ML19210C332
| ML19210C332 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 10/22/1979 |
| From: | Weiss E SHELDON, HARMON & WEISS, UNION OF CONCERNED SCIENTISTS |
| To: | Atomic Safety and Licensing Board Panel |
| References | |
| NUDOCS 7911140081 | |
| Download: ML19210C332 (14) | |
Text
-.
4 NRC PUBLIC DOCU. meg gqq)y g$
UNITED STATES OF AMERICA 3
f L-O[ r[d'
' ~
k t
NUCLEAR REGULATORY COMMISSION N
' #/
q$> <
y' v
)
QlP In the Matter of
)
)
METROPOLITAN EDISON COMPANY
) Docket No. 50-289
)
Three Mile Island Nuclear Station, Unit
)
No. 1
)
)
FINAL CONTENTIONS OF THE UNION OF CONCERNED SCIENTISTS The Union of Concerned Scientists (UCS) contends that neither the short or long term measures recommended by the Director of Nuclear Reactor Regulation are sufficient to provide reasonable assurance that the Three Mile Island Unit 1 ("TMI-1") facility can be operated without endanger-ing the health and safety of the public and that each of the following contentions must be satisfactorily resolved prior to resumption of operation.
1.
The accident at Three Mile Island Unit 2 demonstrated that reliance on natural circulation to remove decay heat is inadequate.
During the accident, it was necessary to operate at least one reactor coolant pump to provide forced cooling of the fuel.
However, neither the short nor long term measures would provide a reliable method for forced cooling of the reactor in the event of a small loss-of-coolant accident ("LOCA"). This is a threat to health and safety and a violation of both General Design Criterion ("GDC") 34 and GDC 35 of 10 CFR Part 50, Appendix A.
1 288 7911140 O b (r,
2.
Using existing equipment at TMI-1, there are only 3 ways of providing forced cooling of the reactor:
1) the reactor coolant pumps ; 2) the residual heat removal system; and 3) the emergency core cooling system in a " bleed and feed" mo,de.
None of these methods meets the NRC's regula-tions applicable to systems important to safety and is sufficiently reliable to protect public health and safety:
a)
The reactor coolant pumps do not have an on-site power supply (GDC 17), their controls do not meet IEEE 279 (10 CFR 50.55a(h)) and they are not seismically and environmentally qualified (GDC 2 and 4).
b)
The residual heat removal system is incapable of being utilized at the design pressure of the primary system.
c)
The emergency core cooling system cannot be operated in the bleed and feed mode for the necessary period of time because of inadequate capacity and radiation shielding for the storage of the radioactive water bled from the primary coolant system.
3.
The staff recognizes that pressurizer heaters and associated controls are necessary to maintain natural circula-tion at hot stand-by conditions.
Therefore, this equipment should be classified as " components important to safety" and required to meet all applicable safety-grade design criteria, including but not limited to diversity (GDC 22), seismic and environmental qualification (GDC 2 and 4), automatic initiation 1 289 (GDC 20), separation and independence (GDC 3 and 22 ), quality assurance (GDC 1), adequate, reliable on-site power supplies (GDC 17) and the single failure criterion.
The staff's proposal to connect these heaters te the present on-site emergency power supplies does not provide an equivalent or acceptable level of protee'.lon.
4.
Rather than classifying the presurrizer heaters as safety-grade, the staff has proposed simply to add the pressuri-zer heaters to the on-site emergency power supplies.
It has not been demonstrated that this will not degrade the capacity, capability and reliability of these power supplies in viola-tion of GDC 17.
Such a demonstration is required to assure protection of public health and safety.
5.
Proper operation of power operated relief valves, asso-ciated block valves and the instruments and controls for these valves is essential to mitigate the consequences of accidents.
In addition, their failure can cause or aggravate a LOCA.
Therefore, these valves must be classified as components important to safety and required to meet all safety-grade design criteria.
6.
Reactor coolant system relief and safety valves form part of the reactor coolant system pressure boundary.
Appro-priate qualification testing has not been done to verify the capability of these valves to function during normal, transient and accident conditions.
In the absence of such testing and verification, compliance with GDC 1, 14, 15 and 30 cannot be found and public health and safety is endangered.
1 290 7.
NRC regulations require instrumentation to monitor variables as appropriate to ensure adequate safety (GDC 13 and that the instrumentation shall directly measure the desired variable.
IEEE 279, 54.8, as incorporated in 10 CFR 50.55a(h),
states that:
To the extent feasible and practical protection system inputs shall be derived from signals which are direct measures of the desired variables.
