ML20049J433

Brief on Exceptions to 811214 Partial Initial Decision

ML20049J433
Person / Time
Site:	Crane
Issue date:	03/12/1982
From:	Weiss E HARMON & WEISS, UNION OF CONCERNED SCIENTISTS
To:	NRC ATOMIC SAFETY & LICENSING APPEAL PANEL (ASLAP)
Shared Package
ML20049J434	List: ML20049J433 ML20049J437
References
NUDOCS 8203180189
Download: ML20049J433 (64)

Text

.

~

C 0( M.7 E TTO.

n UNITED STATES OF AMERICA

+82 M 15 fjl :07 NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING APPEAL BOARD-

~

In the Matter of

)

)

METROPOLITAN EDISON COMPANY

)

Docket No. 50-289

)

(Restart)

(Three Mile Island Nuclear

)

Station, Unit No. 1)

)

UNION OF CONCERNED SCIENTISTS' BRIEF ON EXCEPTIONS TO THE PARTIAL INITIAL DECISION OF DECEMBER 14, 1981 Introduction For each of the UCS contentions covered by the following exceptions, UCS prepared detailed proposed findings of fact and reply findings which track the evidentiary record.

It is virtually impossible to understand the nature of the technical issues and thus of our exceptions other than in the context of those proposed findings.

Nor does it seem productive to UCS to reiterate those findings in detail in this brief since they can be best understood in the original versions which are complete and, in our view, largely comprehensive.

In addition, it is our expectation that the Appeal Board, in fulfillment of its obligation to review the entire record, would in any case give particular attention to the proposed findings.

Therefore, this portion of the brief has been prepared to be read in conjunction with the UCS proposed findings, assumes that the reader is familiar 1

with these and makes liberal reference +^ }[--

A. UCS Contentions 1 and 2 Exceptions 1-15 JP

/zp 9

PID 600-629 DO UCS Prcir, sed Findings 1-3' UCS Reply Findings 10-58

!C 2*7g j0 8203180189 820312 h

PDR ADOCK 05000289 fdl 0

PDR

'b

O

- Summary UCS purcued two contentions asserting that natural circulation cooling at WI is inadequate to remove decay heat and that reliable forced cooling should be provided by systems which meet the Commission's regulations applicable to systems important to safety.

UCS CONTENTION NO. 1 The accident at Bree Mile Island Unit 2 demonstrated that reliance on natural circulation to remove decay heat is inadequate.

During the accident, it was necessary to operate at least one reactor coolant pump to provide forced cooling of the fuel.

However, neither the short nor long term sneasures would provide a reliable method for forced cooling of the the reactor in the event of a small loss-of-coolant accident ("LOCA").

Bis is a threat to health and safety and a violation of both General Design Criterion

("GDC") 34 and GDC 35 of 10 CFR Part 50. Appendix A.

UCS CONTENTION NO. 2 Using existing equipment at THI-1, there are only 3 ways of providing forced cooling of the reactor: 1) the reactor coolant pumps; 2) the residual heat removal system; and 3) the emergency core cooling system in a " bleed and feed" mode.

None of these methods meets the NRC's regulations applicable to systems important to safety and is sufficiently reliable to protect public health and safety:

a) The reactor coolant pumps do not have an on-site power supply (GDC 17), their controls do not meet IEEE 279 (10 CFR 50.55a(h) and they are not seismically and environmentally qualified (GDC 2 and 4).

b) The residual heat removal systera is incapable of being utilized at the design pressure of the primary system.

c) The emergency core cooling system cannot be operated in the bleed and feed mode for the necessary period of time because of inadequate capacity and radiation shielding for the storage of the radioactive water blod from the primary coolant system.

In essence, UCS claimed that the experience of the TMI accident, during which adequate core cooling was established only by operation of the non-safety grade reactor coolant pumps and the residual heat removal system could not be used, showed the need for a reliable, sa fety-grade system to provide forced circulation to remove decay heat.

While finding that voiding would interrupt natural circ'ulation for the majority of small-break LOCA's, the Board concluded, contrary to the UCS contentions, that the THI-2 accident did not show a problem in reliance on i

l

o natural circulation to remove decay heat. (PID 611,617,618)

This conclusion largely ignores all of the evidence presented by UCS concerning the sequence of events which occurred at 1NI-2 and is based upon two primary and in our view, incorrect premises: 1) that, after liquid natural circulation is interrupted, a two phase mode of natural circulation known as the " boiler-condenser" mode will be established which is sufficient to remove decay heat so long as the emergency feedwater system ("EFW") is available; or 2) if EFW is unavailable, decay heat can be reliably removed by the so-call'ed bleed-and-reed cooling mode. (PID 619)

These premises a're incorrect because, inter alia: the steam void collected in the U-bend will not condense without operation of the reactor coolant pumps and cannot be removed other than by use of the nonexistent hot leg high-point vents; post-THI-2 operator procedures call for immediate refilling of the primary system, thus removing the necessary condensing surface for the two-phase i

or boiler-condenser mode (UCS RF 49-50); and bleed and feed is an untested, unverified cooling mode which depends on operator action and a complex decision process and cannot proceed to cold shutdown (PID 757).

Exceptions:

1. The Board err,ed in failing to confront and adequately consider evidence and UCS proposed findings demonstrating that all of the cooling modes available at TMI-2 during the accident were ineffective.

2. The Board erred in failing to confront and adequately consider evidence and findings demonstrating that the only way in which the primary coolant circulation necessary to core cooling was established during the TMI-2 accident was by startup of a reactor coolant pump.

12. The Board erred in giving significant weight to the testimony of Licensee witnesses Keaten and Jon,es as it related to the phenomena that occurred during the THI-2 accident.

(PID 609,610).

The Board deals in two paragraphs (PID 609,610) with a great deal of L.

evidence presented by UCS cr cross-examination concerning the sequence of events

o

'. - during the THI-2 accident.

Indeed, virtually all of the use ful information regarding the accident was brought out during this cross-examination.

Despite this fact, the Board makes literally no mention of any of this evidence, which showed that adequate core cooling was established only after operation of the reactor coolant pumps, preferring to rely 'instead upon the concluscry and generally theoretical assertions of the Licensee's witnesses Keaten and Jones, who are asserted to be "both familiar with the accident at INI-2."

PID 609)

To deal with this point first, the record simply does not support a conclusion that Keaten and Jones were familiar in other than a very gel &ral way with the TMI-2 accident sequence insofar as it bears on the issue in question:

whether adequate core cooling was present or established during the accident until the reactor coolant ptanps were used.

Keaten was unaware of the extent to which attempts were made to start the pumps (RF 21 Tr.4611).

Indeed, the extent of Mr. Keaten's testimony on details of the accident sequence was merely to confirm that UCS Exhibit 1,

a detailed chart of plant behavior during the accident prepared by the Nuclear Safety Analysis Center, indicated the occurrence of certain events, but that he had not reviewed it in detail. (RF 21 Tr.4612-13)

Mr. Jones also relied on what he had heard concerning operator actions during the accident but did not know the basis for the operator's decisions. (RF 22 Tr.4650)

Neither can be called an expert on the accident sequence. In any case, when questioned as to the basis for their broadly-stated opinions, their testimony te7ded to establish the need for and reliance on the reactor coolant pumps rather than the contrary.

This evidence, apparently ignored by the Board is as follows:

During the 1NI-2 accident, forced cooling of the core was provided by operation of all four reactor coolant pumps from the start of the accident until about 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 13 minutes when two were shut off. The remaining two were shut off at approximately 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br /> and 40 minutes. (Tr. 4608 Keaten) At the time the

last two reactor coolant pumps were stopped, there was not sufficient liquid water in the primary system to establish two-phase natural circulation. (Tr.

4628 Jones; Tr. 4963, Jensen) The result was a period of core damage which was stopped by the closure of the PORV block valve and the resumed operation of a reactor coolant pump. (Tr. 4678-4680, Jones)

A second period of core damage about 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br /> and 45 minutes after the start of the accident was terminated by the initiation of maximum high pressure injection flow. (Tr. 4680-4681. Jones)

Liquid natural circulation did not become established during the THI-2 accident because steam or a mixture of steam and hydrogen was trapped in the 180 bend of the reactor coolant system hot legs at the top of the steam generators. (Tr. 4616-4617, Jones)

The boiler-condenser or two-phase mode of natural circulation was not established because the primary systen was being refilled, thereby raising the primary system level above the secondary coolant level in the steam generators, blocking the condensation of steam in primary system. (Tr. 4616, Jones)

In summary, in the period from four hours into the accident when maximum high pressure injection was initiated until sixteen hours, when a reactor coolant pump was started, liquid natural circulation was not established because of the void in the hot legs and two-phase circulation was not established because there was too much water in the primary system to expose a steam condensing surface in the steam generator tubes.

Under the conditions that prevailed from approximately 4 to 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> after the start of the accident, the only way to get natural circulation started was to start a reactor coolant pump. (Tr. 4617 Jones)

It is true that as the Board notes (PID 609), the Licensee's witnesses testified that after adequate high pressure injection flow was restored, subsequent to core damage, the core was effectively cooled even though natural L

circulation was not occurring. (Keaten and Jones, ff. Tr. 4588, at 8)

Under

- cross-examination, however, the witnesses testified that their attention had actually centered on the accident up to the time the last reactor coolant pump was initially turned off, at about one hour and forty minutes into the accidenu.

(Tr. 4605, Keaten)

These witnesses also testified, that for about the first three days following restart of one reactor coolant pump, natural circulation might not have been established if the pump had stopped because of the amount of noncondensible gas in the primary system. (Tr. 4654-4655, Keaten)

Finally, the witnesses testified that the first time following the start of the accident when adequate core cooling is known to have been established is at 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> when a reactor coolant pump was restarted. (Tr. 4655, Jones)

The Staff's witness testified that he did not know when adequate coolant inventory had been restored, and did not know when (whether days or months) natural circulation was restored. (Tr. 4942, 4954, 4963, Jensen)

He did not know, for all times after an adequate coolant inventory was restored, whether the 1NI-2 core was successfully cooled by natural circulation. (Tr. 4964-4966, Jensen) Furthermore, the Staff's witness testified that he did not know whether it was necessary to have started a reactor coolant pump to achieve adequate core cooling during the 1NI-2 accident.'(Tr. 4977-4978 Jensen)

Thus, the evidence shows that, as UCS claimed, the only way in which the primary coolant circulation necessary to core cooling was established during the l

THI-2 accident was by startup of a reactor coolant pump.

l Exceptions:

3. The Board erred in failing to consider that, after circulation is interrupted, as it will be for most SBLOCAs. heat removal from the primary system is dependent upon re-establishing primary coolant circulation.

I 4.

The Board erred in finding that the expected quantities of noncondensible gases should not interfere with natural circulation. (PID 619) l l

- 13. The Board erred in finding that steam voids formed in the RCS following a SBLOCA should be condensed as pressure is increased by I

operation of the HPI system. (PID 619)

The Board found that the THI-2 accident did not demonstrate an inadequacy with natural circulation, but rather demonstrated that " maintaining adequate reactor coolant system inventory is essential to adequate core cooling." (PID 611)

While it is true that adequate inventory is essential, this statement overlooks the fact that, after natural circulation is interrupted because c.'

void formation - as it will be for the majority of SBLOCA's (PF 13 RF 13) -

primary coolant circulation must be re-established.

The Board was simply incorrect in asserting that a steam void "should be compressed and condensed as the primary system pressure is increased by operation of the HPI system." (PID 619) The record is undisputed that the steam voids will not so condense. (RF 10-15, 57)

Licensee's witnesses conceded that the only way to re-establish liquid natural circulation is by operation of one ce more reactor coolant pumps which are not safety-grade or removing the void through hot leg high point vents, which have not been installed at 1NI-1.. ( RF 10-15, 34, 35.)

The Board is incorrect that the Crystal River, incident demonstrates condensing of the steam bubble through use of HPI.

At Crystal River, the reactor coolant pups were restarted. (PF 31. Tr. 4705-4706, Jones)

The Board also accepted the Staff's assertion that the " expected quantities" of non-condensible gases should not interfere with natural circulation. (PID 619i vihile citing some of the pertinent UCS proposed findings (PF 54-58), the Board did not respond to the points made therein.

First, the Staff's analysis is based entirely on the assumption that no significant core damage occurs. (PF 56. Tr. 4991-2)

In addition, some sources of gas were nct included. (PF 55, 56)

Thus, the record does not contain evidence showing that if core damage or operator error occurs, non-condensible gases will not also

- block coolant circulation. (Id). This void in the record does not work in favor of, but against the licensee, since it has the burden of proof in this proceeding.

