ML19338E965

Direct Testimony Re Ucs Contention 9.Administrative Procedures Informing Operator That Safety Sys Has Been Deliberately Disabled Are Inadequate & Unreliable.Prof Qualifications Encl.Related Correspondence

ML19338E965
Person / Time
Site:	Three Mile Island
Issue date:	10/02/1980
From:	Pollard R UNION OF CONCERNED SCIENTISTS
To:
References
ISSUANCES-SP, NUDOCS 8010070011
Download: ML19338E965 (16)

Text

_

DTED Colugpg,gg,.

,t 19/

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION 00%g ,,

g '

USNPc BEFORE THE ATOMIC SAFETY AND LICENSING BOARD -

~

,,' . 5 & > ' s O!Cce C:cket;ng eith} ,

Staan p/

) 4 '

In the Matter of ) m

)

METROPOLITAN EDISON ) Docket No. 50-289 COMPANY, et al., )

)

(Three Mile Island )

Nuclear Station, Unit )

No. 1) )

)

DIRECT TESTIMONY OF ROBERT D. POLLARD ON BEHALF OF THE UNION OF CONCERNED SCIENTISTS REGARDING UCS CONTENTION NO. 9 5

950s

~

I October 2, 199n 80100700//

, i, ROBERT D. POLLARD OUALIFICATIONS Mr. Pollard is presently employed as a nuclear safety expert with the Union of Concerned Scie n tis ts , a non-profit coalition of scientists, engineers and other orofessionals supported by over 80,000 public sponsors.

Mr. Pollard's formal education in nuclear design negan in May , 1959, when he was selected to serve as an electronics technician in the nuclear power program of the U.S. Navy.

After completing the required training, he became an instruc-tor responsible for teaching naval personnel both the theore-tical and practical aspects of operation, maintenance and repair for nuclear propulsion plants. From February, 1964 to Apr il , 1965, he served as senior reactor operator, supervis-ing the reactor control division of the U.S.S. Sargo, a nuclear-powered submarine.

After his honorable discharge in 1965, Mr. Pollard attended Syracuse University, where he received the degree of Bachelor of Science maana cum laude in Electrical Engi-neering in June, 1969.

J 1 In July, 1969, Mr. Pollard was hired by the Atomic Energy Commission ( AEC ) , and continued as a technical exoert with the AEC and its successor the Uni ted States Nuclear Regulatory Commission (NRC) until February, 1976. After joining the AEC, he studied advanced electrical and nuclear engineering at the Graduate School of the University of New Mexico in Albuquerque. He subsequently advanced to the oositions of Reactor Engineer (Ins trumenta tion ) and Project Manager with AEC/NRC.

As a Reactor Engineer , Mr. Pollard 9as primarily respon-sible for performing detailed technical reviews analyzing and evaluating the adequacy of the design of reactor protec-tion sys tems, control systems and emergency electrical power systems in proposed nuclear facilities. In September 1974, he was promoted to the position of Project Manager and became responsible for planning and coordinating all aspects j of the design and safety reviews of applications for licenses to construct and operate several commercial nuclear power plants. He served as Project Manager for the review of a number of nuclear power plants including: Indian Point, .

Unit 3, Comanche Peak, Units 1 and 2, and Catawba, Units -

1 and 2. While with NR C , Mr. Pollard also served on the standards group, participating in developing standards and safety guides, and as a member of IEEE Committees.

OUTLINE - DIRECT TESTIMONY .

ON UCS CONTENTION NO. 9 The testimony begins by showing that systems or compon-ents necessary to protect the public can be completely disabled without the operator's knowledge or recognition. The TMI-2 accident offers two examples: auxiliary feedwater and onsite emergency power. Because deliberate disabling of one train of redundant safety systems for maintenance and repair is not unusual, NRC has adopted regulations requiring continuous indication in the control room when such a system has been bypassed or disabled, in order to prevent actions leading to total loss of safety function. The testimony demonstrates that the use of administrative procedures to inform the operator of these conditions is inadequate and unreliable. j Because of the alarmingly high rate of instances of total loss of safety function despite procedural controls, NRC adopted Regulatory Guide 1.47, which requires automatic indication at the system level of inoperability of a safety system. The testimony demonstrates why conformance with the requirements embodied in that Regulatory Guide or equiva-lent is vital to ensuring safe operation of TMI-1 and why the staff and licensee's positions are inadequate.

l l

y. '

4 UCS CONTENTION NO. 9 The accident at TMI-2 was substantially aggravated by the fact that the plant was operated with a safety system inoperable, to wit: twc auxiliary feedwater system valves were closed which should have been open. The principal reason why this condition existed was that TMI does not have an adequate system to inform the operator that a safety system has been deliberately disabled. To adequately protect the health and safety of the public, a system meeting the Regulatory Position of Regulatory Guide 1.47 or providing equivalent protection is required.

