Text

Forwards Statement in Reply to 791025 Notice of Violation & Answer to Notice of Proposed Imposition of Civil Penalties
	ML19309E477
Person / Time
Site:	Crane
Issue date:	12/05/1979
From:	Arnold R; METROPOLITAN EDISON CO.
To:	Stello V; NRC OFFICE OF INSPECTION & ENFORCEMENT (IE)
References
	NUDOCS 8004220393
	Download: ML19309E477 (98)
	v • d • e

.

,,. (*

.s Metropolitan Edison Company e

Post Office Box 480 Middletown Pennsylvania 17057 717-94+4e4+ 948-8000 December 5, 1979 Mr. Victor Stello, Jr.

Director Office of Inspection and Enforcement U. S. Nuclear Regulatory Commission Washington, DC 20535

Dear Mr. ciello:

3EO no Subj ect: Docket No. 50 6 Response to Notice of Violation and Notice of Proposed Issuance of Civil Penalties Your letter of October 25, 1979 transmitted a Notice of Violation and a Notice of Proposed Issuance of Civil Penalties based upon the Office of Inspection and Enforcement's investigation of the March 28, 1979, accident at Three Mile Island Unit 2.

Your letter also addressed some general remarks concerning Metropolitan Edison and its management controls for the operation of the Three Mile Island facilities.

We have carefully considered the information and conclusions set forth in your letter and in the Notices enclosed with it.

This consideration has been aided by many studies, analyses and reviews which we and others have undertaken since the March 28, 1979 accident. We have sought to forthrightly address eac.a of the charges while recognizing that many of the issues turn upon interpretations of complex procedures. Our detailed responses are set forth in two anclosures to this letter: Metropolitan Edison Company's Statement in Reply to Notice of Violation, and Metropolitan Edison Company's Answer to Notice of Proposed Imposition of Civil Penalties. These responses are based upon our present understanding of the accident. Certainly, our mutual understandin'g of the accident and its underlying causes can be expected to improve as studies continue.

Although the specific violations asserted in the Notice generally addressed the Unit 2 operating organization, the criticism of the October 25 letter is aimed at Metropolitan Edison's management controls. The problems with manage-ment controls were not obvious from events prior to March 28, 1979. The nature and extent of noncompliances identified during NRC inspections did not indicate fundamental problems with the safe operation of the plant. During the period from 1975 to 1978, operators at Three Mile Island had a failure rate on their NRC written and oral exams half the industry average. NRC performance evalua-tions ranked the Three Mile Island facility above the average for comparable plants. Metropolitan Edison does not feel that there was any significant decline in the Company's performance. What is clear to us is that changes in the approach to management and management controls must be made by Metropolitan Edison as well as the total nuclear complex, to address the deficiencies which the severe testing

(

of the accident revealed.

Metrocoutan Edson Company is a Memeer of the General Pubhc Utat:es System M

3

Victor Strilo, Jr. DIcembsr 5, 1979 To identify the nature of the needed changes, we have undertaken exten-i sive internal reviews of the Company's corporate structure and staffing.

Major changes have been made or are in progress in our approach to corporate management and controls. While many, if not all, of the changes which have occurred or are in progress have already been submitted to the NRC for re-view, it is appropriate to mention them again here. The IMI Generation Group was formed to integrate the nuclear management and technical support capabili-ties of Metropolitan Edison and the GPU Service Corporation in a single entity.

As a result, the professional technical staff for Three Mile Island has been tripled to a current level in excess of 200 with over 2,600 man-years of nuclear experience. A primary objective of the group is to ensure safe operations by means which include strict adherence to NRC regulations, Technical Specifica-tions, and plant procedure. Unit 1 and Unit 2 line management responsibilities have been separated in recognition of the different status of the units and each unit given direct control, to the maximum possible extent, over the resources necessary for the effective and safe conduct of plant activities. A

^

shift technical advisor has been added to the normal shift complement and sub-stantial additional attention will be directed to the operating experience of similar reactors and the nuclear industry as a whole.

Improvements in the organizational status and staffing of the health physics departments have been achieved (although we recognize that the unique circumstances of Unit 2 will require further significant improvements)

Upgrading of operational quality assurance, specific procedural requirements for the independent verification of operational activities affecting safety, and changes to the review and approval provisions for plant and emergency procedures have all been undertaken to improve management controls. Operating and emergency procedures are under review and revision as appropriate. A major revision and expansion in the training programs for the operating organizations has been made and a management training program is under development. We are taking steps to transmit the management commitments through all levels of the Company to assure that all personnel have a high degree of awareness of our comitment to safe operation. These items have been described in detail in our submittals to the Staff in connection with the Unit 1 restart.

1 These changes and our commitment to continued improvement underscore our commitment to correct the inadequacies which have now become clear. The hard lessons taught us by the events surrounding the accident have been comprehended.

The need to significantly upgrade our nuclear program has been recognized.

Metropolitan Edison, we believe, is confronting the issues raised by the acci-dent and its af termath and is taking the steps needed to resolve those issues.

e The Company has also conducted extensive reviews of the accident and related issues to ensure we have as complete an understanding as possible of all factors which contributed to the accident. It is our view that the accident cannot be i

traced solely to inappropriate operation action. Rather, it must be ascribed to a much more complex set of events. We find support of this view in the findings by the Advisory Committee on Reactor Safeguards, the President's Commission, and recent Commission statements.

The key to understanding the accident, in our opinion, lies not so much in the procedural violations which are charged, but with more basic causes. We believe that there are cio such causes. First, there was a lack of understanding, and thus, an absence of clear procedures, to deal with a small break loss of coolant accident from the sts'm space of the pressurizer. No guidance was given the operators for a LOCA from the pressurizar, in which pressure decreases while

,-s>w w---.,-rw..-

---~.

2_

Vict:r Stello, Jr. Decemb:r 5, 1979 pressurizer level increases. In fact, training and procedures prepared with-out knowledge of this detail of systen behavior probably inhibited proper operator action. The second basic cause was an exaggerated concern with "taking the plant solid." Technical Specifications and procedures prohibited this condition and the reactor simulator on which operators were trained could not simulate solid conditions. While operator training and plant procedures were deficient in a number of areas, these deficiencies arose from the under-lying lack of awareness by Metropolitan Edison, the nuclear industry, and the Commission that thekind of system behavior which the plant experienced could occur.

The investigation conducted by your Office in the aftermath of the acci-dent was the largest ever undertaken by the Commission. Even though it did not purport to is a full analysis of the causes of the accident, the investi-gation was unprececented in terms of scope, intensity, duration, and manpower.

It produced a voluminous.nd detailed report, NUREG 0600. The investigation discic2cd some violations of plant procedures. We have recognized these and are taking or have already taken steps to assure that there will be no repeti-tion. The investigation disclosed areas in which plant procedures were ambigu-ous or incomplete. We are modifying or have already rewritten those proce-dures to incorporate the lessons learned from the accident and are undertaking a comprehensive review of all plant procedures. The investigation disclosed aspects of the accident where conditions went beyond the bounds of plant pro-cedures and indeed beyond the bounds of previous industry assumptions of sys-tem behavior in accident conditions. And finally, the *.nvestigation also pro-duced some charges which, based upon our further analy~is, we believe are not adequately supported.

The accident was the worst in the history of the commercial nuclear power industry. Metropolitan Edison, the nuclear industry, and the NRC have been unalterably changed as a result. We recognize the fundamental need for these changes and are committed to the implementation of those that apply to us.

We will, of course, keep you informed of further developments, and are committed to working with the Commission to assure the operational safety of our nuclear program.

Very truly yours,

/

R. C.

od Senior Vice President RCA:cib Attachments l

1 i

i

3.

o UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION In the Matter of

)

METROPOLIIAN EDISON COMPANY

)

Docket No. 50-320

)

(Three Mile Island Nuclear

)

Power Station, Unit 2)

)

METROPOLITAN EDISON COMPANY'S STATEMENT IN REPLY TO NOTICE OF VIOLATION In accordance with 10CFR 2.201 and the Notice of Violation of October 25, 1979, Metropolitan Edison Company provides the following responses to the apparent items of noncompliance identified in the Not ic e.

1.

Statement of Apparent Honcomoliance:

Technical Specification 3/4.7.1, " Turbine Cycle," requires in Section 3.7.1.2, that three independent steam generator emergency feedwater pumps and associated flow paths shall be operable during power operations, except: if one emergency feedwater system is inoperable it must be restored to operable status within 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months or the plant must be in Hot Shutdown within the next 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months .

Contrary to the above, for an undetermined period just prior to the reactor trip at approximately 0400 hours0.00463 days 0.111 hours 6.613757e-4 weeks 1.522e-4 months on March 28, 1979, the flow paths to both steam generators were made inoperable by foedwater header isolation valve closure.

(In addition, on January 3, February 26 and March 26, 1979, the flow paths from all three emergency feedwater pumps were simultaneously made inoperable by feedwater header isolation valve closure during the performance of, and in accordance with, an improper surveillance test procedure.)

l -.

e

.m

z..

2.-.--.

.--- -.:~ w=:n.

Diecutaien:

Metropolitan Edison agrees that continued plant operation with the emergency feedwater header isolation valves (EF-V12A and 12B) in the closed position is an apparent breakdown in controls over the operability of safety related equipment as stated in NUREG 0600 Section I 2.3.2.

While Metropolitan Edison j

does not believe that controlled isolation of the feedwater header for rou-l tine testing is in violation of the Technical Specification, we agree that it is undesirable and steps will be taken to modify surveillance test procedures for the emergency feedwater system, and to provide routine (including some as frequently as each shift) status checks on components important to the safe operation of the plant. Our analysis supports the conclusion of the Kemeny Commission as stated in the Report of the President's Commission on The Acci-dent at Three Mile Island, "The loss of emergency feedwater for 8 minutes had no significant effect on the outcome of the accident. But it did add to the confusion that distracted the operators as they sought to understand the cause of their primary problem".

The emergency feedwater system, like many engineered safeguard features, is required to undergo periodic surveillance and testing which in some cases reduce the ability of the system to perform its intended function while in the test condition. Technical Specification 3/4.7.1 recognizes this condition and specifically allows 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months of inoperability of the emergency feedwater system before additional corrective action must be taken. Although the Technical Specification is written in terms of the inoperability of "one emergency feedwater system", (implying the exis-tence of more than one " system") there is only one emergency feedwater system for TMI-2.

The Safety Evaluation Report for TMI-2 (NUREG-0107, Sept. 1976, pg. 7-5) states, "The emergency feedwater system consists of one turbine drive pump, two motor-driven pumps and associated piping.

i

~~

~.

r

cnd vcivoo." Tha Tcchnical Specifiestion thsrsfera clicwa full icolction of all or part of the emergency feedwater system for up to 72 hours8.333333e-4 days 0.02 hours 1.190476e-4 weeks 2.7396e-5 months before proceeding to hot shutdown.

On this basis, the Surveillance Procedure 2303-M14A/B/C/D/E, " Emergency Feed System Valve Lineup Verification and Operability Test and Turbine Driven E.F. Pump Operability Test", Revision 8, is in compliance with Technical Specification 3/4.7.1.

It would appear that this judgement was confirmed by NRC inspection.

" Combined Inspection Report 50-289/

78-23 and 50-320/78-36", dated January 9, 1979, stated "The observations and records review were conducted to verify that startup, powcr and/or shutdown reactor operation were in conformance with Technical Specifica-tion safety limits, limi. ting safety system settings, and limiting con-dicions for operation".

Among the procedures inspected with acceptable results was SP 2303-M14A/B/C/D/E Revision 8, and acceptance criteria included requirements from Technical Specification 3.7.1.2.

This surveillance procedure was followed in January, February, and March 1979.

In January and February, as far as we can determine the emergency system was returned to full operation immediately upon completion of the testing.

The elapsed time from the March 26 test to the time of dis-covery of the closed valve was 42 hours4.861111e-4 days 0.0117 hours 6.944444e-5 weeks 1.5981e-5 months (and, therefore, also with(n the Technical Specification limit), if we assume that the valve was closed and not reopened after completion of the test.

The status of these valves following the March 26 test was reviewed with the people performing the surveillance on that date.

Three people have stated that the valves were reopened following completion of the surveil-lance procedure. How and when the valves actually became closed following the performance of the surveillance has not been determined despite ex-tensive investigation by many parties.

L

Tha Pr sidtat'o Commission was clso unable to datermins tha racron far thesa valves being closed. Their report states:

"A Commission investigation has not identified a specific reason as to why the valves were closed at 8 minutes into the accident. The most likely explanations are:

the valves were never reopened after the March 26 test; or the valves were re-opened and the control room operators mistakenly closed the valves during the very first part of the accident; or the valves wers closed mistakenly from control points outside the control room after the test."

We agree that the inability to provide any other testimony or documenta-tion to support that the valves were opened after the surveillance testing was completed on March 26 indicates a lack of management controls, and we have revised our procedures and training to correct this deficiency.

To assess the ef fects of. EF-V-12A/B being closed on the outcome of the ac cide nt, a comparative analysis has been made of the TMI-2 accident with and without delay in the initiation of emergency feedwater (EFW). This analysis was performed with the RETRAN Systems Analysis code. After a benchmark against plant data was made for the first eight minutes of the accident (the EFW delay time), the same case was reanalyzed without the delay.

The results are provided in the attached figures. A review of Figures 1 and 2 shows that the depressurization rate is less severe.with-out EFW than it is with normal EFW.

This is attributed to the depressuri-zation resulting from the additional cooldown.

Inbothcases,howhver, J-the primary system would saturate as can be seen from Figure 3 which shows that the hot leg saturation occurs at almost six minutes with normal EFW flow. This is approximately the same time that the hot leg saturated during the accident.

The pressurizer level for each case is shown in Figures 4 and 5.

Al-though the pressurizer filled in about six minutes during the accident as

1 c rc: ult of high prassuro injactica flow, Figura 5 shcwa thet th3 pecc-surizer would also fill in about nine minutes for the case with normal EFW

~

as a result of void swell into the pressurizer. Hi gh pressure injection was not included in this case, so the pressurizer would in fact be filled even sooner.

In both cases, pressurizer level is rspidly increasing while pressure is not responding similarly.

In both cases, the primary system is voiding and losing mass through the stuck open PORV at the eight minute point.

t The conclusions of the above discussions are that system behavior, includ-ing pressurizer level, with or without an eight minute delay in EFW, is very similar and that subsequent operator actions keyed to pressurizer level would be essentially the same whether or not the emergency feedvater had been lost for 8 minutes.

Corrective Action:

Metropolitan Edison believes that in the interest of improved plant safety it is important to take all reasonable steps to assure the maximum avail-ability of all safety related systems and systems required for safe shut-down.

Toward this goal, all surveillance and test procedures are being reviewed for both units 1 and 2.

In particular, the Unit 2 emergency feed-water system surveillance and test procedures will be modified to avoid J

isolating all flow capability from the emergency feedwater system during surveillance and testing so that at least two feed pumps and one flow path from the emergency feedwater system will be operable at all times. This item is not an issue for Unit I due to the differences in design of the Unit 1 system.

l 1

l

-S-

,g

= - -

In tdditien, a formal reutina shift chsck of enginssrsd safsgusrds squip-ment, including tha status of emtegency feedwater pumps and valves has been instituted for those systems necessary for safe operation of TMI Units 1 and 2.

2 4

Tne importance of diligent monitoring of the status of safety equipment and the role of the various administrative control systems in assuring proper l

and safe operation of plant systems is being emphasized in our operator

,i training program.

il e

4 6

4 4

t i

G

~..

e

_f_

\\

107 A HDT LEG PRESSURE, PSIR j

pse is9s isse 215s 2sse 2548

~

- " ~ ~

-J N

LD 8

,e h

./

to

/

--I

/

3 m

i

/

i

/

Z

/

m O

i-N

/

O ys

./

g y

lf rn O

o S

r'

/

r W W, n

21 G

G I

\\

r-i Qc

'c

\\

E r

c

\\

m

=

m rn tus U3 n

rr 2

i oy

\\*

M 3

l-g8 8

~

m O

l rra l

~

=

i

~'

1 3EDId e

e l

i f

l

t

. \\

FIGURE 2 m

6 a

4 5

i R

y m

u.J

."2 G

.I s

o

.CD g O..

z

-y O

h.)

t/J x

7 sc

=

.3 e t.L.

cz-

~

o c3

J

.D tr E

r O

tr E

o u

z

~

I'

>=*

Ds C2 w

nu Z

un LU Q

a.

O t.u z=

\\

N I

e a

g

+

Q l

(n E-

~

N&

c3 e

s e 7'

190C 1993 I92Z I99I T 5.hI I98 1

0]Sd

3BnSS38d 03710H 6 LOT w

e-

1l

,il

,I 11j1 l

5h w.

i!

i 0

9 6

0 6

1

)

i 5

SE TU g

N e

I L

s.

o M

0 u.

t 0

e d.

i 8

o 1

e l

(

l s

s V

F

. V XU r

0 F 0 O i

Ai ed 9 L pa a

pe A

UI M

l I

O M

R R

F O

N 0 E 1

2 i

3H H

I T

T I

V D

d T

a E

S N

e 0P l

E I

9 R l

i D

r L

2 I

e E

C p

N p

I U/

2 r

T' s

e 0

It p

1 6 1

p H

U T

l i

9 i

n 1

0 1

i 8

3/

70

i,i iI l. :

h os.

g go*

g9 g

hc t $HQ o

,e8

a

~

07/31n9 THI-2 INCIDENT ANALYSIS (8.HINUTES) l i

I I

I n

Reactimeter Data Retran mr I

O Z

i e

_J o j--

-- (Top of Indicator iti@

Range is 400 i

y

/ '

inches)

J M

/

W

/

No

/

mN M O

/

3 (n

/

(n

/

d

/

M

/

L

\\

o

/

e

/

N

{

p

,/

s i

S

/

l 3-

.s.[.

y" e

.,f3 g

g i

R.

