ML20100H296

Forwards Explanation of Unique Risks Arising from Degraded Steam Generators at Facility.Emergency Procedures Untried, Complex,Confusing & Rely Fundamentally on Improvisation. Deferment of Operation of Facility Requested

ML20100H296
Person / Time
Site:	Three Mile Island
Issue date:	04/05/1985
From:	Pollard R, Weiss E UNION OF CONCERNED SCIENTISTS
To:	Asselstine J, Palladino N, Roberts T NRC COMMISSION (OCM)
References
CON-#285-412 OLA, NUDOCS 8504090091
Download: ML20100H296 (10)

Text

"

'p UNION OF owmuna

' " " " - - -p-)ggsf "

' l CONCERNED ,,,  !

SCIENTISTS m C_ue.u_. xw. . s. um . washie,atoC 2oo36. (2o2> 2* seoo I

'65 APR -8 Fjl :01 h1,5{f fSjk m.m hunzio J. Falladino, Chairman Womas M. Ibberts, Commissioner James K. Asselstine, Comissioner Frederick M. Bernthal, Commissioner " ' ~ " ~ ' " ~ ~

Iando W. Zech, Comissioner U. S. Nuclear Regulatory Commission Washirgton, D. C. 20555 Gentlemen:

s

%e Union of Concerned Scientists believes that operation of %ree Mile Island Unit 1 (TMI-1) with its degraded steam generators could pse serious risks that have not been evaluated or brought to the commission's attention.

%ese risks are unique to 7MI-l and arise froin the inability of the steam generators in their degraded condition to withstand the forces that may occur following a steam generator tube rupture accident.

We previously discussed this subject in our August 24, 1984 filing with the Comission. (Union of Concerned Scientists' Cbjection to Waiver of Sub-cooling Criteria and Comments on NRC Staff's Safety Evaluation of Subcooling Criteria for Actuating or Throttling High Pressure Safety Injection (SECY 237), August 24, 1984, pp. 10 - 13] GPU Nuclear's currently penoing request to relax the criteria applicable to plugging of degraded steam generator tubes and the scheduled April 19th Commission briefing on the 7NI-l steam generators prmpt UCS to provide a more detailed explanation of our safety concerns.

Having decided to seek permission to operate 7NI-1 .ithout replacing the steam generators, GPU Nuclear is attempting to prevent catastrophic rupture of the steam generators by adopting mergency procedures that violate a number of safety limits applicable to every other similar plant. The TMI-1 emergency procedures for accidents involving leakage or rupture of one or more tubes in either or both steam generators are untried, remarkably complex and confusing, rely fundamentally on improvisation, and would result in unavoidable radiation exposure to the public. Moreover, there has been no demonstration that, even if these procedures are correctly interpreted and followed, the fuel damage limits specified in the ECCS criteria and the radiation exposure limits for the public wuld be met fora design basis steam generator tube rupture accident.

Attached is a more detailed explanation of the unique risks arising frce the degraded steam generators at 7MI-1. Were are neerous specific safety questions that remain unanswered. %ese specific questions are related te one gDRSO4090091 850405 g ADOCK 0500aggy ,y PDR Main Office: 26 Church Street . Cambridge, Massachusetts o2238 . (617) 547 5552

))

. principal concern: Is there reasonable assurance that the health and safety of the public will be protected in the event of a design basis steam generator tube rupture accident?

In the face of these questions, we urge the Commissioners to defer oper-ation of 2I-1 unless and until it has been demonstrated that such operation will not pose undue risks to the health and safety of the public.

Sincerely, Robert D. Pollard Nuclear Safety Frgineer lN )% - ?{'l!)}

EllynSR. Weiss General Counsel

Enclosure:

Safety Pazards of regraded Steam Generators at W I-1 cc w/ encl:

W I Service List

i t g l

s l SAFETY HAZARDS OF DEGRADED STEAM GENERATORS AT TMI-1

-I. Suninary of Safaty Hazards Daring normal power operation of 'IMI-1, the pressure in the rescte coolant system (inside the steam generator tubes) is about 1000 psi higher than the pressure in the steam generators (outside the tubes) . In the event of ~ steam generator tube leakage or rupture, water will flow from the higher pressure reactor coolant system into the secondary side of the steam ,

generator, causing the steam generator water level and pressure to rise.

