10/20/02

Ever since a remote-controlled repair machine stumbled upon a gaping acid hole in the lid of FirstEnergy Corp.'s dormant nuclear reactor last March, a haunting question has lingered: Could Davis-Besse have become the next Three Mile Island?

"How close were we to disaster?" wondered veteran engineer and Nuclear Regulatory Commission adviser Thomas Kress at an agency meeting in June, voicing what the plant's neighbors, regulators, industry experts and company officials have wrestled with for seven months.

The short answer, according to numerous people knowledgeable about the unprecedented corrosion damage, is that Davis-Besse was the most serious American nuclear plant near miss in the last two decades.

If operators had fired up the reactor after its refueling shutdown without finding the pineapple-sized hole, a major accident was only a matter of time.

Assuming that the jagged cavity had continued to rapidly widen, FirstEnergy's own analysis indicates the thin stainless steel liner beneath it was about two years away from rupturing under normal conditions.

Already the liner - never meant to be a pressure barrier - was bulging from the one ton-per-inch strain of holding the reactor's vital coolant.

Had there been a major accident, the company insists it could have safely shut down the reactor. The sturdy containment building would have kept radiation inside the plant, FirstEnergy's analysis shows, so residents wouldn't have been harmed.

But "clearly, the probability of this event creating a loss-of-coolant accident was . . . high in relative terms," said NRC deputy engineering director William Dean, referring to the scenario operators fear because it threatens to unleash the hellish core.

Defining how near the miss was, though, and gauging the outcome of an accident, is proving especially difficult.

Pursuing the answers has taken analysts down a rabbit warren of what-ifs, some that have not been explored before.

Along with FirstEnergy, the NRC concludes that a lid rupture wouldn't have jeopardized the public, relying in part on the company's analysis and the belief that Davis-Besse's reactor operators and equipment would perform as they should.

"It's a unique place to get a hole," Dean said. "But the plant's designed to encompass that sort of accident. Does that mean core damage would have occurred? Probably not, unless you have failures of safety equipment, operator errors."

Dean is on the NRC team assessing the plant's condition.

Some independent experts are less certain than FirstEnergy of the plant's ability to safely shut down had the weakened lid section unexpectedly burst and sent jets of steam and shrapnel into the reactor's control rods above.

"If you have a major blowout of hot, radioactive water in the vicinity of the control equipment, it's not a given that all is going to work properly," said Hal Ornstein, a 28-year NRC veteran who now is a forensic engineer for a private firm. "It hasn't been proven that the [reactor] operators, even if they got all the signals, would know what to do."

FirstEnergy acknowledges the consequence of a loss-of-coolant accident would be "a more significant cleanup" than the $220 million-plus work the company has incurred just from the corrosion repairs and lid replacement, said nuclear division engineering director James Powers.

Left unsaid by the utility, though, is that the accident likely would have been financially catastrophic for its Toledo-area plant and a public-relations disaster for the nuclear industry. Even if the violent geyser of coolant from the reactor was handled properly and nothing else went wrong, it would rank as the second-worst event in U.S. nuclear history, behind the partial meltdown at Three Mile Island in 1979.

"Even something less than TMI would be a permanent shutdown" for Davis-Besse, said nuclear engineer and safety consultant William Corcoran. If the lid had ruptured and spilled a large amount of coolant, "that plant would not be useful anymore."

While two years from a blowout may sound like a long time, the Davis-Besse acid hole already had been festering unnoticed since at least 1998. Plant officials missed it then and again in 2000 while supposedly doing thorough lid inspections during refueling shutdowns. So did NRC personnel who reviewed the inspection reports and photos in 2001.

When workers found the hole by what FirstEnergy executive Steven Loehlein acknowledged was "happenstance," the plant was gearing up for a two-year-long operating run, during which the lid normally isn't inspected.

Additionally, FirstEnergy's confidence is based on the lid's liner being in perfect condition. It was not.

New tests last month have shown it was cracked, and thinner than expected. Those findings are forcing the company and its consultants to consider revising their doomsday calculus.

The NRC is struggling with its own problems - how to decide the severity of a condition not seen before; one that could have, but didn't, lead to catastrophe.

Core damage ahead?

The steel pot that holds the reactor's fuel core, lid atop it, and the piping that supplies it are supposed to remain sealed, so coolant can't escape.

If the fuel rods were left uncovered long enough, they could partially or completely melt. In the most extreme case, if emergency systems failed, the molten fuel could cause an explosion that jeopardized the containment building. Or it could bore through the steel and concrete floor below the reactor, hitting groundwater and causing disastrous blasts of radioactive steam.

Such a full-blown, uncontained meltdown, which has never happened, would contaminate the environment around the plant and cause injuries or deaths downwind if airborne radiation levels were high.

