data from the d event itself, but also data obtained from plant tests run .j l specifically for the purposes of this report to try to l t 1
n
- b. .
position, but before the alarm came in.69 The same analysis L also indicated that the speed reduction on the "C" pump . p occurred just before (W) turned the "B" discharge valve control switch to "closect."70 The above-described sequence suggested by the data differs from (W)'s account in that he L@.
., recalled reducing the "B" pump speed prior to closing the Lj' "B" discharge valve, and did not recall changing the "C" pump speed at all.71 , 4. Conclusions O
The evidence supports the following conclusions: 0 a. (W) caused the safety limit alarm to be actuated when he moved the "B" recirculation discharge valve _ control to the closed position in the course of securing the a 11 "B" pump. b ., (W) made this error because, in a lapse of concentration, he reacted to GSS (HH]'s order to secure the pumps by following what (W) termed a "normal shutdown" procedure that was not appropriate for the prevailing plant conditions (i.e., only two loops'open) that existed at the h.'. time.
;f) a
- c. No one else breached any standard of conduct thct contributed to the safety limit violation.
lq U
- d. (W) immediately corrected his error by n
y opening the "A" and "D" discharge valves, restoring the jl a 0
h Q 5i testimony on this point.
.?
w Two discrepancies between the data and (W)'n testimony ' remained. The first related to the post-alarm sequence of I actions he described. The technical analysis squarely _ wp contradicted (W)'s essertion that he tripped the "B" and is "C" pumps after the safety limit alarm cleared. As , explained in Volume III (Section D-9), the "B" and "C" pumps , e were tripped about one minute before the alarm cleared, sg within a few seconds after the RBCCW isolation. Confronted n with this discrepancy, (W) had no explanation except to b reiterate his firm recollection that he tripped the pumps after the alarm had cleared.68 We concluded that the technical analysis was accurate on this point. The above-described discrepancies between the technical ]
.1 i data and (VV]'s testimony, however, did not give rise to any serious implications for his overall honesty and credibility, such as would have been present if the evidence .,
M had shown that he closed two loops instead of one. In the d context of all the evidence, we could discern no plausible p [
. O reason why (W) would intentionally misrepresent the order in which he performed certain post-alarm actions, such as .h .a tripping the "B" and "C" pumps.
,,]
.a our analysis of the data also strongly suggested, 3 ,
although it did not establish conclusively, that (W) . reduced the "B" pump speed (using its individual controller) , d after moving the discharge valve control to the closed
- )
- 84 - 1 ii I .2
?
Q - the GSS (unless the person knows that the GSS has already been informed)."74 A safety limit ciolation is m a separate event cate-gory under Procedure 126. However, from the description of 3 h reporting categories in Procedure 126 -- many of which are [ B tied to NRC regulatory requirements -- it is clear that such
", .. violations, depending upon their nature and the prevailing plant conditions, are reportable to the NRC under one of the time categories (one hour, four hour, etc.). For example, q
O among the events requiring a report to the NRC within one 7 hour are "those events for which Technical Specifications
" require the initiation of reactor shutdown."75 The
.3 September 11, 1997 safety limit violation fits at leant part L.J of this description because the Technical Specifications did
~t j require the reactor to be brought to a cold shutdown condition in the event of such a violation.76 on the other hand, because the reactor already was in a cold shutdown condition when the violation occurred, no "initiation" was required to bring it into that condition. In that sense,
,, the September 11 avant did not fit the description of a one-hour reportable event.
- g( 3.-
Among the events requiring a four-hour notification to ,hp. l the NRC is the following:77 Any event, found while the reactor is shut 3 J. down, that, had it been found while the !J reactor was in operation, would have resulted in the nuclear power plant, including its
!.l principal safety harriers, being seriously U degraded or being in an unanalyzed condition i(3 t -53
': l
. g
- ;5 ,
plant to compliance with the safety limit within two .- u minutes. . to The "C" discharge valve remained oper
~
e. throughout the event, and at no time was there a, loss of m communication between the core and annulus regions, of the Q reactor vessel. u i B. Ban.prtina of Safety Limit Violation Within GPUN Chain of Command W{ 7 Standards of cor@Lgt 1. ll The Oyster Creek Technical Specifications, Section 6.7.1(b), require that a safety limit violation be reported to "the Vice President and Director Oyster Creek," as well as to the NRC.72 The Technical Specifications do not, -,3 .
,1 however, specify the timing, procedures, and responsi-bilities for internal reports. These and other standards
[% for internal reporting are found in Oyster Creek Station Procedure 126 (Procedura for Notification of Station -{: Events), as well as in commonly understood practices and g procedures. T Iaction 5.2 of Procedure 126 makes the GS'S responsible b
'-. datornining th.: category of an event and, depending upon <-
%t cat, % , making the appropriate notifications to 9
- ,,ai w. ant, the Public Affairs office and the urn, any person discovering cortain categories of aw.' .aquiring notifications "shall immediately inform a i
5 g __ ~9.
P . . requires the GSS to make internal notifications, in addition to notifying the NRC.80 Moreover, even if a safety limit , violation did not fall within one of the NRC reportable time a categories, it would fall within the category of "Reportable Events (Potential Government or Public Interest)."81 This
., category includes: "evonts of potential public interest,"
such as (amphasis ir. original) :82
~
plant conditions . . . that are in progress f id or have occurred which . .
. EAX be construed by the public to be detrimental to the environment or the health and safety of the public or plant personnel.
The GSS must report events falling within this category (! "promptly" to higher management (the Plant Operations Director or Manager of Plant Operations) and to the Public I,! rj . Affairs Office, "so that the required notifications can be
~
a made to local, state or corporate officials and to the NRC, II if necessary,n83 The rationale behind requiring prompt M-U reporting of "Category VI" events is instructive:84 In regard to the need and timeliness of i ?, making notifications for each of the hj following events, many of which may have only i very minor actual significance, it must be borne in mind that: h) A. Experience has shown that when rumors reach the news media in the absence of
$?- official notification, very minor events
,d may be reported by the media in a mar.nar ( ontirely out of proportion uo the actual !n significance of the event. B. Local, state, and NRC officials are
,s placed at a great disadvantage when they l' " hear of events from the media about which they have not been provided facts by the licensee.
U C. Such circumstances can lead to: Y h ,
h a that significantly compromises plant safety. Like the one-hour evhnt description referred to above, this b' l .> description of a four-hour reportable event covers at least [
- :+
some aspects of the September 11 event, while in other x respec:;s it arguably does not describe that event. { Ultimately, GPUN management determined that the
~
September 11 safety limit violation was a four-hour - reportable event, and the NRC inspection team that investigated the incident concurred in that judgrent.78 g, r did not make an independent determination of whether the ~ safety limit violation was properly categorized as a four-hour reportable event. As the wording of the above-quoted provisions makes clear, however, categorizing an event for reporting purposes requires analysis of language that is not . . , always free of ambiguity. Recognizing this, Station Procedure 126 staquires the GSS to begin this analysis '9 a)
^
promptly and to enlist the aid of others in GPUN management and staff positions:79 ] The GSS, in addition to taking action in _ accordance with other procedures to correct 6 the event and/or mitigate its consequences, d shall promptly evaluate the event against the six categories defined in Section 3.0, start- JJ ing with category I and proceeding through ;j the other categories in' numerical sequence, until the correct Category for the event, if j any apply, has been determined. The GSS shall consult with the Plant Operations Director, Manager Plant Operations, Shift Technical Advisor, or others, as he censiders '.] necessary in determining the correct a l Category. ' Each of the categories of NRC-reportable events jI l 3 i m
. _ - - - , - _ . -_ - i
Station Procedure 126, Section 6.1, that any person L1 discovering certain categories of reportable events . immediately inform the GSS "unless the person knows the GSS 4 has already been informed." B A The safety limit alarm ocer.rred at 2:17:34 and cleared N' at 2:19:17.86 (HH] reported the violation to (R) at
. approximately 3:45 a.m., nearly an hour and a half later.87 He had two basic explanations for his failure to , report the event sooner: first, that he had other t
'd priorities, such as arranging help for a maintenance worker lD who had been splashed with' water from the leak in the RBCCW l system and restoring the plant to its pre-leak conditions; and second, that his memory and behavior were affected by a severe psychological reaction to stress. b b (HH), like all of the other members of "B" crew, denied (h any intention to conceal or delay reporting the safety limit violation, whether individually or in combination with g d others. A more detailed discussion of (HH]'s psychological
, state and individual behavior appears in Volume II. This section will focus on his and the crew's testimony that t there was never any ir.tention, conspiratorial or otherwise, to conceal the safety limit violation from higher to Id management.
G b
"I 'j - 91 _
D _ _ _ _ _ _ - _ _ _ _ _ _ _ _ _ _ _
- 1) Improperly raising anxiety of the p public, and sometimes company -
g employees and contractors, concerning their safety. ,
- 2) Extensive follow-up efforts having ~b to be expended to put the event in proper perspective and to explain f why notifications were not made in d.
a timely manner (or not made at , all). q r,
- 3) Raising suspicions on the part of
- T government officials and/or the _
media that the licensee is not S forthright. - U T In addition to the requirements of Procedure 126, the Station Procedure that specifies the proper operator F responses for each alarm on the control panel includes the , corrective actions for the "less-than-two loops open" il alarm. The corrective actions mandated for that alarm J include the following: "Immediately notifying the NRC and ;? Operations Department."85 r.; c1
- 2. Crew recortina to hicher manacement Because the entire crew simultaneously witnessed the h safety limit alarm (except for GOS (A), who was at the site Q
.e) of the leak on the twenty-three foot level), there was no
. :9 immedikte issue of reporting within the crew. GSS [HH), ,,} whose respons.4.bility it was to report the safety limit violation to the next level of management, was present when m
\
tile alarm occurred, and the rest of the crew could plainly q see that he was as aware of the violation as they were. Thus, the members of the crew satisfied the requirement of 5 a v 1
- .J nj
_- - - - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . _ _ J_
"d his own personal role in the violation. He cited as an f example an incident involving another GSS who was given one _ week off for tying off a vacuum breaker, and assumed he e d would be even more severely disciplined for a safety limit violation that occurred on his shift.96 The operators
] , generally felt there would be discipline even for an honest h, 6 mistake.97
{ Although the crew immediately understood the serious-ness of the safety limit alarm, there were a number of other m
] matters to attend to in the alarm's immediate aftermath.98 In the control room, (ZZ) was raising the reactor water g
O level. The reactor level had to be increased to 185 inches Q in order to promote natural circulation.99 He estimated la that it took ten to fifteen minutes to raise the reactor IG y water level sufficiently.100 l . While the reactor water level was being raised, (HH] and (II) were talking about the mechanic who had been p] [ sprayed with RBCCW water, which was thought to be slightly g radioactive.101 J Meanwhile, outside the control room the effort to b"' isolate the leak at V-5-167 had resulted in a slowing of the
,rq 1eak, but water was still leaking out heavily.102 gg) discussed the matter with (P), a maintenance supervisor,
) and (P) volunteered to climb up and backseat the valve.103 After (P) did this, the leax appeared to step.104 (A) u called for electricians to check things out because there n g O
U E
- a. Crew account of nost-alarm events g
M The following account of the events that occurred between the alarm and the first report of the safety limit -y7 violation to higher management is based upon the testimony g e M of the various crew members.
'k, ,
In the control room the ".tess-than-two-loops" alarm was L greeted with a hush and, in the case of one crew member, an
, 9 ,
expletive.88 The members of "B" crew who were present knew
~
.V, that a safety limit violation had occurred because the alazan o
-- which the operators referred to as the "death alarm" --
r had a distinct:ive green color.89 g The CRos understood that the safety limit violation meant the plant would have to remain shut down until the NRC
.7 l
permitted it to start again.90 They also assumed that the a individual responsible for the safety limit violation would r l be disciplined, although ther[ were differences of opinion l over how severe that discipline would be.91 Although f(j management personnel testified that no specific discipline
<i.
was called for by the cornission of a safety limit .d violation,92 (W) perceived that such discipline would be ~' more savere than for other types of violations.93 (W) thought he would be suspended for at least a week.94 The other control room operators also thought that (W) would g face punishment but of a lesser degree. 5 For his part, . . (HH] thought he would be disciplined because es a GSS he - l would ba hcid responsible for (W)'s actions regardless of
-]
d 92 -
,----r-,--.r--=-w-- -~ve,--r-,.r-,-,., ...m,,,,ew w -,. w w - w
about time tc call (R) and tell him what was going on.113 l h La (A), still unaware of the safety limit violation, assumed . (HH) was referring to the lack and the water sprayed on 6 114 As (HH] was dialing (R), CRO (ZZ) came to the doorway of the GSS's office and asked (A) to talk outside in t.- the hallway.115 (A) and (ZZ) left the control room at 3:28 a.m.116 (A) then learned about the safety limit for the 7 first time. (ZZ) also told (A) that the SAR tape was gone and apparently had been ripped out.ll7 (ZZ) said that he
] had asked (HH), (II), and (W) if they had the tape, and they said they did not have it.118 (A) asked if (HH] knew r.
y) everything, und (ZZ) confirmed that (HH) was standing next 3 to (VV) when (W) shut the valve and the alarm came in.119
.(ZZ) testified that he did not know, prior to his discovery of the missing SAR tape, whether the safety limit ,
p violation had been reported to higher management.120 There J had been no discussion of withholding the information that ' there had been a safety limit alarm, and (ZZ) had no h. L intention of withholding such information.121 He told (A)
@ about the alarm and the missing tape because "I wanted to p%. . make sure he knew as fast as possible, because ((HH))
t. was on the phone and I (didn't] know how long he was going to be on the phone or whu he was talking to."122
'?,. (HH] called (R)'s home between approximately 3:25 and
,id 3:30 a.m. The call awakened (R). (HH] informed (R) of the
.v4 leak, and of the injured worker, but did not disclose either ] .)
d iD -
l l 3 were many electrical components in the area getting wet, which might cause them to malfunction.105 (A) also called , for station helpers to clean up the pool of water which had r p$ formed from the leak.106 He then started to return to the control room. On the way, he realized that RBCCW was still ? Eg " isolated to the drywell, and that the backseating, not the isolation, had stopped the leak. Therefore, he thought -] there was a good possibility RBCCW flow could be restored to the drywell. (A) contacted the control room and suggested b this possibility to the control room crew. They agreed, and (A) supervised the opening of the manual valve that had been closed during the isolation process.107 ] When (A) finally returned to the control room at 3:03 a.m., after a 52 minute absence,108 he found (HH] working hard trying to determine which chemicals were in the corrosion inhibitor that had sprayed (C), the maintenance - y
'J worker, in the face. Up to this point, (A) had no knowledge that a safety limit violation had occurred.109 7
.a (A) then left the control room at 3:09 a.m. and went to q e -J the fifty-one foot elevation to look at a drum containing the chemical that was the corrosion inhibitor in the RBCCW.110 (A) returned to the control room at 3:15 a.m. and spoke with a health and safety representative, (G].111 He .]
then reported to (HH) that the health and safety represen- , tative was looking into first aid for (C).112 ~ I At this point, according to (A), THH] said that it was U q
,1 I
......a-.~-... .z....-.. .... - . . . ,
The second (HH]-[R] conversation, as noted above, was
; initiated by (R) from his home to (HH]'s office. After -
- F i (HH]'s first call, (R) had phoned operations Director (N).
b As a result of his conversation with (N), (R) called (HH] to f ' ask about the recirculation pumpe. This questioning prompted (HH] to reveal that they had actuated the safety
, limit alarm.131 Upon learning of the safety limit
~] .- violation, (R) instructed (HH] to notify the NRC.132 (HH] did notify the NRC at approximately 4:05 a.m.133 The third telephone contact between (HH] and (R)
- occurred shortly after 4 a.m., while (HH] was in his office a
with (A). When the (R) call came in, (HH] answered the in g phone but handed it to (A) because (HH] was in the process of contacting the NRC.134 (A) took the phone from (HH] and
- ha, had a brief conversation with (R). (R) wanted to know when
?s the event occurred. (A) recollected telling (R] that "from
- the computer, it looks like 2
- 24."135 (R) also wanted to know why li: took (HH] so long to tell him about the safety limit violation. (A) expressed the belief that (HH] was just about to call (R) when (R) called.136 f b. Comoarison of crew account with other evidence
[) d During the nearly one and one-half hour period between Pj the safety limit alarm and the notification to higher LA management, ten persons other than the "B" crew members who q
!j witnessed the s,cafety limit violation entered the control m
l - 97 - m -
the safety limit violation or the fact that the SAR tape was y p missing.123 , L' C (A) was shocked by (ZZ)' revelations concerning the -g safety limit and the missing tape.124 When he reenter.id the 7 control room after his discussion with (ZZ), he intended to hear what (HH) was telling (R). (A]'s recollection was that
]J as soon as he reentered the control room, (HH) left quickly -
T with a red binder containing a list of hazardous sub- g stances.125 J When he got back into the control room after speaking _ with (ZZ), (A) questioned (II) about the safety limit .,_ violation and missing SAR paper. (II) confirmed what (ZZ) m
\
w had said.126 (HH) then returned to the control roon. (According to d. l the computerized records this occurred at 3: 41 a.m.)127 gg) asked (HH) if he had told (R) about the safety limit violation. [HH) said no. (A) said that they had to tell { , people about this. (HH) agreed and began walking towards his office, presumably to call (R).128 e As (HH) was walking towards his office, (R) called ]L back.129 (HH] reported that (R) had asked if they had 7 violated the safety limit, and (HH] had disclosed that they had.130 ((R), as described below, testified that he called to ask about the status of the recirculation pumps and to remind the crew to keep the valves properly aligned.)
':}
I J!
As can be seen from the pattern of entries and exits, after 2:33 a.m., persons other than the "B" crew members who . witnessed the alarm were in the control room almost _ continuously. The only substantial period during which no "outsiderc" -- i.e., persons who had not witnessed the alarm
-- were in the control rocm was between 2:17 and 2:33 a.m.