, 80 160 zw.'

320,7 '

900 900 560 elo '

9 g

ELRPSED2 TIME FROM LOFV (SECONDS) d I

1

-n-PRESSURIZER LEVEL. INCHES.

g, 159 209 254 309 g.

i mi O

-J N

8 C.d

.-su CD

=4 3

-ca cm I

rc g

~

,~.e Z

7 71 G

F "D 2 U.o

,~

O Im CA Z

TTI

.-4 C

C

-=4

~.

--t Z l.af rTI B c

Z n

N ~.,~

2 i

W l

O

' ' /..

s 1

o F

r

.c Co o

-n o

.s C

C X

^

"Tl C

Mo o'

CO z8 o

1 M

zC

.-4 TTI LO w

4

- ;g; S 32nDI3 a

e s

g e

e

_,my.m-m k-

2.

Strtement of Apper:nt Nrncomplirnca:

The severity and uniqueness of the accident which occurred at Three Mile Island resulted in a marked reduction in the normal good health physics practices which are mandated by the NRC Regulations. Under the circum-stances of an accident of this magnitude the NRC recognizes that in the interest of reactor safety a departure from normal health physics prac-tices and standards may sometimes be mandated by the exigencies that exist during such conditions. However, the NRC also believes that the licensee, with the resources available and taking into account the time frame available for conduct of safety-related functions, could have taken additional measures to better control the overall health physics actions and decisions which were made during the course of the accident. The following items of noncompliance exemplify unacceptable degradation from health physics practices pertaining to control of access to high radia-tion areas, conduct of radiation surveys, and personnel radiation exposure monitoring.

10 CFR 20.201, " Surveys," requires in Section (b) that each licensee shall make or cause to be made such surveys as may be necessary to comply with the regulations in 10 CFR 20.

10 CFR 20.202, " Personnel Monitoring," requires that the licensee supply appropriate personnel monitoring equipment and requires its use for each individual who enters a restricted area and is likely to receive a dose in excess of 25 percent of the applicable value specified in 10 CFR 20.101.

l l

Technical Specification 6.12. "High Radiation Area," requires that each area in which the intensity of radiation is greater than 1000 mrem /hr be provided with locked doors to prevent unauthorized entry into the area and that any individual entering the area be equipped with a continuously indicating dose rate monitoring device.

10 CFR 20.103, " Exposure of individuals to concentrations of radioactive materials in air in restricted areas," requires in Section (a)(3) that the licensee make suitable measurements of the concentrations of radio,

active materials in air for detecting and evaluating airborne radioac-tivity in restricted areas for the purposes of determining compliance with the regulation in 10 CFR 20.103(a)(1).

10 CFR 20.101, " Exposure of individuals to radiation in restricted areas," requires that no licensee possess, use or transfer licensed material in such a manner as to cause any individual in a restricted area l

co receive in any period of one calendar quarter a dose in excess of three rem to the whole body, or 18 3/4 rem to the hands and forearms, or 7 1/2 rem to the skin of the whole body.

General Discussion:

The specific statements of apparent noncompliance (2A through 2F) address apparent break downs in good health physics practices. Although l

l Metropolitan Edision does not agree with the conclusions of noncompliance l

in each case, the total assessment clearly indicates areas where -

Unprovements in emergency health physics practice are needed. Addi-tional comments are provided immediately following each statement (2A through 2F) for each example of apparent noncompliance.

In evaluating the execution of the post-accident radiation protection pro-gram it must be remembered that this accident was the worst experienced in the commercial nuclear power industry.

In addition only five people re-ceived doses exceeding their occupational quarterly dose limits during the period immediately following the accident.

As pointed out by the NRC above, under the circumstances of an accident of this magnitude departure from normal health physics practices and standards may sometimes be mandated by the exigencies that exist during such condi-tions. In some cases, the extreme levels of radiation did not allow for rapid complete area mapping prior to access. The heavy use of all available radiation instrumentation and contamination of analytical equipment req-quired alternate dose assessment measures. The immediate need for equip-ment operation and surveillance resulted in some violations of controlled access requirements. And the assignment of less experienced personnel to man stations replacing more experienced personnel required elsewhere re-sulted in delays in radiation assessments.

In all of the above situations, alternate measures were sought and applied in carrying out good health physics practices and constant ef forts were made to maintain acceptable health physics performance levels while meeting the operational demands of the accident.

Summary of Corrective Actions:

To further strengthen our program actions including the following are being implemented. _

Mintginsnt hns pitcsd incrassid emphecis on observation of gecd rtdic-tion protection practices in all aspects of routine daily activity.

Since the immediate post-accident period there has been a substantial ef-fort to upgrade the entire Health Physics / Radiation Protection program.

Numerous contract HP technicians and supervisors have been added to sup-port the station staff. Additional people in technician and supervisory positions have also been added to the permanent plant staff.

Further additions to the permanent staf f are planned.

The revisions to the Radiation Emergency Plan has placed significant addi-tional emphasis on In-Plant Health Physics retraining on accident condi-tions. Procedures are being developed to define the specific approach to high airborne activity and the ability to analyze samples with extreme levels of gaseous activity.

Because of the lack of on-site monitoring capabilities, site monitoring devices will be reevaluated and enhanced as necessary.

The upgrading of equipment requirements will enhance and thus eliminate the deficiencies in the respiratory program.

The addition of long handled tools and portable shielding will be completed as well as training of chemistry personnel. Additional gir monitoring equipment has been purchased and is in place.

The added a

capabilities for normal operations will provide increased assurance that response during emergencies will be adequate.

Retraining programs for Radiation Protection Personnel will also place additional emphasis on air sampling techniques and respiratory protection during normal operations. The procedures covering the respiratory pro-l tection program have been upgraded and are in effect.

i I l l

--._- : ~. _. w.

a Tha hsalth physics pregram will b2 raviscd to firmly establich 'ths posi-tive conte l concept and required training of all appropriate personnel q

will be undertaken to assure that full compliance with a positive control program is achieved, even under accident circumstances. The Technical Specifications 6.12.2 should be modified to permit the imposition of a positive control entry system during periods when locked doors are im-prac t icab le, impossible or inconsistent with good health physics practices.

The revised Radiation Protection Plan has been submitted to the NRC in Amendment 7 to the Unit 1 Restart Report and a similar plan is being completed for Unit 2.

Revisions to the Emergency Plan have resulted in specific procedures which will be written to addre'ss post accident sampling and analysis to insure minimal exposures by personnel involved.

The revision to the Emergency Plan includes specific plans for increased Health Physics support during the response to an incident.

Included in the plan is the organization to focus on the documentation and evaluation of individuals who are contami-nated.

Procedures will be developed and training of personnel will be accomplished to fully implement the emergency plan prior to the start up of Unit 1.

The revised Emergency Plan has been submitted to the NRC as part oE the Unit 1 Restart Report and is currently being reviewed for their acceptance.

The following gives additional comments to be considered in evaluation of the specific claimed noncompliances.

I e

s

?

l l _. _.... _..

_ ~.._. _. -.

2A.

Stctement of Appresnt N;ncomplienen

.j

~

From 1100 hours0.0127 days 0.306 hours 0.00182 weeks 4.1855e-4 months on March 28, 1979 until the afternoon of March 30, 1979, the doors to the auxiliary building were not locked and access was not otherwise controlled even though the building was known to be a high radiation area with radiation levels much greater than 1000 mrem /hr during this period; Discussion:

Technical Specification 6.12.2. provides that " locked doors shall be pro-vided to prevent unauthorized entry into... areas" in which the radiation level exceeds 1000 mrem / hour. During the period from 1100 hours0.0127 days 0.306 hours 0.00182 weeks 4.1855e-4 months on March 28, 1979 until the afternoon of March 30, 1979, areas within the auxiliary building had radiation levels above 1000 mrem / hour. The auxi-liary building was not locked. However, a program of positive control over entry was established as contemplated by 10CFR 20.203. Under the circumstances of the accident, there were a small number of cases (two of which we are aware) in which the positive control program did not result I

in the level of control desired. The failure to have locked doors con-stituted a deviation from the Technical Specificatics, but steps were taken to be consistent with good health physics practices. Although Metropolitan Edison acknowledges that failure to maintain positive con-trol in any particular instance constitutcs a noncompliance with 10CFR20, the overall program as implemented during the March 23 - March 30 period was in conformance wita 10CFR20.

e The locking requirements of Technical Specification 6.12.2 are not written l

cn provide an exception for cases in which spaces cannot or should not be locket,

10CFR20 on the other hand allows control of access to "high radi-ation areas" (i.e. areas with radiation levels greater than 100 mrem / hour) based upon "pou stive control over each individual entry" during periods

[

y wh n accase to tha croa is required.

10CFR 20.203 (c)(2)(iii).

It was this mechanism which was used to control access to the auxiliary building during the' period in question.

Following declaration of the Site and General Emergency, positive control was established. The first steps were positive control of all individuals on site, ingress and egress control to the station, evacuation of non-essential personnel and individual task assignment briefings by responsible individuals prior to entry for monitoring or other activities. To the ex-tent possible, the maximum amount of protective and monitoring equipment was provided. Under the conditions of the accident, " positive control" was maintained during the period in question.

No entry to the auxiliary building was to be made without' appropriate authorization. As circum-stances allowed, information on known conditions inside the auxiliary building was communicated to personnel prior to entry.

To improve reliability of entry control on March 29, the radiological con-trol point was moved from the ECC and ECS to the main entrance of the auxiliary building. This was possible because of the reduced levels of airborne contamination. The process of moving control points centinued as' radiological conditions permitted.

As the Notice of Violation recognizes, departures from normal health 3

physics practices are sometimes mandated by accident conditions.

Un-anticipated conditions arise where normal practices, such as locked doors or local control points, can lead to unnecessary exposures to plant per-sonnel and can be contrary not to be good health physics practices.

By setting up a positive control program during the accident, the attempt was made to -comply with good health physics practices to the max mtma extent while meeting the operational demands of the accident.

'le believe !

.a.

=

~ ~ ~.

a i

- 1

. \\

t,

that the magnitude of the accident must be taken into account in evaluating j !

i the seriousness of the instances where the controls which were established failed to be fully effective.

i e

e I

1 W

e t

i e

-18=

y m.-

7 w

~

.,,__.._~me.

28.

Stctr: mint of Apperant Noncomplirnen:

From the evening of !! arch 28, 1979 until the evening of March 29, 1979, i

at least two entries into the auxiliary building were made by individuals who were not equipped with a radiation monitoring ' device which continuous-ly indicated the dose rate; Discussion:

Metropolitan Edison agrees that a violation occurred in that the individ-uals specified in NUREG 0600 Sect ion II 3.2.4.6 and II 3.2.4.8 did not have radiation monitoring devices which at all times indicated the dose rate.

In each case, individuals were making entries into the Auxiliary Building with some awareness of information on dose rates and anticipated exposures, and attempts were made to provide monitoring equipment from the available equipment.

As indicated in Section II 3.2 other individuals who had previously entered the areas were questioned and approximate dose rate information was deter-mined. The approximate total exposure information for previous entries into the Auxiliary Building was also available for guidance to individuals planning an entry. A briefing was generally provided to each individual to insure that he was familiar with the specific task to be performed and the exact areas to which he was going.

Sect ion 3.2.4.8 indicates that this operator was aware of the area,with respect to proximity to primary system piping and available shielding.

Section 3.2.4.6 states that personnel did carry dose race instrumentation but at times the low range instrument was off-scale.

Every effort was being made to provide each individual with the proper instrumentation.

However the limited number of instruments available during the first hours of the accident prevented this is some cases. The individual was aware of e.

c tho dres r to to which h2 would be cxpo:cd and had cetimated tha tecol cx-5 posure to perform his task,as 500 meca. This was based on discussions with i

o;her personnel who had recently exited from the same area.

The exposures received by personnel making Auxiliary Building entries were not as low as we would have liked to have achieved. However, there were few overexposures relative to the number of entries and the associated radiation levels. The highest exposures due to Auxiliary Building entries were not significantly greater than the occupational limits specified in 10CFR20. Also, during the initial days following the accident, evaluations were constantly being made to determine the risk associated with each oper-

~

ations and maintenance function, based on previous dose-rate and exposure information, areas which had to be entered and time needed to complete the ~

ac t ion. These risks were evaluated against the risk to plant personnel and the general public due to not performing the function.

4 5

s o

l 1

l,

2C.

Sectement cf App rnnt Noncomplirac'4:

{

No measurements were made of the concentrations of airborne radioactive i

materials in the Unit 2 auxiliary building for periods during which individuals.,were exposed from 1100 hours0.0127 days 0.306 hours 0.00182 weeks 4.1855e-4 months on March 28, 1979 through f

midnight March 30, 1979, nor in the Unit I nuclear sample room and primary chemistry laboratory for periods during which individuals were exposed from 0400 hour0.00463 days 0.111 hours 6.613757e-4 weeks 1.522e-4 months <

a March 28 through 0800 hours0.00926 days 0.222 hours 0.00132 weeks 3.044e-4 months on March 30, 1979.

Discussion Technical S'pecification 6.11 requires that procedures for personnel radia-tion protection be prepared consistent with the requirements of 10CFR20.

10CFR20.201(b) requires that each licensee make or cause to be made such surveys as may be necessary for him to comply with the regulations in this

~

part. Section 20.201(a) states that a " survey means an evaluation of the radiation hazards incident to the production, use, release, disposal, or presence of radioactive materials or other sources of radiation under a specific set of conditions. Wen appropriate, such evaluation includes a I

physical survey of the location of materials and equipment, and measurement of levels of radiation or. concentrations of radioactive material present."

The general guidance of 10CFR20.201 therefore is applicable and Metropolitan Edison does not believe it was in violation of this regulation.

Emergency conditions existed which made physical measurements impossible.

Specifically, because the on-site analytical equipment was located in a high 4

background area and the samples that were taken had been gas saturated, the Ge (Li) capabilities were ineffective. Although a physical survey was de-sirable, the ineffective on-site analytical equipment prohibited its comple-tion.

It was e-.d.

felt that a physical survey at that time was necessary to I.

5 comply with 10CFR 20.201(b). Upon the arrival of a mobile laboratory on March 28 at the Observation Center, two in plant air samples were analyzed t

i '

l l

m

____y_

far iodina cctivity using a G3 (Li) datteter. Naithsr indicctsd chovo tho f

~

minimum detectable activity for I-131 (NUREG 0600 Chapter 3 Section 3.2.4.6).

j

' This delayed sampling demonstrated that the airborne limits wre not exceeded.

?

The use of Self-Contained Breathing Apparatus unt s as denonstrated in NUREG 0600 Chapter 3 sections 3.2.4.4, 3.2.4.5, 3.2.A.7, 3.2.4.8 and 3.2.4.9 exemplifies the maximum positive action taken in the evaluation and protection of inhaled contaminates by the personnel involved.

The referenced paragraphs also establish that individuals were given whole body counts as soon as practical.

Rasults of whole body count analysis showed that the protection afforded was sufficient to maintain internal exposures within acceptable limits.

The actions taken during the accident were within the general guidance and the intent of 10CFR20.201 for the circumstances that existed.

E f fo rt s were made to establish airborne activity levels, but, since operations which were vital to directing the plant to a safe condition and minimizing the impact on the health and safety of the public were necessary, some actions were taken without the benefit of thorough sampling and analysis.

Repeated ef forts to obtain additional samples and perform analyses would have resulted in added personnel exposure without assurance that the de-cermination accurately represented the hazard. The data, although infor-mative would not have caused a change in the health physics practices given the equipment available during the caergency.

i'.

I

~

t e

2D.

Streement of Apparent Noncomplirnen:

On March 29, 1979, an Auxiliary Operator was permitted to enter areas of i

e auxiliary building where exposure rates of up to 100 R/hr existed.

f diation survey information and appropriate personnel monitoring were not provided to the operator for this entry.

This contributed to the operator receiving a whole body dose of 3.170 rems. When this dose was added to the operator's previous dose for the quarter, the operator's quarterly whole body dose was 3.870 rems as measured by personnel dosi-metry devices; Discussion:

10CFR20.101 (b)(1) states that "during any calendar quarter the total occupational dose to the whole body shall not exceed 3 rems."

It is evident by the indicated reading of the individuals TLD that the 3 rea limit was exceeded and therefore the regulation has been violated.

However, Metropolitan Edison feels that appropriate instrumentation to define radiation levels was provided as well as adequate dosimetry in the form of TLD's.

As indicated in NUREG 0600 Chapter 3, section 3.2.4.7, a high range self-reading dosimeter was not available. As described in 3.2.4.7 of NUREG 0600, the individual did not inform Radiation Protection personnel of his intention to make a second entry into the auxiliary building. The individual assumed that his exposure was about I rem based on dose rate and stay time information. No one was informed that the in-dividual's Low-Range Self-Reading Dosimeter was off-scale.

Following the second entry by the individual and upon determination by his supervisor of the off-scale reading on the self-reading dosimeter, the individual was removed from radiation areas and his TLD processed.