TMI-l has no capability to directly measure the water level in the fuel assemblies.
The absence of such instrumentation delayed recognition of a low water level condition in the reactor for a long period of time.
Nothing proposed by the staff would require a direct measure of water level or provide an equivalent level of protection.
The absence of such instrumentation poses a threat to public health and safety, i
8.
10 CFR 50.46 requires analysis of ECCS performance "for a number of postulated loss-of-coolant accidents of different sizes, locations, and other properties sufficient to provide ass urance that the entire spectrum of postulated loss-of-coolant accidents is covered."
For the spectrum of LOCA's, specific parameters are r.ot co be exceeded.
At TMI, certain of these were exceeded.
For example, the peak cladding temperature exceeded 2200* fahrenheit (50.46(b)(1)), and more than 1% of the cladding reacted with water or steam to produce hydrogen (50.46(b)
(3)).
The measures proposed by the staff address primarily the very specific case of a stuck-open power operated relief valve.
However, any other small LOCA could lead to the same consequences.
Additional analyses to show that there is adequate protection for the entire spectrum of small break locations have not been 1
291 performed.
Therefore, there is no basis for finding compliance with 10 CFR 50. 4 6 and GDC 3 5.
None of the corrective actions to date have fully addressed the demonstrated inadequacy of protection against small LOCA's.
9.
The accident at TMI-2 was substantially aggravated by the fact that the plant was operated with a safety system inoperable, to wit:
two auxiliary feedwater system valves were closed which should have been open.
The principal reason why this condition 3xisted was that TMI does not have an adequate system to inform the operator that a safety system has been deliberately disabled.
To adequately protect the health and safety of the public, a system meeting the Regulatcry Position of Reg. Guide 1.47 or providing equivalent protection is required.
10.
The design of the safety systems at TMI is such that the operator can prevent the completion of a safety function which is initiated automatically; to wit:
the operator can
( and did ) shut off the emergency core cooling system prematurely.
This violates S4.16 of IEEE 279 as incorporated in 10 CFR 50.55 (a)(h) which states:
The protection system shall be so designed that, once initiated, a protection system action shall go to completion.
The design must be modified so that no operator action can prevent the completion of a safety function once initiated.
11.
The design of the hydrogen control system at TMI was based upon the assumption that the amount of fuel cladding that could react chemically to produce hydrogen would, under 1 292 all circumstances, be limited to less than 5%.
The accident demonstrated both that this assumption is not justified and that it is not conservative to assume anything less than the worst case.
Therefore, the hydrogen control systems should be designed on the assumption that 100% of the cladding reacts to produce hydroget.
12.
The accident demonstrated that the severity of the envircnment in which equipment important to safety must operate was underestimated and that equipment previously deemed to be environmentally qualified failed.
One example was the preneurizer level instruments.
The environmental qualification of safety-related equipment at TMI is deficient in three respects : 1) the parameters of the relevant accident environment have not been identified 2) the length of time the equipment must operata in the environment has been underestimated and 3) the methods used to qualify the equipment are not adequate to give reasonable assurances that the equipment will rema.n operable. TMI-1 should not be permitted i
to resume operation until all safety-related equipment has been demonstrated to be qualified to operate as required by GDC 4.
The criteria for determining qualification should be those set forth in Regulatory Guide 1.89 or equivalent.
13.
The design of TMI does not provide protection against so-called " Class 9" accidents.
There is no basis for concluding that such accidents are not credible.
- Indeed, the staff has conceded that the accident at Unit 2 falls within that classification.
Therefore, there is not reasonable
~
1 293 assurance that TMI-l can be operated without endangering the health and safety of the public.
14.
The accident demonstrated that there are systems and components presently classified as non-saf f.ty-related which can have an adverse effect on the int eg:lity of the core because they can directly or indirectly affect temperature, pressure, flow and/or reactivity.
This issue is discussed at length in Section 3. 2,
" System Design Requirements," of NUREG-0578, the TMI-2 Lessons Learn Task Force Report (Short Termi.
The following quote from page 18 of the report describes the problem:
There is another perspective on this question provided by the TMI-2 accident.
At TMI-2, operational problems with the conden-sate purification system led to a loss of feedwater and initiated the sequence of events that eventually resulted in damage to the core.
Several nonsafety systems were used at various times in the mitigation of the accident in ways not considered in the safety analysis; for example, long-term maintenance of core flow and cooling with the steam generaters and the reactor coolant pumps.