The TMI-2 accident demonstrated that safety systems necessary to protect the public can be completely disabled without the operator recognizing the condition. For example, two valves in the auxiliary feedwater syst6m which should have been open were closed. The effect was to completely disable the auxiliary feedwater system. No auxiliary feedwater could be pumped to either steam generator even though all three auxiliary feedwater pumps were running. This aggravated ,,

the accident at least to the extent that it distracted the

9-2 operator and added to the evident confusio.1 of the operators in their attempt to analyze the causes of the accident. Had the operators not discovered the closed valves for a longer period of time, the complete absence of feedwater could have resulted in significantly greater damage to the plant and harm to the public.

Another example of total loss of a safety system occurred shortly after the accident began. The two emergency diesel generators had automatically started in response to the engineered safeguards actuation signal. Since offsite electric power was available, the operator decided to shut down the diesel generators. This was accomplished by another person who manually shut down both diesel generators by tripping the fuel racks. In violation of operating procedures, the fuel racks were left in the tripped position. Failure to reset the fuel racks resulted in a condition that prevented either diesel generator from being started, either automatically or manually from the control room. The control room operator '

was unaware of this condition. It is indeed fortunate that a subsequent loss of offsite power did not occur. A loss Eight minutes into the accident, one of the operators dis-covered that the valves were closed and opened them.

9-3 of offsite power with both redundant diesc1 generators un-available would have resulted in a total loss of a-c power (with the insignificant exception of that derived from battery-powered inverters) to all TMI-3 sLfety systems.

The TMI-2 accident did not result in disclosing anything new or previously unknown with regard to the potential for disabling safety systems. The NRC, and the AEC before it, have approved the design of safety systems which require that the systems be deliberately rendered inoperable during routine operations such as periodic testing and maintenance.

The NRC also routinely approves the practice of deliberately disabling a safety system when the plant is in a condition-requiring the operability of that safety system to protect the public in the event of an accident. The conditions under which the NRC permits a system to be deliberately rendered inoperable are: 1) the redundant safety system is operable,

~

and 21 the inoperable system is restored to an operable status within a specified time (ranging from minutes to days for particular systems). This obviously violates or, as the Staff phrases it, "is a temporary rel.axation of" the Commission's single failure criterion. With one redundant system disabled, a single failure of the other system results in total loss of the safety function. In addition to being a violation of the Letter to "ALL POWER REACTOR LICENSEES" from Darrel G.-Eisenhut, Office of Nuclear Reactor Regulation, April 10, 1980. l l

l

9-4 single failure criterion, I believe this abould not be permitted because it is unnecessary. With a little forethought, skilled engineers could design many of the systems so that they could be .ested and. maintained without being rendered inoperable.

, For systems where this may be too difficult or too expensive, the plant could be shut down while performing the necessary testing and maintenance.

Nevertheless, the NRC approves designs knowing that safety systems will be deliberately rendered inoperable.

Consequently, in an attempt to prevent loss of both redundant parts of a safety system, NRC has adopted regulations requiring indication of the operability status of the plant's safety l systems. Section 4.13, " Indication of Bypasses," of IEEE 1

Std 279 requires that "If the protective action of some part of the system has been bypassed or deliberately rendered inoperative for any purpose, this fact shall be continuously indicated in the control room." This requirement is based on the presumption that if the operator is. aware that a safety -

system is inoperable, he will prevent any action that would disable the redundant backup safety system.

Prior to the development of Regulatory Guide 1.47, l

the Staff interpreted this requirement of IEEE Std 279 to be sat-isfied by the administrative procedures developed by Met Ed Incorporated in 10 CFR 50.55a.

9-5 and other licensees which were intended to prevent simultaneously disabling redundant safety systems. In addition, the NRC incorporated technical specifications into each operating license which define the plant conditions under which safety systems must be operable. The technical specifications also define the conditions that must be met for a safety system to be considered operable and limit the time the plant can remain in operation with a system inoperable. In spite of the precautions taken, errors continued to occur. These errors resulted in many instances of plant operation in violation of the technical specification requirements. Safety systems were inoperable but plant operators were unaware of it. In some instances, plants operated with both redundant safety systems inoperable. For example, in 1978, the Staff estimates

• that there were about 30 instances where operator error resulted in total loss of a safety function, i.e., all redundant systmes for a particular function such as core cooling or containment cooling were inoperative. Since this estimate was based on 'l l Licensee Event Reports, there may have been more instances which were not reported.

