ML19338D357

Direct Testimony Re Contention 4.Explains Proper Application of Single Failure Criterion.Connection of Heaters in Proposed Manner Violates General Design Criterion 1F. Certificate of Svc Encl

ML19338D357
Person / Time
Site:	Three Mile Island
Issue date:	09/15/1980
From:	Pollard R UNION OF CONCERNED SCIENTISTS
To:
References
ISSUANCES-SP, NUDOCS 8009230011
Download: ML19338D357 (18)

Text

. 1 -

.m,mr

. P gT.

(p/>

~

-8 UNITED STATES OF AMERICA' ,t A NUCLEAR REGULATORY COMMISSION g

BEFORE THE ATOMIC SAFETY AND LICENSING BOARD 6

) -

In the Matter of )

)

) Docket No. 50-289 METROPOLITAN EDISON COMPANY, e_t, t g., )

),

(Three Mile Island )

Nuclear Station, Unit ) 7.f No. 1) )

)

DIRECT TESTIMONY OF

=

ROBERT D. POLLARD ON BEHALF OF THE UNION OF CONCERNED SCIENTISTS REGARDING UCS CONTENTION NO. 4 3sof

.s s  ;

//

I l

September 15, 1980

~

L; 8 00923 cott . - . ...

'a x ~

y. . F

gy:

y .e.

slw .,

... i;

<a . .

., ROBERT D.' POLLARD , .

. QUALIFICATIONS Mr. Pollard;is presently' employed.as a. nuclear safety-

, expert ~ with the Union r of' Concerned Scientis ts , . a non-profit .

Leoalition~offscientists, engineers and.other orofessionals supported,by over- 80,1000 public; sponsors. .

. Mr. Pollard's formal educationL in .nuclearc design' began in May,< 1959, when . he was selected to - serve as an electronics techni'cian tin the. nuclear power program of Lthe U.S. Navy.

~ ".'

After ; completing -the required ' training ,f he became an. instruc-tor Jresponsible for teaching naval personnel..both the .theore- ~

'tical and practical aspects : of operation',: maintenance and  !

repair'for nuclear; propulsion plants. . ~From February, 1964 to -

April',1965; .he served as senior reactor operator, supervis-. 2 ing the reactor control division of the U.S.S. Sargo, a nuclear-powered submarine'.'

After his honorable' discharge inl1965, Mr. Pollard attended Syracuse University, where he received .the degree of Bachelor of Science imhana cum laude in Electrical Engi-neering'in June, 1969.

In - July , 1969, Mr. Pollard was hired by the Atomic Energy .

Commissionz (AEC), and continued as a tech'nical excert wi~th - the AEC and 'its successor the United - States Nuclear Regulatory ,

Commission (NRC) ;until February , '19 76. After joining the AEC, che studied' advanced electrical' and nuclear engineering '

at the -Graduate ' School of the University of New Mexico in Albuquerque. He-subsequently-advanced to the oositions of Reactor Engineer: (Ins trumenta tion ) and Project Manager with AEC/N,RC.

As .a Reactor: Engineer , Mr. Pollard was primarily respon- I

'sible for performing detailed technicalL reviews analyzing i and evaluating' the. . adequacy of the design of reactor protec- ~

tion systems, control, systems and emergency electrical power

. systems,in proposed'nuclaar facilities. 'In September 1974,

~ he wasE promoted L to the npo'sition of Project Maneger and ibecami responsible for ' pleaning 'and ' coordinating. all aspects of Lthe . design and safety reviews of applicati'ons for licenses to construct . and : operate 'several' commercial nuclear power  ;

Lplants. .: Helserved ;as Project Manager for the review of a j

-number of:: nuclear: power plants including:' Indian Point, v1

Unitl 3, ' Comanche H Peak ,. Unitsj l and 2,'. and Catawba, Units  ;

, , liand '2 1 While with NRC, Mr.7 Pollard also' served on the

,4 .standardstgroup, participating in developing standards and N (safety' guide's ,< and Las.' a ' member' of: IEEE Committees.

l

,x .

% s 4

C'4 w_ -

7_ , .

• OUTLINE ~- DIRECT TESTIMONY

. ON UCS CONTENTION No. 4 ^

J While not requiring pressurizer heaters to. conform.with all safety-grade criteria, the Staff and Met. Ed. propose to connect -

the heaters to the onsite emergency power sdpply, in an apparent attempt to meet GDC 17. This testimony explains the proper appli--

cation of the' single failure criterion and demonstrates that connection of the-heaters in the manner propose'd. compromises the emergency power supply by making it vulnerable do_(a single failure.