Exceptions:

6. The Doard erred in ruling that the evidence supports a finding that the boiler-condenser mode of heat-removal meets the requirements of GDC 34 and GDC 35. (PID 621) 7 The Board erred in failing to confront evidence and UCS proposed findings demonstrating that the boiler-condenser mode is not sufficiently reliable because:

a) There is no method of determining primary system water level; b) Post-TMI-2 emergency procedures requiring immediate refilling of the primary system after a LOCA will preclude the establishment of a condensing surface on the primary side of the steam generator tubes; and c) The effectiveness of the boiler-c'andenser mode has not and will not be tested - none of the tests or " unplanned occurrences" duplicate the expected conditions following a SBLOCA.

The Board accepted the proposition that two-phase natural circulation or the boiler-condenser mode is a sufficiently reliable method of heat removal.

(PID 621-623)

In so doing, it totally failed to confront unrefuted evidence cited by UCS that post-TMI-2 procedures and directives would preclude establishment of the necessary condensing surface. (PF 28, RF 49, 50.)

We are, of course, aware that as the LOCA occurs, the water level in the primary side of the steam generators would fall, exposing temporarily a condensing surface.

However, post-TMI-2 emergency procedures direct the operator to immediately refill the primary system and not to terminate HPI until the reactor is subcooled.

Thus, continued operation of the HPI pumps will refill the primary system and block the condensing sur face, precluding boiler-condenser cooling.

(Id.) This mode of cooling is theoretical only.

There is absolutely no basis for the conclusion that the boiler-condenser mode meets GDC 34 and 35, which require redundant, single failure proof,

safety-grade systems for residual heat removal and emergency core cooling.

As noted above, plant procedures preclude its use.

In addition, in dismissing UCS's argument that the reliability of boiler-condenser has never been demonstrated (by stating that "some of the tests did not duplicate the expected conditions" following a SBLOCA (PID 621, emphasis added)] the Board seriously misstates the situation and fails to respond to overwhelming evidence showing that none of the tests or so-called " unplanned occurrences", duplicated these conditions. (PF 27, RF 00-47)

Indeed, the tests referred to were solely to verify the capability of the TMI-1 design for liquid or single-phase natural circulation. (RF 40. Tr. 4684-5, Jones)

Furthermore, there are no plans to test the boiler-condenser mode on a B&W plant because there is no instrumentation available to control either the secondary or primary water levels accurately and the reactor might therefore be damaged. (Tr. 4687-8, Jones)

In this context, the Board's citation of Tr.

4695-4696 at PID 621 is inexplicable.

The reference contains no information as to whether boiler-condenser is sufficiently reliable.

The most it can be cited for is opinion that the method can theoretically work under certain conditions

-- a proposition with which no one takes issue.

Operation of the boiler-condenser mode depends upon the emergency feedwater system which is not safety-grade, will not be safety-grade at restart, and has a probability of failure on the order of 10~

to 10-per reactor year. (PF 29 Wermiel and Curry, ff. Tr. 16,718 at 35, 37).

This further bolsters the inescapable conclusion that boiler-condenser cooling has not been shown to be sufficiently reliable to meet GDc 34 or 35.

Exceptions:

11. The Board misplaced the burden of proof by allowing reliance on the bleed-and-feed mode because it "has not been shown to be an unacceptable way of cooling the core." (PID 756)

9. The Board erred in failing (PID 626) to require proof that the

" extensive training and well-c'onceived procedures" required for use of the bleed-and-feed mode of cooling have been provided prior to restart. (PID 625)

~

10. The Board erred in ruling that the record supports a finding that the procedures and training necessary for reliance on bleed-and-feed can be provided. (PID 625)

The Board's acceptance of reliance on so-called bleed-and-feed cooling is central to the resolution of UCS Contentions 1 and 2 (and to Board Question 6 concerning the reliability of emergency feedwater)..

Bleed and feed is not only the sole remaining mode of cooling, it is asserted to be a necessary backup to emergency feedwater. (PID 623-624)

The evidence does not support a conclusion that feed-and-bleed can be relied on to meet the requirements of GDC-34 and GDC-35. (PF 30-35)

First of all, the Staff did not rely for its analyses or findings on heat removal using feed-and-bleed; the Staff relied on heat removal using the emergency feedwater system. (Tr. 5016, Jensen)

It never performed an anaylsis of the capability or reliability of feed and bleed cooling.

Thb February 26, 1980 accident at Crystal River was advanced by the Licensee and the Staff as an event which demonstrated the adequacy of feed-and-bleed cooling. (Jones, ff. Tr. 4589, at 3-4; Jensen, Natural Circulation, ff. Tr. 4913, at 9 - 10)

However, on cross-examination, it was established that natural circulation occurred during a y,on of the transient, feedwater was provided to one steam generator except foi s period of four to five minutes, a bubble was restored in the pressurizer probably by use of the pressurizer heaters, and the reactor coolant pumps were restarted. (Tr.

4705-4706, Jones)

It was also established under cross-examination that feed-and-bleed cooling was not required in this instance to cool the core because feedwater was restored within twenty minutes. (Tr. 5012, Jensen)

The most that can be concluded from this Crystal River accident is that water was fed into and bled from the reactor coolant system.

It cannot be concluded that this demonstrated the adequacy of feed-and-bleed to remove decay heat.

It is also highly significant that the feed-and-bleed mode cannot be used to achieve cold shutdown conditions using safety grade equipment because the primary system cannot be depressurized.

Bleen and feed depends on use of the safety valves which the operator cannot control. (Tr. 4984-4985. Jensen; Jones, ff. 4589, at 2)

Finally, a quantitative reliability assessment of the feed and bleed mode has not been performed. (Jones, ff. 4589, at 3)

Although the actions taken by the operator directly related to achieving feed-and-bleed are not complex, the combination of other actions which the operator must take during a LOCA and the decision process that must be followed is complex. (Tr. 4788-4840, Jones; Lic. Ex. 48, at 31.0)

The crucial nature of the operator's role in achieving and controlling cooling via bleed and feed i

introduced another clear element of unreliability.

In the face of all of this evidence, which the Board never refuted, two statements are offered: 1) that "the feed-and-bleed mode has not been shown to be an unacceptable way of cooling the core" (PID 756) and "the complete record as it stands today supports the conclusion that these [well-conceived]

procedures and (extensive] training [ required for bleed-and-feed] "can be provided." (PID 625, emphasis added)

No citation is offered to support the latter conclusion and we are at a loss to speculate as to where such support might be found.

UCS conducted extensive cross-examination concerning these procedures. (Tr. 4788-4840)

The Licensee's witness who had stated that the actions to be taken by the operator were not complex, had " scanned" some of the relevant procedures and not reviewed others at all. (Tr. 4793).

After detailed questioning on their content, he

stated that they might be incorrect. (Tr. 4803)

Most importantly, the questioning established that the operator actions required to initiate bleed and feed are just a small portion of the required operator actions during an inadequate core cooling event which include, inter alia, the need to properly diagnose the event. (See, e.g., Tr. 4808-4812)

Certainly the record does not support a finding that the training and procedures necessary to ensure that the approproate actions will be taken have been provided.

As to whether they "can" be provided -- the language used by the Board --

any conclusion is purely speculative and not supported in the record.

Nor can the hope that they can be provided in the future be used as the basis for authorizing restart of the plant today.

As to the former conclusion - that bleed and feed "has not been shown to be unacceptable"M - it manifests a fundamental misunderstanding of the burden of proof. The Licensee does not come to these hearings with a presumption that any of its assertions are correct.

Even if unchallenged, those assertions must be supported in the record.

However, in this case the assertions were strenuously challenged, as discussed above (PF 30-35), and the questions raised were not resolved.

Thus the Board must conclude that the Licensee has not met its burden of proving that bleed and feed is a sufficiently reliable mode of decay heat removal.

Exceptions 1

15. The Board erred in finding that the only concern about high radiation levels while using the feed and bleed mode in the proximity of the HPI piping to two motor control centers. (PID 627, 628) 1/ - UCS also believes.the Board's statement to be incorrect.

We believe that the record shows that bleed and feed is unacceptable because it is untested, relies on non-safety-grade equipment, and cannot be used to achieve cold shutdown.

- The Board failed to address whether the radiation shielding outside containment is adequate if the letdown line is used during an accident as is specified in the TMI-1 emergency procedure for inadequate core cooling.

(Lic.

1 Ex. 51, at 4.0, 5.0) This issue is discussed at PF 27-29.

Unfortunately, there is nothing in the record to indicate ' that either the Licensee or the Staff assessed this aspect of the radiation shielding problem.

In fact, the Restart Report states that the shielding review was predicted (sic) (predicated?) on the

~

assmption that letdown of reactor coolant outside containment will not be employed when coolant activity is at unsatisfactory levels.

The Restart Report also states that letdown will be automatically terminated and will not be re-established if activity levels are unacceptably high.

Earlier versions of the TMI-1 emergency procedure contained such a caution but the current version does not. (Compare UCS Ex. 4, at 6.0 with Lic. Ex. 51, at 4.0, 5.0)

Furthermore, the Restart Report relies on letdown through the RCS high point vents which have not been installed to compensate for the prohibition against letdown via the normal path to outside containment. (Lic. Ex.

1, at 2.1-38e, Am. 25)

In sum, the radiation shielding assessment required by Section 2.1.6.b of i

NUREG-0578 was based in part on the abandoned commitment to install the RCS high point vents prior to restart and the former prohibition against use of the normal letdown path.

There fore, the shielding review now on the record cannot be used as the basis for an assertion that TNI-1 is safe enough to restart.

Exceptions:

i

8. The Board erred in finding that the operation of one or more reactor coolant p m ps is not required in the event of a SBLOCA.

i

14. The Board erred in finding that high point vents are useful rather than essential in reestablishing natural circulation and that the schedule for installing such vents requires installation by July 1, 1982, i

O 6.

5. The Board erred in failing to require installation of high-point vents prior to restart.

The above exceptions are in the nature of summaries of the conclusions compelled by the record.

As discussed above, it is virtually beyond disput'e that there are only two methods of removing the voids that will form during the majority of SBLOCA's and which must be removed in order to est ilish coolant circulation, i.e., by operation of a reactor coolant pump or by opening a high polut vent. (RF 10-15)

The high point vents on the reactor coolant system hot legs have not been installed and were not scheduled to be installed until July 1,

1982, at the earliest, subject to further extensions. (PF 19) 2_/

Thus, contrary to the Licensee's Proposed Finding No. 7, the record in this proceeding shows that forced cooling via the non-safety grade reactor coolant pumps is the only method available at TMI-1 to establish or reestablish single-phase natural circulation for the majority of small-break LOCA cases. The reactor coolant pumps cannot be run or even "bunped" unless offsite electrical power is available (Tr. 4654, Keaten) and the loss of offsite power is a condition required to be postulated by GDC-17 and GDC-34.

The reactor coolant punps are not single-failure proof and generally do not meet the requirements of equipment important to safety, as -

decay heat recoval systems must. Therefore, high-point vents are essential, not desirable.

In conclusion:

a.

Liquid natural circulation capability at 114I-1 is not a sufficiently reliable method of decay heat removal because: (1) Voids that can accumulate in 2/ - The Wall Street Journal recently reported that parts shortages and

" disagreements over the number of vents" required have already resulted in a further extension until mid-1983. ("Many Nuclear Plant Perils Remain Three Years After Three Mile Island," J.

Dashwiller, Wall Street Journal, February 26, 1982.)

So far as we are aware, this latest extension has not been reported to the Board.

i j

. i i

the hot legs and interrupt liquid natural circulation cannot be removed because the reactor coolant ptraps are not safety grade and therefore cannot be relied upon and high point vents on the hot legs have not been installed; and (2) The emergency feedwater system is not sufficiently reliable.

b. The boiler-condenser or two-phase mode of natural circulation at TMI-1 is not a sufficiently reliable method of decay heat removal because: (1) There is no method of determining primary system water level; (2) Post-TMI-2 emergency procedures requiring refilling of the primary system after a break will preclude the establishment of a condensing surface on the primary side of the steam generator tubes; (3) The effectiveness of the boiler-condenser mode has not been and will not be tested; and (4) Emergency feedwater is not sufficiently reliable.

c. The feed-and-bleed mode of operation at WI-1 is not a sufficiently reliable method of ( ecay heat removal because: (1) Its effectiveness has not been demonstrated; (2) Its operation depends on operator action and the requisite actions and decision process are complex; and (3) cold shutdown conditions cannot be achieved using feed-and-bleed.

d.