The events show the intent to follow sound Health Physics practices and j

provide adequate monitoring during the accident conditions. The events t

e i j

- l

d3 howev3r show th3 tesd for additicusi high rcngs monitoring cquipment t

~~

and the desire of personnel to respond to the actions necessary to r

mitigate the consequences of the accident.

l i

i i

i I

t i

't J

i I

f

~

l

(

e

2E.

Strteme5t of App *rrnt Noncomplianent f

I building where the radiation level was greater than that which could be

-3 On March 29, 1979, a Nuclear Engineer entered an area of the auxiliary measured by-his portable survey instrument (2R/hr).

Failure to perform a survey of the exposure rate in this area contributed to the individual receiving a whole body dose of 3.14 rems for this entry.

When this dose was added to the engineer's previou# dose for the quarter, the engineer's quarterly whole body dose was 4.173 rems as measured by personnel dosi-metry devices; Discussion:

This item is a violation of 10CFR20.101. However, the following circum-stance must be considered in evaluating this incident:

In the time period (approximately 12 hours1.388889e-4 days 0.00333 hours 1.984127e-5 weeks 4.566e-6 months ) prior to the Nuclear Engineer's entry into the auxiliary building, there was considerable concern for water leaking into the building from an unknown source. During the day of March 29 accumulated water had been removed from the basement floor via floor drains to the auxiliary building sump pump (s).

By 6 PM the water level had again increased 2 to 3 inches on the 281' elevation.

This water was thought to be a possible contributor to the continuing, uncontrolled release of radioactivity to the building and ultimately the environment. Since the water level was continuing to increase, it'was con-sidered vital to identify the source of leakage. An entry team was sent into the auxiliary building in an attempt to visually locate sources of d

leakage. Prior to entry the team, consisting of two engineers, was briefed on the known radiation areas in the auxiliary building. Radiation levels known at that time were limited to information obtained from previous en-tries. Information was limited because of the relatively small number of 3,

previous entries and the rapidly changing conditions. The entry team also I

reviewed the intended locations of the areas to be checked and entry and exit' routes.

l l

e w

Tho entry tsam was properly decscsd es indicceed en I&E Tecnceript of i

Intarview of "Enginser J" (May 2,1979, Tapes 92-93), p.13.

i Each engineel was provided with a radiation monitor.

One had a high range instrument (0-1000 R/h) and the other had a low range instrument (0-2R/hr). A second high range instrument was not available.

Each was also provided with self-reading dosimeters.

Together, the two engineers intended to jointly inspect a variety of equip ment and cubicles, frequently monitoring radiation levels.

Shortly after entering, the high range monitor failed.

The re fo re, the engineers tried to avoid areas with radiation levels beyond the range of the low range in-.

strument.

However, in the one area where they were unable to avoid radia-tion levels above 2R/hr, they checked their self reading dosimeters after leaving the area.

Self-reading dosimetry was checked after leaving an area in which the low range monitor reached the full scale resding. At that time each engineer had received less than 500 mR.

The engineers separated after 10 minutes of the 15-20 minute total entry time.

The engineer with the low range instrument returned to the 281 elevation to conduct a further investigation. The other engineer went to the radwaste panel (a lower radiation area) to adjust valve positions The engineer with the low range instrument continued the touY, frequently checking the radiation levels and attempting to cover as much of the 4

building as possible.

After finding that the radiation level at the door-way to the RC Bleed Tank room was 2R/hr, he checked his low range self-reading dosimeters and noted that it was off scale.

I The engineer immediately.

left the auxiliary building.

The high range dosimeter read in excess of I

3R.

Each man was debriefed by a Radiation Protection Foreman for the lo-cation of high radiation areas.

The Supervisor of Radiation Protection Y sim. *.

.-w and Chemistry instructed tha cnginacr with th3 high rarding to h vo his f

TLD read to confirm the exposure. The exposure was confirmed and the Y

engineer was restricted from further activities in controlled areas for I

the remainder of the quarter since his exposure exceeded the 3 Rem / quarter limit of 10CFR20.

Separate reports and evaluations have been submitted to the NRC regarding this matter.

The entry which resulted in the exposure of the Nuclear Engineer in excess of limits specified in 10CFR20 was made with strong consideration toward exposure control. The entry was considered to be vital to the limiting of release of radioactivity and minimiring the effect on the general public.

~

Proper radiological practices were followed to the degree possible under tPe existing conditions.-

This dose was well within the annual guideliner of 10CFR20 and far be-low the guidance of the Nationsi Council on Radiation Protection for emer-gency and accident conditions.

0 9

J t

e l !

2F.

Stetsment ef App rsnt Noncomplirnenf I

On March 29, 1979, a Chemistry Foreman wts parmitted to repeatedly enter high radiation areas and handle samples of highly radioactive reactor coolant. This contributed to the Foreman receiving a whole body dose of 4.100 rems. When this dose was added to the Foreman's previous dose for the quarter, the Foreman's quarterly whole body dose was 4.115 rems as measured by personnel dosimetry devices; 2C.

Statement of Apparent Noncenoliance:

On March 29, 1979, a Chemistry Foreman and a Radiation Protection Foreman were permitted to handle a highly radioactive reactor coolant sample without adequate personnel monitoring and without first performing a survey of hand and forearm exposure rates. Handling of this sample resulted in a calculated dose to the hands and forearms of the Chemiatry Foreman of about 147 rems and a calculated dose to the hands and forearms of the Radiation Protection Foreman in the range of 44 to 54 rems; Discussion Items 2F and 2G deal with the same event and therefore are covered together in this discussi.q. Metropolitan Edison Company agrees that while obtaining a Reactor, Coolant System sample on 29 March 1979, ex-posure to the whole body of one individual and exposure to the extrem-ities of several individuals exceeded 10CFR20 limits. Also we agree that adequate extremity monitoring was not used by the individuals, however all evaluations of extremity exposure have been completed and documented.

Metropolitan Edison feele however that the circumstances surrounding the drawing of the sample indicated that serious atter. tion was given to radio-logical practices and that the sample was obtained in a way that minimized v

exposure using available equipment considering the urgency of the sample requirements.

The individuals involved in the sample were knowledgeable both in the 1

sample system and radiation protection prectices. A plan to obtain the

[

sample was developed by the individuals which included providing respira-tory protection, protective clothing, high range dose rate instruments, i,

1 l

rstctica of perstan31, ch:cking of dssa retcs oftar occh secp cnd ch:ck-I L

ing of self-reading dosimeters after each step. The sample was not I

obtained untir the individuals felt confident that all were aware of the plan and that all reasonable planning had been done. Extremity monitors were not immediately available. The use of wrist badges which were on-site would not have eliminated the need for the evaluations performed but would have simplified them.

During the drawing of the sample, the plan was followed to the degree pos-sible and dose rates and exposures were continually checked. Although contact dose rates from the sample were greater than the range of the high range instrument available, dose rates at a few inches were measured which provided an indication of the readings on contact.

e G

e 0

t e

2H.

Stetocant of Apptrant Nancomplienes:

T On March 28, 1979 and March 29, 1979, several individus1s receivsd skin

[

contamination of the hand and other parts of the body sufficient to cause

]

exposure rates in the range of 20-100 mR/hr when measured with a hand-held survey instrument and no evaluation of the dose to the skin of these individuals was made.

Discussion:

Metropolitan Edison agrees that in the cases of individuals contaminated on March 28 and March 29, 1979, a ti=ely evaluation of the dose to the skin of these individuals was not performed.

For those individuals whose exposure exceeded the limits of 10CFR20.101, failure to provide a written report within 30 days is a violation of 10CFR20.405. Evaluations have been made based on available information, including whole body count data, survey data, and personnel interviews. A report (Ref. Mec-Ed letter GQL1094 of 21 August 1979) has been submitted for those le Mviduals in which the skin dose due to the contamination was a contributing factor in exceeding their quarterly dose limit.

For those individuals whose skin dose was below the 10CFR20 specified limits, evaluations are complete and available.

It should be noted that the exposure rates were measured immediately fol-lowing entries into the Auxiliary Building or Nuclear Sample Room.

Initial decontamination ef forts occurred within a few hours and in some cages, within minutes. The decontamination ef forts resulted in a significant re-duction of contamination levels for personnel involved, i

4 I

s-e l

l L I

=. -

3 3.

Statcm:nt of Apptrent Noncomplianca:

I 4

Technical Specification 6.5.1, " Plant Operations Review Committee,"

.I requires:

in Section 6.5.1.6 a, that t!.; "l?ar Operations Review Commit-i tee (PORC) review all procedures (and changes theretc) required by Technical Specification 6.8 and any other procedure (or change) determin-ed to af fect nuclear safety.

Contrary to the above, inadequate re iews were performed on both Proce-dure Change Reques t No. 2-78-707, Reviu.on 4 to Surveillance Procedure 2303-M27A/B, and Procedure Change Request No. 2-78-895, Revision 8 to Surveillance Procedure 2303-M14A/B/C/D/E; both were reviewed and approved by the PORC (November 9, 1978 and August 15, 1978 re;;ectively).

Each approved change included a valve lineup which resulted in emergency feedvater header isolation, contrary to Technical Specification 3/4.7.1 requirements.

Discussion:

Metropolitan Edison does not believe that it has violated the cited Technical Specification.

On August 15, 1978 the Plant Operations Review Committee (PORC) reviewed and approved in writing Procedure Change Request (PCR) No. 2-7d-707, finding that this item did not constitute an unreviewed safety question.

On November 9, 1978 the PORC reviewed and approved in writing PCR No.

2-78-895, finding that this item did not constitute an unreviewed safety questior.. These actions demonstrate conformance with Technical Specifi-cation (.5.1.6.a and 6.5.1.7.b which requires a written determination as to whethet or not changes to procedures constitute an unreviewed safety question.

As discussed in connection with Apparent Noncompliance 1, Metropolitan Edison believes that neither PCR was contrary to the interpretation of the Technical Specification 3/4.7.1 requirements. Therefore the reviews I.

I conducted by the PORC were not inadequate. This belief is confirmed by the review and acceptance by the NRC of Revision to Surveillance Pro-l cedure 2303-M14A/B/C/D/E documented in their Inspection Report letter l

dated January 9, 1978, " Combined Inspection 50-289-78/23 and 50-320/

78-36.".

J; T

Many approvsd su;;et tlence and test procedures rendar safsty relstad sye-

[y tems inoperable for short periods of time and so long as the inoperable

(

period does not exceed the Technical Specification time limit for system inoperability this practice has been considered acceptable by both Metropolitan Edison and the NRC.

Examples of similar surveillance and test procedures are:

2303-M2A/B - Decay Heat Removal Pump Functional Test and Valve Operability Test 2303-SA2

- RS Hatch Leak Rate and Interlock Test 2303-M25AIB - Decay Heat Closed Cooling %'a'ter Pumps Functional and Valve Operability Test.

The reasons for the changes to the surveillance procedures were to take into account unnecessary thermal shock to the emergency feedwater nozzles and to obtain repeatable results for tests required by the ASME Code Section XI.

The thermal shock consideration for the emergency feedwater

ince the frequency of the tests required by the nozzles is significant s

ASME Code Sect XI would reduce the number of available thermal cycles associated with normal EFW actuation, thereby reducing the service life of the nozzle connection due to higher cumulative thermally induced stresses.

Corrective Action:

Because Metropolitan Edison believes that the subject PORC PCR review was in conformance with the Technical Specifications no specific action is required. We do not believe that these PCR's placed the, emergency feedwater system outside the licensee requirements.

However, as discussed in connection with Apparent Noncompliance 1, I

Metropolitan Edison believes that in the interest of improved plant t

safety it is important to take all reasonable steps to assure the m

4

j; I

t maximum availability of all safety related systems required for safe shut-

}

down. Toward this goal, all surveillance and test procedures are being T

reviewed for both Units 1 and 2.

In particular, the emergency feedwater system surveillance and test procedures will be modified to avoid isolating all flow capability from the emergency feedwater system during surveillance and testing so that at least two feed pumps and one flow path from the emergency feedwater system will be operable at all times.

In addition, a formal routine shift check of engineered safeguards equip-ment, including the status of emergency feedwater pumps and valves, will be instituted for those systems necessary for safe operation of TMI Units 1 and 2.

e t

2 t

e i

l l l

3 4.A Streement af Apperrnt Noncomplirnen:

j 4

Technical Specification 6.8, " Procedures," requires in Section 6'.8.1 that I

procedures be established, implemented and maintained covering identified i

activities.

A.

Emergency Procedure 2202-1.5, " Pressurizer System Failure," Revision 3, requires in Section A.2.B.1 that electromatic relief isolation valve RC-R2 be closed if, among other things, the valve discharge line temperature exceeds the normal 130*F.

Contrary to the above, the electromatic relief valve discharge line temperature had been in the range of 180*-200*F since October of 1975 and isolation ' valve RC-R2 was not closed as of 0400 hours0.00463 days 0.111 hours 6.613757e-4 weeks 1.522e-4 months on March 28, 1979. Additionally, on March 28, 1979, the discharge line temperature of 283*F was noted at 0521 hours0.00603 days 0.145 hours 8.614418e-4 weeks 1.982405e-4 months , but the isolation valve RC-R2 was not closed until 0619 hours0.00716 days 0.172 hours 0.00102 weeks 2.355295e-4 months , allowing a significant loss of RC inve~ntory.

Discussion:

1.

Operation from October 1978 Metropolitan Edison believes that Emergency Procedure 2202-1.5, " Pres-surizer System Failure", was not violated during the period from October 1978 through March 28, 1979 notwithstanding the temperatures of the discharge line from the pilot operated (electromatic) relief valve

("PORV").

Although this procedure was understood by the plant staff, it is not clearly written and does not reflect actual plant conditions. It will be changed. However, although Metropolitan Edison is concerned about the issue, there is no indication that this procedura or the history of PORV discharge line temperatures delayed recognition that th e, PORV had stuck open during the course of the accident.

Emergency Procedure 2202-1.5 describes in each of its sections a pos-sible failure in the pressurizer system, including leaking or inopera-

?

tive PORV and leaking or incperative code relief valves. Each section I

of the procedure sets forth a number of " symptoms" and several immed-iate and follow-up actions. The crux of the claimed noncompliance is the assumption that the occurrence of a " symptom" automatically requires the implementation of the associated immediate and follow-up l

3 U4 actions. This assumption is not supported by anything in plant i

l' procedures or Technical Specifications and was contrary to the under-

'e standing of Metropolitan Edison personnel at the time of the accident.

A symptom is not a determination that a problem exists. Rather it is a signal that conditions should be examined to determine whether the problem exists. The same symptom may be equally consistent with several underlying situations. For this connection, it should be noted that the symptoms for leaking PORV (Procedure 2202-1.5, Section A) are essentially identical to the procedures for leaking code re-lief valves (Procedure 2202-1.5, Section C).

Thus, the existance of a symptom for leaking PORV does not mean that there is,a leaking PORV.

If there is no leaking PORV, then the procedure for leaking PORV is not relevant and it is not appropriate to apply the immediate and follow-up actions of that procedure.

As described in Section A of Procedure 2202-1.5, the immediate action for a leaking PORV is the closure of the Electromatic Relief Isolation Valve, RC-V2.

The claimed noncompliance is that this valve was not closed during the October - March period despite the existence of one of the symptoms of a leaking PORV, specifically

" Relief valve discharge line temperature exceeding

'l the normal 130*F.

Alarms on computer at 200*F."

l There is no dispute that relief valve discharge line temperature exceeded l

130*F during the period in question. The temperature range during this i

period was generally 170* to 190*F.

However, these temperatures do not i,

-l appear to have been the result of a leaking PORV. During the October -

J January period, the reactor coolant drain tank leak rate (which would

[

have reflected leaks past the PORV) was essentially zero. After the outage which ended on January 31, the reactor coolant drain tank leak rate increased.

-l -

4 Ilowever, this was accompanied by a sharp increase in the discharge yl 3

line temperatures for the code relief valves.

In the October -

i January period, these temperatures had been in tt.e 100* - 115'F range.

After the outage, the temperatures sharply increaned to the 160* - 130*F range.

These matters were discussed by the place staf f. 3ased on temp-erature readings, a determination was made that code relief valve RVIA was leaking and Work Request No. C-1137 (February 9, 1979) was prepared for the repair of this valve.

Additional evidence that the 170* - 190*F temperatures on the PORY discharge line did not result from a leaking PORV can be found by com-paring these temperatures with plant conditions. During the October -

." arch period, this temperature range occurred whether Unit I was at power or in hot shutdown. For example, on October 1, 1978, while the primary system was at 250*F and 265 jsi, the PORV discharge line temp-erature was 171.l*F.

On October 29, 1978, with primary system tempera-ture of 566*F and pressure at 2155 psi, the discharge line temperature was 176.4*F.

Only when the Unit was in cold shutdown did the discharge line temperature fall below the 170* - 190*F range.

For example, on Janiiary 18, 1979, with primary system temperature at 130*F and pres-sure at 0 psi, discharge line temperature was recorded at 80"F.

T ese values make it clear that discharge line temperatures did not, of them-selves, establish that the PORV was leaking. More likely, the tempera-tures resulted from the heating of the line by conductivity from the

?

pressurizer itself. Because the temperature sensors on the code relier i

I valve discharge lines are located much further from the pressurizer than those for the PORV dischaaga lines, the normat temperatures for

[

the former were not affected to the same d* gree by conductive heating from the pressurizer.

