ML071580615
| ML071580615 | |
| Person / Time | |
|---|---|
| Site: | Indian Point  |
| Issue date: | 05/30/2007 |
| From: | Lochbaum D Union of Concerned Scientists |
| To: | Clinton H Office of Nuclear Reactor Regulation, US SEN, Comm on Environment & Public Works, US SEN, Subcomm on Clean Air & Nuclear Safety |
| References | |
| FOIA/PA-2008-0157, FOIA/PA-2008-0174, FOIA/PA-2008-0199, LTR-07-0397 | |
| Download: ML071580615 (8) | |
Text
OFFICE OF THE SECRETARY CORRESPONDENCE CONTROL TICKET Date Printed: Jun 06, 2007 10:21 PAPER NUMBER:
ACTION OFFICE:
AUTHOR:
AFFILIATION:
ADDRESSEE:
SUBJECT:
LTR-07-0397 LOGGING DATE: 06/05/2007 EDO
&I EDO S
DEDMRS Mr. David Lochbaum (UCS)
DEDR DEDIA DC AO SEN Hillary Clinton Iz.1.&c.-
Concerns the 4/25/07oversight hearing... options for restoring public confidence in the NRC's oversight of Indiani Point ACTION:
DISTRIBUTION:
LETTER DATE:
Information RF 05/30/2007 ACKNOWLEDGED SPECIAL HANDLING:
NOTES:
FILE LOCATION:
No Immediate release to the public via SECY/EDO/DPC OCM #1139 ADAMS DATE DUE:
DATE SIGNED:
Union of Concerned Scientists Citizens and Scientists for Environmental Solutions May 30, 2007 The Honorable Hillary Rodham Clinton Subcommittee on Clean Air and Nuclear Safety
--4 i
Committee on Environment and Public Works United States Senate 7
Washington, D.C. 20510
Dear Senator Clinton:
We followed the April. 25th oversight hearing with considerable interest, particularly the discussion regarding the options for restoring public confidence in the Nuclear Regulatory Commission's oversight of the Indian Point nuclear plant. The two leading options are the Independent Safety Assessment (ISA) like that performed by. NRC at. Maine Yankee and the Componrn* De.sign_ Basei inhspection (CDB0).-.nd vreactor oversight process (ROP) currently performed, by NRC at all-:operating 'nuclear-power plants. -Fromc our perspectiVe,,eith~er' tool properly applied can be successful. And both tools will be unsuccessful when used improperly.
Congress needs to ensure that NRC's efforts attain safe outcomes whatever inspection tool the agency opts toapply.
WHAT ISAs ANDwCDBIs CAiNbTl Do Neither an ISA nor a CDBI can provide a nuclear plant with a clean bill of health or even a complete list of its safety*deficienicies for the simple reason that both are very limited scope audits,. Each looks at mliaybe fouri 'sfety `sytinf' out of nearly fiPVe 'doen safety'stsierfis. And each* o'fnly hexariunesh a. small handful,' of 6mlOnents. from-r tihe;four-' salected systems.
Cohsequently, iheither -aifi ISA -hor a--CDBI can" hn6estly conclude thefour s ety-systemsIare problem-free, yet alonie c-offimenit o1n-the" o'.ralls`afet, level of the-'fintiree facility.;
WHAT ISAs AND CDBIs CAN Do While unable to address safety concerns outside their purview, both an ISA and a CDBI can provide insights regarding how a. nuclear power plant has been designed, maintained, and operated. While ISAs and CDBIs do not look. at every.-component, the few components examifiid"ide' dhiie'with 66nsiderabl Uatentfi6onto ýdetail. 'If 'fie ared -programmatit desigh.
maintenance,;.-aifiod!6r operational pioblehfis, an ISAor
'aCDBI are likelyto findthem. The ISA will: likelyidoeufinent more examples becaius" f ýi[ts larger res'ofrces;:but each 'cai identify programmatic problems'i*f thfey xist.
i-:;.
