ML19210C360
| ML19210C360 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 10/24/1979 |
| From: | Israel S Office of Nuclear Reactor Regulation |
| To: | |
| Shared Package | |
| ML19210C355 | List: |
| References | |
| NUDOCS 7911140134 | |
| Download: ML19210C360 (23) | |
Text
_
THI-2 AND ITS IMPACT ON THE REGULATORY PROCESS S. Israel U.S. Nuclear Regulatory Commission Bethesda, Maryland USA In response to TMI-2, several task forces were formed at NRC to evaluate the weaknesses in plant design and operation and make recommendations to assure that a si.nilar event would not occur at other operating plants.
This paper discusses the recommendations made in the areas of emergency procedures, control room operations, auxiliary feedwater design, emergency preparedness, and other systems and instrumentation.
We believe the implementation of these recommendations will significantly improve nuclear power plant safety in the United States.
1326 002 1911140 J3
INTRODUCTION The Three Mile Island accident has had a profound impact on the nuclear regulatory process in the United States.
The significant events of the acci-dent, which have received considerable publicity, include a combination of design deficiencies, equipment failures, and operator errors.
The implica-tions of these events brought into question the criteria used to license plants and our effectiveness in performina our regulatory function.
In respcnse to these concerns, several task forces headed by senior management were formed within the Commission to:
(1) assure that other reac..or licensees, particularly for those plants similar in design to TMI-2, take immediate actions to substantially reduce the potential for TMI-2 type events; and (2) perform comprehensive investigations into the potential generic 1mplica-tions of this accident on other operating reactors and plants with pending operating license and construction permit applications.
In addition, other investigations into the broader policy issues of TMI-2 on nuclear power plant licensing have been initiated.
These independent groups include the Presidential Commission on Three Mile Island, an NRC funded special inquiry group, and congressional subcommittees.
The conclusions and recommendatians of these groups and the extent of implementation of their findings will not be known until early 1980.
Therefore, my talk will be limited to technical issues currently under consideration and will only touch briefly on potential structural and policy changes that might result from these outside investigations.
By way of background, I would like to go over some of the actions we engaged in over the past sewn months.
The preliminary review of the accident chronology identified several events that occurred during the accident and contributed significantly to its severity.
All holders of operating licenses were subsequently instructed to take a number of immediate actions to avoid repetition of these errors, in accordance with bulletins issued by the Commission's Office of Inspection and Enforcement in early April.
The initial bulletins 1326 003
_3
defined actions by operating plants using the B&W reactor system, but as staff evaluations determined that additional actions were necessary, these bulletins were subsequently expanded, clarified, and issued to all operating plants for action. A multidisciplined evaluation team was formed to review the actions taken by the licensecs in response to the bulletins.
In addition, the NRC staff began immediate reevaluation of the design features of B&W reactors to determine whether, and if so, what additional safety corrections or improvements were necessary.
This evaluation involved numerous meetings with B&W and certain of tne affected licensaas.
The con-clusion of these preliminary staff studies were documented in an April 25, 1979 status report to the Commission. We found that tne B&W designed reactors appeared to be unusually sensitive to certain off-normal transient conditions originating in the secondary system.
As a result of this work, the NRC staff identified certain other short-term design and procedural changes at operating B&W facilities that were necessary to assure adequate protection to the public health and safety.
The licensees initiated shut c'own of the B&W p~iants and kept them shut down until these short term actions were completed and the results reviewed by the staff.
In addition to those modifications to be implemented promptly, each licensee also proposed to carry out certain addit'onal long-term modifications to further enhance the capability and reli flity of the reactor to respond to various transient events.
These actio, s were confirmed by a Commission order to each licensee.
Similar generic studies are in progress for the Westinghouse, Combustion Engineering, and General Electric operating plants.
The studies focus specifically on the predicted plant performance under different accident scenarios involving small break loss-of-coolant events and feedwater transients.
Based upon analytically predicted systen behavior, recommended guidelines for emergency operatirig procedures were developed and are being reviewed by the staff.
In addition, these studies include engineering assessments of the reliability of individual plant auxiliary feedwater systems and identification of dominant failure contributors and recommendations for corrective action.
Over 1,000 issues were raised in response to the accident.
A multidisc'i-plined task force (Lessons Learned) was formed to screen and evaluate these 1326 004 issues so that th(y may be placed into various categories according to their importance to safety and their priority for imphmentation.
This group has identified 24 short term recommendations for operating re. actors and near term operating license applicants and is formulating longer term policy type recommendations.
Many of the recommendations developed by these various groups must be implemented by the operating plants by January 1980.
