ML20004C590

Proposed Findings of Fact & Conclusions of Law on Plant Design Issues.Recommended short-term & long-term Actions Do Not Provide Reasonable Assurance of Operation W/O Endangering Public.Certificate of Svc Encl

ML20004C590
Person / Time
Site:	Crane
Issue date:	06/01/1981
From:	Sholly S AFFILIATION NOT ASSIGNED
To:
References
NUDOCS 8106040303
Download: ML20004C590 (97)

Text

_

i A. 's?

SHOLLY, 6/1/81 h

,.C, '3'.,N[

O?.cw

'?,

/

UNITED STATES.OF AMERICA

/

NUCLEAR REGULATORY COMMISSION u.s.

v.

~

T

~. ' -

BEFORE THE ATOMIC SAFETY AND LICENSING BOA 3RD I :93,e j

j h ChW'j&

~

4, In the Matter of

)

' ) f.

~

METROPOLITAN EDISON COMPANY

)

-Docket No. 50-289

)

(RESTART)

(Three Mile. Island Nuclear

)

Station, Unit No. 1)

)

g%f19,)'

S

'+

INTERVELOR STEVEN C. SHOLLY Q, s q\\

g

'f

~

gM 1i PROPOSED FINDINGS OF FACT AND gy I 's

p CONCLUSIONS OF LAW

--l k A

,f# j

~ON PLANT DESIGN ISSUES

• T; e

'*1 ki'

'\\n O 3/

s

%w,.

O/

D' 1 Tune 1981 STEVEN C. SHOLLY Intervenor pro se EOS

\\

O 18106040dd G-

w e

j. -.

w x.

~

. TABLE-OF CONTENTS 4

~

I INTERVENOR STEVEN C.. SHOLLY PROPOSED FINDINGS OF.~ FACT AND CONCLUSIONS'OF LAW ON-PLANT DESIGN ISSUES I.,

' Integrated:Centrol System Failure:

. Modes'and Effects-Analysis..................

1:

w.

II..

Containment Isolation...................'..

49 a.

.III.

Plant-Computer........'....................

51-

IV.

-Humar Factors Engineering Review of Cont'.ol Room De sign......................... 6 3 s.

~V.

Conclus ion s o f Law........................

8 4 G

' O e

R J

\\

l:

4 i

)

..2....

..1

~;

~

. +.

~p:

A\\4 INTERVENOR STEVEN ~C.

SHOLLY PROPOSED-FINDINGS OF FACT:AND CONCLUSIONS.0F LAW ON PLANT DESIGN ISSUES I.-

SHOLLY CONTENTION 6-a (Integra'aed Control. System Failure: Modes and Effects Analysis)

.l.

The Integrated Control System (ICS) is a non'

e..

. safety-grade plant control system designed by; Babcock and Wilcox Company-(B&W) for'use in their pressurized-water nuclear plants (Tr. 7005, Joyner).- The basic function-of-the'ICS is t'o match generated megawatts with the megawatt-demand by coordinating the flow of steam to the turbine

.and controlling the rate of steam production in the-once-through steam generators (OTSG's) (Thatcher, ff. Tr.f7122, at~2).

2.

The ICS represents an evolution from control systesm that were used in the control of B&W-designed OTSG's in fossil-fueled power plants.

The ICS utilized on B&W-designed nuclear plants is very similar to the control

-system utilized in fossil-fueled plants which have OTSG's designed by B&W (Tr. 7021, Joyner).

3.

There are two models of the ICS installed in operating B&W nuclear p'lants.

The Model 721 ICS is installed at the three Oconee nuclear plants and at TMI-1, whereas i

other operating B&W plants utilize a Model 820 ICS.

The L

i

[*

s.

l two ICS models are similar from a functionalfstandpoint, and

~

share the same inputs (Tr. 6984, Joyner)..

The.Model 820 ICS is used at the newer'B&W plants, and has due to major hardware changes, demonstrated improved reliability when

~

compared with the Model 721 ICS.(Licensee Ex. 18,.at 5-8 and 5-9).-

4.

The TMI-2 accident-did.not' involve any ICS failures (Broughton, Sadauskas, & Joyner, ff.-Tr. 6949, at 2).

The TMI-2 accident did,'however, involve z. loss of main feedwater (Tr. 5999,-Lanese) which can-be caused by failure of the ICS involving, for example, failure-to the~" low" failure mode of Functional Module 27, Feedwater Pump Control (Licensee Ex. 18, at 4-60).

The TMI-2 accident-also-involvad a temporary loss of emergency feedwater (Capodanno, Lanese, & Torcivia, ff. Tr.~5642, at 6) which might al'so-be caused by ICS failure (Sholly Ex. 2, at 6).

5.

Shortly after the TMI-2 accident, the NRC Staff began a study of the sensitivity of the B&W reactor design to feedwater transients, and the role that this sensitivity might play as a precursor or contributor to a TMI-2 type accident.

As part of this study the Staff examined the sequence of events that accompanied typical B&W.feedwater transients and the role played in such transients by the plant control and safety systems (Ross

'& Capra, ff. Tr. 15,855, at 1-2).

i I

l.

L

g w

+ 1..

6 ~.. On April'25, 1979, based on the preliminary results of;the sensitivity study-and;in preparation for a Commission meeting on the. matter,:the NRC Staff prepared-a: report entitled, "NRR Status. Report on Feedwater Transients in B&W Plants."

_In'thel report, the Staff expressed five

. specific concerns'aboutithe role played by the ICS in feedwater transients in B&Wfplants:

(a) uncertainty about-the reliability of the ICS,-(b) the lack of a failure raodes

--and effects:cnalysis of-the ICS, (c) operating data which indicated' that - the ICS might initiate 10-15% of all' feedwater-transients in B&W-plants, (d) the possible contribution of the ICS to a total loss of feedwater through ICS control'of emergency feedwater, and (e) concern that even when the ICS works well, there may be, in response to a feedwater transient, wide swings in reactor pressure, pressurizer level, and average reactor coolant temperature (Ross & Capra, ff. Tr. 15,855, at 2).

7.

As a result of meetings between the Staff and B&W following the April 25, 1979 Commission meeting, B&W committed to perform-a reliability analysis of the ICS, including a failure modes and eff2 cts analysis (FMEA),

Formal submission of the scope of the reliability analysis and a schedule for its completion came in a letter from B&W to the NRC Staff dated April 28, 1979 (Ross & Capra, ff. Tr. 15,855, at 3).

8.

-According to the April 28, 1979 letter, the l

I l

v-t 4

4

,,,1

,.4.

reliability. analysis torbetperformed by B&W would[ concentrate on ICS failure modes that could affect the main feedwater.

~

system,7the emergency feedwater (EFW) system,' pressurizer

. level, Land reactor coolant system pressure (Sholly;Ex. 2,-

1

at:30).-

!9... Subsequent toithe. commitment by.B&W'to perform the reliability analysis on the ICS, confirmatory orders 1

.. issued.by.NRC to B&W' plants.other_than TMI-1 incorporated.

the requirement to perform an FMEA on the ICS as soon as practicable.

The FMEA requirement also'became. incorporated in the'later-Commission order on the restart of TMI-l'(Ross

& Capra, ff. Tr. 15,855, at 3).

10. ;During the same time frame in which the confirmatory orders were sent' to B&W licensees, the Staff released the final version of the study into the sensitivity of B&W reactors to feedwater transients (NUREG-0560, " Staff 4

Report on the Generic. Assessment of Feedwater Transients in Pressurized Water Reactors Designed by Babcock & Wilcox Company," May 1979)

(Ross & Capra, ff. Tr. 15,855, at 2),

11.

In NUREG-0560, the NRC Staff made recommendations for, additional analyses related to plant control systema, including:

(a) the role of control. systems and their

' significance to safety,- (b) the rate at which transients initiated by control systems challenge plant safety systems, r

the rate at which transients initiated outside the control (c)

' systems are not successfully mitigated by the control systems, l

' e L

_4_

+-

3 an'd (d) analyses toEidentify realistic plant interactions

.resulting from failures _in.non-safety systems, safety systems,.

~

and operator. actions -(Sholly.Ex. -2,- at 2).

12.

On August 17,-1979; B&W submitted'its reliability analysis of the ICS'to the^NRC Staff, BAW-1564, Integrated Control System' Reliability-Analysis." (Sholly Ex.

2, at.27)..

The Licensee, by letter dated October 26, 1979. referenced BAW-1564 as applicable to TMI-l and adopted ~BAW-1564 as-its

. response to the Commission's August-9, 1979 Order item on

>the ICS (NRC Staff Ex. 1, at 1D-1).

13.

The Staff undertook an evaluation of BAW-1564 and determined.that', due to the nature of'the Commission's confirmatory orders on B&W licensees and due to manpower limitations within the NRC Staff, it was necessary to obtain outside assistance to assist'the Staff in its review of

-BAW-1564.

The Staff had previously used Oak Ridge Nat'ional Laboratory (ORNL) to review the ICS and,-therefore, ORNL already had a certain amount of expertise on the system (Tr.-7257-58, Thatcher).

The Staff testified that they have used ORNL extensively as consultants.for a number of' years, and that the Staff vieta ORNL as an " extension" of the NRC Staff's instrumentation and control expertise (Tr.

C 15,869, Ross).

14.

Through an interagency agreement with the-

'U.S. Department of Energy, the NRC Staff sponsored a review of BAW-1564 by the Instrumentation and Controls Division _

= w-

,.e w-e -

-e.

we er T'

r 7

4 w

v:

qq

.4f ORNL : subsequently subcontracted' part of.the work of ORNL.~

.9 of' reviewing-BAN-1564ito. Science-Applications, Inc. (SAI)

(Sholly Ex. f 2, at cover letter and 1).

15..After.a preliminary review of BAW-1564,-ORNL submitted a' number of questions to B&W through the'NRC Staff

- (Sholly"Ex. 2, ~ at 20; Sholly; Ex. 1, at Enclosure 1). - At

. ORNL's suggestion, a' meeting.was held on' October-23,_1979

-.at.B&W's.Lynchburg,: Virginia, facilities to discuss ORNL's questions on.the ICS and BAW-1564. -The' meeting: included

representation fromLORNL, SAI, NRC, B&W, and three B&W licensees?(Duke Power, Consumers Power, and Toledo Edison)

(Sholly Ex..:1,.at 1 and Enclosure 2).

16.

In a letter t'o the Licensee dated November 7,.

1979 the NRC' Staff ~ requested the Licensee' to evaluate the recommendations made by B&W in BAW-1564 and report to the

~

Staff on followup actions taken by Licensee-in response to

.these recommendations -(Thatcher, ff. Tr. 7122, at 6).

17. :

A' draft of ORNL's review of BAW-1564 was submitted to.the NRC Staff on December 4, 1979 (Sholly Ex.

2, at cover letter).

The NRC Staff reviewed the draft and i

submitted comments to ORNL (Tr. 7260-61, Thatcher).

The final ORNL' review report was transmitted to the NRC Staff L

on January 21, 1980 (Sholly Ex. 2, at 2).

18..As would be noted by ORNL, the evaluation of 4

I the'ICStis aLprincipal requirement in the evaluation of potential or real abnormal events in B&W plants because of,

i

.mm.,._,pa emmw w __

4., _...,,.

4 m,..

_,__.,...-.,,,....y,,,,,

-,. _ ~,.,,,-,..,,- _.,.-,_,

• r s

=..

)

(Sholly Ex. 2, the influence of the ICS on the-course of events

.The.ICS participates so.directly in the coordination at 4-5).

of the generation, transport,.and removal of heat 'from the primary system that the ICS influences the-behavior of the

~

whole' plant (Sholly Ex. 2, at 7).

There is a tight. coupling between the secondary 19. -

system of the; plant (which is controlled by the ICS) and the

' primary system (which includes the reactor and the primary coolant system)

.(Sholly Ex. 2, at 16).

The NRC Staff has expressed'this tight coupling as a greater sensitivity te feedwater' transients (Tr. 15,770, Ross).

The Staff has found that among the factors.which contribute to th',s greater

~

sensitivity are the design of the OTSG's and the reliance-(10 on-the ICS to automatically regulate feedwater flow N.R.C. 141, at 142-143, 1979).

20.

As a result of such factors, the Staff has concluded that the B&W design places more reliance than other pressurized-water reactor designs on the reliability and perforr nce characteristics of the Emergency'Feedwater and the Emergency Core Cooling System (ECCS),

System, the ICS, and that this, in turn, places a large burden on the plant operators to respond in the event of off-normal system behavior during transient conditions (10 N.R.C.

141, at 143, 1979).

21.

By virtue of its design, the ICS can participate.

in major plant events, including loss of main.feedwater,

' steam generator overfill,. secondary depressurization through i

l

i

~

z and, possibly, turbine bypass:or atmospheric dump valves, combinations of these events due to instrument failures (Sholly'Ex. 2, at 8).

)

The task of evaluating'the ICS is complicated

'22.

(a) the by.several engineering considerations, including:

complexity of the ICS due to its " feed-forward" approach (b) ~ t'he to control as augmented by feedback fine-tuning, complexity of the plant response-to control actions, and the sensitivity of the plant to. secondary system (c) perturbations- (Sholly Ex. 2, at 4-5).

Another factor complicating the analysis of 23.

The Staff testified that the ICS'is a lack of information.

unless there is an unusual event which requires detailed there is.not a significant amount analysis and followup, of information upon which to base conclusions about the cause of a particular event-(Tr. 15,771-72, Capra).

For example, the Rancho Seco event which occurred on March 20, 1978, is believed to represent the most severe and prolonged in which the overcooling transient experienced to date, Technical Specification cooldown limits were exceeded That event involved a power by a factor of approximately 3.

(NNI) and the ICS fault to the non-nuclear instrumentation which affected the response of nearly 2/3 of the NNI/ICS equipment and led to confusion on the part of the operators due to lack of information about the status of feedwater delivery-to the OTSG's (UCS Ex. 35, Reference 1, at 2-4).

the NRC Staff had been unable to As of October 29, 1980,.

• mp 4*

4 N6-p6=

9Gre --

• m+-

~

m

7..

'4 m ;:e a t.

- determine whether the turbine' bypass and/or atmospheric were opened to the 50% open-position (UCS Ex.135, dumpivalvesc LSuch!informationJis,important since' Reference'1,~at 5).

the presence.of~open-turbine bypass orl atmospheric relief-

~

valves can; increase the severity of overcooling events (UCS: Ex. 35,. Reference 1, at-4).

.The.ICS is a non'-safety grade plant control

~

24.

B&W doas not. perform' design

~

system' (Tr.f.7005, Joyner)..

~ basis' event testing on the ICS'(such as seismic qualification

~ testing).. The. ICS was not designed to meet. physical separation Oriteria nor was it designed-to meet electrical isolation criteria (such as Regulatory Guide 1.75), nor ldoes the ICS: meet.the single-failure criterion (Licensee

'Ex. 18,Jatt4-2).

25..

B&W groups the' control circuitry *of.the ICS.

into.four major functional groups:

(a) the Turbine Control block represents the control ftv, cions that manipulate the atmospheric dump' valves, the condenser dump valves, and I

the turbine throttle valves; (b) the Steam Generator Control block, which represents the control functions that control the flow of feedwater to the OTSG's; '(c) the Reactor Control block, which represents the control functions which control p-the regulating ~ control rod drive system that causes insertion and

'or withdrawal of control rods from the reactor core;

-(d)'the Integrated Master Control block which coordinates

orf ntegrates the operation of the other three blocks i

i,

t l

i" ap -

k

(Tr. -6951, 6955, and 6957, Joyner).

26.

In addition, there is the Unit. Load Demand control which!" interfaces" with the operator to ensureLthat-the ICS does not allow the plant to operate'outside of the_ desired envelope.

For; example, the plant operator inputs the-desired megawatt electric-requirements to the. Unit Load Demand control and'that control interacts with the Integrated Master Control to adjust plant functions to produce the. desired' electrical The Unit Load Demand control limits operation of output.

the plant based on operating restrictions, such as operation with only three reactor 1 coolant pumps, in which case plant power output is restricted to 75% of full. power. ~ The control' also restricts power. output based on other restrictions such as only one' main feedwater pump and asymmetric rod position limits (Tr. 6958-59, Joyner).

27.