0' None of the persons listed above who entered the control room during this period were told about the safety limit violation and none noticed anything out of the ordinary 141 except (PP), who recalled that on his 3:28 - 3:32 a.m. trip to the control room the atmosphere was "formal" and (W) seemed "shaken."142 0 Several witnesses confirmed that (HH) was concerned h about the leak and the possibly injured maintenance worker.143 (H) discussed these subjects with (HH] between 2:35 a.m. and 2:52 a.m.144 (P), who was in the control room from 3:00 to 3:27 a.m., discussed the leak and the possible injury with (HH), and found him "concerned" about the effect of the chemicals in the water that had splashed on the worker.145 When (P) left at 3:27 a.m., he was under the impression that (HH] was telephoning (R) concerning the i leak.146 l l lq The analysis of technical data confirmed that in the hour following the safety limit alarm, the crew performed a l l]: series of operations related to the leak and to restoring the plant to its pre-leak condition.147 This process had c: i! l^ .n i ;
E' ' E i room. One of these, of courne, was GOS (A), whose account l n i of events during this period is summarized above and in the , L l individual section pertaining to (A) in Volume II. g
-M*V The entry and exit times of the other nine are summarized below:137 E l
(D) 2:33-2:35 'O sf (H) 2:35-2:52 .Y 3 (AAA) 2:36-2:38; 2:39-2:58 6. [RR) 2:37-2:41; 3:03-3:22 , (WW) 2:38-2:40 R (P) 3:00-3:27 ? (PP) 3:28-3:32 (E) 3:35-3:56 (XX] -3:35 In addition to the entries and exits shown above, (G), 3 a health and safety representative, attempted to enter the t9 Q~ control room at 3:33 and 3:34 a.m. with an invalid access card. This attracted the attention of a security guard, - (E), who entered the control room at 3:35 a.m.138 During
,,]
this brief period, (XX], a plant engineer who had i; accompanied (G) to the control room, entered the control q' 3 l room to ask GSS (HH] to step outside so that (G) could speak to him.139 (The computer did not register (XX)'s entry into the control room, only his exit at 3:35 a.m.) (XX) and (G) O] , l confirmed that they had a discussion with (HH) outside the l { control room about the maintenance worker splashed with J RBCCW.140 l l
$*1
As can be seen from the pattern of entries and exits, after 2:33 a.m., persons other than the "B" crew members who. witnessed the alarm were in the control room almost continuously. The only substential period during which no h "outsiders" -- i.e., persons who had not witnessed the alarm
-- were in the control room was between 2:17 and 2:33 a.m.
'- None of the persons listed above who entered the control room during this period were told about the safety limit violation and none noticed anything.out of the ordinary 141 except (PP), who recalled that on his 3:28 -
3:32 a.m. trip to the control room the atmosphere was dy7 "formala and (VV) seemed "shaken."142 L)
] ,
Several witnesses confirmed that (HH) was concerned about the leak and the possibly injured maintenance worker.143 (H) discussed these subjects with (HH] between ! 2:35 a.m. and 2:52 a.m.144 (P), who was in the control room from 3:00 to 3:27 a.m., discussed the leak and the possible ! injury with (HM), and found him "concerned" about the effect l of the chemicals in the water that had splashed on the worker.145 When (P) left at 3:27 a.m., he was under the impre.sion that (HH) was telephoning (R) concerning the g leak.146 w The analysis of technical data confirmed that in the Q, 2 hour following the safety limit alarm, the claw performed a series of operations related to the leak and to restoring
]
the plant to its pre-leak condition.147 This process had
.)
f
i
~. .
been completed shortly before (HH]'s first telephone call to c (R).148 , b e In summary, there was substantial support in the C testimony and technical data for the conclusion that (HH]'s g and.the crew's time and attention were occupied by matters C other than the safety limit violation. Moreover, as . discussed below, there was no substantial evidence to -' r., support a conclus. ion that the crew, or any subset of the d crew, engaged in a conspiracy to delay or avolo reporting the safety limit violation. (The individual actions and - motives of the crew members are discussed in Volume II of . this report.) Jj First, even if an inclination not to report the incident is assumed, the crew had no reasonable expectation that the violation would be kept secret. Only if all crew members who witnessed the alarm (plus (pP),'a non-crew b member who saw it just before he exited the control room at .:
'~
2:17 a.m.) agreed to silence, and the ensuing critiques of
. *15 the leak incident failed to uncover evidence of it, could
[] such a conspiracy succeed. If even one crew member broke ranks, not only would the violation become kaown, so would bl
.a uhe attempt to conceal it, an action the crew knew carried -]
far greater potential consequences.149 J We explored in creat detail the possible motivations J the crew, and each individual member of it, might have to intentionally cover up or fail to report the safety limit
.q
- 100 -
__. v -.
o b
- a . -
a violation. The most obvious motive would be an attempt to avoid punishment for the violation itself. Landing 3 additional credence to this possible motive was evidence a that discipline had become more strict in the period prior i to September 11, and that there was a perception among c['- Operations personnel at the crew level that discipline was h, imposed unfairly.150 ,
.0 (VV) testified that he expected to be suspended without e) pay <for at least a week, and that he might receive .
9 additional punishment. The others, however, thought (VV) would receive less discipline than that. Apart from (VV), only (MH] testified that he expected to be disciplined for
~;.
t! the safety limit violation.151 There were no exceptionally close social relationships
, among the crew members, or other circumstances suggesting j 1i ,a that those who wars at virtually no risk themselves would
[] u agree to cover up the violation for (VV)'s sake, even if it were assumed that (VV) would want them to do so. We concluded that fear of discipline was not a plausible motive g, for a conspiracy to conceal or fai2 to report the safety E[' limit violation. d[3 Strengthening this conclusion was (ZZ)' notification to 3 (A), which the computerized re' cords indicate occurred between 3:28 anL 3:30 a.m., and which was followed only Il fifteen minutes later by (HH)'s disclosure of the violation L to (R). '
- 101 - ) .. ._ .- _
m We air a found it unlikely that the crew could have [ < formulated even a crude agreement to conceal the safety _ l limit violation given the other activities that were in L progress at the time and the number of people coming in and m j out of the control room. (HH), in particular, was 'f frequently observed by "outsiders" during this time. In N.y addition to members of the crew, he had conversations with'
-}
(D), (H), (R), (P), (XX), and (G) between 2:33 and 3:41 _ a.m. After approximately 3:45 a.m., of course, any plan to - conceal the violation from higher management became moot because (R) was made aware of it. In short, the weight of the evidence indicated that there was no conspiracy by the crew to conceal the safety l'imit violation from higher management. Responsibility for reporting the violation clearly rested with GSS (HH). Th e'
\
evidence did not indicate that, prior to (A)'s questioning .9 of (HH) at approximately 3:45 a.m., any other member of ths - crew even knew that (HH) had not yet reported the violation >
-- much less did it show that anyone encouraged (HH) to
[ r delay or not make his report.
~
With respect to (HH)'s asserted reasons for the one hour twenty-five minute delay in notifying higher management of the safety limit violation, we found that he was , i substantially occupied during much of that time with matters - related to the leak, the injured worker, and restoring the
}
plant to pre-leak conditions. These. distractions, however,
\
- 102 -
1 did not sufficiently explain or justif'y his failure to _ 7 [ notify higher management sooner than he did. In particular,, (HH) found the time to telephone (R) at approximately 3:30 l a.m. to tell him about the leak, but did not mention the
]; safety limit violation. Only after (A) confronted him with ?,
the necessity of disclosing it did (HH] prepare to call (R) j about the safety limit violation, by which time (R) had [* called back with questions of his own. W Because (HH) did not report the safety limit violation
. to (R) or otherwise take steps to analyze the appropriate 7 reporting categories and ensu.e compliance with them, by the time upper management personnel found out about the q
6 4 violation it was already too late to make a one-hour report, had one been required. Moreover, as discussed later in this p Lj report (Soction VI(E)), the' delay in reporting combined with p other circumstances to cast a general suspicion on the crew. d , q 3. Reoortine within manacement above crew level 1 a As discussed above, [R], the GPUN manager immediately L.t
,j, above the crew level, learned about the safety limit violation from GSS (HH) at approximately 3:45 a.m. (R) .]"
- immediately notified Plant operations Director (N) who, within minutes after speaking to (R), r.otified Deputy Director (SS).152 (SS) was then the highest ranking GPUN n
y manager at Oyster Creek, Director Peter Fiedler having been n on vacation at the time. [SS), in turn, notified GPUN top
.t management officials in Parsippany; this was dona between ?!
i
- ! - 103 -
' O, . _ __ _ . _ _ _ _ _ _ , . - _ _ - - - ._
p G approximately 5 a.m. and 6 a.m.153 { There was no substantial conflict in the evidence 7
~
concerning the sequence and timing of notifications within upper GPUN management. By 4.a.m. -- approximately fifteen ('e minutes after the first notification to management above the e crew level -- the highest ranking manager at Oyster Creek knew about the violation. The Public Affairs Office was I notified at 4:36 a.m.154 By 6 a.m., corporate management at Parsippany had been notified and a briefing was in progress, attended by a variety of GPUN personnel as well as an NRC representative. .]
- 4. Conclusions ,
The evidence supported the following conclusions: (a) There was no agreement among the members of "B" ']:) crew to conceal, fail to report, or delay reporting the safety limit violation. (b) The responsibility for reporting the safety limit violation to higher management belongnd to GSS [HH).
~
(c) No other member of the crew encouraged (HH] to conceal, not report, or delay reportinqr the safety limit ', violation. l
.i (d) During the nearly one and one-half hour delay between the safety limit alarm and (HH)'s report of it to j higher management, (HH] was preoccupied with matters
}
- 104 -
,l
~ requiring his attention, such as the leak on the twenty-three foot level, a possibly injured worker, and restoring
, the plant to pre-leak conditions. These reasons, however, 1
do not fully explain or justify his failure to report the
- violation earlier.
,]- J (e) By delaying his report to higher management, (HH) I I* risked violating an NRC reporting deadline and created an h appearance that, combined with other events, led to a {w generalized suspicion by higher managers that the crew had been attempting to conceal the safety limit violation. m
-4 I
f} J
'l ,
J L6
~
I 1 L b_ u O W
- 105 -
23 ..
I'. I l l C. Reecrtina Safety Limit Violation to NRC F!
- 5: l l
- 1. Standards of conduct m
-Y ._
The Oyster Creek Technical Specifications, Section 7 il 6.7.1(b), require that a safety limit violation be reported "
~'
"to the (NRC) and the Vice President and Director Oyster
_ Creek."155 The Technical specifications additionally - c
. require that a written report describing the violation, its b effects, and corrective action taken be submitted to the NRC within 10 days of the violation.156 Apart from the 10-day requirement, the Technical specifications do not by 3 themselves set a time limit for initial reports of safety 'I'
~
limit violations to the NRC. NRC regulations establish time limits for reporting n various categories of events.157 The time l'mit i for d reporting the September 11 safety limit violation depended w upon which category the event fit into under the ,
- J1 i regulations. O.
Categorizing the September 11 avant presented certain difficulties, chiefly in determining whether the safsty _. limit violation required a report to the NRC within one hour 1. 4 pursuant to 10 C.F.R. 5 50.72 (b) (1) , or within four hours lt pursuant to 10 C.F.R. 5 50.72 (b) (2) . As discussed in the i
,,3 immediately preceding section of this report, determining i i 1 the proper category required analysis and judgment concerning possible ambiguities in the language of the );
( '
.i
- 106 - -
.___- J
'T .
4 - appropriate reporting provisions. GSS (HH), who made the initial report to the NRC at 4:05 a.m., categorized the m j safety limit violation as a one-hour reportable event.158 He had been instructed to do this by (R).159 (R)'s assistant, (MM), also initially assumed that the safety limit violation required a one-hour report. As he LA
, explained: "You call on a one hour for violating an LCO (limiting condition of operation). . . . I would be surprised if it wasn't the same thing. ',160 la Based upon their later review of the NRC regulations, however, both GPUN management and the NRC inspection team that investigated the violation concluded that it was a .j four-hour reportable event.161 As stated earlier in this s
report, we did not address the legal issue of the proper interpretation of the NRC reporting regulations and, 3 accordingly, we assumed the four-hour standard to be the 3 appropriate one for purposes of this report. 7 L1 oyster Creek Station Procedure 126 (Procedure for I Notification of Station Events) makes the GSS responsible for determining the category of an event 162 and, in the case v1 of one-hour and four-hour reportable events, notifying the NRC and making the appropriate internal notifications.163 l(q "
.i As discussed in the previous section, the GSS is exp' acted to
- Jf/ seek the assistance of higher management and staff personnel when necessary to determine the appropriate reporting ip.
L, category. l , I * ' n - 107 -
' 't a - -
f"! U
. Additionally, as discussed in Section VI(B) of this report, the Station Procedure specifying responses to alarms _
on the control panel contained a directive that violations b of the safety limit be reported "immediately" to the NRC, as r-well as to operations Management. U 9
- 2. Crew recortina to NRC As discussed above, in a telephone conversation at approximately 3:45 a.m., GSS (HH) notified Plant Operations _
Manager (R) that the less-than-two-loops alarm had been u. activated. (R) instructed (HH) to report the event as a
~
- safety limit violation and to categorize it as a one-hour reportable event.164 (HH) called the NRC's. Emergency l J
Notification System (ENS) at 4:04 a.m., later reducing the notification to writing in an Event Notification Form.165
~
In that form, (HH] described the event as follows:166 RBCCW 1eak from V-5-167, B&C recirc pumps in , operation, shut discharge valve on "B" pump. ,. Received "less than 2 loop open alarm." Immediately opened D&A recirc loop discharge .s valves. Alarm cleared before "B" discharge shut. Violation of Safety Limit 2.1(E). j
'J He listed the time of the event as 2:30 a.m., the cause as "personnel error," and the time of his notification to (R)
- h) .
as 3:30 a.m.167 The evidence showed that these times were inaccurate by approximately 13 and 15 minutes, respectively. However, we did not find that these errors - were evidence of intentional misreporting because of the U l unavailability of the SAR data at the time (or any other j precise measurement of the time of the event), and the 108 -
difficulties many of the witnesses had fixing the precise
,a times of telephone calls. (R), for example, estimated that
[ his first conversation with (HH) was at 3:15 a.m.; the
, evidence showed that it was between approximately 3:25 and ; 3:30 a.m.168 9 ; The NRC later confirmed having received (HH)'s notification.169 3
J Following his ENS notification at 4:05 a.m., (HH) t j telephoned William Bateman, the NRC Resident Inspector, and
,q told him about the safety limit violation.170 (As discussed J
below, Plant Operations Director (N) also told Bateman about I the event.) , (HH] provided the NRC with information about the safety limit violation that was timely (using the four hour fj 1; standard) and substantially complete and accurate within the limits of the information then available. However, by waiting nearly an hour and a half before reporting the safety limit violation to (R) or taking any other action f .} U' relating to it, (HH] did not carry out his responsibility as l '. GSS to review and determine the proper category of an we event. Moreover, as discussed above in connection with i f internal GPUN reporting, (HM) made it impassible for higher management to determine the proper reporting category for [j the safety limit event until more than an hour had passed.
, Thus, if analysis of NRC regulations had disclosed that the
'~ one hour standard was applicable to the event, it would have l
- J - 109 -
r
( . . . . . r P e s been too late to provide a timely notification. ,
- 3. Manaaement reeertina to NRC Flant Operations Director (N), who learned about the C safety limit violation from (R) shortly before 4 a.m., ,
telephoned NRC resident Bateman and told him what he knew about the event.171 Bateman later attended a 6 a.m. briefing on the incident, which was led by (N) and Deputy [.j Director (SS).172 A tape recording of that briefing showed .q that the GPUN managers gave a substantially complete and accurate a,ccount of what they knew about the violation at that time.173
~
Later in the day, following the discovery of SAR tape fragments in the trash, GPUN management submitted an updated j report to the NRC which, in addition to reporting the apparent disposal of SAR tape, stated:174 Licensee and NRC review of the circumstances ., surrounding the event has revealed that both cf the in-service recirculation discharge - valves were started closed. . . . As discussed in more detail in Section VI(A) of this t report, management and NRC personnel who examined the , technical data on the morning of September 11 concluded # that, contrary to the version of events given by CRO (W) < and reflected in (HH)'s 4:05 a.m. NRC notification, (W) had closed both the "B" and "C" discharge valves. Our technical analysis, however, led us to. conclude that the "C" valve in ,
\
fact remained open at all times,175 until it was closed at J
\
J
- 110 -
-T ,
w 4 - 3:19 a.m., after recirculation flow had been reestablished by the startup of the "A" and "D" pumps.176 1 Later on September 11, after the discovery of pieces of n j SAR tape in the trash, GPUN management made an updated v
. report to the NRC through the ENS. (The circumstances
] leading up to that notification are discussed in Sections e VI(E) and (F) of this report.)
l
'J The updated notification contained information that we li have concluded was inaccurate -- i.e., that two recircula-p tion discharge valves were going closed during the safety
[] limit event. However, as discussed in Section VI(A) of this [} La report, both GPUN and NRC personnel who examined the data available on the morning and afternoon of September 11 1 L} agreed that the evidence indicated that two discharge valves had been moved to the closed position, and there was support
),;
M in the data for this conclusion. We reached a contrary conclusion only after extensive re-analysis of the technical data and with the benefit of test results that were not available en September 11.177 In summary, the evidence clearly established that GPUN management above the crew level reported the safety 2imit violatien to the NRC in a timely manner. Using the four hour report category, the 4:05 a.m. notification was U obviously timely, because the violation occurred shortly a after 2:17 a.m. If the violation had been reportable under
'I" the one hour standard, the 4:05 a.m. report would have besn -
r,
'j
- 111 -
R - - _ _ _ _ _ _ _ _ _ __ _
ku n late. This lateness, however, could not have been , y attributed to managers above the crew level, because they acted with speed and diligence after they learned about the ~$ violation. ; E-w We also concluded that GPUN managers above the crew ./ c level provided the NRC with information about the safety (' limit violation that was complete and accurate based upon the data available at the time. "
=
b
~
- 4. Conclusions r
The evidence supports the following conclusions: f (a) GPUN management above the crew level did '[
~
not know about the safety limit violation until approxi-m
- t' mately 3:45 a.m. *
, (b) Within twenty minutes after management
. above the crew level learned about the violation, it was a e3 i reported to the NRC through the ENS telephone line, a l l (c) The report to the NRC made by GSS (EH] at approximately 4:05 a.m. was substantially accurate except ,., e for an approximately 13 minute error in the time of the I.J evsnt, which we concluded was unintentional. ." (d) The 4:05 a.m. report submitted to the I NRC by GSS (HH] was timely using the four-hour reporting :2 category. 7 a 1 - 112 - l
n.. ... . .
? .
5 - (e) After the 4:05 a.m. ENS report, both 6 . (HH) and (N) made informal notifications by telephone to the NRC resident inspector.