The testimony also demonstrates that the proposal' violates.GDC 17.

In addition,.it relies'to an inordinate degree on operator action.

Finally, no showing has been made that the TMI-l onsite emergency power supply is qualified to start and operate with 'he t additional

^

load. This poses. undue risk to public health and safety.

t 1

e 4 ,

i UCS CONTENTION NO. 4 Rather than classifying the pressurizer heaters as safety-grade, the staff has proposed simply to add the pressur-izer heaters- to the onsite emergency power supplies. It has -

not been demonstrated that this will not degrade the capacity, capability and reliability of these power supplies in violation of GDC 17. Such a demonstration is required to assure protection of public. health and safety.

In my testimony on UCS Contention 3, I discussed the reasons why the pressurizer heaters must be classified as safety grade and must, therefore, meet the Commission's General Design Criteria. I will now address the reasons ,

why the use of non-safety grade heaters violates General Design Criterion 17 and degrades the capacity, capability and reliability of the onsite emergency power supplies. ,.

General Design Criterion 17 requires that the onsite electric power supplies and Ebc onsite electric distribution system "have sufficient independence, redundancy, and testability to perform their safety functions assuming a single failure."

The design described in Section 2.1.1.3.1 of the Restart Report

4-2 8

violates this requirement because a single failure can result in loss of both onsite emergency power supplies. To explain this statement, it is necessary to first explain the requirements of the single failure criterion. -

The single failure criterion requires that a safety system i be capable of performing its safety function in the presence of any single detectable failure within that safety system (or its essential auxiliary supporting systems or ano er safety system) -

concurrent with all failures resulting from the single failure, all undetectable failures, and all failures that caused or were caused by the accident that-requires operation of the safety system.

Performing an evaluation to determine whether a system meets the single failure criterion involves the following steps:

1. Identify components that are not safety grade, e.g., not seismically and environmentally qualified in accordance with GDC-2 and 4, not physically and electrically separated as required by GDC-17 and 22, or not protected against fire as required by GDC-3.

2. Assume that each non-safety grade component fails if its failure adversely affects the safety system or assume it operates if its

,

• 4,. , - - ,

-e.am- wr * -a e L_.

. *~.

4-3

~ .

/

operation adversely affects the safety system.

3. Assume that all failures which can cause or .

can be caused by the accident requiring the safety system to operste have occurred.

4. Assume that any other single. failure has occurred .

' and then determine whether the safety system being evaluated can still perform the required safety function.

Applying the single f ailure criterion to the TMI-1 onsite power supply considering the proposal to connect non-safety grade pressuri,zer heaters to that power system yields the following:

1. A safe shutdown earthquake occurs and causes a reactor shutdown and loss of offsite power.

This requires use of the onsite electric power system and the pressurizer heaters to assure decay heat removal by natural circulation.

2. Because the heaters are not safety grade, it must be assumed that the heaters are damaged, for example, short circuited.

~

3. As called for by Met Ed's procedures, one group of damaged heaters is connected to one of the .

two redundant emergency power supplies and the

" " # 6= *NWe%, e , ,

l 4-4

+

( short circuit results 'in loss 'of that power supply.

4. The other redundant emergency power supply is also unavailable as thefresult of a single failure, such as the diesel generator failing -

.to start.

The result is that the onsite power supply is

5. l

~

1 unable to perform its safety function because '

both redundant divisions have been lost, one l i

as the result of a single failure and the other I as the result of the failure to require safety grade pressurizer heaters.

.l The foregoing is intended to illustrate only one examp'.e I of how the use of non-safety grade pressurizer heaters can degrade 1

the TMI-1 onsite emergency power systemi Similar analyses can f be done for other events such as a fire in or affecting the pressurizer heater circuits or a smal.1 steam or reactor coolant leak creating an environment which fails the heaters. The I

l results of those analyses will be the same - loss of both redundant onsite power supplies. Of course, each event also l i

1 results in loss of the pressurizer heaters as a means of main- )

i taining the reactor coolant pressure necessary to establish a

natura~1 circulation.

4 m===-.---

, ,, , __ _ _ . _r -

4-5 j

The only disagreement that I foresee from the Staff and Met Ed concerning the foregoing analysis is whether a fault, such as a short circuit in the pressurizer heaters or their circuitry, will result in loss of the emergency power supply.