The utilities have been informed of the requirements by staff act) n letters which allows continued plant operation; except for the B&W plants shich were shut down in early May until they complied with certain very near tere conditions.
Except for Three Mile Island, Unit 1, which is in the hearing proc iss, all the B&W plants have satisfied these requirements and are back in operation.
If the implementation schedu'.es are not met, the Commission may consider additional act;ons against those plants which have not complied with our requirements.
It is obvious that the activities described have had a large impact on available resources both in the Commission and the nuclear industry.
The accident continues to require a significant number m gerial and technical members of the staff to be diverted from their regularly scheauled licensing activities.
The manpower has been diverted from reviewing license applica-tions; however, our Systematic Review Program (of old plants) and generic safety issues programs have also suffered.
An important spinoff is the formation of owners' groups (along NSSS design lines) to more effectively respond to the generic issues that have been raised.
The staff has encouraged this approach because it maximizes our resources and the collegial effort improves the generic resolution of a particular issue.
Each licensee is required to justify that his plant is enveloped by the generic solution developed by his group.
The Three Mile Island accident has been a catalyst for the reevaluation of our licensing criteria and our license review process.
Our initial review covered areas arising directly from the accident, but as the studies progressed, we also considered other areas that were not direct contributors to the conse-t quences of the accident.
1326 005
Emergency Operator Procedures In the Three N5 + ;sland accident, a loss of feedwater transient led to a small break loss-of-coolant accident when the pressurizer pilot-operated relief valve failed to close.
The emergency procedure for a loss of feedwater did not alert the operators to this possibility, nor did it provide any indi-cation that the opening of the PORV should have been expected.
The emergency procedure for a loss of coolant / loss of pressure event did contain a cautionary statement regarding termination of the high pressure injection; however, the operator appeared to be concerned with a water-solid pressurizer and paid insufficient attention to the RCS pressure.
It is clear from the events at Three Mile Island that operator training ar.J emergency procedures were not adequate for the operators to conclude, from the information available, that the reactor core was uncovered and inadequately cooled for a long period of time.
The staff has looked at emergency operator procedures since the accident.
There apperrs to be inadequate coordination between the organizations providing the system design and analysis and the organizations developing the emergency procedures and providing operator training.
In some cases, the NSSS vendor does not supply any guidelines on the development of emergency procedures.
This lack of coordination is carried over into the licensing process.
The emergency procedures are audited by our inspection group; however, we do not perform a formal technical review of all procedures, or evaluate which analyses are used to develop them.
We have initiated a change in the process for developing, reviewing, and implementing emergency operator procedures starting with small break loss-of-coolant accidents.
I am referring to a procedure to recover from an event, a LOCA.
In genera! most of the emergency p'ocedures are written for events similar to those specified in the FSAR. Obviously this places an enormous burden on the operator to identify the type of event that is occurring, particularly when several events, some benign and some serious, exhibit the same symptoms.
Because there is no control room instrumentation to quickly provide a differential diagnosis, we are requiring that logic diagrams be developed to guide the operator in making the correct diagnosis and following 1326 006 the proper emergency procedure.
This is a fairly critical step in the process since misdiagnosing the event could lead to unacceptable consequences.
Our current licensing criteria do not require analyses of a combination of events such as a LOCA coincident with a steamline break; however, we believe that these potential events should be considered in the emergency procedures.
Here again the diagnostic logic diagram is important to assure that the operator follows the most appropriate emergency procedure.
It is recognized that some limits could be violated when trying to recover from some serious coincident accidents, so that it is important to make t a necessary value judgments now for these degraded events rather than burden the operator with making a com-promising decision during a high stress situation. This in no way implies that licensing criteria are being changed.
As a direct result of TMI-2, we have required that the licensees develop new small break LOCA procedures. To support this effort, the reactor vendors performed analyses in the very small break range (e.g., safety and relief valve opening) to examine sensitivity to break location, reliance on the steam generator as a heat sink, the effects of delays in the availability of the auxiliary feedwater system, long term cooling using natural circulatia-a ' f-site and onsite power availability, and operacar actions based upon available information on plant parameters.
The purpose of these analyses is to generate dynamic plant responses tnat can be used to develop operator procedures and also provide supplemental information for operator training.
These analyses are also used to confirm our understanding that stuck open relief valves do not result in uncovering the core if ;.ne ECCS is not terminated prematurely.
The vendors also wrote guidelines for small break LOCA emergency proce-dures that would envelop the operating plaits.
These guidelines followed the traoitional format such as symptoms, immediate actions, and subsequent actions.
Operator actions are based on the sensitivity analyses.