'c (f) A detailed briefing was held at 6 a.m.,
. attended by the NRC resident as well as various GPUN
]7 tj
' personnel, a* which information about the safety limit n
7 violation was disseminated, comprising a substantially complete and accurate account of what was known about the
-il event at that time. 'U q (g) GPUN management above the crew level 1J acted with speed and diligence in reporting the safety limit ,i violation to the NRC after learning about it.
p;- D. Des'truction/ Concealment of SAR Tagg
- b
,. Because CRO (VV) admitted tearing the tape from the SAR and later disposing of it, the investigation attempted to
]a verify the particulars of his account and address two principal issues: (a) whether he acted alone; and (b) what lP], motivated his conduct, particularly whether he intended to conceal the safety limit violation or any event related to L* it. .F
- gr- We questioned (VVJ in great detail about his actions with respect to the SAR tape and compared his story with t'CI}
evidence from other witnesses, documents, and the inferences t hat could reasonably be drawn from all of the
.i!
circumstances. In many respects (vv]'s account was 4 i t 13
- 113
[l.> - l
' ~~ ~ " ' '
. E Lv 7
corroborated. There remained certain discrepancies between y M his testimony and other evidence, the significance of which
'I ,
is discussed below. -1 e
- 1. Standards of conduct f .j e .
l The SAR, as discussed previously in this report,178 ya, y J il installed at the initiative of GPUN management to provide a .s n sequential and automatic recording of alarms. One of its { origir.al purposes was to assist operators in the handling of 7 i . emergencies.179' It was used by management to help b reconstruct events when necessary, such as in the ri preparation of transient analysis reports (TARS).180 hd Neither the SAR itself nor the printed records it produced (in the form Of adding machine-sized tape) were 3 2
- specifically required by NRC regulations, the Oyster Creek Technical Specifications, or internal administrativo procedures.181 SAR tape is, however, arguably covered by '
written GPUU document retention policies 182 and is in b practice retained by the company to assist in the ;' investigation and reconstruction of, among other kinds of
, transient events, the kind that occurred on Scptember 11, 1987.183 7
Because of their role in the investigation and recon-struction of events, records produced by the SAR play a part in the reporting of those events, both internally and to the NRC.184 Thus, the standards of conduct applicable to the o
~
- 114 -
l_
?
L e [ destruction, concealment, alteration, or disposal of SAR
]
tape are closely linked to those previously discussed with j respect to reporting requirements. In particular, the
, seriousness of any tampering with SAR tape depends to a $ large extent on what motivated such an action -- e.g.,
whether it was.done in furtherance of a plan to conceal a
,, reportable event from management and/or the NRC.185 3
3 To the extent that the destruction, concealment, or .[7 disposal of documents is done with intent to conceal the 'O information contained in them, it violates internal policies j mandating complete and truthful reporting to government agencies and management.186 Disciplinary guidelines specifically warn that the consequences of attempting to p conceal an occurrence "could far outweigh (the) potential consequences of the occurrence itself,"187 and there was Ij] evidence that members of "B" crew understood this.188 .u ,i-5 Apart from any motive to conceal, the intentional U destruction or other tampering with SAR tape can violate j-internal GPUN standards of conduct and professional behavior ,. applicable to employees in general and licensed personnel in
'. particular.189
'[) 2. TVV1's account of the tearina and t diseosal of SAR tace r > [j As related by (W), the tearing and disposal of the tape occurred in three stages. First, (W) walked back to
~
the SAR to check the tape as soon as plant conditions were 3
- 115 -
l1 t:
Pr stable enough to permit him to do so -- he estimated that this occurred five to ten minutes after the alarm.190 He , s: was extremely irritated with himself and wanted to see his i error confirmed on the tape.191 When he saw the alarm indication, he reached up in anger and tore the tape.192 He did not know where the tape tore -- near the top, middle, or } bottom -- but thought it tore in only one place.193 (W) ,s n let the bottom portion fall to the floor and returned to the s area in front of the control panel.194 7y E The second stage began when (W) again lef t the front n of the control room and went to the kitchen to get a cup of I coffee. The kitchen is only a few feet away from the SAR, g and (W) testified that he passed the SAR on his way to get coffee, once again became angry, tore off the portion.of u tape hanging out of the machine, wadded it up, and threw it m into the wastepaper basket in the kitchen. After getting , $ his coffee, (W) again passed the SAR, gathered up the SAR y il
- tape lying on the floor, tearing it in one or more places in -
the process, wadded it up, and put it in his pocrats.195 He [ w then returned to the front of the control room.196
?.?.
(W) had no precise time estimate for his second visit l to the SAR, saying only that it was within an hour of the I l safety limit alarm.197 Other evidence suggests that (W) had completed the tea. ring and removal of the tape by 3:00 ] a.m., and probably by 2:32 a.m. CR0 (ZZ) discovered the tap 3 missing shortly after 3:00 a.m., and observed that a l
.J
- 116 -
1
~
portion of tape das hanging out of the nachine.198 The earliest time recorded on that portion was 2:32:54.199 (W) di recalled that on his second trip to the SAR, he tore the q tape near the top where it comes out of the machine.200 gg I that part of his testimony is accurate, the 2:32:54 alarm message was probably printed after the tape was torn.201 (W) then carried portions of the SAR tape in his pockets for approximately an hour. He testified that he did l not discuss tearing or disposing of the tape with the others (until, late in the shift, he made a partial admission of j what he had done), and that so far as he was aware, no one
- n. observed what he did.202
'l The third and final stage of his actions regarding the
'1. d tape occurred between 3:35 and 3:44 a.m., when he went to a q lavatory outside the control room.203 (W) testified that d ~ he took the SAR tape he had been carrying in his pocket and
] flushed it down a toilet.204 He reiterated that he did this u
out of anger and frustration, and not because he hoped to f*1 4 conceal the violation:205 I sat down in the bathroom to go to the l- bathroom, and while I was sitting there, I & was berating myself and I took the balls of paper out of my pocket from the SAR and I q stared at them and I was angry at them and I H
" threw them into the toilet, and when I got done, I flushed the toilet and they were y gone. '.i 2 (W) further testified that he disposed of the SAR tape without regard to its contents:206 J
Q. Do you know whether (the san tape R - 117 - E
'l T
flushed down the toilat) pertained to g; any portion of the sequence of events . leading up to or following the alarm? , W A. I have no idea. e Q. You didn't care? g 6
~
A. It didn't matter. The balls of paper were a reminder that I had screwed up .- and everybody in the world knew that I $ had done so and I never screwed up like h that before. I didn't care what was on .s them. I just threw them in. m E (VV)-returned to the control room at 3:44 a.m., about the same time that (HH] reported the safety limit violation h c to (R). He testified, however, that when he disposed of the P SAR tape he thought (KH] had already reported the d violation.207
- 3. Comerarison of TVV1's account
. With other evidence F i ~
None of the other members of "B ' crew testified that - they saw (vv) tear, dispose of, or otherwise tamper with the
- SAR tape. On the contrary, the crew members all tactified that they did not know [VV) had done any of these things n
until he made a partial admission of his actions just before ( the end of the shift.208 We also questioned everyone who , u was in the control room during the relevant period and no E one saw (VV) do anything with the SAR tape.209 7 k The absence of eyewitnesses is plausible given the - actions (VV) described. Tearing the tape from the SAR,
- throwing a piece in the trash, and putting the rest in his pockets all could be acccmplished in a very short time -- *
?l
~J
- 118 -
'l 1
?
A - possibly a minute or less. Because of the SAR's location, (Vv] would have been shielded frem the view of crew members { who were in the area in front of the control panels, or who
.1 were in the GSS's office.210 The absence of witnesses to d (VV)'s flushing tape down the toilet also was not surprising
?' because that happened in the privacy of a bathroom stall
',, outside the control room.
-Q U According to the testimony of the crew members, the i first person other than (VV] to know that anything out of a the ordinary had occurred with respect to the SAR tape was
} .CRO (ZZ). He tastified that "slightly after" 3 a.m. --
estimated at between 3 a.m. and 3:10 a.m. -- he want behind the main control panels to take the regular three o' clock q logs.211 While in that area he had also intended to get the times of the safety limit event from the SAR for the control
] room log.212 Previously, [ZZ) had been to the SAR machine J
during the HSIV full closure surveillance between 12:00 a.m. 1 j and 2:00 a.m., and had found it in normal operating g condition.213 is
'u, s
On his post-3 a.m. Visit to the SAR, (Z".] observed that .3 Tj ', there was about a foot to a foot and a half of paper hanging
,, out of the top of the SAR and a few feet piled on the 11 O floor.214 The end of the piece of paper hanging out of the p machine contained an alarm message for the isolation conden-J ser alarm.
u (ZZ] identified this alarm as the same one (MM]
]l later saw, which occurred a few seconds before 2:32:54
- 119 -
E
-. . a a.m.215 Realizing that thic alarm had occurred after the f
main part of the safety limit event, (ZZ) searched the tape on the floor for the alarms reflecting the safety limit -1 violation.216 He discovered that the next most recent ala.cm -- k prior to the isolation condenser alarm had occurred on the previous shift -- a time he identified from the tape later l$ d removed from the SAR as 18:48:31 (6:48 p.m.) on September , 10.217 Q L When (ZZ) observed the.t SAR tape was missing for a period extending from the previous shift until after the na nafety limit event, he immediately went to GSS (HH)'s d office.218 (HH) was there and CRO (II) was either in the - doorway or was walking into the office at the time.219 [gg) u asked (HH) if he had taken the paper from th6 SAR; (HH] did not reply, but had a "dumbfounded" expression on his face, as if to register surprise that it was gone.220 (ZZ) then ;j told (HH) that the SAR tape was missing for the time of the safety limit event.221 He also asked (II) if he had the U tape, and (II) said nc.222 p According to (ZZ), he then left (HH]'s office, went to the area in front of the control panels, told (I) and (VV) W about the missing SAR tape, and asked if they had taken ] it. Both denied that they had.223 A short time later, (ZZ) looked in a wastepaper basket that was located a few feet away from the SAR, thinking that "it could have been a mistake that somebody might have thrown it away."224 This a
- )
~!
- 120 -
. . _ - 1_ l
r d a -
],
A was the only wastepaper basket that he searched.225 He did not conduct a "real thorough look," however, because "I
} believed at this time if it was an inadvertent mistake there q would have been a large piece of paper laying near the top 4 d of that trash can."226 (ZZ) saw SAR tape in the trash can
-q he searched, but it was blank.227 He explained that the
~)
',, blank tapa could have gotten into the trash as a result of 4
the machine binding up or in the course of installing a new roll, although he did not know whether either of those
- c i.? $ events had occurred prior to his search.228 r
}]n (ZZ) estimated that about ten minutes elapsed between the time he discovered the missing SAR tape and the time he
!.. finished questioning the other crew members and searching 7 ;, the trash.229 Thus, according to (ZZ)' account, by approximately 3:20 a.m. a'l of the crew except (A) had been made aware that the SAR tape was miss,ing. (VV), according to his testimony, was at this point carrying most of the j ripped tape in his pockets, having thrown a small portion
, into the kitchen wastapaper basket.
1 us . We found (ZZ)' secount of his discovery of the missing [j. I . S SAR tape and the actions he took in response to that
,r; discovery to be credible. Making allowances for understand- ,c t able difficulties in recalling exact times, words used, and
'{ other details, his testimony was, on the whole, internally consistent, supported by the weight of other testi=enial, documentary, and circumstantial evidence, and was inherently
- 121 - ^-
v -- -
plausible. E E The most significant discrepancy with (ZZ)' account was [ l (EH]'s testimony 'that he could not recall 'haing' told by (ZZ) that SAR tape was missing. As discusse/. in more detail in { Volume II, however. (HH]'s testimony rust be evaluated in .
'N the context of his contention that, due to severe 9
. .s psychological stress, he was unable to recall or explain his p e
behavior with respect to this and other events. occurring after the safety limit alarm. Accordingly, we did not find that (HH)'s lack of recollection on this point undermined O the credibility of (ZZ)' testimony. s p, A second discrepancy with (ZZ)' account.was (P)'s { testimony that he remained in (HH)'s office from 3 a.m. to _ 3:27 a.m., and recalled only (HH), (A), and RR being in c the office during that time.230 (Z"), in turn, did,not see 7 p (P) in the office -- he said that only (HH) and (II) were present when he told (HH] about the missing tape.231 However, (P), who testified that he was sitting in a f,' chair against the far wall of the office,232 could not o recall other details of what was occurring in the office . 1
.3 during that period,233 and we concluded that he did not ,.
recall (ZZ)' brief appearance, during which there was no 2 actual conversation between ("Z) and (HH). For purposes of evaluating (vv)'s story, therefore, we accepted as - substantially accurate the foregoing sequence of events ~ described by (ZZ).
- 122 -
q
e
' ^ ? -
t . . We also found to be accurate (ZZ)r testimony that he told GOS (A) about the safety limit violation and the 1 -missing SAR tape, with one minor exception concerning the , _, timing of (A)'s return to the control room. (ZZ) testified a that he approached (A) after noticing that (A) had re- , "s 9* entered the control room for "the first time . . . since he
,, left when the leak started."234 He asked (A) to step outside the control room and there told him that there had been a safety limit violation and that SAR tape relating to the violation was missing.235 (A) confirmed this 3 conversation.236 ai The computerized record of control room entries and i
I exits shows that both (ZZ) and (A) exited the control room q at 3:28 a.m., the only time after the safety limit alarm that both men left the control room during the same Il.LJ minute,237 and we concluded that this was the time of the (A)-(ZZ) conversation. (A) had returned to the control room 7 j at 3:03 a.m., after a lengthy absence attending to the 43 spill, twenty-five minutes before his conversation with bd - That was approximately when (ZZ) began his 3 a.m. (ZZ).238
]. surveillance, leading to the discovery of the missing tape, ~
and it is likely that he was behind the control panels and
. unable to see (A) come in. (A) exited again six minutes later, at 3:09 a.m., to obtain infor7ation about the
'El J chemicals that had splashed on the maintenance worker, a remaining out until 3:15 a.m.239 We concluded that (ZZ)' ! notification to (HH] and (II) that SAR tape was missing a - 123 - m
,. - - . _ _ , , _ _ _ , _ . . _ , , _ . , ,--n. . . . . , . - -,_.n _ _ . , , _ , _ . . _ , , . - . _ , _ . _ _ _ . . ~ , . . . . _ .- . . _
. .c .. .._, .
i
,. i$
n occurred shortly after (A)'s 3:09 a.m. exit, and that when {
+
(A) re-entered at 3:15 a.m., (ZZ) assumed this was the first _ , E-3 time he had been back since the spill. h G Thus, by the time (VV) exited the control room at 3:35 g a.m. to go to the bathroom -- the time during which he testified he flushed down the toilet the tape he was carry-911 ing around in his pockets -- every member of the crew knew if about both the safety limit violation and the missinc SAR tape. By approximately the time (VV) returned to the I,:: B control room at 3:44 a.m., the safety limit violation Y (although not the missing tape) had been reported to higher [ management, thereby eliminating any possibility that (VV) , ej
~
could have concealed the violation by disposing of SAR tape. *~ r The testimony and circumstances outlined above, while d not directly corroborating (VV)'s account of how he tore and n Ci disposed of the tape, are consistent with it. There are,
- however, inconsistencies between some of the details of .
(VV)'s account and other evidence. O N one discrepancy involves (VV)'s testimony that he - l wadded up a piece of SAR tape he had torn from the machine [El 3 and threw it into the wastapaper basket in the control roon - kitchen. (HH), (A), [I), and (ZZ) all testified that they i , searched trash in the control room looking for the missing , 1 SAR tape, but did not find any of it.240 Yet, pieces of " i tape were later found in trash collected from the control room during the search ordered by management, and these l
]"
- 124 -
l
uu i 7 included the section evidencing the safety limit violation.241 on first impression, the failure of the crew !S to find any SAR tape is troublesome because it suggests ~ either that (VV) did not throw it in the trash when and k whera he said he did, or that he or someone else removed the
~
tape from the trash and later replaced it in time for the a management searchers to find it later in the morning. Md However, of the four crew members who testified that they searched the trash, only two, (EH) and (A), testified that their search included the kitchen vastapaper basket. j1 ].j (A) described his search of that receptacle as superficial,
, recalling that there was "a dump of coffee grounds on top J and a little box of a T.V. dinner or something,"
l ' discouraging him from conducting a thorough search.242 only .
- t (HH] was firm in his testimony that he searched every scrap I of paper in the control room wastepaper baskets and found no missing SAR tape.243 However, (HH]'s recollection of
'1 a
gj events, as well as his ability to find small scraps o* paper I, others missed, must be regarded as suspect given his self- , described memory lapses and other stress-related symptoms on !I3 , September 11.244 We concluded that the crew could easily
- b
- have missed small, wadded up scraps of tape, especially if in ,
lg they were buried under coffee grounds or other moist 4 garbage, as the recovered pieces apparently had been.245 [ P l!d l There is also an inconsistency arising from the number 11 + 'L of SAR tape fragments recovered. Although (VV) was adamant h- l l id - 125 - !
- 4. - - . )
ee 6 . _ s . -. ( that he ripped gna piece of tape from the machine, wadded it
'[
up, and threw it in the trash without making additional _ tears,246 the SAR tape ultimately recovered from the control room trash was in thIan pieces. (vy) suggested a possible explanation for this; i.e., that stains from coffee grounds ' or other substancas in the trash might have caused the (L ! vadded-up tape to tear when unfolded.247 That explanation ,, l C is plausible for two of the three recovered SAR fragments, [ which pertain to the period surrounding the safety limit n, violation. These two pieces fit togetheri combined, they b5 l covered the period from 2:17:45 -- a few seconds after the ' y' 1:
^
time of the safety limit alarm -- to 2:24:35, which was well after the clearing of the alarm.248 Additionally, as noted above, they did give evidence of having been stained by coffee grounds or other moist substances.249 ; 3 The third piece, however, could not have been part of :;j
}
the SAR tape (VV) ripped from the machine on his second trip , W to the SAR, when he went back to get coffee. It contained C alarms that occurred on September 10, hours before the [ safety limit alarm. Together with a short piece of blank ' tape (wadded up but not stained) which was also recovered ?4
.h from the control room trash, it matched the end of the section of September 10 tape recovered from the machine.250 If, as he testified, (VV) tore the SAR tape and let it drop to the floor on his first trip to the SAR, these -
September 10 fragments must have been among the tape lying C u on the floor when (VV) made his second trip. (VV) did not
}
n
- 126 -
i
-- ~~'
r ~' P
,t,i . -
testify to having picked up any of the tape on the floor and throwing it in the trash -- the only tape he recalled throw-
$ - ing in the trash was the tape he saw hanging out of the
, machine on his second trip.251 The presence of these two d pieces in the trash that were recovered from the control room, therefore, is unaccounted for by (VV)'s version of
._a
, , events.
7 k'- We found, nevertheless, that these unexplained pieces R of SAR tape did not seriously undermine (VV)'s testimony U with respect to whether he acted alone or whether his t]' actions were motivated by an intent to conceal or destroy evidence. The SAR tape fragment itself, which records b alarms that occurred on September 10 during the previous er shift, is irrelevant to the safety limit event and its i separation from the rest of the tape is generally consistent a with the tearing and ripping (VV) described when he gathered up the tape and put it in his pockets. Although D Lj (VV) could not explain how the September 10 pieces got into the trash, he had no apparent motive for treating them any differently than the other irrelevant portions of SAR R tape.252 C '- p We also found it troublesome on first impression that t:
~~
of only three pieces of missing tape recovered which
]-
contained printed elarms, two pertained to the safety limit violation and its immediate aftermath. The tape removed i'
; from the machine covered a period of just over seven hours, s
- 127 -
4
y
- N c
forty-four minutes; i.e., between 6:48 p.m. on September 10 p a and 2:32 a.m. on September 11. The three recovered E fragments with printed alarms spanned an aggregate period of e just over one hour, six minutes, nearly an hour of which was g on the September 10 fragment, leaving a period of just under six hours, thirty-eight minutes unaccounted for. Because 'r5 k there was a long period on September 10 with no alarms, the , s 15 actual gap comprised by the tape that was removed and never s 3 recovered was just under five hours, thirty-nine g minutes.253 Both of the two September 11 fragments that I were recovered pertain to the period surrounding the safety y limit violation. Indeed, one of the fragments brackets the violation almost perfectly, from the actuation of the less- , than-two-loops alarm to the clearing of that alar =.254 This y seemed to be a remarkable coincidence in light of (W]'s a testimony that he acted randomly when he tore and disposed e i of the tape, without regard to the relevance of the tape to , the safety limit violation.255 g U One can extract from (W)'s testimony an explanation of 7 E how such an apparent coincidence could have occurred. He ' stated that his first trip to the SAR was for the specific purpose of confirming that the safety limit violation had been recorded.P.56 Thus, he focused on that portion of the tape, which he recalled being near the top of the machine.257 After seeing the alarm, he tore the tape in anger, not recalling where the tear occurred. Only if the tear occurred just below the point where the actuation of 1 J
- 128 -
a
PL
- E] .