For the purposes of the failure modes and effecto analysis (FMEA), B&W defined the ICS as that equipment, excluding power supplies, contained within the ICS cabinets (Licensee Ex. 18, at 1-1).

The NRC Staff concurred-with B&W's definition of the ICS, but testified that ORNL (the Staff's consultants in reviewing BAW-1564) disagreed with B&W's definition of the ICS- (Tr. 7126, Thatcher).

28.

ORNL took the position that the ICS should be more broadly defined, s'tating (Sholly Ex.

2, at 6): _

m"O w=ga I

+moe-e ew.

% see e.no

-e a p a#

• • b -

'f

"A control. system, particularly one claimed as ' integrated,' should include 4

sensing, signal conditioning, and 1

actuating equipmentfand perhaps power.

-supplies--if.not primary power sources.

The system being controlled' includes a number of process loops that are-highly interactive and which must often

. operate'within rather narrow individual constraints."

29.

The B&W analysis of the.ICS (BAW-1564)~

considered failure modes caused.by single failures.of ICS inputs, ICS outputs, and functional blocks of the ICS.

These failures were considered in their failed state-one at a time (Licensee Ex. 18, 4-1).

30.

The Board found that the framework within which-ICS failures are viewed is greatly influenced.by 4

the definition of just what constitutes a failure.

NRC Staff witnesses focused only on.ICS-ralated failures that occurred within the ICS cabinets, noting that only 6 such failures out of the 162 studied led to reactor trips, and that these 6 trips were the only trips out of the 310 studied which were caused by ICS failures (Thatcher, ff. Tr. 7122, at 6; Ross & Capra, ff. Tr.

15,855, at 5-6).

31.

The description of the ICS boundary appears to have greatly influenced the definition of ICS failure.

The position of the Staff's consultants at ORNL on what constitutes the boundary of-the ICS led these consultants to question the definition of a " failure," noting for _,

r example that instrument drift not normally associated with id d

a' failure might be: sufficient-to initiate an ICS-n uce transient'.(Sholly-Ex. 2, at 5).

This may be sigraficant since 71 of the 162 instances of ICS ' involvement in trips were-due'to; calibration problems (Licensee Ex. 18, Table' 5-8, at 5-14).

32.

A review of the tabulated data on B&W reactor tirps presenting in the operating history section of BAW-1564 (Section 5) reveals that the ICS has been involved in reactor trips-in1several ways.

Direct failures of'ICS

' internal components have caused five reactor trips (Tr. 7122, Thatcher).

The Staff has repeatedly relied on this statistic (Tr. 7122, Thatcher; Ross & Capra, ff. Tr.-15,855, However,. Licensee's witness Joyner, who co-authored at 4).

i

'BAW-1564 (Tr. 6950, Joyner), testified that although.BAW-1564 lists only 6 trips out of the 310 studied as being caused by ICS failures, in reality this number could be as high as 20'(Tr. 7083-84, Joyner).

33.

Power supply failures in non-nuclear instrumen-tation (NNI) and the ICS have been found by B&W to be

. vulnerable to single failures and human errors (Licensee Ex.

18, at 2-2).

Power supply failures to the ICS have caused 11 reactor trips out of the 310 studied by B&W in BAW-1564.

l and do not These'11 trips include only electrical failures, include human actions which caused an additional 6 trips l

involving loss of power to the ICS (Licensee Ex. 18, Table 5-1 at.5-ll, Table 5-3 at 5-12, and at 5-5).

12-t

+

O,

.y

,m,y 9-h emg -

&n g

p i-r; megp ee.

ge w,,ya

+,

gw-m W*

h-T4A

,J

' $ s' j

L34.

Power supply failures to NNI/ICS have led not only to reactor trips, but.to overcooling incidents as well.

- L (Licensee Ex. 18, at 2-2).

Power supply failures can be important since suchL ailures within the NNI can' affect the f

performance of.-the ICS and other key systems simultaneously (Sholly Ex.'2,~at 7)..An example of such an event is the

. Rancho.Seco transient'of March. 20, 1978 in.which adequate

. control room readout'of steam generator conditions.and

~

Lthe primary system was' lost for over an hour.

Such a

~

" common cause" failure likef loss of power can not only initiate the transient, but " blind" the operator due to instrument-failure (UCS Ex. 35, Reference 3, at 4).

35;.The' accident at Crystal River Unit 3 in February 90 'is also an example of the conccquences of NNI/ICS power failure, in which such a power failure (lasting 21 minutes) caused the opening of the PORV, rendered informat. ion inputs to the-ICS false, caused partial withdrawal of the control rods from the reactor core, caused the pressurizer spray valve to open, and caused a reduction in feedwater flow (Tr. 15,800, Ross).

36.

Significantly, the FMEA as performed by B&W

-could not highlight NNI/ICS power failures because of B&W's

-definition of the ICS boundary as excluding power supplies (Sholly Ex. 1, at 3).

The B&W Reactor Transient Response Task' Force recommended in NUREG-0667 that there'be a qualified Instrumentation and Control Technician on duty at B&W plants Lon all shifts as a result of NNI/ICS power problems, although.

wa-m 4 '-

?

W v

=

7 thefNRC's Division of Safety' Technology later. concluded that while<this is. advantageous to the utility,'the NRC should not make this a, requirement, based on'the installation of a safety-grade panel of vital instruments (NUREG-0737, item I.D.2) and-on the revision of procedures to incorporate i

emergency procedures for dealing with NNI/ICS power loss (to which Licensee. committed in a letter dated 5/29/80, TLL-245) (NRC Staff Ex. 9, at 1-2).

37.

Failures of ICS inputs other than power supply

'have caused reactor trips as well.

B&W found that 11 trips were caused by ICS input failures, five caused by loss of reactor coolant flow signals, three from loss of RCS

' temperature signals, two from loss of neutron fim: signals, and one from a loss of feedwater flow signals (Licensee EEx. 18, Table 5-3 at' 5-11).

38.

B&W also found that the ICS has a tendency to cause or participate in feedwater oscillations, causing an additional 11 trips (Licensee Ex.18, table 5-2 at 5-11).

In addition to causing ruactor trips, these feedwater

. oscillations have resulted in actuation of ES* and 1 css of main feedwater (Licensee Ex. 18, at 2-2).

39.

Concern about the role of the ICS in feedwater oscillations was one of the.five concerns which the NRC Staff raised in its April 25, 1979 " Status Report" on transients in B&W reactors, and was one of the-reasons for requiring the FMEA to be performed (Ross &-Capra, ff. Tr. 15,855, at'4).

Despite this prominent concern, ORNL's review of

~

. W e

w= m.=emmem.p -o e

w,

+w-m

- +

g-7

--.y m

+

= !.l:

cy..

'BAW-1564Lfound thatiB&W used-analysis methodology in BAW-1564.

~

that isLincapable of; evaluating the involvement of'the;ICS ORNLnoted two distinct regimes

.in feedwatar* oscillations.

of feedwater oa3Allations,.one-of which occurs during opers. tion' CRNL concluded at up'to 70%.of full' power.in some plants..

that the' ability of plant systems, including the ICS,"to withstand such perturbations'has not been determined,-and-that.it was not clear that the' effects ofJfeedwater osaillations had been included in the=" plant duty cycle" (Sholly Ex. 2, at-9).

'40. ' The control. response of the ICS has-led-to an additional 16 reactor trips.

Twelve of-these trips were feedvater/ power. mismatches and four were' caused caused bv by;causes primarily related to switching modes of control

^

of the.ICS from automatic to manual or vice versa (Licensee Ebc. 18, at 5-4, 'and Table 5-2 at 5-11).

-41.

Finally, operator error could have caused additional trips.

The Staff testified that although they-have looked.at the possibility ;f human-error-induced trips involving switching the ICS to manual mode, they could not specify how many such instances had occurred.

The 16 trips. listed in Table 5-5 of BAW-1564 as involving manual control error would, however,- be the bounding case for such1 trips (Tr. 15,885-86, Caprc, Licensee Ox. 18, Table 5-5 at 5-13).

The. Staff also-testified that scme of the 19

^42..

trips? listed'in Table'5-5'of BAW-1564.as involving operator-t..

M__

Mg e54 9,-'*8-#92" Wh m

M _

t error in misunderstanding an instruction or procedure could have involved. operator' actions.'in controlling tra ICS in mannal' (Tr. 15,885, Capra; Licensee. Ex. 18, Table 5-5 at 5-13).

43.

In evaluating operating experience involving ICS failures, thefevaluation.may be complicated by a lack

- of significant.information (Tr. 15,771"-72, Capra)..The

~

Board:has already noted.the information problems. associated

'with the' Ranch'o Seco transient on March 20, 1980.

Licensee.

witness Joyner, who co-authored BAW-1564,. testified that in

~

order ~to compile the information for the operating history section of the reliability-analysis'B&W sent two engineers to each B&W plant.to gather information anc talk to plant personnel (T. 6965, Joyner).

The schedule for the reliability c

analysis 'which was submitted to. the.NRC gave a period of 14 days to gather this information (Sholly Ex. 2, at 31),

although the. witness could not recall'how much time was actually spant in gathering the dataf(Tr. 6965, Joyner).

44.

According to BAW-1564, the data base.for-the operating history section of ' the reliability analysis included-reactor trip writeups, control room logs, Licensee Event Reportu T LER' s ), transient records (where available),

allowable operaring transient cycle - (A0TC) data (where available), and. records of maintenance and repair from the instrument shop _ records.

This data base was utilized to perform ' analyses of._ plant transient events and ICS hardware failures -(Licensee Ea.18, at 5-1). s 4

W.

• • em..-

' ene -..

• e = eese,-

r.

9 m

[e e 4,e t.e p#,

,..r.,

+

+.-.

r.-.

~.n

o failures Licensee witness Joyner testified that 45.

involving the ICS are very dependent on the time in core life at which the" failure occurs, the initial pcwer level at which the failure occurs, the response of the plant ope'rators to the failures, and other unspecified factors (Tr. 6967, Joyner).

Despite the extent of the dependency of failures 46.

on.these factors, the B&W analysis of the ICS failure modes and effects was limited with respect to each of the specified A basic assumption in the computer simulations factors.

used to evaluate the effects of ICS failures is that the reactor core was-at its midpoint in core life (Licensee Ex. 18, This is significant since such computer-simulation at 4-2).

was used in evaluating the effects of ICS failures on the tuclear steam system in 75% of all cases (Shally Ex.

2, at 22).

47.

Secondly, all analyses of the ICS by the NRC Staf f, the Licensee, and B&W dealt with normal full-power operation of the plant (Tr. 15,896, Capra).

BAW-1564 discussed a number-of conditions of off-normal operation such as which result in operation at reduced power levels, (resulting in the loss of one or two reactor coolant pumps power limitations of 75% and 45% of full power, respectively),

loss of a feedwater pump (limits power to 55%), asymmetric rod CRD runback fault conditions (limits power to 60%),

reductions in reactor coolant flow, and any hand / auto 4

selector station of the ICS in manual mode (Licensee Ex. 18, ORNL's evaluation. of BAW-1564 ' found~ that B&W failed at 4-5)..

~-

~

• ;e

.to address the consequences of single ICS failures.during fact

-off-normal conditions of plant operation, despite the-

-that such conditions of operation are allowable and their occurrence is not unaommon (Sholly Ex. 2, at 10-11).

48.

In response to a-question posed by ORNL on this matter, B&W asserted that it did not miss "any significant transients or protective system challenges" by not including off-normal initial conditions in their analysis..ORNL's review of BAW-1564 noted, however, that the operating history showed that the majority of events involved off-normal initial conditions and/or with some and functions'of the ICS in the manual or tracking mode, that this tended to deny B&W's assertion.

B&W noted that it had no data available for manual operating modes of the ICS (Sholly Ex. 2, at 21 and 23).

49.

Regarding the third factor upon which ICS failures are dependent, Licensee witness Joyner testified that B&W did not consider the effect of operator action on the events which were covered in the B&W study (Tr. 7086, Tabular data in BAW-1564 shows that nearly one-third Joyner).

of all the trips studied in BAW-1564 had causes.that were attributable to operator / technician action.

Half of these f

trips resulted from misunderstood instructions and procedures, 4

manual control errors, and valve.mispositioning (Licensee Ex. 18, at 5-11 through 5-13).

Regarding trips caused by valve mispositioning, B&W has stated that the ICS is not E

4

.v

--w r

+

e a

designed to deal with many abnormal situations such'as odd alignment of equipment (Sholly Ex.

2,- at 23).

the Board _ finds that 50.

Apart from these concerns,

~

the. ORNL/SAI review of BAW-1564 has identified a number of other weaknesses in the B&W reliability analysis.

ORNL found;that the B&W analysis in'BAW-1564 utilized a technique that-is not suited for analyzing multiple failure situations (Sholly Ex. 2,.at 8).

Since the ICS is not-safety-grade (Tr. 7041, Joyner; Tr. 5711, Lanese) and it does not meet-the single-failure criterion (Licensee Ex. 18,.at 4-2),-the Board can find no basis for assuming that multiple failures are not credible events with respect to the ICS.

In fact, ORNL-found that sincc there is insufficient evidence to the contrary, multiple-failure-induced transients may have a significant probability of occurrence (Sholly Ex. 2, at 8).

51, ORNL judged multiple failure events involving the ICS to be significant since single failures within the ICS can occur without being annunciated, and can go undetected by plant personnel until the failed component is called upon to function when a second component fails (Sholly Ex.

2, at 8).

B&W notes in BAW-1564 that very few failures within the ICS are self-annunciated to plant operators (Licensee Ex. 18, at'4-2).

52.

BAW-1564 points out, and Licensee witness Joyner confirmed, that the only failures considered in the FllEA were single failures of ICS inputs, ICS outputs, and ICS functional blocks, failed one at a time.

No combinations )

.. _~

'of these failures nor any.other type of failure were considered

~

Lin the.FMEA~(Licensee Ex. 18, at'4-1; Tr. 6964, Joyner).

53.

Specifically, the B&W analysis failed 6 o t

consider mid-scale ~~ failures, undetected ~ failures, and multiple failures due'to common causes (Sholly Ex. 2, at 8).

o Whereas B&W explicitly assumed that "high-scale" or " low-

)

sscale"' failures represented the worst: case.(Tr. 6965, Joyner,

the'NRC Staff testified that at least in some cases, mid-scale

. failures might~be worse than.high-or low-scale failures (Tr. 15 896,[Capra)....ORNL could find no specific evidence.

to support'B&W's position on mid-scale failures and, to the

. contrary, pointed out that operating experience confirms that-

~

mid-scale' failures are highly credible events (at least for-

' cases 1 involving multiple input s'ignal failures)

(Shoily Ex.

2, latv21).

ORNL pointed to the' Rancho Seco event on March 20, L1978 (the so-called'" light bulb. incident") as an example of such a failure (Sholly Ex.

2, at 21).

An NRC Staff review of overcooling transients in B&W plants noted in particular that the turbine bypass-and atmospheric dump valves at Rancho Seco are designed to fail to the 50% position on loss of ICS power (UCS Ex. 35, Reference 1, at 5).

54.

ORNL concluded that mid-scale failures of

. inputs to the'ICS are of particular concern because there may be a simultaneous adverse impact on the ICS and other key systems, and because such failures may remain undetected and thus contribute to multiple component failure events

'(Sholly Ex.

2, at 8). --

'w'

~

l M

55.

The NRC' Staff confirmed that it had not analyzed even the ICS cabinets for possible multiple failures-(Tr. 15, 394, Capra), with the possibic exception of so-called " cascaded failures" (Tr. 7235, Thatcher).

The' Staff could point to no study, report, or_ analysis which was concerned with multiple failures in the ICS

~

and their. potential impact on the plant (Tr. 7240, Thatcher).

56.

Multiple failure events involving the IC.?

have been ident'ified, however.

Licensee witness Joyner testified that if multiple failures are assumed, the ICS can cause emergency feedwater valves in both OTSG's to go to the full open or full close position (Tr. 7039-40, Joyner).

Another Licensee witness noted that if the pressure in a steam generator drops kelow 600 pounds, the steam line rupture detection system will isolate that steam generator (this event is within the design basis of TMI-1).

Assuming a subsequent failure after the isolation of the steam generator, a single ICS failure could cause a total loss of feedwater (Tr. 5730-31, Lanese).