A staff team composed of professionals with analysis, systems, and plant operation backgrounds reviewed the adequacy of these guidelines which is a departure from previous practice.
Subsequent to our approval, the licensees wrote procedures for their plants incorporating specific features their facilities mly have.
1326 007 One of the most important operator actions required during the recovery from very smal' breaks is the termination or throttling back of high pressure injection flow.
The potentially conflicting concerns are maintenance of core cooling versus water-solid operation.
Since reliance on pressurizer level was discredited by TMI-2, other criteria for HPI termination were proposed by the vendors, consistent with their analyses.
The common element among the proposals is to maintain full HPI flow until the water in the primary system is subcooled with respect to the system pressure.
Although this criterion was developed for small break LOCAs, it appears to be applicable to other events as well.
If ultimately this criteria is shown to be generally applicable, it would simplify operator training by providing a simple functional requirement for all events.
Another TMI-2 concern is tripping of the reactor coolant pumps.
Serious fuel damage occurred after the reactor coolant pumps were turned off; the consequent steam-water separation resulted in uncovering the core.
Our initial response was to require that the pumps continue to operate during an accident until their failure was imminent.
Subsequent analyses by the vendors indicated that, for a certain range of small breaks, reactor coolant pump termination, at certain inappropriate times following the LOCA, could result in unacceptable consequences. We aow require that the reactcr coolant pumps be tripped when there is an automatic actuation of the ECCS.
To ensure this manual action is carrie d out in a timely fashion, we also_requ.i.ted a second operator in the control acom at all times.
In the longer term, we expect that this pump trip will be performed automatically and use additional initiation signals to pre-clude unwanted pump trips during severe overcool:ng transients.
Considerable discussion centered around the loss of natural circulation at TMI-2 which conH nued uncorrected.
We have required that the licensees incitde in their procedures instructions on how to monitor natural circulation in the primary system and how to initiate it.
The proposed instructions include monitoring primary system coolant temperatures and jogging the reactor coolant pumps in order to sweep out voids in the loop.
We required that the emergency procedures contain instructions for the operator to verify his readings of critical parameters before initiating.any
. c,_
'1326 008
significant action. This concern stemmed from an erroneous operator action based on a single control room indicator that was faulty.
In this instance, the issue is not a direct result of TMI-2, but evolved during the generic studies following the at ::ident.
Sensitivity analyse were performed for small break LOCAs assuming dif-ferent delay times in auxiliary feedwater actuation.
Our concern in this area stemmed from the small water supply on the secondary side of the steam generator and tne 8 minute delay in initiating auxiliary feedwater at TMI-2.
These analyses showed, that for plants with high pressure, injection pumps, core cooling could be achieved by opening the relief 9alve on the pressurizer and maintaining fuli HPI flow.
a result, we required that instructions be included in the procedures to open the pressurizer relief valves and maintain full HPI flow for those situations where feedwater is not available but normally required for decay heat removal.
We required that the licensees perform studies of inadequate core cooling resulting from (1) an insufficient coolant inventory; (2) an unspecified occurrence that results in departure from nucleate boiling; and (3) an unspecified event during refueling operations.
The pur,1se of these studies is to identify early warning signs that could be monitored with presently available instrumentation and to develop operator procedures for recovering from the event.
Another aim of these studies is to develop critAria for designing new instrumentation that would provide an enambiguous indication of inadequate core cooling.
Lastly, we have required that all transients and accidents be reevaluated on a 'onger time scale.
The analyses shall include a sir.gle active failure for each system called upon to function for a particular event.
Consequential failures shall also be considered.
Failures of the operators to perform required control manipulations ', hall be given consideration for permutations of the analyses.
Operator actions that could cause the complete loss of func-tion of a safety system shall also be considered.
The transient and accident analyses shall include event tree analyses, which are supplemented by computer 1326 009 calculations for those cases in which the system response to operator actions is unclear or these calculations could be used to provide important quantita-tive information not available from an event tree.
For example, failure to initiate high pressure injection could lead to uncovering the core for some transients, and a computer calculation could provide information on the amount of time available for : rrective action.
The transient and accident analyses are to be performed fo. the purpose of identifying appropriate and inappropriate coerator actions relating to important safety considerations such as natural circulation, prevention of core uncovery, and prevention of more serious accidents.
The information derived from the preceding analyses shall be included in the plant emergency procedure and operating training.
It is expected that analyses performed by the NSSS vendors will be put in the form of emergency procedure guidelines and that the changes in the procedures will be imple-mented by each licensee or applicant.
Control Room A major focus of our attention following the TMI-2 accident has been control room activities following a serious event. Most of us, who are accustomed to evaluating situations that can be quantified, such as hardware or analysis probleins, are relati aly naive in integrating the human element into our considerations.
