ML19254F628
| ML19254F628 | |
| Person / Time | |
|---|---|
| Site: | Three Mile Island  |
| Issue date: | 10/31/1979 |
| From: | Trowbridge G METROPOLITAN EDISON CO., SHAW, PITTMAN, POTTS & TROWBRIDGE |
| To: | Atomic Safety and Licensing Board Panel |
| Shared Package | |
| ML19254F625 | List: |
| References | |
| NUDOCS 7911160106 | |
| Download: ML19254F628 (19) | |
Text
October 31, 1979 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )
)
METROPOLITAN EDISON COMPANY ) Docket No. 50-289
) (Restart)
(Three Mile Island Nuclear )
Station, Unit No. 1) )
LICENSEE'S RESPONSE TO FINAL CONTENTIONS OF THE UNION OF CONCERNED SCIENTISTS Contention No. 1. The accident at Three Mile Island Unit 2 demonstrated that reliance on natural circulation to remove decay heat is inadequate. During the accident, it was neces-sary to operate at least one reactor coolant pump to provide forced cooling of the fuel. However, neither the short nor long term measures would provide a reliable method for forced cooling of the reactor in the event of a small loss-of-coolant accident (" LOCA" ) . This is a threat to health and safety and a violation of both General Design Criterion ("GDC") 34 and GDC 35 of 10 CFR Part 50, Appendix A.
Contention No. 2. Using existing equipment at TMI-1, there are only 3 ways of providing forced cooling of the reactor:
- 1) the reactor coolant pumps; 2) the residual heat removal system; and 3) the emergency core cooling system in a " bleed and feed" mode. None of these methods meets the NRC's regu-lations applicable to systems important to safety and is sufficiently reliable to protect public health and safety:
a) The reactor coolant pumps do not have an on-site power supply (GDC 17), their controls do not meet IEEE 279 (10 CFR 50. 55a (h)) and they are not seismically and environmentally qualified (GDC 2 and 4) .
b) The residual heat removal system is incapable of being utilized at the design pres-sure of the primary system.
716 049 7911160/Ob G
c) The emergency core cooling system can-not be operated in the bleed and feed mode for the necessary period of time because of inadequate capacity and radiation shielding for the storage of the radioactive water bled from the primary coolant system.
Licensee's Response Licensee views Contentions 1 and 2 as a single contention. Contention 2 is in substance a statement of the basis for Contention 1.
Licensee objects to Contentions 1 and 2 in that they are unrelated to the bases for suspension of operation of TMI-l and therefore not within the issues specified in the Commission's August 9 Order. The Commission's statement of the bases for suspension does reference the I&E Bulletin series addressed to B&W reactor owners (79-05,79-05A, 79-05B and 79-05C) and these bulletins do recognize that the forma-tion of voids in the TMI-2 reactor coolant system prevented core cooling by natural circulation. The only concerns ex-pressed in those bulletins, however, and the only concerns addressed in the Staff's recommended actions, relate to oper-ator actions to avoid the formation of voids and to enhance core cooling in the event such voids are formed. Nowhere has the Commission questioned the reliability of forced cool-ing systems or the adequacy of the criteria applied by NRC for many years in its licensing of such systems for PWR reactors.
'16 050 Contention No. 3. The staff recognizes that pressurizer heaters and associated controls are necessary to maintain natural circulation at hot stand-by conditions. There-fore, this equipment should be classified.as " components important to safety" and required to meet all applicable safety-grade design criteria, including but not limited to diversity (GDC 22) , seismic and environmental qualifi-cation (GDC 2 and 4), automatic initiation (GDC 20) , sep-aration and independence (GDC 3 and 22) , quality assurance (GDC 1), adequate, reliable on-site power supplies (GDC 17) and the single failure criterion. The staff's proposal to connect these heaters to the present on-site emergency power supplies does not provide an equivalent or acceptable level of protection.
Licensee's Response Licensee does not object to this contention. One of the Staff's recommended actions which are at issue in this proceeding (Section 2.1.1 of NUREG-0578) is to upgrade the re-liability of pressurizer heaters by providing an emergency power supply. UCS is entitled to challenge the adequacy of this degree of upgrading as a condition to restart.