57.

A second weakness noted by ORNL in its review of BAW-1564 is B&W's use of the functional block approach in analyzing failures internal to the ICS cabinets.

B&W expressed the view that very few observations made by B&W as a result,of utilizing the functional block approach would be in error, but ORNL noted that an example of incorrect or 1

incomplete conclusions arising from this approach is that failure considerations involving turbine bypass valve control.

m y

4-lly do not~ include details of whether condenser cooling is actua

~ l h

cvailable, and whether the control will be transfer';ed to t e Also r.ot included condenser dump or.to the atmospheric dump.

i

' f operator actions

'in.such situations was any considerat on o (Sholly Ex. 2, at 20).

Although ORNL agreed with B&W that functions 58.

d out that can fail because of equipment failures, ORNL pointe, h

it is not clear that in using the functional block approac that there are (as opposed to the equipment block approach)

An example-no undisclosed couplings or interactions of blocks.

l blocks of comraon. elements that may involve nultiple functiona i

is the arrangement of power supplies and their protect ve

~

within the ICS (Sholly features (such as fuses and breakers)

Ex.

2, at 6).

The third weakness.in the B&W analysis relates 59.

ponse to the computer model used by B&W to simulate plant res

~~L.

The hybrid computer model upon which the

~

to ICS failures.

d on computer simulations of ICS failures were run is base (Sacramento Municipal the ICS at the Rancho Seco nuclear plant It (Licensee 2x. 18, at 4-1).

Utility District, or SMUD) h as should be noted that Ranch Seco has a Model 820 ICS, w ere (Tr. 6986, Joyner; Sholly Ex.

2, TMI-l has a Model 721 ICS at 23).

POWER TRAIN IV The computer model used by B&W, 60.

models the ICS (which is an analog system) as a

-(PT-IV)

As a result, the digital system based on functional blocks.

RNL (using the same weakness in general approach cited by O.

e e e tone.

.D

.g,

}

+

funct'ional block' approach.rather than the equipment block approach).was carried through into the B&W: computer simulation model as well.

The' computer model was used to determine.the effect on the plant of ICS failures (Sholly Ex. 2, at 12 and 22).

There are.other problems with the computer 61.

simulation aa well.

There are limitations inherent in.the PT-IV programming, including limitations on primary system pressure (limited to 1500-3000 psi), secondary system

-pressure (500-1500 psi), primary and secondary system

~

temperatures.(400-700 degrees F.), and limits on feedwater temperature (350-700 degrees r.)

(Sholly Ex.

1, a t 4 ).

62.

Further, a single feedwater valve is used to represent all feedwater valves.

In general,, there_is not much detail of the feedwater system.

A more complete'model o'f the feedwater system would include pump drains, flash tank The levels and condensate pumps as well as main feed pumps.

condensate pumps have suction pressure trips that sometimes actuate when the interceptor valves close; this is not modelled in the PT-IV simulation either (Sholly Ex. 1, at 5).

63.

The Board also notes B&W's admission that the PT-IV. computer model is not valid at low power (Sholly Ex. 2, at 22).

The lack of detail in the feedwater system in B&W's computer model, which.B&W used to determine the effects on the plant of'TCS failures, is very disturbing to the Board.

since the response of B&W reactors to feedwater transients

'is-the main reason why the ICS was studied in the first l..

4 C

' ~

m

j g.

(10 N.R.C 141, at 14 2, 197 9).

~

place Another weakness in the B&W study of the ICS 64.

sider-

'which was identified'b'y ORNL is the failure of B&W to con ORNL concluded that interactions control. systems' interaction.

and controlled' imong control systems (including human operators)

~

i fic cquipment may result in a transient even-thoughino speci ORNL found that.it In fact, equipment failure has occurred.

ditions or would not be impossible for peculiar operating con t

cquipment interactions to, place the ICS at such a disadvan age

~

desirable that it would respond,'although as designed,-in.an un 1

the ICS is not designed to deal According to B&W, manner.

f ipment with many abnormal situations such as odd alignment o equ (Sholly Ex. 2, at 7 and-23).

The issue of control systems interaction with 65.

having been recently controlled equipment is important, issue" classified by the NRC Staff as an "unresolvci safety

+-

(Tr. 15,765, Ross).

ORNL also-found that BAW-1564 failed to respond 66.

in a meaningful way to concerns about the ICS and the rate d to at which protective features are called upon to respon failed to address ORNL found that BAW-1564 transients.

d in a credible whether the ICS can cause the plant to malfd erion I

handle tha problem.

way so that the protective systems cannot l

carried consideration of a particular event B&W seldom-ORNL concluded if the trip occurred.

beyond reactor. trip, i gfully l:

that neither of these two concerns can be answered mean n j,

a.em e,g e.

o.

o w manma m - =

• .-J

~

j by consideration'of:only a relatively small portion 1of'the

. 1

-entire control' structure, such as the,ICS was. defined in-BAW-1564 (Sholly, Ex. 2, at 6-7).

67.

BAW-1564 also failed in many~ cases to pursue the effect of operator posttrip actions,- and failed to pursue-the'posttrip operation of the ICS, even though_the ICS controls. equipment that is important in posttrip situations.

For example, ORNL ' suspects that some failure modes of the -

ICS could initiate a loss of feedwater event and then inhibit emergency feedwater flow via the flow control valves, but

.the limitations _placed by B&W on consideration of posttrip actions of operators and posttrip actions by the ICS eliminated consideration of such sequences (Sholly Ex.

2, at 6).

68.

Operator posttrip action may be a significant factor in determining the severity of feedwater transients.

The Rancho Seco event of March 20, 1978'was classified as Y

the most severe and prolonged overcooling transient experienced to date and was initiated by a loss of NNI/ICS power (UCS Ex. 35, Reference 1, at 4-5).

That event could have been made worse through human inaction, such as failure to partly secure emergency feedwater or prolonged inattention to OTSG heat removal (UCS Ex. 35, Reference 1, at 6).

Human error probabilities in such situations may be high; a preliminary

assessment of overcooling transients in B&W reactors performed by the Acting Chief of the Reliability and Risk Assessment Branch of the NRC's Division of-Safety Technology postulates a human error probability, assuming that the operator is c L a-

+.

already trained to stay.within pressure-temperature limits and mai'ntain' adequate primary system subcooling, of 0 6 for a situation in which'ine.dequate--instrumentation to monitor transients-is unavailable due to NNI/ICS power failure-

~

and'there is over 30 minutes to respond to the event (UL9 Ex. 35, Reference 3, at 6-7).

The assessment noted.that there may:be an uncertainty in the estimated human error-probability ~of a factor of 2 to 10 (UCS Ex. 35, Reference 3,

at 7).

69.

Another possible'reakness in BAW-1564 is the description of the effects of failures provided by B&W.

ORNL apparently did not delve deeply into this problem, but they did-cite an important. example.

According to B&J, they used a combination of compu,ter simulation on. POWER TRAIN IV and engineering evaluation of the ICS and the primary system response to determine "the. worst credible NSS effect" of e=

ICS failures -(Licensee Ex.18, at 4-21).

The example cited by ORNL relates to the effects of steam generator overfill

. occasioned by an ICS failure.

B&W described the consequences of the event as ".

. overcooling of the primary, and possible loss of pressurizer inventory and/or level indication."

(Licensee Ex. la, at 4-33 as cited in Sholly Ex.

2, at 11).

ORNL cited another description of the same event which appeared in an~NRC meeting summary prepared by Staff witness Capra (Sholly Ex. 2, at 12)

l w

s n

w-1 r

= :. -

"The resultant carry-over of-liquid into the main steam lines.could_ lead to equipment _

damage toLboth the main turbine and any auxiliary turbines (i.e., AFW pump turbines) being supplied steam from the main steam system.

In addition,.the carry-over_could lead to excessive waterhammer.

It is also possible that~the weight of the water in the steam lines could cause excessive stresses on tha piping system and pipe :tupports."

1

- While taking.no position on the appropriatenesslof either description, ORNL notes that the latter description places "a greater emphasis on the potential need for remedial action" (Sholly_Ex. 2, at 12).

70.

Overcooling transients are of particular concern to thisLBoard since the Licensee has testified that TMI-l is sensitive to overcooling transients'and that

- the ICS is.usually a contributor to such events (Tr. 5881, 5888, Lanese).

In this regard, the Board notes the recent Board Notification on the subject of pressurized thermal shock to PWR reactor vessels (BN-81-06, UCS Ex. 35, cover letter at 1).

The Staff presented a witness near the end of che proceedings to address this issue, but the witness's ability to respond to cross-examination on the matter was limited, and the Board noted its displeasure

- with the qualit,v of the record which was created on this issue.

Despite this, neither the Staff nor the Licensee proposed any remedy for-clarifying the record on a matter of some significant importance.

71.

In summary, the issue is as follows.

Severe.

4 49+we

+

+

e s

~

~_

a r

l overcooling. events can be followed by repressurization, resulting in-a;relatively highlprimary system pressure

-(1500-2100_psig) while primaryLsystem temperature decreases significantly-(down to the.280 degrees F. range).

Such events'can be caused by instrumentation and' control i

system malfunctions-(such'as-loss of power to ICS/NNI),

and postulated' accidents such as-small-break LOCA's, main steamline breaks,.and.feedwater pipe breaks.

Rapid cooling of.the reactor vessel internal surface causes a temperature distribution acorss the RV wall, resulting in a thermal stress.- This thermal stress combines with the " hoop stress" caused by the internal pressure in the RV.

As long as the fracture resistance of the RV remains high, such events will not cause. failure of the reactor vessel.

Neutron irradiation during plant operation reduces the fracture toughness of the vessel.

Once reduced sufficiently, severe i-thermal. transients can cause fairly small cracks near the inner surface.

If these cracks propogate, reactor vessel failure can occur.

The reactor vessels which are of concern are those with a history of high radiation. exposure and which are made of material that has a~high sensitivity to radiation damage (such as those made with high copper content welds).

For failure to occur, a ' number of contributing factors must be present:

(a) a reactor vessel flaw of sufficient size to propogate, (b) high copper content welds, (c) relatively high level of irradiation, (d) a severe overcooling transient with repressurization, and (e) a resulting crack of such

. Y t

^

\\

-4 e

.o size and location that the ability of the RV to maintain

< core cooling is affected (UCS Ex. 35, Attachment to 4/28/81 memo from.Eisenhut to Denton-and Case, at 1-2).

~

72.

The Staff has concluded,. based on a preliminary evaluation, that'the probability of.an overcooling transient similar to or greater.in magnitude'than the March 20, 1978

-3 Rancho Seco event-is'about 10 per reactor year for B&W-

' designed plants (the' Rancho Seco trans'ient represents the most severe overcooling transient' experienced by any PWR in the U.S.).

The safety concern associated with such an overcooling transient (i.e., L the probability of vessel failure following pressurized thermal shock) increases with neutron irradiation time (UCS Ex. 35, cover memo, BN-81-06, at 2).

73.. The Staff concludes that even if another. Rancho Seco-type event occurs at a B&W facility over the nex't "few years" that RV failure would be "unlikely."

honthel'ess, h

the Staff could not rule out the possibility that vessel failure could occur as a result of an overcooling transient (UCS Ex. 35, 4/28/81 memo from Eisenhut to Denton and Case, at 2).

Regarding the Rancho Seco transient, the Staff has concluded,-based on an evaluation by ORNL, that if the

~

Rancho Seco event had occurred after ten effective full power years (EFPY's) of neutron irradiation (more than twice its current level), "the probability of failure of the Rancho Seco vessel would have been very high" (UCS Ex. 36, at 2).

74.

One of the factors which governs the probability

.of vessel. failure following pressurized thermal shock is the.

.m m

t-

), -

9 e

e

b e

-s'..

copper content of the welds on the reactor vessel (UCS Ex..'35,.

q 1

BN-81-06, cover. letter, at 1). -The Board notes the testimony j

.of' Staff witness.Klecker that Rancho Seco's RV has welds with~a copper conten't of.0.234, while TMI-l's welds have an

~even higher. copper content of 0.31% (Tr. 21,4 45, Klecker).

Staff witness Klecker characterized.the TMI-1 weld copper content as being'"in the high range" (Tr. 21,427, Klecker).

75.-

Another~ factor which governs'the probability of vessel failure following a pressurized thermal shock is

~

the degree fo neutron irradiation of the vessel.

Witness Klecker testified'that'in general for-B&W' reactors this concern-becomes effective at about 10 EFPY's.

TMI-l has accumtlated 3.45 EFPY's of neutron irradiation- (Tr. 21,447, Klecker).

There is disagreement within the' Staff,-however, on'when the' concern becomes effective.

One reactor safety engineer 'on the NRC has stated, in a letter to Congressman 9

Morris K. Udall (dated 4/10/81), that in his view the level ~

of neutron' irradiation which represents a " dangerous level" with regards to possible vessel fracture following a pressurized thermal transient is "probably as low as 4 EFPY of opertion with vessels with high copper alloy wells or welds" (UCS Ex. 35, Reference 5, at 1).

This same engineer (Demetrios L. Dasdekas)'- also states in the same letter that the Rancho Seco transientL of March 20, 1978 is not as severe as can be

. expected on-a " reasonable worst case basis", and that there has'been discovered a discrepancy between'-the estimated versus the measured values of neutron fluence for the' Maine:

espweeman f

+

en ' ese

-4

• e -e-me=

a+

+

y

..m.w--

y r-

, v.

L.f, -

3 indicates-a generic Yankee reactor vessel which',-lin his view, L

~

Mr. Basdekas proposed that problem that "makes things worse."

all PWR's with:high copper content welds which have operated for 4 EFPY.be shut down until the issue is resolved (UCS Ex.

35,' Reference 5,-at 1-2).

~~

Regarding another factor which determines the 76.

probability of reactor vessel failure following pressurized

! thermal shock, the presence of a reactor vessel flaw _of.

sufficiett size to propogate, Staff witness testified'that-

~

ht Ethe Staff does not have sufficient statistics to tell w a -

the'probab'ility.is~for a small crack existing.in the reactor vessel ~fTr. 21,447, Klecker).

The Staff witness could not specify at what.

77.

level of-neutron irradiation between'TMI-l's carrent level of.3.45 EFPY and the generic level of concern at 10 EFPY the level of concern about reactor vessel failure following

.=

pressurized thermal ~ shock increases, other than to state-that l-the effect_is highly-nonlinear and that it would take vessel'

~

specific calculations to determine the precise number for TMI-l (Tr. 21,453-54, Klecker).

The Board is not at all satisfied with the

~

78.

Reactor vessel failure state of the record on this matter.It is widely known, and the is.an extremely serious matter.-

that reactor Board herein~ takes official notice of the fact,

-vessel failure is'beyond'the design basis of any currently The Board notes that licensed commercial nuclear reactor.

severe overcooling transients (as defined by the Staff,.,

x

~ ~ *

-nu-

9

s~..

Y an. overcooling transient which causes the cooldown rate of 100 degrees F./ hour to be' exceeded) are not limited to

-high power operation.

Indeed, there are several events described-by the Staff which have occurred at relatively

' low power levels:

(a) the Rancho Seco event. reported on 10/8/79 which was initiated at about 15ts power, (b) the

.Oconee-3 event reported on 6/27/75 which was initiated at

~

about.15% power,' (c) the'TMI-2 event on 12/2/78 which was

-initiated at 22% power, and. (d) the Davis Besse event of 4/29/78 which was initated at about 20% power (UCS Ex. 35,

' to Reference 1, at 2, 3, and 4).

7 9. - The Staff presented the only witness and then only by oral testimony in response to cross-examination, Neither the Staff nor the Licensee cross-examined the Staff witness on substantive matters related to the reactor vessel fracture issue.

L 80.

The Staff witness, Mr. Klecker, by his own admission had no formal education in materials science or

• -materials engineering, but had rather learned about the matter by experience (Tr. 21,419, Klecker).

The witness could not answer questions which appear to the Board to be critical to the issue.