I suspect we give the reactor operators too much credit or no crede based on our personal biases, rather than on thoughtful deliberations. We intend to perform a more measured review of contro, room operations to insure that the reactor operatars' capabilities are properly weighted in assessing the safe operation of the plant.
Part of this effort is a more intensive review of emergency procedures as I discussed earlier; the other is an expansion of operator licensing requirements.
Following the accident, we required the licensees to provide operator training in the TMI-2 scenario to insure that the operators were aware of the errors committed during the recovery and to relate this experience to his plant.
In addition, all reactor operators at B&W plants were required to have simulator training in the TMI-2 event which included practicing successf.ul~ 1326 010
recovery from the event.
To determine the effectiveness of this *:aining, the NRC staff audited a sample of B&W plant operators.
Additional training was required at some of the facilities.
In order to provide more effective response during accident situations, we required the licensees to clearly define the shift supervisor's responsi-bility and authority for safe operation of the plant.
In addition, procedures must be established for shift and relief turnover to insure that the operator 3 are always aware of the exact plant status.
Procedures must also be estab-lished to limit control room access to essential personnel.
At one time, there were up to 85 persons in the control room following the TMI-2 accident.
The most controversial recommentation made by the staff was the require-ment for a shift technical advisor, whc would advise the shift supervisor during recovery from unusual events.
He would not participate in reactor operations, but would stand back, monitor plant parameters, independently evaluate the situation, and recommend courses of action (if deemed necessary) to the shift supervisor. The shift supervisor would retain the responsibility for directing control room activities.
The staff has proposed that this position be filled by an engineering graduate who has additional plant training.
Industry has made a counter proposal that the pos.eion be filled by an experienced senior reactor operator who has additional engineering course work.
There is agreement on the need for such a function; however, the nmt effective means of fulfilling this function is still under discussion.
Finally, the staff has recommended 15 changes in cur licensing practices for training and licensirig operators which are under consideration by the Commissioners. These recommendations are:
1.
The xperience requirements regarding power plant operations for senior operator applicants should be increased.
2.
Establish requirements for applicants for senior operator licenses, after the plant achieves criticality, to be licensed as an operator for six months.
1326 011
.g_
3.
Establish requirements for participation in plant shift operations prior to licensing.
4.
Establish requirements that simulators be used in training programs for hot applicants.
5.
NRC should audit training programs more closely, includir.g administration of
'ification examinations.
6.
Develop eligibility requirements for instructors.
7.
In addition to the present operator requalification program requirements, all licensees should be required to participate in periodic retraining and recertification on a full scope simulator representative of theie facility.
8.
Establish more explicit requirements regarding exercises to be included in simulator requalification program.
9.
An increased level of confidence in the effectiveness of requalification programs should be provided by NRC examiners administering annual requalification examinations.
- 10. The scope of the written examinations should provide increased emphasis on understanding of thermohydraulics, hydraulics, and related matters.
- 11. Applicants for operator and senior operator licenses should be examined at a nuclear power plant simulator.
12.
Senior operator applicants who hold operator licenses should be required to take an cral test as well as the written examination.
13.
The passing grade of written examination should be increased to 80% or greater overall and 70% or greater in each category.
1326 012 14.
NRC should inform facility management of the results of each examination so that remedial training may be instituted, as applicable.
- 15. ANSI /ANS 3.5-1979, " Nuclear Power Plant Simulators," should be reviewed and revised and a Regulatory Guide reflecting NRC endorsement be developed.
These are initial recommendations that the staff considers appropriate.
In no way do they preclude initiating additional requirements that are deemed appropriate based on other studies ard investigations of the licensing program.
We anticipate thar. full implementation of most of the recommendations could occur within one year except for those requiring rulemaking.
Those involving nuclear oower plant simlators may also require more time to permit the purchase, finance and construction of more simulators.
Auxiliary Feedwater System The isolation of the auxiliary feedwater system for the first 8 minutes of the TMI-2 accident initiated a broad study that went beyond the impact of this system on the accident.
Unlike the emergency core cooling system design, which is fairly uniform for the diff arent PWRs, the auxiliary feedwater sys-tems, which are designed by the architect engineers, exhibit more individuality in the operating plants.
NRC acceptance criteria for this system were developed and implemented over the last five years so that earlier vintage plants have AFW systems of varying quality.
In addition to the requirement for providing long term decay heat removal whenever main feedwater is lost, the AFW response time is critical.