5 the safety limit alarm was recorded, however, could the rest U of (W)'s account be accurate. Otherwise, the part hanging [ out of the machine during (W)'s second trip to the SAR -- r the part he said he wadded up and threw in the trash and, 1 therefore, the part that was later recovered -- would not [
.)
have contained the safety limit alarm actuation and clearing
,, messages.
- p
'C The evidence is not inconsistent with an inference that (W) did tear the tape below the part evidencing the safety limit event. As can be seen from the fraguent with the j time /date stamp "02:24:35 09/11/87," there is a blank space of approximately two inches after that point and before the next alarm at 02:32:54.258 This is consistent with (W)'s
] .having grasped the tape just below the safety limit alarm
'3 message and yanked on it at some point between those times.259 The "give" of the tape at the point it exits the
- ['.)
c. m machine could then have prevented it from tearing there, j resulting in a tear where (W) was holding the tape -- r,) which, given his purpose in going to the SAR, could logi-2- cally have been near the point where the safety limit alarm Tp actuation message was printed. We found this explanation
. b ,.
sufficiently plausible to conclude that (W)'s testimony
] that he "randomly" disposed of the SAR tape without regard to what was on it was neither inherently improbable nor
- lj contradicted by the physical and circumstantial evidence.
'j In summary, the weight of the evidence does not i; ,
- 129 -
fl
7 _ E contradict (VV)'s contention that his tearing and disposal [1 of the SAR tape was primarily motivated by anger at himself for having caused the safety limit violation, and not by an intention to conceal that violation. ((VV)'s motivations a 4 are further discussed in the individual section pertaining to him in Volume II of this report.) '),& The evidence also supported (VV)'s testimony on the 4 closely related issue of whether he acted alone in tearing and disposing of the tape. To the extent that (VV)'s 3 actions were an anotional reaction to his earlier mistake, p the others had little reason to encourage or assist him. As y discussed in Section VI(B) of this report, they had no , plausible motiva powerful enough to entice them into a e conspiracy to conceal the safety limit violation itself. [
~
Absent such a conspiracy, it would have made even less sense for any of the others to join (VV) in tearing or disposing .9
, u of SAR tape. Thus, regardless of what (VV)'s personal h
=otivations were, the evidence did not indicate they were S shared by the other crew members, m 9
Whatever his motives, (VV)'s tearing and disposal of D' the SAR tape, coupled with his failure to report thesa -L actions, caused substantial time and energy to be expended on reconstructing the sequence of events during and after l the safety limit violation and attempting to account for the 9 J l l missing evidence. More inportant, the missing tape and the l l I absence of a timely explanation for it caused management LJ l ' i
- 130 -
m
~. - T . 5 suspicion to extend to the entire crew and magnified the L ' apparent significance of other errors and omissions, such as 3 (II)'s inaccurate log entries and (HH)'s delay in reporting _ the violation.
- J
- 4. cenelusions P
[3 Ths evidence supported the following conclusions: m si
# a. After the safety limit violation, (VV) tore a quantity of SAR tape from the machine. He later threw some in the wastapaper basket located in the control room kitchen and put most of the torn tape in his pockets. These actions were probably completed prior to 2:32 a.m. and certainly j completed prior to a few minutes past 3:00 a.m., when (22)
- 1 discovered that SAR tape was missing. '
li u
. b. (VV) carried SAR tape in his pockets until
,d - LJ shortly before 3:45 a.m., when he flushed it down a toilet p in a bathroom outside the control room, d
- c. The tape (VV) flushed down the toilet did not
- ]
J2 pertain to the safety limit violation, with the possible D exception of a fragment of tape that recorded the time of ld '. occurrence of the alarm. O U d. A portion of the tape thrown in the kitchen (] wastapaper basket and later recovered recorded the entire u safety limit event, from the alarm to the clearing of the 1
. alars less than two minutes later, except for the printed
- 131 -
': l E
- C time of the alarm actuation itself, which we were able to [
t 1 establish from other data. 5 c--
- e. (W) acted alone in tearing and disposing of the SAR tape. hw
- f. No one other than (W) knew what had happened 8 E
to the tape (W) took from the machine until (W) partially ,, admitted what he had done shortly before the end of the shift. En
;4 w
- g. (W) tore and disposed of the tape out of C.7 anger and frustration and not because he intended to conceal
- 3 evidence of the safety limit violation. ,
t
'a m
9-i em
)
ena d 7 g-
.=4
.y 5 -
C< t~ se d ej a
.1' 132 - J
..g
- - , - . - - , , , - -.,.n..-.,-,--.-- - . - - . - . - . . _ . .
r' E. Raeortina of Missine SAR Tane Within GPUN Chain of { Command [3 , tw As discussed above, (VV) did not reveal to anyone what he had done with the SAR tape until approximately 7:30 a.m., P 12 when he approached (A) and told him that he had torn the
- g. tape and let it drop on the floor. (VV) did not reveal that 42 he had also disposed of the tape until late in the afternoon
] of September 11, when he returned to the plant and spoke to .I (R) and (SS).
I' }} Prior to (VV)'s admissions, the other members of the Il crew and management learned utout the missing tape in U various ways and at different tides, This section will [) focus on their responses to the information they received I,J about the SAR tape, particularly the extent to which accur-W ate and timely information about the missing tape was passed
- j up the chain of command.
Ww
- 1. Standards of eenduct There are no specific irritten standards governing the j, internal reporting of missing SAR tape comparable to the
.) requirements for reporting safety limit violations and other ,
U" categories of reportable events. As discussed in the jl previous section of this repert, the standards applicable to L the destruction, concealment, or disposal of SAR tape I; depends upon the context in which it occurred, particularly
., whether such actions were intended to conceal a reportable event. Likewise, the standards applicable to recortina
_ - 133 -
. G
_ O' e missing SAR tape depend to a great extent on how the tape @ came to be missing and its relation to a reportable event. 7 D The SAR tape that was torn and disposed of on September 11, 1987, was related to the safety limit violation on that date in two important ways. First, some of the tape .2, h contained information directly relevant to the violation 5 itself (including the exact time), to the scquence of 'h 4 events, and to the question of how many recirculation loops were closed during the event. Some of this information was S unavailable from other sources. Thus, the SAR was necessary . p to improve the accuracy of internal and external reports [' concerning the safety limit violati.on. ,, ti G-Second, as' set forth in Section VI(B) of this report, Station Procedure 126 requires that GPUN management personnel be advised promptly of certain categoridk of g events. Most of these categories correspond to NRC d reportable event categories contained in the appropriate .@ Ci federal regulations. Category VI, however, makes reportable
- a broader group of events having "potential government or public interest," including events having "only very mino*
;a l
actual significanca."260 If not reported by the company, 's "very miner events may be reported by the news media in a ;},
;J manner entirely out of proportion to the significance of the n
events," resulting in "suspicions on the part of government officials and/or the media that the licensee is not I forthright."261 ; l 'I i 134 -
- _ . - - - - - , - - , - _, - . - , , - -c.- , . - _ _ ,,m. -e,__.m,, ,__._,_m .,,,,-__,,,_m., _, _,_- _- ,,
f That rationale is especially pertinent to the internal C . reporting of the missing SAR tape. Particularly in the context of an event as serious as a safety limit violation,
,q the apparent destruction or concealment of relevant u documents was certainly an event "of potential public nb interest"262 within the spirit, if not the letter, of U
,, Procedure 126, Category VI. Events covered by that
] procedure were to be reported "promptly" to various GPUN management personnel so that they could decide what further
,a reports, if any, were required.263 i'; 2. Crew knowledce of missine taee
{ {[} With one ,significant exception, the testimony of the L crew members was in agreement about when and how they became 1, ij, aware that SAR data were missing. As set forth in detail in Section VI(D), (ZZ) was the first crew member other than
.i
.U (W) to notice that SAR data for the period of the safety
', ll=it event was missing. This occurred between 3:00 a.m.
and 3:10 a.m., approximately forty to fifty minut.es after the alarm. Within the next five to ten minutes, (ZZ) notified (HM), (II), and (I) of his discovery and asked each
.]
d' , of them if he had taken the missing tapo. (II) and (I) said they had not. (HH] made no reply, but had a "dumbfounded"
~
expression on his face which (ZZ) took to mean that he was
- ]
_a surprised to hear that the tape was missing. (ZZ) also asked (W) if he had taken the tape. (W) , according to his
!t own testimony, was carrying some of it in his pockets at the
- 135 -
N.
M time. Nevertheless, he also denied having taken the tape. All the crew members except (HH) corroborated (ZZ)' c testimony about this sequence of events.264 { (HH] gave a much different account of how he became k, ta aware of the missing SAR tape. He testified that after he ., . , completed his written and telephone notifications to the NRC 1 and the GPUN Public Affairs Office, he went back to the SAR to collect data about the event and noticed, for the first time, that tape was missing.265 (HH) said this occurred v s just after he spoke to the Public Affairs representative and a just before (MM) arrived in the control room 266 -- a period $ the documentary evidence indicates was between 4:36 a.m. and 4:49 a.m.267 d, if (HH) did not recall being told that the tape was _
- missing shortly after 3 a.m., as described by (ZZ). He did ,
recall that while he was sitting at his desk looking at the E "red chemical book" -- which he had obtained during his .y M , brief exit from the control room between 3:04 and 3:06 a.m.
-- he looked up and saw someone standing by the door, after which he looked at the book again.268 He estimated that ,
i this occurred "around three o' clock."269 ,, .
':1 Although (HH) testified that he could not recall (ZZ) .j; telling him about the missing tape, he did not dispute (ZZ)' ,
! y l testimony on this point. Indeed, (HH) partially - correborated (ZZ)' account by testifying that he saw someone j . (he could not recall who) standing near the door to his l *)
~
- 136 -
- E .
d . f office around 3 a.m., while (HH) was looking at the red J, chemical book. Computerized records showed that (HH) was d out.of the control room between 3:04 and 3:06 a.m.,270 and q that is when (MH) said he obtained the chemical book from a
,i nearby office.271 For reasons set forth above,272 y, s
(7' concluded that (ZZ)' notification to (HH) and (II) that SAR
' t.)
- e. tape was missing occurred between 3:09 and 3:15 a.m. Thus, to the extent that (MH) recalled seeing someone standing in the door "around 3 a.m.," and after he had obtained the l
l'i 1 t chemical book, his testimony is consistent with (ZZ)' and g with the other testimonial and documentary evidence. 'UJ !,y With respect to his inability to recall (ZZ) (or anyone else) saying anything to him about the SAR tape during this q1 period, (HH] raised the possibility that a psychological reaction to stress resulted in memory lapses and other symptoms. This psychological explanation is discussed in b] ! detail elsewhere in the report.273 For the purpose of this 'l Id section it is sufficient to state that in resolving the apparent conflict between (HH)'s testimony and (ZZ)', (MH)'s f* self-described psychological state weighed heavily in favor of crediting.(ZZ)' version of events. Thus, we concluded y ! that (HH] was told about the missing SAR tape shortly after 3 a.m., the most likely time being between 3:09 and 3:15. L 't.i This was approximately 15-20 minutes before the first of t- (HH)'s three telephone conversation's with (R). lpL The final member of the crew to learn about the missing ,~ - 137 - l .'i
. ~
. r7
. b tape was GOS (A). He and (ZZ) agreed in their testimony that (A) learned about the missing tape at the same time he
]
c learned about the safrty limit violations i.e., during the E (A]-(ZZ) conversation that took place outside the control q roca between 3:28 and 3:30 a.m.274 There was some variance N in their recollections of when (A) actually saw the SAR fh after being told the tape was missino. (ZZ) testified that ,$ when he returned to the control roc, 3tcar spesking to (A) he took him back to the SAR and she. ' him its 3 condition.275 (A) recalled looking at the SAR, but couldn't li recall when. He did not think that he had seen it prior to y his 4 a.m. telephone conversation with (R),276 and did r m ' recall anyone being with him when he saw the SAR.277 [gg), p C-testimony on this point was not inconsistent with (A)'s but was more specific, and we cbncluded from it that (A) .] l probably viewed the SAR between approximately 3:36 a.m., ., when (ZZ) returned to the control room, and 3:45 a.m., the approximate time of (A]'s conversation with (HH) regarding "$ U whether he had reported the safety limit violation to (R).
. D l-Thus, by 3:30 a.m. the entire crew had been told about the missing SAR tape, although only (W) knew exactly what *>
had happened to it. Moreover, at least one member of the crew, (ZZ), suspected by then that (W) had taken the , tape:278 j (W) made the mistake that violated the - ! safety limit. He has a reputation of being ] very good and not making any mistakes, and I j thought that if anybody was going to do a] something like that, it was going to be him, i l ]'
- 138 -
l __ _ _ . _ _ _ _ _ . _ - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ . , _ _ _ . _ _ _ _ _ _ . _,. ._ _ _ _ _ . ~ _ _ _ __
1 l m 1 n 1 [? because nobody else would have had a reason u to try and cover things up. . 7 (A), in contrast, testified that he believed that there d" was an innocent explanation for the missing tape:279 Of . . . I asst N3 the SAR paper was missing, it It was lost scan hers and it was completely innocent. I hought that somebody just qh haphazardly threw it away or somehow some-j thing happened to it that was totally
,' innocent, and I really didn't believe that somebody did something wrong.
R one possibla "innocent" explanation--that the SAR i] machine simply ran out of tape and for that reason did not b record the safety limit violation--did not occur to the crew members as plausible, given the condition of the tape when it was found.280 As discussed below, ma:ngement personnel h] above the crew level formed the impression that there was r-such an innocent explanation for the missing data after telephone conversations with (HH] and (A). Both (HH) and 2 U (A) testified that they did not advance this "ran-out-of-tape" possibility as a hypothesis to explain the missing SAR r-
,! data.281
]a- 3. Crew recortine of missine tane to hieher manacement 'U. ij. The testimony was in general agreement about F.hAD y) management above the crew level became aware that SAR data t. J were missing. There were significant differences, however,
?; concerning y. hat the crew told management about this subject.
g
, As discussed above in connection with the reporting of ~
the safety limit violation, between approximately 3:25 a.m.
- 139 -
m
-. . - - . . . , , - - --n_. - - s -
. . . -- - . . -. _- , , , , _ ~ - -- -
_ f_ and 4:05 a.m., there were three telephone conversations between the crew and Plant Operations Manager (R), the GPUN manager immediately'above the crew level in the chain of k. command. The first of these calls occurred between 3:25 g td a.m. and 3:30 a.m., when GSS (HH) called (R) at home to tell J:1 him about the leak in the RBCCW system and the worker p u , splashed with chamicals. Both (R) and (HH] testified that , 2 there was no mention of either the safety lioit violation or .y L the missing SAR tape during this conversation.282 The next conversation took place at approximately 3:45
.W a.m. When (R), having spoken to Plant Operations Director [
~
(N) after his first conversation with (HH), called back to 3
- c obtain more information about the injured worker and to convey to the crew (N)'s admonition to keep two f a
recirculation loops open when putting the pumps back in service. It was during this conversation that (R) first learned about the safety limit violation. [R) allowed for ,, w the possibility that (HH) mentioned something about the SAR C tape during this conversation,283 but : aid it was more p E likely that there was no mention of the SAR until the third
- conversation.284 (HH),,who testified that he did not even [
become aware of the missing SAR tape until after 4:30 a.m., was for that reason certain he did not mention it to (R) w during the second conversation.285 Most of the other evidence supports the view of (R) and (HH) that there was no " mention of the SAR during the second conversation. (A), for I example, acknowledged responding to (R)'s question about the 0
.J
- 140 -
1
f7 b - time of the safety limit event during the third F{ conversation.286 This was the question (R) said elicited j the information that SAR data were missing.287 l U The only evidence suggesting that there was mention of I
.C \
the SAR or missing tape during (R]'s 3:45 a.m. conversation
.y.
j with (HH) was (N]'s recollection that he learned about the
/* missing SAR data during his second conversation with (R),
which occurred right after (R]'s second conversation with (HH).288 (N) recalled having only two telephone conversations with (R) prior to arriving at th9 plant.289 If (R) did tell (N) about.the missing SAR during the second h,J conversation, he could only have learned about it from (HH) kj during the 3:45 a.m. call he made to the control room. q j We concluded, however, that (N) was mistaken in his recollection that he had only two telephone calls from (R). [N) was not completely sure when he received the
] information about the missing tape,290 an uncertainty that was understandable under the circumstances -- he had been
,@ awakened at 3:30 a.m. and during the next hour had telephone a, conversations with (SS), Bateman, and (NN], in addition to ' @b ', his calls from (R). In contrast, (R) specifically recalled q telephoning (N) a third time to convey the results of his 4 j 'f
'd a.m. call to the control room.291 That call had been l [.7 prompted by (N)'s question to (R) about the time of the t1 e v e n t ,2 '. making it likely that (R) would call back after
!n
-., obtaining the information (N) had requested. Thus, the lU - 141 -
F' W-evidence strongly indicated that the first time the SAR was [1 mentioned to management above the crew level was during ' (R]'s third telephone conversation with the control room, which took place between approximately 4 a.m. and 4:05 e a.m.293 k
+
(R]'s recollection of that conversation was that he $
.t spoke to (A), who told him that (HH] was on the red 3 il" emergency notification telephone reporting the safety limit violation to the NRC.294 He asked (A) about the time of the safety limit alarm, and (A)'s reply made it clear to (R) for A
the first time that the alarm had occurred "a long time ago " when they were taking the pumps out of service."295 [R) also testified that there was "some information transferred to me that the SAR. paper was not available for this ;p event."296 (R) u s certain that neither (HH) nor (A) told
~
.him that the reason for the unavailability of SAR data was [
u that the tape was missing, apparently because it had been P removed from the machine.297 He was also sure that, after I,h his third telephone conversation with the control room, he r
- y. '
was left with the impression that the reason for the ' unavailability of SAR data was that the machine had run out , of tape.298 (R] was less certain, however, exactly what (A) or (HH] said to him that created that impression:299 I don't recall what words were used. The .. information as I understood it was yes, that the tape had (run) out of paper, and was from --
.]
direct discussion with, I think, (A), and it possibly could have been (HH), that the SAR was out of paper.