A 8

Corrective Action:

7 Based upon the above discussion, it appears that the underlying cause

}

for the claimed non-compliance was the scacement in Section A.I.1. that the " normal" temperature of the relief valve discharge line was 130*F.

The normal temperature was actually in the 170* - 190*F range.

Once the plant staff determined that this discharge line temperature was not normally below 130*F, the procedure should have been changed. Metropolitan Edison's training program will therefore include steps to assure that these types of changes are initiated when appropriate.

In addition, Metropolitan Edison procedures will be clarified to make explicit the meaning and role of " symptoms" in these procedures.

And, Metropolitan Edison will address and recognize the deficiencies identified in the procedure by the Staff of the President's Commission on the Accident at Three Mile Island.

See Technical Staff Analysis Report on Technical Assessment of Operating, Abnormal, and Emergency Procedures (October, 1979), pp. 14-17*.

2.

Failure to Close Isolation Valve on March 28, 1979 The second aspect of this claimed noncompliance states that a dis-charge line temperature of 283*F was noted at 0521 hours0.00603 days 0.145 hours 8.614418e-4 weeks 1.982405e-4 months in March 28, 1979, but that the isolation valve RC-R2 was not closed until 0619 d

hours. While the discharge line temperature at 0521 hours0.00603 days 0.145 hours 8.614418e-4 weeks 1.982405e-4 months was 283*F, this value was not known by the Shift Supervisor at that time. Only at 0618 did the on-coming Shift Supervisor observe that the PORV discharge line temperature was significantly higher than the temperatures for the code relief valve discharge lines and cause the closing of the PORV I

isolation valve RC-V2. Since Emergency Procedare 2202-1.5 does not automatically require that the isolation valve be closed on a high temperature reading, failure to close it until 0619 did not violate the e

4 I

procedure. However, an explanation of this aspect of the accident is j

2 nonetheless appropriate.

i Following the turbine trip in the early stages of the March 28 acci-i dent, the PORV was expected to open (see Procedure 2203-2.2, " Turbine l

Trip", step 2.A.3).

The operators noted that it did open and shortly thereafter received an erroneous indication that it had closed.

At 0425 hours0.00492 days 0.118 hours 7.027116e-4 weeks 1.617125e-4 months , the temperatures for the PORV and code relief valve discharge line were called up from the computer. The reported temp-eratures were 285'F (PORV), 264*F (relief valve A) and 275*F (relief valve B).*

Since the PORV had just lifted, these temperatures were not considered unusual. Furthermore, the three temperatures were grouped reasonably close together.

At 0521 hours0.00603 days 0.145 hours 8.614418e-4 weeks 1.982405e-4 months , another set of discharge line temperatures was called up from the computer. The computer printout, a copy of which is at-tached, printed the temperature for code relief valve RVIB twice and physically separated by about an inch the 283*F value for the PORV discharge line. Because of this printing error, it appe ars that the high valve for the PORV discharge line may have been missed. The Shift Supervisor has recalled that the valves were lower than those J

taken at 0425 hours0.00492 days 0.118 hours 7.027116e-4 weeks 1.617125e-4 months and that all three readings were similar, thus not alerting him to an abnormal situation.

Finally at 0618, the on-coming Shift Supervisor again called up the temperature data from the computer. Perhaps noting that the PORV

These values were reported to the Shift Supervisor. His later re-collection was that the PORV discharge line temperature was 225* 230*F.

I&E Transcript of April 12, 1979 Interview of W. H. Zeve, p. 29, I&E Transcript of March 30, 1979 Interview of W. H. Zewe, p. 16.

a 1 j

I

+

discharge line was almost 40*F higher than the code relief valves, he j

i suggested the closing of the PORV isolation valve. With that closing, the loss of reactor coolant inventory was stopped.

Corrective Action:

Although this asserted non* compliance did not involve any violation of plant procedures, it does point up the need for improved and expanded training of the operating organization and the need for better diagnostic capabilities. With the then existing procedures and training and the availability of instrumentation for identifying a PORV failure, the delayed diagnosis of the PORV status is not surprising. Better training and procedures and plan; instrumentation modifications will be implemented to improve the ability of the operating organization to diagnose such conditions.

These actions will be completed for Unit.1 prior to re-start of the unit.

I J

e l i

\\

^C 1

_.3t 0

-g 04:W: 11_ DATA _0386__RC. PRESSURIZER WTR LVL 1. (DP) 105.3 O

04:44:21 DATA 0387 RC PRESSURIZER WTR LVL 2 (DP) 110.0 04:44:3_1_ DATA 03.88_ RC_E8ESSURIZER_WTR LVL 3 (DP)

-101.n 04:52:41 DATA 0153 C0tO H HOT PRESS (Iti HG) 28.96

,O_

04:53:02 DATA 0117 84ER FD R4P1_DI.SCH_P.RESS

______4..

05:12:48 ANtJUNCI ATOR GROUP ALARM REV181

-~

O REACTOR C00LAtiT RJI4PS & i40 TORS C0llT 2956 RC RJf4P 2A SEAL LEAK TK LVL

O C0 lit 2967 RCP 1A Of L_LIF_T_R4P._DSCHG PRESS.___

ColiT 2968 RCP 2A OIL LIFT R4P DSCHG PRESS RCP 2B OI L_LIF.. _R4P_DSCHG_ERESS T

ja Col 1T 2969

0 C014T 2970 RCP IB Oil LIFT R4P DSCHG PRESS C0!(T 2971 RCP 1A FULL _S_P_EED Col 4T 2972 RCP 2A FULL SPEED I O CONT 2974 RCP 18 FULL SPEED ColiT 2975 RCP 1A BACKSTOP OIL FLOW C0!iT_2976_RCP_2A _ BACKSTOP _01 L _ELOW

_O CONT 2977 RCP 2B BACKSTOP 01L FLOW l.

Col!T 2978 RC_P_18 BACKSTC_P__0_l_L_E.LQi 2

'_ O 05: 21: 00 _ DATA __0401 RC PRESSURIZER _ SURGE LINE TEMP _

513.9 s

05:21:08 DATA 0402 RC PRESS REL VLV RV2 OUT TD4P 283.0 l(

05:21:1. _

C 6

El DA A

0403 TC PRESS REL VLV RV1A GJT TFl4P 211.3 05:21:26 DATA 0404 RC PRESS REL_VLV...RV1B OUT TD4P 2_18_.6 O

05:21:35 DATA 0404 RC PRESS REL VLV RV13 OUT TB4P 218.G 0_5:21_:43_ DATA 0405 RC PRESSURIZER SPRAY LINE TB4P 49G.6 05:31:05 DATA 0098 CtOS RJt4PS OUTLET HDR PRESS 164.3 O

GROUP._4 1

05:31:33

\\

03/28/79 O

SEQUB!CE_0F_E_V_04TS REVIBf l

3212 RC RJ4P 2B 0FF OFF 0 -

05:14:06:1G6 -3213 RC RR4P 2A 0FF 0FF 05:14:06:183 i

05:14:06:396 3213 RC RJf4P 2A 0FF OFF O

05:14:19:091 32 14 RC RJf4P,1B 0FF OFF 05:14:20:276 3196 RP GREEN CH RlR/_R_iPS TRIP TRIP

~

05:14:20:302 3198 RP BLUE CH RlR/R4PS TRIP TRIP t

Q 05:_14_:201308 _3_19_5 RP RED CH RIR/R45__ TRIP TRIP 05:14:20:365 3197 RP YELLQ1 CH RlR/R4PS TRIP TRIP 05:14:23:394 3213 RC RJf4P 2A 0FF OFF

)

05:36:56 DATA 1682 PLVL RC PRESSURIZER LVL (liH2O) 372.9 1

,i

=__

,O 1

__f ri O_

?

~

e 04:t 4:11_ DATA _0386_..RC. PRESSURIZER WTR LVL 1.(DP) 105.3 t

O 04:44:21 DATA 0387 RC PRESSURIZER WTR LVL 2 (DP) 110.0 Oi:t 4 3.1_ DATA _03.88_RC_E8ESSURIZER_WTR.LVL 3 (DP) 101.n L1 04:52:41 DATA 0153 COND H HOT PRESS (IN HG) 28.96..

.O 04:53:02 DATA 0117 B4ER f_D._R4P1_DI SCH _P.RESS 4..

05:12:48 N4NUNCIATOR GROUP ALARtd REVlai O

REACTOR C5~LANT RJ4PS & 140 TORS a

C0!iT 2956 RC RE4P 2A SEAL LEAK TK LVL

.:; O

_C0riT._2967 R.CP__1A__01 L_LIF.T_R4P_DSCHG PRESS

'i Col 4T 2968 RCP 2A Oil LIFT R4P DSCHG PRESS 25

___C0!i_T__29 69_.RCP_2 B_0 I L_L I F T_R4P_DSCHG_fRESS

?O CONT 2970 RCP IB OIL LIFT R4P DSCHG PRESS

~

i CONT 2971 RCP 1A FULL _SP_EED i

CONT 2972 RCP 2A FULL SPEED

! O CortT 2974 RCP IB FULL SPEED Col 4T 2975 RCP 1A BACKSTOP OIL FLOW CONT _2976 _RCP_2A. BACKSTOP _01 L _ELOW O

CONT 2977 RCP 2B BACKS. TOP Oil FLOW i;

C0t4T 2978 RCP_1_B BACKST0f_0l_L.f_ LOW

~ $

O 05: 21: 00 _ DATA _.040.1 RC_ PRESSURIZER SURGE LINE TEMP 513.9 05:21:08 DATA 0402 RC PRESS REL VLV RV2 OUT TB4P 283.0 l?

__05: 21: 1._

i_O 6

1 y

DA

' O _

_ __ _ _ _ _ _. _ TA 0403 RC PRESS REL VLV RVIA OUT TD4P 211.3 05:21:26 DATA 0404 RC PRESS REL_VLV..RV1B OUT TB4P 2_18_.6 0

05:21:35 DATA 0404 RC PRESS REL VLV RV1B OUT T94P 218.6 0.5:21.:43_ DATA 040.5 RC PRESSURIZER SPRAY Li!4E_T.El4P 49G 6 2

j 05:31:05 DATA 0098 CNDS PUt4PS OUTLET HDR PRESS 104.5 O

GROUP _4 t

05:31:33

\\

03/.28/79 O

SEQU_El!CE_OF_E_V.ENTS REV1 EW

'O -

05:14:06:1G6 3212 RC RJ4P 2B 0FF OFF

~ ~ ' '

05:14:06:183 3213 RC RR4P 2A 0FF OFF l

05:14:06:396 3213 RC RR4P 2A 0FF OFF i

I l

,O 05:14:19:091 3214 RC PUf4P IB 0FF 0FF 05:14:20:276 31'36 RP GREEN CH RlR/_R_y_G_TRI P TRIP i

i 05:14:20:302 3198 RP BLUE CH RlR/R4PS TRIP TRIP 6

05:14:20:308 3195 RP _ RED CH RlR/R4PS_ TRIP TRIP 1

05:14:20:365 3197 RP YELL 0d CH PdR/R4PS TRIP TRIP 23 }_94_ _3213 RC RR4P 2A 0FF OFF 05.:_14:

1 05:36:51 DATA IL82 PLVL RC PRESSURIZER LVL (!!N20) 372.9-

j 1

+

4.B.1 Statement of Apparent Noncompliance:

Y 2

B.1 Emergency Procedure 2202-1.3, " Loss of Reactor Coolant / Reactor Coolant System Pressure," Revision 11, requires in Sections B.2.2.3, B.3.6.2 and A.3.2.5:

that high pressure injection is initiated on low RCS pressure (1600 psig), and that the operator verify high pressure injection is operating properly as evidenced by flow in all four legs (250 gp2); that flows be maintained at this rate by throttling as RC! pressure drops; and that hi n Pressure injection h

not be terminated until RCS pressure can be maintained above the reset point (1640 pr'.g) or until low pressure injection flow is established at 3000 gpm.

Contrary to the above:

1.

At about 0405 on March 28, 1979, high pressure injection flow was throttled to minimum conditions even though RCS pressure was less than 1600 psi and falling, and without low pressure injec-tion flow established.

2.

At various times throughout the day of March 28, 1979, the high pressure injection system was modified such that the required flow rates were not maintained during continuing low pressure conditions within the RCS following the period when the reactor coolant pumps were stopped and the high pressure injection system ess the only m:'e available for the removal of core decay heat.

Discussion:

Metropolitan Edison recognizes that, in the light of detailed af ter-the-fact analysis the failure to maintain full High Pressure Injection flow in the first few hours of the accident led to severe core damage.

It is not clear however that this failure was a failure to comply with one procedure, as described in the statement of apparent noncompliance.

e Ihis failure was due to a complex interaction of system performance characteristics dictated by design, equipment failures, analytical myopia, procedural inadequacies, technical specification conflicts, the focus on regulation requirements as necessary and sufficient standards in themselves, and training which reinforced many of these inadequa-cies as well as being deficient in the general treatment of accidents outside of predefined events.

~

3

~

t In ordar to assess groccdural complitnco, it mu:t first ba datorminto y

7 which procedures were possibly applicable and then determine which procedure was in use.

However it is generally recognized and accepted that specific procedures cannot be written to cover every possible sequence of events or conditions.

Thus analysis of these more complex conditions requires a much broader review of influences beyond the specific guidance of written procedures.

Analysis must consider the basis for judgements made by the operator in order to make a determination of non-compliance.

The conditions surround-ing the TMI-2 accident require that this latter approach be taken.

The conditions that the ' operators perceived immediately following the turbine trip appeared to reflect a normal response to a loss of feedwater.

The immediate actions for the trip were followed.

These included verifi-cation of automatic functions, manual start of a second makeup pump to account 'for system shrinkage, and isolation of letdown to help reduce the effect of shrinkage. Shortly thereaf ter the situation deviated from normal.

This was apparant to the operators when the pressurizer 1evel stopped its decline sooner than expected and then started a rapid recovery. The rise in pressurizer level could not bestoppedbytge operator as the level rose through the normal range and continued to e

fill the pressurizer beyond the Technical Specification limit of 385 inches, until it appeared to be solid or nearly so.

During this same period two other significant events occurred. Emergency feedwater was i

discovered to be blocked by the unexplained, closed condition of EF-V12A&B, and High Pressure Injection was automatically initiated as RCS pressure dropped through 1640 psi. The operators took corrective action for each; High Pressure Injection was placed in manual control and significantly cut back to attempt to prevent going solid, and Emergency Feedwater flow _. _ _ _,..

T S

1

+

was initiated to both steam generators to restore levels to approximately 5

2 30" as described by, the Loss of Feedwater Procedure (EP2202-2.2A).

It

?

should be noted that the possibility of a loss of both main feedwater pumps and failure to achieve emergency feedwater flow is not addressed by

~

procedure, nor is the condition where Reactor Coolant Systen pressure is low (less than 1640 psi) and pressurizer level in high. At this time (approximately 0408), the conditions of the plant were outside of the entire set of unit operating procedures. This situation required the operator to make judgements on the best course of action on the basis of his general training and experience, technical specification limits, general plant operating limits and precautions and whatever other guidance, although possibly incomplete, might be derived from specific emergency procedures.

The response of the operator is conditioned by the order in which he receives, recognizes and reacts to conditions in the plant. As events continue to develop, early judgements are modified, discarded or reinforced by the analysis of incoming data versus the expectation of what should have occurred. The expectation of what should occur is a function of training and experience.

J The specific events which followed the brief period of " normality" did not fall into easily recognizable, discrete events. The operators were forced to recognize the correct symptoms from several hundred abnormal alarms and indications. The following brief discussion reflects the key I,

procedures which may have been applicable and were used in part, and the I

events which reflect that these procedures may have been applicable to t

some degree. Steam Supply System Rupture (AP2203-2.3 Rev.5) is identified by the following symptoms:

O E

P "1.1 Rapid decrease in secondary pressure. (Both OTSG's start to blow 4

down)." At 0407:45 both OTSG's reached their minimum pressure

}

l of 788 psi on A and 777 psi on B.

This was the approximate time e

the Emergency Feedwater valves were opened, i

"1.2 Electrical load reducing rapidly." The turbine generator had

~

already tripped.

l "1.3 Decrease in pressurizer level, R. C. Pressure, and cold leg temp-erature." Pressurizer level had decreased initally then rose un-expectedly; R.C. Pressure had rapidly decreased below the Safety Injection setpoint of 1640 psi and was still decreasing although more slowly; and following an initial rise during OTSG dryout, the RC cold leg temperature began a steady decline.

"1.4 For a rupture inside the Reactor Building; Indication of increas-ing building pressure and temperature. (Possible high Radioac-tivity Levels on HP-R-227 if a tube leak exists)." At approxi-mately 0415 the Reactor Building pressure started to increase followed shortly by an increase in temperature. This was due to the rupture of the RC Drain Tank but was unknown at that time.

"1.5 For a rupture outside the Reactor Building; Noise may be heard in Control Roem or a report made from personnel outside the Control Room."

There were no reports of this kind.

I "1.6 Decrease in main condenser hotwell level or condensate storage tank level." The hotwell level had increased due to a blockage in flow at the condensate polisher outlet but the condensate storage tank was being slowly depleted by the Emergency Feewater System.

These are all the symptoms for Steam Supply System Rupture. All of these symptoms were essentially met in the first 15 minutes of the accident.