No reliable method of forced cooling is provided at THI-1 because: (1)

The reactor coolant pumps do not meet the Commission's requirements applicable to components important to safety (i.e., safety grade components); and (2) The normal shutdown cooling ciode of operation of the decay heat removal system cannot be used because primary system pressure will be far above the design pressure of the decay heat removal system.

Therefore, UCS Contentions 1 and 2 were sustained on this record.

B. UCS Contention 3 Exceptions 16-23 PID 748-757 UCS PF 38-71 UCS RF 59-65 Summary UCS CONTENTION NO. 3 The Staff recognizes that pressurizer heaters and associated controls are necessary to maintain natural circulation at hot stand-by conditions. Therefore, this equipment should be classified as " components important to sa fety" and required to meet all applicable safety-grade design criteria, including but not limited to diversity (GDC 22), seismic and environmental qualification (GDC 2 and 4), automatic initiation (GDC 20), separation and independence (GDC 3 and 22), quality assurance (GDC 1),

adequate, reliable on-site power supplies (GDC 17) and the single failure criterion.

The Staff's proposal to connect these heaters to the present on-site emergency power supplies does not provide an equivalent or acceptable level of protection.

There can be no serious question but that the El-2 accident showed the importance of highly reliable decay heat removal. The inability to remove decay heat can - and did - lead to severe core damage. (PF 39)

UCS testified that there are two ways to provide the necessary circulation of water: 1) forced circulation using reactor coolant ptraps er 2) natural circulation. Both require 4

controlling reactor coolant system pressure. (PF 41) The pressurizer is used to perfonn - this pressure control function, by.use of the. pressurizer heaters and pressurizer spray. (PF 42) l l

Indeed, the importance to safety of pressure control is one of the primary lessons learned from the accident. The WI Lessons Learned Task Force concluded as follows:

Maintenance of safe plant conditions, including the ability to initiate and maintain natural circulation, depends on the maintenance of pressure control in the reactor coolant system.

Pressure control is normally achieved through the use of pressurizer heaters.

Experience at TMI-2 has indicated that the maintenance of natural circulation capability is important to safety, including the need to maintain satisfactory natural circulation during an extended loss of offsite power.

Without the

(

availability of pressurizer heaters, it may be necessary to operate i

the high pressure emergency core cooling system to maintain b

satisfactory natural circulation conditions. (NUREG-0578, at A-2,

(

emphasis added; PID 751) l

The Lessons Learned Task Force further found that changes to plant design were needed "to increase the availability of the reactor pressurizer for pressure control in the event of loss of offsite power, thus decreasing the frequency of challenges to [the] emergency core cooling system." (NUREG-0578 at 6; Pollard, ff. Tr. 8182 at 3-4 to 3-5)

Thus, the purposes of the plant modifications proposed by the Lessons Learned Task Force (the ability to connect some heater banks to the emergency power supply) are, while interrelated, twofold in focus : 1) to improve the availability of the pressurizer heaters to control pressure in order to maintain the capability of natural circulation, and 2) to decrease challenges to ECCS.

UCS testimony was that both functions are important to safety. (Pollard, ff. Tr.

8182, at 3-4 to 3-5, 3-7, 3-14; Tr. 8306-7)

The modifications proposed by the Staff and adopted by Order Item 8 call only for modifying the pressurizer heaters to provide the capability of manually connecting some heater banks to the onsite emergency diesel generators.

(Pollard, ff. Tr. 8182 at 3-3.)

UCS's testimony was that this modification is insufficient to assure the availability of pressurizer heaters when needed, does not achieve the objective of the lesson learned from TMI-2 (Id. at 3-5 to 3-15) and, because the heaters and their instrumentation and controls are not safety l

l grade, poses an additional hazard to public ' health and safety by potentially endangering the integrity of the plant's emergency power supply.

(This latter issue is covered by UCS Contention 4.)

If the heaters and their associated instruments and controls were classified as components important to safety and required to meet the applicable General Design Criteria governing diversity (GDC 22), seismic and environmental qualification (G9C 254), automatic initiation (GDC 20), separation and independence (GDC 3 and 22), quality assurance (GDC 1),

on-site power (GDC 17) and the single failure criterion, this would assure their availability, decrease challenges to ECCS, and preclude endangerment to the emergency power supply for plant safety systems. (Id_.)

- The Board resolved this contention against UCS not by finding that the pressurizer heaters are reliable enough to ensure the availability of natural circulation, but by finding instead that ther, are other means to remove decay heat that do not use the pressurizer heaters, namely:

1) bleed and feed (PID 752) and 2) natural circulation with the primary system in a water-solid condition, with pressure control via the makeup or HPI system. (PID 754).

In reaching this conclusion, the Board disregarded and failed to confront substantial evidence demonstrating that use of the HPI for decay heat removal while the primary system is water-solid poses serious safety problems and is contrary to a major TNI-2 lesson learned - the need to decrease the number of demands for operation of the emergency core cooling system.

In addition, as with Contention 1 and 2, it has improperly endorsed reliance on bleed-and-feed for an important safety function.

Exception:

16. The Board erred in disregarding and failing to confront substantial evidence demonstrating that there are serious safety disadvantages inherent in reliance for removal of decay heat on use of the HPI system with the primary system water-solid or in a bleed-and-feed mode.

A very substantial amount of evidence was introduced showing that there are serious safety disadvantages associated with attempting to cool the plant in a solid water condition.

(PF 60)

The following evidence is not mentioned anywhere in the PID, much less refuted:

It is extremely difficult to control reactor coolant system

("RCS")

pressure in the solid mode while making any changes whatever to the plant condition. (Tr. 3183, Pollard)

Very small changes in temperature can result in large pressure fluctuations. (Id.: see also Tr. 8060, 8083-5, Brazill.)

If the pressure decreases too rapidly, there is a risk of flashing to steam in the RCS, creating bubbles which can interrupt natural circulation. (Id.)

If the pressure

increases too rapidly, a challenge to the non-safety-grade P0dV and/or safety valves can result.

At low temperatures there is also a risk of exceeding the pressure / temperature limits on the reactor vessel.

This has happened even with plants in a cold shutdown condition. (Id.)

UCS's witness knew of no case where a commercial plant has been taken from hot to cold shutdown in a solid water condition throughout. (Tr. 8187, Pollard)

None of the other witnesses knew of such an example either. (Tr. 8055-6, Brazill and Keaten; Tr. 8726-7, Jensen)

Cooling down in a solid water condition would take the full attention of at least one operator and possibly others to avoid fluctuations in the temperature or inventory of the RCS, to stay within the pressure / temperature limits on the reactor vessel and to maintain the required subcooling margin. (Tr. 8189, Po11ad) These are substantial safety disadvantages which preclude finding that solid water operation is a satisfactory substitute for natural circulation using the pressurizer heaters to control pressure.

Moreover, there are other important safety-related advantages of using what the Licensee concedes to be the preferred and normal mode of removing decay heat.

The operator is fully familiar with this mode and trained in it. (Tr.

8185, Pollard)

This supports upgrading the heaters to full safety-grade for precisely the same reason that the staff has required upgrading the emergency l

feedwater system to full safety-grade, as explained in its letter to all Licensees of October 21, 1980.

While the staff recognizes in that letter that alternative ways for removing decay heat may be available, it is requiring emergency feedwater to be fully upgraded because use of the steam generators to remove decay heat is the first choice and therefore "should satisfy the same standards applied to other safety-related systems in the plant." (Tr. 8185-6, Pollard)

The Loard had, at a minimtan, the duty to present an articulate response to this evidence presented by UCS.

. Exception:

17.

The Board erred in failing to find that reliance on the HPI system to remove decay heat is directly contrary to one of the major lescons learned from the 1NI-2 accident, namely, the need to decrease the number of demands for operation of the emergency core cooling system.

Both the makeup and HPI system use the HPI pumps. Therefore, both involve a challenge to ECCS. (PF 56, 59; Tr. 8184, 8311-8314)

One of the principal reasons for upgrading of the pressurizer heaters advanced by the Lessons Learned Task Force is to reduce the frequency of challenges to ECCS which may go beyond the previously understood and accepted design basis. That in itself is a safety function. (PF 59; Tr. 8199-8202, 8306)

It is indeed ironic that the Board now finds that the lack of reliability of the pressurizer heaters can be compensated for by relying on a system which constitutes a challenge to ECCS.

This stands the 1MI lesson learned on its head.

The Board attempts to downplay the significance of the goal of reducing ECCS challenges by referring to it as a " general philosophy." (PID 156)

It is s

not. On the contrary, it is a fundamental lesson learned, as The Lesson Learned Task Force concluded:

"The frequency with which the high pressure emergency core cooling system is operated may exceed the previously understood and accepted design basis.

Therefore, there is a need to consider the upgrading of those pressurizer heaters and associated controls required to maintain natural circulation at hot standby conditions in order to achieve greater reliability and decrease the number of demands for operation of the emergency core cooling system." (Tr.

l 7743; See also PF 63, 66)

Emergency systems such as ECCS are designed to be used only very rar-aly.

There are design basis limitations on the number of times a vessel may undergo rapid cooling.E (The Licensee's witness at first claimed no knowledge of l

y - In light of the recent revelations concerning the risk of reactor 1

pressure vessel rupture at a number of plants, this issue is far from l

theoretical.

l l

criteria limiting the frequency of use of ECCS, but later agreed to the above proposition although he had no idea what the design basis limitations are for ECCS for TMI-1. (Tr. 7743-4 PF 63)

Indeed, the Board has accepted UCS's contention that " repeated challenges to safety systems are unacceptable" in the context of Contention 5 concerning the PORV. (PID 785)

Yet the upshot of the Board's ruling is that ECCS will be relied upon to mitigate not only accidents, but also anticipated operational occurrences such as loss of offsite power which necessitate plant cooldown via natural circulation. This result is absurd when both of the pertinent objectives of the increasing the availability of natural circulation and lessons learned l

decreasing the demands for ECCS - would be met by making the pressurizer heater safety grade.

Exceptions:

18. The Board erred in accepting the adequacy for removal of decay heat of bleed-and-feed cooling.

19. The Board erred in accepting the adequacy of the bleed-and-feed mode on the basis that it "has not been shown to be a, unacceptable way of cooling the core."

Exception 19 essentially duplicates Exception 11.

The substance of Exception 18 was also discussed supra.

Once again, the Board has come down to reliance on bleed and feed.

As we showed above in connection with UCS contentions 1&2 bleed and feed is not a satisfactory substitute for a safety-grade mode of core cooling.

No analysis has been made to support a determination that it meets such criteria as fire protection (GDC 3). independence (GDC 22) or the single failure criteria, either alone or in combination with use of the other plant systems.

It is clear that neither system alone (bleed and feed or water-solid primary system) is safety-grade. (Pollard, ff. Tr. 8182 at 3-13.)

The staff has not relied on bleed and feed nor analyzed it in detail.

The staff has seen no

analysis of how the primary system could be depressurized in bleed and feed.

(Tr. 4984-5, Jenste)

No demonstrations proving the effectiveness of bleed and feed alone to cool the core have been made. (PF 30-32)

Nor can the plant be brought to cold shutdown with the bleed and feed mode using only safety-grade equipment. (PF 33)

The Board professes to find UCS in " confusion" about the use of the PORV versus the safety valves during bleed and feed and states at PID 753 that bleed-and-feed "can be achieved utilizing only safety-grade systems and components," if the water is bled through the pressurizer safety valves.

This statement misses the point made by UCS and the evidence cited in support of it.

UCS is not confused; we are well aware that the Licensee has done a theoretical " analysis" showing that the safety valves can be used for the bleeding function and discussed this issue fully in connection with the evidence

• on UCS Contention 5 concerning whether the PORV should be safety grade.

The fact is that the safety valves have never been tested or qualified under conditions requiring the number of repeated openings and closings that would be called for during bleed and feed operation. (UCS PF 210) The Staff has not even evaluated the nature of the demands placed upon the valves during bleed and feed and the current safety valve test program cannot simulate these conditions. (PF l

211) l In addition, the safety valves have no block valve. (PF 188) They cannot be manually operated, but are designed to open and close at preset pressures.

If they fail to reseat, the loss of coolant cannot be stopped.