The reason there may be disagreement is that the Staff I

and Mst Ed may claim that the non-safety grade heaters will be isolated from the safety grade onsite power supplies in '

accordance with the provisions of Regulatory Guide 1.75,

" Physical Independence of Electric Systems." Based on my experience participating as a professional member of the Staff in the development of Regulatory Guide 1.75 and serving as the NRC's representative on the nuclear industry committee that developed IEEE Standard 384, which is endorsed by Regulatory Guide 1.75, I conclude that such claims are without merit.

In fact, statements contained in Met Ed's Restart Report and the Staff's TMI-l Restart Evaluation refute any claim that the design complies with Regulatory Guide 1.75.

On page 2.1-5 of the Restart Report, . Met Ed claims that s

"[t]he 480 volt circuit breaker is the isolation device between C1 ass IE and non-Class IE portions of the design."* Met Ed Emphasis added.

The terms Class IE and non-Class IE are equivalent to safety grade and non-safety grade. '

4-6 also attempts to describe how the use of an undervoltage relay to detect a fault and open the circuit breaker connecting the non-safety grade heaters to the safety grade power supply will remove any endangerment to the power' supply caused by a fault in the pressurizer haater circuits. In addition, on page .

2.1-Sa of the Restart Report, Met Ed atten. pts to describe how the fault protection on the circuit breaker feeding pcwer to pressurizer heaters "will be fully coordinated" with the fault protection on the main circuit breaker supplying power to the safety grade bus. (The latter circuit breaker is not shown on Figure 2.1-4'of the Restart Report. If it were, there would be an incoming circuit breaker above bus IP and another above bus 1S.) Thus, Met Ed's position is that protection of the emergency power supplies is achieved by the provision of a circuit breaker that would open to prevent loss of the onsite power supply in the event of a short circuit in the pressurizer heaters. The cire:uit breaker would be opened either directly by the fault current or indirectly by an undervoltage relay sensing an effect (i.e., undervoltage) I of the fault current. l l

A, circuit breaker generally includes a method of detecting high current through it that causes the breaker to trip ,

open.. These devices can be selected to adjust the magnitude l of current and the time the high current persists needed to l trip the breaker. The word " coordinated" means that when  ;

two (or more) circuit breakers are connected in series, the l breaker closer to the load will open on a smaller current than i 1

the breaker closer to the power source.

4-7 i

In contrast, Regulatory Guide 1.75 states that:

" Interrupting devices actuated only by fault current are not considered to be isolation , devices..." (Regulatory Guide 1.75, Regulatory Position C.1., emphasis added.) The Regulatory Guide goes cn1 to, explain that " coordination" of circuit -

breakers was fully considered in developing the position.

It also explains that for a circuit breaker to be considered ,,

IT t

an acceptable isolation device, it must be opened by " a signal other than one derived from the f ault current or its effects...." (Regulatory Guide 1.75, Regulatory Position C.1, Basisl. Thus, the inescapable conclusion is that the TMI-1 design does not comply with Regulatory Guide 1.75. r-.

Neither the " fully coordinated" breakers nor the undervoltage trip derived from the effects of fault current is an acceptable .

method of preventing a f ault in the non-safety grade pressuriser heater circuits from causing a loss o'f the safety grade power supply.

Met Ed's " Safety Evaluation" of the design is contained .

on page 2.1-7 of the Restart Report. Met Ed acknowledges, .l however reluctantly or tentatively, that a fault in the non-lt l

safety grade pressurizer heater circuits will cause the loss j I

l The example of an acceptable trip signal given in Regulatory Guide 1.75 (an accident signal) is inapplicable in this instance. That signal is incapable of protecting the onsite power supply against a heater fault.

I e m e.- == - = 4 ..

4-8 of the 480 volt ES - system to which the heatUrs are connected.

In the face of that correct statement, the only realistic way .

I can explain Met Ed's conclusion that the design is acceptable I

is to conclude that Met Ed either does not understand or chooses to ignore the requirements of the single failure criterion and the provisions of Regulatory Guide '1.75. I wi]1 now address the Staff's position, which reflects the same basic misapplication of the single failure criterio5,.and then explain .the fallacy in both positions.

Although " Clarification" item 6 (Restart Evaluation,.

page C8-6) references Regulatory Guide 1.75, the Staff never discusses how these provisions are met or states a conclusion as to whether it has been complied with. My opinion is that, in view of the language of position #4 on page C8-3 (incorporated in the Commission's order of August 9, 1979) and the reference to Regulatory Guide 1.75, compliance with Regulatory Guide 1.75 is mandated.