The steam generator dryout time for plants with once through steam generators is on the order of two minutes, while the dryout times for U-tube steam generators is from 15 to 20 minutes. As a result, we required an improvement in the reliability and performance of the auxiliary feedwater systems in the operating power plants.
In evaluating the auxiliary feedwater systems, we perforred a standard deterministic type of review and also a reliability analysis using event tree and fault tree logic techniques.
Time and personnel limitations precluded a complete and extensive review of each system, consequently the results are
~1326 013 viewed in terms of general conclusions and insights into (1) common mode failures, particularly those related to human error; (2) single point failures; and (3) any dominant causes of AFW system unreliability.
Based on these studies, the corrective actions were recommended for all operating s ants that have these deficiencies.
For plants with manually initiated AFW systems, there is the potential for failure of the operator to manually actuate the system following a transient in time to maintain the steam generator water level high enough to assure decay heat removal via the steam generators.
Therefore, we have required that the AFW system be automatically actuated on appropris'- initiat-ing signals and that the actuation system meet our safety grade requirements.
In the interim, we required that a dedicated operator be stationed locally to initiate AFW for those plants which rely on manual actuation.
Some plants were identified that had single or series isolation valves in the AFW system that could interrupt all AFW flow. We required those plants to lock open the critical valves and perform monthly inspections to verify that they are locked in the open position.
In the long term we required that the piping layout meet single failure criteria.
The capacity of the primary water source for the AFW system varies widely from plant to plant.
We required that a low level alarm be installed in the primary water source to alert the operator to the need to transfer to an alternate source.
In addition, we required the licensees to dc. n p specific procedures for initiating alternate sources of AFW supply.
During our review, we became aware of numerous AFW pump trips or failures during tests or required systems operations.
In order to reduce these failures, we required that the licensees perform endurance tests on his AFW pump so that operational problems can be identified and corrected.
Verification of safety systems actuation is part of the immediate operator actions following a reactor trip. We believe the best way to confirm that the AFW is operating is to monitor flow to the steam generators rather than rely 1326 014 on indi'ect indications such as pump motor current, valve status, or steam generator level.
Therefore, we required safety grade AFW flow indication be installed if not already available.
We required thai,the licensees review the failure mode of the AFW valves to assure continued AFW flow in the event of the loss of air or the loss of power.
In addition, an ope ator must be stationed locally to realign valves during periodic testing of che AFW to assure its availability if a loss of main feedwater should occur during the AFW i.est.
Most plants have a turbine driven AFW pump that could provide flow in the event of total ics; of AC power, both offsite and onsite.
During our review, we noted that some of the turbir.e driven pumps had AC dependent lube oil pumps or AC dependent service water to the lube oil coolers.
In addition, some of the valves in the AFW system were dependent on AC power.
To improve the capability of the plants to recover from this low probability event, we required the licensees to remove the AC dependence from the turbine driven pumps and to develop procedures for AFW initiation and control under tnese conditions.
We also required that Technical Specifications that govern plant opera-tion be modified to include a time limit on the outage of an AFW train and required double verification of AFW system valve alignments following any tests or maintenance on the system.
The aoove recommendations are related primarily to potential undercooling situations that could result in heating up the primary system and opening the safety-relief valves in the pressurizer, which was the precursor to TMI-2.
At the other end of the spectrum are overcooling events caused by malfunctions in the main feedwater system and/or aggravated by the auxiliary feedwater system.
Here again, the event (shrinkage of the primary system coolant volume) appears to be more sensitive in plants which have once-through steam generators that closely couple primary system response to perturbations in the secondary system. While the consequences of these events are acceptable based on the results presented in the safety analysis reports, the initial symptoms (loss of pressure and pressurizer level indication) look very similar to major -
B26 01S
accidents such as loss-of-coolant and steam line break.
Thus, these anti-cipated transients pose more frequent significant challenges to the reactor operator to diagnose the situation and take appropriate action.
The risk lies in treating an accident like a transient because of operator conditioning by previous experiences.
The staff has initiated a study of undercooling events to determine what remedial actions, if any, we should iniplerrent.
Other Systems and Instrumentation Modifications to other systems and instrumentation were identified as having safety significance based on the considered engineering evaluation and qualitative professional judgment of the various task forces.
In this regard, the items were selected for "short-term action" if their implemeritation would provide substantial, additional protection required for the public health and safety. These rec?mmendations received extensive reviews within the Commission and by industry prior to their formal issuance.
The power operated relief valve on the primary system was the source of the small LOCA that ultimately resulted in significant fuel damage at TMI-2.
The pressure actuation point on this valve is set below the reactor trip point and the safety valve relief point to accommodate small pressure changes, anticipated during normal operation, without a reactor trip.
