ML20074A129

Revised Proposed Opinion,Supplemental Proposed Findings of Fact,Revised Findings of Fact & Conclusions of Law in Form of Partial Initial Decision on Suffolk County/Shoreham Opponents Coalition Contention 7B.W/Certificate of Svc

ML20074A129
Person / Time
Site:	Shoreham File:Long Island Lighting Company icon.png
Issue date:	05/09/1983
From:	Brown H KIRKPATRICK & LOCKHART, SUFFOLK COUNTY, NY
To:
Shared Package
ML20074A126	List: ML20074A125 ML20074A129
References
ISSUANCES-OL, NUDOCS 8305120300
Download: ML20074A129 (202)

Text

. _ . __ _

UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION Before the Atomic Safety and Licensing Board

)

In the Matter of )

)

LONG ISLAND LIGHTING COMPANY ) Docke t No. 50-322 (OL)

)

(Shoreham Nuclear Power Station, )

Unit 1). )

)

SUFFOLK COUNTY'S REVISED PROPOSED OPINION, SUPP.LEMENTAL PROPOSED FINDINGS OF FACT, REVISED FINDINGS OF FACT, AND CONCLUSIONS OF LAW IN THE FORM OF A PARTIAL INITIAL DECISION ON SUFFOLK COUNTY / SOC CONTENTION 7B l

I May 9, 1983 Herbert H. Brown Lawrence Coe Lanpher Karla J. Letsche i KIRKPATRICK, LOCKHART, HILL, CHRISTOPHER & PHILLIPS 1900 M Street, N.W.

Washington, D.C. 20036 i

8305120300 830509 PDR ADOCK 05000322 G PDR L

1 )

1 SUFFOLK COUNTY'S REVISED PROPOSED OPINION

_ON SUFFOLK COUNTY / SOC CONTENTION 7B i

1 i

I E

I J

I k

l t

1.____.- ... _ . . . _ . .. - _ __ , _ _ _.,____.-_____..,__.__...__.-,_,_-__,,-_._..,___,______._.._....._...-_m.. -

Revised Detailed Table of Contentsl/

Page No.

BACKGROUND AND SCOPE OF PARTIAL INITIAL DECISION............. 1 OPINION...................................................... 2 A. Suffolk County / SOC Contention 7B: Systems, Structures, and. Components Important to Safety: Classification and Systems Interactions.................................... 2 I. Introduction and Summary of Conclusions....... 2 A. Introduction............................. 2 B. Summary of Conclusions.................. 10 C. Organization of Contention 7B Opinion.............................. 15 II. LILCO Has Misinterpreted the NRC's Regulations............................... 16 A. LILCO Has Misinterpreted the Term "Important-to-Safety"................ 18 B. LILCO's Misinterpretation of the Term "Important-to-Safety" Precludes a Finding That LILCO Has Complied With Regulatory l Requirements......................... 30 l

1/ The page references for the Opinion portion of this Re-vised Detailed Table of Contents correspond to the Revised Opinion on Suffolk County / SOC Contention 7B, submitted by j Suffolk County on May 9, 1983. See letter dated May 9, 1983 from Karla J. Letsche to Lawrence Brenner, Dr. James L. Carpenter, and Dr. Peter A. Morris.

(i) l 1

l. LILCO Has Failed to Apply Regulatory Requirements to Systems "Important-to-Safety"......................... 33

2. LILCO Has Not Established a Quality Assurance Program Which Complies With General De s ig n C r i te r ion 1. . . . . . . . . . . . . . 3 7 (a) Stone and Webster Quality Assurance Under General Design Criterion 1......... 41 (b) General Electric Quality Assurance Under General Design Criterion 1......... 43 (c) LILCO Quality Assurance Under General Design Criterion 1................ 44

3. Subsequent Developments on Safety Classification........... 49 III. The Staff /LILCO Methodology for Systems Classification Is Inadequate.............. 73 A. The Staff /LILCO Methodology for Systems Classification............... 73 B. The Staff /LILCO Methodology for Systems Classification Has Severe Deficiencies.................. 76 C. A Review of LILCO Emergency Operating Procedures Will Improve Systems Classifi-cation............................... 83 IV. Identification of Adverse Systems Interactions.............................. 85

! A. Importance of Identifying Adverse Systems Interactions.......... ...... 87 (ii)

B. Supplemental Methodologies are Available to Address the Systems Interaction Issue.................... 95 C. The LILCO Systems Interaction Efforts Are Not Sufficient to Identify Adverse Systems Interactions......................... 97

1. Specific LILCO Studies............. 97

2. The Shoreham PRA.................. 101

3. Effect of LILCO's Misinter-pretation of the Regulations on Systems Interaction Studies........................... 106 D. Unresolved Safety Issues A-17 and A-47................................ 108

1. Task A-17......................... 109 (a) Resolution of A-17 As-signed High Priority..........lll (b) Lack of Progress Toward Resolution.............ll2 (c) Staff's New Proposal for Resolution................ll5 (d) No Basis for North Anna Finding..................ll6

2. Task A-47......................... 120 V. Conclusion.................................. 123 FINDINGS OF FACT2 /.......................................... 84 2/ Page references for the remainder of this Revised Detailed Table of Contents are to Volume One of Suffolk County's Proposed Opinion, Findings of Fact, and Conclusions of Law in the Form of a Partial Initial Decision, dated January 31, 1983.

(iii)

I A. Suffolk County / SOC Contention 7B: Systems, Structures, and Components Important to Safety: Classification and Systems Interaction.................................... 84 I. Introduction and Statement of Contention..... 84 II. Interpretation of Safety Classification Terms "Important-to-Safety" and " Safety-Related".................................. 90 III. GDC 1 Requires a QA Program for all SS&Cs Important to Safety...................... 101 IV. QA Applied to LILCO's Nonsafety-Related SS&Cs is Inadequate...................... 106 V. Review by the NRC Staff of QA for SS&Cs Which are "Important-to-Safety" Has Been Inadequate.......................... 121 VI. Shoreham Classification Utilizing Design Basis Accidents, Regulatory Guides, and Industry Standards................... 125 A. The Classification Methodology Pre-scribed ~by the Staff's Standard Rev i ew P l a n . . . . . . . . . . . . . . . . . . . . . . . . . 12 6 B. Classification Based on Design Basis Accident Analysis................... 128

1. The DBA Approach.................. 128

2. Limitations of the Chapter 15 DBA Approach....................... 132

3. Limitations of the Single Failure Criterion...................... 136 C. Regulatory Guidance for Identifying and Documenting SS&C Classification Categories.......................... 140 (iv)

l. Use of Regulatory Guides in Systems Classification................. 140

2. Limitations in Using Regulatory Guides 1.26 and 1.29 for Safety Classification................. 143 VII. Examples of Deficiencies in Shoreham Methodology.............................. 146 A. Systems Interaction Examples........... 146

1. The Shoreham Water Level Measure-ment System.................... 148

2. The Pilgrim Event - Flashing /

Boiloff........................ 150 (a) Introduction................. 150 (b) Staff and Industry Review /

Analysis of the Pilgrim Incident and the Flash-ing/Boiloff Concern....... 153

3. Michelson Concern................. 160 (a) Introduction................. 160 (b) LILCO/GE Position on Michelson Concern................... 165 (i) Separation of Control and Protection Systems... 167 (ii) Water Level System Redundancy........... 169 (c) LILCO Evaluation of the Michelson Memorandum Appendix A Events......... 170 (d) LILCO/GE Analysis of Michelson Concern......... 175 (v)

{

(e) Staff Position on Michelson Concern................... 177 B. Examples of Deficiencies in Classification Methodology......................... 178

1. Turbine Bypass System............. 178

2. Rod Block Monitor................. 185 (a) Rod Block Monitor Function and Design.................... 185 (b) Rod Block Monitor Safety Func-tion in Chapter 15 Rod With-d rawal Transien t. . . . . . . . . . 18 7 VIII. The NRC and Industry Have Recognized the Need to Supplement Existing Methodologies for Classification and Identification of Systems Interactions.................................. 190 IX. Overview of Supplemental Methodologies Which Would Improve Classification and Identification of Systems Interactions.......................... 195 A. EOP Review Me thodology. . . . . . . . . . . . . . . . . . . . . . 197

1. The Use of Nonsafety-Related Equipment in the Shoreham Emergency Operating Procedures to Respond to Transients and Accidents....................... 197

2. Suffolk County's Review of Shoreham EOPs as a Systematic Method to Verify SS&C Safety Classification... 201 B. Systems Interaction Methodologies........... 207 I

1. Description of Systems Interaction Issues.............................. 207

2. Consideration of Systems Interactions at Shoreham......................... 215 (vi)

(a) Pipe Failure and Internal Flooding.215 (b) Miss11es.......................... 217 (c) Fire Hazard Analysis.............. 218 (d) Ca ble Separa tion. . . . . . . . . . . . . . . . . . 220 (e) Failure Mode and Effects Analysis

("FMEAs")...................... 221 (f) Electrical Bus Failures........... 222 (g) Control System Failures........... 223 (h) High Energy Line Breaks........... 224 (i) Probabilistic Risk Assessment..... 225 (j) Heavy Loads....................... 226 (k) Analysis of Industry Experience... 227 (1) Preoperational and Startup Testing.230 (m) Protection Systems................ 231 (n) Sc r am Reliability. . . . . . . . . . . . . . . . . 2 3 3 (o) Common Mode Failures in Protection and Control Instrumentation.... 235 (p) Water Level Instrumentation....... 236 (q) TMI-2 Implications................ 238

3. The Shoreham PRA and Systems Interaction 240 (a) Background........................ 240 (b) Scope of the Shoreham PRA......... 243 (c) Shoreham PRA Methodology.......... 244 (d) LILCO's Use of the PRA Results Concerning System Interactions. 255 (vii)

(e) LILCO's Use of PRA Results to Verify or Modify Classifi-cation......................... 257

4. Unresolved Safety Issues............... 259 (a) Ta s k A-17 . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 9 (b) Task A-47......................... 262 i

(viii)

I BACKGROUND AND SCOPE OF PARTIAL INITIAL DECISION l

)

This is a Partial Initial Decision on an application from the Long Island Lighting Company ("LILCO") to operate the Shoreham Nuclear Power Station, a single unit boiling water re-actor ("BWR") located in Suffolk County, New York. A permit to construct the plant, which has a rated output of 820 megawatts of electric power, was issued on April 12, 1973, and the notice of an opportunity for a hea, ring on the operating license appli-cation was published on March 18, 1976.

In addition to LILCO and the Nuclear Regulatory Commission Staff ("NRC Staff" or " Staff"), the parties to this proceeding are Suffolk County ("SC"), the Shoreham Opponents Coalition

(" SOC"), the North Shore Committee Against Thermal and Nuclear Pollution, the Oil Heat Institute of Long Island, Inc., and the New York State Energy Office. On the issues addressed in this Partial Initial Decision, the active participants were LILCO, the NRC Staff, Suffolk County and, to a lesser degree, SOC.

This Partial Initial Decision covers the following issues:

Contention Subject Suffolk County / SOC 7B; Systems, Structures, and SOC 19(b) Components Important to Safety: Classification and Systems Interaction Suffolk County 4 Water Hammer Suffolk County 10 ECCS Core Spray Suffolk County 11 Passive Mechanical Valve Failure l _ _ _ --

Suffolk County 16 Anticipated Transients Without Scram SOC 19(e) Seismic Design Suffolk County 21 Mark II Containment Suffolk County / SOC 22; Safety Relief Valve Tests Suffolk County 28(a)(vi)/ and Challenges SOC 7A(6)

Suffolk County 27/ SOC 3 Post-Accident Monitoring Our decision on the remaining issues -- principally quali-ty assurance, environmental qualification, and offsite emergen-cy planning -- will come at a later date.

OPINION */

A. Suffolk County / SOC Contention 7B: Systems, Structures, and Components Important to Safety: Classification and Systems Interactions I. Introduction and Summary of Conclusions A. Introduction Contention 7B is broad in scope, representing a consolida-tion of three contentions submitted by Suffolk County and SOC.

(Findings 7B: 1, 3).1/ Reduced to its essentials, Contention 7B questions whether a systematic and sufficient methodology has been employed by LILCO (including its contractors) and the NRC

! Staff to classify and to assure the quality of Shoreham's

• / This is a Revised version of this Opinion. See letter dated May 9, 1983 from Karla J. Letsche to Lawrence Brenner, Dr. James L. Carpenter and Dr. Peter A. Morris.

?

-1/ This Board's Decision on Contention 7B also includes find-ings on related SOC Contention 19(b). (Finding 7B:2).

SOC Contention 19(b) is narrower in scope than Contention 7B, and thus our conclusions on Contention 7B are suffi-cient to resolve the issues raised by SOC Contention 19(b). '

l l -

2-I .

systems, structures, and components ("SS&Cs") important to safety and whether this methodology has been sufficient to identify adverse systems interactions that could affect SS&Cs at Shoreham. (Finding 7B:1).

LILCO has used what might be termed a " traditional" meth-odology to classify SS&Cs and to identify adverse systems in-teractions. (Findings 7B: 75-96, 119-28). Thus, through a com-bination of design basis accident ("DBA") analyses, which apply the single failure criterion, reliance on Staff guidance in the Standard Review Plan ("SRP") and various regulatory guides, and guidance from industry standards and industry design and operating experience, LILCO has classified critical Shoreham SS&Cs, those required to operate to meet the 10 CFR Part 100, Appendix A criteria, as safety-related. The remaining SS&Cs have been classified as nonsafety-related. (Findings 7B:ll-12, 75-96, 119-28). LILCO argues that this approach has led to a design for Shoreham that satisfies all regulatory requirements and that largely precludes or defends against adverse systems interactions.

Suffolk Countj* and SOC have challenged the sufficiency of this methodology. The Intervenors' main allegations are as follows:

LILCO has misinterpreted regulatory require-h ments, particularly the General Design Criteria

("GDC") of 10 CFR Part 50, Appendix A, by

I equating SS&Cs "important-to-safety," as defined in Part 50, Appendix A, with the narrow class of SS&Cs which are safety-related. (Findings 7B:5-29; S7B:5).

I The traditional DBA approach applied by LILCO '

focuses on safety-related SS&Cs and therefore '

fails to address systematically the safety '

functions of all SS&Cs which are important to safe operation of the facility. (Findings 7B:82-83, 94).

The traditional DBA approach applied by LILCO largely ignores the risks to safe operation caused by multiple failure accidents and fails to identify systematically adverse systems in-teractions which can affect satisfactory func-tioning of safety-related SS&Cs. (Findings 7B:97-ll8).

j --

LILCO has failed to establish and implement a l

I quality assurance ("QA") program to cover all Shoreham SS&Cs which are important to safety.

(Findings 7B:30-64).

LILCO has failed to use available methodologies which would supplement and compensate to some degree for limitations of the traditional DBA approach. Using these methodologies allegedly l

would ensure that all SS&Cs important to safe operation are identified, analyzed for their safety functions, and accorded QA and other controls commensurate with those safety functions. These methodologies allegedly would also identify adverse systems interactions.

(Findings 7B:243-97,378-41).

Suffolk County and SOC allege that the foregoing deficiencies preclude this Board from finding that LILCO has satisfied the NRC's regulatory requirements, particularly those of 10 CFR Part 50, Appendix A.

The bases for the concerns expressed in Contention 7B may be traced most directly to the Three Mile Island ("TMI")

accident of March, 1979 and to other nuclear industry events which have raised serious questions regarding the sufficiency of the traditional DBA approach. (Findings 7B:233-42). These events demonstrate that:

a. Multiple failure accidents have occurred, pointing to limitations in the application of the single failure criterion. (Findings 7B:ll6, 237, 241-42).

3 b. Precise sequences of accidents are extremely hard to predict, pointing to limitations in the b application of the traditional stylized DBA approach. (Findings 7B:91, 100, 238).

c. Serious ac'cidents can be caused by, and the course of accidents can be affected by, the <

functioning (or failure to function) of SS&Cs beyond the narrow class of safety-related SS&Cs which have received the lion's share of atten-tion in safety analyses by applicants and the reviews performed by the NRC Staff. The impor-tance to safe operation of nonsafety-related SS&Cs documents the need for safety analyses and QA programs to address SS&Cs beyond those which have been classified as safety-related. (Find-ings 7B:233-42).

d. Adverse interactions among SS&Cs can result in serious accidents. The fact that such interac-tions have not been systematically identified and analyzed points to further limitations in the traditional DBA methodology. (Findings 7B:239).

Indeed, the TMI accident led the NRC special inquiry group

-- the so-called Rogovin Group -- to conclude that the DBA approach t'o nuclear safety was not sufficient to analyze reac-tor design and potential reactor accidents.

p'

[W]e have come far beyond the point at which the existing, stylized design basis accident review approach is sufficient.

The process is not good enough to pinpoint many important design weaknesses or to

' = ' . - _ . . _ _ - - - - . _ . _ _ _ - _ . - _ - - - _ _ _ . - _ _ - - - _ _ - - - _ . - _ _ _ .

l

! address all the relevant design issues.

some important accidents are outside or are l not adequately assessed within the " design i envelope"; key systems are not " safety re-lated"; and integration of human factors into the design is grossly inadequate.

g (Finding 7B:239).

l l

Similarly, the NRC's Lessons Learned Task Force, after review of the TMI accident, concluded:

The interactions between non-safety-grade t and safety-grade equipment are numerous,  ;

1 varied and complex and have not been sys-tematically evaluated. Even though there ,

is,a general requirement that failure of non-safety-grade equipment or structures should not initiate or aggravate an accident, there is no comprehensive and 4

systematic demonstration that this has been accomplished . . . . (Finding 7B:239).

I l

While the TMI accident and other events provided the impetus for the Contention 7B concerns, the Intervenors did not i

i rest their allegations on that basis alone. Instead, the In-tervenors produced concrete evidence that several potentially ,

severe adverse systems interactions existed at Shoreham

involving the safety-related BWR water level measurement t i

! system,'thus documenting instances where the traditional DBA l i

approach had not adequately identified and resolved potential safety concerns resulting from adverse systems interactions.

(Findings 7B:135-99). The Intervenors and Staff also docu- '

mented questionable interpretation of basic regulatory require-ments by LILCO (Findings 7B:5-29) -+ed-The County further 1'

pointed to several instances where the classification of SS&Cs had not been systematically analyzed in view of the safety functions being performed. (Findings 7B: 200-32). Finally, the Intervenors and Mr. Conran for the Staff demonstated that although the systems interaction problem has been identified by the NRC as a generic safety issue, there has been little progress, either by the NRC or by LILCO, to achieve resolution of the problem. (Findings 7B:432-55; S7B: 87-131).

i Contention 7B accordingly raises serious issues concerning the adequacy of the LILCO/ Staff methodology for classifying SS&Cs according to the safety functions they perform and also whether adverse interactions which may aff1ct these SS&Cs have been systematically identified and analyzed. The Board views these twin aspects of Contention 7B -- the classification and systems interaction issues -- to be both independently signifi-cant and, at the same time, highly interrelated.

The classification process involves the identification of those SS&Cs that play an important role in the safe operation of the facility. (Findings 7B:88, 92). While the importance of individual SS&Cs certainly varies, each SS&C or class of SS&Cs important to safety must be appropriately identified and evalu-ated to ensure that it is designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed. 10 CFR Part 50, Appendix A, Criterion 1. (Findings 7B:8, 31-32, 35).

l i __ _ ___ _ .__ . _ _ - -

The SS&Cs which must be designed, fabricated, erected, and tested with the attention required by GDC 1 initially are iden-tified by a variety of techniques (such as DBA analyses) during the design process of the plant. (Findings 7B:88, 92). This identification procese does not end with DBA analyses. Rather, an important aspect of assessing the safety function of equip-ment is for the licensee to review its actual planned use by the plant operators, as, for instance, when used in the emer-gency operating procedures ("EOPs"). Those SS&Cs used in emer-gency situations, even if not " required" to perform critical safety functions of the kind defined in 10 CFR Part 100, Appen-dix A, nevertheless contribute to safe operation of the facili-ty and thus must be identified. Once such SS&Cs are identi-fled, some form of classification is required to assure that appropriate design, construction, and operational attention, including QA controls, is paid to the SS&Cs commensurate with their importance to safety. (Findings 7B:37, 250-58).

Systems interactions are events that can cause two or more components in different systems to fail to perform their functions or to perform the functions in a degraded manner, thus increasing the likelihood of an undesired event. (Finding 7B:102). Systems interaction analyses are designed to identify interrelationships among SS&Cs. Of primary concern is the identification of SS&Cs whose breakdown or failure to function may adversely affect the operation of other SS&Cs. In l - -_

par'ticular, it is necessary to identify those SS&Cs whose failure to function may affect the safe operation of the facil-ity. (E.g., Finding 7B: 102).

The identification of adverse interactions is directly re-lated to the classification process. For example, an item of equipment classified as nonsafety-related may potentially affect the operation of a safety-related SS&C. (Finding 7B: 148). The identification of this interaction is related to the classification process, because a response may be to improve the reliability of the nonsafety-related item (and, hence, to recognize that item's role in safe operation) to re-duce the likelihood of such interaction. (Findings 7B: 165, 173).

B. Summary of Conclusions The " record" on Contention 7B is extensive. The Board initially heard testimony on the issue from LILCO, the Staff, and the County and SOC at a hearing which began May 4, 1982 and lasted (with some breaks) until late July, 1982. (Finding 7B:4). Subsequently, beginning on September 14, 1982 the Board began consideration of Suffolk County Contentions 12-15 relating to QA. Some of this evidence is relevant to Conten-tion 7B, at least as it relates to QA for nonsafety-related SS&Cs important to safety. Finally, in February 1983, Mr.

Conran, a lead Staff witness on Contention 7B, filed an Affida-vit which materially changed his prior testimony on safety t

l .. _ _ .

classification and systems interaction issues. As a result, the 7B record was reopened and further testimony was heard from all parties. (Findings S7B: 1-2).

Based upon the extensive record which has been compiled, the Board concludes that LILCO has not used a sufficient and systematic methodology for classification of SS&Cs according to their safety functions and their potential for impacting safety and that necessary quality controls for SS&Cs important to safety have not been systematically established. The Board also concludes that LILCO's traditional DBA methodology has been applied in an inconsistent manner and is insufficient to identify all adverse systems interactions. Our bases for these conclusions are set forth in the body of this Opinion and in the accompanying Findings.

First, the NRC's regulations, particularly 10 CFR Part 50, Appendix A, require LILCO to design the Shoreham facility with due regard for the safety functions of all SS&Cs which are defined as "important-to-safety." Through misinterpretation of the regulations, LILCO has equated the term "important-to-safety" with the term " safety-related." However, under the NRC's regulations, SS&Cs which are important to safe-ty constitute a broader class of SS&Cs than those defined as safety-related. Because of thla misinterpretation, LILCO has failed to analyze properly the safety significance of many SS&Cs and has failed to establish and implement a QA program l I

for those SSECs which are important to safety but not safety-related, as required by GDC 1.

Second, LILCO's traditional DBA approach has resulted in a 4 nonsystematic systems classification. The evidence indicates that many SS&Cs which may, in practice, be called upon to function in transient and accident situations have not been

' carefully analyzed to ensure that they will satisfactorily per-form their safety functions. This deficiency results from re-liance on a stylized DBA approach which fails to consider mul-tiple failure accidents and the role which many nonsafety- l l

related SS&Cs may play in safe operation of the facility.

, Third, LILCO's traditional methodology has largely ignored the potential for adverse systems interactions at Shoreham.

This was graphically illustrated by evidence that the water level measurement system at Shoreham -- one of the key BWR safety systems -- is subject to adverse interactions from a va-riety of sources. The fact that these interactions were not t

effectively dealt ~with during the design of Shoreham is evi-dence of the limitations of the methodology applied by LILCO.

Finally, the evidence demonstrates that there are avail-able methodologies by which the deficiencies in Shoreham's approach to systems classification and systems interactions can be addressed. These methodologies include: the review of EOPs to identify those SS&Cs which may be relied upon by operators to ensure safe operation and to ensure that the classification i

i  ;

and associated QA applied to such SS&Cs are appropriate; the use of systems interaction analyses (such as detailed system walkdowns) to identify dependencies among SS&Cs; and the use of probabilistic risk assessment ("PRA") techniques to assess the potential for systems interactions and the need for reclassification of SS&Cs, particularly those identified by the EOP review. While these techniques have been available for many years, the evidence indicates that LILCO has failed to use them effectively.

It is not acceptable that LILCO has largely ignored the supplemental methodologies which can be used to address the interrelated systems interaction / classification issues. The NRC has identified two generic safety issues related to systems interaction: A-17, " Systems Interaction.in Nuclear Power Plants;" and A-47, " Safety Implications of Control Systems."

These issues have been identifed as high priority matters, in recognition of the risks posed by adverse systems interactions.

However, the Staff has made little progress toward resolution of these issues, making it incumbent upon LILCO to demonstrate that systems interactions pose little risk at Shoreham or that LILCO on its own has taken effective steps to address the issue. Neither has been demonstrated: the evidence indicates that systems interactions are a severe potential problem at Shoreham, as illustrated by the water level system interactions which have been identified; and LILCO has done little on its

own to use available systems interaction technioues to address the problem.

It is important at the outset to avoid misinterpretation of our conclusions on Contention 7B. We do not conclude that the traditional DBA approach is without value. On the con-trary, that approach, particularly in its reflection of many reactor years of operating experience, contributes to safe operation of a nuclear power plant. However, we do find that that approach, when examined at LILCO's Shoreham facility, is insufficient and requires supplementation.

Further, this Board is not ruling that an applicant for an operating license must use a particular type of classification scheme. LILCO has used a safety-related/nonsafety-related ter-minology to differentiate classification categories. The Board is not ruling that that terminology is wrong since no particular classification terms are required by the NRC's regu-lations. What we hold, however, is that SS&Cs beyond those classified by LILCO as safety-related, i.e., the broader cate-( gory of SS&Cs which are important to safety but not i

safety-related, are covered by the Commission's regulations and do require detailed consideration in LILCO's safety analyses I

and a QA program covering these SS&Cs is a regulatory require-ment.

LILCO has been steadfast -- indeed adamant -- in its re-fusal to accept that SS&Cs beyond those defined as l

l l

J f

safety-related are covered by the NRC's regulations. The Board is particularly concerned by this position since in the year since the 7B issue first was litigated, there was ample time for LILCO to have taken action to convince all parties that it truly does understand what minimally is required for_ safety.

This has not occurred; indeed, in the last year, a sharp dis-agreement has been created between LILCO and the Staff which clearly could affect safe operation of Shoreham. Thus, in this decision, as described hereafter, we order action to be taken by LILCO designed to overcome this unfortunate impass. This is necessary before there can be any reasonable assurance that Shoreham can be safely operated.

C. Organization of Contention 7B Opinion We have organized this opinion to provide the bases for the foregoing conclusions. In Part II, we address LILCO's mis-interpretation of the term "important-to-safety" as used in the NRC's regulations and our conclusion that LILCO has not suffi-ciently analyzed and provided systematic QA for those SS&Cs which are important to safety but not safety-related. In Part III, we describe the DBA classification methodology used by LILCO and discuss its limitations and the supplemental i

methodologies that may be used to overcome these limitations.

In Part IV, we address the systems interaction issue and Y document the need for additional efforts by LILCO to ensure j that systems interactions at the Shoreham facility have been systematically identified and evaluated.

l

II. LILCO Has Misinterpreted the NRC's Regulations Suffolk County has alleged that LILCO violated NRC regula-tory requirements by failing to interpret correctly the term "important-to-safety." (Findings 7B:17, 21). That term appears frequently in the NRC's regulations, particularly in the NRC's GDC found in 10 CFR Part 50, Appendix A. (Finding 7B:9).

Suffolk County contends that LILCO has focused its safety analyses and its QA program only on SS&Cs which have been clas-sified as " safety-related," while the regulations, in the Coun-ty's view, require LILCO to focus on a wider set of "important-to-safety" SS&Cs of which safety-related SS&Cs are a subset.

(Findings 7B:10-18, 20-24, 30-32, 38-39, 41-64).

The County argues that LILCO's misinterpretation of the term important-to-safety has serious implications for safe operation of the Shoreham facility. Since LILCO has focused analyses and QA activities on safety-related SS&Cs, the County argues there is no basis for this Board to conclude that other t SS&Cs -- those which are not safety-related but still are im-l l portant to safety and thus are covered by the NRC's regulations

-- have received proper attention. (Findings 7B:30-64).

LILCO disagrees with the County on both points, arguing that it has interpreted the regulations correctly but that, even if the County is correct on the regulatory interpretation point, LILCO has paid sufficient attention, particularly l

relating to QA for nonsafety-related SS&Cs, so that the misinterpretation has no substantive effect. (Findings 7B:25, 41, 43-44, 47-50, 52, 55).

The NRC Staff takes a middle, and indeed, internally di-vided position. The Staff agrees with the County on the issue of regulatory interpretation (Findings 7B: 17-20, 22-24, 26).

Most Staff witnesses generally agreed with LILCO, however, that the interpretation matter has little substantive impact on the adequacy of Shoreham's design and construction. However, the Staff witnesses believe that to ensure safe operation of the plan it is essential that LILCO be required to adopt the inter-pretation urged by the Staff as a prerequisite to icsuance'of an operating license. (Findings 7B:73, S7B:46, 66). One member of the NRC Staff, Mr. Conran, has differed with other Staff members and believes that LILCO's misinterpretation could have had a substantive impact on design and construction. He also believes that the misinterpretation does have a substan-tive impact on the likelihood that Shoreham can be safely oper-ated. Thus, Mr. Conran believes not only must LILCO be l

required to adopt the interpretation urged by the Staff, but also must be required to demonstrate that it truly understands l what is minimally required for safety by the NBC's regulations.

(Findings S7B: 3, 5, 46, 47, 52, 55, 58).

For the reasons set forth below, the Board finds that LILCO has misinterpreted the regulations. SS&Cs important to l

l

A safety constitute a broader category than safety-related SS&Cs and the NRC's regulations compel detailed consideration of such SS&Cs in the design, fabrication, and operation of a nuclear power plant. The Board also finds that this misinterpretation is a substantive problem at Shoreham. Because of LILCO's mis-interpretation, there is insufficient evidence to conclude that LILCO has systematically analyzed nonsafety-related SS&Cs to assess their importance to plant safety, and that LILCO has taken necessary steps to ensure that the safety functions of these SS&Cs will be satisfactorily performed. I- particul::,

i Further the Board finds that the regulations require LILCO to have established and implemented a QA program for all SS&Cs im-portant to safety, including those which are not classified as safety-related. However, the evidence does not document that

! such a program has been established.

A. LILCO has Misinterpreted the Term "Important-to-Safety" Appendix A to 10 CFR Part 50 sets forth the GDC which must be satisfied by applicants for nuclear power plant licenses.

l l These criteria establish the minimum design, fabrication, con-struction, testing, and performance requirements for all SS&Cs

(

i at a nuclear plant which are "important-to-safety." (Finding 7B:7).

1 Where the GDC refer to SS&Cs "important-to-safety," LILCO interprets that term to be synonomous with the term i

• I

" safety-related," as defined in 10 CFR Part 100, Appendix A, namely:

i Those structures, systems, or components designed to remain functional.for the SSE (also termed ' safety features') necessary to assure required safety functions, i.e.:

a. the integrity of the reactor coolant pressure boundary; I b. the capability to shut down the reac-

tor and maintain it in a safe shutdown condition; or

c. the capability to prevent or mitigate

the consequences of accidents which t

could result in potential off-site ex-posures comparable to the guideline exposures of this part. (emphasis in original). (Finding 7B:12).