On page C8-7 of the Restart Evaluation, the Staff takes note of Met Ed's procedural " prohibition of energizing the two Clarification item 6 states "The Class IE interfaces for main power and control power are to be protected by safety-grade _ circuit breakers." .

Position #4 states " Pressurizer heater motive and control power. interfaces with the emergency buses shall be accomplished through devices that have been qualified in accordance with safety-grade requirements."

e

r-F- ,

{

4-9 l y

heater banks sLmultaneously." The Staff also states the ',

following: "The concern with simultaneous energization of both heater banks is that the electrical separation of the heaters within the pressurizer and the heater cables leading to the pressurizer are not sufficient to assure the required .

This independence of the two emergency power supplies. "

statement is presumably based on the Staff's recognition ,

that the TMI-1 design does not provide safety-grade isolation devices between the non-safety grade heaters and the safety If a safety-grade isolation grade onsite emergency power supply.

device were provided, there would be no concern about energizing both groups simultaneously. Thus, the Staff recognizes that .

a fault in the heaters can cause' the loss of the emergency power supply. Therefore, onn must conclude that Regulatory Guide 1.75 is not met.

Furthermore, the Staff, either by misunderstanding or disregarding the requirements of the single failure criterion, apparently concludes that, if only one heater bank is connected _

to the emergency power supply, a heater failure and the resultant los.s of only one emergency power supply will leave the redundant emergency power supply operable, thereby (in the Staff's view)

This is the same reasoning meeting the single failure criterion. -

apparently adopted by Met Ed.

Both err in not recognizing that:

i l

y *

• 4-10 h Y

11 the heater failure must be assumed at the outset because the power supply connected the heaters are not safety grade; 2) isolation to the heat'ers must be assumed to,be lost because the " u device" between the heaters and the power supply does not meet -

and 31 the other onsite power supply ,

Regulctory Guide 1.75; ilure.

must be assumed to be inoperable because of a single fa h

Thus, the conclusion that the TMI-1 design does::. not meet t e single failure requirement of GDC-17 is compelled.

Another reason why the connection of the pressuri=er heaters to the onsite emergency power supply degrades that safety grade system is' that operator action will be relied upon to connect the heaters to the emergency power supply and to disconnect other loads to prevent overloading the Relying upon the operator to perform emergency power supply.

more actions needed to protect the public as a result of the TMI-2 accident, which was caused in part by incorrect operator

~

action, is inconsistent with the lessons to be learned from Furthermore, if the objective is to provide that accident.

" substantial additional protection to the public health and i

safety," then disconnecting other loads from and connect ng the heaters to the emergency power supply should be done Relying on operator automatically as required by GDC-20.

It poses the risk action is both unnecessary and unsafe.

1 i

1

4-11 /

I )

i N of operator errors that could result in failure to establish .

natural circulation and/or in loss of the emergency power supply due to overload.

I will discuss one other way in which the TMI-1 design degrades the emergency power supply. Met Ed has not performed -

q any qualification tests to demonstrate the reliability and '

y capability of the TMI-1 onsite emergency power supplies to start and operate uhe loads added as a result of the lessons learned from the TMI-2 accident. Periodic tests are not a substitute for qualification tests. Proper qualification requires that a reliability goal be established and that tests then be performed to demonstrate that the reliability goal -.

1 is met or exceeded.

Met Ed stated that the reliability of the onsite emer-gency power supply "has been demonstrated by monthly surveillances since TMI-l began operation in 1974." (Answer to UCS Interrogatory 3 9 ). . Met Ed also stated that: 1) the monthly tests were for 1 the purpose of demonstrating both the reliability of starting 1 the diesel generators and the reliability of carrying the required loads; 2) no specific reliability goal has been established; and 3). the reliability demonstrated by the j monthly tests is not known quantitatively. (UCS Deposition .I j

of Ronald Stevens, et al, March 26, 1980, Tr 78-801 Considering

4-12

)

these statements and the fact that no monthly tests have been done on the modified design, no basis has been presented to support , Met Ed's conclusion that the requirements of GDC-17 are met. Similarly, since the Staff;.has advanced no reliability goal nor proposed any qualification tests on the modified <

design, there is no basis for determining that the rec;uirements of GDC-17 are met.

I conclude that, in the absence of adequate qualification testing, it has not been demonstrated "that the capacity, capability;. and reliability of the emergency power source (silesel generators) is not degraded as a result of implementing the capability to supply selected pressurizer heaters from . . .

the emergency power source when offsite power is not available."