For example:

(a) the witness could not quantify the probability of vessel failure other

~

than, indirectly, to indicate that.the probability falls

-4 between 10 and 1, and that it probably would not be that low'or that high-(Tr.- 21,447-451, Klecker) ; (t ) the witness could-not' quantify, even roughly, the prcbability of the failure of the TMI-l vessel if at 10 EFPY of neutron irradiation -

l, lthe TMI-1. vessel.underJent aLRancho-Seco-type pressurized L hermal' shock (Tr.-21,'448,.Klecker); '(c) the witness could t

not.specify when'the. neutron irradiation level for TMI-1

would become of concern'for such an event other than'to

~

reference the generic level'of 10.EFPY, despite the fact that the TMI-1 copper ~ content in the reactor vessel welds is about 35% greater than the copper content at Rancho

.a Seco upon.which the generic figure'is apparently based (Tr. 21,44 8, Klecker).

81.

of additional significance, and perhaps most to'the point, the' Staff has been aware of the potential seriousness of this matter for some time.

This issue

~

is the subject of a NUREG-0737 requirement for B&W-reactors (Item II.K.2.13, page 3-129); 'NUREG-0737 was. issued in draft form as a clarification letter to the Licensee on.

September 5, 1980,.and the final version was issued in November 1980.

The requirement in this regard was that by'l/1/81 the Licensee shall submit the results of their thermal-mechanical report.

According to the Staff's SER on NUREG-0737 items outside the Commission's August 9,.1979 Order (dated 4/22/81), the Licensee did not comply with_this requirement until 2/23/81,. over seven weeks late.

The Staff'has had information on the frequency of severe over-cooling. transients since October 29, 1980.

Despite this, the Staff made no apparent effort to inform this Board about-the serious. issue of possible reactor vessel failure following;a_ pressurized thermal shock-until-the Board'.

.g

~

a'.

7 W.; W 3, 3

'g Notification (BN-81-06) was issued on May 8, 1981, nearly seven months after the start of the evidentiary hearing and only1 days'of hearing, time prior to the anticipated close of-the' record.

82..The Board finds a distinct void in the record

- on this matter..-The Board cannot understand the' failure of the ~St' ff (or the Licensee. for that matter, who cannot be a

. presumed to have been totally uninformed on this issue) to bring this matter to the Board's attention promptly.

Failing this, the Staff put on a witness who could obviously not respond substantively'to cross-examination on the issue, and both the Staff and the Licensee utterly failed to cross-examine the witness on' substantive matters.

After-hearing the Board's displeasure with the quality of the record on the issue, the' Licensee nor the Staff-made any suggestions.

or'made any effort whatsoever to suggest how the record' might have been completed.

83.

The burden of proof in this proceeding is clearly-on the Licensee (10 C.F.R. 52.732).

This very point was brought forward by the Commonwealth of Pennsylvania well before the start of the evidentiary hearing (See, Commonwealth of Pennsylvania's Report on Positions Formulated Based'on'Information Available.as of July 25, 1980),

and no party controverted this-basic legal point.

The Board finds nothing to persuade it that the situation is other-than as. stated above.

On the issue of possible

. reactor vessel fracture following a pressurized thermal shock,

- m

[

the Licensee has clearly not. met.the burden of proof.

Based on the. record on'this issue, the Board most emphatically

- disagrees with the Staff's evaluation that there is no reason to delay the restart of TMI-1-pending further resolution of this issue (NRC Staff, Safety Evaluation Report on NUREG-0737 items'outside the Commission!s Order, 4/21/81, at II.K.2.13-1).

This irsue is of such concern that there is no basis for a-finding of reasonable assurance that TMI-l can be operated without endangering the public health and safety.

84.

The Board wishes to make it clear that.the burden does not-fall entirely on the Licensee, however, since it is the Staff's obligation to inform Licer. sing Boards of d

significant develtpments.

This obligation does not arise when the Staff has completed its own evaluation, but rather-arises immediately upon the Staff's discovery of the information.

Virginia Electric & Power Co. (North Anna Power Station, Units 1 & 2), CLI-76-22, 4 N.R.C 480, 491 (1976); Consolidated Edison Company of New York (Indian Point Station, Units 1, 2,

& 3), CLI-77-2, 5 N.R.C.

13 (1977).

In this case, the Staff has failed in discharging its obligation.

85.

Returning to the reliability analysis, the Board now addresses the conclusions of the Licensee and the NRC Staff regarding the ICS and the adequacy of the reliability analysis.

Licensee's conclusions are fourfold:

l (a) the reactor core remains protected for any:ICS failure

- which'was studied, (b) for postulated ICS failures which.

o w

m m<-,e

(- -

L.1, W.

~

cause' reactor trip, safety systems operate independently of the ICS malfunction, (c) ICS-hardware performance has not led to a.significant number of reactor trips, and (d) the

~

JCS has prevented more trips than it'has caused, thereby resulting in a decrease in-the number of, challenges to the

reactor' protection-system (Broughton, Sadauskas, &.Joyner, ff. Tr. 6949, at 3).

8 6 ".

Regarding Licensee's first conclusion, the Board notes that BAW-1564 does act consider any type of multiple failure (Tr. 6964, Jr ter; Licensee Ex. 18, at 4-1),

'despite'the fact that the.ICS is not a safety-grade system and does'not meet the single-failure criterion (Tr. 7041, Joyner; Tr. 5711, Lanese; Licensee Ex. 18, at 4-2).

The Board also* notes that the FMEA did not consider even single failures-of ICS components, inputs or outputs during off-normal conditions of plant operation, even though such conditions are allowed conditions of operation and their occurrence is not uncommon (Sholly Ex.

2, at 10-11).

The Board further notes that-the Licensee has not analyzed the impact on the plant of a total power failure to the ICS (Tr. 6991, Sadauskas).

This may be significant since both the NNI and IC3 receive power from1the same power sources (Tr. 5716, Capodanno),

and, in-instances where NNI/ICS power is lost, such events t

can_both initiate a transient and " blind" the operator due to lack of information caused by the power failure (UCS Ex.

35, Reference 3, at 4). l

~

• --m.-

l N

87.

The Board also notes that B&W's analysis did not consider the effects of operator actions (or inaction) in its analyses (Tr. 7086, Joyner).

At best,.therefore, assuming, arguendo, that all safety systems work as designed and that B&W's analysis ~is complete in all other respects (which the Board does not b lieve -is the case), the Licensee has demonstrated that for single failures of ICS inputs (except power supplies), ICS outputs, and ICS internal functional blocks as defined by B&W, the reactor core remains protected.

The Board would regard this is a very minimal demonstration with somewhat less than a great deal of safety significance.

The Board agrees with ORNI. on this point--the B&W analysis simply did not go far enough, therefore the results of the analysis are of limited value (Sholly Ex. 2,,at 4).

88.

Regarding Licensee's second conclusion, the Board notes ORNL's finding'that the B&W analysis presented in BAW-1564 does not answer in a meaningful way the question of whether the ICS can cause the plant to malfunction in a credible way so that the protective systems cannot handle the problem (Sholly Ex.

2, at 7).

Further, the Board notes that B&W failed to address the effect of. operator posttrip actions, nor did B&W address the posttri? operation of the ICS despite the fact that ICS controls ~ equipment that is important in posttrip situations (Sholly Ex.

2, at 6).

The Board also notes that B&W did not postulate:any multiple failures, thus greatly decreasing the 37-O w-

i'Rt

. significance of. Licensee's second conc 1u'sion.

e-e 89.

Regarding Licensee's third conclusion,.the Boerd notes that this. conclusion is highly dependent on the h

. definition 1of.the ICS (Sholly Ex. 2, at 6).

The Board

^

finds =that.if ICS internal failures,-ICS control' response, and ICS input failures are considered (the latter is

reasonable since it is the control response of the ICS to the failure that leads to the reactor tript Tr._15,874-74, Capra), the ICS may_be found to have caused 56 reactor trips out of the 310 studied by B&W (Licensee Ex. 18, Table 5-1, - at I5-11).

This total of 56 trips does not include any trips which may have resulted from operator error in taking over manual control of the ICS, nor does it include any trips which may have resulted from operator error in misunderstanding an instruction or procedare, even though in both of-these cases the NRC Staff has conceded that-such t-trips may have occurred (Tr. 15,885-86, Capra).

90.

Reactor trips are not the only result of ICS failures which are of concern to this Board.

NUREG-0667 reveals that there were 29 failures of NNI/ICS power supplies through the spring of 1980.

Twenty of these failures resulted in reactor trips, and nearly all of these were accompanied-by feedwater transients.

Six of these events resulted.in overcooling transients in excess of permissible cooldown limits.. In addition, four actuations of high-pressure injection (HPI) were experienced during these NNI/ICS fail'ures.(UCS Ex. 35, Reference 1, at 5).

~.-

Ng* '

L' n

,7,;

~

' 91F The Boar'd also notes the-unresolved concern;

'aboututh4Lparticipation of ICS in feedwater oscillations

.(Sholly Ex.-2, at 9).

Regarding Licensee's fourth and. final conclusion, 92; be the -Board finds ORNL's finding that' while this ;mla true,rit:is not substantiated by-historical' data nor by the FMEA to be particularly significant (Sholly Ex. 2, at' ll).

The Licensee.is also, relying, in' making this conclusion, on' data from the-Rancho Seco plant, which utilizes a'Model 820 ICS, whereas TMI-1 utilizes a Model 1

721 ICS'(Tr. 7082-84, Joyner).

Although the Staff disagreed, both.ORNL and B&W found the.Model 820 ICS to be more p,

reliable thangthe Model 721 ICS (Sholly Ex. 2, at 13; Licensee tx. 18,Jat 5-10).

The Staff's position _is that there is an inadequate statistical base upon which to make' a comparison, and ORNL agrees to a limited extent (Tr. 7142, Thatcher; Sholly Ex. 2, at 13).

B&W concludes that the 820 Model ICS had improved reliability when compared with the Model 721 ICS due.to a number of major hardware changes, including (Licensee Ex. 18, at 5-8, 5-9) :

(a) extensive use of 2

integrated circuits, (b) use of a single printed circuit board as opposed.to the mother board / daughter board concapt, (c) elimination of module level power supplies, (d) greatly J

4 decreased use of aluminum: electrolytic capacitors, (e) elim-ination of most internal wiring, (f) a change in the type of i

~

~ relays used, and (g) in general, a system which generates "les's' heat in operation....

~***-*e wde + m e,.=

y, l.h

~

93.

B&W found significant differences in the mean time l between f aj ' ure (MTBF) for the two ICS models.

The i

MTBF for the Model 721 ICS is between 2754 and 3660 hours0.0424 days <br />1.017 hours <br />0.00605 weeks <br />0.00139 months <br />, whereas the MTBF for 'the Model 820 ICS is between 33,000 and 49,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br />, a difference of an order of magnitude in MTBF's for the two ICS modela.

It is B&W's view that the hardware design changes made in going from the Model 721 ICS design to the Model 820 ICS design account for the difference in MTBF's (Licensee Ex. 18, at 5-9).

94..The Staff's conclusions are different from the Licen.

's conclusions.

Staff witness Thatcher concluded that the present ICS has a low failure rate and does not initiate a significant number of plant upsets.

The Board disagrees.

The Board finds that ICS failures.are responsible for between 1/Sth and 1/6th of all reactor trips on had reactors.

Twenty trips, nearly as many feedwater transients, six severe overcooling transients, and four automatic HPI acutations have resulted from the failure of a single input to the ICS (power supply) (UCS Ex. 35, Reference 5, at 5),

and this input was ignored in the FMEA and considered only in the historical operation data (this results from B&W's definition of the ICS boundary as excluding power supplies as an ICS input; Licensee Ex. 18, at 1-1).

95.

The Staff also concludes that anticipated failures of and within the ICS are adequately mitigated by plant safety systems and that many potential. failures would.

m,

,n w

,--.y

q

- e.-

h%;L *.

^

n j,1 smitigated by cross-checking features,of-th's ICS.

The Board.'s; l findings'regarding the; superficial nature of ther" anticipated 9

fa'il'ures"loflthe ICS.are'as; applicable lto the: Staff's findings Las they are to the Licensee's similar, findings.

The B&W

~

. analysis was: simply toollimi,ted to.be'very useful in this-

- regard.. The,only " anticipated failures"-the Sta'ff seems to

'be concerned'with'are those singleLfailures analyzed by.B&W.

I a

1As theLBoard observe'd-earlier,-it is.not-reasonable to-assume-

~

that~only single failures will occur, since the-ICS is not N

l

. safety-grade and doesinot. meet the' single-failure criterion.

RSgarding the Staff's reliance on " cross-checking" features 1

of the ICS to mitigate.many ICS failures,.the' Board agrees h

that-to an extent this is correct.

However, the Board,also notes-ORNL's admonition that cross limits, though useful, are

~

i not infallible (Sholly Ex, 2, at 14).

Indeed, since there e

is no evidence which suggests that the cross-limiting

~

features of the ICS are of higher reliability than other ICS, components, the Board finds no basis for assuming that 3,

such devices cannot also fail, especially since such' devices.

can fail-without being annunciated, thereby " announcing" their failure when,they are called upon to function and do not.1 96.

The Staff-also places a great deal of-reliance on procedures and design changes that will benin place at

~theitime of' restart regarding feedwater control independent s

of'ICS.

While.the Board agrees that this will provide some benefit, the degree of: improvement is not clear and remains p,

+

n LQ I4 e

i

l-r I

?

EY' i

?

-3.,.

.i g

s g%

,,g

4

.*r.

s;;, :

J

s

~"

unquantified'.'

Further, the Board' sensitive toithe fact that-

~

many;ICS failures-arefnotiannunciated'to the plant operators, Land-the plant operators need:to promptly recognize' failures m

.in order to1 implement the: proper emergency: procedures for L

dealing 1with the failure.;.-

~

97. 'The Stsffitest'ified that its conclusions.that

^

^

the ICS hasia low failure ratefandIdoes not initiate a'=

significant' number of-upsets'are based "mostly" onLoperating

-experience:as presented 11n.BAW-1564, and that.the FMEA did'

W not have;any impact on these conclusions.-(Tr. 7270-72,

. Thatcher).- The' Board is aware of the Staff's own expressed

concerns about'the adequacy of the-operating history data

~

abase-with regards to the ICS (Tr. 15,771-72, Capra).

The Board also: finds a conclusion by ORNL.particularly'significant in this regard (Sholly Ex.

2, at 7) :

"The supplenuntary operating statistics indicate that the controlfsystem is'of reasonable. reliability, but they also give a somewhat hazy image ofia-system that has some; performance defic 3rncies.

It does not appear to be an unworkable system, but it falls ~short of-being a strong influeiice-for safety? (Boardr s emphasis) 4 i

-ORNL further stated that the operating statistics shouA?

not be regarded as a source of insight in,to the sensitivity

~

i '

lof'the plant to the-ICS (Sholly Ex. 2, at 13).

98. -The Staff.later stated during the proceeding e

i' !'

b i.,

i' b.

,a that duringlthe time period since the B&W analysis (BAW-1564),

the Staff had not identified any additional. concerns regarding the role of the ICS'in feedwater'transie ts (Ross.& Caprc, ff.-Tr. 15,855, at-7-8).

The Board has been presented with no evidence which even suggests that additional st'udies of

. the ICS have been undertaken in-this time frame, therefore the Staff's statement is hardly a surprise.

More importantly, however, the Board finds'that the'five original concerns that the Staff expressed about the ICS at the April 25, 1979 Commission meeting have still not been fully resolved, Staf#

representations in testimony notwithstanding.

The-Board will address these-five concerns: individually.

99.

The first concern expressed by the Staff _was concerned.with the reliability of the ICS:(Ross & Capra,

' ff. Tr. 15,355, at 2).

The Staff relies on their'interpreration of the operating history of the ICS which leads.them to conclude that only.6 trips have been caused by ICS failures and that the Staff has found no evidence which suggests that the-ICS provides more frequent or more severe challenges to-the plant protection systems than other control systems of similar scope (Ross & Capra, ff. Tr. 15,855, at-4).

This

[

conclusion is apparently based on the ORNL review of BAW-1564 (Sholly Ex. 2, at 14).

The Board has already stated its j

disagreement with the Staff view on the number of trips caused

. by ICS failures ~and will not reiterate that matter here.

On the latter point, the Board finds no evidence in the record l '

p.

e

-ers

.q.