Contention No. 4. Rather than classifying the pressurizer heaters as safety-grade, the staff has proposed simply to add the pressurizer heaters to the on-site emergency power supplies. It has not been demonstrated that this will not degrade the capacity, capability and reliability of these power supplies in violation of GDC 17. Such a demonstra-tion is required to assure protection of public health and safety.
Licensee's Response Licensee does not object to this contention.
'16 051 Contention No. 5. Proper operation of power operated relief valves, associated block valves and the instruments and ,
controls for these valves is essential to mitigate the con-sequences of accidents. In addition, their failure can cause or aggravate a LOCA. Therefore, these valves must be class-ified as components important to safety and required to meet all safety-grade design criteria.
Licensee's Response Licensee does not object to this contention. Two of the Staff's recommended actions which are at issue in this proceeding are (1) to upgrade the power operated relief valve by providing direct indication of valve position and (2) to require a program for relief valve testing. (Sections 2.1. 2 and 2.1.3.a of NUREG-0578) UCS is entitled to challenge the adequacy of this degree of upgrading as a condition to restart.
Contention No. 6. Reactor coolant system relief and safety valves fonn part of the reactor coolant system pressure boundary. Appropriate qualification testing has not been done to verify the capability of these valves to function during normal, transient and accident conditions. In the absence of such testing and verification, compliance with GDC 1, 14, 15 and 30 cannot be found and public health and safety is endangered.
Licensee's Response Licensee has no objection to this contention for the reasons stated in response to Contention 5.
6 052 Contention No. 7. NRC regulations require instrumentation to monitor variables as appropriate to ensure adequate safety (GDC 13) and that the instrumentaticn shall directly measure the desired variable. IEEE 279, S4.8, as incorporated in 10 CFR 5 0. 55a (h) , states that:
To the extent feasible and practical pro-tection system imputs shall be derived from signals which are direct measures of the desired variables.
TMI-1 has no capability to directly measure the water level in the fuel assemblies. The absence of such instrumentation de-layed recognition of a low water level condition in the reactor for a long period of time. Nothing proposed by the staff woul?
require a direct measure of water level or provide an equiva-lent level of protection. The absence of such instrumentation pores a threat to public health and safety.
Licensee's Response Licensee has no objection to this contention which is closely related to the Staff's recommendations for instru-mentation for detection of inadequate core cooling. (Section 2.1.3.b of NUREG-0578)
Contention No. 8. 10 CFR 50.46 requires analysis of ECCS per-formance "for a number of postulated loss-of-coolant accidents of different sizes, locations, and other properties sufficient to provide assurance that the entire spectrum of postulated loss-of-coolant accidents is covered." For the spectrum of LOCA'S, specific parameters are.not to be exceeded. At TMI, certain of these were exceeded. For example, the peak cladding temperature exceeded 2200* fahrenheit (50. 46 (b) (1) ) , and more than 1% of the cladding reacted with water or steam to produce hydrogen (5 0. 46 (b) (3) ) . The measures proposed by the staff address primarily the very specific case of a stuck-open power operated relief valve. However, any other small LOCA could lead to the same consequences. Additional analyses to show that there is adequate protection for the entire spectrum of small break locations have not been performed. Therefore, there is no basis for finding compliance with 10 CFR 50.46 and GDC 35.
None of the corrective actions to date have fully addressed the demonstrated inadequacy of protection against small LOCA's.
7'6 053 Licensee's Response Licensee understands this contention to call for reanalysis of the capability of the ECCS to meet the perform-ance requirements of 10 CFR 50.46 over the entire spectrum of small breaks. Since completion of analysis for potential small breaks has been required by the Commission for other B&W reactors and since one of the Staff's short term recom-mendations contains the same requirement (August 9 Order, p.5, item 1(d)), Licensee has no objection to this contention.