WHAT CBDI DID DO AT INDIAN POINT On March 30, 2007, the NRC issued Inspection Report 50-247/200707 for its CDBI at Indian Point: Unit 2. As best we can tell from publicly available documents, it was the 22 nd CDBI Washiington Office: 1707 H Street NW Suite 600 oWashington DC 20006-3919, 202-223-6133
- FAX: 202-223-'6162
- Cambridge Headquarters:.Two Brattle Square
- Cambridge MA 02238-9,105 9 617-547-5552
- FAX: 617-864-9405 California Off'ice: 2397 Shattuck Avenue Suite 203 "
Be1kele* CA 447'04-1567*
510-843-1872 FAX: 510-8 43-3785
/
J Jý j 7
May 30, 2007 Page 2 of 6 performed by the NRC since this new inspection procedure was implemented last year. The Indian Point CDBI examined only 19 components, 5 operator manual actions, and 6 operational experience issues (i.e., lessons learned elsewhere as applied at Indian Point) and produced 8 green findings. With the exception of Quad Cities (November 2006 with 12 green findings) and Palisades (February 2007 with 10 green findings), all other CDBIs resulted in fewer findings.
Given that a CDBI is approximately one-quarter the inspection effort of an ISA, one might reasonably infer-that an Indian Point ISA. would have yielded approximately 32 findings, four times the CDBI output. Or, the Indian Point CDBI did not find about 24 safety violations that likely would have been found by an ISA - and now fixed rather than remaining undetected.
WHAT ISAS AND CDBIs SHOULD Do The crux of the problem behind the year-plus shut downs at Indian Point and dozens of other nuclear power reactors is an inability to detect and evaluate safety deficiencies prior to NRC's involvement. Three existing layers of self-assessment already in place are intended to provide the needed protection against such safety deficiencies. ISAs and CDBIs should seek to make each of these existing protective layers as robust as possible.
Onlie Off4ine Real4r e, terAhe4act THREAT EVENT Defense Failed:,
77-7-,Emil lieppene 4:d Imaem etIneps:
en
.. ~
a work *roup A S*mp*e0iion Asiesment Asseismeet I ST Level
.2nd Level 3rd Level 4th LEVEL Of Defense; of Defense Of Defense Of Defense n
eia*4 objectivity, i ependeft", breadth of perspective, ahd Inleiation sapaeity..
8dereasing depth of review.
- 0
&~i am mR; uroo'ram~ NSI.C Cop,86M67,A~idoe4u.Ad An NRC inspector identifying a broken widget, a calculation error, or a non-conforming operational practice has actually identified two related but distinct problems. The first problem is the widget that must be repaired, the calculation that must be corrected, or the operational practice that must be remedied. The second problem is that the NRC inspector has discovered holes in three levels of defense. The first level of defense is qualified workers trained for tasks following pre-approved procedures to reach the right outcomes. The second level is management
May 30, 2007 Page 3 of 6 oversight monitoring workers to ensure they reach the right outcomes. The third level is independent assessments by internal auditors to verify the right outcomes were reached.
Collectively, the three levels are like an assembly line putting together design, maintenance, and operations elements to conform with NRC's safety regulations so as to manage risk to an acceptably low level.
No single level is assumed to be 100 percent effective. If so, the other two levels would not be necessary. The goal, is to have three highly effective, overlapping levels to make a safety problem eluding detection and correction as unlikely as possible. Some compare the levels to physical barriers with holes in them that allow problems to slip through. The goal is to have as few holes as possible, as small holes as possible, and few times when holes in all three barriers lineup as possible.