A 1982 study for the NRC of the consequences of a worst-case meltdown at individual nuclear plants showed that around Davis-Besse there would be 1,400 radiation deaths in the first year; 73,000 radiation-related injuries; 10,000 long-term cancer deaths; and an economic cost of $154 billion in today's dollars.

No one has suggested that Davis-Besse was anywhere near a meltdown. There are emergency systems to keep the core supplied with water, and reactor operators practice responding to accidents. When the hole was found, Davis-Besse was shut down for refueling, so on that day, there was zero accident risk.

But the plant had been running at full power before the discovery, and was supposed to again in a matter of weeks. That meant the chance of a loss-of-coolant accident, or LOCA - the possible precursor to a meltdown - had existed, and probably would have again.

What kept that from happening was a layer of stainless steel about as thick as a yellow legal pad. This cladding covers the inside of the reactor pot and lid, like the plastic liner in a pickup truck bed. It keeps coolant away from the carbon steel vessel. The water, laced with the chemical boron to sustain the nuclear reaction, is mildly acidic. But if it evaporates and the boric-acid crystals left behind get wet again, the concentrated sludge can devour carbon steel.

At Davis-Besse some of the coolant had leaked onto the outside of the hot reactor lid, where there is no protective liner. It got there by seeping through stress cracks that had formed in some of the 69 metal sleeves that penetrate the lid. The sleeves are pathways for the long control rods that dip in and out of the reactor core to regulate the nuclear reaction. The rods slide through the lid nozzles like a straw in the plastic top of a soft-drink cup.

The leaking coolant pooled on the lid, obscured by insulation and scaffolding. A thick, molten layer of acid built up, eventually dissolving a 35-pound hunk of steel. The exposed patch of liner at the bottom of the hole was about the size of a CD case.

The lid is built to withstand the high pressure in the core. It is 6.6 inches of steel, thicker than the Cleveland White and Yellow Pages plus Webster's New World Dictionary. The liner is less than a quarter-inch.

At first it flexed without losing shape. Eventually it permanently deformed, bulging upward into the acid hole about an eighth of an inch - a sign of significant stress, engineers say.

FirstEnergy's contractors made a 3-D computer model of the liner to test its durability in various conditions. No computer can perfectly mimic such a complex situation, so the engineers had to simplify some aspects.

The model showed that, with a hole the size found in March, the liner could have withstood up to 5,600 pounds per square inch - far more pressure than Davis-Besse's reactor has ever experienced. Relief valves would have tripped, and the lid would have warped enough to vent around its edges, before the liner would have given way, the company's engineers determined.

But the hole was widening when it was found, the corrosion still at work. FirstEnergy estimates the loss at two inches per year. The NRC says the uncertainties make growth-rate prediction unreliable. So while the company estimates the hole would have been big enough in two years for the liner to fail, the NRC won't make such a call.

FirstEnergy's modeling was done before last month's finding that the liner was cracked and slightly thinner than expected. While the model took into account dimensions even thinner than what was found, the cracking is a different story. Metallurgists must learn if and how it might have affected the liner's strength, Powers said, before knowing whether the model's predictions will change.

A reactor's lid is massive, as heavy as an empty Boeing 767 and big enough to cover a one-car garage. The prospect of this next-to-last barrier between the highly radioactive reactor core and the outside world giving way was considered so unlikely it had never been examined in depth.

FirstEnergy and its contractors had to base their assessment of what would have happened on what's known about the physical properties of the materials involved, on calculations of pressure and force, and on the known outcome when steam pipes have broken in other locations.

They didn't know whether the breach in the lid's liner would be pinhole-sized or an immediate, wide-open split. At worst, they assumed the control rod nozzle next to the acid hole might tear loose, opening an even bigger rent in the lid.

The sudden pressure drop as the coolant spilled out would automatically trigger emergency pumps that draw borated water from a half-million-gallon storage tank. Eventually, the amount of coolant pumped into the core would overtake the amount flowing out, allowing the big pot to begin to refill.

But in less than an hour, depending on the size of the lid hole, the huge tank would empty, tripping two smaller tanks to dump water into the core. When the stored water was exhausted, the reactor operators would have to manually turn on emergency sump pumps to suck spilled coolant from the bottom of the containment building and shoot it back into the vessel to keep the fuel rods from overheating.

The uncertainties in that nightmarish scenario are:

Would the control rods, which are supposed to automatically drop into the core to stop the nuclear reaction, be damaged by the explosive liner rupture?

Would the emergency sump become clogged with debris?

Would the reactor's operators take the right actions?

FirstEnergy's analysis judged that the nozzle next to the hole, and the control rod that passes through it, might be ejected when the liner burst, shooting straight up.