Contention No. 9. The accident at TMI-2 was substancially aggravated by the fact that the plant was operated with a safety system inoperable, to wit: two auxiliary feedwater system valves were closed which should have been open. The principal reason why this condition existed was that TMI does not have an adequate system to inform the operator that a safety system has been deliberately disabled. To ade-quately protect the health and safety of the public, a system meeting the Regulatory Position of Reg. Guide 1.47 or provid-ing equivalent protection is required.
Licensee 's -Response Licensee has no objection to this contention insofar as it relates to the feedwater system, since it is closely re-lated to the Staff recommended action (Section 2.1.7b of NUREG-0578) for indication in the control room of auxiliary feed flow.
To the extent this contention deals with indication in the con-trol room of the operability of other safety systems it lacks the specificity necessary to enable Licensee either to respond to the contention or to determine its relevance to the bases for suspension.
716 054 Contention No. 10. The design of the safety systems at TMI is such that the operator can prevent the completion of a safety function which is initiated automatically; to wit: the opera-tor can (and did) shut off the emergency core cooling system prematurely. This violates S4.16 of IEEE 279 as incorporated in 10 CFR 50.55 (a) (h) which states:
The protection system shall be so designed that, once initiated, a protection system action shall go to completion.
The design must be modified so that no operator action can pre-vent the completion of a safety function once initiated.
Licensee's Response Licensee has no objection to this contention insofar as it relates to shutdown of the emergency core cooling system, since premature shutdown of the TMI-2 ECCS was recognized as a problem in the I&E Bulletins referenced in the Commission's statement of the bases for suspension and since several of the Staff's recommended actions address this problem. To the extent this contention deals with prevention of the cpmpletion of a safety function with respect to other safety systems, it lacks the specificity necessary to enable Licensee either to respond to the contention or to determine its relevance to the bases for suspension.
7'6 055 Contention No. 11. The design of the hydrogen control system
, at TMI was based upon the assumption that the amount of fuel cladding that could react chemically to produce hydrogen would, under all circumstances, be limited to less than 5%. The acci-dent demonstrated both that this assumption is not justified and that it is not conservative to assume anything less than the worst case. Therefore, the hydrogen control systems should be designed on the assumption that 100% of the cladding reacts to produce hydrogen.
Licensee's Response Licensee objects to this contention on the ground that it attacks an existing Commission regulation. Part 50.44 specifies the requirements and design criteria for recombiners.
For older plants, including TMI-1, recombiners are not recuired.
For later plants the regulatory design assumption does not exceed more than a five percent metal-water reaction. Licensee recognizes that one of the Staff's recommended actions includes revision of the current regulation on recombiners (Section 2.1.5.c of NUREG-0578) and Licensee in fact latends to provide a recombiner for TMI-1. Any quarrel which UCS may have with proposed revisions to the requirements and design assumptions of Part 50.44 should be addressed in the rulemaking forum.
7'6 056
Contention No. 12. The accident demonstrated that the sever-ity of the environment in which equipment important to safety must operate was underestimated and that equipment previously deemed to be environmentally qualified failed. One example was the pressurizer level instruments. The environmental qualification of safety-related equipment at TMI is deficient in three respects: 1) the parameters of the relevant accident environment have not been identified 2) the length of time the equipment must operate in the environment has been underesti-mated and 3) the methods used to qualify the equipment are not adequate to give reasonable assurances that the equipment will remain operable. TMI-1 should not be permitted to resume oper-ation until all safety related equipment has been demonstrated to be qualified to operate as required by GDC 4. The criteria for determining qualification should be those set forth in Reg-ulatory Guide 1.89 or equivalent.
Licensee's Response Licensee has no objection to this contention insofar as it relates to the pressurizer level instruments. Licensee objects to the balance of this contention on the ground that it is so lacking in specificity as to the equipment in question that Licensee can neither respond to the contention nor deter-mine its relevance to the bases for suspension.
7'6 057
-9_
Contention No. 13. The design of TMI does not provide protec-tion against so-called " Class 9" accidents. There is no basis for concluding that such accidents are not credible. Indeed, the staff has conceded that the accident at Unit 2 falls within that classification. Therefore, there is not reasonable assur-ance that TMI-l can be operated without endangering the health and safety of the public.