The NRC is the fourth level of defense. If any one of the first three levels worked, the NRC would not find anything. Put another way, an NRC inspector finds a problem only when all other levels failed. It is simply not enough for an NRC inspection finding to only result in the widget,.
calculation, or practice being corrected. The deficiencies in all three levels must also be found and fixed for the safety trend to be in the proper direction.
iSAs, CDBis,, and Safety Trends
/
S CDEI~
II ISA~
- ee G*
Time The chart illustrates the difference between simply treating the symptoms and fixing the underlying fault. ISAs make larger "course corrections" than CDBIs because they apply more resources to turn over more rocks and find more problems that are corrected. But if the assembly line itself remains unfixed (e.g., the red, dashed-line case), it continues to crank out bad outcomes along an adverse safety trend. As time passes, the backlog quickly builds, offset periodically by ISA and/or CDBI effort. On the other hand, when ISA and CDBI findings result
May 30, 2007 Page 4 of 6 in fixed problems and fixed processes, the steadily improving assembly line (e.g., the green, solid line) cannot help but yield a positive safety trend. As time passes, the repaired assembly line results in safety improvements supporting but outside of those attained through ISAs and/or CDBIs.
Even if an ISA or a CDBI successfully identified every single safety problem at a nuclear power plant, the current NRC practice for handling those identified problems would reset the risk value to its minimum level. Absent fixes to the flawed processes that generated all those safety problems, the defective assembly line would immediately start driving the risk higher and higher each passing day.
Today, when an NRC inspector finds a safety violation, the NRC does not ask why the worker qualification and training measures didn't prevent it (first level breakdown), or why management oversight didn't prevent it (second level breakdown), or why internal self-assessments didn 'tfind it-(third level breakdown). Again, all three levels had to fail for the NRC inspector to find a safety violation. Instead, the NRC - at best - only follows up to verify that the violation has been corrected. Thus, the NRC's efforts make minor incremental gains but do not ensure or verify that the overall safety trend is in the right direction. The NRC fails to realize the major gains that can be derived from the findings of its inspectors.
iThe ISA and the CDBI are not comprehensive determinations of a plant's safety level, but 7limited glimpses intow the safety culture at that moment in time. It is imperative that NRC
.maximize the value of its glimpses by using them as opportunities to fix identified process
,problems. That is the-intent of an audit. That must be the result.
- WHATYCDBI DID NOT DO AT INDIAN POINT IThe-CDBI at Indian Point identified eight green findings. The eight findings in the order listed in the NRC report:
- 1. Entergy "used a non-conservative method to calculate the level required to prevent [safety injection] pump vortexing, and used a non-conservative RWST [refueling water storage tank]
level value for determining available NPSH [net positive suction head] for the SI pumps."
When the calculation error was corrected, the safety margin was cut in half.,
2., Entergy "used an incorrect and nonrconservative differential pressure in the calculations for MOV [motor-operated valve] 746 and MOV 747, which were developed to verify that the valves could develop sufficient thrust to open under postulated design basis conditions.
Additionally, an incorrect equation was used in determining the reduction in motor torque due to degraded voltage conditions." The calculation error was made nearly 10 years ago (October 24, 1997).
- 3. Entergy "did not establish adequate design control measures to ensure the availability of the turbine driven auxiliary feedwater pump (TDAFWP) during a postulated loss-of-offsite power (LOOP) event... [in that] a calculation to determine the auxiliary feedwater pump (AFWP) room temperature rise during a LOOP did not include heat input from the TDAFWP." The calculation error was made over 9 years ago (February 13, 1998).
A May 30, 2007 Page 5 of 6
- 4. Entergy "did not establish appropriate GT [gas turbine] reliability goals, and therefore did not take corrective actions, when GT-1 had exceeded these goals for maintenance preventable functions failures (MPFF)." The MPFF reliability goal was established at 5 failures back when the gas turbines were used both as a safety backup and for generating electricity during peak demand periods. In 2000, Indian Point stopped using the gas turbines to meet peak demands, dropping the average number of starts per 24-month interval from 82 to less than
- 40. But the MPFF goal was maintained at 5 and not adjusted down to 2 to match the revised usage pattern. The gas turbine system "failed to achieve the established reliability goals, availability goals, or both during the past ten years."