Since this was not previously considered a safety related system, it was not reviewed except for assessing the consequences of an inadvertently stuck open valve.
As noted earlier these consequences were fou-d acceptable because no fuel damage was predicted based on the expected operation of the high pressure safety injection system.
Based on our review of the operating history of these valves since TMI-2, we concluded that the frequency of challenges to this valve and its failure rate were excessive in B&W plants. We, therefore, required that the reactor trip setpoint be lowered and the relief valve actuation setpoint be raised to reduce the challenges to the valve.
We have also required that an unambiguous valve position read out in the control room be provided so that the operator can verify the status of plant symptoms representative of a small break I.0CA.
In addition, the relief valve and the isolation valve on the same relief line must be capable of being
' 1326 016
actuated with either onsite or offsite power so that the operator can isolate the line if the valve is inadvertently opened and/or fails open.
As part of a longer term effort, we have required that tests be performed on the relief valve and representative installations to demonstrate satis-factory performance under anticipated flow conditions which would include two phase and water discharge from the valve.
Remedial action will be taken if the test results do not verify that the valve can perform satisfactorily under these conditions.
Since this is a generic concern, this program will be an industry wide effort conducted by EPRI.
The role of the pressurizer in plant operation was also reviawed.
To improve the capability of primary system pressure control durir.J extended recovery periods without offsite power, we have required the licensees to insure that the pressurizer level instrumentation is connected to an emergency power source and that the pressurizer heaters are capable of being connected to emergency power also.
Because the pressurizer level alone is nut an adequate indication of primary system inventory under certain accident conditior.s, the operating procedures have been modified to direct the operator to monitor the subcooling of the coolant in the primary system which would indicate the absence of significant voids in the primary system.
To aid the operator in this procedure, we have required that the licensee install redundant sub-cooling meters that can be used to assess the potential for inadequate core cooling because of voids in the primary system.
The reactor containment has received considerable attention from the standpoint of isolation and hydrogen control.
Containment isolation was not achieved until approximately 4-1/2 hours after the start of the accident.
Although this apparently did not lead directly to release of fission products outside containment, it clearly indicated an unacceptable possibility that it could occur.
To prov1de aswrance that the containment will be isolated in future events, we required that a secorid diverse signal, in addition to the present high containment pressure signal, be used to initiate the isolation.
A complementary action is the reevaluation of the basis for categorizing essential and non-essential systems that penetrate containment to assure that all non-essential systems are isolated automatically when accident situations 1326 017
- require it. Another requirement is to assure that the design of control systems for automatic containment isolation valves shall be such that resetting the isolation signal will not result in the automatic reopening of containment isolation valves.
The design of the THI-2 post-ac:' dent recombiner system uses the 36-inch containment penetrations for the normal contai ment purge system.
These pene-trations are oversized for the purpose of hydrogen recombiner operation and lack adequate redundant isolation to preclude inadvertent venting of the con-tainment when the recombiner is in operation.
As a result, we required plants using external recombiners to provide dedicated penetrations for that service only and to assure that the penetrations meet our redundancy and single failure requirements.
The post-accident recovery at TMI-2 has indicated some weaknesses in our ability to monitor conditions inside containment.
To correct same of these shortcomings, we required that the licensees install new instrumentation to measure containment pressure, water level in the sump, and hydrogen concentra-tion in the containment atmosphere.
The measurement range should be extended beyond the values predicted in the safety analyses for the plants.
Everybody is familiar with the infamous hydrogen bubble at TMI-2.
Several tension filled days were spent evaluating various options before the gas was finally releasad through an obscure one-inch vent line en the pressurizer.
Based on this experience, we required that the licensees install vent line(s), at the high point (s) in the primary system, that can be operated from the control room and procedures be developed to cover operation of these vents.
Another weakness exposed by TMI-2 was the limited capability for measuring radiation levels inside and outside of containment.
Ta correct these deficien-cies, we required the licensees to:
1.
Upgrade their capability to obtain and analyze primary coolant and contain-ment air samples without overexposing personnel.
~1326 018' 2.
Develop interim procedures fcr estimating noble gas and radionuclide release rates if the existing effluent instrumentation goes off scale.
3.
Install high range noble gas monitors with an extended range by January 1981.
After an accident in which significant core damage occurs, large radiation 'ields, resulting from large radiation sources being contained in systems nat designed for such acti7ity, may make it difficult to effectively perform accident recovery operations.
Such systems, although not specifically identified to perform post-accident functions, may nevertheless be of significant value aftar an accident.
In addition, vital areas such as control rooms, rad-waste panels, emergency power supplies, and instrument areas, may fall within the radiation fields of such systems.