During this early period not all of the symptoms continued to persist but t

the deviations were partially understood by the operator when the combined effects of loss of main feedwater, reactor trip on high pressure, and sub-sequent dryout of the OTSG's were considered. These operators had been previously exposed to the conditions of a main sterm line break from the I,

April 23, 1978 Main Steam Relief Valve failure event on TMI-2, and there-I fore the existence of low reactor coolant pressure without a LOCA was an b

i easily conceivable situation. Since this was apparently not a large rupture based on the rate of change of parameters, the operators had no analytical base or training to rely on in determining whether these.-

O specific conditions were fully reflective of a small rupture. They were k

7 forced to make judgements at this time to assess the next appropriate

~,

steps.

This summary is supported by the Shift Supervisor and Control Room Operator in interviews with the NRC (I&E Group Interview, 6/28/79, Tape 319, pg. 38-48). Specifically, the Control Room Operator and the Shift Supervisor agreed that at about 0415 they thought they had a leak in the steam gener-ator. As the Control Room Operator highlights the fact that the principle distinguishing factor between a LOCA and a steam system rupture is the ab-sence of a Reactor Building Air Sample alarm on HP-R-227, (which was not present until about 0615) and,the absence of an alarm on the condenser off gas monitor, VA-R-748, (which indicates an OTSG tube failure and was re-ceived about 0700).

l The automatic and manual immediate actions outlined by the Steam System Rupture procedure were followed for the conditions as they existed.

Since both OTSG pressure had not reached the feedwater latch setpoint (585 psig) the OTSG that was leaking had yet not been isolated.

However, at about 0510 a significant pressure differential started to exist between the two OTSG's, with the B OTSG rapidly falling.

By 0520 a 150'.

psi differential existed. At 0526 the B OTSG was isolated. Continuing to perform followup actions in this procedure would have the operator initiate High Pressure Injection if pressurizer level dropped below 20",

RCS pressure decreased below 1600 psig or neutron flux starts to rise.

I, Subsequently, when pressurizer level returned to above 100", High Pressure Injection was properly secured. There are no criteria or additional guidance on restoring reactor coolant system pressure above 1600 psi.

Included within these steps is the requirement to initiate a cooldown with the unaffected steam generator..

1\\

=!

Th:s2 secps w:ro all follow:d, cnd y:t tha plcnt was nst ad:quctoly pre-7 tected. The operator did not understand why pressurizer level was per-il forming anomalously and because of this continued to evaluate other possibilities while dealing with the other events of the moment.

s

~

A similar analysis of the symptoms in Emergency Procedure 2202-1.3 " Loss of Reactor Coolant / Reactor Coolant System Pressure", Rev. II, would not result in the conclusion that this procedure should have been followed.

A LOCA cf significant size is identified in EP 2202-1.3 B by:

4 "1.1 Rapid continuing decrease of reactor coolant pressure.

(1) Lo alarm 2055 psig.

(2) Lo-Lo-alarm 1700 psig.

(3) Safety Injection acutation at 1640 psig."

This condition existed until pressure initialy stabilized near 1000 psi.

This was substantially above the accident analysis levels of less than 600 psig for classical large and small break analyses.

"1.2 Rapid continuing decrease of pressurizer level.

(1) Lo alarm 200".

(2) Lo-Lo alarm 80" (Interlock heater shutoff)".

Following an initial decrease following the trip, pressurizer level continually rose uniti exceeding Technical Specification (385") and procedural (400") limits.

"1.3 Hi Radiation alarm in Reactor Building."

Although the specific alarm is not noted in this step, it is discussed in the note below step 1.8 as HP-R-227.

This did not alarm until approximately 0615.

"1.4 Reactor Building Ambient Temperature Alarm."

This alarm was received at about 0420 following the RC Drain Tank failure.

"1.5 Hi Reactor Building Sump level."

This was not recognized until approximately 0430 when reported by an auxiliary operator to the control room.

"1.6 Hi Reactor Puilding pressure (RCS or main steam line rupture)."

"1.7 Rapidly decreasing makeup tank levee."

The makeup tank level increased steadily.

"1.8 Both core flood tank levels and pressures decreasing."

This did not happen in the first eight hours.

I.

The note at the end of the symptoms sections states that an operator may I

distinguish between LOCA's, OTSG tube ruptures, and steam breaks inside i

the reactor building by specifically checking three conditions " unique to the aforementioned accidents." These conditions are:

,1 1

).

t "1.

Loss of coalcnt insida Racctor Building p:rticulato, icdine gas monitor alarm on RP-R-227 " Reactor Building Air Sample."

7 "2.

OTSG tube rupture - Cas monitor alarm on VA-R-748.

"e "3.

Steam break inside Reactor Building:

~

(1) Low condensate storage tank level alarm - and or low hetwell level alarm.

(2) FW Latch System Acutation."

None of these criteria were fulfilled until approximately 0615.

The actual conditions of the accident following 0405 did not clearly fit the symptoa of a significant loss of coolant but more closely fit the symptoms of a steam system rupture. The operators felt they had a steam system rupture and complied with that procedure.

It was 0619 when the

~

operators become aware that the plant had actually suffered a LOCA in the pressurizer steam space.. This rceognition immediately followed the closure of the PORY block valve, but the plant conditions had degraded to a point where all subsequent activities were clearly outside of pro-cedural guidance. There were often procedures which to a lesser extent could have been considered since some of the symptoms present did exist during this period. However, these procedures would not have been appropriate.

The discussion above highlights the potential for ambiguity or conflicts in procedures and the difficulties facing plant operations when the 2

plant conditions in a complex accident no longer fall within existing plant procedures. When the conditions within the plant deteriorate to a point outside the scope of procedural guidelines, the operators must be required to exercise judgements on the appropriate course of action.

I, These judgements must be founded on training which prepares the operator I

to evaluate alternative actions that will lead to a sequence of events j

which will' satisfy the fundamental requirements of decay heat removal, control of radioactive material and protection of the general public, plant staff and equipment.

.(

,I i

S In the period following the closure of the PORV block valve, the full 1

7 extent of the initiating events came into clear focus to the operators.

e r

Normally this would be the end of the transient phase and would be followed by an orderly transition to cold shutdown following existing procedural, guidelines. The conditions at TMI-2 were not however within conditions defined' by procedure. The operators were therefore required to make judgements in order to fulfill the basic steps towards long term stability. During this period the operator made several attempts to achieve long term stability of operations within the scope of his procedures and training.

At certain times the use of High Pressure Injection fulfilled the cooling requirements of the core and at other times it supplemented core heat removal via the steam generators. The use of High Pressure Injection had to be carefully balanced with other plant conditions and parameters.. The operators would not take the plant to the 25s0 psi safety valve setpoint since this presented an additional potential failure that in their minds would seriously degrade the plant condi-tion. Judgement was sound since a valve which failed open would have ultimately forced rne use of the Decay Heat System in the recirculation mode from the Reactor Building sump.

The continued use of the atmospheric steam dump valves which was removing core heat via the steam gsnerators was perceived to be a significant release path by off-site authorities and they exerted pressure to terminate the use of this cooling path.

5 This was done at approximately 1230.

From this point on, a combination of High Pressure Injaction and core boil off through the PORV block valve was the only ef fective method of cooling.

l e

I.

Analysis of the plant data of that period would show that cooling appeared I

7 to be adequate as evidenced by gradually decreasing hot leg temperature Y

in the A steam generator, until the point the A cold leg temperature be-gan to respond. At this time the response in the A cold leg was indica-tive of some natural circulation type flow resulting from partial refill-ing of the A loops. Throughout the next period variations in the amount and location of High Pressure injection coupled with the use of the PORV block valve continued to ef fectively remove core heat while taking the plant towards the more stable condition of forced circulation.

The performance of the operators proved to be ulitimately effective during the period subseq-uent to closing the block value at 0619 when no procedural guidance or specific training guidance was available.

It is recognized that this process may not have been the optinum nethod to achieve stable, forced circulation condition, but there is insufficient analysis available to conclude that the performance of the operators after 0619 was an additional contributor to the final condition of the core.

Corrective Action:

The shortcomings in procedures and training identified by this acetdent are being corrected in both units. A thorough and on going program to review, upgrade and effectively integrate those aspects of design, ana-lysis, operating experience and regulatory requirements essential for a sound nuclear program is underway. Organizational changes necessary j

to support this program have been made on both units, with each organ-ization tailored to the specific needs of the unit.

1 i

Specific training emphasis on the responsibilities of operators to comply with procedures has been added. Guidance on actions to be taken when -

a f

e outside of the procedural envelope has been added. Metropolitan Edison is participating in industry program to improve operator guidelines which I

aim toward satisfying the basic requirements of reactor safety for all transient condit ions. These guidelines will be integrated into the training program and procedures as they become available.

Metropolitan Edison will continue to use diverse management tools such as internal and external examinations of operations, independent safety re-views and expanded quality assurance activities on a continuing basis to provide the maximum possible opportunity for issues important to safety to be identified and resolved.

The continual development of improved analytical techniques will be used to perform best estimate analyses of transient and accident sequences using specific plant data. The results sf these analyses will be used as an, aid in operator training.

These analytical models have been initially benchmarked against actual plant per formance. This will allow future predictive analysis to understand operational events not previously anticipated in safety analyses. Procedural change will result when pass guidance is shown to be in error.

It is recognized that these changes not specific in their implementation schedule. These changes are not quickly conceived or implemented, but l

rather require deligent preparation, careful integration, and ongoing re-view to assure that the improvements necessary are achieved and maintained.

t Metropolitan Edison is committed to this effort and will continue to meet t

the high standards demanded.

-l i

e The requirements in training and procedure identified by the NRC in each of their task force activities are being reviewed by the NRC and will be a

completed prior to the restart of Unit 1. -

~

3 E

+

4.B.2 Statement of Apparent Noncompliance:

I 1

B.2 Emergency Procedure 2202-1.3, " Loss of Reactor Coolant / Reactor 3

Coolant System Pressure," Revision 11, requires certain actions to be taken following the automatic initiation of high presssure injec-tion, including in Section B.3.1, that all ESP equipment is verified to be in its ESF position (capable of performing its intended function).

Contrary to the above, during the period of approximately 0600 hours0.00694 days 0.167 hours 9.920635e-4 weeks 2.283e-4 months until 1300 hours0.015 days 0.361 hours 0.00215 weeks 4.9465e-4 months on March 28, 1979, during continuing low pressure conditions within the RCS, the Core Flood System was removed from its ESF position (rendered inoperable) by closing both tank isola-tion valves.

[This portion of the ESF was inactivated during a period when reduction of Reactor Coolant System pressure was not the immediate goal. This removed from service this safety feature during a period when it could have been called upon.

In the course of the accident while attempting to depreasurize to activate the decay heat removal system NRC recognized that it was necessary to isolate the core flood system and encouraged this action.

This citation does not apply to isolation during this attempt.]

Discussion:

(

Metropolitan Edison does not believe that the Core Flood Tank Isolation valves (CF-VIA and B) were closed during the period from approximately 0600 hours0.00694 days 0.167 hours 9.920635e-4 weeks 2.283e-4 months until 1300 hours0.015 days 0.361 hours 0.00215 weeks 4.9465e-4 months on March 28, 1979. Therefore, this item.is not a noncompliance.

In addition, if they were in fact closed, no vio-lation of Emergency Procedure 2202-1.3 occurred since the core flood tanks were verified to be in their ESF position after automatic initia-tion of high pressure injection.

4 A Shift Supervisor testified that he closed the isolation valves.

I&E Transcript of Interview of " Shift Supervisor A" (July 11, 1979), p. 8.

1 However, others in the Control room during this period have stated that i

the valves in fact were open.

I&E Transcript of Interview af Frederick, I

Faust, Scheimann, Zewe and Ross (May 29,1979, Tapes 269 270), pp.

19, 20, 23,24; I&E Transcript of Interview of Zewe, Scheir ia, Faust and 7

Frederick (June 28,1979, Tape 321), pp. 47. Subsequent es. nts confirm that the isolation valves were never shut. At about 1230 iours, the reactor coolant system pressure was low enough to permit the discharge

~ _

r a

2 s+

of some of the core flood tank inventory into the reactor vessel.

Since I

1 there is no indication that anyone opened the valves after 0600, the h

clear indication is that they were never closed.

This implies that if Shift Supervisor "A" in fact attempted to close the core flood tank isolation valves, that attempt did not succeed.

The pos-sible explanation for this hypothesis is that the procedures for closing the valves require that the electrical breakers (normally locked open) must first be manually closed at the motor control centers before the valves can be closed from the control room.

If Shift Supervisor "A" tried to operate the valves prior to manual closing of the breakers, the valves would not hav.e closed.

While the breakers were closed at some point during the morning of March 28, I&E Transcript of Interview of Schelmann and Laudermilch (March 30, 1979, Tape 95), p. 27, the open status of the valves indicates that Shift Supervisor "A"'s actions, if taken, occu,rred before the breakers were closed.

In any case, even if the isolation valves were closed, Emergency Procedure 2202-1.3 would not have been violated.

In this procedure, one of the follow up actions to automatic initiation of engineered safety features is:

" Verify that all E.S.F. equipment is in its ESF position, by.,

observing that all equipment status lights indicate as shown in Table B-1" Emergency Procedure 2202-1.2, section 3.1.

One of the indications in Table B-1 is that the isolation valves be in the open position.

However, i

the procedure does not specify thct the valves must remain in that under I

all conditions. At least one other procedure, Operating Procedure 2102-3.2, " Unit Cooldown", provides for closing the isolation valves.

In I

addition, where plant conditions did not fall within existing procedures, operator judgment must be allowed reasonable discretion.

=

5

8 Because Metropolitan Edison believes th.c the core flood tank isolation 4

5 valves were not closed, no corrective action is appropriate.

-h e

4 9

9 J

.r e

i !

l

- l 1

=

I W

~54-

a i

Y!

4.C StatemTnt of Apptrant Nrncomplitnca:

{l 2

Operating Procedure 2104-6.2, " Emergency Diesels and Auxiliaries," Revi-sion 9, establishes the procedures for the control of the emergency diesel gene rators :

1.

Section 4.10, " Diesel Generator - Automatic Start Upon Engineered Safety Features Actuation," states in the closing step, 4.10.6, that the unit can be shutdown after the Engineered Safeguards Feature actuation has been cle'ared.

2.

Section 4.6, " Diesel Generator IA(IB) Shutdown to Emergency Standby,"

states in the closing step, 4.6.6, to place the diesel generator on standby in accordance with Section 4.2; and 3.

Section 4.2, when completed, establishes conditions, for automatically starting the diesels upon actuatien of an Engineered Safeguards Feature (ESF) including requirements to place the " Emergency Standby /

Maintenance Exercise" switch in the Emergency Standby position and i

resetting the fuel racks.

Contrary to the above, at about 0430 hours0.00498 days 0.119 hours 7.109788e-4 weeks 1.63615e-4 months on March 28, 1979, both the 1A and IB diesel generator fuel ' racks were manually tripped, thereby prevent-ing an automatic start of the diesel generators upon ESF actuation and manual start from the control until 0949 hours0.011 days 0.264 hours 0.00157 weeks 3.610945e-4 months .

Discussion:

The shutdown of the emergency diesel generators at 0430 by manually trip-ping the fuel racks and the failure to reset the diesels for automatic start violated Operating Procedure 2104-6.2, " Emergency Diesels and Auxiliaries".

At 0402 hours0.00465 days 0.112 hours 6.646825e-4 weeks 1.52961e-4 months , the two emergency diesel generators started with automatic engineered safeguards actuation. Because the diesels were running un-loaded (offsite prower continued to be available), their shutdown was appropriate.

See Operating Procedure 2104-6.2, section 2.1.1.4.

A Control Room Operator dispatched an Auxiliary Operator to shut down the diesels by manually tripping the fuel racks, the only method by which

i the diesels can be shut down after an automatic diesel start on engineered

},

i safeguards' actuation.

h

r

~

+

Since of f-site power remained available, the unit was no longer at 5l 5

power, further engineered safeguards actions were possible, and additional h

manual tripping of the fuel racks would require dispatching personnel into areas with airborne contamination, the Control Room Operator con-templated that the diesels, once tripped, would be reset in the maintenance exercise position. This would prevent automatic starting on engineered safeguards actuation but allow diesel start from the control room in the event of that of fsite power were lost.

However, the Control Room Operator did not give specific instructions to the Auxiliary Operator and the Auxiliary Operator did not report his specific actions back to the Control Room Operator. As a result, the fuel racks were not reset and the diesels could only have been. estarted by dispatching an operator to reset the fuel racks. Only at 0930 hours0.0108 days 0.258 hours 0.00154 weeks 3.53865e-4 months was this situation recognized and the fuel racks reset. Afte 0930 hours0.0108 days 0.258 hours 0.00154 weeks 3.53865e-4 months , the diesels could have been manually started from the contral room had there been a loss of off-site power.

Corrective Action:

In order to assure that the situation which existed from 0430 to 0930 hours0.0108 days 0.258 hours 0.00154 weeks 3.53865e-4 months is not repeated, the operator accelerated retraining program is addressing the importance of procedural compliance and the Unit 2 J

licensed operator requalification program will specifically emphasize both the procedural compliance issue and the diesel generator procedures.

Because Operating Procedure 2104-6.2 does not contemplate keeping the i

t emergency diesel generators in the maintenance exercise position under the conditions as they existed after 0930 hours0.0108 days 0.258 hours 0.00154 weeks 3.53865e-4 months on March 28, 1979, Metropolitan-Edison considering amending the procedure to allow the main-l tenance exercise position when the reactor is in hot standby condition

=

a 2

E and wh!.n chara ara go:d recaons (such as occupational exposure) to avoid j

2 dispatching operators to manually trip the diesels.