~,s which addresses whether the revised-PORV and reactor trip i

setpoints have increased the-frequency. of challenges to-the reactor protection' system, only the Staff's naked conclusion that the answer to the question-is in the negative. - The Board has found information,to_the contrary.

The Board was requested very late in-the proceeding to take official ~

notice of certain portions of NUREG-0667.

One of the matters brought to the Board's attention in this request _was the conclusion, at least by the Task Force which prepared NUREG-0667, that since the inversion of the PORV and reactor trip setpoints following.the TMI-2 accident, the responsiveness of the B&W design'to.undercooling events reflects a high. challenge rate to'the plant protection system. 'The Board is compelled to take official notice of this fact.in the context that it

' presents a contradictory conclusion to a Staff position taken in the proceeding which'was not addressed by the Staff's witnesses-(NUREG-0667, at 5-20).

The fact that this different conclusion was not raised h-1 the Staff is especially puzzling to the Board since the Staff's conclusion that there has been no increase in protective system challenges as a result of the ICS operation was sponsored in part by Staff witness Capra, who also served as the Editor for NUREG-0667 (Capra, Statement of Professional Qualifications, ff. Tr. 15,855, ad 3).:

e-

6

[

100. 'The fact that inverting the PORV and reactor. trip.

~

-set points'would' result the reactor trip circu't being i

challenged'"far more often" was acknowledged by. Staff witness Ross- (Tr. 15,882,. Ross). -

101.

The third concern raised by the Staff is that the ICS may.initiaten10-15% of all feedwater transients (Ross & Capra, ff..Tr. 15,855,;at 5).-

The. Board notes that the witnesses' response to this concern was to; discuss. the number of reactor trips. caused bylICS failures.

This, in

'the Board's' view,. totally misses'the point.

Again, in-response to a motion to take official notice of certain facts in NURBG-0667, the Board's attention was drawn to the conclusion of the B&W Transient Response Task Force-that NNI/ICS power failures'alone caused 18% of all observed feedwater transients in B&W plants through the period of that study (spring of 1980) (NUREG-0667, at 4-8).

Again, the Board in compelled by a void in the record to take official notice of this fact.

Neither the Staff nor the Licensee'has addressed how much improvement will result in power supply reliability from improvements in power supplies undertaken by the Licensee, nor'has either the Staff or the Licensee addressed the degree of improvement to be exp'ected from improved ICS/ balance of plant tuning, both of which were cited by the Staff as " proof" that this

-concern had been resolved (Ross & Capra, ff. Tr. 15,855, at 6).

The' Board cannot, as a result, find that this matter has been completely resolved.

h._

102.

The' fourth concern expressed by the Staff, regarding ICS control of' emergency feedwater, has been resolved for the long term _in.the Board's. view by provision For for.EFW-control completely independent of'the ICS.

the interim period during whigh procedures will be available

'for accomplishing EFW control independent of ICS, the Board.

is concerned'about the likelihood that the operators may not be able'to promptly detect'ICS failures involving EFW control due to lack of annunciation of many ICS failures Neither and the problems involved with mid-scale failures.

the Staff nor the Licensee addressed this problem.

103.

The fifth and final concern expressed by the Staff regarding the ICS relates to the sensitivity of the B&W' design-and feedw$ter oscillations.

The Board agrees with the Staff that some of the recommendations in BAW-1564 are aimed at reducing this sensitivity, but the Board can find in the record no qualitative or quantitative information Furthermore, as to the degree of reduction in this sensitivity.

l-l-

the Board reiterates its conclusion (as noted by ORNL) that B&W used methodology in BAW-1564 that was incapable of evaluating.the involvement of the ICS in feedwater oscillation.

104.

The Board, as a result of these facts, must disagree withithe Staff and conclude that the B&W reliability l

analysis as performed and documented in BAW-1564 did not As observed-resolve the concerns which. occasioned the study.

the.B&W analysis is more notable for what it by ORNL, does not include than for what it does include." (Sholly Ex. 2,.

esem@'

-'f*

-ee

,- 4auly me 9

• • M _

g v

m g-

---w w

~

J 1.

e at-3).

In-the Board's view, BAN-1564'and the ORNL review of BAW-1564 raised ~far'more-questions than.they a.nswered.

.It it the Board's view that the Staff looked at the ORNL conclusions -which supported the Staff's position on. t he adequacy of the reliability analysis, and. conveniently

' ignored other findings and recommendations.

105..

The Board.found recommendations made'by ORNL which were ignored ~ by the Staff. and' the Licensee (and, apparently, by B&W as well).which appear to the Board to address some of the outstanding concerns raised by the B&W reliability analysis.

In summary form, these p

recommendations are:

Despite apparent _ agreement among the a.

Staff, B&W, ORNL, and several B&W licensees that additi nal work was 9

j needed, no additional work appears to have been initiated'on the subject of the deteccion and annunciation of ICS failures.

There was apparent l

agreement at a group meeting that such additional study was needed because I

of the fact that many ICS failures are not self-annunciated and may remain as undetected failures for long. periods i

of time, thereby leading to multiple failure incidents (Sholly Ex.

1, at 6).

b.

Power supplies for ICS input instrumentation were not addressed in the FMEA, and although B&W agreed that more work in this area needed to be done, no such work has been brought to the attention of this Board (Sholly-Ex. 1, at 6).

c.

ORNL recommended that a fault tree

. analysis be performed for the loss of feedwater event using an equipment block diagram.

The results should be used to..

w-e e

r-t W

,,e e

.s e,

.s..

...3

~

judge whetherEit'would be appropriate-to develop additional fault trees for other.

q major events involving the ICS - (Sholly Ex. 2, at 8). -The Staff referenced the development of fault. trees in the ATOG program (Ross &.Capra,Eff. Tr. 15,855, at 5), but the Board was not presented

with sufficient information to determine whether the. specific event of loss of feedwater was-being evaluated in a fault treecevaluation,'nor was-the Board able

~ to conclude whether the ATOG work met

'ORNL's~ concern, ORNL recommended that a' dynamic analysis-d.

be performed on the.ICS to answer the-following questions:

(1)

Since the dynamic. response of_the feedwater. pump control is generally slower than that~of the feedwater valves, will transition.from valve to pump control of feedwater cause stability problems?

(2)

Do the pressurizer controls mitigate or amplify pressure oscillations and how are the pressurizer and the ICS interdependent with regard to stability?

(3)

Are feedwater oscillations caused or mitigated by the ICS?

(4)

What conditions involving the ICS could lead to plant instability?

(Sholly Ex.' 2, at 11).

A full-plant simulator should be developed e.

to evaluate the interaction of the primary, secondary, and control systems (Sholly Ex. 2, at 15).

f.

Additional investigations should be performed of ICS failures (component failures) under off-normal conditions of operation, and postscram heat removal should be followed in order to demonstrate the medium-term consequences of the event and the adequacy of the computer predictions made by B&W in BAW-1564 using POWER TRAIN IV (Sholly Ex. 2, at 11)..

-N gen.e w e. hOWae a

eem

+e up=m-We

.r,.-

l

?

106.-

The recommendations-for' additional. study or

~

additional actions-are especially significant in the Board's

-view due to ORNL's conclusion"that.is was difficult for:

ORNL to assess. the" need for. further ' evaluations or -for

-potential' design' modifications to the ICS because B&W's.

analysis of'the ICS in BAW-1564 was so limited (Sholly E'x.

2, at.11)...

a II. - SHOLLY CONTENTION 1 (Containment Isolation) 107.

Both Licensee witness Lanese (Tr. 7352, Lanese) and'NRC Staff witness Hearn (Tr. 7379, Hearn) ~comfirmed that one of the recommendations arising from NUREG-0667 was for a safety-grade high radiation containment isolation signal for-the reactor building vent and purge system.

Neither witness, however, could explain why the recommendation was not approved for implementation.

108.

The TMI-2 accident demonstrated that significant fuel damage can occur in the absence of a high reactor building pressure signal, thus resulting in delayed containment isolation (Lanese, ff. Tr. 7349, at 3).

109.

A non-safety grade hiah radiation containment isolation signal has always been in place at TMI-1 for the containment purge system.

Licensee's witness asserted that the diverse containment isolation signals now used at TMI-1 a i

'e.,

41 j

are " superior" to a-high radiation signal,'and'that the

~

non-safety grade high' radiation signal.is acceptable be'cause of the-additional presence.of the anticipatory

~

reactor trip containment isolation signal (Lanese, ff.

~

'Tr'.

7349, atil,.4).

110.

Upon cross-examination, however, it was Erevealed that this assessment'is based on the assumption-

'that;no spurious PORV opening occurs (Tr., 7354, Lanese).

Even under this-case, the witness still preferred the anticipatory reactor trip signal, but provided no justification for this preference.

~

111.

Furthermore, NRC Staff witness Hearn testifi ed :that. is. is possible to have. the purge line

.open on'an operating or.maintenancq bypass and have it fail to close on the' reactor trip. signal (Tr. 7384, Hearn).

112.

Tie only radiation monitors in the reactor building at TMI-l wh!.:h are safety-grade are the containment dome monitors (Tr. *,362, Lanese).

There are two nuclear plants in the U.S.-with safety-grade high radiation monitors (Tr. 7 350-51, Lanese),' demonstrating that such instruments are available.

~

113.

The Board concludes that a safety-grade high radiation signal ~ isolation for the containment purge system is-clearly preferable to a non-safety grade signal.

The Board therefore requircs the Licensee to obtain and )

.f'e l

Linstallia. safety-grade high radiation containment isolation

' signal.on the containment purge system as'soon-as' practicable.-

lIniths interim,ithe Licensee >is ordered-to prepare.and submit for:NRC Staff' review and approval, procedures which will

~

sassu'resthat~the containment purge.line will be promptly isolated upon detection of a high radiation. signal from the

. existing equipment.

_The Licensee'shall-submit these procedures to the NRC Staff and secure'their approval ~for

-the implementation of these.proce'dures prior to restart of

~TMI-1,'and1shall report an estimated date for the-completion

~ of the installation of the safety-grade high radiation

' isolation equipment tol the NRC Staff aus soon as practicable.

Licensee must demonstrate reasonable progress toward

~

completion of.the_ safety-grade installation as a condition of restart.

III.

SHOLLY CONTENTION 13 (Plant - computer) 114.

Both the Staff and the Licensee agreed that th( plant computer at TMI-l is not relied upon in order to demonstrate Licensee's compliance with General Design

' Criterion 13 (GDC 13), but rather that compliance i,s achieved by ' the provision of hard-wired safety-grade instruments ' in l

the' plant control room (Joyce, ff. Tr. 7467, at 3-5; Hamilton

' l O

v v

y..

T

& Keaton, ff. Tr. 7397, at 3)..

115.

Since'the compliance (or. lack thereof)'with

.GDC 13 was largely the thru'st of the contention, this conclusion would.seem to end the Board's inquiry.into the matter.

This

' !is not the case,- however.- The testimony on the plant computer raised, perhaps for the first time, novel issues regarding-

-the reliance of plant operators on non-safety grade plant

~

computers for information, which is then used to make decisions about operational maneuvers, particularly under accident conditions.

'116.

From-this standpoint, the Board is mainly concerned about the Staff's role in reviewing plant computer systems and.possible operator reliance on computers as an operational aid.

The Staff witness who testified on tae plant computer, Mr. Joyce, was a member of the human factors

~

review team'which examined the TMI-l control room (Joyce, f f. Tr. 7467, at 1).

The witness testified that the TMI-2 accident was an example of why the plant computer is not needed to assist operators with responding to feedwater transients or small-break LOCA's (Joyce, ff. Tr. 7467, at 4).

Yet, under cross-examination, the witness-revealed L

-that he had not reviewed the TMI-2 accident sequence of I

events and related documentation with regard to how the plant' operators may have used the plant computer (Tr. 7472, Joyce).

Since the possible use of the plant computer during the TMI-2 accident appears to have been the genesis of the

~ -,

4,.

.4'

~c..

-contention,-the Board is. puzzled as'to the reason.the Staff

~

put on a witness who-had not at the.very least assured-himself' by.. reviewing the TMI-2' accident-records that the. operators In fact, the Edid not'roly unduly-on the' plant computer.

Board wonders if any member of the Staff has examined this issue,1although the general ~ subject ~of the role of the computer has apparently_been the subject of some work by the: Staff (Tr.; 7472-73, ?-Joyce).

117.-

Staff witness Joyce testified that in a number of control room reviews (from a human factors standpoint),

operators were observed-in walk-throughs on emergency procedures,- both in the plant control rooms and at simulators, and that-he had never seen operators use the computer, and he had never seen emergency operating procedures reference the use of the computer _(Tr. 7474-74, Joyce).

118.

The witness testified, however, that he did not routinely or even periodically observe operators at the controls of the power plant while the reactor is Moreover, the witness testifed that such observations at power.

would be a function of the Inspection and Enforcement Office rather than a function of the Office of Nuclear Reactor of NRC, Regulation, suggesting tnat no one from the human factors branch (or any branch of NRR) observes operators at the controls during actual operating situations (Tr. 7476, Joyce).

E 119.

The witness also testified that the Staff does I

not review plant computers in any way (Tr. 7483, Joyce).

! t e-r e e*

y

-w w

-w 4

]

l, '

-l

)

-The[ Staff does/not review-the computer to determine'its 5

reliability, nor its adequacy'for whatever'use is be'ing

)

. made ofthe computer by plant. operhtors (Tr.'7485-86, Joyce).

1120.

Evenlthough emergency operating procedures fdo'not reference the use of:the computer, neither'do such procedures specifical1y prohibit the use of the. computer-

~

(Tr.'7485-86, Joyce).- The Staff's~humanLfactors consultant,.

Mr. Price, testified that'even if operators were instructed specifically not' to rely exclusively 'cn1 informe* ion.from the computer in the performance of1their emergency -functions,.

'this:would-not stop the op3rators.from using the computer in such situations'(Tr. 10,587-88, Price).- Licensee's witness Keaten acknowledged that. Licensee has no such policy of prchibiting operators from,tilizing the compater during

~

u upset conditions (Tr. 10,595, Keaten).

The Staff's computer witness agreed that there.is nothing to p'revent the operators

'from using the plant computer whenever they see fit to do so (Tr.'7485-86, Joyce).

121.

Licensee's witness testified that he would normally expect the operators not to rely on the computer during the first portion of a transient when conditions are changing rapidly (Tr. 10,595, Keaten).

This is mostly because of the training which the operators have received and'also a result of the design of the control room which I

would result in the operator being forced to leave his instrument-panel station and go behind the main panel to e

T dr w-

=++we e

+

m -

y-e

.-m

+ ; 3.,

access'tbe computer.. Operators:would not be expected to do-thinfuntil the first portion of the transient is over-and-the-plant has stabilized (Tr. 10,595, Keaten).

122. 'During.'this period of time, however, it would i

'not be unusual for the Shift 50pervisor or Shift' Foreman to use the' computer to obtain additional or. backup information (Tr. 10,595-96, Keaten).- During the TMI-2-accident, the

-Shift: Supervisor.and/or Shift Foreman did use the computer in-this manner (Tr. 10,592-96,. Keaten).

The first1 time the' operators themselves (the operators actually manipulating the controls) accessed the computer.during the TMI-2 accident was at approximately 27 minutes, when the operators called up information from the computer to try to assist with.

.their determination of -whether or not the pressurizer relief valve (PORV) or safety valves were stuck open (Tr.

10,597, Keaten).

.In fact, temperatures from the PORV and the safety relief valves are normally accessed through the plant computer (Tr. 10,597, Keaten).

123.

During the TMI-2 accident, operators also used the computer to call up " raw input" data from the computers to use to determine if control room instrumentation was operating properly (Tr. 10,598, Walsh).

In general, during the TMI-2 accident, operators used the computer as a matter of convenience (Tr. 10,603, Keaten).

124.: The Board finds it clear that not only did operators,. including senior shift personnel such as'the,

=

9 4-Shift Foreman and Shif t Supervisor, use' thefplant computer-

-atLTMI-2 during the TMI-2 accident, there is noireason to suspect-that the operators at TMI-1 will not utilize the-Ecomputer in all kinds of situations'in the future. : Staff twitnessesLin particulariaddrssed this issue during cross e

examination in the proceeding,'and it became abundantly O

Lclear that:this is expected. behavior from plant operators.