General Electric ("GE") and Stone and Webster Engineering Cor-poration ("SWEC"), LILCO's two chief Shoreham contractors, make the same interpretation. (Findings 7B:12, 14-15, 38; S7B:8, 76, 77).

The NRC Staff and Suffolk County take a different posi-tion, arguing that "important-to-safety" SS&Cs constitute a broader category than just SS&Cs which satisfy the Part 100 criteria. Thus, as set forth in a November 20, 1981 Memorandum

{ issued by Harold Denton, the Director of the NRC's Office of Nuclear Reactor Regulation (the "Denton Memorandum"), the Staff and Suffolk County position is that important-to-safety SS&Cs:

t i

i

_ 19 _

w Encompass [] the broad class of plant features, covered (not necessarily explic-itly) in the General Design Criteria, that contribute in important way[s] to safe operation and protection of the public in all phases and aspects of facility operation (i.e., normal operation and tran-sient control as well as accident mitiga-tion). (emphasis in original). (Finding 7B:20).

Thus, the Staff and Suffolk County believe that safety-related SS&Cs constitute an important subpart of the larger "important-to-safety" category. (Findings 7B: 17-21).

For reasons specified below, this Board agrees with the Staff and Suffolk County interpretation of the term important-to-safety. First, the definition of SS&Cs which are "important-to-safety" supports this conclusion. In the Intro-duction to 10 CFR Part 50, Appendix A, they are defined as:

structures, systems, and components that provide reasonable assurance that the fa-cility can be operated without undue risk to the health and safety of the public.

(Finding 7B:10).

This definition certainly encompasses those Part 100 functions which frame the definition of the term safety-related. Howev-er, while safety-related SS&Cs focus on three specified safety functions, the definition of important-to-safety SS&Cs is not so limited. Hence, from its very words, the term important-to-safety implies a broader coverage of SS&Cs than v

the term safety-related does.

l  :

7 -. ..p.. ,-_-.--._.c,_ , . , , -. _ _ . . _ ,, _, _ . , _

Second, the interpretation we adopt in this Decision has been adopted et three levels of decision-makers within the NBC:

the Staff, another Licensing Board, and, by strong implication, the Commission itself. First, as noted above, the NRC Staff has urged us to adopt this interpretation. Mr. Conran, testi-fying for the Staff, explai,ned that this interpretation of the regulatory requirements was reached after extensive Staff analysis. Thus the Denton Memorandum on safety classification reflects an in-depth review by the Staff, encompassing more than a year of effort, and concurrence by all senior technical management within the Office of Nuclear Reactor Regulation.

This effort also included extensive discussion with industry representatives. These industry discussions produced no fundamental disagreement by industry with the " standard defini-tions" ultimately set forth in the Denton Memorandum. (Find-ings 7B:17-19). The Board concludes that this Staff effort to consider carefully the meaning of fundamental regulatory terms cannot be lightly dismissed.

Second, the one Licensing Board which has considered'the t

" standard definitions" of the Denton Memorandum has agreed with them. Thus, in the TMI restart proceeding, and in this pro-i ceeding, Mr. Conran testified that the category "important-to-safety" is broader than " safety-related." Mr.

Conran stated:

i t

T

a. The term "important-to-safety" applies generally to the broad class of struc-tures, systems, and components L addressed in the General Design Criteria.

b. " Safety-grade" structures, systems and components are a sub-class of all those "important-to-safety."

c. All structures, systems, and compo-nents encompassed by the term "important-to-safety" (including the

" safety-grade" sub-class) are neces-sary to meet the broad safety goal ar-ticulated in Appendix A to 10 CFR Part 50 of the regulations (i.e., provide reasonable assurance that a facility can be operated without undue risk to

) the health and safety of the public).

d. Only " safety-grade" structures, systems and components are required for the critical accident prevention, safe shutdown, and accident consequence mitigation safety functions identified in Sec. III.c of

, Appendix A to 10 CFR Part 100.

~

(emphasis in original) (Finding 7B:22).

The TMI-l Licensing Board accepted the Staff's definitions of safety-related and important-to-safety. See In re Metropolitan Edison Co. (Three Mile Island Nuclear Station, Unit 1),

LBP-81-59, 14 NRC 1211, 1342-44, 1346, 1352 (1981). This Board, while not necessarily bound by the TMI-l decision, cer-l tainly places great weight on the decision reached therein, particularly since Mr. Conran presented to the TMI Board essen-tially similar testimony on this point to that presented in this proceeding. (Finding 7B:22).

4 p-,.- , , , - - - . - . , ~- em,, ,,,.--n- -

m,-w-w- -v--,~-w-

1 Finally, the NRC itself has recently confirmed that it i

endorses the interpretation that safety-related SS&Cs

. constitute a subset of the important-to-safety category. In its recent final rule on Environmental Qualification of i Electric Equipment, 48 Fed. Reg. 2728, 2730 (1983), the Commission refers'to the scope of that rule as covering "that

]

, portion of equipment important-to-safety commonly referred to as " safety-related" . . . . (emphasis supplied). This state-ment makes clear that the Commission, as the Staff and Suffolk County, interprets the term "important-to-safety" more broadly 1

than LILCO does. (See Finding S7B:80).

The Board notes that the foregoing interpretation of the scope of the term important-to-safety is consistent with the need to interpret rules and regulations in a manner which serves their intended purpose. The TMI accident demonstrated the dangers of strict reliance on only a narrow set of safety-related SS&Cs. (Findings 7B:233-34, 238, 241). Given the uncertainties in predicting the course of potential accidents and the impossibility of the DBA approach analyzing all accidents that might occur (Findings 7B:91, 100), the items of equipment which may in fact be relied upon to respond to a serious accident may extend considerably beyond those which are narrowly defined as safety-related. (Findings 7B: 6, 252). It would be anomolous, in our view, to rule that SS&Cs, relied upon in practice to respond to serious accidents but not i

I classified as safety-related, are outside the purview of the NRC's regulations. Rather, in the Board's opinion, these SS&Cs used in practice to respond to accidents and transients, and also to help ensure reliable power generation, are part of the broad category of SS&Cs that " contribute in an important way to safe operation and protection of the public" -- even if not

" required" to function pursuant to the 10 CFR Part 100, Appen-dix A criteria. (Findings 7B:20, 253).

LILCO makes several arguments against the interpretation which we.have reached. First, LILCO urges this Board not to follow the TMI-l decision:

In the TMI-l case . . . the Board did not have the benefit of the testimony of the licensee on industry practice. Although the licensee did comment on safety classi-fication, it did not squarely address the issue of important-to-safety, as has been done in detail by LILCO's witnesses. In-stead, the TMI-l witnesses described the quality standards for non-safety-related equipment without ever directly stating an interpretation of what "important to safe-ty" means. Thus, we believe the Shoreham record has gone well beyond that in TMI-1, and the Shoreham record shows Mr. Conran's concitaions are not ultimately convincing.

LILCO Proposed Findings, Vol. 2, at 43-44.

We decline to reject the TMI-l conclusions. To accept LILCO's position, this Board must assume that the TMI-l Board undertook its regulatory interpretation responsibilities lightly and failed to consider the implications and bases of its decision. We cannot accept that, particularly given the l l

obvious regulatory and public importance of the TMI-l restart proceeding. Rather, the Soard's decision shows considerable reasoning. For instance, the Board stated:

The Board is of the opinion after hearing arguments and testimony on all sides for the question that the Staff's interpreta-tion, especially that of Mr. Conran, is the one closest to the system actually used by the Staff. It is also the system which the Board feels should be employed. To argue otherwise would in one aspect of the question argue against making improvements in safety which would result in a safer system, without upgrading to a fully

" safety-grade" system. In other words such a viewpoint might discourage safety im-provements to existing systems. We agree with Mr. Conran when he states that: "The language of regulations typical'ly is broad-ly drawn so as not to be too prescriptive

-- to permit flexibility in the imple-mentation of those requirements." 14 NBC at 1346 (emphasis supplied).

Further, LILCO has made statements about what testimony and other evidence was before the TMI-l Licensing Board (for example, assertions that the licensee did not testify regarding industry practice).. However, LILCO did not present data to support these assertions in cross-examination of Mr. Conran or even in its brief before us. We cannot accept such unsupported statements.

Second, but related to the arguments LILCO makes regarding the TMI-l decision, LILCO asserts that industry and NRC Staff practice has been to interpret the NBC's regulations in a manner which equates "important-to-safety" with the more narrow

definition of safety-related. (Finding 7B:27). This argument requires little attention by the Board, because even if that has been the past practice, we hold that such interpretation of the regulat_ ions is wrong. However, we do not agree with LILCO that a consistent industry / Staff practice, such as asserted by LILCO, did in fact exist.

The evidence adduced at the hearing documents that the terms safety-related and important-to-safety have been the source of considerable confusion. Mr. Denton, in issuing his November 20, 1981 Memorandum, was candid in acknowledging this confusion.

[I]t appears that terms "important-to-cafety," " safety grade," and

" safety-related" have been used at times interchangeably, or in ways not completely consistent with the definitions and usage of such terms in the regulations, and which do not fully reflect the intent of the reg-ulations or current licensing practice.

( Findings 7B:23; see S7B: 12-13).

However, Mr. Conran, in testifying before the Board, was em-phatic that there has been a consistent Staff practice to interpret the regulations in a manner consistent with the defi-nitions we have adopted in this Decision, even if the terminology which has been used has been inconsistent. (Find-ings 7B:24, 27). LILCO's evidence on this subject went solely to the question of terminology, and did not rebut the asse'rtion that there has been a consistent Staff practice in the actual application of the regulatory requirements.

The Board adds another observation on this terminology issue. LILCO argues, as evidence of past industry practice, that no entity in the industry, to its knowledge, uses a clas-sification scheme that employs the term "important-to-safety."

Rather, LILCO asserts it is standard industry practice to clas-sify SS&Cs as safety-related or nonsafety-related. (Findings 7B:ll, 29). LILCO Proposed Findings, Vol. 2, at 38-40. This ,

argument is factually inaccurate, since at least one utility, Metropolitan Edison, has adopted the interpretation set forth in the Denton Memorandum. (Finding S7B:15). More important, however, this argument misses the basic point. In interpreting the' term important-to-safety to encompass a subset of safety-related SS&Cs, this Board is not ruling that licensees must use any particular classification system. The NRC's regu-lations do not require an applicant to use any particular clas-sification terms but rather to comply with substantive regula-tory requirements. We cannot find that LILCO does comply with regulatory requirements, however, given its adamant position j that the Commission's regulations cover only SS&Cs in the safety-related category. (Finding S7B:7, 8). Accordingly, the fact that industry may have generally used a safety-related/nonsafety-related classification scheme (see Finding 7B:ll) is not probative to the question whether proper attention has been paid to all SS&Cs important to safety. Mr.

Conran noted, however, that he knew of no utility with which

the Staff has had such serious substantive disagreements as have occurred with LILCO. (Finding S7B: 14). Similarly, Mr.

Mattson, another Staff witness, indicated that Metropolitan Edison has displayed a much more open attitude toward the Staff interpretation than LILCO. (Finding S7B:15).

LILCO's final argument against the interpretation we have reached is that the history of the NRC's regulations, particu-larly Appendices A and B to 10 CFR Part 50 and Appendix A to 10 CFR Part 100, indicates that the term important-to-safety was always intended to mean the same as safety-related. LILCO argues that if a different interpretation were now made, the Part 50, Appendix A rule making would be invalid for failing to give proper notice of the actions intended in that rulemaking.

LILCO Proposed Findings, Vol. 2, at 31-32.2/ This argument is not persuasive. It is extremely difficult to infer accurately from brief Federal Register discussions more than 10 years ago what was actually intended by the NRC in promulgating those re-quirements. We have reviewed the materials cited by LILCO3 /

2/ LILCO's argument that the Part 50, Appendix A rulemaking would be invalid for failure to give notice if "important-to-safety" is interpreted broadly ignores the fact that the NRC provided an opportunity to comment not only on the proposed rule, but on the final rule as well. See 36 Fed.

Reg. 3256 (1971).

l 3/ See 32 Fed. Reg'. 10,213 (1967), and 36 Fed. Reg. 3255 l (1971) (Part 50, Appendix A); 34 Fed. Reg. 6599 (1969) and l 35 Fed. Reg. 10,498 (1970) (Part 50, Appendix B); 36 Fed.

l Reg. 22,601 (1971) and 38 Fed. Reg. 31,279 (1973) (Part l 100, Appendix A); 43 Fed. Reg. 46,309 (1978) and 45 Fed.

(footnote con't) 28 -

and do not find them to be conclusive.4/ Further, as Mr.

Conran testified, the Staff has considered the historical per-spective of these terms, both regarding the actual words in the regulations and the historical interpretation of those terms in the regulatory process. The Staff found that the standard definitions in the Denton Memorandum were consistent with the regulations as initially adopted.and as applied in Staff practice over the years. (Finding 7B: 18).

Finally, LILCO's interpretation leads to a result which cannot have been intended. For example, the safety-related SS&Cs are those which are required to function in mitigation of Chapter 15 DBA events. All parties would agree that such SS&Cs (footnote con't from previous page)

Reg. 74,693 (1980) (Part 72); 48 Fed. Reg. 1026 (1983) (QA reporting changes).

4/ For example, LILCO argues that the fact that the Commis-sion did not specifically discuss the use of the term "important-to-safety" in the final rule adopted in 1971 relating to Part 50, Appendix A, "strongly suggests that the drafters did not consider that the change in terminol-l ogy [the term did not appear in the 1967 proposed rulel l

made any difference in scope or substance." LILCO Pro-posed Findings, Vol. 2, at 27. We do not agree that such a conclusion raay be reached. Almost four years elapsed

, between the proposal of the rule and'its final adoption, making it difficult to read substantive intentions into what the Commission said or did not say. In fact, the changes in the rule as proposed vs. as adopted appear to have broadened the rule so that flexible interpretation would be possible, consistent with the need for such flex-ibility cited by the TMI-l Licensing Board. See 14 NRC at 1346.

l l

l

require the full application of Part 50, Appendix B QA requirements. It turns out, however, that operators will actu-ally use far more than just safety-related SS&Cs in mitigation of these accidents. Thus, the EOPs call for use of many nonsafety-related systems, albeit with safety-related backup systems available, to respond to DBAs. (Findings 78:12-14, 33-34, 37, 88-89, 93, 252; S7B:54) Under LILCO's interpreta-tion, those nonsafety-related SS&Cs which are in fact used to ensure safe operation would not be required by NRC regulations to meet even minimal quality standards because LILCO believes that only safety-related SS&Cs are subject.to any NRC-imposed quality requirements. Thus, any CA applied to nonsafety-related SS&Cs would be largely a matter of utility discretion. (Finding 7B:26). We decline to interpret the reg-ulations in a fashion that leads to such a result.

B. LILCO's Misinterpretation of the Term "Important-to-Safety" Precludes a Finding that LILCO Has Complied with Regulatory Requirements

, LILCO argues that even if the term "important-to-safety" i

is interpreted broadly as urged by the Staff and Suffolk Coun-ty, it makes no substantive difference. LILCO's rationale is that it and its contractors allegedly have taken adequate care in the design, fabrication, construction, and testing of all SS&Cs, even those not classified as safety-related. (Findings 7B:41, 43-44). LILCO also asserts that the care taken by LILCO l i l

has been confirmed by the Staff's " systematic review" which ensures compliance with GDC 1. See LILCO Proposed Findings, Vol. 2, at 45, et. seq. the FPC St ff ruppert L!LCO cr thic peint ' Finding 79:73), "hile the County argucc that the 011-dence Of record precluder any finding th2t L!LCO hac cc plied

• ?ith regul:t0ry r0quircrentc. ' Finding: 73: 39 30, 55, SS 51).

. The County consistently has taken the position that LILCO's failure to interpret the regulations correctly constitutes a substantive problem which precludes any finding that LILCO has complied with the NRC's regulatory requirements.

(Findings 7B:38-39, 56, 58-61; S7B:19). The NRC Staff ini-tially agreed with LILCO that the misinterpretation of the reg-ulatory requirements did not constitute a substantive problem, although the Staff did indicate for the future that LILCO should commit to the terminology in the Denton Memorandum (Finding 7B:73; S7B:4). At the reopened 7B hearing, however, in April 1983, it was clear that the Staff position had changed. Thus, as set forth in greater detail in Part II.B.3, infra: ,

a) Mr. Conran believes that LILCO does not understand what minimally is required for safety.

b) The remaining Staff witnesses are disatisfied with LILCO's opposition to the Denton terminology and reject LILCO's proposed FSAR amendments as an inade-quate solution to the safety classification problem.

31 -

Based upon the evidence of record, this Board cannot agree that LILCO has demonstrated compliance with regulatory require-ments despite its misinterpretation of the regulations.

(Finding S7B:9, 31). Rather, when LILCO's FSAR commitments are reviewed, -- both those existing at the time of hearing and those proposed to be added by LILCO -- the evidence confirms that LILCO's efforts to comply with the GDC focus only on safety-related SS&Cs and that LILCO has demonstrated no true understanding of the NRC's regulatory requirements. The re-maining SS&Cs covered by the GDC--those which are nonsafety-related but important to safety--are largely ignored by LILCO.

Further, with respect to the QA requirements of GDC 1, LILCO has not established and implemented a systematic QA program for all SS&Cs important to safety. Rather, while LILCO has not completely ignored QA for nonsafety-related SS&Cs, its approach has been ad hoc and nonsystematic and thus does not constitute a CA " program" as required by 10 CFR Part 50, Appendix A, Cri-terion 1. Finally, we give little weight to the Et:ff view of certain Staff witnesses that LILCO's compliance has complied with GDC 1 despite its misinterpretation of the regulations.

b:::::: The uncontroverted evidence documents that the Staff in fact has done almost no review d th:2 in met ir : of LILCO's alleged program for GDC 1 compliance insofar as nonsafety-related SS&Cs are concerned. Thus, the Staff witnesses were in no position to provide an informed opinion. Each of these matters is discussed below.

l

.I t

1. LILCO Has Failed to Apply i Regulatory Requirements to -

t Systems "Important-to-Safety" The term "important-to-safety" as used in the Introduction i to 10 CFR Part 50, Appendix A, applies generally to all SS&Cs addressed in the GDC. See In re Metropolitan Edison Co. (Three Mile Island Nuclear Station, Unit 1), LBP-81-59, 14 NRC 1211, ,

f 1342 (1981). Indeed, a number of GDC, by their express terms, l

require an applicant to take actions relating to SS&Cs which are "important-to-safety." (Finding 7B:9). '

a i In Section 3.1 of the FSAR, LILCO evaluates its compliance I

with the GDC. Based upon the content of Section 3.1, and the i

references to other FSAR Chapters contained therein, LILCO

, concludes that Shoreham " fully satisfies and is in compliance i with the General Design Criteria." LILCO Ex. 11 (FSAR), at 3.1-1. However, in view of LILCO's interpretation of the term important-to-safety, LILCO has actually agreed to comply with the GDC only insofar as safety-related SS&Cs are concerned.

(Finding 7B: 38). Thus, LILCO's mere conclusion that it complies with the GDC clearly is inadequate to find that LILCO has prop-l erly satisfied its regulatory obligations.

f

! This Board has reviewed FSAR Section 3.1 to determine whether the misinterpretation of the term "important-to-safety"

appears to have affected the substantive content of the FSAR I

! analyses. We believe that it has or, at the very least, that a finding cannot be made that the misinterpretation is of no b

concern. For example, GDC 2, " Design Basis for Protection Against Natural Phenonmena," states in relevant part:

Structures, systems, and components important to safety shall be designed to withstand the effects of natural phenomena such as earthquakes, tornadoes, hurricanes, floods, tsunami, and seiches without loss of capability to perform their safety functions. 10 CFR Part 50, Appendix A, criterion 2 (emphasis supplied).

l In evaluating its compliance with GDC 2, LILCO states:

All safety related structures, systems, and components are protected from or designed to withstand the effects of natural phenom-ena. The natural phenomena considered, and the loading combinations and analytical techniques used in the design of safety related structures, systems, and components are discussed in various sections of Chap-ter 3. LILCO Ex. 11 (FSAR), at 3.1-3 (emphasis supplied).

Thus, LILCO's evaluation of GDC 2 compliance, as expressed in the FSAR, is not adequate since it is only in terms of safety-related SS&Cs, instead of the broader important-to-safety group covered by the regulations.5/

1 The same kind of deficiency as illustrated above for GDC 2 also affects LILCO's GDC 1 compliance. GDC 1 specifies that:

5/ The Board is not holding that all SS&Cs important to safe-ty must meet seismic Category 1 requirements. However, the

, Board is ruling that GDC 2 requires that SS&Cs important to safety must be considered for such status. LILCO's FSAR description is not indicative that this has been done.

Structures, systems, and components impor-tant to safety shall be designed, fab-ricated, erected, and tested to quality standards commensurate with the importance of the safety functions to be performed.

10 CFR Part 50, Appendix A, Criterion 1.

(Finding 7B:30).

To accomplish this task, GDC 1 requires that a QA program "shall be established and implemented" to ensure that all SS&Cs important to safety will perform their safety functions.

( Finding 7B:30) .

In FSAR Section 3.1, LILCO again has committed to comply with GDC 1 only for safety-related SS&Cs. The FSAR does not contain a pledge to establish and . implement a Q& program for all SS&Cs important to safety. Further, Chapter 17 of the FSAR, where LILCO's QA program is described, contains no data concerning any systematic QA program pertaining to those SS&Cs which are important to safety, but not safety-related. In-stead, Chapter 17 pertains solely to QA for safety-related SS&Cs and the Staff's SER discussion pertaining to QA also assesses only the QA program applicable to safety-related

! SS&Cs. Accordingly, this Board concludes that the FSAR is com-pletely deficient in documenting QA compliance with GDC 1 for SS&Cs important to' safety but not safety-related. (Findings 7B:15, 38-39, 59, 62, 66).

Subsequent to the initial 7B hearing in May-July, 1982, the Staff sought additional FSAR commitments from LILCO designed to ensure that LILCO interpreted the regulatory l

l 1

requirements in a fashion consistent with the Staff terminology. This evidenced Staff concern regarding LILCO's continuing refusal to commit to the same regulatory interpreta-tions used in Staff practice. (See Findings S7B: 64-69, 70-71, 72). These efforts by the Staff -- and the fact that they still do not obviate the deficiencies in LILCO's understanding of the regulations -- are discussed in Section II.B.3, infra.

LILCO's failure to interpret the term important-to-safety correctly is of concern for a diffe' rent reason as well. The Staff.has limited personnel and conducts only audit-type reviews. Thus, the Staff must rely upon applicants' commit-ments to meet regulatory requirements. Mr. Conran, testifying for the Staff, explained that if the Staff cannot rely upon ap-plicants' commitments, it would be extremely difficult for the Staff to conclude that an applicant had in fact satisfied regu-latory requirements. (Finding 7B:26; S7B:86). During the design and construction phase, this concern is lessened some-what because the SRP perhaps constitutes a kind of backstop or safety net to protect against the consequences of regulatory misinterpretation. However, during operations, there is no such safety net comparable to the SRP. (Findings S7B:24, 27, 40-43;Section II.B.3, infra). u e"e"er, Since LILCO's FSAR commitments apply only to safety-related SS&Cs, rather than the broader class of SS&Cs that are important to safety (Finding 7B:15), there can be no assurance that LILCO is, in fact, meeting the requirements of the regulations. (Finding S7B:29).

Indeed, during operations, the Staff, County and Mr. Conran all agreed that the differences in terminology between the Staff and LILCO would affect plant safety. (Finding S7B: 43-45).

The Board is mindful that LILCO testified that it has met the substance of the regulatory requirements even if it used the wrong terminology. However, on only one issue -- the QA required by GDC 1 -- has LILCO presented evidence to attempt to demonstrate that the regulatory misinterpretation is of no effect. That evidence is discussed directly below. On the rest of the GDC, LILCO has only asserted that it has carefully analyzed all SS&Cs, including those which may fall within the scope of the term important-to-safety. No specific evidence was submitted, except to assert that the FSAR as a whole demon-strates that a wide range of SS&Cs, beyond those classified as safety-related, have been analyzed. (Findings 7B:43-44, 64).

The Board agrees that the FSAR does address SS&Cs beyond those narrowly classified as safety-related. However, such a general FSAR reference is not sufficient to demon.tc' rate that a system-atic methodology has been used to classify and analyze SS&Cs in accordance with regulatory requirements and definitions.

2. LILCO Has Not Established a Quality Assurance Program Which Complies with General Design Criterion 1 i In view of our interpretation of "important-to-safety,"

l

the Board agrees with the Staff and Suffolk County that GDC 1 embodies a regulatory requirement that an applicant establish and implement a OA program for all SS&Cs important to safety.

(Findings 7B:26, 32, 66, 72). We set forth below our interpre-tation of what constitutes " quality assurance" and what constitutes a " program" insofar as SS&Cs important to safety but not safety-related are concerned.

QA is defined in Part 50, Appendix B:

"[0]uality assurance" comprises all those planned and systematic actions necessary to provide adequate confidence that a structure, system, or component will perform satis-factorily in service. Quality assurance includes quality control, which comprises those quality assurance actions related to the physi-cal characteristics of a material, structure, component, or system which provide a means to control the quality of the material, structure, component, or system to predetermined require-ments. 10 CFR Part 50, Appendix B, Introduc-tion (emphasis supplied).

(See Finding 7B: 61). There is no indication -- and no one has urged -- that.the term " quality assurance" means anything different when it appears in GDC 1. Thus, QA consists of

" planned and systematic actions" to ensure satisfactory perfor-mance of SS&Cs.

GDC 1 also requires that a program be established and im-plemented. In GDC 1, the term " program" is not defined. How-e.rer, Criterion 2 of Part 50, Appendix B describes the elements of a QA program. (Finding 7B:61). Those elements include:

Documentation in writing via policies, procedures, or instructions regarding what is going to be done; Identification of the SS&Cs to be covered by the pro-gram; Implementing the program in accordance with those policies, procedures, or instructions; Identificatior of the organizations involved in the program; and Designation of the functions of'those organizations involved in the program.

We believe that the same elements should control the establish-ment of a QA program for nonsafety-related SS&Cs as required by GDC 1.

Insofar as nonsafety-related SS&Cs important to safety are concerned, however, we do not hold that the full requirements of Appendix B apply regarding the precise QA activities which must be carried out. No party has so urged and we decline to so rule. Appendix B does constitute guidance, however, regarding the kinds of QA activities which should be consid-ered. The extent to which particular QA activities specified by Appendix B should be applied to a nonsafety-related item (for example, extent of design control, if any, etc.) depends on a judgment of the importance of an item to safe operation (its " safety function")f/ and, given that importance, the kinds I

6/ The Board notes, in this regard, that the safety function of SS&Cs must not be unduly limited. If a particular item, for example, is relied upon by operators in the EOPs j in responding to an accident or transient, that item clearly has a safety function. The analysis of the neces-(footnote con't)

and frequencies of QA controls which are appropriate. However, as noted above, whatever activities are carried out must be accomplished in a planned and systematic manner. (Findings 7B:

33-34, 49, 59).

In Contention 7B, we are not concerned whether LILCO has applied the right kinds of QA controls to specified SS&Cs.

LILCO has presented in'its Proposed Findings specific examples

~

of QA-type activities relating to specified SS&Cs.7/ This evi-dence largely misses the point: the concern in Contention 7B is whether LILCO has established a planned and systematic QA program for nonsafety-related SS&Cs.8/ Thus, two basic questions must be answered:

(footnote con't from previous page) sary QA to be applied will need to consider that function and the expected frequency of use, as well as what adverse consequences (such as operator confusion increasing the possibility of operator error) may result if the item fails to operate as expected. If the adverse consequences of failing to operate are large, then an appropriately in-creased degree of QA attention may be required. (Findings 7B: 8, 31, 37, 40, 45, 58, 252, 254-57, 268-71).

7/ For example, in LILCO Proposed Finding B-243, LILCO talks about audits of nonsafety-related control panels and l switch gears; in Proposed Finding B-245, LILCO talks about inspections of the main condenser and condenser tubes.

(See Finding 7B: 48 for other examples of specific QA exam-ples mentioned by LILCO).

8/ Assuming that such a program has been established, the ad-equacy of its implementation is more appropriately re-served for our consideration of SC Contentions 12-15.

i

• _ 40 _

Is there evidence that LILCO has established a QA program covering SS&Cs which are important to safety but not safety-related?

Is there evidence that that program is designed to carry out QA activities in a planned and systematic manner? This inquiry includes the question whether I

there is evidence of a systematic analysis of an item's safety function so that the appropriate degree of QA may be determined.

The Board concludes that LILCO has failed to demonstrate compliance with GDC 1. Our reasons are set forth below.

(a) Stone and Webster Quality Assurance Under General Design Criterion 1 SWEC does have a QA program which, on its face, applies to SS&Cs beyond those which are classified as safety-related.

This program is described in the " Stone and Webster QA Program Manual," which was submitted as part of LILCO's testimon'i on the QA/QC contentions. From the Manual and from LILCO's 1

prefiled 7B testimony, it appears that SWEC uses three QA categories: SWEC QA Category I applies to safety-related SS&Cs; SWEC QA Category II applies to nonsafety-related SS&Cs I

essential to reliable electric power generation but not to safe shutdown (QA Category II also includes nonsafety-related SS&Cs containing radioactive material); and QA Category III applies l

to nonsafety-related SS&Cs not essential to reliable electric power generation and not containing radioactive material.

(Findings 7B:49-50).

SWEC has established on paper a relatively comprehensive QA program. The Manual documents responsibilities for imple-menting the program and designates functions covered by the program. The evidence indicates that SWEC attempts to apply this overall QA program to activities affecting all SS&Cs.

Thus, the fact that SWEC has never attempted to identify the SS&Cs which are important to safety but not safety-related is not necessarily a crucial failure. (Findings 7B:15, 49-50).9/

The Board has one concern. There is no evidence that SWEC has a systematic and planned means of assessing what level of QA attention should be applied to particular SS&Cs which are not safety-related. The SWEC manual states:

The design, procurement, construction, and testing of Cat-egory II and Category III structures, components, and systems shall be accomplished based on applicable codes and standards and good design and construction practice.

(Finding 7B:50).

In the Board's opinion, this constitutes merely boilerplate, providing no evidence that careful attention is paid to particular SS&Cs (or classes of SS&Cs) to ensure that l

9/ As set forth in Section II.B.3, infra, however, we are ordering that LILCO identify all SS&Cs important to safe-ty. This action is taken to ensure that LILCO does in fact understand what minimally is recuired for safe operation of Shoreham.

l l l

appropriate QA is applied in light of the safety functions to be performed. Further, the evidence indicates that nonsafety-related SS&Cs are only designed for their normal service conditions (Finding 7B:45), despite the fact that such SS&Cs may be relied upon by operators in responding to design basis events. SWEC must, at a mininum, assess whether QA beyond that applied for normal service conditions is needed to ensure that these safety functions will be satisfactorily performed.

Accordingly, while SWEC appears to have a OA program for SS&Cs important to safety, the evidence does not document a planned and systematic means to ensure that the program is ap-plied to an appropriate degree to all SS&Cs in this category.

Therefore, the Board cannot find compliance with GDC 1.

(b) General Electric Quality Assurance Under General Design Criterion 1 It appears that GE has a QA program for SS&Cs beyond those classified as safety-related. In most respects, the GE program appears similar to the SWEC program. As with SWEC, GE has failed to prepare a listing of the SS&Cs important to safety to l

which its OA program applies. Similarly, as with SWEC, we can-not conclude, based upon the evidence presented, that the GE program includes a systematic means to assess the safety function of nonsafety-related SS&Cs to determine the appropriate degree of QA to apply. (Findings 7B:15, 52, 54-55).

i l

l l

l

Our concern with the adequacy of the GE QA program for nonsafety-related SS&Cs is somewhat greater than our concern with SWEC. Unlike SWEC, no detailed GE manuals concerning the total scope of the GE QA program were provided. Rather, only the general GE BWR QA Program Manual was introduced into evi-dence. However, this manual constitutes only a synopsis of that aspect of the GE program pertaining to compliance with 10 CFR Part 50, Appendix B and only concerns safety-related SS&Cs.