This l

ciretanstance compels full qualification of the safety valves to demonstrate i

their ability to perform repeatedly without failure.

This has not been done -

a fact which is undisputed.

Finally, the evidence is clear that all applicable bleed and feed procedures have been written for use of the non-safety grade PORV and asstane use

1

~23-of the PORV. (PF 208)

After the 1HI-2 accident, the staff observr.d accurately that "[tlhis method of decay heat removal (bleed and feed] requires the use of the emergency core cooling system (ECCS) and the power-operated relief valves (PORVs) in the pressurizer." (PF 214)

The Board erroneously disregarded and failed to consider all of this evidence. While the safety valves may be safety-grade for other purposes, they are not qualified to perform the function necessary during bleed and feed.

Prestanably this is why all of the pertinent operator procedures direct the operator to use the non-safety grade PORY which can at least be controlled by the operator and has a block valve.

Moreover, UCS attempted to introduce evidence concerning the condition of the plant during a steam generator tube break and was not permitted to do so.

(See Exception 31)

What this evidence would have shown, and what the January 25, 1982 accident at Ginna has confirmed beyond question, is that the pressurizer safety valves cannot be used for the bleeding function in the event of a steam generator tube break.

In such an incident, the secondary system is subject to primary system pressure. The steam generator safety valves will open at a pressure rar below the set point of the pressurizer safety valves.

Pressure will never reach the set point of the pressurizer safety valve. Absent an operable PORV, the bleeding function will take place through the steam generator safety valves, -discharging radioactive steam directly into the environment.

The need to accomplish the bleed and feed mode using the steam generator safety valves as the bleed path can result from a number of accident scenarios involving a steam generator tube break.

Some examples are: failure of the PORV to open on demand; inability to reopen the non-safety block valve; and a single failure that prevents delivery of EFW to the intact steam generator resulting in the inability to use it as a heat sink.

)

Finally, the Board found, as UCS contended, that bleed and feed cooling cannot be used to achieve cold shutdown using safety-grade equipment because the reactor coolant system cannot be depressurized. (PID 757) It " notes" that there is a longterm requirement to provide by June 1982 an environmentally qualified method of achieving cold shutdown. (Id_.)

However, it is not at all clear now that that is the case, despite the Staff witness's testimony.

The Commission has published a proposed rule that will, if adopted, extend that " deadline."

Exceptions:

20. The Board erred in failing to establish the necessary conditions and standards for the pre-restart demonstration of satisfactory reactor coolant pressure control using the HPI system, in requiring such a demonstration to be performed only "to the satisfaction of the Staff", and in failing to include this demonstration as a requirement for restart. (PID 755)

21. The Board erred in authorizing restart on the basis of an as-yet unperformed demonstration of pressure control using HPI, when the evidence in this record otherwise establishes that use of the HPI system for pressure control poses serious safety problems and is unproven.

The Board derived from its discussion of the UCS contentions "The importance of being able to control reactor coolant pressure using the HPI system." (PID 755)

It then directed that "as a ministan, the Licensee should perform a demonstration of satisfactory reactor coolant pressure control using the IIPI system," this demonstration to be done "to the satisfaction of the Staff." ( d.)

There are four basic errors here.

First, the ability to control pressure with HPI is central to the Board's decisions Contention 3 is rejected only "given a satisfactory demonstration of reactor coolant pressure control by the high pressure injection and letdown systems."

(PID 756.) -

The only logical conclusion from this is that the 4/ - It should be noted that the only way in which the Board avoided having t

to resolve the question of whether there must be a safety-grade method

~

of achieving cold shutdown was by concluding that this can be done with the RCS solid and pressure control via HPI. (PID 753-757)

.~,

Licensee has not yet proven that this method of pressure control is acceptable; if it had, no demonstration would be necessary.

Indeed, UCS believes and asks the Appeal Board to rule that the record as discussed above supports the conclusion that this method of heat removal is unacceptably risky.

Apparently the Board at least agrees that it is unproven.

Under these circumstances, the Board must find (and implicitly did) that the current record does not justify restart.

It is the Board's obligation to make an affirmative finding on each contested issue as a condition of authorizing restart.

It may not delegate to the NRC Staff - an adversary party in this case - the task of making the conclusion as to whether pressure can be controlled satisfactorily with HPI.

Only the Board can make that conclusion and it must do so on the basis of a record to which all parties have had an opportunity to contribute.

Second, the condition is impermissibly vague.

It does not specify the purpose of the test, the plant conditions under which the test should be conducted, the duration of the test, or the criteria for judging success.

The Board never even specifies whether the primary system should be solid during the demonstration.

This makes the " demonstration" virtually without value since it is not specified what it must demonstrate.

Third, by directing that the letdown system rather than the safety valves be used, it avoids testing a crucial element in the system - the safety valves.

Fourth and last, this demonstration, even if completed, does not meet the issues raised by UCS.

No one questions that cooldown can theoretically be accomplished with pressure control via HPI.

UCS contends, and our evidence demonstrated, that this poses serious risks and is directly contrary to the goal of reducing safety system challenges.

A one-time " demonstration" performed j

under highly controlled conditions can do little but confirm the theoretical proposition that no party seriously disputes.

\\,.

Exceptions:

22.1he Board erred in failing to find that the pressurizer heaters are "important to safety."

l 23 The Board erred in failing to find that upgrading the..

u i i pressurizer heaters to safety-grade would better meet the pertinent

\\

lesson learned from the "D1I-2 accident the need to maintain natural circulation capability - without endangering the integrity of the plant's emergency power supplies.

The Board never directly confronts the central question raised by' UCS Contention 3 of whether the pressurizer heaters are "important to safety" with'in 5

the meaning of NRC practice.

One can only infer the following from tfe

,O V.

decision: 1) that the function of controlling primary system pressure for decay heat removal after a shutdown is important to safety (otherwise, why require the demonstration called for in PID 755 and 7577); and 2) so long as that pressure control function can be performed in any other way, the pressurizer heaters are not important to safety.

N We believe that the first proposition con hardly be disputed. (See UCS Ph 39-52, 56-71, RF 63-64).

In adopting the second proposition, albeit unstated, the Board appears to have accepted the Licensee's argument that only those systems required to mitigate a design basis accident are important to safety -

the rest are " niceties." (Tr. 7573-4)

This was reflected in the Licensee's continual use of the phrase " essential to sa fety" in discussing the role of pressurizer heaters, rather than "important to safety."

That is, since the consequences of failure of pressurizer heaters can be mitigated by use of ECCS, they are not important (or " essential", in Licensee's terminology) to safety and need not be safety-grade. (PF 63)

In implicitly endorsing this proposition, the Board was able to avoid the force of all UCS evidence showing that: 1) In contrast to all the alternatives, the operators are trained to cooldown using pressurizer heaters and are familiar and comfortable with this mode (PF 63. Tr. 7573-5); 2) All of the alternatives to use of the pressurizer heaters involve a potential challenge to ECCS (PF 63);

i F

I'

(

mA

\\'

~ !1 l

t 3

,s and 3).fhere are serious risks, discussed above, to control of pressure via HPI with tbj p'rimary mystem in a water-solid condition. (See PF 63-70) s..

In view of, the fact that one of the primary THI-2 lessons learned was. the C

7 y.

t 4

s e

need to niaintain, the ability to remove decay hgat by natural circulation, the s

s Licensee's and the, Board's overly reatt ctive application of the term "important i

y

\\

to sarpty",is anosanicus.5/

^

,Nq,.

b.

The followW4 key quotation is from NUREG-0578, ttu Lessons Learned Task

-N',

,le v?

w

\\

4N =

Forcerepbrt,:

i,

\\

4 N

g

'" g, 'i t i a t eHaintenance p r safe plant conditions, including the ability to in and ' maintain natural circulation, depends on the maintenance of pressure contrcl in the reactor coolant system.

Pressure contrcl is normally achieved through the use of pressurizer heaters.

Experience at INI-2 has indicated that the maintenance of natural circulation capability is important to safety, including the need to maintain satisfactory ' natural 4

circulation during an extended loss of offsite power.

Without the availability of pressurizer heaters, it may be necessary to operate the high-pressure emergency core cooling system to ma,intain satisfactory natural circulation conditions.

The frequency with 3

which the high-pressure emergency core cooling system is operated may exceed the previously understood and accepted design basis.

There fore, there is a need to consider the upgrading ' of those pressurizer heaters and associated controls reTaired to maintain natural circulation at hot standby co'nditions to a safety-grade classification in order to achieve greater heater reliability and to decrease the number, of demands for operation of the emergency core cooling system. s However, the. requirsd number of pressurizer heaters required to maintain natural circulation during transition to cold shutdown needs further evaluation, in the longer term.

In the short term, designs 'should be upgraded to provide the operator with the capability to maintain natural circulation at hot standby through the use of pressurizer heaters when offsite power is not available.

The thrust of UCS's contention and our evidence is that, given that the i ~

goals are as articulated dy the Task Force - to increase the reliability of the

/

\\

/

j.

5/ - It should be noted that the Licensee's witness had not even reviewed i

the plant procedures or training for TMI-1 to determine the extent to which the operators are instructed to rely upon the pressurizer heaters.

His testiminy dealt solely with system capability. (tr.

8033 11, Brazill)

In light of the crucial part which the operators' actions had in the THI-2 accident, such a narrow view of the scope of analysis required to demonstrate that safety is assured is unreasonably restricted.

s

pressurizer heaters for natural circulation and to decrease challenges to ECCS -

the "fix" of simply providing a connection of the heaters to onsite power does not achieve those goals.

Brie fly, our evidence showed that it does not significantly increase reliability (given the ways in which the heaters can fail) and likewise does not decrease ECCS challenSes. (PF 48-55, 59-63)

The Licensee's response is essentially that, the lack of reliability of the heaters and thus the lack of reliability of natural circulation can be compensated for by using systems which constitute an ECCS challerge.

This is directly contrary with the goal of the Lesson Learned.

A fair reading of the record leads to the conclusion that the functions of maintaining natural circulation and decreasing challenges to the ECCS are important to safety, the pressurizer heaters are important to safety, and that only making them safety grade will ensua that the THI-2 lessons are geniunely implemented.b C.,UCS Contention 4 Exceptions 24-30 PID 758-773 UCS PF 72-144 Summary UCS CONTENTION NO. 4 Rather than classifying the pressurizer heaters as safety-grade, the Staff has proposed simply to add the pressurizer heaters to the on-site emergency power supplies.

It has not been demonstrated that this will not degrade the capacity, capability and reliability of these power supplies in violation of GDC 17.

Such a demonstration is required to assure protection of public health and safety.

In accordance with the Commission's August 9, 1979, Order and Notice of Hearing, Item 8, the Licensee was required to design THI-1 to provide the capability to supply electrical power from the onsite emergency power source to a predetermined number of pressurizer heaters and associated controls necessary 6/ - The danger to the plant's emergency power supply resulting from the proposed connection of some heaters to these power supplies is covered by UCS Contention 4.

. to establish and naintain natural circulation at hot standby conditions. (Staff Ex.

1, at C8-3)

The objective or this modification has been discussed above in connection with UCS Contention No. 3 In mandating this connection of a substantial non-safety grade load (126 KW in this case) to emergency power supplies, the Lessons Learned Task Force recognized that the modification must not result in endangering the safety-grade emergency power supplies which provide on-site power for the plant's engineered safety features:

Careful attention should be given to assure that the capacity, capability and reliability of the emergency power source (diesel generators) is not degraded as a result of implementing the capability to supply selected pressurizer heaters from either the offsite power source or the emergency power source when offsite power is not available. (NUREG-0578, p. A-3, Tr. 9549)

In order to ensure that the emergency power supplies are protected against the effects of a fault in the non-sa fety-grade pressurizer heater circuits -

that is, that a failure in the non-safety grade pressurizer heater.s does not result in loss of the emergency power supplies used to power all of the plant's the pressurizer heater motive and control power vital safety equipment l

interface with the emergency buses is required to be accomplished through devices that have been qualified in accordance with safety grade requirements.

(Staff Ex. 1, at C8-3)

This latter requirement was clarified as follows: "The Class IE interfaces for main power and control power are to be protected by safety-grade circuit breakers. See also Reg. Cuide 1.75)" (Staff Ex.1 at C8-6; See also NUREG-0737, at 3-86)

As the record and the proposed findings on this issue show, the technical questions involved were litigated in depth and are complex, although UCS's basic position can be stated rather simply:

the design of THI-1 does not provide 5

safety grade interfaces between the pressuri*zer heater circuits and the

emergency power supplies because the main feeder breakers do not meet the provisions of Regulatory Guide 175 pertaining to isolation devices.