']Tj
. i
- 142 -
l
- . _ . _ __ _ _ ._._m_.-_____ ___ - . _ - _ _ _ _ . . . _ - - _ _ - - - - _ _
2 1 - (R) was "maybe 90 p,ercent certain" that there had been some specific mention by (HH] or [A] that the SAR had run out of d paper.300 - Both (HH] and (A), however, denied telling (R) or i
- s. anyone else that the SAR had run out of paper.301 (HE], as D
d,, noted above, maintained that he did not even become aware of i 7 the missing tape until Icng after his telephone conversation with (R).302 [HH] recalled (R) telling him, during the Q EJ-
' third conversation, to make a one-hour notification to the NRC, after which (HH] handed the telephone to (A), telling q
g him to complete the conversation with (R) while (HH] set
,_. about making his notifications.303 m
Il (A) confirmed that (HH] handed him the phone and told him to speak to (R).304 He testified that he had a brief q conversation with (R) in which (R] wanted to know what time l]' the safety limit event occurred. [A] recalled saying that,
] from the computer, it looked like 2:24 a.m.305 (R) also J
wanted to know why (HH] had taken so long to call (R), to 19
$, which (A) replied that (HH] was about to call (R] when (R) called him instead.306 According to (A), (R) did not ask d* anything specifically about the SAR tape and (A), in turn r did not volunteer anything on the subject.307 [A] explained as follows why he did not mention the missing tape to Od
[R]:308
. . . [T]he general method of determining when something like that (i.e., the safety
_ limit violation] happened would be to look on l the SAR. So, when he asked me that,
- 143 -
t..
. . . . . .. .........a . .. . . . . . . . --
w N
. a immediately I thought of the SAR. I thought, hh well, we have a missing document. I didn't .
want to . . . all of a sudden tell him look, I can't find the SAR paper, I can't figure @ out where it went, because it might raise t-concerns unnecessarily and it might get' people very excited, wher I didn't think at g that time there was any reason to be excited. g Thus, while (HH]'s and (A]'s testimony conflicted with (R)'s on whether either man told (R) that the SAR had run & out of tape, they confirmed that (R) was not informed about 'h 22 . the actual condition of the SAR tape at that time -- i.e., that it was missing under circumstances suggesting that it ;2 k had been deliberately removed. Moreover, (A) acknowledged A that this omission was intentional, because disclosing the $d condition of the tape "might raise concerns unnecessarily y;;
"309 "j
b and it might get people very excited . . . . (A]'s testimony that he intentionally did not mention 1 l l the missing SAR to (R) to avoid raising unnecessary concerns e I suggests the possibility that he went a step further and, in order to offer an innocent explanation for the missing data, [j
~
told (R] the SAR had run out of paper. We found, however, l that although the evidence supported (R]'s testimony that he p]j rocaived the impression that the SAR had run out of paper, t-it is inconclusive on whether (A) specifically told him that. (R) was less than completely certain that (A) had l used those words, and could not even be entirely sure a i whether it was (A) or (HH) who had mentioned the SAR running ] l out of paper, or whether it occurred during the second or ,. I third telephone conversation. Moreover, some of (R)'s other ~ a
]
- 144 -
7
'^
- ~
.C recollections of what was told to whom during this sequence D . of conversations were in conflict with other evidence. For
, example, (R) believed that he told his assistant, (MM],
g about a problem with the SAR when he called (MM] at about 3:50 a.m.310 ((MM] estimated this call to have occurred at 3:45 a.m.)311 (MM] did not recall being told about the SAR b
,. during this conversation,312 and the probable sequence of w
px the (R]-(MM) conversation -- i.e., erior to [R]'s conversation with (A) -- conflicts with when (R) believes he I] first learned about a problem with SAR data. m [ ] These difficulties in recalling precise details were to be expected given the context of (R]'s conversations with i.1 (HH] and (A). Like the other managers above the crew level, 3 (R] had been awakened in the middle of the night and was d given a partial account of a complex series of events [a[ transpiring at the plant. The conversation with (A) occurred in the midst of a lengthy sequence of telephone (1 Lj calls back and forth among (R), (HH], (N), and (MM). The
,r.) primary focus of attention during these calls was the safety i? ") - limit event, not the SAR.
l. J- Because there was doubt concerning the exact statements m made to (R) by (A) or (HH), we did not find that either man N" affirmatively misled (R) by telling him that the SAR had run out of tape. There was at least a substantial possibility that (R) formed this impression based more on what was not
, said under the circumstances rather than what was, 4
- 145 -
l
~. .
especially because (R) was aware of a previous transient n$
.w during which, he recalled, the SAR had apparently run out of E
paper and failed to record data.313 $ , e Moreover, other witnesses recalled later discussions )g about the pos'sibility that the SAR ran out of tape that were 4 h M not prompted by (A) or (HH]. During the meeting (R) attended in (N]'s office after the 6 a.m. briefing, (NN) did 7 not remember (HH] (who was present at the meeting) making i any suggestion that the SAR machine had run out of tape. y J Indeed (NN], in response to the accusatory tone of the W investigation (R) was helping to conduct, urged using more $ caution. [NN) suggested that it was possible that there was
~
C7l l an innocent explanation such as the machine running out of tape.314 (NN]'s recollection was supported by (O), the f.' l i plant engineering director, who also attended the meeting. I ; P l At one point, (O) recalled there was a discussion about the g possibility that someone had been changing the tape because c it had run out of paper, and that this was the explanation b for the missing tape. (O] said this suggestion (which fits p E: the description of the suggestion (NN) said he made) was thrown out for discussion as a hypothesis.315 y It was clear from the evidence, however, that the ,7 i.; failure of (HH] and (A] to give (R] a complete and accurate account of the condition of the SAR tape helped generate a spurious "ran cut of tape" theory as the explanation for the ., missing SAR data. s
)
d l - 146 - l 1
v 5 O - It was also clear that CRO (ZZ) promptly and accurately
]
reported the condition of the SAR tape to his supervisors, - m (HH] and (A). (ZZ) also shared this information with the other members of the crew, and we found no substantial G I;) evidence of a generalized conspiracy to conceal, rt misrepresent, or fail to report the condition of the SAR U tape. o. 3 3 The behavior of the two supervisors in response to y information about the missing tape was more problematical. By 3:30 a.m., both (HH] and (A] had received information
' '? from which they knew, or should have known, that substantial b
portions o* the SAR tape were missing, including the parts p relevant to the safety limit violation. The only information
'd indicating the absence of an SAR record of the event was conveyed to R, after he called the control room twice E with specific questions, and even then the suspicious il condition of the tape was not revealed to him.
, As a result, (R) was allowed to believe in an innocent explanation for the missing tepe -- that it had run out of lS paper -- that no one on the crew who had seen the tape d, believed. This pattern of behavior persisted when [MM] , (R), and
- fl lU [SS) entered the control room later in the morning. Neither g (HH] nor (A) showed them the SAR or otherwise called their i,
U attention to the circumstances indicating that tape had been f-l removed. As a result, the erroneous impression created 1.- I earlier -- i.e., the spurious "ran out of tape" explanation ln l< - 147 - lu u
E _ E
-- was allowed to continue. When (MM] saw the SAR and g
W" immediately noticed the suspicious gap, the crew's prior - silence on the subject was bound to fuel management [e suspicions of a coverup. Thus, while the evidence weighed against a conclusion tht either (HH] or (A] affirmatively misled (R) by specifically advancing the "ran out of tape" explanation, .4 y they were content to leave him with incomplete information d cencerning the condition of the tape which allowed him to y X believe in tiat theory until the management investigation C disproved i'.. (HH], as GSS, was primarily responsible for S o A reportin; the condition of the tape to higher management. Indeed, had (HH] reported both the safety limit violation and the missing tape in a timely manner, it would not have been. _d .. necessary for (A] to be involved in this reporting. .3 As discussed more fully in the individual sections on (HH] and (A), we did not conclude that either man intended h, to conceal, much less destroy, the SAR tape. On the W contrary, the evidence supported their testimony that they g did not know where the tape was and sincerely hoped that 5, they would be able to find it. In essence, each of them '1 held back from fully disclosing the condition of the SAR m tape in order to buy time, hoping that it would turn up d before its absence became a major issue.316 By so delaying, r
.I however, they created the very impression they sought to d avoid and thereby contributed to the management suspicion of the entire crew.
- 148 - )
i
O , .
],;, 4. Reporting of missing tape within higher 1 management q The "ran out of tape" theory was passed along by [R] to
~
[N], [R] 's immediate superior in the GPUN chain of Si command.317 [N], in turn, notified Deputy Director [SS] al that SAR data were missing, although it is not entirely m-g clear when this occurred. [N] thought he mentioned this to [SS) when he called at around 4 a.m. to tell (SS) about the U CJ safety limit violation, although he was not certain of p this.318 [SS) said he did not learn about the missing data LI at that time.319 The first time [SS) recalled hearing about missing data was after the 6 a.m. meeting, possibly between 7 and 8 a.m., when [SS] thought that [N] called and told him about missing SAR tape. [SS] then went to [N]'s office,
,., where the details were explained to him.321 At some point
[SS] also heard the "ran out of tape" explanation for the l'; missing data, but he could not recall when or from whom he b ~ heard this,322 f' Both [R] and [N] testified that until they arrived at p the plant, and for some time thereafter, they did not have
- L2 the impression that anything suspicious had happened in
-r l]q j connection with the SAR tape, although both were annoyed 3 that the machine had been allowed to run out of paper. Discussion among the managers centered around other topics l[3 p during this period, such as gathering information about the rr, i" safety limit violation, making notifications, and preparing for a meeting that had been scheduled for 6 a.m.324 [N] did not enter the control room during the period prior to the 6 L - 149 - I 3-,
5
. (O a.m. meeting.325 (SS) and (R) did enter the control room, f..l at 4:43 and 4:58 a.m., respectively.326 They spoke to (HH]
and (VV) about the safety limit violation and (R] asked (HH] k why he had not reported it earlier. According to [R), (HH] . replied that he had been caught up with the spill.327 No one volunteered any additional information about missing SAR y data.328 , , (7'
!"7(
The next information the managers received about missing data came from (MM]. He had entered.the control [ ca room at 4:49 a.m. and had first spoken to GSS (HH], who did not tell him anything about missing SAR tape.329 [MM] also , spoke to GOS [A), who asked him whether the safety limit y g alarm was recorded on the plant's computer.330 In the 1 course of this conversation, (A) said something that left ] (MM] with the impression that the SAR had failed to record the event because it had run out of tape.331 However, neither (A) nor (HH] actually used those words:332 , They didn't say to ne that somebody took the L tape anc threw it out or ripped it or any thing. But they didn't say it was out of r paper, either. { (MM] exited the control room at 5:24 a.m. without O having seen the SAR.333 He returned at 5:39 a.m., having I3 been instructed by (R] and (N] to get a statement from the .f , crew regarding the safety limit event. During this visit, (MM] went back to see the SAR for the first time.334 He I noticed that the tape coming out of the machine was , separated from the tape on the takeup reel, and that there T4 t "
- 150 -
~7 L !
.e. . . .
I I e . was a gap of some seven hours in the recorded alarms.335 ~ I k@i This caused (MM] to feel that "something looked totally fishy."336 He left the control room at 5:52 a.m. and q reported what he had seen to (R).337 b r" g When (R) and (N) heard (MM]'s observation of the condition of the SAR tape they began to doubt the "ran out of paper" theory they had until then assumed.was the explan-I. O ation for the missing data.338 Because (MM)'s news arrived () just before the 6 a.m. meeting, however, no action was taken until after that meeting, when (N) told (R) and others to meet in his office to discuss the SAR tape.339 During the ensuing discussions among (N), [R), (SS), (MM), and others who were in the process of gathering and n y analyzing information concerning the safety limit event,
,. suspicion grew that the crew had been engaging in a b coverup. (HH] was unable to give satisfactory explanations
,n for either his delay in reporting the safety limit violation i?i or the whereabouts of the SAR tape, and the "ran out of l L, paper" theory was beginning to look dubious, suggesting that it had been contrived to assist in a coverup.340
- cy $
l[4 To test whether the missing data could have been caused R by the machine having run out of paper, (MM) was sent back G to the control room to retrieve the remainder of the roll j then in the machine. When brought to (N]'s office, at approximately 7:10 a.m.,341 this roll was compared to a new rol1 of SAR tape. The experiment showed that a substantial t_. - 151 - I
.1
. .. .<. . . -e- -- -
tt, amount of tape was missing from the roll that had been on the machine, thereby disproving the "ran out of paper" T l explanation.342 gl l m -l Later, other data and circumstances fueled management h suspicion of the crew. The analysis of the technical data g , l seemed to contradict the crew's report that only the "B" 4 discharge valve had been closed, and (II)'s "late" log i p%
^
entry, which itself seemed suspicious, also indicated that two valves had been closed.343 B3 tween approximately 7:00 and 7:20 a.m., (SS) decided Q to suspend the members of "B" crew from licensed duties pending the outcome of the investigation into the safety ! limit event. This decision had been discussed with Edwin Kintner, Executive Vice President of GPUN, and was relayed - through (N) and (R) to (HH), who advised the crew of the p decision when he reentered the control room at 7:21 a.m.344
- a. .'
Shortly afterwards, at 7:35 a.m., [R) entered the ". control room and was advised by (HH] that (W) had something g "w to tell him.345 [W) then revealed to (R) that he had torn ' re r the SAR tape and dropped it on the floor, although he s l & continued to deny that he had done anything further with m it.346 (R) informed '[N) of this development, and conductod E a cursory search of the control room wastepaper - baskets.347 He exited the control room at 7:51 a.m. and shortly afterwards -- estimated by (R) to have been between 8:15 to 8:30 a.m. -- he and (N) decided to organi::e a
- 152 -
y
~
l lV l 1 a l l g collection and search of trash from around the site, E particularly the control room and main office building . b area.348 (SS) was advised of this decision.349 According to (R), it took an hour or so to organize the search.350 fl d They also, at about this time, requested the security office
'j\ to provide data evidencing who had entered and left the
,. control room during the relevant period.351 LN The testimony of the maintenance personnel and Shift (Q Technigal Assistants who organized and conducted the trash p"
search confirmed that they were instructed to conduct a n M comprehensive search that initially included the trash b compactor, where trash frem various points is dumped after ID O collection.352 The search of the compactor, which had g consumed more than an hour, was suspended when (R) learned l"i that no trash had been placed there since the previous 3 evening. The searchers were told at around 11 a.m. to . redirect their efforts toward the control room and its immediate environs.353 ['i Between 11:13 and 11:28 a.m., maintenance worker J, (U) emptied all the trash in the control room into a p
] ~, single bag, labelled it, and brought it to where other
. members of the search team were sifting through the d trash.354 They soon found pieces of SAR tape, one of which p had the notation "less than 2 loops normal" on it.355 This d
tape fragment was balled up, with ragged edges, and had u; coffee stains on it when found.356 Between approximately 4
- 153 -
l
.' 1
. E 11:30 a.m.-and noon, three pieceslof SAR tape with alarms I[k recorded on them were brought to (N]'s office.357 One r
appeared to contain most, if not all, of the alarms -( pertaining to the safety limit event.358 e , b , s The discovery of the tape fragments indicated to (R), . U (N] and the other management personnel investigating the 'd event that someone had deliberately taken the tape.- As (R) Y. W explained:359 L [S]omebody had taken the tape, had torn it up and thrown it in a trash receptacle, and 1 { because there was very little of this tape left in the trash receptacle, apparently u somebody had removed it . . . and put it Y somewhere else. - Within a short time after (R) and (N) became aware of : the recovered SAR fragments, (SS] was notified; he, in turn, notified Kintner and Clark in Parsippany.360 Concurrently, as discussed in the next section of this report, the NRC ,,
.i site representative was advised of this development, and by L 1:20 p.m. an official notification had been made to the NRC
{ in Washington. O Based upon the above-described sequence of events, we b concluded that the managers above the crew level, beginning [b' with (R), acted with reasonable speed and diligence in verifying and reporting possible tampering with the SAR tape. There was a gap of approximately eight hours -- from ..
- (
4 a.m. until noon -- between (R]'s first information that d SAR data were unavailable and notification to the highest levels of GPUN (and to NRC representatives) that there was l - 154 -
id - l [1 evidence of concealment or destruction of SAR tape. How-d ' ever, prior to (MM)'s inspection of the tape just prior to 6 w3 a.m., the management personnel had no reason to suspect any deliberate tampering. The investigation they began after .U the 6 a.m. meeting led to increased suspicion, but the q'- managers did not believe they had a clear indication of p", , intentional destruction or concealment until the tape frag-f[ a ments were foun:1. From the great weight of the evidence it was clear that there was no intention on the part of these p (j managers to conceal or ignore the problem of the missing SAR q tdpe. u)
.s
- 5. Conclusions r.: .
h4 The evidence supports the following conclusions: r ., h* a. CRO (ZZ) was the first person other than
] (VV) to notice, between approximately 3:00 and 3:10 a.m.,
a that SAR data were missing for the period of the safety Yi y limit event,
- b. Between approximately 3:10 and 3:15 a.m., (ZZ) reported to GSS (HH) that SAR data were missing.
m i$.
- c. A short time later, between 3:28 and P
t; 3:30 a.m., [ZZ) reported to GOS (A) that SAR data were LJ missing. b
- d. CRO (ZZ) promptly and accurately 1
reported the condition of the SAR tape to his supervisors,
- 155 -
m the GSS and the GOS. b g 9
- e. By 3:30 a.m., every member of "B" crew I had been told about the missing SAR data.
- f. No member of the crew considered the possibility that the SAR machine had run out of tape to be a j L
plausible explanation for the missing data. ., T
- g. GSS [HH), who had the primary responsi- b bility for reporting to higher management, did not make a 7 u
timely and accurate report concerning the condition of the
?
SAR tape. {*]
- h. The first GPUN manager above the crew [
.:h level to learn about the missing SAR data was Operations Manager (R), who became aware that SAR data were unavailable for the time of the safety limit event during a ..,
telephone conversation with GOS (A) between approximately 4 4:00 and 4:05 a.m. f. 2:
- 1. During his telephone conversation with p (R), (A) omitted relevant details concerning the condition -
of the SAR tape. As a result, (R) received the impression ,
]
that the reason SAR data were unavailable was that the n machine had run out of paper. g
- j. (R) conveyed both the information that SAR data were missing and the "ran out of paperO explanation T'
to his immediate superior in the GPUli chain of command, (N).
- 156 - -
r3
7 k. In later conversations with management d representatives, neither (HH] nor (A) corrected the impression that the data were missing because the machine had run out of tape. As a result, when a management
-b investigation revealed that explanation to be implausible, q\ the entire crew came under suspicion.