(Finding 7B:55). Further, there was evidence that the GE pro-gram for nonsafety-related SS&Cs is not systematically applied.

(Finding 7B:53).

Accordingly, with respect to the GE QA activities, the Board is confronted with general testimony that GE's total QA program covers nonsafety-related SS&Cs, but the only detailed evidence thereof is a GE QA manual synopsis which appears to represent a program only for safety-related SS&Cs. On this record, we cannot conclude that GE's QA program complies with l

GDC 1.

(c) LILCO Quality Assurance Under General Design Criterion 1 With respect to LILCO, we find that there is no established QA program which meets GDC 1 requirements for SS&Cs which are not safety-related. (Finding 7B: 62). The evidence, summarized in our Findings, indicates that LILCO has pursued

(

some QA activities for some nonsafety-related SS&Cs. (Finding i

l 7B:48). However, the evidence indicates tF.at this is an ad hoc endeavor, rather than the planned, systematic effort which we have described in this Decision as being required by GDC 1.

Thus, the deficiences in LILCO's efforts include:

There is no evidence that LILCO has a documented written program or comprehensive instructions for QA activities pertaining to SS&Cs important to safety but nonsafety-related. The evidence indicates that there is a Construction Site Inspection Manual covering inspection of nonsafety-related SS&Cs. That is the only manual which was identified and it was never made part of the record. The evidence also in-dicates that there apparently is no comprehensive manual or other document which describes LILCO's QA program for nonsafety-related SS&Cs. On this evi-dence, we cannot find that LILCO has properly docu-mented its program for GDC 1 compliance. (Findings 7B: 47-48, 56-60, 63; S7B:36, 38).

The SS&Cs to which this program applies (assuming a program exists) have not been identified. (Findings 7B: 15, 63; S7B: 38, 59) Unlike the SWEC program, there is no substantial evidence that the LILCO pro-gram applies to all nonsafety-related SS&Cs. Accord-ingly, we find LILCO's failure to identify SS&Cs covered by its program to be a serious deficiency.

See Section II.B.3, infra, concerning need for LILCO to compile such a list.

The organizations involved in the program were not identified for the record, beyond those which were involved in th'e particular examples presented. (See Finding 7B:48). Accordingly, we cannot find that the program has identified those organizations which have responsibilities relating to QA for nonsafety-related SS&Cs which are important to safety.

There is no evidence that the safety functions of SS&Cs important to safety, but not safety-related, have been carefully assessed to ensure that the proper degree of QA has been applied. Rather, it appears that QA for nonsafety-related SS&Cs focuses only on satisfactory performance to ensure reliable power generation. The QA for nonsafety-related SS&Cs does not appear to have been graded in any systematic manner to reflect assessment of the safety functions these SS&Cs might be called upon to perform. (Find-ings 7B:40, 45, 58; see S7B: 32, 37, 59).10/

In short, LILCO has documented that it conducts some QA l

activities for nonsafety-related SS&Cs. It has not documented 10/ The importance of assessing the safety significance of SS&Cs important to safety was documented by the recent ATWS events at Salem. (Finding S7B:73).

1 1

l t

that it has conducted these activities in a planned and systematic manner or that it has established a program to cover these activities. Further, the Board has not seen convincing evidence of any commitment to establish such a program. Thus, LILCO's Corporate Statement of QA policy is devoted to QA for safety-related SS&Cs.

The Long Island Lighting Company Quality Assurance policy applies to the activities affecting the safety-related functions of nuclear station struc-tures, Systems and components that prevent or miti-gate the consequences of postulated accidents that 4 could cause undue risk to the health and safety of j the public. (emphasis supplied). (Finding 7B: 42).

l The Board recognizes that GDC 1 is not prescriptive in terms of what QA must be applied to SS&Cs important to safety but not safety-related. That judgment has been left to licens-ees and nothing in this Decision is intended to dictate that particular QA requirements should apply to particular SS&Cs.

Rathe , this Decision directs that LILCO must " establish and 1

implement" a QA program "to provide adequate assurance that (SS&Cs important to safety] will satisfactorily perform their safety functions." 10 CFR Part 50, Appendix A, Criterion 1.

On the GDC 1 QA issue, this Board offers several final i

observations. First, the NRC Staff has acknowledged that it l

has made no meaningful effort in either its NRR review process I

or in its I&E program to determine whether LILCO has esta-blished and implemented a QA program for items important to safety but not safety-related. Furthermore, the Staff has made 1

no meaningful attempt to provide any guidance regarding GDC 1 requirements. (Findings 7B:56-57, 65-67, 70-72). This appears highly unusual, since the Staf f-wee has been forceful in asserting its view that it is a regulatory requirement that such a QA program must exist. If such a program is a regulato-ry requirement -- and the Board holds that it is -- then the Staff, in performing its functions, should certainly have taken steps to determine whether LILCO has established such a pro-gram, and to report the results of its investigation in the SER. This was not done.

The Board emphasizes, however, that the Staff's inaction I

in providing guidance on the GDC 1 OA requirements does not re-lieve LILCO of its obligation to comply with that regulation.

Rather, the NRC has recognized that some of the GDC may require l'nterpretation and definition, but that applicants still must comply. 10 CFR Part 50, Appendix A, Introduction.ll/

)

Finally, although the Staff has performed no investigation I

into the details of LILCO's QA efforts for SS&Cs which are nonsafety-related, the Staff NRR witnesses testified, initially, based almost exclusively on LILCO's written and oral testimony l

l 11/ The lack of Staff guidance regarding GDC 1 QA leads this

, Board to state, however, that applicants must have consid-erable leeway in efforts to comply with GDC 1. For reasons noted previously, however, we cannot conclude that LILCO has complied with GDC 1 even when leeway is provid-ed.

I a

j  !

l l

on Contention 7B, that the Staff was generally satisfied that LILCO had instituted an adequate QA program despite its misin-terpretation of GDC 1. (Findings 7B:65, 73; See S7B;35, 39).

We would be inclined to give no weight to this Staff testimony.

It is based on no foundation, given the Staff's failure to per-form a review of LILCO's activities in this area. As discussed in the following section, however, the Staff witnesses have j sharply reduced their support for LILCO in this regard in view of subsequent reflection and events.

3. Subsequent Developments On Safety Classification i On February 8, 1983, James H. Conran, a member of the Staff's witness panel on Contention 7B, submitted to the Board an Affidavit which addressed the two primary issues on which Mr. Conran had previously testified: safety classification, particularly concerning the proper regulatory interpretation of L

the term "important to safety," and systems interactions, par-ticularly concerning Unresolved Safety Issue ("USI") A-17. In his Affidavit, Mr. Conran identified (1) areas in his previous testimony which, in his opinion, required amendment or supple-I j mentation, and (2) changes in facts and circumstances material l

l to the matters at issue in Contention 7B. (Finding S7B:1).

Over LILCO's objection, the Board reopened the record on Contention 7B and admitted Mr. Conran's Affidavit into evi-dence. In addition, the NRC Staff, LILCO, and Suffolk County

were given the opportunity to submit supplemental testimony on the issues discussed in Mr. Conran's Affidavit. Only the Staff and Suffolk County took advantage of this opportunity. Follow-ing three days of cross-examination of Mr. Conran, the Staff witnesses, and the Suffolk County witnesses, however, the Board requested that LILCO make company representatives available to l answer questions from the Board. In response to this request, a panel of witnesses appeared on behalf of LILCO and was brief-ly questioned. (Finding S7B:2; See also S7B:76-86).

The evidence presented at the reopened Contention 7B hear-ing directly supports conclusions which this Board would have reached on the basis of the record compiled at the initial 7B hearing: LILCO has failed to understand NRC regulatory re-quirements concerning SS&C3 important to safety but not safety-related; and progress toward resolution of USI A-17 has been so retarded that the required North Anna findings cannot be made.

l The safety classification matters are discussed directly below.

The USI A-17 matters are discussed in Section IV.D.l.

On the safety classification issue, Mr. Conran stated in his Affidavit that based on a combination of factors, he has l

l concluded that LILCO truly does not understand what is required j minimally for safety by the NRC under its regulations; that is,

he is now convinced that LILCO does not understand what is con-sidered necessary and sufficient to provide reasonable assur-l, ance that the operation of Shoreham will not pose undue risk to the health and safety of the public. (Finding S7B

3).

f

- so -

Mr. Conran explained the genesis of his opinion stated in the Affidavit as follows. At the time of his original testimo-ny on Contention 7B, Mr. Conran was " predisposed" to think of the defect in LILCO's position regarding the term "important to safety" simply as a " language problem." Although the " language problem" concerned him (see Section II.B.1 above, and Finding 7B:26), he nonetheless believed in the summer of 1982 that the Staff and LILCO understood in basically the same way the fundamental safety concepts underlying the term "important to safety" as applied by the Staff. (Finding S7B:4). Mr. Conran stated in his Affidavit, however, that he no longer believes LILCO and the Staff are near a " meeting of the minds" regarding the meaning of the concept "important to safety," which he considers to be the heart of the safety classification issue.

(Finding S7B:5).

As we have noted, SS&Cs that are important to safety, including those that are not in the safety-related subset, are covered by the NRC's regulations. (See Section II.A above).

Mr. Conran observed in his Affidavit that because LILCO believes the term "important to safety" as used in the NRC reg-ulations applies only to safety-related equipment, LILCO in i

fact does not recognize the existence of regulatory require-ments covering the set of equipment that is important to safety but not safety-related. Accordingly, Mr. Conran now believes there is a substantive defect (as opposed to a differing use of 51 -

i language), in LILCO's understanding of what is required as a minimum to protect the public health and safety. (Finding S7B:5).

As we noted in Section II.A, the NRC's regulations do not in our view require an applicant to use any particular classi-fication terms; rather, they require compliance with substan-1 i tive regulatory requirements. Accordingly, we find significant Mr..Conran's conclusion that LILCO does not understand, as a matter of substance, the scope of the NRC's regulations.12/ As a general matter, so long as LILCO interprets the NRC regula-tions to cover only safety-related equipment, LILCO's under-standing of what is minimally necessary to operate a plant without undue risk to the health and safety of the public differs markedly from that of the Staff. (Findings S7B:8-10).

Stated simply, LILCO refuses to recognize the existence of an i

i 12/ We note that although it would have been helpful if Mr.

Conran had reached these conclusions earlier in the liti-gation process, his explanation for the timing is persua-

! sive. He stated that he reached his conclusions as a l

result of a combination of three factors: (1) an opportu-nity to review thoroughly and consider LILCO's 7B testimo-ny; (2) his involvement in the Staff's review of LILCO proposals to the Staff.for resolving the so-called "lan-l guage differences"; and (3) a synergistic consideration of l those two factors. (Finding S7B:6). His conclusion was

! also based upon what he termed the surprising lack of sig-

! nificant effort by LILCO to develop or promote mutual un-derstanding with the Staff on the identified differences between them, and LILCO's steadfast refusal, over a period I of several months, to accept the Staff's interpretation of l its own regulations. (Findings S7B:7, 48-49).

I

[

entire set of SS&Cs (those important to safety but not safety-related) which the NRC considers significant enough to require its regulatory attention. (Finding S7B:ll). Despite LILCO's assertions that its philosophy includes consideration of the safety significance of nonsafety-related SS&Cs, we nontheless cannot ignore LILCO's refusal to acknowledge that i

the regulations cover, and indeed require that a particula.r type of consideration be given to, nonsafety-related equipment that is important to safety. (Finding S7B:9).

We believe that LILCO's refusal to recognize the NRC's regulatory authority constitutes sufficient reason to deny LILCO a license. The Staff has so urged, as has Mr. Conran and Suffolk County. (Findings S7B: 46, 66). During the reopened proceeding, the parties discussed the impact of LILCO's posi-tion on design and construction, and on actual operation of the plant.

(a) Design and Construction We have discussed at some length our views concerning the effect of LILCO's misinterpretation of the regulations on the QA measures applied during the design and construction of Shoreham. (See Section II.B.2, ab ve). During the reopened proceeding, there was substantial discussion concerning LILCO's I

application of quality standards, as opposed to QA measures, 4

during design and construction.13/ Quality standards l

l 13/ Quality standards are specifications or standards found in

the NRC's regulations and its regulatory guidance, which (footnote con't) i

applicable to SS&Cs important to safety are found in the SRP and in the Staff's Regulatory Guides. (Finding S7B:20).

Mr. Conran and the County witnesses testified that because LILCO regards the NRC's regulations as applying only to safety-related equipment, there is no assurance that LILCO properly applied the quality standards set forth in those regu-lations and related regulatory guidance during the design and construction of Shoreham. (Finding S7B: 19). The Staff's posi-tion remained unchanged from that stated in its initial testi-mony: that is, its audit review, based on the SRP and the dis-cussion of specific examples during the 7B hearing, satisfied the Staff as to LILCO's regulatory compliance during design and construction. (Finding S7B:21).

Uhile acknowledging the Staff's position, Mr. Conran nonetheless stated that in his opinion, the normal SRP and Reg-ulatory Guide review can only "perhaps" provide a safety net or backstop to mitigate the serious misunderstandings which exist between LILCO and the Staff. (Findings S7B:19, 22, 24). Mr.

Conran's reservations concerning the adequacy of the Staff's -

review of design and construction at Shoreham focus on two (footnote con't from previous page) identify performance levels or materials requirements which must be met in designing, constructing, or operating a plant. QA measures, on the other hand, are the actions i taken to implement compliance with quality standards.

(Finding S7B:20).

l l

cepecto of that reviews (a) its scopa; and (b) its reliance on affidavits from the applicant relating to those items not reviewed. (Finding S7B:24).

With respect to the scope of the Staff's audit, Mr. Conran stated that the Staff soould review an expanded sample of items at Shoreham in order to be certain that there is compliance with the regulatory requirements for SS&Cs important to safety l

but not safety-related. He testified that in light of LILCO's persistent disagreement with the Staff on the meaning of safety importance, the limited scope of the Staff's audit review, even as supplemented by the specific examples discussed on this record, is still insufficient to permit an affirmative conclu-sion that there is reasonable assurance of compliance in all areas. (Findings S7B:25, 26. See also S7B: 23). The County witnesses had stated this position earlier and agreed with Mr.

Conran's conclusions. We find that Mr. Conran's opinion in this regard provides additional support for our belief, stated above, that the Staff's review of the Shoreham design and con-struction was in fact inadequate. See Section II.B.2(c) above; see also Finding S7B:27.

We so conclude despite LILCO's suggestion that Mr.

( Conran's opinion should be rejected out-of-hand b'ecause he was unable to provide any specific examples of an instance where

(

LILCO's misinterpretation of the regulations had a substantive effect. See LILCO Proposed Opinion at 70 and n. 26.14/ We find

(

( 14/ We recognize that this LILCO argument was actually

( addressed to Mr. Conran's opinion that LILCO's interpreta-

[

l (footnote con't)

Mr. Conran's explanation for the lack of readily identifiable examples of such noncompliance -- that is, specific Shoreham equipment which had not in the Staff's view received proper treatment -- to be persuasive. He indicated that " examples" of noncompliance discovered during the Staff's review process would, in the normal course, find expression in Staff inquiries to LILCO. Generally, the Staff's concerns would be phrased in terms of the Staff's need for additional information, not in terms of " noncompliance with the regulations." Thus, such "ex-amples" would not have been flagged as noncompliances. In addition, any such concerns presumably have by now been re-solved to the Staff's satisfaction. Thus, at this point, it is not surprising that no examples of such noncompliance remain outstanding. (Finding S7B:28). Our familiarity with the give and take involved in the typical Staff review process leads us to accept Mr. Conran's explanation. We conclude that his in-ability to point to a particular example of noncompliance in l

the areas covered by the Staff's re'iew v is of no moment.

l (footnote con't from previous page) tion of the regulations would affect Shoreham operation,

! rather than his concern about design and construction. We l

discuss it in the context of design and construction, how-ever, because as applied to operations it is specious.

Shoreham has not operated yet; Mr. Conran could not be ex-pected to provide examples that have not yet occurred.

l Moreover, Mr. Conran and the Staff did provide specific examples of areas in which they expect LILCO's performance i to suffer during operations. See Section (b) directly I below.

l l

1

similarly, wo do not find it surprising or disturbing that Mr. Conran is unable to identify a particular example in the areas not reviewed by the Staff. As we understand Mr. Conran, his point is not that specific noncompliances necessarily exist, rather, LILCO's refusal to acknowledge the full coverage of the NRC's regulations leads Mr. Conran, and this Board, to conclude that in this case, a conclusion of reasonable assur-ance of compliance cannot be derived from the limited audit review conducted by the Staff.15/ Accordingly, while specific examples would have been desirable, their absence is not dis-positive. Given the unusual circumstances of this applicant's denial of regulatory authority over an entire class of equip-ment, we agree that in this case, the Staff's audit review should involve a larger than usual sample.

Mr. Conran also restated, with renewed emphasis, his concern that the Staff's review may have been inadequate be-cause of its reliance upon LILCO's affidavits of compliance with the Staff requirements. As we have already noted, we agree with Mr.,Conran and the County witnesses that the Staff cannot rely upon such assurances coming from this applicant i

15/ Despite its position with respect to Shoreham design and construction, even the Staff acknowledged that differences in equipment classification that may have gone undetected during the Staff's audit review could result in unfavor-able performance during plant operation. (Finding S7B:27).

l O

because LILCO does not recognize that the Staff's requirements cover the class of equipment important to safety but not safety-related. ( Findings 7B:29-31) .16/

(b) Operations The focus of the safety classification discussion during the reopened proceeding was on the question whether LILCO's misinterpretation of the term "important to safety" was signif-icant for operation of the Shoreham plant. Mr. Conran, the other Staff witnesses, and the County witnesses were in agree-ment that LILCO's refusal to acknowledge and adopt the Staff's interpretation of its regulations would adversely affect the safety of Shoreham operation. (Findings S7B: 40, 43). We note at the outset of this discussion our disagreement with LILCO's characterization of the Staff's position in the reopened pro-ceeding concerning the adequacy of LILCO's regulatory compli-ance as applied to operations. See LILCO Proposed Opinion at 66 (n. 23), 67, and 68-69.11/ Contrary to LILCO's assertion 16/ As the entire preceding discussion makes clear, we take issue with LILCO's assertion that "even Mr. Conran did not express any serious reservations about LILCO's compliance with NRC regulations during the design and construction of Shoreham." LILCO Proposed Opinion at 68.

17/ On page 66 at note 23 of its Proposed Opinion LILCO states that the Staff testified "that a commitment from LILCO to do in the future what had been done in the past would. sat-isfy the Staff's interpretation of GDC 1"; on page 67, LILCO states that the Staff's prefiled testimony " general-ly reaffirm [ed] the position [] taken in the prior litiga-tion"; and on pages 68-69, LILCO states: "The Staff disagreed with [Mr. Conran's] conclusion (that with

( footnote con' t) that the Staff "is satisfied" by a LILCO commitment to comply with GDC 1 during operations, we believe a more accurate char-acterization is the following: the Staff testified in the reopened proceeding that given LILCO's refusal to adopt the Denton definition of "important to safety," even LILCO's com-mitment to "do in the future what had been done in the past" would not constitute an acceptable basis for licensing l

Shoreham. (Findings S7B:40, 42, 46, 64, 66, 70). See Section II.B.2(c) below. Indeed, even LILCO agreed that the difference

, in sadety classification terminology would lead to confusion between LILCO and the Staff during operations. (Finding S7B:43).

We concur with the Staff's observation that LILCO's fail-ure to acknowledge the applicability of regulations to equip-ment beyond that defined as safety-related will result in a lower standard of performance during operation. (Finding S7B:44). Poor performance is likely to occur with respect to treatment of nonsafety-related equipment (including both l

i (footnote con't from previous page) respect to the operation of Shoreham, LILCO's quality as-surance and quality standards for nonsafety-related SS&Cs I

are inadequate]"; "LILCO satisfied the Staff's concerns about compliance with GDC 1 during operations by commit-ting to make certain changes to the Shoreham FSAR and

! other LILCO documents . . . "; and "The Staff believes that

[the LILCO] commitment [to amend the FSAR] will ensure j that GDC-1, as the Staff interprets it, is met during l operation."

- - . - - . - - . _ = _ - _ _ _ _ - -

requirements, and cooperation with NRC inspectors. (Findings S7B:44, 45).18/ Although we disagree with the Staff's conclu-sion regarding the adequacy of Shoreham design and construc-tion, we are persuaded that there is even more cause for concern with respect to operation because there is little if any " safety net" (such as the SRP serves, in the Staff's view, during design and construction) available during operation to mitigate the adverse effects of LILCO's misunderstanding of the ,

Staff's regulations. (Findings S7B:41, 42). The Staff itself emphasized that during Shoreham operations, Staff resources and ,

time will not be available to permit the type of extensive review, with numerous follow-up discussions, supplemented by  ;

, months of testimony, which was necessary for the Staff to reach i

18/

We are cognizant of Mr. Pollock's statement that LILCO believes NRC inspectors have a legal right to inspect all

! parts of a nuclear plant. Mr. Pollock also suggested, however, that LILCO would be much more likely to' challenge a finding of violation concerning nonsafety-related equip-

' ment than one concerning safety-related equipment. Mr.

Pollock stated: "We would be dealing on a different set of ground ~ rules [:] within the safety-related area, [it is] specifically covered by regulation. In a ncnsafety-

, related area, it is not." (Finding S7B:85). Mr.

Pollock's comment is telling; it indicates the legitimacy of the Staff's concern, which we share, about the Staff's r ability to regulate this applicant if it were granted an i operating license. Although LILCO asserts "That LILCO might subsequently object to a citation as legally unfounded is of no moment," (LILCO Proposed Opinion at l 73), we disagree. Having been placed on notice that LILCO is likely to challenge the Staff's regulatory authority with respect to an entire class of equipment, we cannot ignore the implications of that fact.

i l

m. .,w.. e -

,...e ..---,.-.--*.w-ee ------,,-w--

its conclusion on the adequacy of Shoreham's regulatory compliance during design and construction. (Finding S7B:42).

We also concur with Mr. Conran's observation that LILCO's compliance with regulatory requirements during design and con-struction does not necessarily provide substantial comfort con-cerning the likelihood that such compliance will continue dur-ing operation. In our view, there is a difference between com- ,

plying with a particular regulatory requirement and acknowledg-ing that the action necessary to achieve such compliance is ei-ther necessary for safety or required by the regulation. The significance which LILCO attributes to equipment will govern the treatment of that equipment for the thirty or forty years of plant operation. Despite LILCO's repeated statements on

~

this record that it has and will continue to attribute some safety significance to nonsafety-related equipment, its insis-tence that such consideration is not required under the regula-tions causes us substantial concern. In sum, we believe that LILCO's basic conceptual difference with the Staff over what is required for safe operation of the plant -- i.e., the scope of the NRC regulations -- will permeate the operation of Shoreham and is likely to affect in a negative way the safety of that operation. (Findings S7B:9-11, 27, 32-34).19/

19/ LILCO's own testimony provided a concrete example of how its interpretation of the regulations would result in reg-ulatory noncompliance during operations. The LILCO witnesses testified that under their interpretation of 10 i (footnote con't) 61 -

(c) Necessary Conditions of Licensing In the reopened proceeding, all witnesses with the obvious exception of LILCO, requested this Board to require as a condition of licensing that LILCO accept and adopt the Staff's definitions of safety classification terms, as set forth in the Denton Memorandum. (Findings S7B:16, 46). For the reasons al-ready discussed, we agree that such a condition is necessary.

In addition, we recognize that the mere imposition by this Board of a definition upon LILCO would not necessarily achieve the desired result -- that is, an alteration in LILCO's under-standing of the scope of the NRC's regulations and its imple-mentation of that understanding during operation. Therefore we find that as an additional condition of licensing', LILCO must demonstrate its substantive understanding of the regulations.

(Findings S7B:47-50).

We have given substantial thought to the form such demon-stration should take. We are also cognizant of the Staff's view that the preparation of a list of SS&C's that are (footnote con't from previous page)

CFR S 50.59, LILCO would not be required to obtain prior Staff approval before making an equipment change which may increase the probability of the occurrence, or the consequences, of a malfunction of equipment important to safety but not safety related. (Finding S7B:86). Accord-ingly, we reject LILCO's argument, at pages 74-75 of its Proposed Opinion, that LILCO's interpretation of the term "important to safety" will have no impact on LILCO's com-pliance with its reporting obligations.

importcnt to sofoty 10 not nacoccery cnd may not b2 tho moat efficient use of resources. (Finding S7B:63). However, we believe that for this applicant, the preparation of such a list would be the most effective means of ensuring that the existing and potential future problems of communication and mutual un-derstanding between the Staff.and LILCO, as well as LILCO's misinterpretation of the scope of the NRC's regulations, will be eliminated. (Findings S7B:55, 58-60). Accordingly, we require LILCO to prepare a list, at the component level, of SS&Cs at Shoreham that are important to safety under the Staff's definition of that term. (Finding S7B:62).

In so ruling, we take into account the testimony by Mr.

Conran and the other Staff witnesses to the effect that the preparation of such a list would not be particularly difficult.

They base their opinion or; two premises: (1) SS&Cs important to safety are addressed and, by implication, identified in the SRP and regulatory guides; and (2) if an applicant's safety classi-fication process has been set up with due consideration of both safety-related and important to safety equipment, a list of equipment important to safety could be easily derived. (Find-ings S7B: 53-57, 63). Accordingly, if LILCO is correct in its assertion that philosophically it has already complied with the

" intent" of the Denton definition of important to safety, it should not be difficult for LILCO to prepare the list which we require.20/

20/ As several witnesses have pointed out, a draft systems level list of. equipment important to safety has been (footnote con't) l

(d) LILCO's Opposition to Licensing Conditions In its proposed Opinion LILCO addresses at length the pro-posed licensing condition requiring adoption of the Denton ter-minology.21/ We now turn to LILCO's arguments on that point.

First, LILCO purports to find in the Staff's supplemental testimony a Staff " acknowledgment" that LILCO is correct in characterizing the Denton Memorandum as " imposing new require-ments." See LILCO Proposed Opinion at 47 and 75-76. We do not find the Staff's testimony in the reopened proceeding in any way inconsistent with its original testimony concerning the Denton Memorandum. (See Findings 7B:17-24, 28-29, and our (footnote con't from previous page) prepared for the Staff by EG&G, one of its contractors.

This draft also contains a list of 23 factors or guidelines for ranking the safety significance of individual components within a given system. This draft list should provide a useful starting point for the LILCO effort. (Findings 7B: 67, S7B:61, 62).

21/ LILCO LILCO did not bother to address in its Proposed Opinion the necessity for a list of SS&Cs important to safety. See LILCO Proposed Opinion at 72. In this regard, we disagree with LILCO's disingenous observation that Mr. Conran thought a list would be "only marginally beneficial." LILCO Opinion at 72. Mr. Conran clearly stated his belief that such a list is essential for p Shoreham. (Finding S7B:52, 58). We also decline to

, accord any weight to the fact that Mr. Goldsmith, a Suffolk County witness who sponsored supplemental testimo-ny on USI A-17 but not on safety classification, stated that he had not formed an opinion on whether a list is necessary. See LILCO Proposed Opinion at 72. The County witnesses who testified on safety classification stated clearly their opinion that a list is necessary. (See Findings S7B:58, 59, 74, 75).

64 -

l

discussion in Section II.A. above.) Thus, although the Denton definition of the term "important to safety" was described by one Staff witness as "new," that witness' testimony as a whole makes clear that the definition is a " clarification" of the meaning of existing regulations. (Findings S7B: 12-13). While acknowledging the existence of confusion and even misuse of i

regulatory terminology prior to the issuance of the Denton Mem-orandum, the Staff maintained its position that the Memorandum does not in any way change (as opposed to clarify) the regula-tions. We believe an accurate characterization of the Staff's testimony is: the clarifications contained in the Denton Memo-randum may have been new; the definition, and the fact that the equipment within the definitica is covered by the regulations, is not. (Finding S7B:12). If the Denton definition is "new" to LILCO, that " newness" can only be attributed to LILCO's mis-understanding of the regulations as written.22/

Second, in the reopened proceeding, LILCO reiterated its argument that the nuclear industry in general has interpreted the NRC regulations to apply only to safety-related equipment i as asserted by LILCO. We have dealt with this argument earlier l

P 22/ Because we accept the Staff's interpretation of its regu- '

l 1ations and, accordingly, agree that the Denton Memorandum is a clarification rather than a new requirement, we do not need to respond to LILCO's argument that a rulemaking is necessary to justify the imposition of the Denton defi-nitions on an applicant.

l l _ - _ _ ~ . - . . _ , . _ _ . - - . _ - - . _ - _ - - _ - - .- . - - .

1 in this opinion. (See Section II.A. above.) It is pertinent to note, however, that both Mr. Conran and the other Staff witnesses disagree with LILCO's assertion that its interpreta-tion is no different from that of other applicants and licens-ees. Mr. Conran stated, for example, that to his knowledge no other applicant or licensee interprets the term "important to safety" as LILCO does; no other applicant or licensee differs co fundamentally with the Staff on the meaning of the concept of "important to safety"; and no other utility refuses to recognize the existence of regulations for equipment important to safety but not safety-related. (Finding S7B: 14).23/ The Staff witnesses testified more affirmatively on this point. At least one other licensee -- Metropolitan Edison -- has been more willing than LILCO to accept the attitude toward imple-mentation of safety requirements that is desired by the Staff.

Metropolitan Edison has, in fact, adopted the Denton defini-tions as required by the Staff. (Finding S7B: 15).

Third, the central point in LILCO's argument against a re-quirement that it adopt the Denton definitions boils down to a substantive objection to the NRC's regulations. See, e.g.,

LILCO Proposed Opinion at 77, n. 31. LILCO argues that it 23/ Mr. Conran has recommended in a Differing Professional Opinion dated March 31, 1983, that the Staff undertake to determine whether there is a common understanding of the concepts involved in the use of the term "important to safety." See Finding S7B: 14 n.2.

should not be required to adopt the Denton definition of "important tc safety" as it is used throughout the NRC regula-tions because that definition is too vague and open-ended.

(Finding S7B:77). The fact that a utility does not like a j.

particular regulation, or that it believes a regulation could or should be written differently, does not justify its refusal to comply with that regulation. The proper course for such a utility is to apply to the NRC for an exemption or to seek NRC clarification of the requirement, as by a rule making request, not to request a Licensing Board to rule that it is not required to comply with the objectionabla regulation.

Nonetheless, we have several comments on the substance of LILCO's vagueness argument. First, if other licensees are able to understand and apply the Staff's regulations as clarified by Mr. Denton's Memorandum (e.g., Metropolitan Edison), we see no reason why LILCO is unable to do so. Furthermore, in response to questions from the Board and Staff counsel, LILCO represen'-

tatives made clear that no definition of the term "important to safety" that would be satisfactory to them unless it were lim-ited to the safety-related set of equipment. (Findings -

t i S7B:78-81). This fact only reinforces our view that without i

action by this Board, there is no assurance that LILCO has in the past, or will in the future, comply with the regulations as written and interpreted by the Staff.24/

24/ There is no denying that the Denton definition is a general one and that the boundaries of the important to (footnote con't)

Moreover, in the reopened proceeding, the only point on which all witnesses agreed was that LILCO's failure to adopt the Denton definition would result in confusion between the Staff and LILCO during Shoreham cperation. (Finding S7B:43).