Nevertheless, the observation that operators disable ~l redundant safety systems at an alarmingly high rate is not new.

It was recognized in the early 1970's by the AEC Staff. The

• NUREG-0578, page A-62 l

_ )

v 9-6 response was the promulgation of Regulatory Guide 1.47,

" Bypassed and Inoperable Status Indication for Nuclear Power Plant Safety Systems," which was issued in May, 1973.

I was then a member of the Staff and had been assigned the responsibility of developing Regulatory Guide 1.47. My analysis of the events that had occurred in operating plants and that had caused the Staff to conclude that the Regulatory Guide was needed led me to one principal conclusicn. I con-cluded that the operators of nuclear power plants did not have sufficient knowledge of the plant's design to recognize the functional interdependence between plant systems or, less often between components of the same system. Since few events involved disabling two identical components in redundant safety systems, the operators' knowledge and the administrative procedures were apparently adequate to limit the number of such events. Of course, the closure of both AFW valves in the TMI-2 accident is an example of an exception to this.

However, the operators' knowledge, administrative procedures, ,

and technical specifications were not adequate to prevent l I

total loss of a safety function from less direct or less )

obvious causes. For example, when an auxiliary supporting system such as cooling water or electric power was disabled, ,

the operator frequently failed to recognize that the safety .

l systems served by that auxiliary supporting system were also effectively disabled. Therefore, instances occurred where

9-7 a component in one safety system was disabled and simulta-neously an essential auxiliary supporting system for the redundant safety system was disabled.- The operator failed to recognize that this resulted in total loss of the safety function provided by those safety systems. The TMI-2 example of disabling both diesel generators by not resetting the fuel racks is an example of disabling all redundant safety systems by disabling the same essential auxiliary supporting system for each redundant system.

My review of events leading to the development of Regulatory Guide 1.47 also* led me to the secondary conclusion that procedures alone could not prevent some of the common, silly operator errors that had occurred. For example, following the prescribed administrative procedures, permission would be given to disable a safety system or an auxiliary supporting system. The operator would then proceed with the approved disabling, but instead of disabling the approved system, its redundant counterpart was disabled by error. Sometimes, in a multi-unit plant, the system in the operating plant would be disabled rather than the system in the shutdown plant, as intended. Other operator errors involved failure to restore the system to its operable status after completion of the test ,,

or maintenance. With no effective indica *. ion of these condi-tions in the control room, the operator was unaware of the 1 i

status of the safety systems.

9-8 In my judgement, conformance with the provisions of

( Regulatory Guide 1.47 would provide an effective method of

promptly detecting the types of operator errors described j above and would significantly aid the operator in recognizing the effects of an inoperable component on the operability status of the plant's safety systems. The principal pro-visions of Regulatory Guide 1.47 are

1. Automatic Indication. The indication of inoperability is automatic for all routine operations that occur more frequently than once a year.

2. System Level Indication. The inoperable status information is displayed at the system level rather than, or in addition to, the component level. That is, the operator is 4

5 informed that a safety system is inoperable rather than, for example, that a valve is closed. This aids the operator in recognizing the effects of a disabled component on safety system operability.

3. Interdependence Determined Automatically. The operator's information emphasizes safety system status, thereby aiding in recognizing the func-tional interdependence of safety systems and their essential auxiliary supporting systems.

The indication that a safet system is inoperable will be automatically actuated if a component in its essential auxiliary supporting systems is disabled.

4. Supplements Procedures. The indication system does not eliminate the need for well-trained operators and rigorous administrative procedures.

Not all methods by which a safety system can be '

disabled provide an automatic input to the inoperable status indicators. Therefore, the

, operator's knowledge and administrative procedures remain as valuable and necessary contributors

9-9 to safety. In addition, an unexpected indica-tion of safety system inoperability could promptly disclose an operator error or an inadequacy in the administrative procedures.

Based on my evaluation of the events involving inoperative sLfety systems during the TMI-2 accident and my knowledge of the reasons for developing the provisions of Regulatory Guide 1.47, I conclude that TMI-l must meet the provisions of Regulatory Guide 1.47 or equivalent before restart. The present design of TMI-1 precludes a finding that the health and safety of the public will not be subject to undue risk.