- 5. Entergy "failed to take corrective actions to address degraded GT-1 reliability. This resulted in a two and one half day time period in January 2007 when GT-1 and GT-3 were simultaneously inoperable because, after GT-3 was made inoperable for planned maintenance activities, GT-1 was subsequently found to be inoperable."
- 6. Entergy "did not perform station battery capacity testing in accordance with IEEE Standard 450-1995."
- 7.,Entergy "did not take effective corrective actions for a condition adverse to quality
'.concerning out-of-tolerance inter-tier resistances on the No. 21 station battery... [in that]
%after repeated failures-of the No. 21 station battery inter-tier resistance testing, vendor and
'-,IEEE Standard 450-1.995 recommended corrective actions were not taken to correct the
'nadverse 'out-of-tolerance resistance trend." The 'inter-tier connections had failed the
,.resistance test for eachof the last four years... [and] the inter-tier connection between cells
ý40 and 41, which failed all four years."
- 8. Entergy 11did not recognize that the appropriate time the need to write a condition report, perform an operability determination, or place controls on the use of the No. 23 battery design calculations when errors were discovered in the No. 23 battery design calculations that significantly lowered the battery capacity margin." Entergy received the design
'calculations in April 2006.
The NRC's CDBI chronicled longstanding safety violations dating back at least a decade. The CDBI, documented repetitive failures representing numerous missed opportunities to right wrongs. And the CDBI provided zero basis for believing these were isolated safety violations and that the thousands of other safety components in the dozes of other safety systems would be free from similar, or worseviolations.
For each of the eight CDBI findings, the NRC reported that "Entergy entered the issue into their corrective action program." The corrective action program is mandated by NRC's regulations (specifically, Appendix B to 10 CFR Part 50) to find and fix problems in a timely and effective manner. Every single one of the NRC's findings represents a failure to find a problem and many of them entail failures to fix problems in a timely and effective manner. Individually and collectively, the NRC's findings represent prima facie evidence of a corrective action program breakdown at Indian Point. And the NRC allows Entergy to get away with entering the NRC's
IP May 30, 2007 Page 6 of 6 findings into the corrective action program just proven beyond any reasonable doubt to be impaired. That's an unacceptable safety practice that explains why the situation at Indian Point never seems to tangibly improve. The NRC's treatments never cure the underlying disease. The NRC's findings failed to induce Entergy to seek out and patch the holes in the three existing protection layers. Consequently, more safety problems will find their way through those holes tomorrow, the day after tomorrow, and every day the reactors operate. The NRC should have forced those holes to be patched so that in addition to the small handful of safety problems identified by the CDBI being fixed, bucketfuls of future safety problems would have been prevented. That is the proper role for a safety regulator relying on periodic audits of very limited scope. It is the role the NRC must assume if the inherent risk from nuclear reactor operation is to be responsibly managed.
WHAT INDIAN POINT, AND EVERY OTHER US NUCLEAR POWER REACTOR, NEEDS The NRC's fundamental approach to reactor safety oversight must be reformed by Congressional guidance either through hearings or by legislation. Whether ISAs or CDBIs are used, the NRC must alter how it handles findings by its inspectors. The company's response to NRC's findings must bring about the much-needed repairs to defective assembly lines. Doing so will very prevent the. adverse safety trends that produced unnecessarily high risks and costs at Davis-Besse, Millstone, Salem, and so many other facilities over the years. It is the safe, economical, and responsible thing to do. And now is the second best time to do it.
Sincerely, David Lochbaum Director, Nuclear Safety Project cc:
Dr. Dale Klein, Chairman U.S. Nuclear Regulatory Commission
Union of Concerned Scientists 1707 H Street NW Suite 600
- Washington, OC 20006-3919 Ný2; W*BOVE-02 IF 90002335424 MAY31 2007 MAILED FROM ZIP CODE 20006 Cj-j%%Z1C-235NLP Vte-
- ll iI;IIIa..iiIiIiiId a IIuIIiIIhaIiliIIJIaII I III III II