Ui
,, 1. The first management representative to
- 1 a see the condition of the SAR tape was [MM), who inspected it g shortly before 6 a.m. and, like (ZZ), noticed a gap in the l.
tape. m 3 m. (R) and (N] did not begin to suspect El that anyone had destroyed or tampered with the SAR tape L' until they received [MM]'s report on the condition of the ,
~
tape just before the 6'a.m. meeting that had been called to discuss the safety limit event. 'll , U
- n. Following the 6 a.m. meeting, between g approximately 6:30 and 7:30 a.m., [R), (N), (MM), and others met in [N]'s office to discuss the missing SAR data; (SS),
U. the highest-ranking GPUN official then on the site, was also c; (. made aware of the circumstances surrounding the missing data during this time. n ei li o. Between approximately 6:30 a.m. and
;[] noon, the managers above the crew level and various 4i technical, maintenance, and staff personnel were actively n
investigating the missing SAR tape as well as other aspects 4
- 157 -
a
.4. w e
5 tg of the safety limit event, an investigation which included { L attempts to reconstruct the event with other data, an experiment to determine whether the machine ran out of - paper, questioning of members of the crew, and a search of the trash. 4
- p. Between approximately 11:30 a.m. and y'j noon, three fragments of the missing SAR tape were found as a result of the trash search, one of which evidenced the hl
( u-safety limit violation. E G
- q. Within a short time after the discovery of the tape fragments, the news was conveyed to the top management levels of GPUN and to the local NRC 9 1
representatives. b
- r. Management personnel above the crew level acted with reasonable speed and diligence in verifying 31 1:]
and reporting possible tampering with the SAR tape. e f-l
~
F. EgJLortinc of Missine SAR Taee to NRC
!)
- 1. Standards of condt.et *d
??
The destruction, concealment, or disposal of SAR tape 2;- does not clearly fall within any of the categories of m l reportable events contained in NRC regulations or in the 1 Oyster Creek Technical Specifications. Its reportability to @ J the NRC depends upon the extent to which it is related to another reportable event -- in this case, the safety limit 1 n
- 158 -
O b - violation that occurred on September 11, 1987. G1 , As discussed in the immediately preceding section of Ul,f this report,361 the SAR tape was necessary for accurate reporting of certain details concerning the safety limit [} L violation, such as exact times, sequences and other infor-4 J
'4 mation not retrievable from other sources. SAR data were not necessary for initial telephone notifications to the NRC that a safety limit violation had occurred. Both NRC n regulations and company procedures, however, contemplate followup reporting, some formal and some informal.362 Although arguably not required to be included in such ]
followup reports, the missing SAR tape was a circumstance h) L. that could explain the absence of data that normally would be included in such reports. Similarly, the later discovery
!.1 of portions of SAR tape that had been thrown in the trash affected tne accuracy of reports to the NRC to the extent ~
that the recovered tape supplied additional data concerning the safety limit violation, or corrected information previously reported.363 l
~
I Apart from formal reporting requirements, in practice GPUN and NRC personnel exchanged information on an informal {. basis.364 This informal sharing of information reflected ' IS U the prudential concerns set forth in Station Procedure 126, rh Category VI, portions of which were quoted and discussed in other sections of this report.365 Thus, an additional l standard was whether the circumstances surrounding the
.a 1
lj - 159 -
~
missing SAR tape warranted disclosure pursuant to the normal p
. h
"~
considerations that induce the company to report informally - to the NRC. _$u The most relevant of these considerations to the events e of September 11 is the above-referenced section from Proced-P ure 126, which expresses a concern for the undermining of sj 2 confidence resulting from the NRC's learning about certain .s kinds of events from sources other than management.366 As discussed in the preceding section of this report, the , apparent destruction or concealment of SAR tape relevant to a safety limit violation falls within the rationale of this q su category, apart from whether it was reportable for any other
.q reason. ;J.
. 2. Manacement version of events ]
~l.
The removal and disposal of SAR tape was officially reported to the NRC through the Emergency Notification System (ENS) at approximately 1:20 p.m. on September 11, 1987.367 This was characterized as an update of the company's previous notification of the safety limit viola- ,m tion.068 h. Prior to the official ENS notification, the NRC resi- ,, dent inspectors were told about the removal and disposal of E l SAR tape. This occurred, according to one management esti- m mate, between approximately 11:30 a.m. and noon.369 The event that prompted the notification to the NRC inspectors
- 160 - f) I 1
l ':1 I a
~
was the recovery of fragments of SAR tape during the trash search.370 At that point the GPUN managers had what they n. a regarded as clear evidence that some SAR records had been intentionslly ret'7ed.371 The recovered pieces of SAR tape h, JJ were shown to the NRC inspectors.372 F:N d After the NRC inspectors were briefed about the removal and disposal of the tape, they and GPUN management repre-M sentatives discussed whether an official ENS notification p, was necessary and, if so, how the notification should be U phrased.373 The result of the discussion was the 1:20 p.m. ENS notification.374 ' i"> 3. Comearison of manacement accou9t
!.j with other evidence n }i t..) The time of the formal notification to the NRC -- i.e.,
in the area of 1:20-1:30 p.m. -- was documented in (R]'s d diary note.375 This telephone call resulted in the written .p NRC preliminary notification that was later issued.376 To
. y^:
the extent that the NRC document reflected the substance of H [R)'s 1:20 p.m. notification, he gave the NRC an accurate LJ , report of what was known to GPUN management at that time.377 b While the precise time of the earlier notification to the NRC resident inspectors could not be established, all
.t witnesses agreed that it was shortly after the tape frag- ! ments were recovered from the trash.378 Allowing for the time it took the NRC inspectors to arrive and inspect the ~~
tape, discuss it and the other evidence with GPUN 2
- 161 - 's 8 .. _ - . - . . . . _ . . . _ _ , . . . _ . . _ _ _ _ , . _ _ _ . . . . _ . _ . . _ - . _ - _ . -
. .a management, and the time consumed in debating the wording of f E
the formal notification that was made at 1:20 p.m., (R]'s 7 estimate of 11:30 a.m. to noon -- which was the period -f I during which the fragments were recovered and shown to , w management -- provides a reasonably accurate estimate of 6 when the first informal notification to the NRC occurred.379 # 9 b Because the evidence was clear that NRC representatives S were promptly shown the SAR tape fragments found in the N trash, and were at that time fully briafed on the reasons to S a suspect destruction of records (the NRC representative who attended the 6 a.m. briefing had already been advised that 7
. y ,4 SAR data for the event were unavailable 380), the remaining ,,
issue is whether GPUN managers should have notified the NRC 3 earlier that SAR tape was missing under suspicious r circumstances. Absent a clear standard requiring that the NRC be notified of management suspicions at a particular C i d l time -- and there was no such standard applicable to these m j circumstances -- the timing of such a notification was a C matter of judgment and discretion. The evidence indicated 1 V that GPUN managers exercised this judgment in a responsible M m'anner, consistent with the policy considerations set forth in Procedura: 126. m l l The sequence of steps by whien management personnel became aware of the missing tape and their reporting of this information within the GPUN chain of command has been
]
detailed in the preceding section of this report. As we } e
- 162 -
l l 1
3
? -
p3 concluded there, the evidence strongly supported the mana-b gers' testimony concerning how their initial impression that - the SAR had run out of tape changed to a suspicion that the crew was engaging in a coverup. The evidence also corrobor-
'l
'j ated the managers' accounts of the efforts they made to t investigate the circumstances surrounding the missing SAR b,l La data, culminating in the discovery of the tape fragments.
q It was that discovery that convinced them that there was solid evidence of intentional destruction of records. rr In short, the evidence showed that during the period
~
before the NRC was told about the apparent destruction of tape, the management personnel were diligently attempting to
)). find the tape and explain its disappearance. When their suspicions ripened into certainty, they promptly and accer- .li m ately informed the NRC about the evidence of record destruc-r5 tion.
h
- 4. Conclusions The evidence discussed above and in the preceding
- \
[], section on reporting of the missing SAR tape within the GPUN r; chain of command supports the following conclusions: l I:'] '
- a. Between approximately 11:30 a.m. and
, r: Y noon, the apparent destruction and/or concealment of SAR r: tape was reported to NRC site representatives. This report was accurate within the limits of the information avail-able. It was made shortly after the recovery of tape frag-l - 163 - l 1 Se _ _ _ _ - - . - _ _ . _ = - - . -- - _ - - - - _-- -
ments during a management-ordered search of the trash. E
- b. A formal report was submitted to the NRC G'
-b at approximately 1:20 p.m., which contained information that r
was accurate within the limits of the information available F W at the time.
*IE 1
- c. The timing of GPUN reports to the NRC ,,
I was prompted by the recovery of the SAR tape fragments, F t. which confirmed earlier management suspicions that there had been an intentional concealment or destruction of records. S 7
- d. The management investigation of the ifv missing SAR tape was conducted diligently, with the goal of ,
' uncovering and reporting the reason for the missing SAR 5
. data.
M
.L t'
?
.E il
- s l
[
~
I - e
*]
- 164 -
..t., , . . _ _ , _ _ _ _ , _ . _ _ _ _ _ , . _ _ _ , _ _ . _ _ , _ . _ _ . _ . , , _ _ . _ _ _ . _ , . _ . _ . , . _ . . _ . _ _ _ _ , . _ _ _ , _ . _ _ _ _ . - _ . , . _ _ , , _
1 I( NOTES , 2 , p A. The Crew and Manacement Accounts of the cause and [ Nature of the Safety Limit Violation
- 1. GPU Nuclear Oyster Creek Station Control Room Log, L- September 11, 1987, midnight to 8 a.m. shift (Exhibit 6) ;
{' NRC Augmented Inspection Team Report No. 50-ji 219/87-29 (Sept. 28, 1987), p. 4 (Exhibit 27); 4= NRC Preliminary Notification of event or Unusual b Occurrence -- PNO-I-87-86A (Sept. 11, 1987 -- 16:00) d (hereinatter cited as "NRC Notification Form," 16:00) (Exhibit 30); Notes, (R] (Exhibit 12C); 7 (R), pp. 124-25; i (O), pp. 26-27, 38-42. j 2. Section VI(D).
! 3. Photograph of Recirculation Pu=p C Controls (Exhibit SA).
J l -
- 4. JCP&L Report to NRC (May 12, 1979), p. 3.D-1 (attachment to Exhibit 31) ;
n j (N), pp. 28-29; q (R), pp. 45-46. d.
- 5. E224, Station Procedure 301, Section 7, pp. 31.0, kl
- 1. , c
. 35.0 (Exhibit 17);
Station Procedure 2000-ABN-3200.02, p. 8.0 g (Exhibit 32); 11
'2 See also: Technical Specifications-Safety Limits,
,, Section 2 (Exhibit 9A);
- L (N), pp. 26-30;
[R), pp. 45-46.
- 165 -
iq r
1
. P
- 6. E gt, (VV), pp. 37, 82-83; h k
-( A) , pp. 28-29 ;
5 (ZZ), 10/7/87, pp. 78, 91-93. g n
. _ 7. (VV), pp. 36-45; D W
Station Procedure 301, pp. 31-35 (Exhibit 17).
,Yi
- 8. Station, Procedure 301, Section 7.3, p. 35 (Exhibit .,
17). The warning appeared in the same written step, but g after the direction to close the valve. It was, however, :3 displayed prominently with borders so as to attract attention. F l T
- 9. Station Procedure 301, pp. 16.0, 22.0, 31.0, 43.0 (Exhibit 17). '
- 10. Oyster Creek Nuclear Generating Station Procedure ._
2000-ABN-3200.19, "RBCCW Failure Response," Rev. 3, 'f (effective Aug. 31, 1986) (Exhibit 26) (hereinafter cited as d "Station Procedure 2000-ABN-3200.19"] ~
~~
- 11. Ibid., p. 4.0. The language in this procedure
! appears to apply to full operating conditions. As applied r
- to the shutdown conditions that existed on September 11, we interpreted the reference in this procedure to keeping "all" i valves open to pertain to the valves in the loops that were'
( operating, and not to impose a specific requirement that E I additional loops (beyond two) be opened. U r +
- 12. E g., (ZZ], 10/7/87, pp. 68-69; (j (A), pp. 93-941 ,
~
(II), 10/8/87, pp. 57-59. .; l "
- 13. (VV), p. 29. i l
- 14. Ikid; l _'
(A), pp. 76-77; l , (HH], pp. 101-04. _
- 166 -
i o I
-- - ~ , . _ . - - - . ,. _ ~ -.- . . - -, - , . . - - - - - , . - . . , . . - - , - -- -
. . . ~ , , ,7 ,
I 15. (VV), pp. 30-31;
.1 (HH), p 104; r
1 (I), 10/0/87, pp. 47-48. ~ ~
- 16. (VV), p. 32;
]
s, 333 Volume III (Taylor Report), Sections B-5 and 9, D-6. Lv
- 17. (VV), p. 33; (HH], pp. 107-09.
P
- 18. Ibid. The written procedure specifying that recirculation pumps could not be run without RBCCW flow through the drywell was Station Procedure 301, Section
,- 5.2.3.6, p. 20.0 (Exhibit 17).
- 19. (VV), p. 33.
f5 20. Ibid., pp. 33-34; C (HH), p. 109. i
" 21. (VV), pp. 33-36.
9 3 22. Ibid., pp. 21-22; i;4 133 Volume III (Taylor Report), Section D-5.
- -s ki .
- 23. (VV), pp. 22-24.
U:
- 24. Ihid., p. 36.
f1
- 25. Egg Station Procedure 301, Section 7, pp. 34-35 (Exhibit 17);
dl 133 Volume III (Taylor Report), Section B-2. _, 26. (VV), pp. 56, 63. '~ 167 -
F
- 27. (W) , p. 56. $
M
- 28. Ihid. s
- 29. Ikid., pp. 60-61. --
Id
- 30. Ihid., p. 61. ,
- 31. Ihid. , pp . 65 -6 6, 69. ,,
5 V
- 32. S.33 Volume III (Taylor Report), Section B-2 (Explaining double light indication).
t 4
- 33. (W], pp. 69-70.
O. .
- 34. Ihid., pp. 74, 79.
m
- 35. Ibid., p. 76.
3
- 36. Ibid., pp. 72-73. 1
- 37. Volume III (Taylor Report), Appendix 1.
i
- 38. (W) , pp. 73-74 ; [
13.3 Volume III (Taylor Report), Section D-10.3 and 1
- 39. (W] , pp. 74-75, 79-80. ,,,
- q l 2d l 40. Ibid., pp. 81-82
'. ]
dJ
- 41. Ihid., p. 81.
I
*i J
- 42. Ikid., p. 198. J l 'S; i
b
~'
- 168 -
E i . p 43. Sworn Statement of (PP] (Oct. 5, 1987), pp. 13-18 t ., . j (hereinafter cited as "(PP]"); Control Room Access Records ("entries"), 10:00 h Lt p.m., 9/10/87 - 11:30 a.m., 9/11/87 (Exhibit 14A). 7 44. (PP), p. 18. 4
-% 45. Ibid., p. 33.
- 46. Ikid., p. 28.
E ta
- 47. [HH), pp. 114-15.
r? {". *
- 48. [II), 10/8/87, pp. 52, 55.
1, a 49. (ZZ), 10/7/87, pp. 71; 95-97. 1 ,l 50. (I), 10/8/87, p. 54.
- 51. Ikid., p. 55.
1 52. (HH), pp. 116-20; J - (II), 10/8/87, pp. 66-67; m
] (ZZ), 10/7/87, pp. 94-95; ., (I), 10/8/87, p. 57.
- 53. Control Room Log, September 11, 1987, midnight to 8 a.m. shift (Exhibit 6).
L' .
- 54. (II), 10/8/87, p. 113.
n 0
- 55. Ibid., pp. 113-16.
ll>: ~
- 56. Ihid., pp. 113-26.
I
- 57. Ibid., p. 124.
?
i .s - 169 - k
U EU (W) , p. 76. 58. {
- 59. I); tid. {
- yt
- 60. (NN), pp. 7-8. S.g3 Volume III (Taylor Report), y Section E, which illustrates the effect of (W]'s opening of g two valves.
4.T. .
- 61. (NN], p. 21. i F
- 62. (O), pp. 37-38. 1
]
1
- 63. Ihid., p. 38. ("
- 64. (R),'p. 110.
L{
- 65. Ihid., pp. 109-10. ;
a
- 66. Volume III (Taylor Report), Section D-9. _
o
~
- 67. Ihid., Sec' ion D-10.3.
1
- 68. (W) , pp. 74-75, 79-80.
T n
- 69. Volume III (Taylor Report), Section D-11. As L discussed in that section of the Taylor Report, it was physically impossible for (W) to have used the master controller and also to have performed the "B," "D," and "A" ;ii
~ '
l valve manipulations within the time period that these events occurred. ,."'
. it
- 70. Ibid.
I V d
- 71. (W), pp. 67-69.
w TP ' i i '
~
- 170 -
,]
~., , I s A - . B. Recortine of Safety Limit Violatien Within GPUN Chain fd of Command , e h 72. Oyster Creek Technical Specifications, Section 6.7 (Exhibit 9C). ] 73. Oyster Creek Nuclear Generating Station Procedure g 126, "Procedure for Notification of Station events," Rev. 7 P (effective Mar. 28, 1987), Section 5.2, p. 7.0 (Exhibit 25) d ,. (hereinafter cited as "Station Procedure 126"]
- 74. Ikid., Section 6.1, pp. 9.0-10.0.
j 75. Ihid., Enclosure l'at E2-1. D[J q 76. Oyster Creek Technical Specifications, Section a q 2.1(C) (Exhibit 9A). 'l 77. Station Procedure 126, Enclosure 2 at E3-1 J (Exhibit 25). q ^" g 78. NRC Augmented Inspection Team Report No. 50-219/87-29 (Sept. 28, 1987), p. 18 (Exhibit 27); (NN], pp. 21-25. 1 79. Station Procedure 126, Section 6.2 at 9.0-10.0
- j (Exhibit 25).
[Ifj 80. h , ibid., Enclosure 2 at E3-1 (requiring GSS to notify GPUN personnel in the case of four-hour reportable events). J * .1 '
- 81. Ibid., pp. E6 E6-4.
t "i
- 82. Ibid., pp. E6-3, E6-4.
U 83. Ibid., p. E6-1.
- 84. Ikid., pp. E6-1, E6-2.
r,
- 171 -
~ _ - _ .
E
,. E0 C
- 85. Oyster Creek Nuclear Generating Station Procedure b ,
2000-RAP-3024.01, "NSS Annuniciator Response Procedures," , Rev. 22 (effective July 12, 1987), Section E-4-b, p. 1 of 2 (Exhibit 3). I
- 86. Volume III (Taylor Report); Section D-10.3 and q '
Section E. h
- 87. Although (R) estimated this call to have occurred #[
at-3:30 a.m., the 3:45 a.m. estimate 'is based upon the great 1 weight of evidence showing the time and sequence of certain .. events. All witnesses agreed that (HH) told (R) about the r safety limit violation when (R) called back to the control D room after his first conversation with (HH]. (HH), (A), and other crew members testified that this occurred just after y (A] had urged (HH) ,to call (R); that event, in turn, V occurred shortly after (HH) came back into the control room E at 3:41 a.m., after speaking with the health and safety representative. E33 Access Chart (Exhibit 14C).