Licensee's Response Licensee objects to this contention primarily because it fails to identify the accident or sequence of events for which it is contended that the TMI-l design does not provide protection, thus making it impossible for Licensee either to respond to the contention or to determine its relevance to the bases for suspension. The term " Class 9" accident provides no explanation. Properly used it refers to accident evaluations for purposes of NEPA and means only an accident involving a series of failures more severe than those postulated for the design basis accidents considered in plant licensing. Class 9 accidents represent "an indefinable number of conceivable types of accidents which are more severe than the design basis acci-dents of Class 8." Long Island Lighting Co. (Shoreham Nuclear Power Station), ALAB-156, 6 NRC 831, 834-35 (1973). The Com-mission's August 9 Order cannot be read to mean that because the Staff in one unrelated proceeding concluded that the TMI-2 accident was a Class 9 accident in the sense above stated, this Board is now instructed to consider every conceivable accident more severe than a design basis accident.
716 058 Contention No. 14. The accident demonstrated that there are systems and components presently classified as non-safety-related which can have an adverse effect on the integrity of the core because they can directly or indirectly affect tem-perature, pressure, flow and/or reactivity. This issue is discussed at length in Section 3.2, " System Design Require-ments," of NUREG-0578, the TMI-2 Lessons Learned Task Force Report (Short Term). The following quote from page 18 of the report describes the problem:
There is another perspective on this question provided by the TMI-2 accident. At TMI-2, operational problems with the condensate purification system led to a loss of feedwater and initiated the sequence of events that even-tually resulted in damage to the core. Several nonsafety systems were used at various times in the mitigation of the accident in ways not con-sidered in the safety analysis; for example, long-term maintenance of core flow and cooling with the steam generators and the reactor cool-ant pumps. The present classification system does not adequately recognize either of these kinds of effects that nonsafety system can have on the safety of the plant. Thus, requirements for nonsafety systems may be needed to reduce the frequency of occurrence of events that ini-tiate or adversely affect transients and accidents, and other requirements may be needed to improve the current capab ility for use of nonsafety sys-tems during transient or accident situations. In its work in this area, the Task Force will in-clude a more realistic assessment of the inter-action between operators and systems.
The Staff's proposes to study the problem further. This is not a sufficient answer. All systems and compcaents which can either cause or aggravate an accident or can be called upon to mitigate an accident must be identified and classified as com-ponents important to safety and required to meet all safety-grade design criteria.
'16 059 Licensee's Response Licensee objects to this contention on the ground that there is no specification of the non-safety-related sys-tems and components to which the contention is addressed and therefore no basis on which Licensee can either respond to the contention or determine its relevance to the bases for suspension.
Licensee further notes that the quotation from NUREG-0578 in this contention, which deals with the inter-action between non-safety and safety systems, comes not from the discussion of recommended short-term actions but in the discussion of further matters to be considered by the Les-sons Learned Task Force. The Commission's bases for suspen-sion of operation of TMI-l did not include this Staff concern and the Commission's August 9 Order provides a mechanism by which the Commission can add this concern to the issues in the proceeding if it finds it appropriate to do so. See Part A of Licensee's covering memorandum.
7'6 060 Contention No. 15. The measures identified by the staff in NUREG-0578 and the Commission's Order of August 9, 1979 include many which will not be implemented until after the plant has resumed operation and some which will not even be identified until some unspecified time in the future. No justification has been provided for concluding that the plant can safely operate in the period while these corrective ac-tions are being identified and prior to their implementation.
The public health and safety demands that all safety problems identified by the accident be corrected prior to resumption of operation at TMI-1.
Licensee's Response Licensee has no objection to this contention since UCS is entitled to challenge the sufficiency of Staff recom-mendations for actions which may not be completed prior to restart of TMI-1.
'16 061 Contention No. 16. The events at TMI-2 showed the inadequacy of NRC emergency planning requirements. Emergency planning beyond the LPZ is a recognition of the residual risk associ-ated with major reactor accidents whose consequences could exceed those associated with so-called design basis events.
Such planning should be based on a worst case analysis of the potential accident consequences of a core melt with breach of containment. The public health and safety requires that there be in place prior to restart of TMI-1 a feasible plan to evac-uate the public in the event of such an accident.