(NUREG-0578,- page A-31 I also. conclude that it has not been demonstrated that the requirements of GDC-17 are met and, therefore, TMI-1 should not be permitted to restart.

In summary, my testimony has.shown that connection of the pressurizer heaters to onsite power supplies in the manner proposed compromises the emergency power supply by making it vulnerable to a single failure as defined by NRC practice.

Met Ed's proposed method for " isolating the emergency power supply from the non-safety grat'e pressurizer heater circuits is unacceptable; it does not meet GDC-17, Regulatory Guide 1

__..7,. _ . _ _. .... ._ _ _ -...___...._j m'

A

4-13 i

1.75 and Position #4 of the Commission's requirements for upgrading the heaters. In addition, Met Ed's proposal relies improperly on operator action. Finally, no showing has been made by either Met Ed or the Staff that the TMI-1 onsite emergency power supplies are qualified to' start and operate 9 the loads added as a result of the lessons learned from TMI-2, including pressurizer heaters. In my opinion, it is clear that the Commission's regu2ations have not been met and that TMI-l cannot safely be operated under these circumstances.

i W

G 6*

e G

9 b

e

• 41119ll O O

UNITED STATES OF AMERICA NUCLEAR REGULATORYSINGCOMMISSION 8A D+g BOARD _

> c BEFORE THE ATOMIC SAFETY AND LICEN  %

4 g

-) 1p 6

)

In the Matter of )

Docket No. 50-289

) '

METROPOLITAN EDISON )

COMPANY , e__t a_l._ , )

)

(Three Mile Nuclear IslandUnit Station,

)

)

No. 1) ._

)

o CERTIFICATE OF SERVICE " Direct Testimony of

' I hereby certify that copies of the erned Scientists Robert D. Pollard on Behalf of the Union of Conc" hav Regarding UCS Contention No. 4, to the following parties:

0, this 15th' day of September, 198 Sholly Mr. Steven C.

304 South Market Street 17055 Secretary of the CommissionU.S. Mechanicsburg, Nuclear PA Regulatory C 20555 Washington, D.C. Chief, Docketing Service Attn: Cunningham, Esq.

Section Jordan D.

Fox l Farr & Cunningham James A. Tourtellotte, Esq. 2320 North Second Street 17110 Office of the Exec. Legal Harrisburg, PA DirectorU.S. Nuclear Reg 20555 Washington, D.C. Frieda Berryhill Karin W. Carter, Esquire Coalition for Nuclear Power Postponement Assistant Attorney General 2610 Grendon Drive 19808 505 Executive House Wilmington, Delaware P.O. Box 2357 17120 Cohen, Consumer At Harripburg, PA Wal'ter W.

Department of Justice 14th Floc Danie'l M. Pell Strawberry Square,17127 32 South Beaver Street 17401 Harrisburg, PA York, Pennsylvania h $

Cert. of Service Docket No. 50-289 Knupp, Esquire Chauncey Kepford Robert L.

Judith H. Johnsrud Assistant Solicitor Environmental Coalition on County of Dauphin P.O. Box P Nuclear Power 407 North Front Street 433 Orlando Avenue State College, PA 16801 Harrisburg, PA 17108 .

John A. Levin, Esquire Robert O. Pollard Assistant ~ Counsel Chesapeake Energy Alliance Pennsylvania Public Utility 60c dontpelier Street Sc_cimore, Maryland 21218 Commission Harrisburg, PA 17120 Theodore Adler Marvin I. Lewis Widoff, Reager, Selkowit: 6504 Bradford Terrace i Philadelphia, PA 19149

& Adler i 3552 Cld Gettysburg Road I Camp Hill, PA 17011 Ivan W. Smith, Chairman [

Ms. Marjorie Aamodt Atomic Safety & Licensing Board RD #5 U.S. Nuclear Regulatory Commission {

Coatesville, PA 19320 20555 Washington, D.C.

Dr. Walter H. Jordan Dr. Linda W. - Little -

i 881 W. Outer Drive 5000 Hermitage Drive Raleigh, North Carolina 27612  !~

Oak Ridge, Tennessee 37830  !

George F. Trowbridge, Esquire Ms. Jane Lee l Shaw, Pittman, Potts & R.D. #3, Box 3521 Etters, Pennsylvania 17319 ,

Trowbridge ~

I 1800 M Street, N.W.

Washington, D.C. 20036 .

%o &

Elly'h-R. Weiss s .

7