Staff ~ witness Ramirez testified that most operators-at most-plants have a tendency to use the process computer because it is. easy to get to (Tr. 10,515, Ramirez).

Staff human factors consultant Price agreed, stating that if-there is a process computer present, the operators will use it because it is convenient.

The witness further testified-that if the computer is there, it becomes an operational aid which the operators do and will depend upon, and will attempt to use it under all conditions (Tr. 10,515, 10,540, Price).

125.

Staff witness Price also' testified that from a human factors viewpoint, he would be surprised if the operators did not use the computer during an upset condition, and that he would be upset if operators were told not to use the computer during upset conditions because the computar is a source of very fast information (Tr.

.10,544-45, Price).. Licensee witness Keaten agreed that if the computer is-present, operators will attempt to use it under all conditions (Tr. 10,547, Keaten).

4

o..

~

126.-'Both Staff-witness Ramirez and Staff consultant.

Price' agreed that if the computer is available, the operators will put some reliance upon it,<and Price testified that in

-his view'the operators will use the comuter as much as possible if it isLpresent (Tr. 10,556-57, Ramirez & Price).

127.

Operator. utilization of the process computer raises some concerns in-the Board's view.

The Board is r

especially concerned with Staff witness Price's observation

'that if real system status and the process computer'get out of synchronization, there could be problems if' operators are trying to use computer information, and the witness thought it.likely that operators would try to use the computer even in'these' situations (Tr. 10,545, Price).

128.

The Board agrees with the gene"al observation

• r by the Staff that although computers are not-required, it they are present as operational aids, the Staff should be concerned that tl.e data presented is accurate and reliable (Tr. 10,514, Ran irez).

Staff human factors consultant Price agreed wich this viewpoint, noting that if the computer is going to be present in the control room, it

[

should be adequate from both an engineering and a human factors point of view (Tr. 10,516, Price).

129.

There have been concerns about the e:cisting process computer at TMI-1.

The Board notes that the Licensee 1

is in the process of upgrading the computer facilities at.TMI-1, including new CRT's, new printers, and new software, L

I -

s w%-*

g-

-r-

-rn--

w,g g

g g

m-gg p-e

>=

ve-

v:

e.-

z =.;

e-b'ut :the ' modifications will not be completed ' prior to

restart - (Hamilton. & - Keaten, f f. Tr. 7397, at 7-8).

Licensee witness Keaten agreed that the existing CRT

-rystem is "tetally unsatisfactory" from a human factors standpoint, and noted his preYerence for a faster computer system at TMI-l than is present now, asserting-that a faster computer system would haveLdistinct advantages associated with it (Tr.10,537, 10,543, Keaten).

130.

Licensee's witness could not, however, state with ' certainty exactly winst new computer ' functions would'be present at the time of restart, and he. expressly

^

left open the option of modifying the existing Bailly 855 computer system, even though he acknowledged that this modification would be difficult to accomplish due to the vintage of the system and the lack of replacement parts (Tr. 10,538-40, Keaten).

The witness testified that the-existing computer was not designed to be used under plant upset conditions, but that operators have used it under such conditions to call up specialized data points from the computer (Tr. 10,543, Keaten).

[-

131.

The Staff's control room design review report (NRC Staff Ex. 2, at 7) raised problems with the existing i

computer system, noting.that the vintage of the system I

raised concerns about the reliability of information coming

-from the computer.

Elaborating under cross-examination, Staff witness Ramirez testified that this general concern m

'W g-,3-g,

W, arose from conversations 1with TMI-l plant' operators.and with

~

one-individual who works with:the computers at TMI-11(Tr.

10,510-12,- Ramirez).

Witness Ramirez testified that. operators

'had-informed the human factorsfroview team that the computer

has: failed in the past and isnot'always available, specifying

.that.it was his! understanding that availability' referred both to the physical availability of the information and the accuracy of'the'information (Tr. 10,471, Ramirez).

When asked'-to specify the conditions under which' accuracy of information from the computer became a concern,. witness Ramirez expressed the concern that it is not always immediately recognizable when the computer.begins to have problems unless the computer. absolutely quits operating, and it is during the period from the start of computer-related problems until the problem is discovered that there is concern about the accuracy of the information presented by the computer.

The witness also testified that the operators at TMI-1 had noticed this problem as well (Tr. 10,471-72, Ramirez).

132.

Staff witness Ramirez also expressed concern with the computer being slow, referring both to the printout capability and the processor capability (Tr. 10,511, Ramirez).

Staff witness Price also noted problems with readability of computer displays and the response time of the computer (Tr. 10,544, Price).

l 133. 'Although expressing the view that no computer

- would be better than one that is too slow (Tr. 10,516), L i

'+

3 L9 g-i Staff human factors consultant Price testified that if the computer is present,-it will be used.by'the operators along with other indications, and that it:is essential that the

~

computer-be at least as accurateLas other indications would be - (Tr.-- 10,516, - Price).. Both Staff witnesses testified that the computer is.a positive influence on the operator and that it-should be regarded as a tool to be used as-appropriate ~(Tr. 10,566, Ramirez & Price).

.13 4 '. LAllhough noting his preference for the improved

' computer-capability as proposed by the. Licensee,. Staff witness Ramirez agreed that the existing computer would be better

-than no computer, provided that the Licensee establishes a verification program-to assure that computer data output is accurate and reliable, and that operator training highlight how the computer is to be utilized (Tr. 10,560-61, Ramirez).

F '

13 5 '.' The Board expressed three major concerns about the computer:

(a) the timeliness of the data presented, (b) the accuracy of the data presented,.and (c) the down time of the computer system and components (Tr. 10,475, Administrative Judge Little).

The Board's concerns will be handled in the The Licensee is directed to establish a following' manner.

schedule for completing its computer upgrade and submit this schedule to the NRC Staff for approval.

The schedule shall identify the components which remain to be obtained and tinstalled, shall specify a schedule for implementing each of-these items, and shall provide details of operator training The Staff shall to be provided on each of these components. -

e

}

w w w

- +

w

o.. '.

_ monitor Licensee's adherence to this schedule through the and the Staff shall-Officelof Inspection and Enforcement, assure that the Human Factors Branch' of-NRR is involved

~

'in evaluating the human factors adequacy'of;the new installation as it proceeds.

136..The Licensee is'also directed,.though nego-tiations with the Staff,'to design and' implement prior-to restart a monitoring program to~. assess the reliability of the (both inntermsa3f' availability'and accuracy) fThe monitoring program.shal1~ continue computer system.

with the installation of new computer hardware and software until there is a sufficient data base upon which to make a determination'as to the sufficiency and accuracy of the The Licensee is also directed to new computer system.

i propose appropriate modifications to the Technical Speci-fications to TMI-l to incorporate this requirement along with periodic reporting requirements for the information generated by the reliability monitoring program for the The Staff is directed to monitor process computer.

Licensee's reports through the Inspection and Enforcement staff.

The Staff, through the Office of Inspection 137.

(with appropriate consultation and i

and Enforcement is cooperation with the Human Factors Branch of NRR),

directed'to undertake periodic routine observations of TMI-1. plant operators during normal (and emergency operations to the extent feasible) operations to ascertain I !

t

..e

.g

.._w e

~

'0, 4: 4

?

the degreelto_which plant operators rely on the process

' computer, for'which functions the operators rely upon

.the' plant computer, and to what purposes the information

~

.trom the plant computer is utilized.

Such information,

-in' addit' ion'to being necessary.to evaluate the human factors and operational appropriateness of utilizing the process computer, will assist:the' Staff lin reaching a

. determination as to what standards, if any, should be

' applied.ta) process computers to ensure that they'are

~

+

properly designed and qualified for-the purposes for which they are being utilized.

This program shall also be utilized, to the extent feasible, to verify the conclusions of Staff and Licensee witnesses that operators do not rely solely on computer information as a basis for making operational decisions, especially in upset con-ditions.

138.

Further, it is the Board's view, after examining the record on this issue, that the process computer is an;important operator aid, and that the operators will rely on the computer in the performance of their luties As a result, during normal as well as emergency, situations.

the Board finds that it is essential that the computer be available to the maximum extent feasible, comparable with i

the availability desired, for example, of the Integrated The Board is therefore directing that the Control Systam.

- Licensee investigate the feasibility of powering the plant

~

t computer from Class lE power sources, and further directs

..mw-ww

%-.4 e same-4

.e-e w

-4 ww

,p 4,,

o wn e-e,r ayn-

-p y

>>w---

p ws+

~

~

e that'this' feasibility study be completed promptly, before'

~

restart if~possible. -In the interim,^the Licensee:is' directed

- to ensure'that the power. supply.Lfor.the computer-is of'

-reliability; comparable tofthe' power: supply-forithe ICS, thefvery least assuring th'at the computer'has: redundant

~

at s power sources and 'that there is reasonable assurance that the? computer;will be~available in the. event'of'a station-

~

.The. Staff'is directed to monitor. Licensee's 1

blackout.

compliance with this requirement-through the Office of

- Inspectio'n and Enfcrcement.

IV.

SHOLLY CONTENTION 15 (11uman factors engineering review of control room design) t Both the Licensee and the NRC Staff completed 139.

reviews of the TMI-l control room from a' human factors engineering perspective.

Reports on both rt 7iews were received into. evidence (Licensee Ex. 23; NRC Staff Ex. 2, The Licensee's with - Supplement No. 1 dated April 1981).

review was undertaken prior to the publication of any-and was LNRC guidance on how.to conduct such a review,

~in response to generic criticisms of control room design which arore from the TMI-2 accident (Licensee IDc. 23, at I-1) '. - The' Staff's review was undertaken in response to f

W e -

++,e cams *me ee-e,

rw w-b wr J

w! w-i-

e+

9+

yey+-

y eryi'*

'-C g

&wp 1 Ap 9r ev'-

r:.

^ 4.~ g i,

"TMI-Related Requirements to th'e requirementsiof NUREG-0694,

-for I?ew Operating Licenses," generally referred to asLNTOL

(NRC Staff Ex.

2,

-requirements (Near-Term Operating License)

L at 1).

'The Staff review took place during;the week

'140.

A~ draft control room design-of July-21 through' July'25,-2980.

review report was submitted to the-Licensee for comments,

~

and the Licensee and the Staff met on October 10,11980 to discuss the Staff's draft report.. Licensee submitted a draft response to the. Staff's draft control. room design report on. October 27, 1980, and submitted its final response on Additional discussions with the Licensee November 7, 1980.

were held through early December 1980; the final Staff control room. design review report (NUREG-0752) was published-in December 1980 (HRC Staff Ex. 2, at 1-2).

The Staff conducted its review using an intensive

-141.

An week of observation and discussion with plant operators.

One of the 8-9 man Staff team performed the review at TMI-1.

Mr. Harold Staff team members was a human factors consultant, E. Price.

As guidance for the review, the Staff relied upon NUREG/CR-1580, draft control room design human factors (Tr. 10,486-criteria developed by Essex Corporation for the NRC 87, Ramirez).

Licensee's review was conducted by an eight 142.

three man team, including two human factors consultants, members of Licensee's engineering staff, and three members

~

e,..a

=+

ser e

- w e.

w w-w

-,s p_,

Ke, of MPR Associations, Inc. ?Dsing " Human. Engineering Dc3ign.

~

i

-Criteria'forcMilitary Systems, Equipment and Facilit es

-(MIL-STD-1472B) f as 'a guide, and incorporating other human factors gnades as appropriate,.the review. team formulated

.a set-of human factors guidelines against -which the TMI-l control room design was evaluated.1 The final study was published in' December 1980 (Licentee Ex.-23).

As a result of the two human factors reviews

~

143.

of the TMI-1-control room' design, numerous changes were Additional studies were committed to by the

' recommended.

Licensee, and alterations to the control room were begun to correct certain deficiencies.

The Staff will bear a heavy responsibility 144.

for determining that the alterations to the control roo,m which' were committed to by the Licensce are carried' out and that the Licensee's operations staff has been fully trained ~

on these changes.

The Staff Division of Human Factors Safety has made specific arrangements-with the Office of Inspection and Enforcement to followup on the. implementation of the changes to the TMi-1 control room (Tr. 10,502, Ramirez).

However, a further review by the Staff human factors specialists will be necessary prior to restart because some of the changes involve inspection of changes which are simply not within I&E's capabilities (Tr. 10,503, Ramirez).

i An example of such an item is the implementation of color-l coding.of alarms to prioritize important alarmst the imple-

' mentation evaluation of such an item requires a trained human '

-a s> w -

m r

vv

-w._

9:

• factors-specialist - (Tr. 10,503, Price).

J45.. The link' drawn by the Board,between the implementation of. human factors improvements to the.TMI-l control' room design-and the training of operators Ein those improvements 1(Finding 144) is.particularly:important in-the Board's view because'of the intimate interaction between

-human. factors engineering and operatorstraining'(Christensen, Licensee's human factors and training f f. Tr, 12,409,. at 8).

witness-Christensen noted in particular that' training can be used to compensate for' control room design shortcomings ff. Tr. 12,409, at 6; Licensee.Ex. 23, at

~

(Christensen, This is especially important due to the impracticality III-13).

-(for the short term, at least) of a complete redesign of the control room (considering time lead time for design, installation, testing, and training of operators in the new control room design).

A key element in training as it is related to 146.

Simulato: training is human factors is simulator training.

an essential element of both initial operator training and requalification training (Long, et al.,

ff. Tr. 12,140, Licensee has relied upon and continues to rely upon at 29).

i

-the B&W simulator facility at B&W's Nuclear Training Center The B&W at Lynchburg, Virginia for simulator training.

i l

simulator is.similar to, but not a replica of, the TMI-l control room (Long, et al.,

ff. Tr. 12,140, at 29).

The B&W simulator is useful for functional or conceptual training, it is not useful because of the differences in design, but, e et s

y w

mm

for'" reflexive" or stimulus-response type training (Tr. 12,476, I

Christensen), training the Board regards.as1 proficiency. training.

.147.

' Licensee is committed in the long term to purchase a full' replica simulator for.use in its onsite

-operator training.

Licenseeis witness on training estimated-thatJthereLwould be a four-year lead time to obtain a replica simulator for TMI-l (Tr. 12,145, Long).- Purchase of such a." full-mission" simulator was recommended by'the OARP Committee (Licensee Ex. 27, at 110) to. improve overall operator training and permit more use of simulation (Licensee hex. 27, at 109, 144).

148.

Simulators offer unique training as compared' to: classroom. instruction.

It is impossible, _for example, to evaluate-shift crew interaction'in written examination, but sach evaluation is accomplished in simulator training, and is a very important part of simulator training (Tr.

12,264-65, Long).

The simulator is utilized to develop skills which cannot be developed in the classroom (Tr. 12,201, Knief).

Simulator training is used to eliminate operator candidates with low stress tolerance, and is also useful to training to reduce the stressfulness of :ransients and promote effective response during transients (Gardner, ff. Tr. 12,409, at 7-8).

149.

Purchase and installation of an onsite replica simulator for TMI-l would have numerous advantages.

The availability of the onsite_ simulator would result in increased i l p

yv,

,,,, + = + -

.,t 9

t q

g.

! -n i i

1 utilization of the simulator in training programs -(Licensee

- l

.Ex, 27,--at 109,- 144 ;f Tr.12,257, Long). yThe simulator would F --

also be'used to trainLnew operators and the engineering staff.

-The use of the simulator to;tra n other personnel is also being-i evaluated (Tr. 12/258, Long). :.The simulator wil1 also be used

~

to examine the control room design.(Tr. 12/149, Long). ~ The Board observes.that the presence of an onsite simulator will facilitate op.erator training regarding control room and procedural modifications,.and'would' permit testing, under controlled conditions,.of alternative control' room modifications in order to find the.most effective arrangement.

Staff human factors witneeses also agreed.that 150.-

simulator training is useful.

Witness Ramirez testified that-the use of video / audio. taping in simulator conditions would reduce the objections of operations personnel to the constant observation of.on-shift performance (Tr. 10,501, Ramirez).

Staff witness Price noted that much more valuable experiencn

-can be gained by the use of simulators.

For example, detailed analyses of operator performance can be performed, rather than simply a "right" or " wrong" evaluation (Tr. 10,501, Video-taping of tra ining on the simulator would be Price).

useful for proficiency exercises to facilitate evaluation of operator performance (Tr. 10,499, Price).