The present classifica-tion system does not adequately recognize either of these kinds of ef fe<:ts that nonsafety system can have on the safety of the plant.
Thus, requirements for nonsafety systems may be needed to reduce the frequency of occur-rence of events that initiate or adversly affect transients and accidents, and other requirements may be needed to improve the current capability for use of nonsafety systems during transient or accident situations. In its work in this area, the Task Force will include a more realistic assessment of the interaction between operators and systems.
The Staff's proposes to study the problem further.
This is not a sufficient answer.
Al'. systems and components which can either cause or aggravate an accident or can be called 1 294 upon to mitigate an accident must be identified and classified as components important to safety and required to meet all safety-grade design criteria.
15.
The measures identified by the staff in NUREG-05 78 and the Commission's Order of August 9, 1979 include many which will not be implemented until after the plant has resumed operation and some which will not even be identified until some unspeci-fled time in the future.
No justification has been provided for concluding that the plant can safely operate in the period while these corrective actions are being identified and prior to their implementation.
The public health and safety demands that all safety problems identified by the accident be corrected prior to resumption of operation at TMI-1.
10.
The events at TMI-2 showed the inadequacy of NRC emergency planning requirements.
Emergency planning beyond the LPZ is a recognition of the residual risk associated with majc; reaccor accidents whose consequences could exceed those
~
associated with so-called design basis events.
Such planning should be based on a worst case analysis of the potential accident consequences of a core melt with breach of containment.
The public health and safety requires that there be in place prior to restart of TMI-l a feasible plan to evacuate the public in the event of such an accident.
17.
The accident at TMI-2 was caused or aggravated by factors which are under study as so-called " generic unresolved safety issues."
For example, interaction between non-safety 1 295
-9_
and safety systems created demands on the safety systems that eyOLeded the latter's design basis.
This problem is listed as A-17 in NUREG-0410 and is more fully described therein as well as in Appendix A-17/1 of testimony dated September 27, 1978 of staff members Aycock, Crocker and Thomas in Docket Nos. STM 50-556, 50-557, Public Service Co. of Oklahoma et. al.
(Black Fox Station, Units 1 and 2) (horeinafter " Black Fox testimony").
At TMI-2, the failures of the pressurizer power operated relief valve and the condensate system, both non-safety systems were principle contributors to the accident.
Another example of an unresolved safety problem directly involved at TMI-2 is A-24, " Qualification of Class IE Safety-Related Equipment," found at Appendix A-24/1 of the Black Fox testimony.
The pressurizer level instruments which failed at TMI-2 were previously deemed to be qualified to function in the acciden environment.
The Appeal Board in Virginia Electric and Pc,._c Co. (North Anna Nuclear Power Station, Units 1 and 2), ALAB-491, 8 NRC 245 (1978) ruled that, as a requirement for the issuance of an operating license, the record must demonstrate either that each applicable generic safety issue has bqen resolved for the parti-cular reactor or the existence of measures employed at the plant to compensate for the lack of a solution to the problem.
There is a clear need for this procedure to be undertaken prior to resumption of operation at TMI-1.
The public health and safety requires a findina tnat each applicable unresolved safety problem
~
l 296 at TMI-l has been addressed.*
18.
The accident at TMI-2 was caused or aggravated by factors which are the subject of Regulatory Guides not used in the design of TMI.
For example, the absence of an auto-matic indication system as required by Regulatory Guide 1.4 7 contributed to operation of the plant with the auxiliary feed-water svstem completely disabled.
The public health and safety requires that this record demonstrate conformance with each Regulatory Guide presently applicable to plants of the same type as TMI-1.or an equivalent level of protection.
19.
The design of TMI-l does not comply with the Commission's regulations concerning fire protection, including GDC 3.
The NRC staff has concluded that safety system modificatious to implement an alternate shutdown system are required for TMI-1.
The modifications are required because of a few specific plant locations where the staff does not have reasonable assurance that a postulated fire will not damage both redundant divisions of shutdown systems.
Therefore, unless these mod '.fi-cations are implemented and Tound to comply with all applicable Commission regulations, opec, tion of TMI-l will endanger public health and safety.
20.
Neither Metropolitan Edison nor the NRC staff has presented an accurate assessment of the risks posed by operation of Three Mile Island Unit 1, contrary to the requirements of
- The generic issues relevant to TMI-l are those in NUREG-0410 which are designated by the staff in the Black Fox testimony as applicable to either all LWR's, all PWR's or all Babcock &
Wilcox reactors.