Thus, a failure in the non-safety heater circuits (a failure which must be postulated because those circuits are non-safety-grade) can be transmitted to the emergency power supplies and result in a loss of all onsite emergency power.

The Board has found, as UCS contended, that Regulatory Guide 1.75 is violated by the '[NI-1 design. (PF 767) However, on the basis of "some competing interests and countearguments" noted in one paragraph of the decision (PID 769) the Board rules that this design does not degrade the reliability of the

. emergency power supplies.

This tru)y remarkable conclusion is only reached by considering some " competing interests" that are entirely irrelevant to the sa fety issue raised, ignoring most of the. record, and failing to confront evidence showing that the design is not simply in violation of some quibbling requirement, but that it endangers vital power supplies.

Exception:

24. The Board erred in failing to find that a fault in the pressurizer heater circuits at THI-1 could endander the emergency power supplies needed to power vital safety equipment.

25. The Board erred in failing to find that the TMI-1 deaign violates GDC 17 because a single failure, within the meaning of NRC practice, can result in the loss of both on site emergency power supplies.

28. The Board erred in relying on the Licensee and Staff " belief" that the pressurizer heater main feeder breakers meet safety grade requirements (PID 769) and in failing to confront substantial evidence to the contrary.

The Board found that the THI-1 design violqtes Regulatory Guide 1.75, which spells out the requirements for safety-grade interfaces between tne emergency power supplies and non-safety grade equipment.

The Board failed to make the finding which follows logically from this, and which was amply supported by record evidence neither refuted nor discussed by the Board, to wit:

. that this design would permit a failure in the pressurizer heater circuits to result in a loss of bothemergency. power supplies, in violation of GDC 17 which requires that the onsite power supplies have sufficient independence, redundancy and testability to perform their safety functions assuming a single failure.

(10 CFR Part 50, App. A Criterion 17)

The reasons why the isolation device between the emergency buses and the heater circuits violates Regulatory Guide 175 are presented in detail at PF 78-98.

The result of this is that a fault originating in the heater circuits can be transmitted to the emergency power supplies.

As explained below, a single failure within the meaning of the NRC's regulations can result in loss of redundant safety grade emergency power supplies in violation of the requirements of General Design Criterion 17 of Appendix A to 10 CFR Part 50.

The single failure criterion requires, in part, that a safety system be capable of performing its safety function in the event of any single failure r

within that safety system concurrent with all failures of non-safety grade components whose failure adversely affects the system.

(Pollard, ff. Tr. 9607, at 4-2 to 4-3)

Applying this requirement to the THI-1 design, an electrical fault in the l

pressurizer heaters can and must be assumed because the heaters are non-safety grade components. (Pollard, ff. Tr. 9607, at 4-3)

The main feeder breaker can and must be assumed to fail to interrupt the fault before the emergency power supply is lost because it is a non-safety grade isolation device. (Pollard, ff.

j Tr. 9607, at 4-3 to 4-4.)

The other redundant emergency power supply is assumed failed by the single failure. (Pollard, ff. Tr. 9607 at 4-4)

In other words, failure of one diesel generator is the " single failure" in safety-grade equipment.

l t

The result is that the onsite power supply is unable to perform its safety function because both redundant divisions have been lost, one as the result of a single failure and the other as a result of a fault in the non-safety grade heaters connected to it without the use of a safety grade isolation device.

(Id.)

Even if the connection of the pressurizer heaters itself causes the loss of only one 480 volt ES bus, rather than an entire diesel generator, this is equally unacceptable in combination with the postulated single-failure loss of the other diesel generator, since the safety functions being performed by the other equipment powered by that 480 volt ES bus could be critical at the time of failure of the bus. (Tr. 9682-5, Pollard)

Neither the Licensee nor the Staff attempted to argue that loss of one diesel generator plus loss of one 480 volt ES bus on the other diesel generator would be acceptable.

4 The Licensee and Staff apparently concluded that the requirements of the single failure criterion were met 'on the basis that, if only one heater bank is connected to the emergency power supply, a hester failure and the resultant loss of only one emergency power supply will leave the redundant emergency power supply operable. (Pollard, ff. Tr. 9607 at 4-9) This reasoning depends entirely upon the argtmoent that the isolation devices protecting the diesel generators from failures originating in the pressurizer heater circuits are safety grade and thus their failure cannot be asstaned. (Tr. 9334-9339. Torcivia and Shipper)

This is the argument referred to by the Board at PID 764, p. 91, lines 6-10.

That reasoning is incorrect and was refuted by UCS because, as discussed above, the heater fault and isolation device failure must be assumed concurrent with a single failure in the redundant emergency power supply because the heaters and isolation devices are not safety grade components. (Pollard, ff. Tr.

4907, at 4-10)

The Licensee agreed that, if the isolation device does not meet the provisions of Regulatory Guide 1.75, it cannot be classified as safety grade for the purpose of performing the failure analysis. (Tr. 9339. Torcivia)

The Board found that, the isolation devices do not meet Regulatory Guide 1.75.

Thus, they are not safety-grade and their failure must be assumed in addition to a postulated, random single failure.

The conclusion compelled by this evidence is that the proposed connection of the pressurizer heaters to the THI-1 emergency power supplies will endanger those power supplies.

In the light of this record, the Board's treatment of the issue is baffling.

It states:

" Third, the observation that the design does not meet the specific guidance of RG 1.75 does not mean that the design will not protect the emergency power equipment as intended.

Both Staff and Licensee witnesses believe the pressurizer heater main feeder breakers meet safety grade requirements." (PID 769, emphasis added) 1 And that is where the Board stops, as if the Staff and Licensee's

" beliefs" can substitute for a rational refutation of the evidence presented by UCS.

Nor does the Board explain how the main feeder breakers can meet safety grade requirements when they do not meet Regulatory Guide 1.75 which defines safety-grade in this context.

This portion of the PID is clearly erroneous and l

can.ct be squared with the record.

Exceptions:

26. The Board erred in failing to conclude that since the requirements of Regulatory Guide 1.75 are not met by the '114 I - 1 design, the design is unacceptable.

l

27. The Board erred in failing to require the 'D(I-1 design to provide a level of protection equivalent to Regulatory Guide 1.75.

29. The Board erred in weighing as a " competing interest" against the UCS contention the fact that one of the lessons learned is to provide a connection of the heaters to the on-site power supply, without giving apparent weight to evidence presented by UCS showing i

. that this objective could be accomplished in one of two ways without endangering the emergency power supplies, to wit: by making the pressurizer heaters and circuitry safety grade or by making the interfaces between the pressurizer heater circuits and the Class 1E circuits safety grade. (PID 769)

As discussed above, despite its finding that the THI-1 design violates Regulatory Guide 1.75, the Board found it acceptable on the basis of a series of so-called " competing interests" listed at PID 769. We will treat them seriatim.

(They are paraphrased rather than quoted fully) 1.

The drafters of RG 1.75...probably did not foresee reconnection of non Class 1E loads after isolation.

2.

It seems to have been Staff practice at least since the mid-1970's to allow reconnection of non-Class 1E loads to Class 1E power supplies if adequate diesel generator capacity is available and if the systems have stabilized.

These two points are really the same; they amount to a claim that it is acceptable to reconnect non-sa fety loads via a non-safety interface to the emergency power supplies after non-safety loads have been automatically shed and the emergency power isolated from non-safety systems.

Prestanably, the staff's

" practice" is not by itself dispositive evidence of the safety of this arrangenent.

After all, if past staff practice were adequate, the 'DiI-2 accident would not have occurred and this proceeding would not have taken place.

Yet the Board makes no reference to the subsuantial evidence that was introduced to refuto the staff's position. (See PF 110-116.)

The staff argued that if the requirements of Regulatory Guide 1.75 continued to apply after the plant systems have " stabilized" (defined as the 25 seconds or so required for sequenced loading of the diescis,) this would preclude any connection of non-safety loads to the safety buses. (Tr. 9772, Fitzpatrick) That testimony was manifestly incorrect because, as both the Licensee and UCS testified, there are isolation devices available that meet the requirements of Regulatory Guide 1.75. (Tr. 9620, Pollard; Tr. 9225-7, Torcivia)

. Moreover, the witness's definition of " stabilization" - the point at which the diesels are loaded (Tr. 9710, Fitzpatrick) - bears no relationship whatei er to the condition of the plant as a whole and the need for the operation of the safety systems powered by the diesels. (Tr. 9712-14, Fitzpatrick)

The witness agreed that "one" purpose of requiring isolation between non safety equipment and emergency power supplies is to ensure the integrity of the power supplies to the engineered safety features. (Tr. 9713. Fitzpatrick)

However, his interpretation of the scope of Regulatory Guide 1.75 would permit that integrity to be threatened at the very time when the engineered safety features are needed to protect public health and sa fety.

The Staff provided no technically supportable justification for this result and it must be rejected.

We note in this connection that the record indicates that this is the first time the Staff has ever required the connection of a non-safety component or system te the plant's sa fety-grade emergency power supplies. (Tr. 9694, Pollard) Perhaps this explains the apparent inability of the Staff to recognize that the fundamental safety purpose reflected in the provisions of Regulatory Guide 1.75 would be thwarted were this design to be accepted.

The record does not support the argment that Regulatory Guide 1.75 provisions can be disregarded after the stabilization period of the emergency power supply.

There remains the need to insure that the connection of the non-safety grade pressurizer heaters to the emergency power supply does not result in loss of the emergency power supply.

Thus, the Board's first and second counter-arguments fail.

3 The observation that the design does not meet Regulatory Guide 1.75 does not mean that it will not protect emergency power equipment.

This " counter-argment" has been fully discussed in connection with exceptions 24, 25 and 28.

While failing to meet Regulatory Guide 1.75 may not in all instances lead automatically to the conclusion that the emergency power

supplies are endangered, the factual record in this case requires the conclusion that this design does not adequately protect those power supplies and violates GDC 17 - a requirement that is not waivable.

4.

One of the TINI-2 accident lessons learned recommendations was that provision be made for connection of the heaters to the diesel generators to establish and maintain natural circulation.

The implication of the Board's characterizing the above unexceptionable observation as a " competing interest" is that, since this measure was recommended by NRR and included within the TMI lessons learned, it must be done regardless of whether it is a detriment to safety.

This reflects a profound misunderstanding of the Board's role in this proceeding, which is to determine whether the plant as modified can be operated without undue risk to public health and safety.

In any case, the evidence establishes beyond question that there is no necessary clash between the goal of connecting the hesters to the diesels to ensure natural circulation availability and the goal of protecting the emergency power supplies.

Indeed, the essence of UCS's contention was that the obvious way to meet all of the goals is to make the pressurizer heaters safety grade.

They could then be connected to the emergency power supply like any o'ther safety load without any concern for endangering those vital power supplies. (PF 144)

In addition, they c'ould be fully relied upon for national circulation.

Even if the heaters are not made safety grade, the record is clear that there are-acceptable isolation devices which meet Regulatory Guide 1.75 that are available and in use. (PF 144; Tr. 9225-7, 9497-8 Torcivia; Tr. 9620, Pollard) Thus, the l

Board is incorrect that this point argues against UCS's position.

5.

Methods and solutions other than those set out in the Guides are acceptable under certain conditions.

Again, the statement is true, insofar as it goes.

However, the "certain conditions" referred to include the requirement that the alternative solution

. provide a level of protection equivalent to that resulting from meeting the Regulatory Guide. The face of each Regulatory Guide states as follows:

Methods and solutions different from those set out in those guides will be acceptable if they provide a basis for the findings requisite to the issuance or continuance of a permit or license by the Commission.

In this case, the underlying " requisite finding" is compliance with GDC 17 j

and we have shown above that the record requires a finding that GDC 17 is not met by this design.

This record does not support the proposition that this design provides a level of protection equivalent to that provided by Regulatory Guide 1.75, nor l

does the Board articulate the basis upon which such a finding could be made.

In summary, the so-called " competing interests and counter-arguments" do not overcome the weight of the record.

Exceptions:

30. The Board erred in disregarding and failing to confront substantial evidence showing that a combination of the TMI-1 design and its operating procedures fa n to meet the pertinent lesson learned from the TMI-2 accident with regard to redundancy of the power supply.

Well after litigation of this contention was completed, the Licensee provided for the record a large number of revisions to various emergency procedures (Tr. 16.569-16,572) without drawing the Board's or the parties' attention to any particular changes therein.