Licensee has implemented a new practice of 151.

reviewing all modifications to the TMI-l control room from

'a human factors standpoint prior to implementation (Tr. 10,252, Walsh)..Such evaluations would, in the Board's view, be greatly..

-e e.

,.e He s

w-s-

-a e-

'q 4 e

enhanced'by the use of'an onsite simulator.

Although revisions to operating'and emergency procedures'do no6 receive a similar

' human factors. review (Tr. 10,304-305, Walsh & Estrada), the Soard recommends on the basis of-the-record' developed in this proceeding,.thst a' human factors review of procedural changes also:be-implemented by the Licensee.

Such reviews would also be enhanced by a replica simulator which could be used to evaluate procedurus to be certain that the procedures are compatible with the existing control room design at the time the procecures are revisen.

152.

The basis for evaluation of the TMI-1 control room was not firmly established in the Commission's regulations at the time the reviews of TMI-l were conducted in that formal requirements ha.d not been promulgated, nor had a final version of a regulatory guide on human factors engineering standards been published.

Although the Staff disagreed (Ramirez & P. rice, ff. Tr. 10,452, at 6), Licensee witness Meek testified that in his view,~ General Design Criterion 13 (GDC 13) not only requires that adequate instrumentation be provided to monitor accidents, but implies that the arrangement of such instru-mentation be logical and proper (Tr. 10,274, Meek).

The Board agrees, although GDC 13 does not provide any specificity in terms of what is acceptable and what is not.

153.

The Board notes that there is an ongoing process to define control room design guidelines, and recommends that j-I the Staff complete this work and implement the guidelines as l

L soon'as practicable. f w-

,4 r

w v.

4.

T 154.

Before addressing the various commitments made by the Licensee regarding the upgrade of the control room design, the Board addresses itself to several areas of apparen'.

~ disagreement between'the Staff and_the Licensee on requirements

.to be met before restart.

A p'rincipal item of disagreement, which apparently has not yet been resolved judging-from an exchange of correspondence and the Staff's Supplement No. 1 to NUREG-0752, is.the provision of a backup display capability for the in-core thermocouples.

Licensee's proposal is to utilize cc.nputer readout as the primary display capability, while relying upon an operator utilizing portable test equipmsnt as the backup capability (Licensee Ex. 33, at 1; NRC Staff Ex. 15, at-11).

The Staff found the backup capab.ility to be unacceptable for four reasons:

(a) in-core thermocouple information is relied upon in Licensee's inadequate core cooJing procedures, (b) a similar system was shown to be inadequate during the TMI-2 accident, (c) the vintage of the present computer raises questions about the reliability of the information displays, and (d) the proposed backup system represents a poor human factors interface during stressful situations (NRC Staff Ex. 15, at 11-12).

155.

To correct this problem, the Staff proposed requiring data logging or recording equipment displays capable of displaying tem ^erature information from a mininium of 16 operable thermocouples (4 from each core quadrant) on demand l

in the control room.

The power source for this system should.

+

a

'w' r

I;D L.

.t.

}y be. independent.of.the CRT power supplies to assure redundance and reliability of displays, according to the Staff.

The Staff would also. require that this backup system be. operational before escalation beyond 5% power.(NRC Staff Ex. 15, at.ll-12).

-The. Board agrees with the Staff, and will requ re such a.

i systemito' tun operational before.the Licensee is permitted to' exceed.5% of rated power.

The alternative offered by the Licensee is not sufficiently reliable to perform this important -function, especially when it will be required-under circumstances when time may be of the essence in halting or mitigating inadequate core cooling.

156.

There are other areas of disagreement between the Staff and the Licensee which relate to the performance of the so-called." detailed control room design review" (DCRDR) by the Licensee.

It is apparently the Lic,ensee's position that Licensee Exhibit 23 represents its DCRDR; the Staff's position on this is not clear, but it is clear, in any event, that the Staff has not reviewed Licensee's report and does not intend to do so prior to restart (NRC Staff Ex. 15, at 5).

Regardless of the outcome of this matter,.the Board requires that the Licensee review and resolve the following matters which were identified in the Staff's control room design

-review: (a) the Licensee shall investigate systems and techniques.for effective communication of indicator and display: lamp status information to operators where " push-to-test"' capability does not already exist (this investigation shall be completed no later than by the end of the first 6

. refueling outage following restart) (NRC Staff Ex. 15, at.2); and Il 1

(b); Licensee will premanently mark final operating ranges on

'all' applicable vertical meters by-the end of the first refueling outage following restart (NRC Staf f Ex. 15, at 5-6).

157.

The' Board is concerned in particular with several areas related to the design of the TMI-1 control room and will require that these issues be resolved as indicated..The first such concern relates to the alarm and' annunciator system at

. TMI-l'.

The Board's concern in thic matter relates to the fact that once an alarm is acknowleuged, it is indistinguishable from previously acknowledged alarms (Tr. 10,496, Ramirez).

,The Licensee is committed to an investigation of an alarm suppression system.which would supprecs alarms under conditions in which the alarms are meaningless (Tr. 10,254-55, Estrada).

In the interim, Licensee will accomplish the goal of ensuring that operators understand alarms prior to acknowledging them by procedural changes-(Tr. 10,465, Price).

Although the Staff approved this approach, neither NRC Staff witness Ramirez or Price had seen the new procedure, and witness Ramirez indicated that this would be left to I&E to verify implementation of the new procedure (Tr. 10, 4 6 5-6 6, Ramirez & Price).

NRC C%aff witness' Price testified that the procedural change should take the form'of a caution to the operations to clearly identify which annunciators are flashing and understand what these alarms mean before acknowledgement of. the alarms.

Price and

^

Ramirez testified that for the short term, operator awareness

.ofLthe problem, combined with the new procedure and some level

-1 1

,I

~

e 4

I prioritization of alarms by level of importance, will be sufficient (Tr. 10,466-68, Price & Ramirez).

Prioritization of alarms :. rill be in place at re' start (Tr. 10,468, Ramirez).

The Board is concerned, however, about what would happen in the event of a large number of alarms coming in in a short time period.

The Board recognizes that there are much fewer alarms at TMI-l as compared with TMI-2 and other plants (350 alarms as opposed'to 700-1,000 alarms) (Licensee Ex.

23, at III-ll),. but remains concerned because neither Staff witness evaluated the numners and types of alarms that annunciated during the TMI-2 accident to determine whether it would have been possible under such circumstances to

~

understand the signficance of the alarms before acknowledging the alarms (Tr. 10,469, Ramirez).

The Board therefore requires that the Licensee complete its evaluation of alarm acknowledge-men't alternatives before the end of the first refueling outage following restart.

It is the Board's view that this requirement gives Licensee sufficient flexibility to address the problem, while at the same time recognizing the importance of resolving this issue as expeditiously as possible.

The Staff is directed to satisfy itself that the Licensee is making reasonable l

pc;gress toward satisfying this requirement as a condition l

of restart.

In this context, reasonable progress would be j

l initiation of the study, together with a full description of I

the study and a projected date for completion and recommendations from the review.

t !

m e

e

j A second area of concern relates to communications 158.

+

p'oblems at the facility.

Inoperable plant.page system phonec r

was noted in the Staff's Control Rocm Design Review Report as a problem at TMI-1; the Staff further noted that some areas

~

in the plant are not reachable by telephone (NRC Staff Ex. 2, Licensee's control room design report acknowledges at 19-20).

this problem, and also concludes that messages of importance to the plant might be lost in the noise of general adminis-The Licensee is trative traffic (Licensee Ex. 23, at D,'l-2).

investigating a new page system designed to keep general administrative traffic out of the control room, restricting control room communications to operational traffic only

~

(Tr. 10,265-66, Walsh).

One of the Licensee's human factors recommended that the Licensee establish

~

consultants (Estrada) a closed 2-way communications circuit between the control room and auxiliary operators (Tr. 10,268, Estrada).

A similar recommendation is made in the Licensee's control room design report (Licensee Ex.

2',

at D,

2).

I The Board is not convinced that the Licensee 159.

A

-is giving a sufficiently high priority to this problem.

Staff human factors witness testified that communications between the control room and remote areas are important to the safety of the plant (Tr. 10,478-79, Ramirez).

The Staff witness e

knew of no specific program of the Licensee to deal with ha

. inoperable page-phones, although he testified that suc 10,477, Ramirez).

The program should be implemented (Tr.

l Board itself noted problems with the page phone system during

' l

~

e

,m,

.s

.gy.4 e

,av

'l a-site 1 visit. held prior to the start of the' evidentiary phase I'

of this proceeding, mostly relating to nuisance usage of the paging system.

The Board concludes that this-is a serious problem which must be alleviated expeditiously.

The Board requires that the Licensee promptly' initiate its communications study (if not already. initiated) and complete this study as

.soon as practicable, before restart if at all possible.

If this is not possible, the Licensee is directed to inform the Staff at the earliest possible time, following'which the Staff

'will undertake a review to determine if and under what conditions any operr21er.s involving safety-related equipment require the establishment of communications between the control room and-a remote location.

If the-Staff determines that there are circumstances under which'such communication with the control room is necessary, the Staff shall so inform the Licensee and the Licensee shall make such improvements as are necessary tc create a highly reliable communications system for use in plant operations.

Such improvements must be made, if required, prior to restart.

160.

A third area of concern relates to the possible use of video and audio taping in the control room.

Licensee is investigating the use of a video recorder and/or audio i

recorder in the control room.

Licensee acknowledged that the use of audio / video taping in the control room, perhaps keyed to reactor / turbine trip annunciation, would be "an L

L extremely-valuoble tool" in analyzing operator response to accidents.and transients, and would also be useful in evaluating l.

E&

• s e

-er

- r we--e+

p y,.

,r

r..

-human-factors considerations associated with accidents'and

~

transients (Tr. 10,271,J alsh).

The Board recognizes the W

- implications that video / audio taping in'the control room would have for the operations personnel,.and is sympathetic

. to considerations of a " big: brother" atmosphere in the control The Board,.however, considers the manifest public interest room.

in the safe operation of the plant to take clear precedence in this case, and finds that the. benefits in terms of.

protecting the public health and safety' exceed the risks of.such a' program.- The Board considers the use of video-taping-in the control room to be analogous to the use of. flight recorders and the so-called " black box" recorder on commercial aircraft.

The responsibility for safe operation of a nuclear

~

power plant is a heavy burden to_ bear, and the public is entitled to know, in the event of an accident, precisely what occurred to the extent that this is possible to know.

The Board is convinced that had there been a video-taping system present in the TMI-2 control room during the TMI-2 accident, our knowledge of what happened during the first hours of the accident would have been greatly enhanced.

For example, it would be abundantly clear who utilized the plant computer, and when it was utilized.

The Board is also certain that. replay of such video tapes would have facilitated operator recall of information and events of that morning.

As a result of these considerations, the Board is requiring that, prior to restart, the Licensee install a video-taping

- system in the TMI-1 control room.

The vid-m-taping system p

~

should be activated.under appropriate conditions automatically, for instance,.upon receipt of a reactor or turbine trip signal These and2orcontainmentisol'ationorESFASinitiation.

details, as.well as the number and location of cameras shall ff and Im worked out jointly.by the NRC's human factors sta i.

the Licensee's staff. -The Staff should discuss with-the Licensee the necessity.for entering into any agreements concerning.the use:of the video tapes, especially to ensure-

that:they are not misused; the Staff.must, however, be assured of rapid access to the_ tapes following an_ accident or transient where the analysis of :nch tapes would assist in the evaluation of the' accident or transient.

161.

In its human factors review report for TMI-1, the Licensee's review team made many recommendations for changes in physical equipment and procedures related to the' So'.e of the recommendations relate to additional control room.

studies which might require on the order of years to complete and implement recommendations which may result'from such studies.

Other recommendations are for changes which can be effectively implemented in a short period of time, many The Staff, through a combination of the Office before restart.

of. Inspection and Enforcement and the Division of Human Factors Safety, is directed to closely monitor Licensee's progress in this area.

A final pre-restart report on the status of Licensee's: implementation of modifications to the TMI-l control room should be prepared by the Staff and published f-to document which changes have been completed, which changes

- L o

a

,yy,,.%.,

,g.

+,

might be-delayed (along with explanations for the delay and a projected implementation schedule), and changes which require further' evaluation on the part of the Licensee and/or the Staff.

The Licensee is directed to provide whatever information

-is required.by.the Staff in preparing this report.

162.

As a. result of the modifications which are underway and which will be' occurring for some time into the future as a result of ongoing studies, the Licensee is required to periodically document the status of his control room upgrading The Licensee shall propose modifications to his program.

Technical Specifications to incorporate a reporting requirement on this matter, with the first report from the Licensee to the Staff due no later than six months after reaching full power foilowing restart.

The reports shall follow at six month intervals until the modifications contemplated in the Licensee's control room design review report are completed.

163.

The Staff, through the Office of Inspection and Enforcement and the Division of Human Factors Safety, shall inspect Licensee's facility prior to restart to ascertain 7

Licensee's progress in meeting the following commitments which were made during these proceedings:

a.

New labelling will be added to panels 1

to avoid interchanging legend switch covers (NRC Staff Ex. 15, at 3).

b.

Additional training regarding Bailey controllers for licensed operators (NRC Staff Ex. 15, at 3-4).

i,

i

?G i

u J

I Normal operating ranges.on vertical ~ meters c.

will.be temporarily marked-(NRC Staff Ex. 15,

' at'5-8).-

- d.

Alarm system audible tones will be adjusted so-that each such tone is clearly. audible-and distinguishable above normal control

' room background noise,"and so that operators can communicate with one another while' the tone is sounding (NRC-Staff Ex. 15, at=6-7).

Communications at the remote shutdown

- e.

- panel shall be improved to be independent of both the main control room and the relay room (NRC Staff Ex. 15, at 9).

f.

Lighting deficiencies will be corrected (NRC Staff Ex. 15, at 10).

g.

Important alarms will be color coded and ESFAS alarm tiles will be improved (NRC Starf Ex. 2, at 6).

h.

Annunciator tile legends will be improved i.

(NRC Staf f Ex. 2, at 7).

i.

A new CRT display system will be installed and operational in the control room (NRC Staff Ex.

2, at 7).

j.

A new printer will be installed to improve the speed of computer printout (NRC Staff Ex.

2, at 7).

k.

A guard rail or alternative means will be..

t

+

k w

g g

e p

-.e e

'provided to prevent inadvertent actuation'of I

"J" handle controls (NRC Staff'Ex. 2, at 7).

Improved label. ling for mult'iple position 1.

rotary controls will be implemented to compensate for violation of convention s.

with respect to other such controls (NRC Staff Ex. 2, at 8).

A formal surveillance program will be m.

initiated to detect'and replace burned out indicator lamps promptly (NRC Staff Ex. 2, at 8)..

Improved labelling will be installed on n.

i illuminated legend switches which will on information lessen operater dependenca contained on illuminated legends (NRC Staff

~

Ex. 2, at 9).

Emergency feedwater-flowmeters will be o.

installed near the Bailey controllets and backup controllers (NRC Staff Ex.

2,-

at 9).

Panel legend lights will be adjusted and p.

replaced to provide consistent illumination and improve the contrast with the panel at 10).

background (NRC Staff Ex. 2, Glare will be reduced by installation q.

of light baf fles (or alternatives) and by installation of glare-resistant label (NRC Staff Ex.

2, at 10).

plates a

t

h

.1 e.

2 A. system of. annunciators and indicators r.

P to-signal upsets in power supplies to the ICS and NNI control systems will be installed, and a distinctive-mark will be placed on-instruments 4 to identify the mid-scale point to assist operators in identifying instrument failures (NRC Staff Ex. 2, at 10).

For certain motor driven valves', a second s.

independently powered position indicator will be-installed to show valve position after the circuit breaker for:the valve is tripped (NRC Staff Ex.

2, at 11).

t.

Color coding will be reviewed to assure consistency (NRC Staff Ex. 2, at 11).

A hierarchial scheme of labelling will u.

be instituted to improve labelling, at the group, function, system or panel level rather than just at the component level (NRC Staff Ex.

2, at 11).

Makeshift "dymo" tape labels will be v.

replaced with permanent label plates with consistent color coding and letter size (NRC Staff Ex.