~,

O e

9 i

.r.

e l

4 3

i 3

S 4.D Statement of Apparent Violation:

7 Emergency Procedure 2202-2.2 " Loss of Feedwater," Revision 3, requires in k

Section 2.B.2.d that the operator adjust feed flow to control steam generator levels at 30 inches.

Contrary to the above, from approximately 0532 hours0.00616 days 0.148 hours 8.796296e-4 weeks 2.02426e-4 months until 0543 hours0.00628 days 0.151 hours 8.978175e-4 weeks 2.066115e-4 months , the level in A steam generator decreased to 10 inches (the minimum level indication) while the A steam generator level was being controlled manually.

Discussion:

Metropolitan Edison does not believe that the item is a noncompliance.

During the period in question, Emergency Procedure 2202-2.2A (which re-quires maintaining steam generator level at 30 inches under certain con-dicions) did not apply.

In the period just prior to 0532 hours0.00616 days 0.148 hours 8.796296e-4 weeks 2.02426e-4 months on March 28, 1979, the steam gen-erator were being controlled manually since aute=stic mode had behaved errati: ally in the early stages of the accident.

I&E Transcript of Inter-view of Frederick, Faust, Scheimann, Zewe and Ross (May 29, 1979, Tapes 269 and 270), pp. 42-43.

With feedwater being supplied through the emer-ency feedwater system, levels were being kept at essentially a steady state. At 0514 hours0.00595 days 0.143 hours 8.498677e-4 weeks 1.95577e-4 months , reactor coolant pumps 1B and 2B were tripped due to vibration levels. With the loss of primary side flow in the B steam generator, heat transfer was lost. This caused a rapid reduction in steam generator pressure and a pressure differential between the A and B steam generators. As a result, emergency feedwater flow preferentially went to steam generator B, and the A steam generator level dropped rapidly.

i The operator took corrective action to restore level slowly.

,e j

The claimed noncompliance states that section 2.B 2.d. of Emergency a

t l

l Procedure 2202-2.2A, " Loss of Main Feedwater Flow to Both OTSG's",

was violated. This manual action procedure did not apply during the period in question.

Section 2.B 2.d states:

l.

S "If reteter coolat.t campirstura and pressure cannst ba maintainsd, j

or if feedwater flow cannot be restored, or if the reactor trips, j

start the emergency feed pumps and maintain 30 inches in the 5

steam generators (S/U range indication)."

However, this provision only applies to " Loss of feedwater due to valves closing".

Section 2.B.2.

That condition did not occur during the acci-dent. The other manual action alternative, "If loss of feedwater is due to loss of both feed pumps" (section 2.B.1), was applicable in the early stages of the accident.

F.owever, the applicable step in section 2.B.1 (sect ion 2.B. I.d) is based upon automatic operation of the emergency feedwater valves:

" Verify emergency feedwater valves (EF-11A (B)) are in automatic and controlling OTSG 1evel at 30 inches (S/U range indication)."

There was no procedure in this section 2.B.1 governing manual operation.

As of the 0532-0543 hour time period, the more appropriate procedure was Emergency Procedure 2202-2.2B, " Loss of Main Feedwater Flow to One OTSG", since the condition which led to the low level in A steam generator was the loss of flow to it alone. Under this procedure, which is the only one to anticipate a steam generator boiling dry, the appropriate action is to " establish feed flow using emergency feedwater pump through the emergency feed valves EF-V-llA(B) very slowly (2 inches per minute)." Emerge,ncy Procedure 2202-2.2B, section 3.2 Note. (original emphasis).

The operator e

complied with this procedure.

Corrective Action:

Although no noncompliance is involved, Metropolitan Edison's revised and I

augmented training programs will stress the importance of careful control of plant functions in the manual mode.

f

h 4.E Stctem:nt of Apptrant N:ncexplirnca:

+

4s Three Mile Island Nuclear Station, Administrative Procedure 1004, "Three Mile Island Emergency Plan 1004," Revision 2, dated February 15, 1978:

1.

Requires in Section 2.1, that the " Station Superintendent / Senior Unit Superintendent, Unit Supt./ Shift Supervisor / Unit Supt.- Technical Support in the Control Room will, after reviewing the emergency conditions, classify the emergency as one of the following:

"a.

Personnel or Local Emergency, "b.

Site Emergency, and "c.

General Emergency "He will make this classification according to the condition of Table 1 of this Plan, and initiate actions according to the Emergency Plan Implemen ing Procedures, and according to his own best judgment;"

and i

2.

States in Table 1 of Section 2.1 that a Site Emergency exists when there is a reactor building *high range gamma monitor alert alarm (Condition No. e).

Contrary to the above:

1.

Adequate written procedures were not established and implemented in that Section 2.1 of Procedure 1004 for implementing the Emergency Plan lacked sufficient specificity and failed to result in a Site Emergency being declared at approximately 0430 on March 28, 1979, even though primary system pressure had decreased to the point where safety injection was automatically initiated and a reactor building sump high level alarm existed; and Discussion:

The claimed noncompliance is that section 2.1 of Administrative Procedure 1004 was not adequate, rather than that Metropolitan Edison failed to comply with its procedures. While Metropolitan Edison thus believes that Administra-tive Procedure 1004, rev. 2, section 2.1 was not in noncompliance, Metropolitan Edison recognizes the need for greater s,secificity in its emergency procedures.

The Notice of Violation does not asser t that Metropolitan Edison failed to comply with its procedures by not declaring a Site Emergency at 0430 hours0.00498 days 0.119 hours 7.109788e-4 weeks 1.63615e-4 months .

G e

- 1 Th2 caly potGntially sppliccblo canditica w:s l

" Loss of primary coolant pressure, coincident with high reactor building pressure and/or high reactor building sump level."

Administrative Procedure 1004, section 2.1, Table 1 (Site Emergency, Con-dicion (c)). Unless there were a " loss of primary coolant pressure",

condition (c) would not be operative. As set forth in NUREG 0600, p. II-2-1, primary coolant pressure had dropped from 2435 psig to 1275 psig, a level below the reactor coolant low pressure trip setpoint and the set-point for emergency core cooling system initiation. The Shift Supervisor determined that primary system pressure, while it had decreased, had stabilized.

The pressure was several hundred psi above the level which would occur during a large break loss of coolant accident.

In the absence of a definition of " loss of primary coolant pressure", the Shift Super

visor interpreted the phrase as relating to a LOCA or other accidents (such as Main Steam Line Break) which could give similar symptoms.

Ab-a " loss of primary coolant pressure" as interpreted by the Shift sent Supervisor, condition (c) was not satisfied and a Site Emergency was not declared.

Corrective Action:

's Metropolitan Edison has totally revised its emergency procedures and has submitted them to the Commission. The revised procedures greatly expand the categories and conditions for declaration of emergencies. They have also i

been made much more specific in order to avoid ambiguities and uncertainty to e

the greatest extent possible. The revised procedures will be covered in the Operator Acclerated Retraining Program and will be tested in the emergency drill program.

-s 2.

A sita emergsney w:s net d:clercd at 0635 h:urs en M:rch 28, 1979, at

'j which time Condition "e" of Three Mile Island Emergency Plan 1004 had ll 1 occurred.

}

?

Discussion:

Condition (e) for declaring a Site Emergency is " Reactor building high range gamma monitor alert alarm".

Adr'nistrative Procedure 1004, section 2.1, Table 1.

The claimed noncompli.nce is that this condition occurred at 0635 hours0.00735 days 0.176 hours 0.00105 weeks 2.416175e-4 months on March 28, 1979. Metropolitan Edison does not believe that this item is a noncompliance.

Its best information is that Condition (e) occurred at 0643 hours0.00744 days 0.179 hours 0.00106 weeks 2.446615e-4 months and that the Site Emergency was declared some seven minutes later. Under the circumstances, this sequence was not unreason-

~

able and did not violate any procedure.

The apparent basis for the 0635 hour0.00735 days 0.176 hours 0.00105 weeks 2.416175e-4 months figure is a review by a Inspection &

Enforcement investigator of the strip chart from the chart recorder (HP-UR-1901) for the dome monitor (HP-R-214).

The investigator's reconstruc-tion of the chart is presented in NUREG 0600 as Figure II-3-3 (p. II-3-75).

This reconstruction would hsve the alert alarm (25 mR/hr) occur at 0635 hours0.00735 days 0.176 hours 0.00105 weeks 2.416175e-4 months .

The exact time at which the alert alarm occurred cannot be determined fro the multiprint strip chart. The time annotations on the chart are not exact. Nor can the specified chart speed of eight inches per hour be used to arrive at a precise time since that speed varies with the radius of the chart roll, a radius which changes over time. By attempting to duplicate the NUREG 0600 reconstruction, it appears that the 0635 hours0.00735 days 0.176 hours 0.00105 weeks 2.416175e-4 months timing of I

the alert alarm was based on an assumption that the actual chart speed I

(

at that time was eight inches per hour.

i M

-m-

~

e j

A mora accurces oathod of reconstructing th2 time of tha clare clarm is i

3 to locate on the strip chart two events for which the timing is precisely

}

?

known and to interpolate the timing of the event in question.

In this case, the reactor trip and the containment dome monitor reading of 8 R/ hour (causing the declaration of a general Emergency) can be both precisely located on th: strip chart and identified with a specific time, i.e. reactor trip at 04l0:37 (NUREG 0600, Appendix I-A) and 8 R/hr at 0724 (NUREG 0600, p. II *t-6).

By interpolation, the time at which the dome monitor reached the a.ert alarm level (25 mR/hr) would be at about 0643.

The best information on the time at which the Site Emergency was declared indicates that this occurred at 0650 hours0.00752 days 0.181 hours 0.00107 weeks 2.47325e-4 months . The Shift Supervisor has con-sistently identified 0650 as the time of the declaration.

I&E Transcript of March 30, 1979 Interview of W. H. Zewe, p. 22; I&E Transcript of April 23, 1979 Interview of W. H. Zewe, p. 67; I&E Transcript of Interview of W. H. Zeve (undated, tape 273), p. 7.

The time of the declaration was re-corded on a blackboard in the Unit 2 control room and subsequently trans-cribed for historical purposes (ISE Request item 116.1).

This too shows*

a time of 0650 hours0.00752 days 0.181 hours 0.00107 weeks 2.47325e-4 months for the declaration. The only other time record was a notation in the Unit I control room of 0655 hours0.00758 days 0.182 hours 0.00108 weeks 2.492275e-4 months based on the annuncia,s tion over the plant page system.

I&E interviewers also used 0650 hours0.00752 days 0.181 hours 0.00107 weeks 2.47325e-4 months for the timing of the declaration.

I&E Transcript of June 28, 1979 Group Interview (Tape 319), p. 37 (question by Dale Donaldson).

I The Site Emergency was declared when many of the radiation monitors began I

to alarm and alert together, when "the Christmas tree [went} off" I&E Transcript of June 28, 1979 Group Interview (Tape 319), p. 54.

These l

l l l

5_

alerac cnd clerts vara treollseted as occurring batwren 0645 and 0650 3

1 hours1.157407e-5 days 2.777778e-4 hours 1.653439e-6 weeks 3.805e-7 months . Idl; President's Commission Interview of Brian Mehler (May 10, h

1979, Tape 5), Transcript, p. 15-16.

The time interval of seven minutes or less from the alert alarm level of the dome monitor to the declaration

~

of the Site Emergency was not unreasonable under the circumstances surrounding the accident. Administrative Procedure 1004 does not require that the declaration occur simultaneously with the occurrence of the particular condition.

Instead it provides that "after reviewing the emergency conditions", the Shift Supervisor will classify the emergency "according to the conditions in Table 1 of this plan... and according to his own best judgment." Administrative Procedure 1004, section 2.1.

There is no indication that the Shift Supervisor failed to comply with this procedure.

Corrective Action:

As noted above, Metropolitan Edison has dramatically revised its emergency procedures and will implement an expanded training and drill program to

~

assure that the operating organization is thoroughly familiar with these procedures and can effectively carry them out.

2 f

e 1 __

a 4n Additionclly, procsdurss far th3 monitoring tesa response, including 4

operating procedures for the monitoring equipment, were immediately avail-

[

able to the cenitoring team members. Although the 1978 training reTri -

ment was not completely fulfilled, the response of the monitoring teams 1

was sufficient to properly implement the emergency plan and provide radiation monitoring information that did ensure proper assessment of the effect of the incident on the health and safety of the general public.

Due to adsinistrative problems, none of the individuals specifically des-ignated as Repair Party Tema members received in 1978 the complete training program as required by the emergency plan. However, all of the individuals are radiation workers and have received extensive training and have experi-ence in radiation protection relative to their normal repair functions.

It should be noted that during the incident on March 28, 1979 as well as the days following, many functions, both operations and maintenance, were per-formed that could be classified as emergency Repair Party functions. As the need for any task was determined, individuals most qualified to perform the task were assigned. Qualifications included specific job knowledge, familiarity with the systems, radiation protection knowledge and previous *.

exposure. The intent was also to equalize as much as possible the exposure over all qualified personnel. As a result, the individual selected for a

J particular task was the most qualified individual available although that individual may not have completed the entire training program.

Corrective Action:

i A revision to the Radiation Emergency Plan has placed significant emphasis on in plant Health Physics during an accident. Procedures will be devel-oped to clearly define the training requirements of all personnel.

In-plant Health Physics will become a major factor in the training of all

=

. i

=

2 E

4.F Stctsmint of App:rr..t Nancomplisnes:

+

3 Three Mile Island Nuclear Station Health Physics Procedure 1670.9,

" Emergency Training and Emergency Drills," Revision 4, dated

?

January 16, 1978:

1.. Identifies in Section 3.1, the on-site emergency job categories and requires that training programs for these categories will be conducted on an annual (calendar year) basis; and 2.

Describes in Section 3.1.1 through 3.1.9, the training program for all on-site emergency job categories.

Contrary to the above, during calendar year 1978, not all individuals having emergency responsibilities were trained in that two Emergency Directors, one Accident Assessment individual, eight Radiological Monitoring Team Members, and 37 Repair Party Team Members had not received the specified training.

In addition on March 28, 1979, during an emergency, at least four individuals who were assigned as required members of a Radiological Monitoring Team and seven indivi-duals who were assigned as required members of a Repair Party Team performed emergency duties for which they were not trained.

Discussion:

Metropolitan Edison agrees that the administration of the emergency training requirements was not complete. Two potential Emergency Directors (both shift foremen), and one potential Accident Assessment individual (a Shift Supervisor) did not receive the training during the year 1978.

It is important to note however that a total of 27 potential Emergency Directors and 29 potential Accident Assessment personnel did receive the training and that each shift complement did at all times have personngl on site who received training in each category.

On March 28, 1979, none e

of the three individuals mentioned acted in a capacity for which he did not have up-to-date, documented training.

I e

Of the eight Radiological Monitoring Team members, two did not have documen-i ted training in 1978 and six are believed to have received training which l

I was not totally in accordance with the training procedure requirements.

f Training which was not received, due to an administration error, was in areas that are similar to the routine monitoring functions performed by Health Physics technicians with which these individuals are familar.

1.. -

emerg:ncy p rs:nnel. Tecining in tha inplsmentctisn of th2 pecesduras

{t 4

will be implemented prior to start-up of Unit 1.

Additionally management 5_

has increased the emphasis on all aspects of radiation protection during daily operation. Additional training of operations and maintenance personnel as well as radiation protection personnel will provide increased

assurance that response during emergencies will be adequate.

O 9

4 I

J I

f' i

a D

. l

_ _ ~.. _ _

_, )

4G Statemint of App'dF%nt Nanco2pliEncn:

3 Station Administrative Procedure 1002, " Rules for the Protection of Employees Working on Electrical and Mechanical Apparatus," Revision 4

14, requires in Section 4.3, 4.4 and 4.5 that on restoration of equip-ment to service, removed tags will have all required information entered thereon and then be suitably stored, and that the shift foreman shall approve equipment operation by signing the original tagging application.

Additionally, Station Corrective Maintenance Procedure 1407-1, Revision J

0, specifies in Section 5.0, " Job Ticket (Work Request) Flow," the step-by-step process for initiating, processing, obtaining approvals and ultimate filing of the " Job Package" which will include, among other things, documentation of corrective action taken (resolution description and certification of satisfactory post maintenance testing) and Station Preventative Maintenance Procedure E-2, " Dielectric Check of Insulation, Motors and Csh19s," specifies how to make the measurements and contains data sheets fo: recording the values measured.

Contrary to the above, when inspected on June 20, 1979, the tagging application could not be found for maintenance performed in January, 1979, on Emergency Feedwater isolation valves (EF-V12A,12B, 32A, 32B, 33A, and 33B). No suitable documentation to determine whether the maintenance work had been completed, tags removed, acceptance criteria met, or valves approved for operation could be found.

The TMI-2 main-tenance log lists this work request as being in an open status as of June 20, 1979.

l l

Discussion:

Metropolitan Edison agrees that this was a violation of procedures in that a tagging application could not be found for this maintenance.

As of July 10, 1979 the TMI-2 maintenance log lists this work request as being in a closed status and associated documentation is filed in the Maintenance Department.