Licensee's Response Licensee objects to this contention on the ground that it challenges the NRC Policy Statement issued by the Commission on October 18, 1979, and published in the Federal Register on October 23, 1979. (44 F.R. 61123). In that state-ment the Commission has endorsed as a planning basis for emer-gency response NUREG-0396 (EPA 520/1-78-016) dated December 1978 prepared by a joint NRC/ EPA Task Force. This report calls for the establishment of two Emergency Planning Zones (EPZs).
The EPZ for airborne exposure is to have a radius of about 10 miles. The EPZ for contaminated food is to have a radius of about 50 miles. The report also provides planning basis guid-ance in the form of a range of time values in which emergency response officials should be prepared to implement protective action. The distances for EPZs and times for response are based on a spectrum of design basis and core melt accidents which do not include a core meltdown accompanied by breach of containment.
716 062 Contention No. 17. The accident at TMI-2 was caused or aggra-vated by factors which are under study as so-called " generic unresolved safety issues." For example, interaction between non-safety and safety systems created demands on the safety systems that exceeded the latter's design basis. This problem is listed as A-17 in NUREG-0410 and is more fully described therein as well as in Appendix A-17/1 of testimony dated Sep-tember 27, 1978 of staff members Aycock, Crocker and Thomas in Docket Nos. STM 50-556, 50-557, Public Service Co. of Oklahoma et. al. (Black Fox Station, Units 1 and 2) (hereinafter " Black Fox testimony"). At TMI-2, the failures of the pressurizer power operated relief valve and the condensate system, both nonsafety systems were principal contributors to the accident.
Another example of an unresolved safety prob-lem directly involved at TMI-2 is A-24, " Qualification of Class IE Safety-Related Equipment," found at Appendix A-24/1 of the Black Fox testimony. The pressurizer level instruments which failed at TMI-2 were previously deemed to be qualified to func-tion in the accident environment.
The Appeal Board in Virginia Electric and Power Co. (North Anna Nuclear Power Station, Units 1 and 2),
ALAB-491, 8 NRC 245 (1978) ruled that, as a requirement for the issuance of an operating license, the record must demonstrate either that each applicable generic safety issue has been re-solved for the particular reactor or the existence of measures employed at the plant to compensate for the lack of a solution to the problem. There is a clear need for this procedure to be undertaken prior to resumption of operation at TMI-1. The public health and safety requires a finding that each applicable unresolved safety problem at TMI-l has been addressed.*
- The generic issues relevant to TMI-l are those in NUREG-0410 which are designated by the staff in the Black Fox testimony as applicable to either all LWR's, all PWR's or all Babcock &
Wilcox reactors.
Licensee's Response Licensee objects to this contention primarily on the ground that it bears no discernable relation to the bases on which the Commission suspended the operation of TMI-l or to the issues specified for consideration in this hearing. Licensee also has a number of secondary objections to the contention.
These include the failure of UCS to explain or provide the basis
6 063 for its allegation that in the TMI-2 accident non-safety sys-tems creamed demands on the safety systems that exceeded the latter's design basis. (The contention does refer loosely to the fact that failures of the relief valve and condensate sys-tems were principal contributors to the accident but does not even suggest that the failures led to conditions exceeding the design basis of any safety system.) Licensee also objects to UCS's effort to incorporate by reference in its contention testimony in the Black Fox proceeding not readily available to the Board or Licensee in the time frame provided for response to the concention. (No reference to the Black Fox testimony was included in UCS's draft contentions.)
Contention No. 18. The accident at TMI-2 was caused or aggra-vated by factors which are the subject of Regulatory Guides not used in the design of TMI. For example, the absence of an automatic indication system as required by Regulatory Guide 1.47 contributed to operation of the plant with the auxiliary feedwater system completely disabled. The public health and safety requires that this record demonstrate conformance with each Regulatory Guide presently applicable to plants of the same type as TMI-l or an equivalent level of protection.