In its Proposed Opinion LILCO argues that its use of the Denton definitions would create e/en more confusion. See LILCO Proposed Opinion at 72-73. We reject this argument in light of our finding that the preparation of a list of equipment impor-tant to safety is necessary at this plant. In our view, LILCO's preparation of such a list, which will be reviewed by the Staff, will do more than any other device this Board can imagine to eliminate the possibility of confusion.

Fourth, LILCO argues that Mr. Conran " confuses" a dispute over the construction of a regulatory term with the presence or absence of the knowledge required to build and operate a plant (footnote con't from previous page) safety set of equipment are not as sharply drawn as they might be. As LILCO has recognized, however, regulations are frequently both general and vague. See LILCO Proposed Opinion at 77, note 31. Nonetheless, this Board is bound to apply the regulations as written, and applicants are obligated to comply with those regulations unless they have obtained appropriate relief. In this instance, the f Staff has provided regulatory guidance and a clarifying memorandum to assist applicants in such compliance. LILCO may in fact have difficulty defining the outer boundary of the set of equipment important to safety in complying with the regulations; such difficulty, however, does not exempt LILCO from its obligation to comply in good faith and to the best of its ability with those regulations.

l l

safely. See LILCO Proposed Opinion at 70-71. The point made by Mr. Conran, with which we agree, is that given LILCO's " dis-l pute" over the construction of the Staff's regulations, it is not possible to state with confidence that there is reasonable assurance that LILCO has designed or will operate its plant according to the safety requirements set forth in the regula-tions. There is no confusion.

We also reject LILCO's assertion that " agreement with the Staff on the definitions of regulatory terms is not in itself a valid test of understanding safe plant construction and operation. . . ." LILCO Proposed Opinion at 71. We believe that agreement per sjt would not indicate that a utility's un-derstanding of safety was necessarily consonant with that of the Staff. However, a vigorously asserted disagreement, such as LILCO's, is something else. At the very least, this indi-cates the applicant does not feel strongly enough about its agreement with the Staff's safety philosophy (if such agreement exists) to commit formally to implement that philosophy for the life of the plant. At worst, it indicates that the applicant in fact has a very different concept of safety. (See Findings S7B:10-ll, 32-34, 39, 48-49). In this case, there is no doubt

?

that LILCO questions the authority of the NRC to regulate its L activities. Indeed, LILCO states bluntly that its dispute is "over agency jurisdiction." LILCO Proposed Opinion at 71. In our view, such an attitude on the part of an applicant is i

sufficient in itself to deny that applicant an operating license.25/

(e) Proposed FSAR Commitments Following the original hearing on Contention 7B, the Staff and LILCO engaged in a series of discussions and correspon-dence, in an apparent effort to resolve the differences identi-l fled during that hearing. (Findings S7B:49, 64, 65). These efforts were unsuccessful, because LILCO refused to adopt the Denton definitions and because none of the alternatives pro-posed by LILCO involved any change in LILCO's interpretation of the regulations. (Finding S7B:49).

There was much discussion during the reopened proceeding of the last set of commitments proposed by LILCO: LILCO pro-posed to amend its FSAR to commit that nonsafety-related SS&Cs 25/ In footnote 27 on page 71 of its Proposed Opinion, LILCO states:

LILCO does not assert that the NRC cannot exercise jurisdiction over nonsafety-related items as envisioned by Mr. Conran.

Rather, LILCO believes the NRC has not ex-ercised such jurisdiction in the past and must proceed by rulemaking if it intends to do so in the future.

f In our view, this is a distinction without a difference. Since the Staff has stated that its regulations dio cover nonsafety-related equipment that is important to safety, LILCO's position on the meaning of the term "important to safety" does constitute a challenge to the agency's ju-risdiction.

"shall be accorded the safety significance given to [them) in the FSAR, the technical specifications, and the emergency operating procedures," in LILCO's preventive and corrective maintenance program, design change control program, procurement procedures, procedures for modifications and removal of equip-ment from service, and the QA program. (Findings S7B: 64, 65).

Following a meeting on February 18, 1982 (after the filing of Mr. Conran's Affidavit), the Staff extracted this commitment from LILCO with the understanding that LILCO would also accept and adopt the Denton definitions (Finding S7B: 64). Subse-quently, LILCO submitted to the Staff three examples of lan-guage it intended to incorporate into the proposed FSAR amend-i ments. The proposed amendments are very general and tend to repeat verbatim the Staff's request for a commitment. They in-dicate that during Shoreham operation, various LILCO personnel will exercise their judgment concerning the appropriate treat-ment for equipment, by considering the safety significance accorded to such equipment in the FSAR, technical specifica-tions, and emergency operating procedures. (Finding S7B: 65).

Because the LILCO commitment does not include an agreement to accept the Staff's definitions, the proposed FSAR amendments do not constitute an acceptable basis for licensing the plant i

in the Staff's view. (Finding S7B:66). Both Mr. Conran and the County witnesses additionally criticized the proposed FSAR amendments on the basis that they do not address the root cause j -

71 -

of the safety classification problem. (Findings S7B:67-72).

We agree with both observations.

Standing alone, the proposed FSAR amendments change nothing. They merely restate what LILCO has said all along --

that " consideration" will be given to nonsafety-related equip-ment. That " consideration" will be based upon the " safety sig-l nificance" assigned to such equipment in LILCO's FSAR, technical specifications, and emergency operating procedures.

Of course, the heart of the dispute with LILCO is precisely that -- LILCO assigns a level of " safety significance" different from that assigned by the Staff and the County, to the entire set of equipment that is important to safety but not safety-related. (Finding S7B:67, 68; see also S7B:49).

In addition, since the term " safety significance" as used in the proposed LILCO FSAR amendments has not been defined, the commitments contained in the amendments are meaningless.

(Finding S7B:69). As the Staff and Suffolk County witnesses pointed out, in order to implement the proposed amendments in any meaningful way, LILCO's records and procedures would have to be modified so the " safety significance" accorded to all

SS&C's important to safety is identified and described in such Y

a way that future plant employees are appropriately instructed.

(Findings S7B: 70-71). Absent such implementation, which in our view could be accomplished only if a listing of SS&Cs important to safety were first compiled, there is no assurance that a

maintenance worker, or other LILCO employee who deals with a problem in the plant years from now, will correctly identify j either the " safety significance" of the equipment involved or

the " appropriate" action to be taken. (See Findings S7B

73, 74). The Board finds that in order to make the proposed FSAR

amendments meaningful and achieve appropriate implementation of those amendments, LILCO must identify the equipment important j to safety in the plant, identify and document the " safety sig-nificance" of all such equipment, and then appropriately modify the pertinent plant documents and procedures to reflect the past and future treatment to be accorded such equipment.

i (Finding S7B:75).

1 I I The Staff /LILCO Methodology for Systems Classification III.

Is Inadequate The Staff and LILCO have used a traditional DBA methodolo-gy for systems classification at Shoreham. The Board finds that this methodology has been applied in a nonsystematic  !

i

manner and results in incomplete compliance with regulatory re-quirements. The Board further finds that there are available means to supplement this approach to ensure systematic classi-h fication of SS&Cs important to safety at Shoreham. The bases for these conclusions are set forth below.

l j A. The Staff /LILCO Methodology for Systems Classification

In the FSAR and in its prefiled Contention 7B testimony, i

l l

' ___._:___.._._._,,,-._ _ ~ _ _ . _ _ _ . . . _ . _ , _ _ _ _ _ _ _ _ _ _ . _ _ _ .

LILCO described the methodology it has used for classification of SS&Cs. That methodology is two-fold: the DBA approach contained in regulatory guides; and the industry standards ~

approach that has evolved over time. (Finding 7B:75).

The DBA approach originated in the 10 CFR Part 100, Reac-tor Siting Criteria. (Finding 7B:90). Under this approach, LILCO followed NRC guidance and in FSAR Chapter 15 analyzed specific accidents which, if not controlled, would create situ-ations which might violate Part 100 criteria. These accidents were analyzed using the single failure criterion and it was demonstrated that there were SS&Cs that would prevent exceeding the release limits of 10 CFR Part 100. Such SS&Cs that were required to function to avoid violation of Part 100 criteria were classified by LILCO as safety-related and the full QA re-quirements of 10 CFR Part 50, Appendix B, were designated to be applied to ensure that necessary quality was achieved. Other SS&Cs -- i.e., those not required to function in prevention or mitigation of the Chapter 15 DBA events -- were classified as nonsafety-related. (Findings 7B:77, 85-94).

The DBA classification methodology was supplemented by ap-

. plication of additional NRC regulatory guidance and industry standards. Chief among those used at Shoreham were Regulatory Guide 1.29, " Seismic Design Classification," Regulatory Guide 1.26, " Quality Group Classifications and Standards," and American Nuclear Society ("ANS") 22, " Nuclear Safety Criteria l l l

l

t for the~ Design of Stationary Boiling Water Reactor Plants."

Thus, Regulatory Guide 1.26 was used to determine quality group classifications for fluid system components, Regulatory Guide 1.29 was used to identify SS&Cs that must be seismic Category I

1, and ANS-22 was used to establish a uniform basis for design classification requirements. The use of these Regulatory

{ Guides and industry standards supplemented the DBA approach particularly because they pulled together industry and regula-tory experience regarding those SS&Cs which needed to be clas-sified as safety-related. (Findings 7B: 119-28).

The result of the DBA/ regulatory guide / industry standards approach was to identify a set of SS&Cs which were classified as safety-related. These SS&Cs, in accordance with Staff guid-

! ance, are identified in FSAR Table 3.2.1-1 as QA Category I.

Remaining SS&Cs at Shoreham are classified by LILCO as nonsafety-related and are designated in FSAR Table 3.2.1-1 as i QA Category II. (Finding 7B:16).

The Staff review of the Shoreham operating license appli-l

! cation is based upon the Standard Review Plan ("SRP"). This review closely tracks the methodology used by I.ILCO which, in L turn, follows Staff guidance. Thus, Chapter 15 of the SRP constitutes the Staff's review procedures for analyzing an ap-plicant's DBA analyses. Further, the Staff reviewed LILCO's

l application of Regulatory Guides 1.26 and 1.29 to ensure that the LILCO interpretation of those documents was consistent with NRC practice. (Findings 7B:77, 79-81, 88, 126-27).

B. The Staff /LILCO Methodology for Systems Classification Has Severe Deficiencies This Board finds that the Staff /LILCO methodology for systems classification has severe deficiencies which preclude a finding that LILCO has complied with regulatory requirements.

First, the use of DBA analyses and Regulatory Guides 1.26 and 1.29 results only in the identification of safety-related i

SS&Cs. This guidance does not specifically identify the broader class of SS&Cs important to safety which must be ana-lyzed so that an applicant can comply with 10 CFR Part 50, Ap-pendix A.26/ Thus, the Staff's guidance is incomplete and LILCO, which has relied upon this classification guidance, has developed a classification scheme which is incomplete when com-pared to regulatory requirements. (Findings 7B:77, 82-83, 111, 115, 129-131, 134).22/

26/ Mr. Conran and the Staff believe that all SS&Cs important to safety are addressed in regulatory guides and the SRP. Mr. Conran believes a specific list of SS&Cs important to safety would be useful to summarize the mass of data contained in the four volumes of the SRP.

(Findings S7B:53, 55).

27/ Further, these two regulatory guides are limited

in scope to fluid systems and seismic classifi-cation. The Staff guidance and review assumes that equipment related to fluid systems is designed to the same quality standards. The guides do not address other related equipment regarding safety classification. As a result, there are gaps left for interpretation of how a system should be classified. (Findings 7B:123, 129-34).

Second, notwithstanding the limitation of Staff guidance to safety-related SS&Cs, the Staff undertakes no systematic ef-forts to ensure that an applicant properly interprets regulato-ry requirements pertaining to classification of SS&Cs important to safety but not safety-related. This lack of systematic Staff review was most graphically illustrated by the fact that I

the Staff, despite the FSAR having been filed in 1976, and the Staff preparing a SER and two supplements, first learned of LILCO's misinterpretation of the GDC regulatory requirements when it reviewed LILCO's Contention 7B testimony. (Findings 7B:73, 78 ; see also Section II.B.3, supra).28/ The Staff review methodology is deficient if matters as significant as the interpretation of basic regulatory terms have not been identified prior to the operating license hearing.

Third, the DBA methodology used to " bound or encompass" accident sequences that could result in releases exceeding 10 CFR Part 100, Appendix A standards is incomplete and too re-strictive. This approach is based on the generic assumption that the probability of serious multiple failure accidents is I

( 28/ A similar example of the inadequacies of the j Staff's review process was.that Suffolk County l documented a host of deficiencies in LILCO's

, FSAR classification table (Table 3.2.1-1) in 1 late March 1982. These deficiencies and errors had not been identified by LILCO or the Staff which purportedly had reviewed that table.

l (Finding 7B:84).

sufficiently low that mitigation of the consequences is not necessary for public safety. (Finding 7B:99). However, the TMI accident and Browns Ferry fire are real events. They did not follow the stylized DBA approach. Further, these events in-volved multiple failures, which indicate the limitations of re-liance on the single failure criterion. (Findings 7B: 99, 110-14, 116-241). These accidents indicate a broader perspec-tive is required.. To repeat a statement quoted earlier:

[W]e have come far beyond the point at which the existing, stylized design basis accident review approach is sufficient. The process is not good enough to pinpoint many important design weaknesses or to address all the relevant design issues. Some im-portant accidents are outside or are not adequately assessed within the ' design envelope'; key systems are not ' safety related'; and integration of human factors into the design is grossly inadequate.

(Finding 7B:238).

The Board agrees with Suffolk County and the Rogovin Report that a shortcoming of the DBA approach ic that in the FSAR, the applicant is not required to analyze accidents more severe than the DBAs. (Finding 7B:99).

Further, the single failure criterion, while useful as an p analytical tool, has come to be viewed as a regulatory maximum.

l In fact, however, the GDC set forth minimum design standards, h which may be supplemented. (Finding 7B:109). In our view, the recent events at other facilities demonstrate clearly that com-pliance with what is the minimum required by the regulations is not acceptable.

l

Fourth, in addition to the foregoing deficiencies in the scope of the LILCO/ Staff methodology, it also appears that this methodology has been applied inconsistently. Two examples, one involving the turbine bypass system (" TBS") and one involving the rod block monitor ("RBM"), illustrate LILCO's failure to apply the traditional methodology in a consistent manner.

l The TBS is required to operate to mitigate several Chapter 15 events. In addition, in each of the EOPs reviewed by Suffolk County, the TBS was one of the first items of equipment which an operator may be directed to use. Therefore, even though the TBS is not " required" to mitigate a DBA, its use is clearly anticipated, since early actuation of the TBS, under certain scenarios, can avoid actuation of the safety relief j valves ("SRVs") and under other scenarios can reduce the 1

overpressure transient. Avoiding challenges to the SRVs is clearly desirable, particularly given the relatively large

! number of BWR SRV failures that have been reported. (Findings 7B:209-11, 213-14, 256, 258).29/

~

The TBS at Shoreham has been classified by LILCO as nonsafety-related, although in apparent recognition of its im-l portant role, some upgraded QA requirements have been imposed.

l This classification is in apparent contradiction to other

(.

29,/ For discussion of SRV failures, see Opinion and i Findings on Suffolk County Contentions 22 and 28(a)(vi), infra.

l

! i l

l

_ ~ __ _

I decisions where equipment relied upon in Chapter 15 has been i

classified as safety-related. There appears to be no real jus-l tification for classifying the TBS differently. (Findings 7B:200-04).

The Staff in its review justified the nonsafety-related classification for the TBS because the valves allegedly have had high reliability (based on industry experience), and be-cause they will be subject to periodic surveillance require-ments pursuant to the Technical Specifications. (Findings 7B: 205-06). This is not, however, a sufficient basis for clas '

sification. Rather, classification of SS&Cs should depend upon an analysis of how a particular structure, system, or component is used, i.e., a functional criterion, rather than a judgment concerning reliability. Accordingly, the Board. finds that the classification of the TBS is not based upon a systematic appli-cation of applicable methodology. (Findings 7B:207-08, 215-16).

! The Board notes that it does not hold that the TBS needs i to be classified as safety-related, although a systematic review of the TBS functions might result in such a classifica-tion. However, the TBS certainly is important to safety (Find-ing 7B:253) and needs an appropriate function-oriented analysis i

! to determine the role it will play in safe operation of the fa-cility. (Findings 7B:268-74). To the Board's knowledge, such a

specific analysis has not been performed. Therefore, it is I

impossible for the Board to determine whether the QA that has been applied to the TBS is commensurate with the TBS's impor-tance to safety.

Another specific example of inconsistent classification methodology by LILCO concerns the RBM. The RBM is relied upon to prohibit the withdrawal of a control rod so that local fuel damage does not occur. Where fuel damage occurs, safety sig-nificance may result. (Findings 7B:217-20, 225).

The RBM has important functional parts that are classified by LILCO as nonsafety-related despite the RBM's use to mitigate or prevent a transient in Chapter 15. In addition, the RBM is not considered as the single failure ir. this transient, in con-tradiction to the application of the single failure criterion.

(Findings 7B:221, 227-32).

In a manner similar to the TBS, the RBM has been subjected by the Staff to increased requirements. Thus, the Staff has applied considerations to assure reliability "over and above provisions which would normally apply to SS&Cs having no impor-tance to safety." (Findings 7B:222-23). However, as with the TBS, no specific analysis has been performed to assess the RBM 7

function and to justify its present classification. (Finding l

7B:230). Without a specific analysis, the Board cannot deter-mine whether this " half-important-to-safety" characterization by the Staff is appropriate. It is obvious that a nonsafety characterization is not sufficient. In addition, the Board l

finds that a failure that could cause the degradation of a fission product barrier compromises the Staff's defense-in-depth philosophy. (Finding 7B:5-6).

As a result, it is the Board's opinion that the RBM provides further evidence of a nonsystematic application of the DBA/ regulatory guide methodology by LILCO and a further example l

of the need for use of a classification scheme that recognizes the importance to safety of SS&Cs that are not classified as safety-related.

Fifth, the nonsystematic approach to system classification is also documented in our systems interaction discussion later in this Decision. In the so-called " Pilgrim event," a failure of the nonsafety-related drywell coolers caused inaccurate readings in the safety-related water level indication system.

(Findings 7B:148-49). There is no evidence that this potential for a nonsafety-related system to adversely affect a safety system had been carefully considered in the analyses leading to classification of the drywell coolers. Thus, neither the DBA analysis process nor any systems interaction studies conducted by GE had adequately detected and resolved this problem. (Find-ing 7B: 160). If proper environmental systems interaction analyses had been performed, it would have been determined that upgraded QA and operating requirements relating to permissible drywell temperature limits could have avoided the problem.

(Finding 7B:165).

C. A Review of LILCO Emergency Operating Procedures Will Improve Systems Classification As documented above, the Shoreham plant has beer, designed under the DBA approach for a specified spectrum o.1 transients and accidents. However, safe operation is not ensured only by the specific SS&Cs identified in Chapter 15 that are designed to control those events. Rather, undo: the de itse-in-depth approach and as a practical consequence of the way nuclear plants are operated, adequate safety dependa significantly on the use of many other plant design features, which are not presently classified as safety-related, but which may be used to control the course of anticipated transients and accidents.

(Findings 7B:5-6, 252, 256-58).

It is clear that the SS&Cs that are actually relied upon by operators in the EOPs fall within the category of important-to-safety. (Finding 7B:253). As a useful supplement to LILCO's existing classification methodology, a review of EOPs should be undertaken. The purpose of this review would be.

to determine: (1) what equipment is recommended to be used in response to particular events; and (2) what leve] of QA should be applied to ensure to the extent possible that, given a piece of equipment's likely use, it will be capable of satisfactorily t

l performing that function. Related to this second inquiry is the assessment of what impact, if any, may result from the failure of a piece of equipment, including the creation of f

t

undesirable challenges to safety-related SS&Cs. (Findings 7B:225-58, 262-75).

A review of the Shoreham EOPs reveals that a large amount of equipment is used during the response to transients and accidents, but that much of the equipment that is used is not mentioned in the Chapter 15 analyses or in FSAR Table 3.2.1-1.

! This omission further indicates that there has been a non-systematic approach to equipment classification, since the equipment that actually is being relied upon apparently has not been subjected to any documented analyses of its importance to safety. Secondly, the degree to which QA controls have been applied to design and construction, and will be applied during operation, cannot be discerned. The failure to use a systemat-ic approach to equipment classification increases the risk that equipment with important safety functions has been overlooked and that appropriate QA for this equipment may not be established. (Findings 7B:265-73, 275).

The Board finds that a systematic review of the Shoreham EOPs in conjunction with data that would identify the relative importance of this equipment (data such as frequency of use, availability of reliable backup equipment, . familiarity of oper-ators with the equipment, likely

! consequences / disturbance / operator confusion resulting from breakdown of the equipment) would produce a more comprehensive listing than presently exists of equipment important to safe i

I

oparation. (Findings 7B:270-73). The identification of SS&Cs in such a review would not necessarily result in reclassification of an item as safety-related. However, such equipment certainly would be considered important to safety and, once systematically identified and analyzed in terms of its safety significance during actual operation, an informed decision could be made regarding the amount of QA to be ap-plied. (Findings 7B:253, 260, 268-73).

LILCO has not undertaken a systematic review of equipment used in the EOPs. Such a review, in the Board's opinion, is essential in creating a listing of SS&Cs important to safety.

Further, such analysis is essential in determining whether the correct QA and classification have been imposed in view of the item's likely functions and the reliance placed upon it.

IV. Identification of Adverse Systems Interactions There is no dispute among the parties as to the importance of identifying potential adverse systems interactions. . Adverse systems interactions have resulted in accidents and precursor events of potential safety significance. (Findings 7B:277, 289). Under the NRC's regulations, such events must be identi-fled to ensure that the operation of the facility poses no undue risk to the public health and safety. Thus, in the

Board's opinion, it is fair to state that there is a regulatory requirement, particularly embodied in Part 50, Appendix A, In-l troduction and GDC 22, 24, 26 and 29, and also encompassed in the North Anna 30/ requirements related to unresolved safety 30/ Virginia Electric and Power Co. (North Anna Electric Power Station, Units 1 and 2),

t ALAB-491, 8 NRC 245 (1978).

l l

)

t issues pertaining to systems interactions, to ensure that ad-verse interactions are adequately considered in the design of a nuclear plant.

The issue in controversy in Contention 7B is how best to identify such interactions before they occur and whether LILCO's existing DBA methodology is sufficient for that 1

purpose. Further, Contention 7B also encompasses the question whether the Board can make the affirmative findings required by North Anna on Unresolved Generic Safety Issues ("USI") A-17 and A-47 which pertain to systems interaction.

To consider this matter, the Board addresses three

~

questions below:

Is there a need to identify potential adverse systems interactions in a systematic fashion going beyond the traditional DBA approach?

Are methodologies beyond the traditional DBA approach available to identify systems interactions and would their use be beneficial?

Has LILCO used such methodologies in a meaningful way to prov.ide assurance that potential adverse systems

interactions have been addressed at the Shoreham fa-l cility?

For the reasons specified below, we hold as follows: (A) potential adverse systems interactions need to be identified systematically; (B) methodologies which supplement the DBA l 1

approach are available, and can be used to achieve a more systematic assessment; and (C) while LILCO has performed some analyses and used similar methodologies to some degree, its ef-forts are not sufficient to provide the necessary assurance of safety at Shoreham. The Board also holds that the Staff's dis-cussion of "aea-^'"ad c=#a*"

Irrurr_USIs A-17 and A-47 per-taining to systems interactions is insufficient to provide a basis for operation of the facility while these issues remain unresolved.

A. Importance of Identifying Adverse Systems Interactions LILCO takes the position that the design process, supple-mented by traditional DBA analyses and compliance with regula-tory guidance, results in identification of the majority of potential adverse interactions. We have discussed in Section III how the DBA/ single failure criterion approach addresses safety classification of SS&Cs. We discuss here how that approach deals with the identification of systems interactions.

The general concern involved in the systems interaction issue is the possibility of one plant system's acting on one or more other systems in a way not consciously intended by design, thus adversely affecting the safety of the plant. (Finding 7B:280). In designing nuclear plant systems, a primary objective, as part of the defense-in-depth philosophy, has been to incorporate design features (e.g., redundancy and diversity

-. .. . . . . . . . . -- - - ~ ~ . - . . - - - - . --- _ - - _ - _ _ _ - . _ _

4 in systems that perform required safety functions, independence i of safety systems, and measures to protect against hazards like pipe ruptures, missiles, seismic events, and flooding), such

! that, ideally , several independent system failures must occur i

to degrade unacceptably or to fail totally any necessary safety function. (Finding 7B:281). The Staff thus testified that i the specific objective of a systems interaction analysis is to -

provide assurance that the independent functioning of safety systems is not jeopardized by preconditions within the plant design, particularly dependencies hidden in supporting and ,

i interfacing systems that cause failures or faults to be depen-j dent. (Finding 7B:282). The Staff and LILCO witnesses f

j testified that within the existing regulatory framework, the systems interaction concern is addressed by evaluating plant design against ectablished deterministic requirements and

! criteria embodied in existing regulatory guidance documents i

(e.g., regulatory guides and the SRP). (Findings 7B:287, 378).

Actual events at operating reactors have highlighted the limitations of reliance solely on the traditional DBA/SRP -

approach for detection and prevention of adverse systems inter-actions. For example, the fire at Browns Ferry and the TMI-2 accident involved several example of systems interactions.

Similarly, in 1980, both Crystal itiver 3 and Browns Ferry 3 l

suffered adverse systems interactions despite having been i subject to the existing DBA analyses and SRP review. (Finding 7B:289).

1---. w----m-- s ey- g yy,-- , ,, ---mg- , - - - - , ,-,---,,-r.-, .,ev wme,-*y--,--m----

Further, the importance of systems interaction identifica-tion is highlighted by the fact that the Staff has identified two unresolved safety issues, A-17, " Safety Interaction in Nu-clear Power Plants," and A-47, " Safety Implications of Control Systems," in the systems interaction area. (Finding 7B:279).

It was the frequency and possiole implications of actual

systems interaction events that have adversely affected redun-dancy or safety system function, which prompted the Staff to consider whether additional systems interaction analysis re-quirements should be developed to examine more fully the sus-ceptibility of a plant system to potential systems interac-tions. (Finding 7B

290).

The Staff and Suffolk County have concluded, and we agree, that the traditional approach to systems interaction identifi-cation is deficient in two respects. First, that approach is not systematic. Although numerous studies may be performed to verify either compliance with a regulatory requirement or the ability of a particular system to withstand a specific postu-lated interaction, the analyses are performed.in a piecemeal fashion. Discrete analyses, each with a distinct goal and purpose, are no substitute for a comprehensive and systematic analysis designed and performed for the specific purpose of identifying potential adverse systems interactions. (Findings 7B:277-78, 293-96, 299-330, 350-76).

89 -

Second, the traditional approach generally does not make the best use of available methodologies designed to identify systems interactions. (Findings 7B:277-78, 293, 295-97, 299-330, 350-76). There is no dispute that several methodologies or techniques exist that are useful in identi-fying potential adverse systems interactions. Such techniques include dependency analyses (such as failure modes and effects analyses ("FMEAs"), and commonality diagrams), comprehensive plant or system walkdowns, and fault tree / event tree analyses.

In addition, a PRA, if designed and performed for the purpose of identifying potential adverse systems interactions, can

. provide a framework for a meaningful combination of such tech-niques. (Findings 7B:211-92, 378-80). Although the DBA approach may make some use of these techniques, to date it has not been used meaningfully at Shoreham or to the full extent necessary to identify potential adverse systems interactions.

(Finding 7B:297).

The deficiencies of the traditional DBA approach were doc-umented in the Contention 7B hearing. Thus, Suffolk County presented evidence concerning two examples of adverse systems

, interaction events, both involving the safety-related BWR water level measurement system. Those examples, the Pilgrim flash-L ing/boiloff problem and the so-called Michelson concern, further demonstrate the deficiencies in the traditional approach. (Findings 7B: 135-99).

l 1

l In a BWR such as Shoreham, the water level measurement system plays an important role in safe operation. It is the only direct means by which an operator knows that sufficient core cooling is being provided and it provides the signals for actu.it!.on of reactor safety and protection equipment. Further, no other diverse system exists to provide this information to the operator should the water level system fail. (Findings 7B: 136-37, 142-45).

The first interaction example was the so-called " Pilgrim event." In 1981, at the~ Pilgrim Nuclear Power Station, a break-down in the nonsafety-related drywell coolers caused drywell temperatures to rise. The high drywell temperatures, in turn, resulted in flashing in the reference leg of the water level indicator system. The flashing caused the water level system to provide inaccurate indication, first reading too high and then too low. The false high signals could have resulted in an operator prematurely terminating feedwater or emergency cooling water flow. This was avoided at Pilgrim because the oscilla-tion bet _ ween abnormally high an.d. low water level readings

(

alerted the operators to the problem. (Findings 7B: 146-51).

The Pilgrim event constituted an adverse systems interac-l , tion between a sat ~ety system and a system that had been classi-r fled as nonsafety-related. The interaction was adverse and cons ti tutes.1a safety concern because it reduced the reliability r

of a crucial safety system and increased the opportunity for s

f s L

operator error due to the unreliable indications provided by the water level system. Such unreliable indication is clearly undesirable in a system as important as the water level indicator system. The interaction which caused the unreliable indication had not been precluded in the Shoreham design process and sufficient steps, such as temperature-related technical specifications, had not been implemented prior to the event to ensure that it would not occur. (Findings 7B:148-49, t

152-65).

~T he second example is the "Michelson concern," named after Mr. Carlyle Michelson, who headed a staff group which analyzed BWR operating data and determined that an adverse interaction, again relating to the BWR water level measurement system, existed between BWR plant control and protection systems. The interaction involved fluid coupling and sharing of instrument sensing lines by the sensors that monitor vessel level and provide input to both the protection and control systems. The Michelson concern, described in detail in the Findings, docu-mented design deficiencies in the BWR water level measurement system and a significant systems interaction. (Findings 7B: 166-99).

The Michelson design failure involved the adverse interac-tion between the reactor protection system and the nonsafety-related feedwater control system. (Findings 7B: 166-68, 178).

It results in a condition where a protection system

I malfunction (false high water level) causes the control system to respond to false high water level, thereby automatically decreasing feedwater flow in a manner that exacerbates the condition, at the same time possibly disabling the low-level reactor water level protective trip. That trip initiates ECCS water flow to provide cooling water to the fuel. (Findings 7B:169, 172). Thus, the Michelson findings included:

Hydraulic coupling exists between the sensors that provide input to the feedwater control system and to the plant protection systems.

-- A single failure in the instrument lines can decrease the reference leg level, caus-ing a spurious level to be sensed by the feedwater control system and also by two sensors of the protection system. The control system could respond adversely to the spurious level, with the result that protective action is required.

If a random failure then occurs in one of the remaining redundant protection l channels, automatic protective action will not occur. The operator is presented with conflicting information which may inhibit timely and correct manual actions.

(Finding 7B:169).

The Michelson analysts concluded that the foregoing situa-tion resulted in a condition which did not meet the intent of GDC 24. (Findings 7B:166-69). This Board agrees. As the Michelson analysts stated:

The single random failure is the decreasing ref-erence leg level and the resulting control system action is lowering of the actual vessel level, which would require a low level protec-

, tive action. Two protection channels . . . are prevented from performing their protective l l l

l

l actions, leaving redundant channels . . . to provide the required protective function. If a single active failure is now postulated in one ,

of the two remaining channels, then the required 1 automatic protective actions will not occur at the low water level scram setpoint. Further, if one of these four channels is inoperable due to maintenance or required surveillance, and is not placed in a trip condition, then this would tend to exacerbate the safety concern since the single failure of a decreasing reference leg

(

i could defeat the associated automatic protective actions at the low water level scram setpoint.