J The subject Job Ticket was closed out by the Operations Department on January 25, 1979, signed off by Quality Control on June 12, 1979, and signed by the Supervisor of Maintenance on July 10.

t Due to the delay in closing out this work request, a retrospective re-view was conducted to determine what assurances there were that the

~_

?

s valves were operable at the time between the January maintenance and March 28th. The electrical supervisor for the company which performed

=

. _~

l m

-t 41 th2 task varbally confirm 2d thct th3 maggar readings varo taktn and waro 2

acceptable but there are no written records to support this statement.

As part of the unit startup on January 30th, the valves were cycled with-out difficulty in accordance with Surveillance Procedure 2303-M14(A/B).

This was done prior to exceeding a main steam pressure of 850 psi.

Throughout the remaining period the normal surveillance procedures were accomplished with satisfactory results.

The January work request was closed on July 10, 1979.

The motors for EF-V12A/B were satisfactorily tested in accordance with the procedure prescribed in the work request C2555.

Revision to station Adminstrative Procedure 1002 dated July 25, 1979 deletes the requirements for storage of tags because it is not felt to be a necessary feature of records maintenance.

Corrective Action:

The records management function at Three Mile Island is currently being ex-panded to include a significantly larger staf f of professional and clerical personnel dedicated to the collection and retention of records. This func-tion will be led by a department level manager supported by appropriate supervisory personnel directing separate groups for Unit 1 and Unit 2.

J Among the improvement in cecords retention will be computer-aided filing, improved storage and control, and advanced reproduction methods.

The emphasis on records retention and control will be complemented by gen-eral training that emphasizes the necessity to properly complete each as-g pect of any work, including the documentation. Finally the staff and i

supervision of the on-site Quality Assurance Department has taken on an expanded role to assure that each area of performance prescribed by sta-

=

tion procedures and practices are followed.

g w

=

=.

f Th2 cvsroll crgcnization:1 structura far cecomplishing th2s2 chtngas will 4

be subject to thorough review by the NRC as part of the review of Unit 1 1

prior to its restart. The Unit 2 portion of these changes will be sep-t arately submitted to the NRC and will reflect the special nature of ac-civities in that unit, t

9 6

2 I

f.

i o

e I

1m

--p n

m n

w--me a

.m e-w---

t 3

5.

Sectem1nt of App: rent N:ncomplitnen:

di i

Technical Specification 6.8, " Procedures," requires in Section 6.8.2 that 1) changes to procedures which implement the Emergency Plan shall be reviewed

-l by the Plant Operatio*ns Review Committee and approved by the Unit Super-intendent prior to implementation.

Contrary to the above, a change to Station Health Physics Procedure 1670.7, " Emergency Assembly, Accountability and Evaluation," was made without the required review and approval. An additional assembly area was designated and the method used to perform accountability was modified by a memorandum dated October 13, 1978, from the Radiation Protection Supervisor to all departments. As a result, on March 28, 1979, in response to an emergency, some licensee personnel followed the approved procedure while others followed the guidance in the October 13, 1978 memorandum, creating some confusion and delaying prompt attainment of full accountability.

Discussion:

On October 13, 1978, the Radiation Protection Supervisor issued a memor-and um, " Accountability During Radiation Emergency", which added an addi-tional assembly point to those already specified in Station Health luysics Procedure 1670.7, " Emergency Assembly, Accountability and Evacuation".

This memorandum did not receive formal review by the Plant Operations Review Committee or approval by the Unit Superintendent prior to its im-plementation. This was a failure to comply with Technical Specification 6.8.2, which requires such review and approval for changes to such pro-cedures.

Notwithstanding the lack of review and approval, the change made by the memorandum did not, to the best of Metropolitan Edison's knowledge, delay prompt attainment of personnel accountability or cause confusion.

The change made by the October 13 memorandum was to have non-essential I,

personnel outside the security fence report to the North Warehouse.

Prior I

to this change, these people were required to assemble in the North Audi-torium, a location within the security fence. Requiring these people to

=

~

j psco through srcurity to g2t to (n asssEbly point was falt to ba an un-3 necessary, time-consuming step.

Following the October 13 memorandum, Metropolitan Edison conducted seven radiation emergency drills with a scope equivalent to a Site / General Emergency. See NUREG-0600, pp. II-1,-17, 18.

The requirements of the October 13 memorandum were carried out in each of these drills.

The final 1978 drill, on November 8,1978, was abserved by NRC.

As stated in the Combined Inspection Report Nos. 50-289/78-21 and 50-320/78-34, NRC made " detailed observations" of a number of emergency drill activities, including accountability. The inspectors' determinations included the following findings:

1.

"The licensee's response was generally in accordance with existing procedures"., and 2.

"The response was coordinated, orderly, and timely."

No items of noncompliance were observed.

On March 28, 1978, accountability was achieved within approximately 1-1/2 hours. While this was not as prompt as in some of the drills, it was in fact better than in others. Given the facts that a real accident 5 was in progress, that personnel recall and shift changes were in progress, that plant personnel were facing severe operational demands, and that there are no standards for timeliness, full accountability within 1-1/2 hours was timely.

I, I

As to the assertion that the October 13 memorandum introduced any additional T

t confusion into the accountability procedure, Metropolitan Edison is aware l

of no information which would support this claim.

NUREG-0600 contains no

(

=

l

. 1 l l

L _

3 supporting rafarancso. Th2 fcet thct ssysn drills in lato 1978 implemanecd

[j the revised assembly points makes such confusion much less likely.

3 e

And interviews of members of the security protection force indicate their awareness that the North Warehouse was a designated assembly point.

See I&E Transcript of Interview of Mr'. William J. Susansky and James F.

Stacey (May 7, 1979, Tape 161), pp. 5, 8.

Corrective Action:

Accountability requirements are now incorporated in the Emergency Plan and its supporting procedures. These have been reviewed by the Plant Operating Review Committee and approved by the Unit Superintendent.

They are also being submitted as part of the information to be reviewed by NRC prior to restart of Unit 1.

Training in the use of the procedures is a part of the on going and accelerated training programs in Units 1 and 2.

Additional training for supervisory personnel will be undertaken to assure adherence to the review and approval requirements of the Tech-nical Specifications.

e S

i e

k j

t l l L

.7 j

3 6.

Statement of Apparent Noncompliance:

g I

Environmental Technical Specification 5.7 requires that detailed written procedures for instrument calibracion be prepared and followed.

Three Mile Island Nuclear Station Surveillance Procedure 1302-5.24, Revision 3, dated December 19, 1974, specifies the method of calibration and requires that it be performed annually.

Contrary to the abeve, as of March 29, 1979, eight environmental samplers had not been calibrated since 1974.

Discussion:

Although noncompliance with Surveillance Procedure 1302-5.24 was tech-nically not a violation of any Unit 2 procedures, Metropolitan Edison acknowledges that the procedures should have complied with or withdrawn.

Environmental Technical Specification 5.5 requires that detailed written procedures be prepared and followed to implement the environmental tech-l nical specifications and that these procedures include " instrument cali-bration". A nit 1 procedure, Surveillance Procedure 1302-5.24

(" Environmental Monitors Calibrator") set forth a procedure to calibrate the continuous air monitors loca- _ around the site and required that calibration be performed annually. As noted in NUREG 0600, p. II-1-45, 5

there was no Unit 2 procedure equivalent to Surveillance Procedure 1302-5.24.

It was however listed as an active procedure for Unit 1.

J The Surveillance Procedure had been prepared in 1974 to address a draft Technical Specification. Although that draf t Technical Specification was not included in the final Technical Specifications, the procedure was not deleted. The procedure was not, however, followed because of e

difficulties in obtaining useful results and because UGI, the vendor C

I of the monitors, had orally informed Met-Ed that the monitors (par-ticularly their flowmeters) were considered to be primary standards and

=

not subject to accurate calibration.

-74_

L 4

It should be noted that I&E was aware that these monitors were not being routinely calibrated. Combined Inspection Report 50-289/78-08 and I

50-320/78-16 (May 31, 1978), p. 10, included the following discussion:

Discussions with the licensee indicated that at the present time, air sampling units are on a limited pre-ventive maintenance schedule. When a sampler fails, plant personnel either replace or repair the failed unit. The timeliness of this action is dependent, however, on plant operational status at the time of failure. The licensee stated that at the present time the dry gas meters employed with the air samp-1ers are not routinely calibrated. The licensee stated that the preventive maintenance program for the air sampling systems and the calibration of the dry gas meters would be re-evaluated. The inspector stated that pending completion of these evaluations, this item is cosidered unresolved.

(289/78-Go-03; 320/78-16-02)

Ihus, I&E considered the absence of routine calibration of these monitors to be an unresolved item rather chan a noncompliance.

Corrective Action:

The NRC Staff in October 1979 published a draft Regulatory Guide,

" Calibration and Error Limits of Air Sampling Instruments for Total Volume of Air Sampled" (Division 8, Task OH 905-4).

The draft Regula-cory Gr.tde identifies methods acceptable to the Staf for calibrating ai'.- sampling instruments such as the continuous air monitors covered by Surveillance Procedure l< ~ 2-5.24.

Metropolitan Edison will review the procedures described in the draft Regulatory Guide against the de-sign of the continuous air monitors.

If calibration can be performed 5

as described in the draft Regulatory Guide and if it produces accurate, I

reproducible results, Metropolitan Edison will modify the Surveillance Procedure accordingly and include this calibration as part of the station f

surveillance program. If such calibration cannot be performed, the procedure will be deleted.

=

'Rlb 1

+

Th is item also points out the need to thoroughly review all Station

?

procedures.

If there are other procedures which need not exist, they h

will be removed from the active procedure file so c. hat there can be no confusion as to which procedures are to be implemented.

At the same

~

time, the ongoing and accelerated training program will emphasize the requirement to comply with all written procedures as well as describe the adminstration controls for addition, modification or deletion of procedures.

The Operational quality Assurance Plan is also being re-vised to improve the efficiency and validity of that program in support of its role in assuring compliance with station and unit procedures.

I J

E i

e

1 l

- l 3

e i

7.

Statement of Apparent Noncompliance:

Technical Specification 6.2, " Organization," states. in Section 6.2.1 and I

6.2.2 that the unit organization and the organization of the corporate technical support staff shall be as shown on Figure 6.2-1.

Contrary to the above, on March 28, 1979, the organization of the unit and corporate technical support staf f was different from that specified in Figure 6.2-1 in that:

A.

A position titled, " Superintendent of Administration and Technical Support" was added to the organization on September 18, 1978 and filled on March 1,1979, such that the " Supervisor, Radiation Protec-tion and Chemistry," reported to this new position rather than directly to the " Station Superintendent / Senior Unit Superintendent;"

and B.

There were two " Supervisor of Maintenance" positions, one for each unit, rather than one; and C.

A position titled " Superintendent of Maintenance" had bean added such that the " Supervisors of Maintenance" report to this new position rather than directly to the " Station Superintendent (Station Manager)/

Senior Unit Superintendent;" and D.

The position of " Chemical Supervisor" had been vacant since the issuance of the Technical Specifications.

On March 28, 1979 through March 30, 1979, the above organizational discrepancies decreased the effectiveness of the licensee's response to the accident.

Discussion:

Metropolitan Edison agrees the organization in effect at the time of the accident was different than that specified in Figure 6.2-1 of the Unit 2 Technical Specifications. However, the impact of these changes had no 3

adverse effect on Metropolitan Edison's performance following the ac-cident. The following comments should be considered in evaluating this apparent noncompliance.

3*

A.

Although a Superintendent of Administration and Technical Support was added to the organization prior to approval of a Technical Specifi-cation change, this position was not part of the emergency organ-

~

ization put in place in response to the declaration of the site and b

general emergencies. The Emergency Plan organization was manned as

4 i

i prescribed. The Supervisor of Radiation Protection and Chemistry I

2 led the Radiological Assessment E f fo rt in the Emergency Control I

Center (the Unit 2 Control Room), reporting directly to the Emerg-ency Director (Station Manager).

The Superintendent of Administra-tion and Technical Support did not have an intervening role.

B/C.Although a position of Superintendent of Maintenance was added t.

the organization prior to approval of a Technical Specification change, the specific individual who filled this position had pre-viously held the position of Supervisor of Maititenance for the station. Prior to the accident he was promoted to the new posi-tion of Superintendent of Maintenance and two management positions were created belev him as Supe..sor of Maintenance for each unit.

This change provided improved management attention and capability of the on-site maintenance department structure by not leaving the first level maintenance supervisory attention split between units, and by introducing a middle management position below the Station Manager level who could focus on the station needs' and resources in the maintenance area.

As described in NUREG 0600, (pg. II-2-ll) following the emergency declarations, "a Repair Party composed of six maintenance shift workers was formed at the ECS under the control of Maintenance Foreman 8. (Inc. 187). A second Repair Party, composed primarily of daylight instrument and control personnel, was formed in the Unit 2 control room under the direction of the Superintendent of Maintenance and the Unit 2 Supervisor of Maintenance. The Superintendent of j

Maintenance and Unit 2 Supervisor of Maintenance were aware that the assigned location for either of them during an emergency was I

the ECS where they would act as the Repair Party leader.

However, to ensure prompt availability of their expertise, and since a Repair

}

Party was already formed at the ECS under the direction of a main-i tenance foreman, they decided to remain in the control room (Inc.

120). This decision was reinforced by the Station Manager.

On assuming the position of Emergency Director, he announced that the Superintendent of Maintenance would be the one in the control room to be in charge of emergency repair functions (Ref. 72, Inc.120).

. as w-.

e-+

2 4

Some time later, the Superintendent of Maintenance directed the f

Repair Party at the ECS to move to the Unit 2 control room By 0800, L

all Repair Party personnel were assembled in the Unit 2 control room, I

separated from the ECS."

This organizational aligr. ment placed the control of the Repair Party Teams with the senior maintenance personnel who, by their location and proximity to up-to-date operational and radiological information, could best control and coordinate their activities. Had the organ-izational changes prior to the accident not taken place, the response would have been the same.

D.

Although the position of Chemical Supervisor had been vacant, this position was being filled in each unit by a Senior Chemistry Foreman.

Each of these individuals were fully qualified as required by ANSI /

ANS 3.1-1978 and in fact exceeded these minimum requirements.

Al-though not specifically designated as supervisors, having two quali-fied individuals assigned, one to each unit, provided improved super-vision and control over each unit's chemistry programs. There is no evidence that the lack of a specific individual designated as Chemistry Supervisor resulted in i.. appropriate actions.

The organizational changes identified above were discussed with the NRC at the time of implementation on March 5, 1979. On the same day the office of Inspection and Enforcement was also notified in writing of the changes to be made.

It was agreed verbally that a Technical l

l Specification change would be submitted. These changes had been pre-9

.~

pared but not yet submitted at the time of the accident.

l It has been CPU's experience in the past that organizational changes i

to Technical Specifications may take as long as 6 months from the time of initial discussion with the NRC to final implementation. A recent E

contemplated organizational change at Oyster Cecek took 4 months from the

4 4

time of submittal until final approval by the NRC.

The final changes 7

were essentially the same as these discussed initially with the NRC.

k The Company believes that it is not in the best interests of public health and safety to delay changes that will strengthen the organiza-tion.

Mechanisms similar to those in place for changes to the QA and security plans need to be developed for implementing changes in the organizational structure.

Corrective Action:

The organizational structure for both Units 1 and 2 has been re-documented with the NRC and we are attempting to provide for some flexibility to creat necessary minor organizational changes within these specifications.

The Unit 2 Technical Specifications are under final review and should be issued in the near future by the NRC.

The Unit 1 organization has been re-dafined in the TMI-l Restart Report Amendment 6, submitted November 28, i

1979. This' organization will be incorporated in the Technical Specifications prior to restart.

Major changes to address the organizational deficiencies noted through the many post-accident investigations have been discussed with the NRC e

and implemented with their agreement.

4 The Emergency Plan has also been modified to improve the emergency organ-ization. The revised plan has been documented in the TMI-l Restart Report and is currently under review by the NRC. Drills will be conducted prior y

to restart of Unit I to test the effectiveness of the revised emergency plan.

i U

s 4

+

t f

8.

Statement of Apparent Noncompliance:

Technical Specification 6.4 " Training," requires that a retraining and I

replacement training program for the unit staff be maintained that meets or exceeds the requirements and reccc=endatiens of Section 5.5 of ANSI N18.1-19 71.

Contrary to the above, as of March 28, 1979, a retraining program meeting or exceeding ANSI N18.1-1971 recommendations had not been maintained for members of the radiation protection and chemistry staff in that only 2 of the 10 copics recommended were included in the program.

Discussion:

Metropolitan Edison believes that the retraining program established for the radiation protection and chemistry staff met the requirements of Technical Specification 6.4 and Section 5.5 of ANSI N18.1-1971. Metro-politan Edison therefore disagrebs that this item is a noncompliance.

Technical Specification 6.4 commits Metropolitan Edison to a retraining program for the unit staff which " meets or exceeds the requirements and recommendations of Section 5.5 of ANSI N18.1-1971 and Appendix 'A' of 10 CFR Part 55."

(The latter regulation applies only to operators). Section 5.5 of ANSI N18.1-1971 requires a training program "which maintains the proficiency of the operating organization......" Section 5.5.1 of the ANSI standard states:

"A retraining program should include:

J 1.

Plant startup and shutdown procedures; 2.

Normal plant operating conditions and procedures; 3.

Operational limitations, precautions, and set points; 4.

Emergency plans and security procedures; 5.

Abnormal operating procedures; 6.

Emergency shutdown systems; i

7.

Changes in equipment and operating procedures;

.I 8.