UCS brought to the Board's attention (PF 126 ff) the fact that a change in the pertinent procedure was made to direct the operators not to connect the pressurizer heaters to the emergency power supply if only one diesel generator is available. (Lic. Ex. 50, at 12.0)

This would appear to be intended to resolve the question of whether the design meets the single failure criterion.

There are two problems which preclude such a finding.

First, it is obvious from the foregoing discussion that connecting the non-sa fety-grade heaters to the emergency power supply, even if both diesel generators are available, increases the probability of failure of the power supply to which the ' heaters are connected.

Thus, contrary to the lessons learned requirement, the capability, capacity and reliability of the emergency power supply is degraded by the connection of the pressurizer heaters.

It is no solution to specify that such degradation will be permitted only when both i

emergency power supplies are available.

Second, administrative 1y prohibiting the connection of the heaters to the emergency power supply if only one diesel is available is contrary to tue intent of the lessons learned requirement.

The lessons learned requirement is to provide the capability to supply power from the emergency power supply to the l

heaters in order to maintain natural circulation capability. (Staff Ex.

1, at C8-3)

This was clarified to mean explicitly that redundant capability to i

provide emergency power to the heaters must be provided. (Staff Ex. 1, at C8-6)

Thus, if one diesel generator fails, there must be provided a redundant l-capability to power the heaters from the other diesel generator.

The Licensee cannot be permitted to violate this aspect of the lessons learned requirement to compensate for a design that does not provide an acceptable isolation device between the heaters and the emergency power supply.

D. UCS Contention 5 Exceptions 31-45 PID 744-791 UCS PF 148-240 i

UCS RF 66-77 Summary l

UCS CONTENTION NO. 5 Proper operation of power operated relief valves, associated block valves and the instruments and controls for these valves is essential to i

l mitigate the consequences of accidents.

In addition, their failure can cause or aggravate a LOCA.

Therefore, these valves must be classified as i

r----

c,-

components important to safety and required to me,6 all safety-grade design criteria.

As a result of the THI-2 accident, the Commission ordered certain improvements or upgrading of the pilot operated relief valve (PORV), the block valve, and the instrumentation and controls for these valves. UCS's position is that, considering the lessons learned from the THI-2 accident, the Commission's requirements are necessary, but not sufficient to provide adequate protection for the public. (Pollard, ff. Tr. 9027, at 5-1)

Briefly, the requirements incorporated in the Commission's August 9,1979.

Order are as follows:

(1) The motive and control components of the PORV and the PORV block valve shall be capable of being supplied from either offsite power or the emergency power source when offsite power is not available. (Staff Ex. 1, at C8-8; NUREG-0578, at A-5);

(2) The PORV and associated control circuity shall be tested to demonstrate its qualification to operate under expected operating conditions for design basis transients and accidents.

(Scaff Ex.

1, at C8-10; NUREG-0578, at A-8); and (3) The PORV shall be provided with a positive indication in the control room derived from a reliable valve position detection device or a reliable indication of flow in the discharge pipe.

(Staff Ex. 1, at C8-11; NUREG-0578, at A-10)

The purposes or objectives of these requirements are as follows:

(1) To ' reduce the frequency of challenges to emergency core cooling components and systems, N'uREG-0578, at 6 A-3 to A-4);

(2) To limit the lifting frequency of the safety valves, (NUREG-0578, at A-3); and (3) To aid the operator in diagnosing a failure and in taking corrective action. (NUREG-0578, at A-10)

. The above requirements were portrayed as the first steps toward improving the reliability of the PORV and block valve pending a longer term decision on whether the PORV and the block valve should be designated as equipment important to safety and required to meet all safety grade design criteria, whether reliability criteria for valves in the primary coolant boundary are needed, and whether the man-machine interface in the control room needs significant improvement. (NUREG-0578, at 6, 7, and A-3 to A-4)

Nothing beyond these "first steps" has been accomplished or proposed.

UCS's evidence showed that the POR, block valve and associated controls have at least six specific safety-related functions and, there fore, this equipment should be classified as important to safety and required to meet all applicable safety grade criteria. (Pollard, ff. Tr. 9027, at 5-18)

Three fundamental and interrelated safety questions concerning the PORV were raised by the TMI-2 accident:

1 Because a stuck-open PORV can result in challanging ECCS, it raises the question of whether the frequency with which safety systems are called upon to function for reactor coolant system pressure or volume control may exceed _ their generally understood and previously accepted design basis.

2) Because the PORV (and other equipment) previously classified as non-safety-related contributed to the accident and were used in its recovery, the question raised is the need to expand the applicability of existing reliability criteria to include such equipment.-

3) Because a failed-open PORV results in a direct violation of the integrity of the reactor coolant system pressure boundary, an obvious question is raised concerning conformance with GDC 14, 15

and 30, requiring an " extremely low probabililty" of abnormal leakage, rapidly propagating failure and gross rupture. (See PF 159, 160)

UCS identified the following as the primary safety-related functions of the PORV and the PORY block valve:

(1) The PORV is part of the reactor coolant pressure boundary.

(2) The PORV is used to limit the number of times the safety valves are called u,oon to open.

(3) The PORY is used to prevent overpressurization of the reactor coolant system at low temperatures when the integrity of the reactor vessel becomes the limiting consideration.

(4) The block valve serves to reduce the challenge rate to the ECCS because the inability to isolate an open PORV would require ECCS to function.

(5) The PORV is used to " bleed" cooling water during the

" bleed and feed" cooling mode.

(6) The PORV is essential to depressrrize the reactor coolant system in order to utilize the low pressure injection system during conditions of inadequate core cooling. (Pollard, ff. Tr. 9027, at 5-4 to 5-5)

(See PF 167-234)

While the Board appears to agree with UCS that the non-safety-grade PORV is inconsistent with GDC 14 which requires an " extremely low probability of abnormal leakage, of rapidly propogating failure and of gross rupture" of the primary coolant system boundary, it refused to direct the required corrective action on the basis that INI-1 is an operational plant. (PID 785-786)

It also erroneously found that the other safety functions performed by the PORV do not require modifying it to meet safety-grade criteria.

Exceptions:

31. 1he Board erred in excluding evidence related to a steam generator tube rupture, a particular kind of small break LOCA. (The basis for this exception is discussed supra.)

37. The Board errei in finding that the PORV serves only as a back-up to operator action as protection against overpressurization of the reactor vessel during low temperature operation. (PID 790)

38. The Board erred in failing to find that the PORV serves a function important to safety as protection against overpressurization of the reactor vessel during low temperature operation. (PID 790)

In concluding that the PORV is only a backup to operator action for overpressure protection of the reactor vessel during low temperature operation, the Board completely ignored and failed to confront UCS's evidence and proposed findings to the contrary. (PF 198-207)

At low temperatures, the steel of the reactor vessel is susceptible to cracking (i.e. brittle fracture).

Until the reactor vessel walls are above the nil ductility transition temperature, the reactor coolant system pressure must be limited to a few hundred pounds per square inch.

Since reactor pressure vessel rupture is an accident beyond the capability of ECCS to mitigate, it is extremely important to maintain the integrity of the vessel. (Pollard, ff. Tr.

9027 at 5-10, 5-11)

The function of protecting against overpressurization at low temperatures cannot be performed by the safety valves because their opening pressure set point - 2500 psig - is far above the permissible pressure lilmit and cannot be changed by the operator. (Id)

UCS's position is supported by NUREG-0578 which states that:

"[t]he PORV is also used to prevent overpressurization of the reactor coolant system during operation at low temperatures, an operational mode when the nil ductility transition temperatu-e (NDTT) becomes a consideration for structural integrity of the The NDTT protection mode primary coolant pressure boundary.

can also be selected, in which case the PORV opens in the event a

s preselected low-pressure setpoint is reached or [ sic] reactor temperatures are below the NDTT limit." (NUREG-0578, at A-3)

The Staff and Licensee agreed that the PORV is used to prevent reactor coolant system overpressure during low temperature operation, but argued that this function of the PORV is only a backup to reactor operator action. (Jensen, fr. Tr. 8821, at 3; Tr. 8755-8756, Jones)

However, it is incorrect to refer to this function of the PORV as a backup to the operator because under some plant conditions, the only way to limit overpressure is by use of the PORV. (Tr.

9031-9033. Pollard)

During cross-examination by UCS, the Licensee agreed that, if the plant is in cold shutdown condition with the reactor coolant system solid, the PORV "may" serve a safety function in relieving the overpressure. (Tr. 8979, Jones)

Nevertheless, the Licensee still attempted to maintain that the operator has the capability to terminate an overpressure event and the PORV is just a backup. (Id) 4 This assertion is without merit. Operator action can be relied on only if adequate time is available.

In the case of the primary system in a solid condition, i.e., without a bubble in the pressurizer, that operator does not have time to act. (Tr. 8976, Jones)

Furthermore, a technical specification requires that the PORY shall not be taken out of service nor shall it be isolated from the reactor coolant system unless the high pressure injection pumps are disabled, the reactor vessel head is removed, or the average primary coolannt temperature is above 320 F. (Tr.

9015 Jones)

This specification defines plant conditions where either overpressurization has a low probability of occurrence or the primary system

)

temperature is above the nil ductility transition temperature.

In either case, the plant conditions are such that the low temperature overpressure protection provided by the PORV is not needed.

One can reasonably infer that under all

o

>. other conditions of low temperature operation, the PORY is needed for safety, otherwise there would be no prohibition against taking it out of service.

The Board erroneously resolved this question against UCS without even discussing the above evidence.

Exceptions:

39. The Board erred in falling to find that the PORV serves a function important to safety as the " bleeding" valve during bleed-and-feed cooling. (PID 791)

40. The Board erred in failing to give weight to subs' antial evidence showing that bleed-and-feed. using the safety va'res is untested, unproven and poses significant potential hazard.,. (PID 791)

Bleed-and-feed and the role of the PORV versus the safety valves has been discussed in detail above. (See also PF 208-214.)

This Board places extraordinary reliance on bleed and feed.

If bleed and feed is to be relied upon as the cooling system which compensates for the problems with natural 5

circulation, the lack of high point vents, non-safety-grade emergency feedwater system, non-sa fety-grade pressurizer heaters, the basic equipment used to perform bleed and feed - namely, the PORV - must at least be safety grade.

In addition, as noted above in the event of a steam generator tube break, the pressurizer safety valves cannot be used and only the PORV can perform the bleeding function.

Exceptions:

41. The Board erred in failing to find that use of the PORV to depressurize the rector coolant system under inadequate core cooling conditions is a safety function for which no alternative using safety grade equipment is available. (PID 791)

42. The Board erred in finding that adequate procedures have been developed for coping with inadequate core cooling conditions without dependence on the PORV. (PID 791)

The record is undisputed that the emergency procedures for WI-1 direct the operator to use the PORV for depressurivation during an inadequate core cooling event. (PF 216 ff)

Although the Licensee argued and the Board apparently accepted that depressurizationn using the steam generator is an independent method of depressurization not requiring use of the PORV, that assertion was shown to be wrong. (PF 224-227)

The THI-1 emergency procedures call for the operator to depressurize the steam generator (s) as rapidly as possible to 400 psig or as far as necessary to achieve a 100 F decrease in secondary saturation temperature. At the same time, the operator is directed to use the PORV, as necessary, to maintain RCS pressure within 50 psi of steam generator pressure. (Lic. Ex. 48, at 26.0 - 27.0)

Thus, even if the primary system is being depressurized via the steam generators, the P03V is still used to keep primary system pressure within 50 psi of steam generator pressure. Thus, the PORV is needed in conjunction with use of the steam generators.

Furthermore, it. another section of the emergency procedures for inadequate core cooling, the operator is directed to both depressurize the steam generator (s) and open the PORV and, following depressurization, to control reactor coolant system pressure below 150 psig using the PORV. (Lic. Ex. 48, at 28.0)

The Board's failure to consider or confront this evidence in anyway is error.

Exceptions:

35. he Board erred in failing to find that the design at INI-1 violates GDC-14 in that the PORV does not have an

• extremely low t

probability" of abnormal leakage, rapidly propogating failure and gross rupture and that therefore the PORV should be safety grade.

(PID 785-786)

36. ne Board erred in essentially waiving compliance with GDC 14 on the grounds that THI-1 is an operational plant. (PID 786)

43 The Board erred in disregarding and failing to confront j

substantial evidence showing that the PORV must be safety grade in order to limit challenges to the ECCS and that the objective of limiting ECCS challenges is a requirenent of NRC regulations and i

l the IMI-2 lessons learned.