(Finding 7B:171).3_1/

t The Staff referred to the Michelson findings as a safety concern resulting from adverse systems interactions. (Findings 7B: 167-68, 196). LILCO disagreed with the characterization of this matter as a safety concern because it' believed that the s

plant would be able to survive the interaction. (Finding 7B:174). The Board agrees that this was a safety concern.

Failures which compromise the defense-in-depth levels of protection such as those documented by the Michelson concern, particularly where a GDC may be violated, clearly are matters of safety significance. The failures also reduce the

--31/ The Staff witnesses questioned whether the Michelson findings indicated a GDC 24 violation.

Staff practice apparently has excluded sensing u line failures from review. (Finding 7B: 179, l 197-99). The Board considers this to be an ar-l bitrary exclusion of hydraulically coupled instrument lines, particularly in view of the examples of failures set forth in the Michelson Memorandum and also since the Staff witnesses had performed no evaluation of the probability of such failures. (Findings 7B:180~61, 185-89, 197-99).

l l 1

redundancy of the water level system, again affecting its reliability, and result in conflicting data output to the oper-ator, a condition that could hamper timely and correct operator response. (Findings 7B:182-89).

Further, in the context of Contention 7B, the cc-trrl correct inquiry is whether the traditional l

design / classification process used by LILCO sufficiently con-sidered this adverse interaction, not whether the plant is predicted to survive the effects thereof. In this regard, the Board finds that the adverse interaction had not been identi-fled or largely precluded in the design process. Indeed, it was not identified until the Michelson review was undertaken.

(Finding 7B:174, 190-95). Thus, the methodology used did not detect the functional systems interaction that could lead to the loss of a necessary protective trip from a single failure.

Accordingly, the Board concludes that concrete examples have been provided of instances where adverse systems interac-tions had not been adequately addressed under the LILCO method-ology. These examples, as well as the other evidence docu-menting the importance of systems interactions at nuclear plants, lead the Board to conclude that supplemental methods, if available, must be used to identify systems interactions.

B. Supplemental Methodologies are Available to Address the Systems Interaction Issue Each of the supplemental methodologies mentioned earlier

(dependency analyses, comprehensive walkdowns, fault tree / event tree analyses, and PRA), referred to as " systems interaction techniques," provides a means of identifying potential systems interactions. (Finding 7B:291-92). These techniques focus attention on the impact, on other SS&Cs, of operation and/or failure of the particular system, structure, or component being l

studied. There was no dispute during the Contention 7B hear-ing that such techniques are available and capable of applica-tion at Shoreham.

In searching for potential interactions, these techniques go beyond the traditional DBA/ single failure criterion approach. That approach focuses on whether given a predeter-mined event, the plant is capable of reaching a particular goal 4

(such as achieving safe shutdown, or surviving an accident without exceeding the release limits of Part 100). (See Find-ings 7B:287, 299-330, 350-76). Systems interaction tech-niques, on the other hand, concentrate not just on reaching the ultimate goal, but also on what may happen in the process of achieving that desired goal. Thus, in focusing on dependencies and results of failures at the individual component or I

L subcomponent level, systems interaction techniques-permit a re-i viewer to do more than merely verify a system's capability of performing an essential safety function during an accident.

The techniques also allow a reviewer to identify potential problems that may not affect the performance of the system l

being analyzed, but which nonetheless may affect safe operation of the plant. (See Findings 7B:282-86, 291-93). We find that the available systems interaction techniques, if used systemat-ically and for that purpose, are capable of identifying potential interactions that have been missed by the traditional DBA approach.

C. The LILCO Systems Interaction Efforts Are Not Sufficient to Identify Adverse Systems Interactions The LILCO systems interaction efforts fall into two categories: 'the specific analyses and programs listed at pages 56-66 of its prefiled Contention 7B testimony; and the Shoreham PRA. Each is addressed below.

1. Specific LILCO Studies LILCO has identified several studies and programs which, it asserts, concern systems interactions: several are specific to Shoreham and several involve some use of one or more systems interaction techniques. (Finding 7B:298). However, despite the value which may be properly attributable to such' studies when used as verification of design, we are unable to conclude that they constitute systematic analyses performed for the purposes of identifying potential adverse systems interactions l and incorporating those data into LILCO's classification scheme. (Findings 7B:297-377).

In our detailed Findings, we discuss each of the studies and programs cited by LILCO. Most of the studies were l

l l ._

f performed in response to explicit NRC Staff requirements for an evaluation of the effects of a preselected event or condition on a given SS&C or function [e.g., pipe failure studies (Find-ings 7B:299-305), missile studies (Findings 7B:306-08),

analysis of electrical bus failures (Findings 7B:323-25), fire hazard analysis (Findings 7B:309-14), cable separation analysis 1

(Findings 7B: 315-19), analysis of control system failures (Findings 7B:326-28), analysis of high energy line breaks (Finding 7B:329), study of heavy load handling (Findings 7B:336-37)]. The stated purpose of several of the studies was further limited to demonstrating that a predetermined event would not result in consequences outside the bounds of the Chapter 15 analyses (e.g., electrical bus failure analysis (Findings 7B:323-25), control system failures analysis (Finding 7B:326), high energy line break study (Finding 7B:329), TMI-2 implications study (Findings 7B:371-76)], or to demonstrating compliance with a particular regulatory requirement (e.g.,

analysis of cable separation (Regulatory Guide 1.75 compliance) l (Finding 7B:317), failure modes and effects analyses (Regulato-ry Guide 1.70 compliance) (Findings 7B: 320-22), study of heavy j loads (NUREG-0672 compliance) (Finding 7B: 336), protection

! systems study (IEEE-279 compliance) (Findings 7B:350-54), TMI-2 implications study (I&E Bulletin 79-08 compliance) (Findings 7B: 371-76)].

! l

l In addition, although the studies identified by LILCO pur-

~

portedly considered systems interactions, at least two of them failed to identify adverse interactions that later actually

occurred. The BWR Scram System Reliability Study, performed by GE in 1976, failed to identify the design deficiencies which led to the 1980 partial failure to scram incident at the Browns Ferry plant. Moreover, although the study did disclose the possibility of dependent failure mechanisms similar to those suspected to be among the causes of the Browns Ferry event, that disclosure did not cause GE to conclude that the affected systems needed to be changed. The GE witnesses testified that no changes were recommended because the design was single fail-ure proof and met the requirements of IEEE-279. We find that i

this study and the failure to identify and act upon the Browns Ferry scenario, provide an excellent example of the shortcom-

! ings of the traditional design basis / single failure criterion approach and methodology with respect to the identification of adverse systems interactions. (Findings 7B:355-62).

Similarly, a 1981 study of water level measurement errors f ailed to identify and assess the reference leg break interac-l .

tion identified in the Michelson Memorandum. (Finding 7B:368).

[ Finally, several of the studies identified by LILCO were performed by GE several years ago, and included no Shoreham-specific information. Based on the testimony elicited from the LILCO witnesses, these generic studies appear to have

---

a --

m~- 9 ,y . -------,,--n-,---+-,-n---,--,-,,-- ,-- -. , - . - . , - -

limited applicability to particular systems interaction problems that may exist at Shoreham and to classification of systems and components and we give them little weight in that regard. (Findings 7B:350-67, 371-77).32/

Accordingly, we hold that the studies and programs listed by LILCO were performed primarily to demonstrate compliance l

with directly applicable regulatory requirements. Although the witnesses testified that several of the studies listed were re-lated or overlapped (Findings 7B: 315-17, 330, 375), they were not performed or reviewed on a systematic basis. The studies were not comprehensive, and they were not undertaken for the purpose of identifying potential adverse systems interactions.

Indeed, some have demonstrably failed to do so. Therefore, we find them an insufficient basis on which to conclude that LILCO has adequately addressed potential adverse systems interactions and their effects on classification at Shoreham. (See also Section IV.D.l. below and Findings S7B:ll7-21, 123-25).

i 32/ In addition, as we discuss in Section IV.D.1 below, the Staff's USI A-17 program, intended to resolve the systems interaction issue on a generic basis, has failed to confirm the adequacy of the existing review procedures and regulatory requirements in preventing adverse systems interactions events. (See Findings S7B:ll7-21, 123-25;Section IV.D.1 below).

100 -

2. The Shoreham PRA All parties agreed that a PRA can provide a useful frame-work for an analysis of systems interactions. (Finding 7B: 378). There is no question that some systems interaction techniques are used in conducting a PRA analysis, along with statistical techniques and engineering Judgment. (See Finding 7B:395). The controversy concerning the Shoreham PRA centered upon two points: whether the methodology and scope were adequate to identify potentially significant adverse systems interactions; and whether the results of the PRA pertaining to systems interactions were adequately reviewed and acted upon by LILCO.

The Board notes at the outset that the controversy did not center on the general quality of the Shoreham PRA as a risk as-sessment device. Nonetheless, as we discuss below, its value as an overall assessment of risk does not guarantee its value as an analysis of systems interaction.

LILCO commissioned the PRA for three reasons:

a. To assess the Shoreham Emergency Plan by evaluating the Shoreham response to hypothetical accidents and their consequences;

b. To perform an independent design verification to en-sure that the plant design has no atypical or dispropor-tionate elements that dominate risk; and

- 101 -

c. To develop reliability / risk analysis capability with-in LILCO. (Findings 7B: 381, 384).

Although the Shoreham PRA used fault tree / event tree analysis which is a systems interaction technique, the PRA was not undertaken for the purpose of identifying potential adverse systems interactions. (Findings 7B:384, 395). LILCO asserted, l

however, that the PRA " considered" systems interactions and that its results provide assurance that all adverse interac-tions at Shoreham have been identified and adequately addressed. The Board agrees with the general statement that systems interactions were considered in the PRA. However, we find the evidence insufficient to support either of LILCO's conclusions derived from that general statement.

There is much discussion in the record concerning the methodology of the Shoreham PRA. Although in certain respects i

the methodology used was at the state-of-the-art, in other

< respects that are particularly pertinent to the question of systems interaction identification, the methodology was defi-l l cient. In particular, the PRA did'not consider several

! external initiating events and their potential impact on SS&Cs I and interactions among SS&Cs. (Findings 7B:389-94). In

[ addition, the walkdowns performed by the PRA analysts were very limited and were not of the type recommended to identify potential systems interactions. (Findings 7B:398-407). Sys-tematic and comprehensive plant walkdowns have been identified l

102 -

l i , _ _ _ _ -. . _ _ _ - . - . _ _ _ _ _ .

as an important means of identifying potential systems interactions, particularly those resulting from shared space or shared environments. (Finding 7B:398).

Walkdowns performed as part of comprehensive systems in-teraction studies (such as those at the Diablo Canyon or Indian Point plants) have involved thousands of mandays for extensive preparation and detailed and comprehensive in-plant review.

(Findings 7B:403-06). The walkdowns performed by the Shoreham PRA analysts involved a total of 65 nandays for both prepara-tion and performance. (Finding 7B:400). No doubt the walkdowns were valuable for the purpose of familiarizing the analysts with the plant and the systems reviewed, and they also provided an opportunity to identify certain spatial interac-tions. (Finding 7B:408). We find, however, that the walkdowns performed at Shoreham were not the detailed and extensive hands-on review that is required to achieve an adequate identi-fication of potential adverse systems interactions. We find that the limited scope of the walkdowns, the lack of considera-tion of external-initiators, and certain.other limitations on the scope and methodology of the PRA discussed in our Findings, combined with the stated purposes of the PRA, diminish the weight we place on LILCO's assertion that all potential adverse 2

systems interactions were identified. (Findings 7B:389-419; See also S7B: 126-27). Our confidence in the efficacy of the Shoreham PRA is further reduce 6 by the fact that it failed to

- 103 -

. ~_ _ .

identify the interaction identified in the Michelson Memorandum. (Findings 7B: 194-95, 416-17).

More importantly, however, no evidence was presented from which this Board can conclude that there is reasonable assur-ance that potential adverse systems interactions that may have been identified by the PRA analysts have been or will be actu-ally addressed in any systematic way by LILCO. The LILCO PRA review process appears to focus almost exclusively on whether there were any unusual risk outliers, accident sequences, or probabilities identified at Shoreham that were not common to

, other similar plants. (Findings 7B:422-23, 413-19). We find that while such a review is certainly appropriate for some purposes, it cannot provide assurance that potential adverse systems interactions at Shoreham have been considered or addressed. (See also Section 3 directly below, and Findings S7B:126-30).

Moreover, the LILCO witnesses were unable to describe the LILCO review process applied to the systems interaction data produced by the PRA analysts. (Findings 7B:424-26). Thus, there is no evidence from which we can discern or evaluate the criteria applied by the LILCO reviewers in determining whether 1

an identified interaction is acceptable, unusual or adverse.

(Finding 7B

425). There was also no evidence presented from i

which we can conclude that LILCO's classification methodology, or its actual classification of SS&Cs, was ever reviewed in a

- 104 -

1

_m __ _ _ _ ,____._- ._ _ _ _ _ , . - _ _ _ - _ _ _ _ _ _

systematic fashion against the PRA data. (Findings 7B:428-31).

In addition, the LILCO review of the PRA systems interaction data is not documented or, in the words of one of the LILCO witnesses, otherwise " retrievable." (Finding 7B:426). Thus, this Board is unable to evaluate the LILCO review in any meaningful way. (See also Section 3 directly below, and Find-ings 7B:129-30).

Accordingly, our conclusions concerning the Shoreham PRA are as follows:

The Shoreham PRA was an extensive effort undertaken

to deteriaine the risk of accidents leading to undesirable consequences at the Shoreham plant.

Although the PRA used some systems interaction tech-niques and considered certain systems interactions, the PRA was not undertaken as a systems interaction study.

Certain of the methods used, particularly the exclu-sion of some external initiators and the limited walkdowns conducted by the PRA analysts, were not adequate to ensure that potentially important adverse systems interactions were identi-fied.

i As a result, the PRA is incomplete as a systems in-y teraction study, and could be significantly improved, for exam-ple, by data developed from comprehensive systems interaction walkdowns.

- 105 -

M LILCO has not systematically reviewed the systems in-teraction data that were produced by the PRA analysts.

The results of the PRA have not been systematically reviewed to determine if they verify, or require modification t

of, LILCO's classification of SS&Cs.

On the basis of the foregoing, we cannot conclude that the PRA provides assurance that all or,even most potential adverse systems interactions have been identified or addressed at

Shoreham. Accordingly, there is insufficient evidence to permit us to conclude that the Shoreham PRA has been used by LILCO in complying with 10 CFR Part 50, Appendix A.

3. Effect of LILCO's Misinterpretation of the Regulations on Systems Interaction Studies In his Affidavit, Mr. Conran expressed concern about what he termed the " synergistic effect" of LILCO's misinterpretation of the Staff's regulations upon systems interaction studies performed at Shoreham. The issue was discussed during th'e 4

reopened proceeding. (See Findings S7B:129-131). The Suffolk County witnesses shared Mr. Conran's concern; the other Staff witnesses did not.

The concern expressed by Mr. Conran and the County can be

~

summarized as follows. LILCO's view that equipment important

[ to safety is limited to safety-related equipment could affect in several significant ways judgments LILCO would have'to make in connection with systems interactions analyses. First, in j - 106 -

(

determining what systems to include in a systems interaction study, LILCO could consider particular nonsafety-related SS&Cs not important enough for inclusion even though the Staff would consider those SS&Cs important to safety. Second, in per-forming a systems interaction study, LILCO could evaluate the importance of a nonsafety-related SS&C, in terms of both its function and the effect of its failure, in a manner contrary to that SS&C's importance to safety as judged by the Staff.

Third, in performing a systems interaction study, LILCO could make assumptions concerning the care or maintenance to be given an important to safety but not safety-related SS&C that would

' contradict the assumptions considered appropriate by the Staff.

Fourth, in evaluating the results of a systems interaction study, LILCO could consider certain identified interactions, or the effects of such interactions, as being less important and having less safety significance than would the Staff. Fifth, in evaluating the results of a systems interaction study, LILCO could decide not to take certain corrective actions based upon its judgment of what is necessary for safety, while the Staff would consider such corrections essential to plant safety.

j (Findings 7B:294; S7B: 129-31). These possibilities raise a I

substantial question as to how much credit should be given to-LILCO for any systems interaction studies that have been performed at Shoreham.

l i

- 107 -

In its Proposed Opinion, LILCO dismisses out-of-hand Mr.

Conran's " synergistic concerns" on the basis that LILCO's systems interaction studies do not discriminate among SS&Cs based upon their classification. See LILCO Proposed Opinion at 104. This response misses the point. It fails to address the potential problems enumerated above. Each of the listed i

possibilities involves the essential element of any systems in-teraction study -- the analyst's judgments as to the safety significance of equipment. As we have discussed at length in this opinion, we have serious doubts as to how LILCO might ex-ercise such judgments given its refusal to recognize the extent of the NRC's regulations. We find that these concerns identi-fled by Mr. Conran and the County support our ruling ~that LILCO's systems interaction studies, including the PRA, inade-quately address the potential for adverse systems interactions at Shoreham.

D. Unresolved Safety Issues A-17 and A-47 We have already discussed general considerations regarding "nrecc1 red E 2 f e t'j Trruer '* USIs*+ A-17 and A-4 7. (See Findings 7B:279-95). Under the North Anna standard,33/ we now address whether there has been an adequate explanation of why operation n

--33/ Virginia Electric and Power Co. (North Anna Nu-clear Power Station, Units 1 and 2), ALAB-491, 8 i

NRC 245 (1978).

- 108 -

l

may proceed at Shoreham despite the pendancy of these issues.

Under the ALAB guidance, as noted in the Staff's SER, the SER data (which in this case has been supplemented by the Staff's Contention 7B testimony and, on A-17, by Staff testimony at the reopened 7B hearing) on particular USIs should answer: (1) whether the problem has been resolved for the particular reac-

! tor involved; (2) if not resolved, whether there is a reason-able basis to believe a resolution will be reached before the reactor operates; or (3) if the issue will not be resolved prior to operation, whether it is likely to be resolved before it poses a potential risk at the facility (i.e., is it the kind of problem that only arises after several years of operation) or whether there are alternate bases or means that provide as-surance that the problem poses no undue risk to the public.

Staff Ex. 2a (SER), at B-2.

With respect to A-47, we also consider two additional questions: whether the Contention 7B record can be closed de-spite an outstanding Staff request that LILCO provide data regarding control system failures caused by common sensors, hy-draulic headers, and impulse lines; and whether the Staff must

complete review of the A-47 data requests prior to authoriza-l tion of fuel loading.

i

1. Task A-17 The Board concludes that the North Anna standard has l not been satisfied on USI A-17. Our reasons are set forth below.

- 109 -

J Although USI A-17 was discussed during the initial litigation of Contention 7B, it was discussed in greater detail during the reopened proceeding. In its original 7B testimony, the Staff took the position that Shoreham could be licensed de-spite.the absence of a resolution of USI A-17, and it reaf-

~

firmed that position in its supplemental testimony filed in the i

reopened proceeding. (Findings S7B:ll4, 122). Suffolk County took the position originally and in the reopened proceeding that the necessary North Anna findings cannot be made for Shoreham regarding USI A-17. (Findings S7B:109-ll, 113, 115-118, 120, 121, 124, 125, 127). LILCO believes that Shoreham can be licensed despite the existence of USI A-17, and apparently takes the position that progress toward resolution of A-17 is not relevant to the Shoreham proceeding. See LILCO i

Proposed Opinion at 103-04.

Mr. Conran was the principal author of the portion of the Staff's original written testimony concerning systems in-teractions and USI A-17. (Finding S7B: 87). In his Affidavit, Mr. Conran states that he can no longer in good conscience support the position, reflected in his original testimony, that the Staff's systems interaction program provides currently an adequate basis for the " justification for operation" conclusion ,

required under North Anna. Mr. Conran's change in opinion was a result of what he describes as " unfavorable developments,"

which occurred both prior and subsequent to his original i

l - 110 -

l l

testimony, concerning the scope, schedule, priority and resources allocated to the Staff's program for resolving USI A-17. (Finding S7B:88).

(a) Resolution of A-17 Assigned High Priority From the time of its inception as a generic task, A-17 has t

been consistently' designated a high-priority program. (Find-ings S7B:89, 90), In 1977 the Staff determined that the A-17 program was of the highest priority and therefore designated it as a Category "A" activity; that is, one judged "to warrant priority attention in terms of manpower and/or funds to attain early resolution," because its resolution "could (1) provide a significant increase in assurance of the safety and health of the public or (2) have significant impact upon the reactor li-2 censing process." (Finding S7B:91).

In addition, each subsequent Staff review has re-established the high priority given to Task A-17. In 1979 it was designated as a USI, which by definition is:

A matter affecting a. number of nuclear power plants that poses important questions concerning the adequacy of existing safety requirements for which a final resolution has not yet been developed and that involves conditions not like-ly to be acceptable over the lifetime of the i

plants affected.

l (Finding S7B: 92). A-17 has never lost its designation as a USI. Indeed, the safety significance of the issue was confirmed and reinforced following the TMI-2 accident by the inclusion of a systems interaction program in the Commission's l

l - 111 -

l l

l -

TMI Action Plan. In the Action Plan, Task II.C.3, Systems Interactions, was ranked as having high safety significance and a near term benefit. (F'indings S7B:93-95).

Most recently, in a November 1982 draft of NUREG-0933, A Prioritization of Generic Safety Issues, Revision 0, the Staff on-7 again assigned the highest priority to USI A-17. That i

priority was said to mean that " strong efforts to achieve an earliest practical resolution are appropriate . . . because (a) an important safety deficiency is involved . . ., (b) a substantial safety improvement is likely to be attaine'd at a low enough cost to make the improvement very worthwhile, or (c) the uncertainty of the safety assessment is unusually large and an upper bound risk assessment would indicate an important safety deficiency." (Finding S7B:96). We find that the histo-ry of the Staff and Commission actions concerning USI A-17 clearly indicate its importance, its safety significance, and the need for timely resolution. (Findings S7B: 97; see also 7B:237, 239, 277, 278).

(b) Lack of Progress Toward Resolution Unfortunately, the history of progress toward resolution of USI A-17 is inconsistent with the importance assigned to achieving that resolution. Originally, a completion date of December 30, 1978 was set for. Task A-17. In January 1979, the Staff expected to complete " Phase I" of the task (the develop-ment of a workable methodology for identifying systems

- 112 -

interactions) by September 1979; " Phase II" (application of the methodology to actual plants) was contingent upon the results of the methodology study. (Finding S7B:98). By September 1979, the target date for completion of Phase I was moved to March 1, 1980 and Phase II was scheduled for comple-i tion by March 1981. (Finding S7B:99). As part of the TMI l

3 Action Plan, by May 1980 the program for resolving USI A-17 had been revised to include the development and demonstration of workable methodologies for systems interaction analyses, and a j review of three plant-specific systems interaction studies performed by individual utilities. The three utility-sponsored studies were to be performed at the Diablo Canyon, San Onofre, and Indian Point 3 plants. (Finding S7B: 100).

As of January 1981, the Staff had received state-of-

the-art systems interaction methodology studies from three con-tractor laboratories. They all suggested that a combination of existing methodologies could be used to provide a systematic approach to systems interaction analyses. The recommended methodologies have yet to be systematically implemented at any plant, however, illustrating sharply the lack of meaningful progress toward resolution of this USI. (Findings S7B

101; see also 7B:291, 292).

In October 1981, a Staff proposal for the review of four NTOL plants using NRC-developed methodologies was submitted to Staff management. Thus, as of October 1981, the Staff intended 1

l - 113 -

l l

to gather systems interaction data from seven plants in its USI A-17 program. Two of the plant reviews (Diablo Canyon, San Onofre) were to be limited in scope (they analyzed only spa-

, tially coupled interactions initiated by seismic events); the other five (Indian Point and the four NTOL reviews) were to be more complete. (Findings S7B: 100, 102, 103).

It appears that the USI A-17 program has stalled, if not regressed, in the period between October 1981 and April 1983.

The submittal to the Staff of evaluated search results from the Diablo Canyon study, which had been expected in late 1982, has been delayed indefinitely. Similarly, the planned submittal of unevaluated search results from the Indian Point study, which had been expected in late 1982, has been delayed until late 1983. These delays mean that not even one broad scope systems interaction study planned in connection with the USI A-17 pro-I gram has yet been completed at any facility. (Finding S7B:104). Furthermore, the planned review of four NTOL plants has been completely discarded from the USI A-17 program.

(Finding S7B: 105). The total absence of any systems interac-tion data from the USI A-17 program, combined with the decision not to pursue NTOL studies or any alternative to such studies, lead Mr. Conran to file his Affidavit and change his conclu-sions concerning the ability to make a North Anna finding for i

Shoreham. (Finding S7B:106).

l - 114 -

(c) Staff's New Proposal for Resolution In the reopened proceeding, the Staff revealed a new pro-posed plan for resolving USI A-17. This new plan consists of applying certain Staff methodologies in a study of Indian Point 3 and then comparing the results of that study with the methods used by the licensee in its study of Indian Point 3. (Finding S7B: 107). Although the Staff predicted that new licensing re-quirements could result from its new A-17 program in October 1984, we find that prediction overly optimistic. We are more inclined to agree with Mr. Conran's estimate that completion of the program, even as currently described, would take closer to four to five years. (Findings S7B: 108-109).

In our view, a plan for resolution of USI A-17 over a ten-year period, when the first five and a half years have -

i yielded essentially no results at all, is inconsistent with the

! Staff's repeated finding that USI A-17 warrants priority atten-tion. Additionally, it does not appear that the current plan for resolution of USI A-17 will yield data having sufficiently broad applicability to permit a generic resolution to the systems interactions problem. (See Findings S7B: 110-ll, 113).

The Staff itself has confirmed that the purpose of the A-17 program is to identify previously undetected potential adverse systems interactions, and to determine whether there is a need to revise the Staff's review processes and requirements with l respect to systems interactions. (Findings S7B:ll4; see also 1

- 115 -

7B:282, 290, 295, 296). The currently planned A-17 program, however, will yield data from only one plant -- Indian Point 3, a PWR. The Staff has conducted no studies on BWRs in its A-17 program, and does not intend to do so as part of that program.

(Findings S7B:110, 111). Therefore, we agree with the County witnesses who testified that the ultimate results of the A-17 program are unlikely to provide assurance either that there are no significant undetected systems interactions in BWRs or that the Staff's review procedures and. regulations are adequate as applied to BWRs. (Finding S7B:lll).

(d) No Basis for North Anna Finding The lack of progress in, and the resulting lack of data from, the Staff's USI A-17 program, may alone constitute suffi-cient basis for a finding that the North Anna requirements have not been met. Such a ruling would be based on our belief that the Staff review has not satisfactorily come to grips with USI A-17, as required in Gulf States Utility Co. (River Bend, Units 1 and 2), ALAB-444, 6 NRC 760, 774-75 (1975). Our ruling is not premised, however, only on our general opinion of the Staff's efforts. Rather, we find that the Staff's program as 1

described to us, does not provide any basis for a conclusion that while USI A-17 remains unresolved, the Shoreham facility can be operated with reasonable assurance of no undue risk to the public health and safety. (Findings S7B:111-113). Absent such a conclusion, the North Anna test cannot be satisfied.

- 116 -

This finding is consistent with the Staff's own definition '

of the purpose of its A-17 program: to obtcIn systematic in-formation concerning systems interactions so that a determina-tion can be made as to the seriousness of the problem and the resulting need, if shown by the study results, to revise Staff requirements. (Findings S7B:ll4, 7B:282, 295, 296). Because the A-17 program has yet to yield any data upon which such a determination could be based, it cannot be asserted that there is reasonable assurance of no undue risk, particularly in light of the safety significance consistently attributed to USI A-17 throughout its history. (Finding S7B:ll3).

The Staff has made several statements that purport to meet the North Anna standards. For example, in its SER, the Staff states:

[T]he studies to date indicate that current review procedures and criteria supplemented by the application of post-TMI findings and risk studies provide reasonable assurance that the effects of potential systems interaction on plant safety will be within the effects on plant safety previously evaluated.

(Finding 7B:435). We cannot accept this explanation. In our view, this statement by the Staff fails to satisfy the North Anna requirement that the Staff's explanation must be detailed and must include a specification of "all the measures employed at [the plant at issue] to compensate for the current absence the answers sought by [the Staff's] studies."34/ There is no 34/ Virginia Electric and Power Co. (North Anna Nu-clear Power Station, Units 1 and 2), ALAB-491, 8 NRC 245, at 249 (1978). ,

- 117 -

Shoreham-specific information included in this statement (Find-ing 7B:436), and we do not know what the Staff means by "the application of post-TMI findings and risk studies," or "within the effects on plant-safety previously evaluated." The SER statement is remarkably unenlightening.

Moreover, a primary purpose of USI A-17 is to analyze l

whether the current review procedures are adequate to iden'tify systems interactions. (Findings 7B:289, 290, 296, 432; S7B:ll3-114). It thus begs the question for the Staff to rely on those very review procedures as an alleged basis for Shoreham operation absent a resolution of USI A-17. Thus, we find the Staff's SER statement an unacceptable basis for the finding required under North Anna.

The Staff also testified in the reopened proceeding that

" progress" in the A-17 program has provided no indication that present review procedures and criteria do not provide reason-able assurance with respect to systems interactions. (Finding S7B:ll7). We must also reject this explanation. It shares many of the defects contained in the Staff's SER statement just discussed. It is vague, it relies upon the very procedures at

)

issue in the USI, and it contains no shoreham-specific informa-tion. In addition, only one study in the A-17 program has com-pared potential systems interaction events with SRP require-ments; that study identified deficiencies in the SRP. (Finding S7B:ll7). Moreover, actual events involving systems

- 118 -

s ,

7 r

s interactions, such as the Quad Cities flooding incident and the Browns Ferry fire, have illustrated deficiencies in, and have resulted in changes to, the SRP. (Finding S7B:ll8). In our view, the number of systems interactions events that have occurred in recent years confirms that undetected potential ad-verse interactions slip through the current review process.

(Findings S7B 97, 117-21; 7B:241-42, 277, 278, 288-90, 296).

The Staff also asserted in the reopened proceeding that despite the current status of progress on USI A-17, it is pos-sible to make a finding of reasonable assurance of no undue risk to the public with respect to Shoreham because the USI A-17 program is " confirmatory in nature." (Finding S7B:ll4).

We cannot accept this explanation either. As a general matter, it appears to be totally at odds with the history of USI A-17 developments and the repeated evaluations and rankings of that issue by the Commission over the years. We agree with Mr.

Conran and the County witnesses that in light of the high pri-ority consistently.given to this USI, the A-17 program cannot be shrugged off as "merely confirmatory." (Findings S7B:ll5, v

116). Furthermore, although we recognize the sincerity of the Staff's belief concerning the anticipated results of the eventual resolution of A-17, the fact is that there are no resultb,as yet and therefore the hoped for " confirmation" has not occur ed. To be blunt, we find this Staff statement -- at this stage of USI A-17 resolution -- to be nothing more than l

I - 119 -

wishful thinking. (Finding S7B:ll6). We cannot base a finding of reasonable assurance that Shoreham operation would not undu-ly endanger public health and safety on such an unfounded as-sertion that is contrary to the record before us concerning the significance of systems interactions. (See Section IV.A.

above, and Findings 7B: 241-42, 277-78, 288-90, 296).