General safety, first aid, and radiation safety; 9.

Alarms and instrumentation signals; and 10.

Operation of selected auxiliary systems important to overall plant safety."

l' The charged violation assumes that all members of the operating organi-zation must have retraining in each of these ten areas. There is no I l

basis in the language of Section 5.5 or elsewhere to our knowledge for i

~;

this assumption. The retraining program described in Section 5.5.1 is for the entire " operating organization," not for each job category. Many of these areas are relevant to plant operators but not to radiation / chemistry technicians. The Station procedures clearly reflect this understanding.

See Health Physics Procedure 1690, described in NUREG-0600 at p. II-I-16.

Thus, the retraining program for radiation / chemistry technicians did not include items 1-3, 5-7 and 9-10.

The interpretation of Section 5.5.1 implied by the charged violation sould also be inconsistent with the general training provisions of ANSI N18.1-1971. Thus, section 5.1 provides in part that the training program "shall be formulated to provide the required training based on individual employee experience and intended oosition." (emphasis added) If retraining in particular subject areas is not appropriate for the " intended posit ion", then it would be illogical to interpret section 5.5.1 to require such training.

It should also be noted that the training program for radiation / chemistry technicians as described in the FSAR (13.2.1.5) is consistent with Met-Ed's pos it ion. Furthermore, I&E combined Inspection Report 50-289/78-09 and J

50-320/78-18 (dated May 25, 1978) reviewed Met-Ed's general employee train-ing and craft and technician training.

(The latter was specifically ad-dressed to Metropolitan Edison's " program for training and retraining of s

craft and technician personnel who are available for assignment to either 3

0 unit.")

No items of non-compliance were identified.

I t

Corrective Action:

L Although Metropolitan Edison does not believe that its retraining program for radiation protection and chemistry staf f was in non-compliance with I

t f '

r j

I

t 4

4 Section 5.5 of ANSI N18.1-1971, Metropolitan Edison recognizes the need

{

T for more and better training of these and other components of the operating organization. The upgraded training and retraining program is especially necessary in light of the particular level of challenge associated with Unit 2.

A improved and expanded training program to address these concerns is under development and will be in place prior to the restart of Unit 1.

l 9

9 9

9 J

l l

- I

.I I

i i

?

I

+

9.

Statement of Apparent Noncompliance:

[

E Technical Specification 3/4.4.6, " Reactor Coolant System Leakage," requires in Section 3.4.6.2, that Reactor Coolant System (RCS) leakage be limited to 1 gallon per minute (GPM) of " Unidentified Leakage," and that unless rates above this limit are reduced to within the limit within four hours, the plant must be placed in " Hot Standby" in the next six hours and in

" Cold Shutdown" in the next thirty hours.

Contrary to the above, from March 22 until March 28, 1979, RCS "Unidenti-fled Leakage" remained above 1 gpm, and the plant was not placed in " Cold Shut down."

Discussion:

Due to an error in the calculational procedure, computations of unidentified

~

reactor coolant system leakage for the March 22-28, 1979, period mistakenly produced values less than 1 gpm.

As a result, Technical Specification 3.4.6.2 was violated.

i Surve.llance Procedure 2301-3Dl, "RCS Inventory", calculates leak rates in terms of gpm at reactor coolant system operating conditions. TCN 2-79-070, issued on March 16, 1979, made a correction to the calculational procedure by correcting changes in the reactor coolant drain tank inventory to reactor coolant system operating conditions. However, the Temporary Change Notice failed to recognize that a similar correction for additions to the makeup cank was also needed. The result was to remove an off-J setting error.

By correcting only one of the two errors, the Icak race calculation become inaccurate.

Correction Action:

4 i

The procedure has been thoroughly reviewed and changes have been prepared.

The proposed procedure change was provided to the NRC (Site Office) on August 24, 1979. Upon receipt of comments, the procedure change will be completed. A similar review of the Unit 1 procedure has been conducted

=..

3i

EI and appropriate changes will be made. The review of the Unit 1 pro-fc cedure shall be complete and all changes incorporated prior to the re-start of Unic I.

e 9

4 e

I i

e o

e 4

N --

Q

=

8 4

7 10.A Statement of Apparent Noncompliance:

{

10 CFR 20.401, " Records of surveys, radiation monitoring, and disposal,"

requires in Section (a) that each licensee maintain records showing the radiation exposure for all individuals for whom personnel monitoring is required on a Form NRC-5 or equivalent and in Section (b) requires that each licensee maintain records of the results of surveys required by 10 CFR 20.201(b).

Contrary to the above:

A.

The results of approximately 500 ground level radiation surveys conducted during March 28-30, 1979 in offsite areas bordering the Three Mile Island site were not documented in a manner which permitted a precise evaluation of the type of radiation (Beta / Gamma) which existed in the environs. Pertinent information such as the type of instrumentation used and whether the end window on the probe was open or closed was not recorded.

Discussion:

10CFR20.201(b) states in its entirety, "Each licensee shall make or cause to be made such surveys as may be necessary for him to comply with the regulations in this part."

As pointed out in the above statement of apparent noncompliance, 10CFR20.401(b) requires that each licensee shall maintain records showing the results of surveys required by 10CFR20.201(b).

Metropolitan Edison believes that although more detailed documentation of survey results is desirable, the documentation of the results of the 500 ground level radiation surveys conducted during March 28-30, 1979 was not in violation of the regulations.

As required by 10CFR20.201 (b), monitoring teams were dispatched around j

the TMI Site to measure and report the general radiation levels. The results of these offsite radiation measurements (surveys) were radioed to I

the Emergency Control Station (ECS) where they were recorded by emergency 5

i personnel. Discussions with the Supervisor-Radiation Protection and Chemistry who was the ECS Director noted that the individuals receiving the radio reports were using an agreed upon shorthand notation to record l

l radioed survey results. This process allowed them to report the information

--- a v

e vm-+-

4 A

4 7

to supervisory personnel while simplifying the recording process and maxi-7 4

mizing the number of surveys that could be taken.

The annotations woult simply rec +d location, time and level for all surveys using the standard

=eters available in the established fsshion.

Exceptions were specifically noted such as a change in instruments, both open and closed window readings, etc.

By understanding this si.Sethand, it was possible to reconstruct the full survey information.

It is recognized that this method of recording is not sufficiently formal to be understandable without other explanation and was not of the quality desired for historical evaluations of conditions that existed throughout the accident.

It is also recognized that the potential for error with the informal shorthand method of recording is greater than with formal recording methods.

However, in spite of these recognized shortcomings, it is not apparent that the method of recordkeeping hampered the real time evaluation of radiological conditions which is a principal function of surveys as described in 10CFR20.201.

There were no erroneous actions taken as a result of these survey records.

i The post-accident evaluations of offsite exposure primarily relied on information obtained from the existing dispersed TLD array and its supplemental TLD's, and from the numerous air, water, animal, and vegeta-a tion sampling programs. These exposure estimates were correlated against 3

in plant monitor information. Since the early radiation survey informa-tion was not a significant contributor to these evaluations, the uncer-T tainties of these records had no detrimental impact on the ability l

to perform the necessary evaluations of exposure to the general public.

?

4 E

Corrective Action:

4 7

i To enable future reviews of the survey data to be fully understoed, an I

explanatory document will be developed that will provide the sherchand method utilized for the 500 of fsite radiation measurement takee i=medi-stely following the TMI-2 accident. This document will be provided as part of the permanent record requirement of 10CFR20.401 for the accident.

To improve the quality and clarity of future offsite survey records, forms will 5e developed and included in each emergency kit and at other locations as appropriate. These forms will include field survey team identifiers, identification of instruments used, person conducting survey, locat ion, reading time, level of' radiation, type of radiation, and a remarks column to note items such as directionality, shielding or other pe rt e nent facts. Lese forms will be required to be filled out by the survey team at the time of each measurement, and will be collected and retained for historical purposes as required.

Information from these surveys radioed to a central location will be recorded in an abbreviated fashion noting the survey team identifier, time of measurement, location, level and type of radiation, and remarks.

5 Training will emphasize the need to establish survey practices which will J

provide high quality measurements to aid in the response to radiological emerge nc ies. It will also emphasize that producing clear, complete, understandable records of those surveys is essential in order to allow historical evaluations of exposures to people not provided with individual dosimetry.

m 4

l l

l

~

h 10.B Ststemznt of Appr.rsnt Noncomplianen:

4 I

2 10 CFR 20.401, " Records of surveys, radiation monitoring, and disposal,"

I s

rec,uir es in Section (a) that each licensee maintain records showing the radiation exposure for all individuals for whcm personnel monitoring is required on a Form NRC-5 or equivalent and in Section (b) requires that each licensee maintain records of the results of surveys required by 10 CFR 20.201(b).

Contrary to the above:

B.

The records of the radiation exposure for at least 5 individuals exposed during the period March I to 31, 1979 had not been recorded or maintained on a form NRC-5 or equivalent as of July 5,1979.

Further-more, as of July 5,1979 the assesscent of their doses had not been completed.

Discussion:

Metropolitan Edieon agrees that a recording error has been made in thet of the more than 1000 individuals for whom personnel monitoring was re-quired during March, 1979, the records for 5 individuals were not properly naintained.

This recording error is a direct result of the heavy work load placed on a limited staf f under emergency conditions and is not be-lieved to represent a shortcoming in the maintaining of radiation ex-posure records during normal operation.

Within a few days of the accident, the number of individuals for which radiation exposure records was required nearly doubled from approximately 600 to approximately 1200. At the same time, experienced people codtri-J buting to the maintenance of radiation exposure records during normal operation were called upon to perform other functions during the emergency response to the accident. Less experienced people dere therefore utilized to maintain a large volume of new radiation exposure records. As a

.I result a few records were not properly maintained.

No violation of exposure limits or increases in occupational exposure resulted from this error in record keeping.

~

~.

4*

Corrsetiva Action:

g 7

In order to correct for the error in recurds maintenance for the 5 in-a dividuals identified above, and to assure that no other errors exist in the radiation exposure records of all persons for whom personnel monitor-ing has been required from March 28 to June 30, 1979, a review of exposure records will be completed by January, 1980.

This review will involve examining all radiation exposure records during the time period of the accident and identifying those records for which any sort of abnormality or incompleteness exists.

For those records showing abnormalities or incompleteness, a re-evaluation will be completed using telephone and personal interviews.

Re-evaluations will also be performed for all individuals identified as having been present in an area with abnormal conditions, such as the auxiliary building, during the period of March 28 to June 30, 1979.

It is not expected that this program can be completed before the end of January 1980 because at least 2000 exposure records will need to be evaluated, requiring the full time ef fort of six personnel.

This program is documented in a Metropolitan Edison letter to the NRC dated October 29, 1979.

4 In addition to the above records correction program, to assure proper records maintenance in the course of future emergencies, the revised site Emergency Plan specifically charges the Emergency Director with the responsibility for assuring that accurate exposure records are maintained.

j This will require appropriate training for any persons assigned temporary I

responsibilities for records maintenance and advance planning to assure i

the capability to handle the expected increase in records processing in the event of a radiological emergency.

~

p p2l ri 4'

11.

Statement of Apparent Noncomoliance:

y I

10 CFR 50, Appendix B, Criterion X, " Inspection," requires that a program for inspection of activities affecting quality shall be established and executed to verify conformance with documented instructions, procedures and drawings for accomplishing the activity.

"three Mile Island Nuclear Station - Unit 2, Final Safety Analysis Report, Chapter 17.2.15,Section X, requires that the inspection program include random observation of operations and functional testing by individuals independent of the activity being performed.

Procedure GP 4014, "QQA Surveillance Program," Revision 0, requires independent observation of activities affecting quality to verify conform-ance with established requirements utilizing both inspection and auditing techniques... for compliance with written procedures and the Technical Specifications.

Contrary to the above, as of March 28, 1979, the normal operations sur-veillance testing activities had not been made subject to random and/or routine inspections by independent methods.

Discussion:

Metropolitan Edison believes that there is no noncompliance in connection with normal operations surveillance testing.

In accordance with GP4014, Rev. O, the' Metropolitan Edison QC Department scheduled and performed inspections of TMI-2 operations Technical Specification surveillance testing as documented by the following QC Surveillance Reports prior to March 28, 1979.

Date Surv. Rep. No.

Surv. Proc. No.

Title d

9/78 78-175 2303-M15A/B Control Room Emergency Ventilation System 9/78 78-181 2322-Al Waste Gas and Unit Vent Dis-I charge Functional Test l

10/78 78-191 2303-M14C E.F. Sys. Valve Lineup l

Verification and Opera-y

(

bility Test; and Turbine I

j Driven E. Feedpump Opera-bility Test 11/78 78-196 2304-Q1 Diesel Fuel Testing C

l 11/78 78-206 2303-M34 Safety Inj. Manual Actua-T l

tion and Act. Logic Func.

l Test 11/78 78-219 2303-M1B MU Pump & Valve Functional Test D

e E

Date Surv. Rep. No.

S_urv. Proc. No.

Title L

12/78 78-235 2301-M8 Containment Integrity veri-I ficat ion 1/79 79-04 2612-R4 LIQ Radiation Monitor Cali-bration 2/79 79-12 2302-R23 FW Line Rupture Auto Detec-tion Calibration Technical Specification surveillance procedures were selected for per-t formance inspection at random and witnessed when performed to verify conformance with documented procedures.

This process was in accordance with 10CFR50, Appendix B, Criterion X.

Corrective Action:

Although this item does n'ot involve noncompliance with regulations, Technical Specifications or procedures, Metropolitan Edison is planning to expand its program for inspection of surveillance testing activities.

Initial steps to expand this program had begun prior to March 28, 1979.

4 i

Respect fully submitted, g

/

i R. C.

rnold 2

Senior Vice President Metropolitan Edison Company December S, 1979

e.

3 UNITED STATES OF AMERICA E

+

NUCLEAR REGULATORY COMMISSION 4

7s r

~

In the Matter of

)

METROPOLITAN EDISON COMPANY )

Docket No. 50-320

)

(Three Mile Island Nuclear

)

Power Station, Unit 2)

)

METROPOLITAN EDISON COMPANY'S ANSWER TO NOTICE OF PROPOSED IMPOSITION OF CIVIL PENALTIES Pursuant to 10CFR2.205(b) and the Notice of Proposed Imposition of Civil Penalties of October 25, 1979, Metropolitan Edison Company provides the follow-ing written answer. The answer to each apparent noncompliance incorporates by reference the statement in reply to that item set forth in Metropolitan Edison Company's Statement in Reply to Notice of Violation (hereafter

" Statement").

Apparent Noncompliance 1: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

1 Apparent Noncompliance 2A: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

16, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Noncompliance 2B: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

19, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Noncompliance 2C: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

21 Apparent Noncompliance 2D: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

23, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

9 l

~

Apparent Noncompliance 2E: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

25, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed f

penalty.

W v

+

A 4

. 5 1

Apparent Noncompliance 2F: Metropolitan Edison believes that this I

item is a noncompliance. However, the Statement, pp.

28, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Noncompliance 2G: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

28, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Noncomoliance 2H: Metropolitan Edison Company believes that this item is a noncompliance.

Apparent Noncompliance 3: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

31 Apparent Noncompliance 4A: Metropolitan Edison believes that this item is not a noncompliance.

See Statement, pp.

34 Apparent Noncompliance 4.B.1:

Metropolitan Edison believes that this item is not a noncomplianca See Statement, pp.

42 Apparent Noncompliance 4.B.2:

Metropolitan Edison believes that this item is not a noncompliance.

See Statement, pp.

52 Apparent Noncompliance 4.C:

Metropolitan Edison Company believes that this item is a noncompliance.

Apparent Noncompliance 4.D: Metropolitan Edison believes that this item is not a noncompliance.

See Statement, pp.

58 Apparent Noncompliance 4.E: Metropolitan Edison believes that this item is not a noncompliance.

See Statement, pp.

60 Apparent Noncompliance 4.F: Metropolitan Edison believes that this e,

item is a noncompliance.

Apparent Noncompliance 4.G: Metropolitan Edison believes that this item is a noncompliance.

Apparent Noncompliance 5: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

71, sets forth what Metropolitan Edison 'oelieves are extenuating circum-I stances and requests remission or mitigation of the proposed penalty.

I Apparent Noncompliance 6: Metropolitan D4 -ac believes that this 5

i item is a noncompliance. However, the Statement, pp.

74, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

4

e

- ~

n a

3-4 5

1 Apparent Noncompliance 7: Metropolitan Edison believes that this

[

item is a noncompliance. However, the Statement, pp.

77

, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Noncompliance 8: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

81 Apparent Noncompliance 9: Metropolitan Edison Company believes that this item is a noncompliance.

Apparent Noncompliance 10.A: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

86 Apparent Noncompliance 10.B: Metropolitan Edison believes that this item is a noncompliance. However, the Statement, pp.

89, sets forth what Metropolitan Edison believes are extenuating circum-stances and requests remission or mitigation of the proposed penalty.

Apparent Nencompliance 11: Metropolitan Edison believes that this item is not a noncompliance. See Statement, pp.

91 Based upon the above answers, Metropolitan Edison Company respectfully" requests that the Of fice of Inspection and Enforcement appropriately re-duce the cumulative amount of civil penalties which have been proposed.

Respectfully yours, pi)n is R. C.

rnold Senior Vice President Metropolitan Edison Date:

December 5, 1979 i

l

'=

i e

I I

I

-

ML19309E477

Text

Dear Mr. ciello:

Navigation menu

Search