]
CJ Further evidence that (R)'s second telephone conversa- y tion with (HH] occurred at approximately 3:45 a.m. was 4 supplied by (N), who testified that (R) first called him at d 3:35 a.m. ((N), pp. 56-5.7). It was this conversation with (N) that prompted (R] to call the control room and ask the question that elicited disclosure of the safety limit a violation. T
- 88. (ZZ), 10/7/87, pp. 94-95. '
7
- 89. Ikid., pp. 74-76; O I
[II), 10/8/87, pp. 149-50; l [A), pp. 34-36; - r (I), 10/8/87, pp. 57-59; ' Volume III (Taylor Report), Section B-7. l ( 3 O
- 90. (ZZ), 10/7/87, p. 79.
'3
- 91. Ibid., pp. 79-83; (HH), p. 152.
- 172 -
\
l 3 3 .
- 92. (SS), pp. 17-18.
5 93. (VV), pp. 86-87. 1 W q
- 94. Ibid., pp. 110-11, 136-37.
d
- 95. (ZZ), 10/7/87, p. 79.
f] .. [II), 10/8/87, p. 155. q (I), 10/8/87, p. 87. O
- 96. (HH), pp. 152-55.
b$
- 97. (VV), p. 89; (ZZ), 10/7/87, pp. 85-86; f
(A), p. 47. L!
- 98. (I), 10/8/87, pp. 65-66.
n i.
- 99. (ZZ), 10/7/87, p. 66; il t:
(I), 10/8/87, pp. 65-66; Station Procedure 301, Section 7, p. 33.0-34.0 q (Exhibit 17). b3 100. (ZZ), 10/7/87, p. 97. The technical data showed that it took 9, approximately 23 minutes to raise the reactor water level to tj- 185 inches. Volume III (Taylor Report), Table E-1. 101. (ZZ), 10/7/87, p. 100. [], 102. (A), p. 83.
.a 103. (P), pp. 14-15.
4
- 173 -
i
104. Ibid., p. 15; ke (A), pp. 84-85. - 2d 105. (A), p. 85. 106..Ihid., p. 86. f 107. Ihid., pp. 88-90. d 2 108. Access Chart (Exhibit 14C). $~ 109. (A), pp. 90-92. 110. Ikid., pp. 98-99. ,p
,k w
111. Ibid., pp. 101-02. , i( c 112. Ikid., pp. 100-02; Access Chart (Exhibit 14C).
- e 113. (A), pp. 102, 108-09. tj; 114. Ibid., pp. 108-09. "
115. Ikid., p. 110. ,, 9,, 2 116. (A), pp. 102-03; a Access Chart (Exhibit 14C). 11 t .., 117. (A), pp. 102-05. l [] 118. (A), p. 103; h, J (ZZ), 10/7/87, pp. 136-37.
.)
a 119. Ibid., p. 104. O
- 174 - U l
4 4 4 4 4 3 3.. -
] 120. Ihid., pp. 132 L1
- 121. Ibid., p. 132.
122. Ihid., p. 137. -0 123. (R), p. 73;
,Y j (HH), pp. 163-65.
124. (ZZ), 10/7/87, p. 137; (A), p. 103. -Q & 125. (A), pp. 105-06.
- 126. Ihid., p. 111.
ri U 127. Access Chart (Exhibit 14C). , in [~ t 128. (A), pp. 112-13;
.J (ZZ), 10/7/87, pp. 147-49.
~t
. [,3 129. (A), p. 113;
-.. i
-] (ZZ), 10/7/87, p. 149. i
- 0) 130. (A), pp. 113-14; 3 s (ZZ), 10/7/87, p. 149.
lj d 131. (HH), p. 184; Id (R), pp. 81-83.
-L 132. (R), p. 83.
l[]
- u
- r. :
,$d e ' ti - 175 -
i!
. 1. .___
t 133. (A), pp. 121-22; h 61 Oyster Creek Technical Specifications, Section 6.7 (Exhibit 9C). E EE 134. (HH), p. 195; (A), pp. 128-30. d r) 135. (A), p. 129. O 136. Ihid. R u 137. Access Records - Entries and Exits (Exhibits 14A, E 14B). O 138. Access Records - Entries (Exhibit 14A); [P Cworn Statement of (E) (Oct. 13, 1987), p. 9 m (hereinafter cited as "(E]"). 31 d 139. Sworn Statoment of -(XX) (Oct. 1, 1987), pp. 11-14 F (hereinafter cited as "[XX)"). u 140. Sworn Statement of (G) (Oct. 2, 1987), p. 13 . [ hereinafter cited as "(G)"); (XX), pp. 14-15. f 141. Sworn Statement of (D) (Oct. 2, 1987), pp. 25-26 m (hereinafter cited as "(D)"); a
!J Sworn Statement of (AAA) (Oct. 13, 1987), p. 26 (hereinafter cited as "(AAA)"); ,
Ja
]
(WW), p. 38. 142. (PP), pp. 58-60. (PP), as discussed in Section VI(A), was the only person not a member of "B" crew who had seen the safety limit alarm flash, just prior to his exit from the control icom at 2:17 a.m. ]3 143. (A), pp. 97-98. 9 ij il 176 - q. N
- ,--w ----wr-- -
-www w-y. ---y.-- w---- er we.- -----------wye 4mycgw----w--wg-w-v-v ~ " -'-- -'" -
d . R 144. SwornStatementofiH] (Oct. 1, 1987), p. 18 , 1 (hereinafter cited as "(H)"). , 145. (P), pp. 24-25.
] 146. M ., p. 31.
3 p\ 147. E.gg Volume III (Taylor Report), Section D-12 and Q Table E-1. F 148. m . ti 149. h , (ZZ), 10/7/87, p. 83; l]a (I) 10/8/87, pp. 103, 105-08. 3 d 150. h , (HH), pp. 68-69; (VV], pp. 87-93; [R), pp. 26-27; B g (A) pp. 44, 56. f.] 151. There were substantial differences in the percep-(U tions of the crew and management over the fairness and severity of discipline. (N), the GPUN manager most involved q in setting disciplinary standards at oyster Creek, indicated
'j that, depending on the circumstances, violation of a safety limit would not necessarily result in any discipline at all. (N], pp. 7, 46-47.
g t3, 152. [N], pp. 64-67; U. . Lj . (SS), pp. 21-22. 153. [SS), p. 25, p 154. Oyster Creek Duty Notifications, Public d Information and Affairs (9/11/87-4:36 a.m.) (Exhibit 9B). ll c d
- 177 -
iI
C. Renortina Safety Limit Viointien to NRC - is e 155. Oyster Creek Technical Specifications, Section , 6.7, pp. 6-14 (Exhibit 9C). g 156. Ibid., Sections 6.7.1(c) and (d). [ Ki 157. 10 C.F.R. I 50.72 (Exhibit 28). p s 158. Event Notification Form (Exhibit 8). '; O S 159. (HH), p. 195; e (R), p. 83. b} 160. Sworn Statement of (MM) (Oct. 14, 1987), p. 72 @ (hereinafter cited as "(MM)"). u 161. NRC Augmented Inspection Team Report No. 50- 'j~ 219/87-29 (Sept. 28, 1987), p. 6 (Exhibit 27). (NN), pp. 21-25. l 162. Station Procedure 126, Section 5.2.1 (Exhibit 25). l .
]LJ l 163. Ikid., Section 5.2.2; Enclosures 1-5. m Ci d
164. (HH), p. 195. 165. Exhibit 8, T
*~
166. Ikid. 9 167. Ibid. U l\ 168. (R), p. 73; 3.11 note 87, Section VI. d t l NRC Augmented Inspection Team Report, pp. 1, 16 (Exhibit 27); 1
- 178 - -
T 2 ~. T L NRC Preliminary Notification of Event or Unusual , Occurrence, PNO-I-87-86 (Sept. 11, 1987--10:20) (Exhibit 29) p (hereinafter NRC Notification Form, 10:20). Tj p- 169. Event Notification Form (from Station Procedura y 126) (Exhibit 8).
\
3 170. (HH), p. 197. A
,4 171. (N], pp. 68-69.
W 172. (SS), 33-34. 173. Transcript of 6 a.m. meeting (Sept. 11, 1987) g (Exhibit 21). J 174. NRC Notification Form, 16:00 (Exhibit 30). 1
'J 175. Egg Volume III (Taylor Report) Section D-10.3.
e; . 176. Ibid., Section D-12.
'l '
3 177. Ibid., Sections D-9 and D-10. 1 j D. Destruction / Concealment of SAR Taee Il 178. Section II(C). U,
;5 , 179. JCP&L Modification Proposal 224-7-3, "Oyster Creek j- Control Room Alarms," Rev. 6 (July 10, 1984), Section 1, p.
1 (Exhibit 3 3) .
)
180. (R), p. 55. (I U 181. Control room and GSS legs, for example, are specifically required by Station Procedure 106, Section {; 4.4.3 (Exhibit 33). O g ~l 1 _ 179 - (J
E
. t 182. Station Procedure 106 sets forth procedures for 7 handling "strip charts" and "recorder charts" (Section
- 1 4.4.2, pp. 21.0-23.0), requiring that such charts "are to remain intact when removed and brought to the GSS office for e filing in the Document control Center," p. 23.0 (Exhibit M 16 ) .-
7 The GPUN Records Retention Policy (No. 1000-POL- N 1210.02, effective Aug. 29, 1984) specifies that "Recording instrument charts" are to be retained for one year, "except #7 where the basic chart information is transferred to another !jj record," in which case the chart is to be retained for six months, "provided the record containing the basic data is 'A retained one year," p. El-15 (Exhibit 34). [t 183. Eg, (N], pp. 76-77; f 6 (R), pp. 55-60. 9 2d 184. E2ga, (R), pp. 62-63. 7 185. We have not attempted to determine whether federal O or state criminal laws were violated. There are, however, federal and state criminal provisions that arguably would - apply to the September 11 avant, assuming there were an L
~
intention to conceal the safety limit violation. 133 18 U.S.C. I 1001 (making false statements in matter within jurisdiction of federal agency); N.J.S. 2C:28-6 (tampering 9 with or fabricating physical evidence). 13 IM 186. E2g2, GPUN Corporate Policy 1000-POL-2002.00 $
"Standards of conduct" (effective May 15, 1986), pp. 1.0-2.0 (Exhibit 58). e.7
*l 187. GPUN Corporate Policy 1000-ADM-2130.01 "Disciplin-ary Guidelines" (effective May 2, 1986), pp. 4.0-6.0 I (Exhibit 59). ;_
a 188. (ZZ), 10/7/87, p. 83; j [II), 10/8/87, pp. 155-56. ,, 189. 12gt, Station Procedure 106, Section 4.2.7, p. 14.0.(Exhibit 16). ' L1
- 180 - J t
a Section 4.4.1, p. 20.0: "all shift personnel F'1 shall conduct themselves in a saie and professional manner at all times." (Exhibit 16). - 190. (VV), pp. 112-13. [ 191. Ihid., p. 127. O 192. Ibid. d 193. Ihid., pp. 131-34. p! L p 194. Ibid., p. 134. U,i 195. Ikid., pp. 147-49. L 19 6. Ihid. , p . 155. Ild 197. Ikid., pp. 146-47. O U 198. (ZZ), 10/7/87, pp. 110-11; 120-21. Il . [J 199. Ibid., pp. 121, 144;
, (MM), p. 128; v
Notes - (MM) (Exhibit 12A). G3 , Volume III (Taylor Report), Section C-1. For the purpose of discussing the crew's actions, we cite times as p, they were printed on the SAR tape, and ignore the approxi-
~
mately seven-second time difference between SAR and real - time. (Taylor Report, Section D-8). Although this time difference proved to be important to the technical analysis fj and determination of the sequence of events, it is not d critical to our discussion of the actions of the crew members in this section of the report. n
}G 'l 200. (VV), p. 149.
ud 201. gag Volume III (Taylor Report), Section C-1. 2 - 181 -
. . , . . . e . , ,
9 202. (VV), pp. 126; 142-43; 160-61; 174-76. 203. Ikid., pp. 159-60; p Chart (Exhibit 14C). , T 204. (VV), pp. 157-59. I 205. Ihid., p. 157. M b 4e 206. Ibid., pp. 158-59. h L
~
207. Ibid., p. 230. e l 208. (HH), pp. 195-97; 212-17, 227-32; ,2 9<
~*
(A), pp. 130-31, 157-58; , (II), 10/8/87, pp. 103-09, 132-33; ,1 C (ZZ), 10/7/87, pp. 113-32, 180-81; r (I), 10/8/87, pp. 76-79, 83, 93. 209. We questioned under oath everyone who entered or E left the control room between 2 a.m. and 7 a.m. The persons >- who were in the control room during the first hour and a half after the alarm -- the period during which (VV) completed his tearing and disposal of the tape -- are listed (j L and their testimony discussed in Section VI(B) of this report. c< G sa 210. Diagram of control room marked by (VV) (Exhibit , 1B); .d C (ZZ), 10/7/87, p. 111. l
'l 211. (ZZ), 10/7/87, pp. 110-11.
q 212. Ihid., p. 110. J m 213. Ikid., pp. 110-15; 119. j 1
- 182 - -
$4
I u - {c 214. Ibid., p. 120.
- 215. Ihid., pp. 144-45; I Notes - (MM) Exhibit 12A);
7 Fragments of SAR Tape (Exhibit 13C); 3 Volume III (Taylor Report), Section C-1. l' a 4
, 216. (ZZ), 10/7/87, p. 121.
5 217. Ihid., pp. 144-45; q Notes - (MM] Exhibit 12A); o Fragments of SAR Tape (Exhibit 13C) ; [] Volume III (Taylor Report), Section C-1. E q 218. (ZZ), 10/7/87, p. 123. p)
~
g 219. Ibid. * !3 220. Ikid., p. 124. m O" 221. Ibid. El a! 222. Ihld., p. 125. P lj., 223. Ikid. a7't ~- 224. Ikid., p. 126. 225. Ihid., 129. m
,1 226. Ibid., p. 127.
LA F 227. Ibid. 4-e ul - 183 - m
.)
I l 228. Ihid., p. 128. l {E ) 229. Ibid., p. 135. p l b 230. (P), pp. 22-23; , 4 Control Room Access Records (Exhibits 14A, 14B). d U 231. (ZZ), 10/7/87, p. 123. $ 232. (P), pp. 19-20. 233. For example, (P) recalled (HH) talking about "something" with EO (RR) ([P), p. 23). ?; 234. (ZZ), 10/7/87, p. 135. ' f),3 235. Ikid., p. 137. ]
<.s 236. (A), pp. 102-05. +
237. Control Room Access Records and Chart (Exhibits , 14A-C). The computer recorded (A)'s re-entry as having ( ,' occurred at 3:30 a.m., and (ZZ)' at 3:36 a.m. 1 h' 238. Ikid. @ 239. Ihid. Egg Section VI(B). E 240. (HH), pp. 233-35;
.?.
*~
(A), p. 162;
?
(I), 10/8/87, pp. 80-82;
]
(ZZ), 10/7/87, pp. 126-27. , i J 241. Egg Section VI(E) ; Volume III (Taylor Report), Section C-1. [lj
- 184 - J di
242. (A), p. 162. . 243. (HH), pp. 233-35. 244 333 Volume II, individual section pertaining to (HH). 1 s 245. Our visual inspection of the original tape u fragments confirmed the testimony of those who found it that it appeared to have been stained with coffee grounds or other food substance. 133 Volume III (Taylor Report), p Section C-1. L 246. (VV), pp. 223-25.
, 247. Ibid., pp. 222-23.
L 248. 133 Volume III Taylor Report, Sections 5 C-1 and f?, dl 249. Ibid., Section C-1. L 250. Ibid.
, 'i ~
251. (VV), pp. 216; 219-20. 7 J 252. We tested all plausible explanations for the presence of the September 10 fragments in the trash, M including the possibility that (Vv] carried both them and tj ' the other two fragments in his pocket and disposed of them just before exiting the control room. There was insufficient evidence to support any of these explanations. O~ 253. 133 Volume III (Taylor Report), Section C-1. h el 254. Ibid. {:1 255. (VV), pp. 213-14.
- c. 256. Ihid., p. 127. ,
9
- 185 -
- ~
i
i E t . I 257. Ihid. , p. 12 8. { L , 258. Fragments of SAR Tape (Exhibit 13A); g
. T}j 333 Volume III (Taylor Report), Section C-1.
F 259. Volume III Taylor Report, Section C-1. 5, P E. Renortine of Missine SAR Tate Within GPUN Chain of $ Command ,] 7 260. Station Procedure 126, Enclosure 5, p. E6-1 1 (Exhibit 25). -
~
261. Ikid., p. E6-2.
"l 262. Ikid., p. E6-3. U@ '
57. 263. Ikid., p. E6-1. .O. ,
. m
{ 264. (I), 10/8/87, pp. 81-83; [II).- 10/8/87, pp. 101-03; , (VV), pp. 144-45. . 1
?
265. (HH), pp. 171-74. ]' 266. Ihid., p. 175.
.=
( 267. Oyster Creek Duty Notification Form (Exhibit 9B); 7 Access Records - Entries (Exhibit 14A). ! $J 268. (HH), pp. 200-01. i 269. Ihid., p. 201, d' n 270. Access Chart (Exhibit 14C). }i .s
"}
u
- 186 - ~
I A _
, 271. (HN), pp. 176-79.
4 h *
- l' i
F 272 Section VI(D). + b 273. Volume II (individual section pertaining to (HH)) . l P b ?,74 133 Sections VI(B) and (D). 9' 275. (ZZ), 10/7/87, pp. 141-42. a r (C { 276. (A), pp. 125-26; 133. 277. Ibid., p. 145. 278. (ZZ), 12/3/87, p. 8; 113 (ZZ), 10/7/87, p. 132. rs 279. (A), p. 131. I) . 280. (HH), pp. 214-16; I' . L (A), pp. 145-46;
- g (II), 10/8/87, pp. 107-09; (ZZ), 10/7/87, pp! 142-43.
'l t
.S 281. (HH) pp. 250-51; (A), p. 132. O n 7,, 282. (R), pp. 73-80;
- i.; . .
La - (HH), pp. 163-64. [.] The testimony of (R) and (HH) was corroborated by (A) and ("Z), who confirmed (HH]'s admission. U.1 4 L 283. (R), p. 90. ; i l .-a 284. Ihid, t '. a - 187 -
,1 . . . _ - - _ , ., ,--, - , - , - - - - - . . - . - - . _ - . - , _ . - - - , - - - - . . - . - - . - . _ , - - - .