Thus, the Staff's various North Anna conclusions in effect ignore the existence of USI A-17. The' staff's finding for Shoreham boils down to a statement that Shoreham complies with existing regulatory requirements. (Finding S7B: 122). The North Anna opinion requires us to find that something specific has been done at Shoreham that resolves for that plant the out-standing generic systems interaction concern. We cannot make such a finding on the present record. (Findings S7B:122-24; 7B:297-427, 436).35/

2. Task A-47 USI A-47 concerns the potential for transients or accidents being made more severe as a result of control system 35/ We discuss elsewhere in this opinion LILCO's as-sertions that systems interactions have been

/ ,

addressed at Shoreham through various studies and through the PRA. See Section IV.C. above.

We do not repeat that analysis here. We note, however, that in the reopened proceeding Mr.

Conran testified that preliminary information from the Indian Point 3 systems interactions study indicates that systems interaction analyses results may affect significantly the results obtained from current state-of-the-art PFAs. (Finding S7B:126).

- 120 -

failures or malfunctions. (Finding 7B:445, 452). On this issue, the Staff takes the position that fuel load cannot occur until the Staff has received and reviewed further data from LILCO on the effects of failures of common sensors, hydraulic headers, and impulse lines. However, the Staff believes that the Contention 7B record can be closed prior to receipt and re' view of these data. See NRC Staff Position on Resolution of SER Open Item 47, Jan. 3, 1983. LILCO agrees that the record can be closed but states that receipt and Staff review of the LILCO data need not precede fuel load. LILCO Proposed Find-ings, Vol. 2, at 75-77. Suffolk County's position is three fold: the Staff's SER discussion of A-47 is inadequate; the evidence compels the conclusion that the data requested by the Staff are directly relevant to Contention 7B and thus must be made part of the record; and the control system interaction issue must be resolved prior to fuel load.

The Board agrees with the County. First, the Staff's SER discussion, even as supplemented by the Staff's Contention 7B testimony, is unrevealing and falls short of meeting the North Anna requirements. The purpose of the Staff's A-47 efforts is i

to " define generic criteria that will be used for plant-specific reviews." (Finding 7B:444). However, a Task Action Plan for A-47 has not even been adopted, even though A-47 was identified as an USI in December 1980. (Findings 7B:441-43, 454). Thus, it appears there are no generic 121 -

criteria and thus there is no basis to evaluate whether the data requested by the Staff from LILCO are sufficient to address the A-47 problem. The Staff's SER, in turn, fails (as in the case of USI A-17) to deal with this matter in the Shoreham context. Thus, while the Staff has made specific data requests related to USI A-47, the basis for the Staff's belief that these are the only data required to make the North Anna findings is not set forth. (Finding 7B:454).

Second, the A-47 issue is directly part of the 7B contro-versy. The Michelson concern focuses on adverse systems inter-actions resulting from hydraulic coupling of systems. (Finding 7B:169, 451). This is the subject area of the Staff's latest data request. Further, Suffolk County presented testimony which directly concerned USI A-47. (Finding 7B:454). Accord-ingly, while the 7B hearing focused primarily on methodology issues, one example permitted by the Board -- the water level interaction problem -- has clearly been placed at issue, and the Board earlier ruled that USI A-47 (and USI A-17 as well) were clearly relevant to Contention 7B. See Tr. 1099-1100.

While no further " fixes" are necessary for the specific problem t

identified in the Michelson Memorandum, the concern documents the need for the control systems interactions problem to be re-solved as part of Contention 7B. There can be no such resolu-tion if the record is closed and parties have no opportunity to address the issue of the adequacy of the LILCO data and the Staff review thereof.

- 122 -

Finally, we reject, for reasons specified in our Findings (Finding 7B:455), LILCO's argument that the SER Open Item does not need to be resolved prior to fuel load. Briefly summa-rized, our view is that the evidence documents that systems in-teractions constitute a serious potential concern at Shoreham and are part of the Contention, and thus this Board must reach conclusions thereon prior to final decisions on the LILCO ap-plication.

Accordingly, for the reasons set forth above and in our Findings, we rule that the Staff's SER discussion of USI A-47 is deficient and that this issue must be resolved prior to fuel load. The record will remain open on Contention 7B so that we may address the issue.

V. Conclusion Based upon the conclusions reached in our Opinion and Findings of Fact, the Board concludes that LILCO has not used a systematic and adequate methodology for classification of SS&Cs important to safety and for identification of systems interac-tions. We conclude, therefore, that LILCO has failed to demon-strate compliance with 10 CFR Part 50, Appendix A.

l l

- 123 -

Suffolk County's Supplemental Proposed Findings of Fact on Suffolk County / SOC Contention 7B I. _ Introduction S7B: 1. On February 9, 1983, James H. Conran, a member of the Staff's witness panel on SC/ SOC Contention 7B, submitted to the Board an Affidavit which addressed the two primary issues on which Mr. Conran had previously testified: systems interac-tions and Unresolved Safety Issue ("USI") A-17; and safety classification. Mr. Conran stated that the purpose of his Af-fidavit was:

to identify for the Board (1) areas in which I believe that testimony which I pro-vided earlier in the litigation of Conten-tion 73 requires (or may require) amending and/or supplementing, and (2) changes that have occurred in facts or circumstances material to the matters at issue in Conten-tion 7B which may give rise to the need-for amending and/or supplementing the testimony involved.

Conran Affidavit, ff. Tr. 20,401, at 1.

S7B:2. Following the parties' submission of views on the effects of the Conran Affidavit on the litigation of Contention 7B, the record on that contention was reopened. See Tr.

20,315-344 (Brenner) .1/ Mr. Conran's Af fidavit was subsequently 1/ See also Confirmatory Memorandum and Order Directing that Parties Submit Views on the February 8, 1983 Af fidavit of James H. Conran, Sr. and Its Effects on the Litigation of Contention SC/ SOC 7B ( Fe b , 11, 1983); Suffolk County Sub-mission Concerning Affidavit of James H. Conran, Sr. and Request That the Record Se Reopened to Receive the Conran Affidavit (Feb. 22, 1983); NRC Staff Statement of Views and Response to Order of February 11, 1983 (Feb. 22, 1983); LILCO's Views on the Affidavit of James H. Conran, Sr., (Feb. 22, 1983).

admitted into evidence. Conran Affidavit, ff. Tr. 20,401.

In addition, the NRC Staff and Suffolk County submitted supplemental prefiled testimony on the issues discussed in Mr.

Conran's Affidavit. The NRC Staff Supplemental Testimony on Contention 7B, dated March 10, 1983, was sponsored by Roger J.

t Mattson, Richard H. Vollmer, Charles E. Rossi, Ashok C.

Thadani, and Franklin D. Coffman, Jr. Mattson et al., ff. Tr.

20,810. The Suffolk County Supplemental Testimony on Conten-tion 78 of Marc W. Goldsmith, Richard B..Hubbard and Gregory C.

Minor, was filed on March 23, 1983. Goldsmith et al., ff. Tr.

20,903. LILCO chose not to submit prefiled testimony. See Letter dated March 16, 1983 from Anthony F. Earley, Jr. to Lawrence Brenner, Esq., Dr. Peter A. Morris, and Dr. James H.

Carpenter.

On April 7, 1933, following three days of cross examina-tion of Mr. Conran, the Staff witnesses, and the Suffolk County witnesses, the Board requested that LILCO make company repre-sentatives available to answer certain questions from the Board concerning matters raised in the testimony of the other parties y during the reopened proceeding. Tr. 20,937 (Brenner). In re-sponse to the Board's request, on April 8, 1983, a panel of witnesses appeared on behalf of LILCO and was cross-examined.

The panel members were: Millard S. Pollock, Vice President-Nuclear (LILCO), William J. Museler, Director - Office of l

Nuclear (LILCO); James Rivello, Shoreham Plant Manager (LILCO);

Brian McCaffrey, Manager of Nuclear Compliance and Safety (LILCO); and George F. Dawe, Supervisor of Project Licensing (SWEC). Tr. 21,035-37.

II. Safety Classification A. The Change in Mr. Conran's opinion Since Original Contention 7B Testimo,ny S7B:3. In his Affidavit, Mr. Conran stated that in his opinion LILCO truly does not understand what is required minimally for safety by the NRC under its regulations. That is, he believes LILCO does not understand what is considered necessary and sufficient to provide reasonable assurance of no undue risk to the health and safety of the public in the Operation of the Shoreham plant. Conran Affidavit, ff. Tr.

20,401, at 28.

S7B:4. Mr. Conran stated at the time of his original tes-timony on Contention 7B that he was "prodisposed" to think of the defect in LILCO's position regarding the term "important to safety" simply as a " language problem." Conran Affidavit, ff.

Tr. 20,401 at 26. At that time, the " language problem" concerned him because of its impact on the Staff's ability (1) to rely on LILCO's affidavits in the audit review context, and (2) to obtain information required for its regulatory function during operation of Shoreham, as contemplated under 10 CFR Part 21.

_a_ a _ . _ , en , . _ _ _o,_ ~ - - - + - ---+2 - s s.---d4-a -4e---- -- - .- s - - - - -

i Conran Affidavit, ff. Tr. 20,401, at 31; see Conran, ff. Tr.

6368, at 6-7. Despite his concern about what he then believed to be merely a " language problem," in the summer of 1982 Mr.

7 Conran believed that the Staff and LILCO understood in basical-ly the same way the fundamental safety concepts underlying the term "important to safety" as applied by the Staff. Conran Af-fidavit, ff. Tr. 20,401 at 28. -

I S7B:5. Mr. Conran stated in his Affidavit that he no longer believes that LILCO and the Staff are near a " meeting of minds" regarding the meaning of the fundamental concept of "im-i portant to safety." He considers that concept to be the heart

, of the safety classification issue. Conran Affidavit, ff. Tr.

20,401, at 29. SS&Cs that are important to safety, including l

those that are not in the safety-related subset, are covered by l the NRC's regulations. Tr. 20,456, 20,663, 20,773 (Conran).

Because LILCO believes the term "important to safety" as used

! in the NRC regulations applies only to safety-related equip-ment, LILCO does not recognize the existence of regulatory re-

. quirements covering the set of equipment that is important to '

safety but not safety-related. Tr. 20,454, 20,456, 20,525 (Conran). Thus, Mr. Conran believes there is a substantive l

defect (as opposed to a dif fering use of language), in LILCO's understanding of what is required as a minimum to protect I

public health and safety. Tr. 20,525, 20,722 (Conran); Conran Affidavit, ff. Tr. 20,401, at 31.

l i

S7B:6. Mr. Conran stated that he reached his conclusions regarding LILCO's conceptual difference with the Staff based on the following:

a) an opportunity to consider longer and review more thoroughly the original testimony of LILCO's witnesses on Con-l tention 7B; b) his involvement in the review of proposals made by LILCO to the Staff beginning in approximately November 1982, for resolving differences left outstanding at the end of the earlier hearing on Contention 7B; and c) a synergistic consideration of these two items.

Conran Affidavit, ff. Tr. 20,401, at 29; Tr. 20,570-71 (Conran).

S7B:7. Mr. Conran stated that between the spring of 1982 and February 1983, there did not appear to have been signifi-cant substantive effort by LILCO to develop or promote mutual understanding with the Staff on what had been called " language differences." Conran Affidavit, ff. Tr. 20,401, at 30; Tr.

20,555-56; 20,571 (Conran). Mr. Conran also stated that his review of the testimony of LILCO's witnesses caused him'to recognize that they invariably couched their responses in a way that acknowledged some safety relevance to the specific examples provided by counsel of things "Important to Safety, but not Safety-Related", but carefully avoided ac-knowledgement or recognition that such items had enough safety relevance or importance to number them among that category of things required minimally for safety by the regulations.

Conran Affidavit, ff. Tr. 20,401, at 30 (emphasis in original).

B. Impact of LILCO's Position S7B:8. As of April 1983, LILCO still regards the term "important to safety" as used in the NRC regulations as synonymous with " safety-related." Tr. 21,051 (Pollock). Fur-thermore, it is LILCO's position that the NRC does not have jurisdiction to impose regulatory requirements for items which are not safety-related (safety-related items being defined by Appendix A to Part 100), except to the extent that nonsafety-related items might cause safety-related SS&Cs not to meet the performance requirements for those safety-related SS&Cs in the regulations. Tr. 21,076, 21,139 (Dawe).

S7B: 9. So long as LILCO interprets the set of SS&Cs iden-tified in the regulations as "important to safety" as being no different from the set of SS&Cs that are safety-related, Mr.

Conran, as well as the Staff and County witnesses, believe that there can be no reasonable assurance that Shoreham can be oper-

ated without undue risk to the public' health and safety.

Conran Affidavit, ff. Tr. 20,401 at 28; Tr. 20,555 (Conran);

Tr. 20,850 (Mattson); Goldsmith et al., ff. Tr. 20,903, at 28.

S7B:10. In Mr. Conran's opinion, there is a marked dif-j ference in safety philosophy and understanding of what is l

l

k minimally necessary to operate a plant without undue risk to the public health and safety depending on what a utility recognizes as the minimum set of requirements applicable to the plant. Tr. 20,514 (Conran).

S7B:ll. In Mr. Conran's opinion, LILCO's operating phi-

! losophy of safety is different from that of the NRC. Tr.

20,461; 20,622-23 (Conran). The NRC' believes that certain SS&Cs considered by LILCO to be nonsafety-related, are impor-1

tant enough to safety to be addressed in its regulations.

LILCO denies that fact. Tr. 20,456-57, 20,543 (Conran).

! S7B:12. Mr. Conran and the Staff acknowledged that, in

the past, there has been confusion about the meaning of the

, terms '*important to safety," " safety-related," and "nonsafety-related," both within the NRC and among licensees. Tr. 20,484,

! 20,582 (Conran). The Denton Memorandum was drafted in order to f deal with this confusion. Tr. 20,506 (Conran); Tr. 20,835, 20,853 (Mattson).

S7B:13. Mr. Mattson described the Denton Memorandum as an attempt to address the need, identified after TMI, "to clarify

( . . . that there is equipment beyond the reach of safety-

[ related, safety grade that requires consideration of its.impLt-l tance to safety." He stated, further, that "[T}he Denton Memo-randum was issued to clarify the need for licensees to pay at-tention to this equipmont." Tr. 20,857, 20,858 (Mattson).

l l

i

S7B:14. Mr. Conran stated that, to his knowledge, no other applicant or licensee interprets the term "important to safety" as LILCO does. Furthermore, he was not aware of any other applicant or licensee who differs so fundamentally with the Staff on what the concept of "important to safety" means, or on the relationship between safety-related and important to safety SS&Cs. T r' . 20,485-86 (Conran). Nor was Mr. Conran aware of any utility other than LILCO who does not recognize the existence of regulations for equipment important to safety, but not safety-related. Tr. 20,504-05 (Conran).2/

S7B: 15. Staff witness Mattson testified that at least one other licensee -- Metropolitan Edison -- has been more willing than LILCO to accept the attitude toward implementation of safety requirements that is desired by the Staff. Metropolitan Edison adopted the Denton definitions, as required by the Staff. Tr. 20,833 (Mattson).

2/ Mr. Conran prepared and circulated a Differing Professional Opinion, dated March 31, 1983, in which he made recommendations to the NRC management concerning both systems interaction and safety classification. Tr.

20,725-26 (Conran). In his Differing Professional Opinion, Mr. Conran recommended that the NRC act promptly to determine whether there is common understanding of the safety classification concepts involved in the terms

" safety related" and "important to safety," irrespective of the language-type differences that may exist or persist in the usage of those terms by individuals. Tr. 20,646 (Conran).

S7B:16. The Staff's response to the presumed LILCO argument that it is unfairly being " picked on" by the Staff's insistence that it adopt the Denton definitions, even if the' clarifications contained in those definitions were assumed to be "new," was stated by Mr. Mattson:

The Denton Memorandum . . . is meant to be followed as Staff practice and you have to start somewhere.

Tr. 20,853 (Mattson).

S7B:17. The Staff witnesses stated that in their opinion LILCO has refused to adopt the Denton definitions for two reasons. First, it could be very costly to adopt the defini-tions. Second, LILCO,is concerned that adoption of the defini-tions could lead to the imposition of additional requirements in the future. Tr. 20,871-72 (Mattson).

1. Design and Construction S7B: 18. The purpose of safety classification is to assure that appropriate quality standards are applied to all struc-tures, systems and components (SS&Cs) in the plant that are im-portant enough to safety to be covered by the NRC regulations.

Tr. 20,433 (Conran).

S7B:19. Because LILCO interprets the set of important to safety SS&Cs as being identical to the safety-related set, and therefore regards the NRC's regulations as applying only to safety-related equipment, Mr. Conran and the County believe I

l

that there is no assurance that LILCO properly applied quality standards and quality assurance measures during the design and construction of Shoreham. Tr. 20,430-31 (Conran); Goldsmith et al., ff. Tr. 20,903, at 38, 39.

S7B:20. Mr. Conran explained that " quality standards" for SS&Cs are standards or specifications which identify perfor-mance levels or materials requirements, which must be met in designing, constructing and operating a plant. Tr. 20,439-40, 20,442 (Conran). He contrasted quality standards with " quality assurance measures," which he defined as the system of adminis-trative controls and record keeping that is instituted to as-sure both that components meet the applicable requirements and

~

specifications in the first place, and that they are maintained to that level throughout operation. Tr. 20,439-40 (Conran).

Quality standards are found in the NRC's regulations and/or regulatory guidance. Some examples of quality, standards pro-vided by Mr. Conran include ASME Section 3, Regulatory Guides 1.26 and 1.29, the material specifications.in ANSI B.31.1, and IEEE-279. Tr. 20,441, 20,443-44 (Conran). The quality standards applicable to SS&Cs important to safety are found in the detailed guidance given in the Standard Review Plan (SRP) and the regulatory guides. Tr. 20,503, 20,523 (Conran).

S7B:21. In its prefiled supplemental testimony, the Staff stated its belief that during the design and construction of

Shoreham, LILCO satisfied the deterministic criteria embodied in the SRP and other regulatory guidance documents. Mattson et al., ff. Tr. 20,810, at 10. That opinion was based on (a) the Staff review of the Shoreham FSAR in accordance with the SRP, and (b) testimony at the original hearing on Contention 7B regarding certain specific systems. From its audit review of the FSAR the Staff concluded: "[T]here has been no evidence that a substantive difference exists between the Staff and Ap-plicant on the [ design and construction]- treatment to be accorded equipment important to safety." From listening to the 7B testimony the Staff concluded: "The Staff does not believe that a substantive difference exists between the Staff and Ap-plicant on the [ design and construction] treatment to be accorded these specific systems (used as examples for classifi-I cation methodolgy during the testimony)." Mattson et al., ff.

Tr. 20,810, at 10.

S7B:22. While acknowledging the Staff's position stated above, Mr. Conran testif,ied that LILCO's conceptual difference with the Staff leads him to doubt the adequacy of the Staff's review process as applied to the Shoreham plant. Tr. 20,448, t 20,450-51 (Conran).

S7B: 23. A portion of the Staff's original testimony on Contention 7B described the Staff's process for reviewing nu-clear power plant operating license applications. Speis et

al., ff. Tr. 6357, at 4-9. That testimony was prepared by Mr.

Conran in conjunction with other members of the Staff's panel, including Messrs. Rossi and Haass. Tr. 20,406-407 (Conran).

Mr. Conran noted, however, that the description of the Staff's review process contained in that testimony would be true only for an applicant that uses the language in the same way that the Staff does. Tr. 20,408-09 (Conran). Thus, in Mr.

Conran's opinion, that testimony does not apply to LILCO. Tr.

20,408 (Conran).

S7B:24. Mr. Conran testified that with respect to Shoreham design and construction, the SRP and Regulatory Guide -

information can "perhaps" provide a safety net or backstop to mitigate the serious misunderstandings between LILCO and the Staff concerning the safety classification terms used by the Staff and contained in the regulations. Conran Affidavit, ff.

Tr. 20,401, at 32. Mr. Conran's reservations about the adequa-cy of the Staff's review of design and construction at Shoreham focus,on two aspects of the Staff's review: (a) the scope of the review, and (b) the reliance on affidavits for what was not reviewed.

[ S7B:25. As Mr. Conran noted, the Staff's review of Shoreham was only an audit review. Tr. 20,449-50, 20,519-20 (Conran). Not all equipment referenced in the SRP is actually reviewed by the Staff. Tr. 20,449-50 (Conran).

S7B:26. Because LILCO does not interpret the term "impor-tant to safety" as the Staff does, Mr. Conran recommended that the Shoreham application should be re-reviewed to ensure com-pliance with the regulatory requirements for SS&Cs important to safety. Mr. Conran recommended expanding the scope of the Staff's audit of Shoreham by reviewing SS&Cs that the Staff would not ordinarily have included in its audit. Mr. Conran distinguished this expanded review from the discussion of sp'ecific examples that took place on the original Contention 7B record. In his view, the items reviewed in the normal Staff audit of Shoreham, plus the examples discussed in the record, together may not constitute a sample of sufficient size to jus-tify a decision that there is reasonable assurance of compli-ance with the regulations in all areas, including those not reviewed. Tr. 20,438-39, 20,449-51 (Conran).

S7B:27. With respect to design and construction, the Staff witnesses do not consider it necessary to review addi-tional examples of equipment. The Staff witnesses noted, how-ever, that differences in equipment classification that may have gone undetected during the initial review might result in

unfavorable performance of nonsafety-related equipment once the i

plant starts operating. See Tr. 20,836-37 (Mattson). This f act supports Mr. Conran's opinion that review of a larger sam-ple is required.

- - _- _ _ . . . _ = _ - . - - _ _ _ . _ .

S7B:28. Mr. Conran was not aware of any specific examples of Shoreham SS&Cs important to safety but not safety-related, J

which had not received proper treatment during design and con-struction. Tr. 20,436, 20,509-10 (Conran). However, Mr.

Conran explained that one would not expect that examples of such noncompliance with the regulations would be identified as such during the Staff review. He explained that a Staff re-viewer would express a concern regarding a particular SS&C by 1 saying to LILCO that the design or information submitted was not adequate for the Staff to complete its review or for it to license the plant. Tr. 20 /516 (Conran) . Thus, in Mr. Conran's

! opinion, " examples" that may have been identified during the Staff's review would not be recognizable as such; they would have found expression in the several hundred inquiries that have gone from the Staff to LILCO. Mr. Conran has not yet been able to determine whether the number of Staff inquiries to i LILCO during the Staff review has been " extraordinary." Tr.

20,515-16, 20,526-27, 20,538-39 (Conran).

S7B:29. Mr. Conran also stated that the Staff's review may have been inadequate because, for those items not actually reviewed, the Staff merely relied upon LILCO's sworn assurances that the plant meets the Staff's requirements. In Mr. Conran's opinion the Staff cannot rely on those assurances, because LILCO does not recognize the existence of requirements for l

SS&Cs important to safety but not safety-related. Tr.

20,503-04, 20,477-78, 20,565-66, 20,601 (Conran).

S7B:30. For example, during the prior testimony on Con-

, tention 7B, the Staff acknowledged that it had originally erro-neously approved LILCO's commitments in Section 3.1 of the FSAR related to GDCl due to its misunderstanding of the terminology used in the LILCO commitment. Goldsmith et al., ff. Tr.

20,903, at 28. (See Finding 7B:73.) Thus, it is possible that.

some design defects have slipped through the review process due to the Staff's reliance on LILCO's assurances that the plant has been built in compliance with requirements under the regu-lations. Tr. 20,519-20, 20,521-22 (Conran).

S7B:31. The County witnesses agreed that LILCO's failure I

to acknowledge the existence of SS&Cs important to safety but

~

not safety-related makes it impossible to assume that LILCO has correctly assessed the safety significance of all SS&Cs impor-tant to safety. They recommended that LILCO should be required i

l to correct all usages of the terms "important to safety" and l

l " safety-related" in the Shoreham FSAR and that the Staff should re-review the LILCO commitments in order to ensure that for I

design and construction Shoreham does in fact comply with regu-latory requirements. Goldsmith et al., ff. Tr. 20,903, at i 28-29.

l 1

S7B:32. Finally, Mr. Conran testified that LILCO's alleged compliance with design and construction requirements does not alleviate his more basic concern about LILCO's concept of what is minimally necessary for safe operation of Shoreham.

Mr. Conran acknowledged that LILCO's testimony indicates that LILCO has attributed some safety significance to some SS&Cs that are not safety-related. In his opinion, however, the LILCO testimony does not indicate 'that those items are regarded by LILCO as minimally required for safety. Tr. 20,464-65 (Conran). He also noted that it is impossible to determine what safety significance LILCO has attributed to a particular SS&C which is important to safety, but not safety-related. Tr.

20,465 (Conran).

E7B:33. Mr. Conran stated that even if it could be deter-mined that LILCO has applied to a particular SS&C those quality

~

standards commensurate with the safety significance attributed to the SS&C by the Staff, that fact would not indicate how much safety significance LILCO attributes to that component. It would only demonstrate that LILCO has met the Staff's require-ments. Tr. 20,465, 20,467 (Conran). This concerns Mr. Conran occause during the next 20 or 30 years of operation the way LILCO thinks about safety will determine how the plant is oper-ated, not the way the Sta'ff thinks about it. Tr. 20,551-52 i (Conran). See also Tr. 20,848-49, 20,872-73 (Mattson).

l

S7B:34. In Mr. Conran's opinion, LILCO's compliance with a particular regulatory requi.rement does not constitute an ac-knowledgment that that regulation extends to nonsafety-related SS&Cs. In other words, an applicant's statement that it has met the Staff's expectations or requirements under the regula-tions, is not the same as an acknowledgement that the regula-tions require the applicant to do so. Tr. 20,549 (Conran);

see also Tr. 20,775 (Conran). Thus, Mr. Conran testified that LILCO might have complied with certain of the Staff's require-ments not because LILCO believes such compliance is either required by regulation or necessary for safety, but rather be-cause LILCO needs a license. Tr. 20,549,.20,551, 20,780 (Conran).

2. Quality Assurance S7B: 35. Mr. Conran had not reviewed the quality assurance testimony (Tr. 20,802 (Conran)), and did not discuss at length in his Affidavit the quality assurance measures applied by LILCO during design and construction. Nevertheless, he testified that he did not intend to minimize the concerns that others have with respect to the effect of LILCO's safety clas-sification position on QA applied at Shoreham. Tr. 20,770 i

(Conran).

S7B:36. The County witnesses testified that LILCO's qual-ity assurance program for nonsafety-related SS&Cs is l

l  :

i

unsatisfactory because it is not documented. Tr. 21,022, 21,027 (Hubbard).

S7B:37. In addition, the County witnesses noted that, be-cause LILCO has not specifically identified the safety signifi-cance of nonsafety-related SS&Cs, one cannot know whether adequate quality assurance measures have been applied. Gold-smith et al., ff. Tr. 20,903, at 24, 39. Furthermore, the fu-ture QA treatment of equipment will be based upon its original classification. In the case of Shoreham, there is no certainty

. that the original classification was proper. Goldsmith et al.,

ff. Tr. 20,903, at 38-39.

S7B:38. Any QA program has three essential elements:

first, it must be a documented program; second, there must be a list of equipment to which the program applies; and, third, for each item on the list there must be a documented determination of the applicability of each of the 18 criteria in Appendix B.

None of these conditions is met at Shoreham with respect to SS&Cs important to safety but not safety-related. Tr. 21,022 (Hubbard).

S7B:39. Mr. Conran and the Staff acknowledged that the Staff could not know whether applicants applied appropriate levels of quality assurance to items important to safety but not safety-related, because the Staff does not review nonsafety-related QA. Therefore, the Staff must accept

4 assurances from applicants that they comply with the intent of G DC1. Tr. 20,767-68 (Conran). In Mr. Conran's opinion, in the absence of an explicit statement that the applicant does not interpret "important to safety" in the way the Staff does, it is reasonable for the Staff to presume that the applicant intends to apply standards commensurate with the importance to safety of a particular SS&C. Tr. 20,770 (Conran). Such a pre-sumption cannot be made for Shoreham in light of LILCO's refus-al to acknowledge the Staff's definition of the term "important to safety."

3. Future Operation of Shoreham S7B:40. Mr. Conran, the Staff and the County witnesses agreed that the effect of LILCO's refusal to acknowledge and adopt the Staff's interpretation of its regulations will be more significant with respect to the future operation of Shoreham than with respect to design and construction. Tr.

20,834 (Mattson); Tr. 20,434, 20,522, 20,774 (Conran); Gold-smith et al., ff. Tr. 20,903, at 38-40.

S7B:41. Mr. Conran explained that unlike the extensive Staff review which occurs during design and construction, dur-ing operation there is little in the regulations or in the Staff's procedures, that would act effectively as a safety net or backstop to mitigate LILCO's lack of understanding of what is minimally required for safety. Conran Affidavit, ff. Tr.

i 20,401, at 32; Tr. 20,434 (Conran). Mr. Conran also noted that the test for licensing is not that LILCO may operate the plant safely. There must be a finding of reasonable assurance that it will do so, which requires more than speculation about LILCO's understanding of safety. Tr. 20,555 (Conran).

S7B:42. The Staff agreed with Mr. Conran's distinction between design / construction and operation. Mr. Mattson pointed out that it had been necessary to apply substantial resources to extensive discussion and consideration of examples, in order for the Staff to conclude that, despite LILCO's construction of the term "important to safety," LILCO had properly applied quality standards in the design and construction phase. He stated that because such resources will not be available in the future, it is necessary to avoid the need for them during Shoreham operation by eliminating the source of confusion. If LILCO accepted the Denton definitions, there would be no need to go through the exercise of determining whether what LILCO said they did during operations is in fact equivalent to what the Staff requires. Tr. 20,855-56 (Mattson). See also Tr.

20,872-73 (Mattson).

S7B:43. All parties agreed that the difference in safety classification terminology used by LILCO and the Staff would lead to confusion between LILCO and the Staff during operation of Shoreham. Tr. 20,835-36, 20,852-853 (Mattsen); 21,127 (Pollock); Conran Affidavit, ff. Tr. 20,401, at 31-32; Goldsmith et al., ff. Tr. 20,903, at 29. Although LILCO witnesses testified that the confusion would not affect plant safety, (Tr. 21,129 (Pollock)), the Staff, the County, and Mr.

Conran believe that it would. Conran Affidavit, ff. Tr.

20,401, at 31-32; Tr. 20,434-35 (Conran); Tr. 20,852-53 (Mattson); Goldsmith et al., ff. Tr. 20,903, at 29.

S7B:44. The Staff witnesses stated that LILCO's failure to acknowledge and adopt the Denton terminology would result in a lower standard of performance during operation of Shoreham.

Tr. 20,835 (Mattson). Mr. Mattson stated that, once in operation, LILCO will have to take many actions involving nonsafety-related equipment that is important to safety. He testified that if those actions are not performed properly, the plant's safety and operability performance will be poor. Poor performance will be reflected in events that may affect safety.

Tr. 20,852 (Mattson). Mr. Mattson also stated that a utility's performance will be better if future regulators and future op-erators are able to communicate with each other without confu- ,

sion. Tr. 20,835-36, 20,853 (Mattson).

S7B:45. The Staff witnesses testified that they would expect LILCO's position on safety classification to affect LILCO's performance during operation with respect to compliance with NRC reporting requirements, treatment of nonsafety-related

1 equipment including both maintenance and surveillance, and cooperation and mutual understanding with NRC inspectors. Tr.

20,836-37, 20,852-54, 20,872-73 (Mattson).

C. Necessary Conditions of Licensing

1. Adoption of Denton Definitions S7B:46. Witnesses for the Staff and the County and Mr.

Conran agreed that Shoreham should not be licensed unless LILCO agrees to accept and adopt the Staff's definitions of safety classification terms. Tr. 20,833, 20,849, 20,850-51 (Mattson);

Goldsmith et al., ff. Tr. 20,903, at 28; Tr. 20,613 (Conran).