As a result, we required the licensees to evaluate their plants with respect to potential post-accident operations and provide permanent or temporary shielding that will allos access to vital areas.
The long recovery period associated with TMI-2 has underscored problems associated with leakage from systems containing highly radioactive fluids.
Even chronic small leaks pose hazards because of the continuous release of radioactive gases and the limited stor S capability of the rad-waste system.
In order to minimize these difficulties, we have required that the licensees implement all practical leak reduction measures for all systems that could carry radicactive fluia outside of containment.
In addition, they are to implement a program of preventive maintenance to reduce leakage to as-low-as practical and perform periodic tests to confirm the leak tightness of the systems.
Emergency Preparedness The comprehensive evaluations of the response of the licensee, the State of Pennsylvania and the NRC to the challenge of the Three Mile Island accident are still underway and will be for some time.
However, all of these principals, the nuclear industry, the several states involved and the U.S. Congress sense an immediate need for improvements in emergency preparedness and all are )
moving forward with initiatives which will significantly affect the resources committed to this area.
The staff plans to undertake an intensive effort over the next year to improve licensee emergency preparedness at all operating power reactors and those reactors scheduled for an operating license decision within the next year. Thi
..t will be closely coordinated with a similar effort by the Offit of State Programs to improve State and local response plans through the concurrence process.
The main elements of the staff effort are as follows:
1.
Upgrade licensee emergency plans to satisfy Regulatory Guide 1.101, with special attention to the development and use of uniform action level criteria based on plant parameters.
We beliele it is particularly impor-tant that ale involved use similar terminology and take effective action based on the same criteria.
2.
Determine that an Emergency Operations Center for Federal, State and local persont.al has been established with suitable communications to the plant, and that upgrading of the facility to provide direct transmittal of key plant data is underway.
3.
Assure that improved licensee offsite monitoring capabilities (including additional TLD's or equivalent) have been provided for all sites.
4.
Assess the relationship of State / local plans to the licensee's and Federal plans to assure the capability to take appropriate emergency actions.
Assure that this capability will be extended to a distance of 10 miles as soon as practical, but not later than January 1, 1981.
This will include meetings with State and local officials in the vi-inity of each site.
This item will be performed in conjunction with the Office of State Programs effort to achieve concurrence in all affected States within about the next year.
326 0?0 5.
Require tast e:: 'cises of approved Emergency Plans (Federal, State, local, licensees), review plans for such exercises, and participate in a limited number of joint exercises.
Tests of licensee plans will be required to be conducted as soon as practical for all facilities and before reactor startup for new licensees.
Exercises of State plans will be performed in conjunction with the concurrence reviews of the Office of State Programs. Joint test exercises involving Federal, State, local and licensees will be conducted at the rate of about 10 per year, which would result in all sites being exercised once each five years.
Milestones for this program have been developed.
Sites in areas of rela-tively high population density, sites with units scheduled for operating license decisions within the next year, and sites 'ithout NRC concurrences in State plans will be reviewed early in the program.
The entire program will evaluate 52 sites and 76 units.
Another effort in the emergency preparedness area wH ch has been ongoing for some time is the joint NRC/ EPA task force on Emergency Planning.
The task force has recommended staffing increases in all areas of emergency preparedn' ass activities and organizational changes to improve the coordination of efforts within NRC and obtain higher organizational v sibility for emergency planning.
Each program office is now implementing its action plan and in several cases offices have diverted additional resources to the emergency preparedness area.
The task force also drafted regulations which would implement Emergency Planning Zones around each power reactor, require the submittal of licensee implementiim procedures as well as emergency plans for NRC review and con-dition plant licenses on approval of State and local emergency preparedness capabilities.
In a related action, the Commission is issuing a proposed rule which would require updating of emergency plans for power reactors and certain fuel cycle facilities required under current regulations and would require that emergency plans for all research reactors be submitted for NRC review.
Internal NRC preparedness is also receiving extensive scrutiny and up-grading.
The Bethesda Operations Center and our regional offices now have dedicated lines to each facility control room and additional lines are being
~ S-1326 021
installed for communication of radiological release information during emer-gencies. The Bethesda Operations Center is now manned 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> a day and emphasis is being placed on prompt notification of the NRC and State and local agencies of unusual events.
Our ability to quickly identify and dispatch the right technical and management personnel to an affected site is being upgraded and the technology available for data transmission and display are being reviewed to lay the groundwork for improvements in our headquarters and regional physical facilities. The Commission is also examining the internal role it should play in future events as well as the role of the NRC in relation to the licensee and State and local agencies.