These exceptions are interrelated.

We believe that the evidence is clear that the PORV, which is part of the RCS pressure boundary, does not have an

" extremely low probability" of failure, as required by GDC. (PF 169-186)

The Board appears to have agreed. (PID 785-786)

Failure of the non-sa fety PORV would cause a LOCA, calling upon ECCS to function.

The Commission's regulations require both an extremely low probability of a LOCA (e.g., GDC-14) and ECCS protecticn against a LOCA, (e.g., GDC-35, 36, and 37). (Pollard, ff. Tr. 9027, at 5-6 to 5-7)

The fact that an accident can be mitigated does not excuse the Licensee from meeting the GDC requiring that the plant be designed and built so as to have an " extremely low probability" that an accident will occur.

This is a cornerstone of the defense-in-depth philosophy which rightly pervades the regulation of nuclear plants.

Moreover, an important lesson learned from the INI-2 accident is the necessity to reduce the frequency of occurrence of plant conditions which require the operation of ECCS. (Pollard, ff. Tr. 9027, at 5-11)

As noted above, a general lesson learned from the TMI-2 accident is that the frequency with which some safety systems such as ECCS are called upon to function may exceed their generally understood and previously accepted design basis.

Therefore, the Lessons Learned Task Force recommended specific changes to decrease the frequency of challenges to ECCS. (NUREG-0578, at 6)

It is self-evident that if the frequency with which ECCS is called upon to function may be greater than its design basis, then reducing the frequency of such challenges is a function that is itself important to safety.

The Staff position was that " Repeated unnecessary challenges to these systems [i.e., the ECCS and the safety valves) is undesirable. (Jensen, ff. Tr.

8821, at 5)

~47-To the extent that this implies that reducing ECCS challenges is a good idea but not required for safety, it must be rejected.

First, if the PORV is open and the block valve cannot be closed, the result is a need for ECCS to function to provide core cooling.

Its actuation in such circumstances can hardly be referred to as " unnecessary." Similarly if the PORY fails to open and halt the rise in system pressure, the safety valves must function.

Such challenges cannot be labeled unnecessary.

Second, if the ECCS is being challenged in ways and at a frequency greater than it is designed for by failures of the PORV and block valve, the situation is far more than merely " undesirable."

The ECCS provides critical protection relied upon for the public health and safety. Maintaining the rate and type of challenge to such a safety system to a level unquestionably within its design basis is required for safety.

Neither 'the Board nor the NRC is free to waive compliance with fundamental safety requirements on the ground that this is an operational plant.

The Commission's responsibility to assure the continued safety of the plants it regulates does not cease with the issuance of a license. Petition for Emergency and Remedial Action, CLI-78-6, 7 NRC 400, 4041978.

Power Reactor Development Corp. v. Int'l Union, 367 U.S. 396, 402 (1961)

The Commission has taken the position that a violation of HRC regulations does not of itself automatically require license suspension.

Petition for Emergency and Remedial Action, supra, at 405 ff.

However, the NRC does have the obligation to take whatever remedial action is called for - it cannot simply evade the safety issues raised, as this Board has done.

Exception:

44. The Board erred in disregarding and failing to confront evidence showing that the PORV should be safety grade to limit challenges to the safety valves.

Here the Board has again ignored UCS's evidence discussing another safety related function of the PORY - to limit the number of times which the safety valves, which have no block valves and cannot be isolated, are called upon to function. (PF 187-197)

Exceptions:

45. The Board erred in disregarding and failing to confront substantial evidence demonstrating that the requirements applicable to the to-be-installed high point vents should apply with equal force to the PORV.

(The bases for this exception are discussed at PF 182-185) 33 The Board erred in failing to rule that the licensee must demonstrate es a condition of restart that the PORV will lift in less than 5% of overpressure transients.

34. The Board erred in finding that the licensee has made reasonable progress toward demonstrating that the PORV will lift in less than 5% of overpressure transients. (PID 784)

Faced with the evidence which we believe establishes that a

non-sa fety-grade PORV is inconsistent with the requirements and principles of GDC 14, the Board nonetheless rejected UCS's argument that the PORV should be made safety-grade, relying upon a staff requirement that the licensee demonstrate that the PORV will open in less than 5% of overpressure transients.

(?ID 784-786)

It should be noted first that this " requirement" is irrelevant to the issues raised concerning inadvertent PORV openings due to failures in the l

non-safety circuitry and instrumentation associated with the PORV.

l Second, the " requirement" has not been met, nor is there any basis for concluding that it will be met.

All that the licensee has done is to submit an analysis which does not make the required demonstration. (PF 164-165) Surely it is inherent in the concept of " reasonable progress" that it include some substantial basis for concluding that the requirement will be met, particularly when it is so central to a safety issue of this magnitude.

Otherwise, restart i

and operation would be permitted on the basis of nothing but speculation. This is impermissible.

E.

Other Errors of Law 110.

The Board erred in ruling that "necess ary " modifi-cations are those which, inter alia, are reasonable in view of the technology, resources and risk involved. (PID 689 )

In the midst of its discussion of the need for water level indicators, the Board has adopted an improper standard for deter-to provide reasonable -

mining whether actions are "necessary assurance that the f acility can be operated... without.en-dangering the health and safety of the public. ". Rather than judging proposed actions strictly on the ba.,is of whether they are essential to assuring the safety of ti.e reactor, the Board has improperly taken into account the technical feasi-bility of proposed actions in reaching its final judgments.

(PID 683)

This standard has been applied not only with respect to water level indicator issues, but to all plant modification issues. (PID 674 )

In basing its judgments on this standard, the Board may well have rejected some proposed actions on the ground that their implementation would be either infeasible or difficult, despite the f act that the actions must be taken to assure safety.

However, since the Board did not discuss the issue in each instance, it is not possible to determine the extent to which it considered the feasibility issue in each case.

We can only assume that the Board followed the standard that it articulated and considered the feasibility issue at least to some extent in all of its judgments.

The Board 's approach violates f undamental precepts of the Atomic Energy Act.

It also makes it impossible to determine which actions rejected by the Board would have been considered "necessary " to protect the public health and safety had the proper standard been followed.

As a result, the Commission cannot know whether even this Licensing Board would consider TMI-l to be safe under the correct legal standard, and the Commission has no basis for allowing the Partial Initial Decision f avorable to restart to become immediately effective.

In addition, the Board's adoption of this standard violates the due process rights of UCS and other intervenors by establishing a threshold requirement for.a " feasibility" showing without providing any notice that such a showing would be required.

After massaging the Commission's language for several pag es, the Board concluded that we have adopted a standard that "necessary" modifications as stated in the Commission 's hearing order are modifi-cations which would produce a substantial and ad-ditional protection to the public health and safety and which, based upon the record, are reasonable in view of the technology, resources, and risk involved.

In other words, we have done exactly what Staff witnesses have done, i.e., measured necessity partially in terms of feasibility.

(PHD 689).

This standard is, in our view, only half right.

Any modification that "would produce a substan-tial and additional protection to the public health and safety" is necessary to protect the public health and safety under Commission practice and regulations and should be ordered.

The Board erred, however, in taking into account the feasibility of proposed actions.

. Although the Board cites absolutely no authority that supports its interpretation of the Atomic Energy Act, its dif ficulty in attempting to determine the meaning of the word "necessary" in this proceeding is not surpr ising.

If there were an absolute standard against which safety could be judg ed, the word would clearly cover anything that is required to meet that standard.

However, ' there is no such standard, which is undoubtably why Staff witnesses were reluctant to use langu ag e such as " absolutely necessary. "

(PID 682).

There is no absolute standard on which the answer could be based.

Since the term "necess ary " implies some sort of absolute judgment, the Board found itself in a semantic tangle in trying to force the word to-fit where it did not.

Unfortunately, given two basic options for interpreting the Commission 's language, the Board chose the one that is in our view, contrary to the Atomic Energy Act, other Staff views, Commission regulations, and the fundamental mandate to assure safety.

There is no doubt that the mandate of the Atomic Energy Act is to assure that nuclear reactors are not " inimical to the health and safety of the public. "

42 USC 2133(d).

That is, the NRC must assure that nuclear reactors are safe.

There is no room in any provision of the Atomic Energy Act f

for a standard that would permit a reactor to operate in the absence of actions that are required to assure safety.

1

\\

l l

? -

Petition for Emergency and Remedial Action, C LI -7 8-6, 7 NRC 400, 404-406 (1978)~

Thus, UCS ' evidence w as appropriately geared toward showing safety deficiencies at the plan t.

It was not our duty to. show how those deficiencies could' be cured or whether a

~

cure is costly or cheap.

The Board cites Staff testimony, a court decision, and a commission policy statement for the proposition that-it must consider the feasibility of proposed. actions in determining whether they should be required.

None supports the Board 's concl usio n..

The Court decision, Citizens' for a Safe Environment v.

Nuclear Regulatory Commission, 524 F.2d 1291, 1297 (D.C. Cir.

1975), simply recognizes what we have.said above,. that there is no absolute safety standard.

However, nowhere does the Court indicate that actions necessary to assure safety ~or actions that would significantly contribute to assuring safety may be rejected on the ground that they are difficult or expensive to implement.

While the Staff 's view of either the Atomic Energy Act or the Commission's language is hardly definitive its language in the. testimony does not support the Board 's approach.. The clear message of both Mr. Phillips and Dr. Ross (PID 676-682) is that an action is necessary to protect the public health and safety if it would enhance reactor safety to some significant extent.

While both witnesses indicated

.that technical feasibility would be taken.into account in

regardless of whether those actions are dif ficult or easy to take.

For example, there is no dispute that the Emergency Core Cooling System is necessary to assure reactor safety.

No reactor would be allowed to operate without an ECCS, even if the owner could show that adding such a system would be both financially and technically infeasible for that particular plant.

Similarly, reactor operation will not be allowed if a generic safety issue has not bcw resolved for the particular reactor, regardless of he fact that an overall solu-tion may be under development in a.teparate, generic proceeding.

Virginia Electric and Power Company'(North Anna Nuclear Power Station, Units 1 and 2), ALAB-491, 8 NRC 245, 248-249 (1978).

Under the Atomic Energy Act, if a particular action is necassary to protect the public health and safety, it must be taken before reactor operation may be permitted.

If the action is not feasib?e, and there is no feasible substitute which provides equivalent protection,the reactor may never be allowed to operate.

See, Vermont Yankee Nuclear Power Corp.

(Vermont Yankee Nuclear Power Station), ALAB-138, RAI-73-7, 520, 528, July 25, 1973.

Fith respect to plants which have aircady received licenses, the NRC has the continuing obligation to ensure that they can be safely operated and to order whatever action is necessary to remedy safety deficiencies, even if all violations of the regulations do not themselves compel license suspension.

o evaluating a proposed action, they did not conclude that actions necessary to safety would not be required.

To the contrary, as Dr. Ross explained, if one action were found not to be feasible, "some other way" would have to be found to achieve the same goal.

(Id.)

This is an entirely dif ferent proposition.

Neither has the Commission indicated that it would dispense with actions essential to safety simply because they are technically or financially infeasible.

The Policy Statement cited by the Board does no such thing.

The Commission's reference to consideration of NRC a:td industry resources is relevent only to the scheduling of improvements, not to whether or not the improvements will be required. (PID 688).

The Commision 's view of what is "necessary " to assure safety in this context is most clearly demonstrated by the backfit regulation, 10 CFR 50.109(a), under which the Commission may require the backfitting of a facility if it finds that such action will provide substantial, additional protection which is required for the public health and safety.

There is nothing in that regulation that would permit consideration of feasibility.

If an action would provide substantial addi-tional protection, it would be required regardless of whether it is feasible.

If it is not feasible, the plant may not operate.7/

2/The Board expressed some concern that this proceeding not be used as an improper forum for routine backfitting requirements.

This concern is valid only with respect to issues outside the a proposed action is scope of this proceeding.

As long as within the scope, as established by the " nexus " to the TMI-2 accident, it is within the Board's authority and may be required even if it would otherwise be included in a separate backfit pr og r am.

This is consistent with the staff 's view as previously dis-cussed, with the Court's recognition of the limits of current knowledge and technology, and with the absence of an absolute standard by which safety may be judged.

This standard is also consistent with that of other statutes enacted to protect the public health and safety, under which cost or feasibility are not considerations unless the statute specifically so provides.