S7B:47. Both Mr. Conran and the County witnesses testified, however, that the imposition of definitions upon LILCO by the Board would not be sufficient to alleviate their concerns about LILCO's fundamental understanding of what is required minimally for safety. They stated that LILCO should also be required to demonstrate its understanding. Tr. 20,457, 20,555, 20,659, (Conran); Goldsmith et al. , ff. Tr. 20,903, at 38-40; Conran Af fidavit, ff. Tr. 20,401, at 31-32.

S7B;48. Had LILCO acceded to the Denton.' definitions in July 1982, Mr. Conran's concerns regarding the design, con-struction, and operation of Shoreham would have been dispelled because he would have believed that the differences between the Staff and LILCO had been limited to a language difference. Tr.

20,483 (Conran).

i l

l l

S7B:49. Subsequent to the original 7e hearing, Mr. Conran participated in negotiations between the Staff and LILCO which were intended to resolve the differences. Conran Affidavit, 20,401 at 29. The proposals put forth by LILCO during those negotiations said nothing new. LILCO proposed to commit to interpret "important to safety" in the future exactly the way LILCO had in the past, that is, to accord nonsafety-related items the degree of safety importance that had been accorded them in the past. Tr. 20,571 (Conran). LILCO's steadfast re-fusal to change its position by adopting the definitions has increased Mr. Conran's concern, and therefore he would no longer be satisfied by a mere agreement by LILCO to do so. Tr.

20,493, 20,555, 20,613 (Conran).

S7B:50. The County witnesses also testified that the Board's correction of LILCO's improper use of the term "impor-tant to safety" would not remedy the potential deficiencies in classification and QA/QC implementation resulting from LILCO's improper usage of the classification terminology during the design and construction phase. Goldsmith et al., ff. Tr.

20,903, at 24-25. The County witnesses noted, however, that the situation would be even worse if LILCO were not ordered to adopt the Staff's terminology because LILCO would, under that circumstance, continue to use (during operations) its own in-correct terminology rather than that required by the NRC staff.

Goldsmith et al., ff. Tr. 20,903, at 25.

T S7B:51. Focusing just on GDC 1 compliance, the Board questioned whether the Staff would know anything more about a licensee who adopted the Denton definitions than the Staff does about LILCO, given the vague nature of the GDCl requirement that appr'opriate QA be applied commensurate with the importance of the safety functions to be performed by a SS&C. Mr. Conran stated that if a licensee adopted the Denton definitions, the Staff would know that the licensee considered particular SS&Cs (those in the important to safety category) to be important enough to be' covered under the NRC's regulations. Tr.

20,494-95, 20,497, 20,501 (Conran). He considers that fact to constitute an important communication between the Staff and that licensee which would justify the Staff's belief that the licensee's fundamental understanding and safety philosophy was not markedly different from that of the Staff. He contrasted this situation with that present at Shoreham, where the Staff has received the opposite communication from LILCO. Tr.

20,501, 20,766, 20,768, 20,772 (Conran). See also Finding S7B: 39.

2. List of Equipment Important to Safety l S7B: 52. Mr. Conran and the County witnesses testified that as a condition of licensing, LILCO should be required to develop a list of SS&Cs at Shoreham that are important to safe-ty, as a means of developing and demonstrating the requisite

understanding of what is required minimally for safety in the operation of Shoreham. Conran Affidavit, ff. Tr. 20,401, at 32; Goldsmith et al., ff. Tr. 20,903, at 40.

(a) Generic List S7B: 53. Both Mr. Conran and the Staff testified that all SS&Cs important to safety are addressed in the SRP and i the regulatory guides. Tr. 20,667, 20,773 (Conran); Tr. 20,654 (Mattson). The County witnesses agreed that in terms of design requirements, the majority of SS&Cs important to safety are covered in the SRP. Tr. 21,026 (Hubbard).

S7B:54. SS&Cs which are important to safety but not safety-related include those SS&Cs which contribute to safety by providing margin and reliability, as wall as those which may be used in mitigating particular design basis accidents. Tr.

20,456, 20,663, 20,667 (Conran); Tr. 21,011-12 (Minor). One measure of the importance to safety of an SS&C is the function that it plays in the operation of the plant in all phases. Tr.

20,478, 20,665-66 (Conran). Other considerations involved in determining the importance to safety of a particular SS&C are:

its relationship to other items, including its. potential inter-action with other items both spatially and when the human l

element is taken into account; whether the failure of that piece of equipment could cause an effect outside the Chapter 15 analysis; and, whether the reliability of a piece of equipment

contributes to safety by not initiating transients and accidents. Tr. 20,479-80 (Conran); Tr. 21,011-12, 21,017 (Minor).

S7B:55. Mr. Conran stated that as a general matter, he had long considered a list of SS&Cs important to safety to be unnecessary. However, he has now concluded that a list would -

be a useful means of summarizing the information currently spread throughout four volumes of the SRP, and of explaining what the term "important to safety" means. Tr. 20,660, 20,662, 20,668-69 (Conran). See also Tr. 20,606 (Conran). He compared a list of SS&Cs important to safety to Regulatory Guide 1.29, which is a function-oriented LWR generic listing of safety-related plant features. Tr. 20,606 (Conran). Just as Regulatory Guide 1.29 contains no information which is not also in the SRP and regulatory guidance documents, a list of SS&Cs important to safety would simply present existing information in a more convenient format. The list of items important to safety might be several times longer than Regulatory Guide 1.29, since safety-related SS&Cs constitute a subset of impor-5 tant to safety SS&Cs. Tr. 20,606; 20,661; 20,756-57 (Conran).

S7B:56. In Mr. Conran's view, preparing a list of SS&Cs important to safety would not require very much effort because the NRC deals with the items contained on such a list in every licensing application, Tr. 20,756-57 (Conran). Mr. Conran

pointed out that the only difficult part of the process would be the review and approval of a list by Staff members and by the ACRS. In Mr. Conran's opinion, however, if the NRC were to apply the necessary attention and resources to such a project, it could be completed within a couple of months. Tr. 20,756 (Conran). -

S7B: 57. Mr. Conran stated his belief that the creation of a list would not require backfitting of currently licensed facilities unless somehow in the course of a licensing review somebody had missed something. Tr. 20,757-58 (Conran).

(b) Shoreham Specific List S7B:58. For the Shoreham plant, Mr. Conran and the County testified that a list of SS&Cs important to safety would be not merely useful, but necessary. Conran Affjdsvit, ff. Tr.

20,401, at 32; Goldsmith et al., ff. Tr. 20,903, at 39-40.

They testified that LILCO should be required to produce a list in order to demonstrate its understanding of the safety concepts that underlie the NRC's regulations. Tr. 20,659, 20,670, 20,673-74 (Conran); Goldsmith et al., ff. Tr. 20,903, l

at 38-40.

j S7B: 59. The County witnesses testified that a Shoreham list is essential to ensure that the safety significance and treatment of items important to safety has been carefully con-sidered and properly implemented by LILCO, particularly in v 27 -

light of LILCO's recalcitrance in refusing to accept the application of the term "important to safety" as used by the Staff. Tr. 21,028 (Minor); Goldsmith et al., ff. Tr. 20,903, at 38-39 41.

S7B:60. Mr. Conran stated that the preparation of a list by LILCO could alter the way LILCO treats important to safety equipment during operations, with respect to replacement of equipment and compliance with NRC reporting requirements. Tr.

20,672 (Conran).

S75:61. In making its list, Mr. Conran and the County witnesses suggested that LILCO could refer.to the draft list of equipment important to safety that has been prepared for the NRC by EG&G. Goldsmith et al., ff. Tr. 20,903, at 42 n. 47; Conran Affidavit, ff. Tr. 20,401, at 33; Tr. 20,605-06 (Conran).

S7B:62. The County witnesses testified, however, that the LILCO list should be at the component level rather than at the system level, due to the likelihood of divergent QA/QC mea-sures' being assigned to civil, mechanical, and electrical com-ponents within a particular system, and the fact that QA measures are generally assigned at the component level. Thus, l it is possible that a system classified as not important to safety may contain components that are important to safety.

They noted that the EG&G Report provides 23 factors or l

guidelines for ranking individual components within a given system. Goldsmith et al., ff. Tr. 20,903 at 42 and n.47; Tr.

20,932-33 (Minor, Goldsmith).

S7B:63. Although the Staff witnesses testified that, in their opinion, a listing of items important to safety was not necessary,.they also testified that the preparation of such a list would not detract from an applicant's understanding of safety significance. Tr. 20,839 (Mattson). Staff witness Vollmer stated that if an applicant's safety classification process had been set up with due consideration of both safety-related and important to safety equipment, one could cull out of that process a list of safety-related items and items which a're important to safety, but not safety-related.

Tr. 20,842-43 (Vollmer).

3. FSAR Amendments S7B:64. 'Following a meeting on February 18, 1982, the Staff requested LILCO to commit in its FSAR that it will comply with GDC 1 during operations as follows:

Amend the FSAR to commit for non-safety re-i lated structures, systems, and components i

to include in the preventive and corrective maintenance program, the design change

( control progren, the procedures for pro-I curement of equipment, the procedures for modifications and removal of equipment from service, and the QA program, a provision that, as a minimum, the equipment and asso-ciated software shall be accorded the safe-f ty significance -given to it in the FSAR, l the technical specifications, and the emer-gency operating procedures. The charters

, - - - - ---- ,-- - - , - - , - - - ., y

and decisions of the Review of Operations Committee, the Offsite Nuclear Review Board and the Manager of Quality Assurance shall also reflect these considerations.

Letter from Darrell G. Eisenhut to M. S. Pollock, dated February 18, 1983, Staff Exhibit 14, ff. Tr. 20,812. When the Staff extracted this commitment from LILCO, the Staff believed it was with the understanding that LILCO would also accept and adopt the Denton definitions. Tr. 20,849-50 (Mattson).

S7B: 65. In a letter to the Staff dated March 2, 1983, LILCO rormally agreed to amend the Shoreham FSAR as requested and, in a letter dated March 8, 1983, LILCO submitted to the Staff three examples of the language it intended to incorporate in the proposed FSAR amendments. LILCO Exhibits 69 and 70, ff.

Tr. 20,654. The first proposed FSAR insert simply reiterates the words of the Staff directive and calls it a " corporate policy." The second insert specifies that maintenance people working on nonsafety-related SS&Cs, shall, in exercising their judgment on the appropriate measures to be applied, maintain the safety significance accorded to that equipment in the FSAR, technical specifications, and emergency operating procedures.

The third insert states that the QA Manager will consia.er the safety significance accorded to nonsafety-related SS&C's and computer software given to them in the FSAR, technical specifi-cations, and emergency operating procedures. LILCO Exhibit 70, ff. Tr. 20,654; Goldsmith et al., ff. Tr. 20,903, at 27.

S7B:66. LILCO's commitment to amend the FSAR does not constitute an agreement to accept and adopt the Denton defini-tions. Tr. 20,850 (Mattson); 21,046 (Pollock). Although the Staff witnesses stated in their prefiled testimony that in their judgment LILCO's commitment to amend its FSAR would dem-onstrate that LILCO understands the importance of nonsafety-related SS&Cs (hattson et al, ff. Tr. 20,810, at 12), it was clear from the Staff's oral testimony that that conclusion was dependent upon LILCO's acceptance of the Denton definitions.

Tr. 20,848 (Mattson). Thus, in the Staff's view, without a re-quirement that LILCO adopt the Staff's definitions, the pro-posed FSAR amendments do not constitute an acceptable basis for licensing Shoreham. Tr. 20,650 (Mattson).

S7B:67. Mr. Conran criticized the FSAR amendments as "one of the all-time examples of a tautology that I could imagine."

Tr. 20,614 (Conran). He pointed out that, in effect, LILCO has done no more than say: "'We promise to accord to nonsafety-related things the significance that we have accorded to nonsafety-related things in the [F]SAR'"; the Staff's disagree-ment with the significance accorded such equipment in the FSAR is precisely what gave rise to the need for the FSAR amendments in the first place. Tr. 20,617 (Conran). See also Tr. 20,571 (Conran). Thus, in Mr. Conran's opinion, the proposed FSAR amendments do not address at all the problem with LILCO's understanding of what is required minimally for safety, i

S7B:68. The County witnesses agreed with Mr. Conran that the proposed FSAR amendments do not address, much less resolve, the root cause of the problem (i.e., the difference in termi-nology and its effect on classifying and establishing standards of quality for important to safety but not safety-related com-I po nen ts) . The County witnesses also pointed out that in requiring LILCO to accord to equipment and associated sof tware the " safety significance" given to it by LILCO previously in the FSAR, the proposed amendments assume that the " safety sig-nificance" accorded to that equipment and software in the FSAR, technical specifications, and emergency operating procedures is correct. Goldsmith et al., ff. Tr. 20,903 at 26, 38.

S7B:69. In addition, the term " safety significance" as used in the FSAR amendments has not been defined. Absent such a definition, the amendments are meaningless. The County witnesses testified that determining safety signif.icance should include analyses of factors such as the effects of the perfor-mance or failure of a component on a safety function or on a support function (e.g. , power distribution, HVAC, service water), and the potential for misleading the operator, l contributing to a distracting event, or causing a reduction in safety margins. Goldsmith et al., ff. Tr. 20,903, at 38 n. 44.

Finally, the County witnesses noted that including the computer software in the LILCO commitments accomplishes nothing because

that software is not mentioned in the technical specifications or in the emergency operating procedures and is given only a functional description in the FSAR. Gqldsmith et al., ff. Tr.

20,903, at 27.

S7B: 70. Even the Staff witnesses testified that in addition to accepting the Denton definitions, in order to implement the FSAR amendments to the Staff's satisfaction LILCO would have to make sure the commitments have been reflected in the appropriate plant documents. In other words, the plant's records and procedures would have to be modified so the safety significance accorded to SS&C's in the licensing process is identified and described in such a way that twenty years from now a maintenance person, not involved in the licensing process, can know what to do if a problem arises. Tr.

20,872-75 (Mattson). The County witnesses agreed. Goldsmith et al., ff. Tr. 20,903, at 27-28, 39, 41-43.

S7B:71. Because there is no systematic, clearly docu-mented and well-defined " safety significance" of nonsafety-related SS&Cs in the FSAR, technical specifications, and emergency operating procedures, the proposed FSAR amend-ments, standing alone, provide no meaningful directions to Shoreham personnel regarding how to implement those commit-ments. Goldsmith et al., ff. Tr. 20,903, at 27-28.

l l

l l

S7B:72. In addition, the FSAR amendments do not require LILCO to review the FSAR to determine the true meaning of the term "important to safety" in every place that it appears in the FSAR; nor is LILCO required to review the FSAR to determine whether the term "important to safety" should be used in some instances where the term " safety-related" now is used. Gold-smith et al., ff. Tr. 20,903, at 28. The County witnesses testified that such reviews and FSAR corrections, where appropriate, should be part of any resolution of the problem.

Goldsmith et al., ff. Tr. 20,903, at 28.

S7B:73. The County witnesses testified that the ATWS events of February 22 and 25, 1983 at the Salem nuclear plant3 /

underscore the importance of properly assessing the safety sig-nificance of components and providing the necessary level of QA and preventative maintenance at Shoreham. The scram breakers involved in the Salem events had been considered safety-related; however the safety significance of attached trip functions (undervoltage and shunt trip coil) had not been prop-erly assessed. As a result, the attached trip functions were not identified' as safety-related equipment and did not receive required maintenance. Their failure to operate properly, which 1

led to the ATWS events, was a direct result of the maintenance 3/ See Board Notification 83-26, dated March 3, 1983.

deficiency and prevented the operation of the automatic reactor trip. Goldsmith et al., ff. Tr. 20,903, et 40.

The Salem licensee had generated a master equipment list (a computer-based listing of all the equipment in the plant),

which flagged for each item of equipment its safety categorization, its maintenance requirements, and specifica-tions for replacement parts. However, the list had been poorly executed in that the scram system was omitted from the list.

In addition, the document was not controlled, and it was not reviewed by the Staff. Tr. 20,843 (Mattson). In apparent re-liance on the poorly prepared and uncontrolled master equipment list, the scram breaker's shunt relay, which is important to I

safety, received no maintenance at all for years, and when it first failed, it was given ordinary commercial treatment which proved to be inappropriate. Goldsmith et al., ff. Tr. 20,903 at 41, n. 46; Tr. 20,843-44 (Mattson).

S7B: 74. In the opinion of the County witnesses, a prop-erly executed and controlled list of SS&Cs important to safety at Shoreham would demonstrate and ensure that LILCO has attributed the proper safety significance to each component and that it will continue to do so in the future. Goldsmith et al.,

ff. Tr. 20,903, at 41.

S7B:75. County witnesses testified that to resolve the l

safety classification problem and permit a finding that

(

l l

Shoreham is in compliance with the NRC regulations for design, construction and operations, a review of the Shoreham safety classification and quality program should be performed. The review should have, at a minimum, the following elements:

1. A review by LILCO of Shoreham SS&C's and their associated software, and an as-sessment of their safety significance.

2. An assessment of whether the safety significance accorded in the existing guid-ance documents (such as the FSAR and QA Manuals and procedures) is correct.

3. Preparation by LILCO of a list of SS&Cs at Shoreham which are important to safety.

The list should be accomplished at the equipment component level.

4. Correction of usage of the terms

" safety-related" and "important to safety" in the FSAR and other guidance documents.

5. Identification by LILCO of tha QA/QC program elements applicable to each item on the list of SS&Cs important to safety, and an assessment of whether those elements are commensurate with the identified safety significance.

6. Completion and appropriate imple-mentation of the proposed FSAR amendments.

7. Documentation of the results of the above steps in the FSAR.

8. Staff review, to be documented in an SER supplement, to verify compliance with 4

GDC 1.

Goldsmith et al., ff. Tr. 20,903, at 28-29, 42-43.

ll6

D. LILCO Response to Questions Relating to Disagreement with Staff In response to questions from the Board and cross ex-amination by Staff counsel, the LILCO representatives (whose presence had been requested by the Board) testified as follows:

S7B:76. LILCO does not agree that the NRC regulations covem a class of important to safety SS&Cs that is larger than the class of safety-related SS&Cs. Tr. 21,051 (Pollock); Tr.

21,078-79 (Dawe).

S7B:77. LILCO' continues to refuse to adopt the Denton definition of "important to safety" because.it regards the definition as vague, indefinite and open-ended. Tr. 21,047, 21,082-83 (Pollock).

S7B:78. LILCO's vagueness objection to the term "impor-tant to safety" would not be eliminated if the class of SS&Cs I important to safety were the same as the group of equipment addressed in the FSAR, technical specifications, and emergency operating procedures (i.e. , the equipment addressed in the pro-l l

posed FSAR amendments). Tr. 21,125 (Pollock).

i S7B:79. LILCO would have the same problem with adopting the term "important to safety" if the class of equipment covered by that term were limited to the equipment specifically called out in the SRP and the Regulatory Guides (i.e. , the equipment believed by the Staff to be covered by the regula-tions). See Tr. 21,058-65 (Dawe, Museler).

S7B:80. LILCO believes the definition of important to safety but not safety-related electric equipment covered by 10 CFR 550.49, as stated in that regulation, is more specific than the Denton definition. Accordingly, LILCO "can comply" with that particular regulation despite its use of the term "impor-tant to safety." See Tr. 21,095-98 (Dawe, Pollock). The defi-nition in S50.49 is "nonsafety-related electric equipment whose f ailure under postulated environmental conditions could prevent satisfactory accomplishment of safety functions . . . by safety-related equipment [as defined in 10 CFR Part 100 Appen-dix A]." The LILCO witnesses acknowledged that defining equip-mant important to safety as that "whose failure could prevent accomplishment of safety functions by safety-related equipment" would exclude from the set of equipment important to safety at least some of the normal reactor controls. Tr. 21,163-64 (Dawe).

S7B:81. LILCO would agree to the use of the term " safety sig ni fican t" in place of the term "important to safety" in GDC 1 only if it did not signify a change from its belief that the regulations cover only safety-related equipment, and if it were therefore understood to require no change in what LILCO has done or plans to do at Shoreham. Tr. 21,100-01 (Pollock).

S78:82. Mr. Pollock acknowledged that merely because he has difficulty defining the outside boundaries of the set of equipment important to safety, that does not mean that set necemsarily is identical to the set of safety-related equip-ment. Tr. 21,143 (Pollock).

S7B:83. Mr. Pollock stated that he did not know what the consequences would be of LILCO's adoption of the Denton defini-tion of the term "important to safety." He testified that it was possible that nothing would be necessary other than some paper work, or that very extensive work would be necessary.

Tr. 21,055 (Pollock).

S7B:84. LILCO believes it would be proper for the NRC to require a utility to define a set of equipment subject to NRC requirements that would be necessary for it to maintain a safe plant. Tr. 21,133 (Dawe).

S7B:85. LILCO witnesses testified that they believe NRC inspectors have a legal right to inspect in every part of a nu-clear facility. Tr. 21,137-38 (Pollock). However, Mr. Pollock stated that LILCO would challenge a finding of violation if it considered the matter not to be specifically covered by the regulations. Tr. 21,137 (Pollock). When asked if the basis for challenging a violation would be any different if the i

equipment involved were safety-related equipment as opposed to other equipment, Mr. Pollock stated: "We would be dealing on a different set of ground rules (:] within the safety-related area, [it is] specifically covered by regulation. In a nonsafety-related area, it is not." Tr. 21,141 (Pollock).

S7B:86. 10 CFR 550.59 requires prior approval by the NRC of changes in plant equipment or procedures which involve an unreviewed safety question. Section 50.59(a)(2) states, in part, that a change shall be deemed to involve an unreviewed safety question if it may increase the probability of the oc-currence, or the consequences, of a malfunction of equipment important to safety. LILCO witnesses stated that it is LILCO's position that the term "important to safety" as used in Section 50.59(a)(2) is limited to safety-related equipment. Thus LILCO believes that a change in equipment that did not affect safety-related equipment would not involve an unreviewed safety question and therefore would not require prior approval from the NRC. Tr. 21,136 (Dawe).

III. Systems Interaction -- USI A-17 A. Introduction S7B: 87. Mr. Conran was the principal author of the por-tion of the Staff's original Contention 7B written testimony covering systems interactions and USI A-17. He also was the

(

principal witness presenting the Staff's position on those issues in oral testimony before the Board. Conran Affidavit,

( ff. Tr. 20,401, at 1.

S7B:88. The cumulative effect of unfavorable developments with respect to the scope, schedule, priority and resources al-located to the Staff's program for resolving USI A-17 that i

l l

l

occurred both before and af ter Mr. Conran's original 7B testimony, led Mr. Conran to file his Affidavit relating to USI A-17 . He states that he can no longer in good conscience support the position, reflected in his earlier testimony, that

the Staff's systems interaction program provides currently an.

l adequate basis for the " justification for operation" conclusion required under North Anna. Conran Affidavit, ff. Tr. 20,401, at 2.

B. Background of Staff's Program for Resolution of USI A-17 S7B:89. In December 1977 the NRC Staff published the Task Action Plan for Task A-17, Systems Interaction in Nuclear Power Plants. Conran Affidavit, ff. Tr. 20,401, at 3, Goldsmith et al., ff. Tr. 20,903, at 4. The plan for resolution of Task A-17 was:

l [T]o develop and implement, to the extent that a s.tudy indicates the need, a method of review that will extend the present i review techniques in sufficient breadth and depth to assure a systematic and comprehen- '

sive review of systems interaction.

The plan will also include the development of criteria and procedures to assure that applican'ts incorporate appropriate systems interaction considerations into their design and review process.

Goldsmith et al., ff. Tr. 20,903, at 4 (quo ting NUREG-0371, Rev. 1, a t 2 (Nov. 15, 1977)).

4

S7B:90. From its inception, Task A-17 has been consis-tently designated as a high priority program. In 1977, NRR developed criteria for grouping generic technical activities according to their priority. Task A-17 was one of 41 tasks, selected from a total of approximately 133, determined by the Staff to be of the highest priority and therefore designated as a Category "A" ac'ivity.

t Goldsmith et al., ff. Tr. 20,903, at 5-6.

S7B:91. As a Category " A" activity, Task A-17 was one of those tasks which the Staff judged "to warrant priority atten-tion in terms of manpower and/or funds to attain early resolu-tion," because its resolution "could (1) provide a significant increase in assurance of the health and safety of the public, or (2) have significant impact upon the reactor licensing process." Goldsmith et al., ff. Tr. 20,903 at 5 (quoting NUREG-0410, NRC Program for the Resolution of Generic Issues Related to Nuclear Power Plants (Jan. 1978)).4/

4 4/ The other categories of generic activities included those l judged as: "important in assuring the continued health and

safety of the public but for which early resolution is not required"; having "little direct or immediate safety, l safeguards or environmental significance, but which could i lead to improved staff understanding of particular technical issues or refinements in the licensing process";

and, not " warrant [ing] the expenditure of manpower or f unds because little or no importance to the safety, envi-ronmental or safeguards aspects of nuclear reactors or to improving the licensing process can be attributed to the activity." NUREG-0410, Appendix B.

~

{

l - . - ,, .

I S7B: 92. Each subsequent Staff review of generic safety issues has re-established the high priority given to Task A-17.

In 1979, A-17 was designated as an " Unresolved Safety Issue,"

one of only 17 tasks so designated. Goldsmith et al., ff. Tr.

3 20,903, at 6-7. In NUREG-0510, Identification of Unresolved Safety Issues Relating to Nuclear Power Plants, (January, 1979), the Staff defined a USI as:

a matter affecting a number of nuclear power plants that poses important questions concerning the adequacy of existing safety requirements for which a final resolution has not yet been developed and that in-volves conditions not likely to be accept-able over the lifetime of the plants af-fected.

Goldsmith et al., ff. Tr. 20,903, at 6 (quoting NUREG-0510, at 10).

S7B:93. USIs are those programs for which resolution is necessary to:

4 (1) compensate for a. possible major reduc-tion in the degree of protection of the public health and safety, or (2) provide a

'potentially significant decrease in the ,

risk to the public health and safety.

Quite simply, an " Unresolved Safety Issue" is potentially significant from a public safety viewpoint and its resolution is likely to result in NRC aution on the af-( f ected plants.

Goldsmith et al., ff. Tr. 20,903, at 7-8 (quoting NUREG-0510, at 10). Task A-17's designation as a USI, therefore, r e flects the Staff's further judgment that it is a necessary and important program. Goldsmith et al., ff. Tr. 20,903, at 7.

4

..m e-. . - - , . - , . - - , - m-r.-_-- - , - . - . . - , ,

S7B:94. In designating A-17 as a USI, the Staff consid-ered the fact that the task involved the " perform [ance of]

studies to confirm the adequacy of current Staff safety re-quirements," as well as the fact that it was in the highest risk-related category, defined as " Potential High Risk Items."

It also reviewed the Abnormal Occurrences reported to Congress during 1977 and 1978. A consideration of all these factors led to the determination that A-17 qualified as a USI. Goldsmith e t al. , ff. Tr. 20,903, at 7.

S7B:95. A-17 has never lost its designation as a USI.

Rather, as Mr. Conran and the County witnesses noted, the safe-ty significance and importance of USI A-17 was confirmed and reinforced following the TMI-2 accident by the inclusion of a systems interaction program in the Commission's TMI Action Plan. Conran Affidavit, ff. Tr. 20,401, at 3; Goldsmith et al., ff. Tr. 20,903, at 8. The TMI Action Pla.n ranked Task II.C.3, Systems Interactions, as having high safety signifi-cance and near term (within two years of implementation) benefit. Goldsmith et al., ff. Tr. 20,903, at 8 (citing NUREG-0660, NRC Action Plan Developed as a Result of the TMI-2 l Accident, Tables B. 2 at B. 2-5, and B. 3 at B. 3. 3 (May 1980)).

S7B:96. Most recently, in the November 10, 1982, draft of NUREG-0933, A Prioritization of Generic Safety Issues, Revision 0, the Safety Program Evaluation Branch of the NRC's Division e

, -.9,,w y--, - - - - - - , - - , , - , yv- .,e , . - < - , . -

of Sa'fety ".'echnology once again assigned the highest priority to the systems interaction issue. The stated purpose of the priority rankings contained in draf t NUREG-0933 is "to assist in the timely and efficient allocation of resources to those safety issues that have a high potential for reducing risk and in decisions to remove from further consideration issues that have little safety significance and hold little promise of worthwhile safety enhancement." Goldsmith et al., ff. Tr.

20,903, at 8-9 (quo ting Draf t NUREG-0933, Rev. O , at ii-iii) .

The draft explained that:

Assignment of a HIGH priority means that strong efforts to achieve an earliest practical resolution are appropriate. This is because (a) an important safety defi-ciency is involved (though generally the deficiency is not severe enough to require prompt plant shutdown) , (b) a substantial safety improvement is likely to be attained at a low enough cost to make the improve-ment very worthwhile, or (c) the uncertain-ty of the safety assessraent is unusually large and an upper-bound risk assessment would indicate an important safety defi-ciency.

Goldsmith et al., ff. T r'. 20, 903, at 9 (quoting Draft N UREG-09 3 3, Rev. O, at iv). USI A-17 was one of only 15 issues, selected from a total of 74, that were assigned a "high" pr iority. Goldsmith et al., ff. Tr. 20,903, at 9.

S7B:97. The Board agrees with Mr. Conran and the County witnesses that the above-described decisions and actions with respect to USI A-17 indicate clearly that Staff management and

. _ . . , - _ _ - . _,. _ _ _ _ , ,_ . -p._ -.

--...,.m_.

the Commission assigned a high priority to this issue and intended that it be resolved in a timely fashion. Conran Affi-davit, ff. Tr. 20,401, at 5-6; Goldsmith et al., ff. Tr. 20,903 at 3. The Board also agrees with Mr. Conran that an analysis of whether a resolution of this issue is being reached on a timely basis must take into account the following concern:

" Things unanalyzed" in the design of reac-tor plant systems (e.g., common mode / common cause mechanisms, and the effects of non-safety component failure) can lead to

" things unexpected" in the operation of re-actor facilities (e.g., occurrence of unanticipated events, including some serious enough to be termed accident precursoru). And no matter how well ~

trained or capable reactor operating per-sonnel are (i.e., given some finite unreliability rate in operator actions), if the " unexpected" happen often enough (and it does, based on operating experience repo r ts) for long enough, the likelihood of a serious accident (like TMI-2) can become unacceptably high.

Conran Affidavit, ff. Tr. 20,401, at 6 (emphasis in o c iginal) .

C. Lack of Progress Toward Resolution of USI A-17 S7B:98. The original date set for completion of Task A-17 2 was December 30, 1978. Goldsmith et al., ff. Tr. 20,903, at 10 i (citing Task Action Plan, Task No. A-17, Rev. O (Nov. 15, l 1977)). As of January 1979, the NRC still expected to complete

" Phase I" of the task (development of a workable methodology by Sandia Laboratories) by September 1979, with " Phase II" l

l

(application of the methodology to actual plants) being contingent upon whether Sandia's study identified systems in-teractions as a significant problem. Goldsmith et al., ff. Tr.

20,903, at 10-11 (citing NUREG-0510, App. A, at 12).

S7B:99. Be.cause of unexpected delays, by September 1979, the target date for completion of Sandia's Phase I study was moved back to March 1,1980; Phase II was then scheduled for completion in March 1981. Goldsmith et al., ff. Tr. 20,903, at 11'(citing NUREG-0606, " Unresolved Safety Issues" Summary 1 (Sept. 4, 1979)).

S7B:100. As part of the TMI Action Plan,' the program for resolving USI A-17 was revised and rescheduled. As of May 1980, the revised plan included (1) a plan to develop and dem-onstrate workable methodologies for systems interaction

. analysis; and (2) review of three piant-specific systems inter-action studies: the Diablo Canyon Seismic Systems Interaction I

Walkdown; the San Onofre Seismic Systems Interaction Walkdown; and the Indian Point 3 Systems Interaction Review. Conran Af-fidavit, ff. Tr. 20,401, at 4. Goldsmith et al., ff. Tr.