Other relevant ongoing activities include a study on how best to obtain and distribute funds to state and local governments for emergency planning and preparedness measures, increased effort with county and municipal governments in the vicinity of nuclear power plants, and expansion of NRC sponsored training for state and local officials.
Other Potential Licensing Requirements The requirements I have just discussed are intended to address those mat-ters where short-term improvement in safety can be made.
TMI-2 has raised a number of other significant questions and policy issues which are under con-sideration for longer term implementation which may also involve rule making hearings.
I will enumerate some of these licensina requirements with the understanding that they are only poten;ial items for additional action.
Safety systems and their supporting auxiliary systems are required to be operable as a limiting condition of plant operation.
The licensee is respon-sible for implementing administrative controls to insure that these systems are operational. At TMI-2 the auxiliary feedwater system was totally isolated through ineffective administration and our review of plant operations in 1978 indicated about 30 cases of loss of safety function through human error.
In order to increase the licensees awareness of the need to generally im,Juve operations reliability, we are considering imposing a significant penalty such as plant shutdown for loss of safety function events caused by human or.
procedural errors.
1326 u22
Because of the potential for hydrogen explosion at TMI-2, we are con-sidering the requirement that all older boiling water reactor plants, types 1 and 2, have inert containmr.nts and that all plants have hydrogen recombination capability.
Prior to TMI-2, the Commissi- ' was considering the requirement for pro-tection against the consequen::es of Class 9 events in the Offshore Power Systems applicaticn.
Since TMI-2 has been classified as a Class 9 event, the issue has been given additional impetus.
We are seriously considering adding two new Design Basis Events:
(1) large fuel damage, with low offsite doses similar to the TMI-2 accident, and (2) a core melt with high offsite doses.
The requirements would probably focus on minimizing the consequences of these events.
We are reexamining the adequacy of current system design requirements.
In examination of these requirements, we are considering modification of cur-rent requirements to include use of event tree, fault tree, and/or relative reliability methods to supplement the current deterministic licensing criteria.
In addition, consideration is being given to methods to incorporate in the safety analysis operator action (inactive or error) and the role of operating procedures with relation to the system design requirements.
We are also evaluating the current system safety classification methods and are considering modifying these requirements to include additional systems in the safety grade classification as all as developing other system safety classifications.
The classification sj %em being considered is based on identifying systems important to safety, establishing their ranking in order of importance, and developing design requirements and criteria for code class.
We are considering the need to set forth environmental qualification requirements for systems important to safety to include components of fluid systems located both inside and outside containment.
These requirements could include accident and post-accident conditions.
Post-accident considerations are being developed in relation to equipment requirements, provisions for installation of equipment, cnd process systems 1326 023
_,1_
and preplanning requirements. Other post-accident factors are bein, considered that are related to system design requirements.
Organizational Changes Our review of TMI-2 and previous similar events has indicated a weakness in our screening and evaluation of licensee event reports.
As a result, a separate group has been established A thin NRC to collate and assess opera-tional data and initiate generic programs and/or recommendations that would apply to a class of plants. This deficiency was recognized previously, but was not implemented because of limited resources.
The process for reporting operational data, its storage, and retrieval is already available through the nuclear plant reliability data program.
The emphasis of the evaluation group will be to generalize the data and extrapolate the results to potentially more serious situations which require remedial action.
Our present made of license application review is segregated along the lines of different technical disciplines. While this approach provides a good depth in understanding and consistency in licensing requirements for safety systems, no one is responsible for assessing the integrated design and opera-tion of the plant. We are considering the creation of an accident analysis grouo which would provide an integrated evaluation of Design Basis Accidents from initiation through all systems to operator action and offsite procedures.
Such a group would assure that our defer. 3 in depth is really being implemented in the plant.
Prior to TMI-2, we had already initiated a prog am to have resident inspectors at each plant site.
The implementation of this program has been slow because of the limited availability of personnel.
Needless to say, TMI-2 has given renewed emphasis to this plan.
Conclusions Three Mile Island has disrupted our complacency.
The NRC staff has been diligently engaged in the task of self-examination over the past 7 months.
The recommendations we have made will improve safety; however, new rules and t326 024 criteria are not sufficient by themselves to prevent future incidents.
Dedicated people - designers, builders, regulators, and operators - are required to make it work.
In this regard, the response to TMI-2 has been gratifying.
The utilities recognize that real safety comes from within their organizations, not from Washington.
They ha/e formed teveral industry-wide groups to identify and correct weaknesses in plant operation.
I am sure we can regain the public's confidence in nuclear power with this renewed commit-ment to protect their health and safety.
[326 025