Licensee's Response Licensee objects to this contention on the ground that it lacks explanation or specification of the factors in the TMI-2 accident which are the subject of Regulatory Guides not used in the design of TMI, thus providing Licensee with no basis for re-sponding to the contention or determining its relevance to the bases for suspension. The single example provided for this broad contention (absence of automatic indication of a disabled auxil-iary feedwater system) is already adequately covered by UCS Con-tention 9.
7'.6 Q64 Contention No. 19. The design of TMI-l does not comply with the Commission's regulations concerning fire protection, in-cluding GDC 3. The NRC staff has concluded that safety system modifications to implement an alternate shutdown system are required for TMI-1. The modifications are required because of a few specific plant locations wh..re the staff does not have reasonable assurance that a postulated fire will not damage both redundant divisions of shutdown systems. Therefore, unless these modifications are implemented and found to comply with all applicable Commission regulations, operation of TMI-l will endanger public health and safety.
Licensee's Response Licensee objects to this contention on the ground that it bears no relation to the bases for suspension or the issues specified for consideration in this hearing.
Contention No. 20. Neither Metropolitan Edison nor the NRC staff has presented an accurate assessment of the risks posed by operation of Three Mile Island Unit 1, contrary to the re-quirements of 10 CFR 51.20(a) and 51. 20 (d) . The decision to issue the operating license did not consider the consequences of so-called Class 9 accidents, particularly core meltdown with breach of containment. These accidents were deemed to have a low probability of occurrence. The Reactor Safety Study, WASH-1400, was an attempt to demonstrate that the actual risk from Class 9 accidents is very low. However, the Commission has stated that it "does not regard as reliable the Reactor Safety Study's numerical estimate of the overall risk of reactor ac-cident." (NRC Statement of Risk Assessment and the Reactor Safety Study Report (WASH-1400) in Light of the Risk Assessment Review Group Report,. January 18, 1979.), The withdrawal of NRC's endorsement of the Reactor Safety Study and its findings leaves no technical basis for concluding that the actual risk is low enough to justify operation of Three Mile Island Unit 1.
Licensee's Response Licensee objects to this contention. The contention seeks to raise as an issue under NEPA and the Commission's im-plementing regulations whether adequate consideration has been 7'6 065 given to so-called Class 9 accidents, "particularly core melt-down with breach of containment." The recent rulings of the Appeal Board and the Commission in Offshore Power Systems require rejection of the contention. The Appeal Board in Offshore Power Systems (Floating Nuclear Power Plants), ALAB-489, 8 NRC 194 (1978) held that Class 9 accidents need not be litigated in individual licensing proceedings for land-based plants, but were to be considered for the floating nuclear plants involved in offshore. The Commission itself has now reviewed ALAB-489 (Memorandum and Order, September 14, 1979) and has not reversed the Appeal Board's decision, as to either floating or land-based plants. The Commission agreed with the Appeal Board's conclusion that the Class 9 accident consequences should be examined for the floating nuclear plants involved in Offshore. As for land-based plants, the Commission announced that it intended to examine the matter generically by complet-ing the rulemaking begun with the publication of the proposed
" Annex" to 10 CFR Part 50, Appendix D (36 Fed . Reg. 22851-2, December 1, 1971). More importantly, the Commission directed that the Staff
- 1. Provide us with its recommendations on how the interim guidance of the Annex might be modified, on an interim basis and until the rulemaking on this subject is completed, to reflect developments since 1971 and to accord more fully with current staff policy in this area; and
- 2. In the interim, pending completion of the rulemaking on this subject, bring to our attention, any individual cases in which it believes the envi-ronmental consequences of Class 9 accidents should be considered.
716 066 Slip op. at 9-lu. Taken together, these statements make clear that the Commission has left ., force at least on an interim basis the Appeal Board's Offshore holding as to land-based plants--that the consequences of Class 9 accidents need not be considered in individual cases.
Further, there is no justification for UCS's leap from a TMI-2 accident to a core meltdown with breach of con-tainment. The actual consequences of the TMI-2 accident were in fact less than the consequences considered for the maximum design basis accident in the Final Environmental Statement for TMI Units 1 and 2.
Dated: October 31, 1979 7*6 067