4 L

20,903, at 11-12. The Diablo Canyon and San Onofre studies

, were limited to analysis of spatially coupled interactions ini-tiated by seismic events. Goldsmith et al., ff. Tr. 20,903, at 12.

S7B: 101. As of January 1981, the Staff had received state-of-the-art systems interaction methodology studies from three contractor laboratories.5/ They all suggested that a combination of existing methodologies could be used to provide a systematic approach to systems interaction analyses. The NRC incorporated this guidance into a Staff Summary Letter Report, "The Approach to Systems Interaction in LWRs" and in the "Ini-tial Guidance for the Performance of Systems Interaction Analyses at Selected LWRs." Although the guidance document is apparently in circulation within the Commission, there is no evidence that the recommended methodologies have been systemat-ically implemented at any plant. Goldsmith et al., ff. Tr.

20,903, at 11-12.

S7B:102. In October 1981, a Staff proposal for the review of four plants then under construction using NRC-developed methodologies was submitted to the NRR Director. Conran Affi-davit, ff. Tr. 20,401, at 19; Goldsmith et al., ff. Tr. 20,903, at 13. In addition, by October 1981, the Staff had completed its initial evaluation of the methodologies to be used at Diablo Canyon and San Onofre, and had reviewed a preliminary 5/ N UREG/CR-18 59, " Sy s tea.o Interaction: State-of-the-Art Review and Methods Evaluation" (Lawrence Livermore)

(January 1981); NUREG/CR-1896, " Review of Systems Interac-tion Methodologies" (Battelle Columbus) (January 1981);

N UREG/CR-19 01, " Review and Evaluation of System Interac-tion Methods" (Brookhaven) (January 1981).

[

submittal concerning the proposed Indian Point study.

Goldsmith et al'., ff. Tr. 20,903, at 13.

. S7B: 103.- Thus, as of October 1981, the Staff intended to gather dhta from seven plants for its USI A-17 program. Two of the plant reviews (Diablo Canyon and San Onofre) were to be limited in scope; the other five (Indian Point and the four reviews using NRC-developed methodology) were to be more complete. Goldsmith et al., ff. Tr. 20,903, at 13.

S7B:104. The situation today is very different. The sub-mittal to the Staff of evaluated search results from the Diablo Canyon study, which had been expected in leta 1982, has been delayed indefinitely. Similarly, the planned submittal of unevaluated search results from the licensee's study at Indian Point 3, which had been expected in late 1982 or early 1983, has been delayed until late 1983. Conran Affidavit, ff. Tr.

20,401, at 11. These delays mean that no broad secpe systems interaction study planned in connection with the USI A-17 pro-gram has yet been completed at any f acility. Tr. 20,712; 20,746 (Conran).

S7B:105. The status of the four plant reviews has also changed. Mr. Conran testified that following the submission of L

the October 1981 Staff proposal recommending the initiation of the four plant reviews, no authorization was received from the-NRR. In February 1982, however, the NRC stated (in a letter to

l the ACRS) that "[The Staff] proposes to begin soon with reviews of four near-term operating license plants using two different I methodologies for two plants each.a6/ Now the four plant reviews have been discarded altogether from the USI A-17 pro-gram. Conran Affidavit, ff. Tr. 20,401, at 19-21; Mattson et al., ff. Tr. 20,810, at 6-7; Goldsmith et al . , ff. Tr. 20,903, at 14.

S7B:106. The delays in the Staff's receipt of data from utility-conducted studies, combined with the decision not to perform systems interaction studies on the NTOL plants and the lack of any alternative studies, led to Mr. Conran's decision to file his Affidavit regarding USI A-17. Tr. 20,712-13, 20,716 (Conran).

D. New Staf f Proposal for Resolving USI A-17 S7B:107. The Staff testified that it now believes a basis for new licensing requirements could result f rom the A-17 program in October 1984. The new plan for resolving USI A-17 is based on applying the Staff's candidate methodologies to Indian Point Unit 3, to provide a comparison with the methods used by the licensee (PASNY) in its study of that plant.

Mattson et al., ff. Tr. 20,810, at 6-7. The Suffolk County witnesses disagree with the Staff's time prediction (as does 6/ Memorandum from William J. Dirck s, NRC, to Paul Shewmon, ACRS, " Systems Interactions" (February 12, 1982).

_ _ _ _ _ _ _ _ _ _ _ _ l

Mr. Conran), and also disagree that the present A-17 program can form the basis for new licensing requirements. See Find-ings S7B:109-ll1.

l S7B:108. The carrent Staff schedule is based on the Staff's expectations that the following five deadlines will be met:

1. Initiate Staff methodology comparison study on the Indian Point 3 plant in April 1983.

2. Receive the results from the PASNY study in August 1983. (Mr. Conran noted that this projected date has already slipped to September 1983. Tr. 20,792 (Conran).)

3. Receive the results of the Staff's Indian Point 3 study in July 1984.

[

4. Complete a study of the safety significance of identified interactions in July 1984.

5. Develop new licensing requirements, if any, as a result of the USI A-17 program in October 1984. Mattson et al., ff. Tr. 20,810, at 7.

S7B: 109. The County witnesses testified that, based upon i the past history of the USI A-17 program, there is no guarantee that this schedule will be met. Goldsmith et al., ff. Tr.

20,903, at 15. Mr. Conran testified that in his opinion meeting this schedule was possible, but not likely. Tr. 20,791

, (Conran). His " optimistic" estimate was that, at the current l

l

- 51 -

t .

rate of progress, completion of the program would take four to five years from April 1983. Tr. 20,709 (Conran).

S7B:110. Moreover, the County witnesses testified that the results of the Staff's program to resolve USI A-17, as now described by the Staff, will yield data from only one plant --

Indian Point 3 -- which is a PWR. Although the County witnesses considered it possible that the methodologies to be used for the Indian Point studies now planned could be applica-ble to BWR studies, they pointed out that the Staff does not plan to test those methods on BWRs as part of the USI A-17 Pro-gram. Goldsmith et al., ff. Tr. 20,903, at 15; Tr. 21,014-15 (Minor).

S7B:lll. Because the Staff has conducted no studies on BWRs and does not intend to do so as part of its program to re-solve USI A-17, there is no indication that either the current Staff plans for USI A-17 or the ultimate result if those plans are implemented will have applicability to Shoreham. Goldsmith e t al . , ff. Tr. 20,903 at 15-16. Until the methodologies have been tested on a BWR, the results cannot be used to conclude that BWRs in general or Shoreham in particular are free from significant previously undetected adverse systems interactions.

Tr. 21,014-15 (Minor) .

l l

l E. Inability to Make the North Anna Findir.g S7B:ll2. As noted above, Mr. Conran testified that in his opinion, the Staff's program for resolving USI A-17 does not provide an adequate basis for the findings required under North 1

Anna. Conran Affidavit, ff. Tr. 20,401, at 2, 10; Tr. 20,696 '

i (Conran). In Mr. Conran's view, Nort.1 Anna requires a determi-nation as to whether the operation of a facility would pose an undue risk. He stated that the Staff is required un<*er North Anna to state clearly that it is working on the USI such that either (1) the problem will be resolved before the projected operation of the facility in question, or (2) if the facility operates in the absence of final resolution, it will not pose undue risk. Tr. 20,698 (Conran). He stated that progress in resolving USI A-17 is an element necessary for a North Anna finding for Shoreham be use without such progress, he is un-able to conclude that there is reasonable assurance that Shoreham could be operated without undue risk to the public.

Tr. 20,718 (Conran).

S7B:ll3. The County witnesses agreed that progress toward u

resolving USI A-17 is necessary in the context of licensing the 4 Shoreham plant. Mr. Goldsmith explained that the purpose of the A-17 program is to obtain some systematic information on systems interactions so a determination can be made as to whether the potential for interactions is or is not a

substantial concern. Althouch there are methodologies available to analyze systems interactions systematically, those 1

methodologies must be applied before the Staff has the basis for deciding that the potential for adverse systems interac-tions is or is not present at a given plant or type of plant.

Tr. 20,917-19; 20,972-73 (Goldsmith). At this time the Staff has no study data on which to base a conclusion that BWRs in general, or Shoreham specifically, can be operated with reason-able assurance of no undue risk from adverse systems interac-tions. Goldsmith et al., ff. Tr. 20,903, at 20.

S7B:ll4. The Staff witnesses testified that, in their opinion, despite the current status of progress on USI A-17, it is possible to make a finding of reasonable assurance of no undue risk to the public, because the program is " confirmatory in nature"; that is, they expect the results of the progran to confirm that existing regulatory requirements are adequate.

Mattson et al., ff. Tr. 20,810, at 3-4. The Staff witnesses reached this conclusion despite their testimony that the objectives of the Staff's systems interaction program are to u

develop systematic methods and procedures for researching and evaluating plants to identify previously undetected interac-tions, and to determine whether there is a need to revise the Staff's requirements. Tr. 20,830 (Thadani). See also Tr.

20,972-73 (Goldsmith). Similarly, in January 1979, the Staff r

i . l l

L _ . __ - _ _ - _ _.

stated: " Task A-17 will provide an independent investigation of safety functions -- and systems required to perform these functions -- in order to assess the adequacy of current review procedures." LILCO Ex. 71, ff. Tr . 20,9 53, at A-12. The Staff witnesses also acknowledged that the A-17 program is important because they "do think there are lots and lots of interactions there." Tr. 20,862 (Thadani).

S7B:ll5. Mr. Conran and the County witnesses disagreed with the Staff's characterization of USI A-17 as

" confirmatory." Mr. Conran testified that in the absence of a compelling current indication that the definitions and Staff policies associated with USIs and high priority generic concerns no longer apply to USI A-17, the Staff should not now characterize USI A-17 as merely or principally confirmatory in nature. Tr. 20,742 (Conran).

S7B:116. Similarly, the County witnesses testified that the consistently high priority given USI A-17 by the NRC, in their opinion, demonstrates that the program is too important to be shrugged off as "merely confirmatory." In their view, W

resolution or material progress toward resolution is necessary j for there to be any factual basis for the Staff's belief that existing licensing review processes are adequate to protect against previously undetected systems interactions. Further-more, despite the Staff's statements as to the anticipated

=

results of an eventual resolution of USI A-17, the fact is that there are no results as yet, and therefore the hoped for " con-firmation" has not occurred. Goldsmith et al . , ff. Tr. 20,903, at 16-17; Tr. 20,948-50 (Minor).

S7B:ll7. The County witnesses also took issue with the Staff's assertion that " progress" in the A-17 program has pro-vided no indication that present review procedures and criteria do not provide reasonable assurance with respect to systems in-teractions ( see Mattson et al. , ff. Tr. 20,810 at 5). They pointed out that there has been only one study in 'the A-17 pro-gram which compared potential systems interaction events with specific SRP requirements ( the Sandia study) . That study iden-tified dericiencias in the SRP. Goldsmith et al., ff. Tr. ,

20,903, at 17-18; Tr. 20, 973 (Goldsmith).

S7B:ll8. In addition, actual events involving adverse systems interactions, such as the Quad Cities flooding incident i

and the Browns Ferry fire, have illustrated deficiencies in,

, and have resulted in changes to, the SRP. Based on these facts, the County witnesses concluded that the.SRP has in the l

.past addressed certain interactions on a reactive after-the-fact basis, and has been found not to address at all

)

certain other interactions. Goldsmith et al., ff. Tr. 20,903, at 18-19; Tr. 20,974 (Goldsmith).

S7B:119. Mr. Conran similarly noted that operating expe-rience, rather than the supposed results of the as yet incom-plete studies in the A-17 program, is the source of his substantial concern. Specifically, he referred to the unex-pected events that have occurred uecause the underlying systems interactions causes of those events have not been effectively addressed. Tr. 20,788 (Conran). See Finding S7B:97.

S7B: 120. The County witnesses also testified that the initial results of the limited Diablo Canyon systems interac-tion study identified 677 potential interactions, 228 of which have led to plant modifications. In their view, the sheer number of changes suggests that systems interactions are indeed slipping through the review process. Goldsmith et al. , ff. Tr.

20,903, at 19. See also Conran Affidavit, ff. Tr. 20,401, at 13.

S7B:121. Thus, contrary to the Staff's assertion that USI A-17 is " confirmatory," actual operating experience combined with the results of the few studies done for the Staff or by utilities, fail to corroborate the adequacy of tha existing i

review process. Goldsmith et al., ff. Tr. 20,903, at 18-19.

) S7B: 122. The Staff's conclusion that the requisite North l

Anna finding can be made for Shoreham is primarily based on its belief that LILCO's compliance with existing SRP aad regulatory requirements has "most likely taken care of [the] main systems

r i

( interaction issues." Tr. 20,867-68, 20,879 (Thadani); Tr.

20,878-79 (Coffman). The Staff witnesses did not consider l progress toward resolution of USI A-17 to be necessary or rele-l vant to a finding that there would be no undue risk to the

) public resulting from Shoreham operation. Tr. 20,878 (Coffman); Tr. 20,867-68 (Thadani).

F. Need for Systems Interaction Study at Shoreham S7B:123. Mr. Conran testified that all licensees and ap-plicants for operating licenses should be required to begin im-mediately limited systems interaction reviews of their facilities, using methods now known and documented. Conran Af-fidavit, ff. Tr. 20,401, at 12-13.

S7B:124. The County witnesses testified that the lack of progress on generically resolving USI A-17, the identified deficiencies in the SRP, the lack of focus of the Staff's USI A-17 ef fort on BWR systems interactions, and the potential ad-verse interactions found where systems interactions studies have been conducted, all indicate the need for systems interac-tions studies at Shoreham. Goldsmith et al. , ff. Tr. 20,903, at 20 and n.35; Tr. 20,922, 20,926 (Goldsmith).

S7B: 125. Methods of conducting systems interaction I

studies have already been developed through NRC-sponsored f

s tudie s. Those studies have been circulated within the NRC in the form of a staf f Summary Letter Report and have appeared in l

l a draft Initial Guidance for the Performance of Systems -

Interaction Analyses at Selected LWRs. The County witnesses

! testified that the identified methodologies have been suffi-l ciently tested to be used at Shoreham. Goldsmith et al., ff.

Tr. 20,903, at 21; Tr. 20,918 (Goldsmith). The three-step process recommended in the NRC guidance involves: first, mod-eling the plant to select the combinations of systems to be evaluated in detail; second, searching the plant for the selected combinations of systems; and, third, evaluating the discovered systems interactions against criteria for corrective action. Goldsmith et al., ff. Tr. 20,903, at 22.

S7B:126. Mr. Conran testified that information submitted to the Staff by the Indian Point 3 licensee indicates that findings from comprehensive systens interaction analyses may affect significantly the results cbtained from c".rrent state-of-the-art PRAs. Tr. 20,748 (Conran). Mr. Conran stated that the potential for systems interaction analyses results' affecting PRA results would apply generally to any plant. Tr.

20,748-49 (Conran).

k f S7B:127. There is no evidenca that any systems interac-l tion studies performed at Shoreham have been integrated into the Shoreham PRA. Tr. 20,976 (Goldsmith). There is no evi-dence that LILCO has committed to incorporate into its PRA in the future any new knowledge relating to systems interactions.

Tr. 20,978 (Minor).

1

G. Effect of LILCO's Misinterpretation of the Regulations on Systems Interaction Studies S78: 128. Mr. Conran testified that additional considera-tions give the systems interaction issue an added significance at Shoreham. First, because LILCO has taken the position that its PRA study has, in effect, resolved the systems interaction issue for Shoreham, it appears likely that even if the Staff does not effectively pursue timely resolution of this issue, LILCO will not pursue the issue on its own. Conran Affidavit, f f. Tr. 20,401, at 26.

S7B:129. Second, LILCO's position regarding the safety classification issue presents the possibility that in any systems interaction-type analysis, LILCO did not adequately consider the effects of failures of systems important to safety bu t not safety-related, on safety-related systems. Conran Af-fidavit, ff. Tr. 20,401, at 27. Mr. Conran explained that LILCO's view, that equipment important to safety is limited to safety-related equipment, could affect its judgment concerning the impact of the failure of nonsafety-related equipment. In

! his view, this fact raises a question as to how much credit should be given to LILCO for any systems interaction studies it may have performed. Tr. 20,686-87, 20,705, 20,720 (Conran).

He'noted, as an example, that in conducting its study of pipe breaks, the level and degree to which LILCO explored both the effect of a break on a nonsafety-related control system and the 1

safety eC

• of a failure of that control system, could very well have been influenced by LILCO's basic misunderstanding of what is important to safety. Tr. 20,710 (Conran).

S7B: 130. The County witnesses agreed that LILCO's rejec-tion of the Denton definitions could affect in three ways the acceptability of systems interaction studies it may have performed: (1) in performing a study, LILCO might evaluate the importance of systems and assume care and maintenance for systems differently than would the Staff; (2) in determining what systems to include in a study, LILCO might consider certain systems not important enough for inclusi'on even though the Staff would disagree; and, (3) in evaluating the results of I

a study, LILCO might consider some identified interactions as l

being less important and having less safety significance than f

would the Staff, and thus might not take necessary corrective action. Tr. 20,930-32 (Minor). See also Tr. 20,720 (Conran).

S7B: 131. Mr. Conran alto noted that the results of systems interaction studies could identify certain equipment as '

important to safety that had not theretofore been recognized.

1 Tr. 20,774 (Conran).

Suffolk County's Revised Findings of Fact on Suf folk County / SOC Contention 7B1/

7B:4. LILCO, the NRC Staff, and Suffolk County / SOC testified on SC/ SOC Contention 7B. LILCO and the NRC Staff ex-plicitly submitted testimony on SOC Contention 19(b), and the SC/ SOC 7B testimony also addressed many of the issues in' SOC Contention 19(b). LILCO's prefiled testimony was submitted by Robert M. Kascsak of LILCO; George F. Dawe, George Garabedian and Paul W. Riegelhaupt of SWEC; Pio W. Ianni and David J.

Robare of GE; Paul J. McGuire of United Energy Services Corp.;

Dr. Edward T. Burns of Science Applications Inc.; and Dr. .

Vojin Joksimovich of NUS Corporation. Burns et al., ff. Tr.

4346. Mr. William J. Roths of General Electric also testified on behalf of LILCO. See ff. Tr. 4563 (Professional Qualifica-tions -- William J. Roths). The Staff prefiled testimony was submitted by Dr. Themis P. Speis of the Division of Systems In-tegration, Dr. C. E. Rossi of the Instrumentation and Controls System Branch, Walter P. Haass of the Quality Assurance Branch, Marvin W. Hodges of the Reactor Systems Branch, James H.

Conran, Sr., of the Reliability and Risk Assessment Branch, and 1/ The Findings of Fact reprinted herein orginally appeared in Suffolk County's Proposed Opinion, Findings of Fact, and Conclusions of Law in the Form of a Partial Initial Decision, Volume One, filed January 31, 1983. Only those findings revised as a result of the reopening of the record on Contention 7B, are reprinted. Revisions are des-ignated as follows: new material is underlined; a line is drawn through material which has been deleted.

Robert Kirkwood of the Mechanical Engineering Branch. Speis et i

al., ff. Tr. 6357. Mr. Conran also submitted rebuttal testimo-ny for the NRC Staff on the issue of LILCO's interpretation of the term "important-to-safety." Conran, ff. Tr. 6368. Ashok Thadant, Chief of the Reliability and Risk Assessment Branch, I

also appeared for the Staff. See ff. Tr. 6453 (Ashok C.

Thadani -- Professional Qualifications). The Suffolk Coun-ty/ SOC testimony was submitted by Susan J. Harwood and Marc W.

Goldsmith of Energy Research Group, Inc. and Richard B. Hubbard and Gregory C. Minor of MHB Technical Associates. Goldsmith et al., ff. Tr. 1114. See Finding S7B:2 for identification of testimony on reopening of Contention 7B in April 1983.

7B:ll. LILCO classifies SS&Cs at Shoreham as either safety-related or nonsafety-related. Burns, et al . , ff. Tr.

4326, at 28; Tr. 4452 (Dawe); Tr. 4786 (Robare). LILCO believes this is consistent with industry practice. Tr.

4419-23 (Dawe); Tr. 4488-92 (McGuire); Tr. 4883 (Robare).

However, at least one utility, Metropolitan Edison, has adopted the classification terminology specified in the Denton Memoran-dum. Tr. 20,833 (Mattson).

7B:25. LILCO disagrees with the Denton Memorandum's indi-cation that the category of SS&Cs which are "important-to-safety" is broader than those which are classi-fled as " safety-related." Tr. 4423 (Dawe); Tr. 21,051 (Pollock); Tr. 21,078-79 (Dawe).

i 7B:26. It is not acceptable for the language differences between LILCO and the Staff relating to SS&Cs important to safety to go unresolved. The Staff testified:

l a. The Staff conducts audit reviews and thus mu't s rely upon commitments by appli-cants that all portions of the regula-tions are complied with. It is criti-l cal therefore, that the Staff understands what an applicant means in its' commitments to regulatory require-ments.

I

b. Under the Staff's understanding of "important-to-safety" but not under the applicant's, there exists in the regulations a requirement under GDC 1 for a QA program for nonsafety-related SS&Cs which are important to safety.

The LILCO interpretation of GDC 1 would mean that no such QA/QC require-ment is embodied in GDC 1.

c. Under LILCO's interpretation of the term important to safety, the obligations for reporting under 10 CFR Part 21 might be more narrowly construed than would be proper under the Staff's broader definition.

Conran, ff. Tr. 6368, at 6-7. The Staff stated that this in-terpretation issue, therefore, is " extremely significant."

Conran, ff. Tr. 6368, at 7. See also discussion of interpreta-7 tion issue in the Supplemental Findings,Section II, and the Opinion, Sections II.B.3 and IV.C.3.

7B:29. The NRC I&E witnesses testified during the QA/QC hearing that they have inspected a number of plants over the years and have not observed any plant that has used the classification "important-to-safety" to apply to SS&Cs which are not safety-related. Tr. 17284 (Higgins); see Tr. 17285 (Narrow). During the reopened hearing, however, the Staff in-dicated that Metropolitan Edison has adopted the Staff termi-nology. Tr. 20,833 (Mattson).

7B:38. In Section 3.1 of the FSAR, LILCO commits to com-ply with the NRC's GDC. With respect to GDC 1, LILCO states:

Structures, systems, and components important to safety are listed in Table i 3.2.1-1. The total quality assurance (QA) program is described in Chapter 17 and is applied to the items contained in this table. The QA program assures that all phases of design and construction ~ conform to regulatory requirements and design bases described in the license application . . . .

The detailed QA program developed by Long Island Lighting contractors satisfies the requirements of Criterion 1. (emphasis supplied).

LILCO has used " safety-related" and "important-to-safety" in-terchangeably in the Shoreham FSAR. Those terms were consid-ered synonymous with the definition of " safety-related" which L is embodied in 10 CFR Part 100, Appendix A. Tr. 4420-22 (Dawe); Tr. 10164-67 (Museler). In view of the f act that LILCO equates the term "important-to-safety" with the term " safety-related," this commitment in Chapter 3.1 of the FSAR is a com-mitment to comply with GDC 1 only insofar as safety-related SS&Cs are concerned. See Findings S7B:49, 64-72 for discussion of LILCO proposed changes to the FSAR.

)

\ ... ,.._. _ -

7B: 67. The NRC Staff has provided no guidance to appli-cants regarding what constitutes appropriate QA for SS&Cs which are important to safety but not safety-related. Because of this lack of guidance, the Staff believes the burden is on LILCO engineers to identify the safety functions of an item and, in view of that, for QA personnel to apply appropriate QA.

Tr. 6980-81 (Haass). The Staff agrees it needs to develop a more structured approach to provide better guidance for appli-cants on the QA requirements for nonsafety-related SS&Cs which are important to safety. Tr. 6980-81 (Haass). Such guidance is under development. A new EG&G report (commissioned by the NRC), published in draft in November 1982, ranks the importance to safety of various components and systems in BWRs, and then graded QA guidelines are suggested. Tr. 15806-07 (Hubbard).

See also Findings S7B:61-62 regarding the EG&G Repo r t.

7B:73. The Staff learned at~the 7B hearing (apparently for the first time) that LILCO (in the Staff's opinion) had misinterpreted GDC 1 in defining "important-to-safety" as being equivalent to " safety-related." However, based primarily on the written and oral LILCO testimony, the Staff witnesses f

testified initially that helic::: LILCO has, in substance, ade-f j quately complied with the GDC 1 QA requirements for nonsafety-related SS&Cs. Tr. 6974-78, 7124 (Haass, Conran);

Tr. 7850 (Speis). If LILCO would commit for the future to 1

l comply with the terminology with the Denton Memorandum, the l

Staff stated in July 1982 that they would be satisfied. Tr.

7711-17 (Haass, Conran); Tr. 7712 (Haass); Tr. 6977, 7494-95 (Conran). The Staff position has now changed, with Mr. Conran i taking the position that LILCO does not understand minimally what is required for safety under the NRC's regulations and the other Staff witnesses reiterating the need for adoption of the Staff terminology. In the process, the Staff has made clear that certain proposed FSAR amendments by LILCO were not suffi-cient to allay Staff concerns absent clear LILCO commitment to the Denton Memorandum terminology. See Findings S7B: 3, 5, 7, 9-11, 19, 24-27, 29, 32, 40-46, 53, 54, 58, 66, 67, 70.

7B:77. The Staff's review process does not require that those items important to safety, but not safety-related, be specifically identified in a listing or to be otherwise specif-ically addresse'd by an applicant. The Staff stated:

With regard to those structures, systems and components important to safety-but not classified as safety-related, compliance with the criteria and requirements of approved regulatory guidance documents

( (e.c., Standard Re. view Plan, Regulatory Guid.e, etc.) assures that such structures,

, systems.and components are properly classi-

[ fied and addressed in the Applicant's sub-7 mittal although they are not explicitly identified in a listing equivalent to the QA-list for safety-related items. Speis et j al., ff. Tr. 6357, at 10.

.. I

Mr. Conran has now changed his opinion and believes LILCO should specifically identify all SS&Cs which are important to safety. Conran Affidavit, ff. Tr. 20,401, at 32; Tr.

20,660-62, 20,668-69 (Conran).

7B:80. According to the NRC, if an applicant complies

! with SRP requirements, systems are considered to have been classified correctly. In the Staff'c rie", Mr. Conran's ini-tial testimony, he indicated his belief that it is implicit in the criteria in the SRP that there is an understanding of how important a system is and, therefore, what quality standards it

~

must meet. Tr. 6583 (Conran). Thus, if an applicant's sub- ,

mittal satisfies the Staff's "so-called deterministic require-ments," the Staff considers the application to be adequate.

t l Tr. 6594 (Thadani). Mr. Conran has now altered this view as applied to Shoreham. See Findings S7B:4-6, 21.

7B:81. The SRP also specifies how the Staff's review should be documented in the SER. The review generally is docu-mented by " boiler-plate statements." Thus, the SRP suggests exact words that should be included in the SER if the appropriate standards and criteria have been met. Many aspects l of the Staff's review are thus not documented in the SER. Tr.

f 7096 (Conran). While certain staff witnesses continue to believe that the Staff review process is adequate for design and construction' ( see Findings S7B:21, 27), Mr. Conran has now

_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ __--------..-____a

expressed doubts concerning this process. (See Findings 7B:19-24).

7B:133. However, LILCO does not set forth a listing (such as in Table 3.2.1-1) of SS&Cs important to safety but not safety-related. Also, the Staff does not require that this l subset be specifically identified in a listing, and simply requires an applicant to commit to meeting the provisions of GDC 1. Speis et al. , ff. Tr. 6357, at 9; Tr. 4451-52 (Dawe).

Mr. Conran now believes, however, that more than a commitment is required at Shoreham. He believes that L1LCO should prepare a listing of all SS&Cs important to safety. (See Findings S7B:47, 49, 52, 55, 57).

7B:440. One remaining element of the Staff's systems interaction program under the TMI Action Plan is the so-called pilot program. Speis et al., ff. Tr. 6357, at 40. The pilot program has not yet been started or received approval. Tr.

7160 (Conran).2/

l I

2/ See Findi~ngs S7B:89-127 and Section IV.D.1 of the Opinion, for description of subsequent events, involving the Staf f's USI A-17 program , that relate to Findings 7B:432-439 above.

p.

J.

UNITED STATES OF AMERIC A NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD

. [\-

"s '

T 'i

/(C

) A. s.

In the Matter of ) /g v4f LONG ISLAND LIGHTING COMPANY

) l: A!Ay C

) 17 -

) Dockei No. 10 50 f3oI2a(Q,. .)

(Shoreham Nuclear Power Station, ) j Unit 1) ) h'% #g '.'ge,c, A O

)

4 -4

' CERTIFICATE OF SERVICE I certify that copies of SUFFOLK COUNTY's Revised Opinion, Supplemental Proposed Findings of Fact, Revised Findings of Fact, and Conclusions of Law in the Form of a Partial Initial Decision on Suffolk County / SOC Contention 7B, have been served this 9th day of May 1983 to the following by first class mail, postage prepaid, except as otherwise indicated.

Lawrence J. Brenner, Esq. (*) W. Taylor Reveley, III, Esq. (*)

Administrative Judge Hunton & Williams Atomic Safety and Licensing Board P.O. Box 1535 U.S. Nuclear Regulatory Commission 707 East Main St.

Washington, D.C. 20555 Richmond, Virginia 23212 Dr. James L. Carpenter (*) MHB Technical Associates Administrative Judge 1723 Hamilton Avenue Atomic Safety and Licensing Board Suite K U.S. Nuclear Regulatory Commission San Jose, California 95125 Washington, D.C. 20555 Hon. Peter Cohalan Dr. Peter A. Morris (*) Suffolk County Executive d Administrative Judge H. Lee Dennison Atomic Safety and Licensing Board Building U.S. Nuclear Regulatory Commission Veterans Memorial Highway Washington, D.C. 20555 Haupp,auge, New York 11788 Edward M. Barrett, Esq. Atomic Safety and Licensing General Counsel Appeal Board Long Island Lighting Company U.S. Nuclear Regulatory 250 Old Country Road Commission Mineola, New York 11501 Washington, D.C. 20555

Mr. Brian McCaffrey Bernard M. Bordenick, Esq. (*)

Long Island Lighting Company David A. Repka, Esq.

175 East Old Country Road U.S. Nuclear Regulatory Commission Hicksville, New York 11801 Washington, D.C. 20555 Marc W. Goldsmith Stuart Diamond Energy Research Group, Inc. Environment / Energy Writer 400-1 Totten Pond Road NEWSDAY Waltham, Massachusetts 02154 Long Island, New York 11747 David J. Gilmartin, Esq. Daniel F. Brown, Esq. (*)

Suffolk County Attorney Atomic Safety and H. Lee Dennison Building Licensing Board Panel Veterans Memorial Highway U.S. Nuclear Regulatory Commission Hauppauge, New York 11788 . Washington, D.C. 20055 Atomic Safety and Licensing James B. Dougherty, Esq. I Board Panel 3045 Porter Street, N.W.

U.S. Nuclear Regulatory Commission Washington, D.C. 20008 Washington, D.C. 20555 Docketing and Service Section Office of the Secretary U.S. Nuclear Regulatory Commission I Washington, D.C. 20555 1

1

~

K'a r ). a J . Lets g KIRKPATRICK,/LOCKHART, HILL, CHRISTOPHER & PHILLIPS DATE: May 9, 1983 1900 M Street, N.W., 8th Floor Washington, D.C. 20036 l

(*) By Hand l

l l

l l

i i