By the time it crash-landed, though, the grips holding the other control rods would automatically have opened, and in seconds gravity would have pulled them safely through the lid nozzles and into the core to halt the nuclear reaction, the analysis determined.

Even if as many as six of the control rods got stuck, the remaining ones would absorb enough energy to stop the nuclear reaction, the company's analysis concluded.

The only way none of the rods would have worked is if the huge lid shifted or the steel gantry surrounding the rods' drive mechanisms tipped. "I can't come up with a logical scenario" where all the rods jammed, said the NRC's Jack Grobe, who is overseeing repairs at the crippled plant.

Debris worries

It's the debris from the lid rupture that worries some experts, and the NRC, too.

Inches above the lid is a layer of shiny metal insulation, meant to help contain the reactor's intense heat. The explosive jet of steam when the liner burst would pack more than 20 times the punch of water spewing from a fire hose. It would shatter the metal insulation, as well as blast off paint chips and concrete shards in its path.

That flotsam, along with anything else loose in the containment building, could end up in the soup of spilled coolant sloshing around the floor. Some of the junk would flow to the grate over the emergency sump. If more than half the screen was blocked, the pumps couldn't return enough water to the core to prevent overheating.

In that case, with the plant's internal storage tanks emptied, the reactor operators would have to draw in outside water to cool the fuel rods. With a clogged sump, rising water in the containment building would begin to submerge motors and electrical equipment "that don't work too good underwater," said David Lochbaum, a 17-year nuclear plant veteran who is now a nuclear safety engineer with the Union of Concerned Scientists.

Also, if enough control rods are jammed, the non-borated municipal water might enable the nuclear process to start up again, Lochbaum said, undermining the reactor's shutdown.

Reactor operators would have to decide whether to shut off the water and risk overheating the core, or leave it flowing and risk restarting the nuclear reaction, Lochbaum said. "It's a question of which eye you want to be poked in."

The NRC says clogging is a "credible concern," but hasn't decided what action to take.

An NRC study last year rated sump blockage at Davis-Besse unlikely in a medium loss-of-coolant accident like the liner rupture, but very likely if the break was larger.

Powers, FirstEnergy's engineering director, said the structure surrounding the top of the reactor would likely contain the pieces of insulation, keeping them from falling to the floor and being swept to the emergency sump.

Still, Davis-Besse workers are making the plant's sump five times larger, so it will take much more debris to render it useless. And embarrassed managers this summer ordered that nails, screws, duct tape, wire ties and other trash that had accumulated on the floor be cleaned up.

Nuclear plants are highly automated, with computers controlling the numerous emergency backup systems. But in any accident, it is up to the reactor's human operators to oversee the situation and keep it under control.

The operators, at least six per shift at Davis-Besse, undergo extensive training to earn their licenses, and drill every few weeks in the plant's control room simulator, including reviewing various accident scenarios.

Although they don't practice responding to a lid rupture, Powers said, "the consequences would be very similar to the small steam line breaks that the operators are trained on."

For all their training, though, it is operators who caused or made worse the most serious nuclear accidents. Some experts say the unexpectedness of a lid breach would make it tough to quickly diagnose.

"It would have presented a challenge for a while to know how to deal with it," said Harold Denton, the former head of the NRC's reactor regulation branch and the man President Carter dispatched to manage the Three Mile Island crisis. "(Davis-Besse) was very nearly a substantial loss-of-coolant accident. These are extremely rare events. There's no way of knowing how it would turn out."

"A head rupture isn't in their [reactor operators'] vocabulary," said Ornstein, the former NRC accident-potential analyst. A sudden lid rupture "would probably give the operators fits in terms of what's happening and trying to recover from it."

To their credit, Davis-Besse's controllers performed well when a tornado in 1997 knocked out the plant's power and some of its backup equipment didn't work properly, Lochbaum said.

But a lid rupture would have been far more complex. "Months later, we are still trying to figure out what we had" at Davis-Besse, said Lochbaum. "If you compress that down to real time, to guys making decisions with all that is happening . . . it is a difficult environment to work under."

As they debate the scenarios of what might have happened, NRC analysts are still struggling with how to assess the overall "safety significance" of the hole in the lid, especially the fact that the liner held, even though it was not designed to withstand pressure.

If they give the liner credit for holding, their own formula may show that the Davis-Besse situation was of very low significance. To many in the NRC, this flies in the face of good sense, which tells them Davis-Besse was a serious violation of safety standards.

Dean argues that, since the NRC has taken effective control of the reactor, the determination is largely moot. "We've telegraphed that this is something of the highest significance," he said.

For complete coverage of Davis-Besse, go to www.cleveland.com/davisbesse/

To reach these Plain Dealer reporters:

jmangels@plaind.com, 216-999-4842

jfunk@plaind.com, 216-999-4138