I will now address the positions of Met Ed and the Staff on this subject. Met Ed has taken the position that the pre-accident procedures together with additional new administrative procedures at TMI-l provide a degree of orotection equivalent to conformance with Regulatory Guide 1.47. I have evaluated the information provided by Met Ed and conclude that the expanded procedures neither provide a degree of protection equivalent to Regulatory Guide 1.47 nor even represent a sign- ,

ificant improvement over the pre-accident procedures. The TMI-l procedures are incapable of promptly or reliably detecting the types of operator errors discussed above, provide no ,

assistance in recognizing the interdependence of safety and auxiliary supporting systems, and rely essentially on component level rather than system level information. As the Staff has

9-10 observed,* the many levels of regulation and review, the technical specifications, and the administrative procedures have been ineffective in preventing human errors that resulted in total loss of a safety function. The Staff specifically considered and rejected "more detailed review and inspection of procedures and licensee operations me ,agement" as a method of " improving operational reliability and eliminating human errors of the magnitude that yield a complete loss of safety function...." (NUREG-0578, page A-62). Met Ed ignores this and proposes more procedures.

In my opinion, the Staff's position on this issue is inconsistent and indefensible. In apparent recognition that it is unacceptable to allow a plant to operate with a total loss of a safety function, the Staff requires that it be shut down within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of "(i]dentification of a human or opera-1 tional error that prevents or could prevent the accomplishment of safety function. . . . ", a type of error the Staff terms

" intolerable." (NUREG-0578, page A-63) . While I agree that the Staff " Position" expressed on pages A-63 and A-64 of NUREG-0578 is necessary, it is clearly insufficient in that no part of the position would aid in promptly detecting or preventing the occurrence of the " intolerable" condition. In other words, See NUREG-0578, Section 2.2. 3 and pages A-60 to A-64.

9-11 while requiring shutdown upon loss of a safety function, the Staff tolerates a situation that is likely to prevent the operator from knowing when a safety function has been lost.

The Staff has long held the view that the purpose of the indication system required by Regulatory Guide 1.47 is "to enable the operator to determine the status of each safety system and determine whether continued reactor operation is permissible." (Branch Technical Position ICSB 21, Guidance for Application of Regulatory Guide 1.47," Appendix 7-A, Standard Review Plan.) Despite this longstanding Staff posi-tion, the Staff has stated that it is still reassessing whether Regulatory Guide 1.47 should be applied to TMI-1. I believe conformance with Regulatory Guide 1.47 would provide substantial additional protection to the public, would demonstrably , assist in detecting the conditions under which the Staff's shutdown requirement should be triggered and would aid Met Ed in prevent-ing the total loss of a safety function by promptly and reliably indicating loss of one redundant system. ,

Since, as I mentioned, the Staff has not yet determined '

whether Regulatory Guide 1.47 should be applied to TMI-l (3/31/80 Answer to UCS Interrogatory 91) , I cannot evaluate the basis that may be advanced for not doing so. However, I note that "the adequacy of the existing status monitoring system at TMI-1 and the matter of any necessary design and related procedural

+ eyan e A e mm m__ --*-.m - m es_ee- n.  % _ m m. _-.

9-12 changes are presently being reassessed by the Staff."

(3/31/80 Answer to UCS Interrogatory 83) . In such circum-stances, it would appear that the Staff is precluded from finding that TMI-l can be restarted without undue risk to the health and safety of the public.

In summary, the accident at TMI-2 reinforced existing evidence showing the need for a system to inform the plant operators when safety systems or their essential supporting systems have been dis'abled. NRC has recognized the significance of this problem in two ways. First, it has incorporated in its regulations a standard requiring automatic indication of the operability status of plant safety systems. (IEEE Std. 279,54.13, incorporated in 10 CFR 50.55a, and Regulatory Guide 1.47). The design of TMI-1 does not comply with these requirements. Second, NRC has required this plant to be shut down within 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> of identification of a loss of safety function. However, in failing to require compliance with Regulatory Guide 1.47 or to provide equivalent protection, the Staff sanctions a situation likely to prevent the operator from kncwing when a safety function has been lost. In my opinion, this poses an undue risk to public health and safety and TMI should not be permitted to resume operation unless and e6@ - ,% g y - ,,

9-13 until a reliable system has been implemented to inform the i

operators when a safety system or its essential auxiliary l supporting systems have been disabled.

i e h 1

I e*

l l l

\

l l

l l