Hercules, Inc.

v.

EP A, S9 8 F.2d 91, 111 (D.C. Cir. 19 7 8 ), Union Electric v. EPA, __ US __,

8 ERC 2143, 2146-7 (1976) ( " feasibility" not considered in determining safety unless specifically provided for by statute).

Accordingly, the Board 's consideration of the " feasibility" of necessary actions was improper.

Instead, the standard that must be followed establishes as "necessary" all actions that would significantly enhance the safety of the r eacto'r.

While these may not be sufficient to assure reactor safety, they must be considered as necessary.

The Board 's incorrect interpretation of the requirements of the Commission 's Order and the Atomic Energy Act permeates the P artial Initial Decision.

Although the Board does not specifically discuss feasibility in ruling on the various actions proposed by the parties, one must assume that the Board took feasibility into account in reaching all of its conclusions.

Otherwise, the Board would have had no need to undertake its extensive and obviously dif ficult discussion of the issue.

Accordingly, neither the par ties nor the Commission can have any idea which proposed actions were rejected in part because

-S6-the Board believed that the question of feasibility outweighed safety considerations.

The Board may well have rejected a proposed action on feasibility grounds although the action is otherwise required to assure safety.

If that is true, permitting TMI-l to reopen would pose a threat to the public health and safety.

The Commission may not allow the Partial Initial Decision to become immediately effective until it has reviewed all of the rejected conditions under the proper standard to determine for itself whe*her feasibility played a role in their rejection and whether any 9f them should be adopted.

In addition, the Boar d 's use of the feasibility standard violates the due process rights of UCS and other intervenors.

Acting on the Commission's Order, which referred only to whether various actions are "necessary and suf fich at " to provide a reasonable assurance of reactor safety, UCS presented testimony and, we believe, proved that various additional proposed actions such as requiring safety grade qualification of power operated relief valves (PID 774-792), are necessary to assure safety.

We fully expected tne Board to rest its findings on whether or not the plant is safe.

At no time did we under-stand that we would be required to prove not only that the plant would be unsafe if certain actions were not tak en, but that the actions we proposed were technically or financially feasible.

Without giving any notice to the par ties, the Board decided to establish a feasibility threshold under which UCS and other

_~

. 1 1

1 intervenors were required to establish not only that actions are necessary, but that they are feasible.

While UCS did address feasibility at times in passing, we neither planned nor developed the sort of testimony that we would have presented if we i:ad known of the feasibility threshold.

Accordingly, UCS has been treated unf airly.

The correct remedy is to reject the Board 's interpretation of the word "neces sary ".

Even if this Board rules that the standard is correct, the pr oceeding must then be reopened to allow UCS to address the feasibility question in all cases.

111.

The Board erred by delegating its responsibility as dec ision -m ak er to the Staff to establish license conditions.

(PID 1217) 112.

The Board erred in authorizing restart while inde-finitely deferring its decision on the content of the TMI-l license conditions and in giving no party other than the Staff and Licensee the opportunity to participate in this decision.

(PID 1217) @

113.

The Board erred in failing to require that the license conditions for TMI-1 be established as a condition precedent to restart. (PID 1217) 114.

The Board erred in delegating its responsibility as dec isio n-m ak er to the Staff to " verify that the plant procedures include provisions to assure that desired pressurizer heater loads will not be reconnected to the on-site power supply after they have been automatically separated until stabilization has been achieved... " ( PID 771)

S /UCS was incorrect in stating that the parties were given no opportunity to respond to the Staff 's proposed condition.

The PID at 1217 does provide for such responses.

. 115.

The Board erred in delegating its responsibility as dec ision -m ak er to the Staff and licensee by ordering Licensee to demonstrate in a test the connection of the pressurizer heaters to the emergency power buses without specifying the conditions which must be met for success. (PID 772) 116.

The Board erred in delegating its respoasibility as decisio n -m ak er to the Staff to approve a long-term solution to the steam generator bypass logic problem for implementation as soon as possible af ter restart and to "cer tify " to the Commission that reasonable progress has been made. (PID 1064).

The above exceptions are in ter -r elated.

All raise the question of whether it was proper for the Board to broadly delegate fundamental adjudicative tasks to the NRC Staff, an adversary par ty.

The Board first directed the Staff.to provide "the details of its enforcement plan " for ensuring the enforcement of Licensee commitments, Staff requirements, and Bo ar d-r e-quired conditions that the Board relied upon in recommending that TMI-l be permitted to restart.

(PID 1217)

In UCS 's view, the Staf f 's response to the Board's directions was on its face grossly inadequate.

The Staff did little more than restate the requirements listed by the Board in paragraph 1218 of the PID.

See Union of Concerned Scientists' Response to the Staff's Proposed Enforcement Pl an, February 17, 1982.

.=

. The fact is that, as of now, there is no comprehensive listing of the many Licensee commitments 9/ and Staf f requirements upon which the Board relied and which the Board stated are of

. safety significance. (PID '1204 )

As to these Licensee com-mitments and Staff requirementsj0/, the Board ruled that it "should not depend upon the recordkeeping requirement of 10 CFR 50.59(b) to be assured that taose commitments are enforced. "

(Id.)

Without a listing of those Licensee commitments (including the Staf f requirements which the Licensee committed to meet )

upon which the Board relied for "[v]irtually every major de-termination in f avor of restarting TMI-1..., " one cannot even beg in to address the question of whether the Staff's enforce-men t plan is adequate. (PID 1202)

Even if the Staff had the inclination to review the record with the objective of making such a list, how could the Staff or any other party know whether the list included all the significant commitments relied upon by the Board ?

This listing must come from the Bo ard.

One cannot determine whether the Staff 'c proposed license conditions and technical specifications provide the necessary level of enforce-ability until the technical commitments which the Board relied

upon, i.e., those commitments upon which the Board 's conclusion that restart should be authorized is premised, have been identified.

9/See the broad definition of " licensee commitments " in n.150 at p. 316 and the textual discussion at paragraphs 1199-1218 of the PID.

13/ Note that "[ e]xcept in a few instances specifically discussed in context, there is no difference between a Licensee commitment and a Staf f requirement ; the Licensee has committed to the Staff requirements. " (PID 1199)

an..

At the least, restart cannot be authorized until the conditlans of operation have been approved by the Bo ard.

In the absence of the Board 's cer tification that the license conditions and enforcement plan do in fact reflect all of the commitments and requirements upon which the decision is based, restart would be an act of faith.

On several-occasions the Board actually delegated its obligation to decide the matters in issue in UCS contentions to the Staff.

The law in this area is clear.

When a matter is involved in an adjudicatory proceeding under Section 554 of the Administrative Pro-cedure Act, the presiding officer "shall make the recommended decision or initial decision, " and employees " engaged in the per formance of investigative or prosecuting functions for an agency in a case may not... participate or advise in the de-cision. " 5 USC 554(d).

In Trans World Airlines v.

Civil Aeronautics Board, 254 F.2d 9 0 (D.C. Cir. 1958), the court summarily vacated a decision reached af ter an adjudicatory hearing where a former party later decid' d issues in the case.

e Similarly, see FTC v. Atlantic Richfield Company, 567 F.2d 96, 102 (D.C.Cir. 19 77 ) ; King v. Caesar Rodney School District, 380 F.Supp.1112, 1118

7. Del. 19 74 )..

Despite the fact that the Board recognizes that "its r e-sponsibility for adjudicating in the first ins'tance is ours "

(PID 1214), in its PID the Board has given the Staff the respon-sibility to decide contested issues.

These issues include the development of satisf actory procedures to resolve UCS Contention 4 exception 115, (PID 771-73) and the development and approval of new logic for the steam generator rupture detection system, exception 116 (PID 1064).

, UCS does not contest the entirely proper role for the Staff of verifying licensee compliance with the findings of the Board.

Instead, UCS objects to the Board's delegation to the Staff of both roles of decision-maker and enforcer.

By giving the Staff the discretion to decide whether the licensee should perform certain corrective actions, or what standards a particular action must meet, the Board essentially removes that issue from litigation and finds in favor of whatever the Staff's position may be.

Such a result elevates the Staff to the level of a decision-maker,.a. role prohibited by the APA and case law.

117. The Board erred in refusing to admit for litigation UCS Contention 17.

The Eoard refused to allow UCS to litigate the question i

of whether the plant should be allowed to operate in the absence of a resolution of unresolved generic. safety issues, asserting that this contention (UCS Contention 17) lacked

" specificity."

Metropolitan Edison Co.

(Three Mile Island Nuclear Station, Unit 1), LBP-79-34, 10 NRC 828, 838 (1979).

In fact, two illustrative examples were given: (1) interaction between safety and non-safety systems (Task A-17) and (2) environmental qualification of safety-related equipment (Task A-24).

These examples of unresolved safety problems directly involved in the accident demonstrate that the principle policy of permitting plants to operate in the absence of a plant-specific resolution of the unresolved safety problems is unjustifiable.

TMI-2 showed that unresolved

-e safety problems can and will cause accidents; thus the analysis now mandated by the Appeal Board in Virginia Electric Power Co.

(North Anna Nuclear Power Station), ALAB-491, 8 NRC 245 - (1978) prior to the issuance of an operating license should be performed at this stage for TMI-1.

The contention does not lack for specificity.

We have stated precisely what is required to assure public health and safety: a plant-specific resolution of the generic unresolved safety problems applicable to TMI-l as listed in NUREG-0410 or a rational justification for the plant's operation in the absence of such resolution.

The Board's ruling amounts to accepting the principle that each unresolved safety problem must itself cause another accident before the Staff and licensee are required to address them.

This would be a tragic mistake.

118 The Board erred in failing to rule that dEPA requires l

the preparation of an Environmental Impact Statement concerning the consequences for TMI-l of so-called s.

Class 9 accidents, as called for by UCS Contention.20.

(Board order of Dec. 15, 1981).

In a separate order dated December *,5, 1981, the Board ruled that while preparation of an environmental impact assessment was not ordered by the Commission and therefore not required, the EIA that was prepared met the specific contentions raised by the parties. (Order at 5).

The Board then refused to consider UCS contention 20 regarding the impacts of Class 9 accidents, as the NRC policy statement on that issue did not requi such impacts to be considered.

-G3-(Id. at 12).

The obligation to comply with NEPA springs from the Congressional mandate.

It cannot be waived or avoided due to the lack of any explicit delegation from the Commission.

In fact, the question of whether NEPA applies has been implicitly decided in favor of its coverage in PANE v. NRC No. 81-1131 (D.C. Cir. Jan.

7, 1982).

In that case, the court ordered the NRC to prepare an environmental assessment of the impact of psychological distress on nearby residents caused by restart of TMI-l prior to such restart.

NEPA requires that all potentially significant impacts on the human environment be evaluated in an environmental impact statement prior to agency action.

(42 U.S.C. 4331(c))

The accident at TMI-2 clearly demonstrated that. Class 9 accidents are a credible event and therefore " reasonably foreseeable" at TMI-1 (40 C.F.R. 1508.8)Lf The Board itself acknowledges that the record in this proceeding is completely devoid of any evidence on the impacts of Class 9 accidents.

(Order at 11).

Therefore, the Commission must prepare, circulate, and consider an EIS on this issue prior to restart.

Even if the NRC's Policy Statement cited by the Board (45 Fed. Reg. 40101, June 13, 1980) were a correct statement 1[/ CEQ regulations at 40 C.F.R. Part 1500 apply to "all agencies of the Federal Government." 40 C.F.R. 1507.1. NRC regulations at 10 C.F.R. 51.10(a) adopt these regulations, absent any conflict with NRC's NEPA rules. UCS believes that the NRC is bound by all CEO regulations, but it is unnecessary to argue this issue because all relevant CEQ regulations involved here are either not disavowed or not inconsistent with NRC rules.

l of NEPA law, (which we do not believe) the Board has misapplied it.

Contention 20 was timely raised at the beginning of this proceeding prior to the NRC's preparation of a NEPA document for restart.

This case does not involve the reopening of any. prior proceeding or EIS.

Indeed, the proposed policy states that the consideration of Class 9 accidents is motivated in large part by the TMI accident itself.

45 Fed. Reg. at 40102.

Conclusion For the reasons stated, the UCS exceptions should be sustained.

Respectfully submitted, Elly5 R. Weiss HARMON & WEISS 1725 I Street, N.W.

Suite 506 Washington, D.C.

20006 (202) 833-9070 Counsel for UCS DATED: March 12, 1982 d

9 i

s