! -l F _ J 285. IMH), pp. 193-95. 5 b) 286. (A), p. 128-30, 287. (R), p. 90. l 288. (N), p. 64. b 1 289. Ikid., p. 69. 6 290. Ihid., pp. 64-65. k a e 291. (R), p. 95. h 292. Ihid., pp. 87-89. fu ; 293. This estimate is based upon the time of (HH)'s p notification to the NRC, which he recorded as 4:05 a.m. Y
~"
(Exhibit 8), in conjunction with the testimony discussed in the text that (HH) was in the process of making this ,. notification when (R) called, causing (HH) to hand the phone .; - to (A). ' r 294. (R), pp. 89-90. e 295. Ihid., p. 90. { 296. Ihid. 2 2 297. Ihid., p. 92. r;
,(
.!2 298. Ikif.. ,
C u 299. Ikid., p. 94. u. 300. Ibid., p. 93. 301. (HH), p. 250;
- 188 - ._4
. , - - __ _ -__ _ _ ~
3o
7 ., fa . c y (A), p. 132. 9 At approximately 4:30 a.m., (A) had a conversation O with EOs (WW) and (AAA) in the lunch room, during which he mentioned that SAR tape was "missing," not that it had run q out of tape. 133:
!]
(A), pp. 136-38; 'It (WW), pp. 44-48; U r- (AAA), 32-34; Access Chart (Exhibit 14C). Ilb 302. (HH), p. 193.
~
303. Ibid., pp. 194-96. w 304. (A), p. 128. q1. u 305. Ibid., p. 129. t' U 306. Ikid. 7 307. Ibid.. p. 132.
- 308. Ibid., p. 131.
309. Ibid. h 310. (R), p. 94.
- L) .
311. (MM), p. 61. 1[0:.}
- .3 312. Ibid., p. 63.
- D
, 313. (R), p. 58, t -.
I e 'c-
- 189 -
P '-I III
314. (NN), pp. 32-34. 5 b 315. (O), pp. 26-28. g itw 316 133 (ZZ), 10/7/87, p. 153. Ul 317. (N), pp. 64-68. fr
>T 318. Ihid., p. 67. M
*4 r-d '.'
319. (SS), pp. 22-23. 1 320. Ikid., pp. 36-37. I 3 21. Ib.i.d. @
'd 322. Ikid., pp. 40-41. v 323. (N), pp. 67-68; 76-77; -
p (R), pp. 93-95. - 324. h , (N), pp. 69-74; b (R), pp. 101-02; r (SS), pp. 22-25. 2.] ' 325. Access Records "Entries" (Exhibit 14A). JJ 0 326. Ibi.d. 23 327. (R), p. 101. 328. (R), pp. 101-02, 115; Li d (SS), p. 29. i
- 190 - j
'} .
G u - .]# 329. (MM), p. 84; Access Records "Entries" (Exhibit 14A). ' r b 330. (NM), p. 84. 7 2 331. Ihid., pp. 84-87. 332. Ihid., pp. 86-88. pJ [] 333. Ihid., pp. 90-91; .. t l Access Records "Exits" (Exhibit 14B). 'l U 334. (MM), pp. 125-27; I
] Access Records "Entries" (Exhibit 14A).
l.1 g 335. (MM), pp. 127-28; I '* Notes - (MM) (Exhibit 12A). P L3 336. (MM), p. 131. k 337. Ihid., p. 133; - g Access Records "Exits" (Exhibit 14B). b 338. (N), pp. 74-75;
, (R), pp. 102-05.
'; 339. (N), p. 74.
340. EAg4, (R), pp. 2.00-01, 105. p 341. (MM), pp. 147-48;
'i ~
Access Records "Entries" (Exhibit 14A). i 'L. L. - 191 -
342. (R), p. 106; f E (O), pp. 31-32; *
~
(MM), p. 148. J 343. (MM), pp. 151-57, 175-76. { L 344. (N), pp. 85-86; 47 (SS). pp. 41-42; s. (HH), p. 227. [
~
345. (R), p. 116; 7 d Access Records "Entries" (Exhibit 14A). b U 346. (R), p. 116. 347. Ibid., p.' 117. L 348. Ibid. . 349. (SS), p. 39. , ,[ w 350. (R), p. 120. r a 351. (R), p. 119.
~
'a 352. Sworn Statement of (LL) (Oct. 15, 1987), pp. 5-7 (hereinafter cited as "(LL)"); r
! b ' ~~ Sworn Statement of (U) (Oct. 1, 1987), pp. 7-11 (hereinafter cited as "[U)"); , 4 Sworn Statement of (Q) (Oct. 13, 1987), pp. 8-11 d (her11nafter cited as "(Q)"); i
;a 353. (U), p. 11. -
1 d
- 192 - a
y, 354. (U), pp. 11-20; W. C Control Room Access Records ("Entries and "Exits") . (Exhibits 14A, 148). Q , G 355. Sworn Statement of (UU) (Oct. 15, 1987), pp. 11-q 16; Sworn Statement of (CC) (Oct. 15, 1987), pp. 6-10; ^ L f7 SAR Tape Fragment (Exhibit 13A). L o. 356. (Q), pp. 15-18. c 357. Ikid., pp. 22-28. by w 358. (SS), p. 45. l 359. (R), p. 123. q EI 360. (SS), pp. 45.46.
?!
j F. Reeortine of Missine SAR Taee to PTRC
) .L.
361. Section VI(E).
'7 362. 10 C.F.R. 5 50.72(c) (regarding immediate followup j to telephone notifications, 5 50.73 (requiring detailed written reports of ev.ent within 30 days) (Exhibit 28);
in see also, 10 C.F.R. Sections 50.36(c) (1) (1) (A) ; 50.72 (b) (2) (Exhibit 28); [3 Station Procedure 126 (Exhibit 25).
'{O} 363. For example, data from the recovered tape frag-ments were used in later GPUN and NRC reports concerning the event. Eit , t.,,,L. , NRC Augmented Inspection Team Report, No.
,], 50-219/87-29 (Sept. 25, 1987), Table 1 (Exhibit 27). :
a i a.
- 193 -
p9
364. Examples of such informal exchanges on September ;7 11 were joint GPUN-NRC examination of technical data, *A coordinating news releases, and discussing the wording of a
- followup notification. 3.na (O), PP. 33, 50; Sworn Statement of (S) (Oct. 1, 1987), pp. 25-30 (hereinafter cited as .
"(S)").
, 365 3,33 Sections V(B) and (E).
.L.
Lv 366. Station Procedure 126, Enclosure 5, pp. E6-1, 2 g (Exhibit.25). o m E 367. (R), p. 125; & NRC Notification Form, 16:00 (Exhibit 30). O V., 368. (O), p. 51; n
. n NRC Notification Form, 16:00 (Exhibit 30).
?,
369. (R), pp. 125-26. L r 370. Rid., p. 126; { (O), p. 49; ,,
. t, (NN), p. 40. L 371. (O), p. 49. b i
R 372. (N), p. 89. r a 373. (O), pp. 49-50. ,C
-E t
j 374. NRC Notification Form, 16:00 (Exhibit 30). -- L I 375. Notes - (R] (Exhibit 12C). l J 1 376. NRC Notification Form, 16:00 (Exhibit 30). l
~
l 377. As discussed in Section VI(C), the 1:20 p.m. i
- 194 - U 1
E L .
' notification contained a statement about the nature of the ; safety limit violation itself -- i.e., that two recircula- +
tion discharge valves had been closed -- that our analysis - I of the technical data showed to have been inaccurate. This statement, however, clearly reflected the honest opinion of 1 both GPUN and NRC investigators based upon their analyses of the data available at the time. Q 378. (R), pp. 124-26; (N), p. 89; A (NN], pp. 40-42; (O], pp. 32-35. I'l 2 379. In an interim report to the company, we estimated that the discovery of the tapa fragments -- and therefore the report to the NRC -- occurred between 10 and 10:30 p a.m. Letter from Edwin H. Stier to Philip R. Clark (Sept. [j 21, 1987), p. 4 (Exhibit 35). Later testimony and analysis of computerized control room entry and exit data established
, that the recovery of the tape fragments occurred
' a,' approximately an hour later than we had estimated. This does not in any way change any conclusion we have reached concerning the actions .of GPUN management personnel. 380. Transcript of 6 a.m. meeting (Exhibit 21). Qu - 3
- 1
_a .c- ;
- G h3 p
.a ,9 !J j - 195 - t~ , . - . - - . - - . . . - - - - -
~
Table 1 E b List of Exhibit.s (1) Diagram of Control Room (a) Diagram drawn by (II) ha. (b) Diagram drawn by (VV) (c) Diagram drawn by (MM) (d) Diagram drawn by (I) (e) Diagram drawn by (ZZ) Diagram drawn by (PP) (i' (f) ,, (g) Diagram drawn by (HH), e
?
Diagram of Dry Well Cooling System W (2) (a) (b) Diagram of Typical Recirc Alarm Loop (3) Oyster Creek Nuclear Generating Station Procedure y 2000-RAP-3024.01, "NSS Annunciator Response Procedures," Rev. 22, effective date 7/12/87, pp. 11.0-13.0, E-4-b. m (4) Recirculation System Controls Diagram - (5) (a) Photograph of Racirc Pump C Controls 7 (b) Photograph of Section F of Control Panel _ (c) Photograph of Control Panel showing recire pumps A-D controls - (d) Photograph of Sequence Alarm Recorder (SAR) D Photograph of Sequence Alarm Recorder (SAR)
~
(e) (6) GPU Nuclear Oyster Creek Station, Control Roon Lcq -- ild September 11, 1987, 12-8 shift. s (7) Group Shift Supervisol- (GSS) Log -- 12-8 shift - 9/11/87 1 (8) Event Nctific~a tion Form (1 page only) (from Sthtien Proced' Ire 126) ., . NRC notification time 4:05 , c (9) (a) Appendix A to Provisional Operating License DPR-16, October 1, 1986, Technical Specifications and Bases ,7 for Oyster Creek Nuclear Power Plant, Unit No. 1, e_ Ocean County, New Jersey, Section 2.1, "Safety Limit - Fuel Cladding Integrity," p. 2.1-1. -; (b) Report on Safety Limit Violation to Public Affairs /Information Office (Oyster Creek Duty Notifications Form, Public Information Dept.) - (c) Appendix A to Provisional Operating License CPR-16, October 1, 1986, Technical Specifications and Bases for Oyster Creek Nuclear Power Plant, Unit No. 1, ~~ Ocean County, New Jersey, Section 6.7, "Safety Limit
- 196 - E i
'7 d
n d y Violation," p. 6-14. w Chronology prepared by i (10) "B" shift GOS, (A), September 11, l n 1987. '
~
(11) Notes of 9/11/87 Critique of Safety Limit Vio,1.ation R (12) (a) Notes - (MM) (concerning 9/11/87) d (b) Notes - (X) (concerning 9/11/87) (c) Notes - (R) (concerning 9/11/87)
". (13) Fragments of SAR tape found 9/11/87 go (a) 3 pieces (b) 76" piece
] (c) 43h piece
':.1 (14) Control Room Acck1s Records -- 10:00 p.m., 9/10/87 -- 11:30 a.m., 9/11/87 ti (a) "Entries" (b) "Exits"
)a (c) Chart showing "B" shift operating crew control room entries and exits - 9/11/87
- ((j 1 (15) Appendix A to Provisional Operating License DPR-16, October 1, 1986; Technical Specifications and Bases for Oyster Creek Nuclear Power Plant, Unit No. 1, Ocean County, New p Jersey, Section 6.1, "Responsibility," p. 6-1 and Section j 6.2, "Organization," pp. 6-1 thru 6-5.
(16) Oyster Creek Generating Station Procedure 106, "Conduct of
] Operation &," Rev. 45, Effective date 8/13/87.
d (17) Cyster Creek Generating Station Procedure 301, "Nuclear Stream Supply System," Rev. 39, Effective date 3/ 29/87. (18) Diagram of Reactor Building, drawn by Quark, referenced in deposition at pp. 21-21. ~ J= (19) (a) Diagram of lunch room -- drawn (AAA) (b) Diagram of lunch room -- drawn (WW) 'N. 1% (c) Diagram of lunch room -- drawn (J) (20) Cyster Creek Nuclear Generating Station Procedure No. 620.4.004, "Surveillance Review Form," date effective h' 9/11/87, pp. 1-7 and El-1 -- El-4 (from (VV] deposition, p. 165). p (21) Transcript of 6:00 a.m. meeting. E} (22) 11-U-6 Forced Outage Inventory, Rev. 1, September 10, 1987. r: [2 1 (23) RCA Computer Printout showing control room entry (referenced in (H) deposition, p. 15) il Li - 197 - bN ~
7
. . 0 (24) Diagram of Radcon Area (discussed in (H) deposition, p. 0g 23). - '( 2 5 ) Oyster Creek Nuclear Generating Station Procedure 126, E "Procedure for Notification of Station Events," Rev. 7, $
Effective date 3/28/87. F (26) Oyster Creek Nuclear Generating Station Procedure 2000-ABN- c 3200.19, "RBCCW Failure Response," Rev. 3, effective date 8/31/86. (27) NRC Augmented Inspection Team Report, No. 50-219/87-29, ,
,f 9/28/87. g (28) 10 C.F.R. -- Sections 50.72, 50.73 b (29) NRC Notification Form (10:20) Q (30) NRC Notification Form (16:00)
(31) Letter, I. R. Finfrock to NRC, May 12, 1979, with attach- [ ment (JCP&L Report on the May 2, 1979 Transient at the 'i Oyster Creek Nuclear Generating Station). _ (32) Oyster Creek Nuclear Generating Station Procedure #2000- j ABN-3200.02, "Recirculation Pump Trip," Rev. 3, effective date 9/1/86. c4
.r (33) JCP&L Modification Proposal 224-7-3, "Oyster Creek Control -
Room Alarms," Rev. 6 (July 10, 1984), Section 1, p. 1. ,
,a 4
(34) GPUN Records Retention Policy #1000-POL-1210.C2, eff. date August 29, 1984. R (35) Letter from Edwin H. Stier to Pnilip R. Clark, President, ^y GFUN, 9/21/87. (36) Letter from D. L. Ziamann (NRC) to I. R. Finfrock, Jr. [ (JCP&L) datad May 30, 1979, enclosing Amendment 36 to vi , Operating License DPR-16. l
,I?
(37) Letter from R. F. Wilson (GPUN) to J. A. Zwolinski (NRC) 41
~
dated September 19, 1985. (38) GPUN Division I System Design Description for Oyster Creek a
)
Nuclear Generating Station Recirculation Valve Interlock Modification, Rev. O, 8/30/85. (39) Letter from R. F. Wilson (GPUd) to J. A. Zwolinski (NRC) y dated January 30, 1986. (40) Letter from J. A. Zwolinski (NRC) to P, B. Fiedler (GPUN) j dated April 16, 1986. 3
- 198 - d j
P - Y - (41) Letter from J. N. Donohaw, Jr. (NRC) to P. B. Fiedler (GPUN) dated July 15, 1986, with attached Safety - Evaluation. (42) GPUN Request for Project Approval for "Recir. Valve Interlock Modification," Rev. 4, 2/14/86, B/A No. 402207.
** (43) GPUN Turnover Notification for the Recirculation Valve Interlock Modification dated 7/17/86.
L f (44) GPUN Division II System Design Description for the Oyster b # Creek Nuclear Generating Station Recirculation Valve Interlock Modification, Rev. 2, 1/29/86. (45) Dranetz Technologies Inc., System 22 Sequence of Events Recorder, TM-103700, Operation Manual, 3/1/84. T (46) NUREG-0737, "Clarification of TMI Action Plan i Requirements," November 1980, pp. iii-viii, 1-1, 1-10 (Item II.K.3.19) m [] (47) Letter from P. R. Clark (GPUN) to Dr. T. E. Murley (NRC) dated 9/20/87, with Attachments I, II, III. p jj (48) Oyster Creek Nuclear Generating Station Procedure 101, "Organization and Responsibility," Rev. 16, effective date _ 2/21/87. (49) Jersey Central Power & Light Co./IBEW Agreement and Supplements, November 1, 1985-October 31, 1987, pp. 1, 51-3 52. 't (50) Statement -- (UH), written September 17, 1987 (discussed in (HH] deposition, pp. 297-298) .P L (51) Memo from G44GGG to 2.Tztt.u,, dated March 21, 1985. ig (52) Memo from EEE EEEE E to Distribution, dated July 23, 1985. (53) Memo from ng ns to G GG 4CvG , dated July 25, i 1985. ! Wh d. (54) Memo from G4444G to m na dated August 1, 1985. R j lj (55) Preliminary Engineering Design Review (PEDR) Conference Notes, August 8, 1985. ri bj (56) Report of Ruben J. Echemendia, Ph.D., Licensed Clinical C-Psychologist (February 13, 1988). Q (57) Memo from 4GGGGG to ~L*LtT.11 . dated January 28, U 1986. I n
}} - 199 -
- s. .
,A _ . - _ - - ___-_________ _ - ____ - - - -
E N e V (58) GPUN Corporate Policy 1000-POL-2002.00, "Standards of , L Conduct," (eff. 5/15/86), pp. 1.0-2.0
.E (59) GPUN Corporate Policy 1000-ADM-2130.01, "Disciplinary k
~'
Guidelines," (eff. 5/2/85), pp. 1.0-6.0 n C 4 \
- I e'
L w b b u
.s e,
b. g l O r C. C E ele l Ti s' l . {. 4i T3 5l El
- 200 - "\
n 1
n , 7 1 I Table 1
~'
List of Witnesses
- 1 b Witness Date of Decosition (HH)
October 22, 1987
~
(SS) October 29, 1987 A
, [II) October 8, 1987 "4 December 3, 1987 (R) November 4, 1987 (TT) October 2, 1987 CANDELETTI, Glenn R. (Dr.) November 30, 1987 (E) October 13, 1987 d (G) October 2, 1987 (VV] October 23, 1987
]
(LL) October 15, 1987 l (A) October 27, 1987
.J (Y) October 2, 1987 m
j (X) October 6, 1987 (NN) October 16, 1987 e (P) October 7, 1987
} (AAA) October 13, 1987 ~*
[00) October 2,. 1987 i (RR). October 1, 1987 (MM) October 14, 1987 0 Lj (WW) October 5, 1987 p (S) October 1, 1987 s.. l (U) October 1, 1987 [] (T) October 13, 1987 U fl d - 201 -
\~)
Jr.
Q .
. lL Witness Date of Decosition -{
v
~~
(I) October 8, 1987
- December 4, 1987 ;-.
(ZZ) October 7, 1987 D December 3, 1987 E (0) October 15, 1987 13 (J) October 14, 1987 h E' [UU) October 15, 1987 [ (XX] October 1, 1987 IT E (QQ] October 16, 1987 I (PP) October 5, 1987 l} (N] November 4, 1987 y n (D) October 2, 1987 ei (CC] October 15, 1987 e
~
(H) October 1, 1987 (Q) October 13, 1987 ( l M d. ( {'
'Y R
wR { t i a
.Hj g r'
- l y
1: 1 d
- 202 - U
$)
.n}}