1 297 10 CFR 51.20(a) and 51. 2 0 ( d ).
The decision to issue the opera-ting license did not consider the consequences of so-called Class 9 accidents, particularly core meltdown with breach of containment.
These accidents were deered to have a low probabi-lity of occurrence.
The Reactor Safety Study, WASH-1400, was an attempt to demonstrate that the actual risk from Class 9 accidents is very low.
However, the Commission has stated that it "does not regard as reliable the Reactor Safety Study's numerical estimate of the overall risk of reactor accident." (NRC State-ment of Risk Assessment and the Reactor Safety Study Report (WASH-14 00 ) in Light of the Risk Assessment Review Group Report, January 18, 1979.)
The withdrawal of NRC's endorsement of the Reactor Safety Study and its findings leaves no technical basis for concluding that the actual risk is low enough to justify operation of Three Mile Island Unit 1.
3y the Union of Concerned Scientists By:
Ehlyn R.
Weiss SHELDON, HARMON & WEISS 1725 I Street, N.W.
Suite 506 Washington, D.C.
20006 (202) 833-9070 DATED:
October 22, 1979
~
l 298
UNITED STATES OF AMERICA NUCLEAR REGULATORY COIciISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of
)
)
METROPOLITAN EDISON COMPANY,
)
et al.,
)
Docket No. 50-289 (TEree Mile Island Nuclear
)
Station, Unit No. 1
)
)
CERTIFICATE OF SERVICE I hereby certify that a copy of the " Final Contentions of the Union of Concerned Scientists" were mailed postage pre-paid first class this 22nd day of October, 1979 to the following parties:
Secretary of the Commission (21)
U.S. Nuclear Regulatory Commission Washington, D.C. 20555 ATTN:
Chief, Docketing & Service Section James A. Tourtellotte, Esquire (4)
Office of the Executive Legal Director U.S. Nuclear. Regulatory Commission Washington, D.C. 20555 Mr. Steven C.
Sholly 304 South Market Street Mechanicsburg, PA. 17055 Jordan D. Cunningham, Esquire Fox, Farr & Cunningham 232 0 North Second Street Harrisburg, PA. 17110 Karin W. Carter, Esquire Assistant Attorney General 505 Executive House P.O. Box 2357 Harrisburg, PA. 17120 Frieda Berryhill Coalition for Nuclear Power Postponement 2610 Grendon Drive Wilmington, Delaware 19808
~'
I 299
_2_
Cert. of Service Docket No. 50-289 Ms. Holly S. Keck Anti-Nuclear Group Representing York 245 W. Philadelphia Street York, PA. 17404 Walter W. Cohen, consumer Advocate Department of Justice Strawberry Square, 14th Floor Harrisburg, PA. 17127 Robert L. Knupp, Esquire Assistant Solicitor County of Dauphin P.O. Box P 407 North Front Street Harrisburg, PA 17108
~
Chauncey Kepford Judith H. Johnsrud Environmental Coalition on Nuclear Pcwer 433 Orlando Avenue State College, PA. 16801 John A. Levin, Esquire Assistant Counsel Pennsylvania Public Utility Commission P.O. Box 3265 Harrisburg, PA 17120 Robert Q. Pollard Chesapeake Energy Alliance 609 Montpelier Street Baltimore, Maryland 21218 Kathy McCaughin Authorized Representative for Three Mile Island Alert, Inc.
23 South 21st Street Harrisburg, PA 17104 Marvin I. Lewis 6504 Bradford Terrace Philadelphia, PA 19149 Ms. Marjorie Aamodt RD #5 Coatesville, PA 19320 1
500
3 --
Cert. of Service Docket No. 50-289 Ivan W. Smith, Chairman Atomic Safety and Licensing Board U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Dr. Walter H. Jordan Atomic Safety and Licensing Board U.S. Nuclear Regulatory Commission Washington, D.C. 20555 Dr. Linda W. Little Atomic Safety and Licensing Board U.S. Nuclear Regulatory Commission Washington, D.C. 20555 George F. Trowbridge, Esquire Shaw, Pittman, Potts & Trowbridge 1800 M Street, N.W.
Washington, D.C.
20036 John E. Minnich Chairman, Dauphin County Board of Commissioners Dauphin County Courthouse Front and Market Streets Harrisburg, Pennsylvania 17120 L
1'
/
Ellyn R. Weiss 1
301 m