2, at 12).

All labels will be permanently attached w.

(NRC Staff Ex.

2, at 12)

Demarcation will be added to-panels to separate controls / displays by system,

' n.

4

,.y

.g g

-9._

~

t subsystem and. functional grouping-(NRC Staff Ex.;2, at 12).

Related controls and displays-will

-y.

be reviewed to assure that consistent nomenclature and component designation are used (NRC Staff Ex. - 2, at 13).

Labelling and' demarcation of the makeup z.

and purification system will;be implemented to clearly distinguish the two control / display segments-(NRC Staff Ex. 2, at 13).

Operators will be' trained to observe flow

-aa.

transients when makeup pumps are started (NRC Staf f Ex. 2, at 13).

The Engineered Safeguards actuation annun-bb.

ciator window will be clearly labelled (NRC Staff Ex. 2, at 14).

Meter scales for the decay heat removal cc.

system will be changed to make them consistent with one another (NRC Staff Ex. 2, at 15).

The decay heat removal system will be dd.

mimicked and the connection between the DHRS and makeup systems will be clearly indicated (NRC Staff Ex. 2, at 15).

Control room ventilation controls and ce.

displays will be functionally grouped by demarcation and new labels (NRC Staff

, i.

m, i

_! - 1 Ex.-2, at.15).

Labels for the fan start controls will be ff.

improved

' adding." time to depress and hold" infor0& tion (NRC Staff Ex. 2, at 16).

Diesel generator control and indication gg..

displays will be improved with new labels and white-indicator lights (NRC Staff Ex. 2, at 17).

A flow meter for the emergency feedwater hh.

system will be installed (NRC Staff Ex.

2, at 17).

Improve labelling, color coding, and demarking ii.-

of the ICS controls and displays will be implemented (NRC Staff Ex.

2, at 18).

j].

Emergency lighting will be provided at 5"

the emergency shutdown panel (NRC Staff Ex.,

2, at 18).

Sub-cooling margin instrumentation and kk.

displays will be installed and operating (NRC Staff Ex. 2, at 22).

All control room modifications will be 11.

reviewed by an in-house human factors engineering staff; procedures will be implenented (Tr. 10,252, Walsh).

.The following items listed in Licensee mm.

Ex. 33, at 3, will be implemented: 1-5, 7-9, 11-13, 17-22, 29-31, and 34 (these '

~

1r

~~

e 4.

items are identified in Licensee's Ex. 23, Table III-1, page-III-25).

The above items are'those to which Licensee has-committed to

~

There are many other items which implement prior to restart.

have a later implementation date.

The Staff and Licensee are required to' identify'these in,the reports required by this decision and'the Staff is required to monitor Licensee's progress toward achieving these additional improvements.

V.

CONCLUSIONS OF' LAW 164.

The general rule established by 10 C.F.R. 52.732 is equally applicable in this case.

The Licensee, in proposing to-restart TMI-1, clearly has the burden of proof in this

. proceeding Sor issues specified in the Commission's Order and Notice of Hearing.. Metropolitan Edison Company (Three Mile Island Nuclear Station, Unit No. 1), CLI-79-8, 10 N.R.C 141 (1979).

165.

The Commission's Order and Notice of Hearing (10 N.R.C. 141, 148, (1979)) mandated that the Board consider the necessity and sufficiency of the short-term and long-term requirements set forth in the Commission's Order.

Where i

intervenors have raised issues which were not specifically identified in the Commission's Order and Notice of Hearing, b

a burden to. establish a threshold case rests with the proponent of'an-issue.

Once, however, this threshold is established, the i

s..

A.

I burden of proof 111es cleaily with the Licensee.

166.

Absent some special. statutory standard of proof, factual issues-decided by.the Commission are determined by a

-proponderance of the evidence.

Tennessee valley Authority

'(Hartsville Nuclear Plant, Units lA, 2A, 1B,.and 2B), ALAB-463, 7 N.R.C. 341, 343, 360 (1978); Charlton v. FTC, 543 F.2d 903, 907 (D.C. Cir. 1976); Duke Power Company _ (Catawba Nuclear Station, Units 1 and 2), ALAB-355, 4 N.R.C.

397, 405, n. 19 (1976); Consclidated Edison Company (Indian Point Station, Unit No. 2),. ALAB-18 8, 7 A.E.C. 323, 356-57 (1974).

167.

In accordance with Commission Order CLI-79-8, and based-on the evidence of record in this proceeding and the foregoing findings of fact related to plant design issues, the Board concludes:

That the "short-term actions" Tecommended a.

by the Director of Nuclear Reactor Regulation are insufficient to provide reasonable assurance that TMI-1 can be operated without endangering the public health and safety; and b.

That the "long-term actions" tacommended by the Director of Nuclear Reactor Regulation are insufficient to provide reasonable assurance L

that TMI-1 can be operated for the long term without endangering the public health and safety.

168.

The Board concludes that additional short-term actions and long-term actions are.necessary to provide reasonable.

G

ro[

]...

s assurance that'TMI-1 can'be operated'without endangering the

-public health =and1 safety.

The Boa $d concludes that.the following additional 169.

short-term actions are necessary to provide reasonable assurance that TMI-1 can be operated wit,hout endangering the oublic health and'safetyr An acceptable failure modes and effects a.

analysis must be completed on the Integrated Control System.

The Board finds, however,

~than an FMEA is an inappropriate analytical tool for the purposes proposed, and therefore-concludes that fault tree analysis should be utilized in combination with-the FMEA.

The analysis of the ICS shall include random multiple' failures, single and multiple failures at any power level.from zero power through and including the high power level trip-setpoint, propogation of single and multiple failures through the ICS to other' (beth safety and nonsafety systems),

systems operator error (both singly and in combination with other single and multiple failures, especially in situations where operator error probabilities are increesed due to short response time, stressful conditions, and/or

' lack of normal instrumentation), and failures (both single and multiple) occurring under b---

m

k v,_

i

-abnormal initial conditions (such as odd

~

valve' alignment), and.under conditions of permitted' but not norma'l full-power aperation

~

.(such as: with ICS contro11ers Jin mancal, operation wi,h'3 RCP's, or operation with t

only one main feedwater pump).

Specifically,

this analysis must include a fault tree for the loss of feedwater event, including If this both main and emergency feedwater.

fault tree discloses-inacceptable consequences,

.other fault trees should be completed to analyze a range of' failures in which the ICS is capable of participating.

The Licensee must either replace'the Model 721' b.

ICS with a Model 820 ICS or modify its existing Model 721 ICS to increase its reliability into a range (in terms of failure rates) comparable with'the failure-rates'for the If Licensee elects to modify

~

Model 820 ICS.

the analysis required the Model 721 ICS, above at "a" must reflecc the modified system.

Licensee must satisfactorily and completely c.

respond to IE Bulletin 79-27 by submitting i

orocedures which specifica1.'y address NNI/ICS

' power failures and operator actions following such power failures to assure that there is sitfficient instrumentation presenting reliable i

r 4

g-e n,-#

.w y

r y

- +,

, - ~ - -

c.

G O-information with which to make control e

These procedures must carry decisions.

4 through to safe shutdown.

~

4 detailed report

(.

. Licensee shall' submit d.

~

In particular, on ICS/NNI power supplies.

r.

the report should address the. probability of failure, the reliability of the power supply compared to Class.lE standards, the extent to which the power supply system has bc.n " channelized", and the effects of power failures to ICS/NNI on instrument and data-availability.-

Licensee shall either staff the plant at s

e.

all times with at least one qualified Instru-nentation and Control Technician (I&C Technician) or demonstrate specifically why such staffing m :..

If Licensee elects to do is not needed.

the latter, Licensee shall address the I&C' capabilities of existing onsite staff on to which procedures all shifts, the extent and/or training compensate for the lack of an onshift I&C Technician, and shall demonstrate ower does not that extended loss of NNI/ICS e lead to unacceptable consequences.

Licensee shall submit a report addressing f.

i its; capability to effect immediate repa rs f'

including power failure problems, of NNI/ICS, q,

~

' s. w f'

i

. w

~

a ;.

- 7:

^

i

~

~

and shall add'ress,_among otherLitems which may be.necessary, the availability of

~

replacement. parts'and components'onsite.*

Licensee shall install and make: operational:

q L

g.

. - a' safety-grade'high radiation signal on the r

4 reactor building purge sys em,. to provida t

for-automatic-isolation of this line upon

- receipt of a'high radiation signal from.

't'his system..

h.

The Licensee shall establish a schedule-for completing the upgrading of its computer facilities as set forth in Finding.No. 135.

i.

The Licensee shall establish a reliability'

' monitoring program for the computer as set

'forth in Finding No. 136.

j.

The Licensee shall assure a. reliable power

• supply,for. the process computer as set forth in Finding No. 138.

k '.

Licensee shall implement a backup display

+

capability for cata from the in-core 155.

thernocouples as set forth in Finding No.

l.

. Licensee'shall complete its evaluation of in-plant communications as set forth in Finding'No. 159.

Licensee'shall install a video-taping system

~

m.

in the. plant control room as set forth in s,. c

. Finding No. 160.

1. ~

~

T '

~

E'*

+

w

-. -. ~.

.,. ~ _..,,,, _,, _, _, _

ir

!j The Licensee shall complete the short-term n.

upgrade of its control room as set forth in

. Finding No. 163.

Licenses shall perform such analyses as o.

r are necessary;to assure that the pressurized thermal shock problem as set forth'in Findings Nos. 70-84 is. resolved.

Licensee shall propose for Staff approval 1.

certain

. (approval required before restart)

F modifications to the license Technical Specifications, including:

(1)

Reporting requirements on ICS and NNI/ICS power supply failures.

(2)

Reporting requirements on feedwater oscillations.

(3)

Reporting requirements on feedwater transients which result in EFW, ECCS, or safety valve actuations.

(4)

Testing and surveillance requirements for the ICS and associated annunciators.

(5)

Reporting requirements related to forth in the plant computer as set Findings Nos. 135-138.

The Board concludes that the following additional 170.

long-term actions are necessary to provide reasonable assurance that:TMI-l_can be operated for the long term without' endangering the public health and safety, and should be required of the 90-0 g

>M:-,,.

,+

w4-

.y

7 practicable.(or under the specific j

. Licensee as soon as schedule as indicated):-

Licensee shall complete the. upgrading of a.

the TMI-1 control room.

Licensee sha,11 complete the upgrading of b.

the process computer.

Licensee shall install a replica control c.

room simulator as soon as possible (Licensee indicates that this'should be possible by 1985).

The Board concludes that the long-term item 171.

on the Integrated Control System (long-term item No. 1, 10 N.R.C. 141, at 145 (1978)) shall be incorporated as

-a short-term' item and shall be removed as a long-term item.

In accordance with Commission Order CLI-79-8 172.

and ba' sed on the evidence of record in this proceeding and the foregoing findings of fact and conclusions of law, the Board concludes that the record does not support a finding of reasonable assurance that TMI-l can be operated, either for the short-term or the long-term, without endangering Unless and until the short-term the public health and safety.

and long-term actions required of the Licensee by this decision are complied with fully, Licensee is hereby ordered to maintain TMI-l in a cold shutdown condition..

Upon motion by the Licensee, this Board will 173.

. consider a further request by the Licensee for permission to restart TMI-1 upon a' showing that the requirements imposed l l

)

,.?

g yy

e, s.

in this decision have been met.

The Board recommends to the Commission that if 174.

by which it will-the Lihensee cannot provide a projected dats lier-cchieve compliance with these requirements which'is ear

~

issued requiring.

than July 1, 1982, that a show cause order be f

l d'and Licensee to show cause why'TMI-1 should not be de ue e health

-decontaminated to eliminate any risk to the public cnd' safety from the continued status of the plant in a Jrefueled but cold shutdown-condition.

RESPECTFULLY SUBMITTED, DATED:. June 1, 1981 h4 NN9.ATV Steven C. Sholly entists Union of Concerned 1725 I Street, N.W.

Euite 601 20006 Washington, D.C.

L

...i l

- e a

,y

~

i l

4.

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION J

BOARD _

i BEFORE THE ATOMIC SAFLTY AND LICENSING 4

e

)

In th2 Matter of-

)

Docket No.'50-289

.i I

)

METROPOLITAN EDISON COMPANY (RESTART)

)-

)

(Thrce Mile Island Nuclear

)

Stttion, Unit'No. 1)

CERTIFICATE OF SERVICE f INTERVENOR I hereby certify that single copies oAND CONCLUSIONS S1EVEN C. SHOLLY PROPOSED FINDINGS OF FACT 1, 1981, were OF LAW ON PLANT DESIGN ISSUES, dated June vice list cerved upon those persons on the attached serby d

prepaid, firct class, this 1st day of June 1981.kCd

~

j/

f Steven C. Sholly i.a... ;

t e

J e'

e w $

--ese -e eemeu[

M.. 6, SERVICE LTST Docket No. 50-289-TMI-l Restart, Robert W. Adler, Esquire Ivan W. Smith, Esquire

' Attorney for the Commonwealth.

of. Pennsylvania Chairman 505 Executive House j

Adminictrative Judge Stomic Safety and Licensing P.O. Box 2357 17120 Botrd Panel Harrisburg, PA 3

U.S. Nuclear Regulatory John A. Levin, Esquire

.C mmission 20555 Assistant Counsel

.W2chington, D.C..

Pennsylvania Public Utility Commission

.Dr. Walter H. Jordan P.O. Box 3265 Administrative Judge 17120 Attmic Safety and Licensing Harrisburg, PA Bocrd Panel f881 Wast Outer Drive Walter W. Cohen,-Esquire Consumer Advocate 37830 Oak Ridge, TN Office of Consumer Advocate Dr. Linda W. Little 14th Floor, Strawberry Square 17127 Harrisburg, PA Administrative Judge Atomic Safety and kicensing

, Thomas J.. Germine, EsquireDeputy Attorney Ge Bocrd Panel 5000 Hermitage Dri've 27612 the State of New Jersey Reicigh, NC Division of Law - Room 316 Jcmeo R. Tourtellotte, Esquire 1100 Raymond Boulevard Counsel for the NRC Staff Newark, NJ 07102 I

Office of the Executive Legal Director Daniel J. Cosgrove, Esquire U.S.. Nuclear Regulatory Counsel for the Federal Emergency Management Agency Office of the General Counsel Commission 20555 WOchington, D.C.

N.W.

1725 I Street, 20472 George F. Trowbridge, Esquire Washington, D.C.

Counsel for Metropolitan Edison John E. Minnich Shaw Pittman Potts & Trowbridge Company Chairman Dauphin County Beard of N.W.

1800 M Street, 20036 Commissioners Wechington, D.C.

Dauphin County Courthouse Docketing and Service Section Front and Market Streets 17101

Office of the Secretary Harrisburg, PA

,U.S..Muclear Regulatory Commission 20555 WOchington, D.C.

d y

n~g -

I c 0

C Jordan D. Cunningham,-Esquire Marvin I. Lewis

-Counsel for Newberry Township

.TMI Steering Committee

-Intervenor pro se Fox Farr~s cunningham 6504.Bradford Terrace 2320 North Second Street Philadelphia, PA 19149 Harrisburg, PA 17110 Marjorie M. Aamodt Ms.. Louise Bradford Intervenor pro se.

R.D.

1. 5

~-~

Legal Representative for Coatesville, PA 19320 Three Mile Island Alert, Inc.

315 Peffer Street Harrisburg,.PA 17102 Dr. Judith 9. Johnsrud Legal Representative for Ellyn R. Weiss, Esquire Environmental Coalition Counsel for the Union of on. Nuclear. Power Concerned Scientists 433 Orlando Avenue-Harmon & Weiss State College, PA 16801 1725 I Street, ii.W.

Suite 506 William S. Jordan, III, Esquire Washington, D.C.

20006 Counsel'for People Against-Nuclear Energy Ms. Gail Bradford Harmon & Weiss Legal Representative for 1725 I Street, N.W.

Suite 506 Anti-Nuclear Group Representing York Washington, D.C.

20006

'245 West Philadelphia Street York, PA 17404 Robert Q. Pollard p ~'

Legal Representative for Chesapeake Energy Alliance 609 Montpelier Street Baltimore, MD 21218 i

(

Indicates hand delivery.

' Re