Here are nine safety valves associated with _ each steam generator that protect the steam generators against high pressure. %ese safety valves are j

preset to open automatically at various pressures between approximately 1000 and 1100 psig and to reclose when pressure decreases. %e steam generator safety valves are designed to relieve steam but not liquid, cannot be control-

led by the reactor operator, and discharge directly to the outside atmosphere.

If liquid is discharged through a safety valve, there is a strong possibility that the valve will stick open. If a safety valve sticks open for whatever reason, nothing can be done to terminate flow through it until the entire plant is cooled below about 212 F. As long as a steam generator safety valve is open on the broken steam generator, radioactive material from the reactor coolant system will be discharged directly into the outside environment.

At a normal plant, the risk of a large radioactive release following a steam generator tube rupture is reduced by emergency procedures that require isolation of the broken steam generator and rapid cooldown of the reactor coolant system ucing the intact steam generator. %e aim is to rapidly reduce teactor pressure below the lowest pressure at which the steam generator safety valves are set to open. Once this is accomplished the danger of an uncontrolled radioactive release through a steam generator safety valve is

, removed.

l i

n.-

i i.-'

2e crucial point here is that such procedures cannot be used at. mI-1

because

.1) the degraded steam generator tubes could be pulled apart under- the stress of 'a rapid cooldown; 2) the condition of the SI-1 tubes makes it more l likely that ruptures or leaks could ' occur in both steam generators simultane-I ously; and 3) the . use of ' the ' emergency feedwater system, which sprays cold j water' directly on the steam ~ generator tubes, to cool the plant may cause addi- 9 I. tional leaks in the degraded tubes.  ;

Because rapid cooling of the MI-1 reactor could cause additional tube leaks or ruptures, GPU proposes to attempt to hold down steam generator pres-

, sure (and thereby prevent opening of the steam generator safety valves) by I continuingL to release steam from the secondary side of the broken steam gener-j- ator(s) and by reducing the pressure in the reactor coolant' system. Iowering

] the pressure in the reactor reduces the amount of water flowing through the j broken or ruptured tubes .into the steam generator. However, lowering the pressure also--reduces the saturation margin and thus increases the potential

{ for. = boiling in ' the reactor coolant system. %is could result in loss of -

{ natural circulation cooling of the core because the. steam' would collect in

} high points of the reactor coolant system piping.

I i II. Specific Safety Hazards i

l j In order to implement the emergency procedures proposed by GPU for steam l generator tube leakage / rupture accidents, numerous safety limits and. precau-tions applicable to every other similar nuclear power plant would have ,to be

~

l violated. In addition, the degraded condition- of the 31-1 steam generators ,

l has already resulted in a significant reduction in some of the safety margins i

i that exist at all other similar plants. Some of the factors unique to' WI-1 l because of the degraded condition. of its steam generators' and the safety i

limits violated.at 2I-1 are discussed below.

I j 1. Limiting Steam Generator Tube Stresses. The steam generator tubes are l subjected to a tensile stress when the tube temperature is . less. than the l temperature of the steam generator- outer shell. = As the reactor coolant system

~

temperature decreases during cooldown, tube temperature decreases. At some ,

I

...,r._-~ . . _ . . . - - - - , - . - - . _ . , , . , _ . . . , . _ . . . , _ . - - - - . . - . . . _ , _--- ..m_ . . , - - . . - . . . - . . ~ . -

l :$

point the ~ temperature difference between the warmer shell and the colder tubes h creates a force that is sufficient to pull apart a leaking tube.

1 4

he,alloweble shell-to-tube temperature difference for other E&W plants is'100 F for a normal cooldown and 150 F in an emergency. (%e 100 F limit

[ is based on the assumption that any cracks in the tubes are less than 40%

through the tube wall.) However, the limit on the shell-to-tube temperature difference for 1MI-1 is 70 F, less than half that allowed in a plant without corroded steam generator tubes. %is reduced limit slows the cooldown of the j reactor and is necessary to prevent propagation of cracks in tubes. that are i leaking at a rate less than is detectable.

i y %e shell-to-tube temperature difference can be controlled by reducing j the cooldown rate of -the reactor coolant system (and thus the cooldown of the j tubes) and by cooling the steam generator shell. %e shell can be cooled by releasing steam from the steam generator and by supplying feedwater to the steam generators using the main feedwater system which' delivers water into the 2

1 downcomer section of the steam generator. In contrast, . isolation of a leaking steam generator can increase the shell-to-tube temperature difference. %e '

. shell-to-tube temperature difference would also be increased by use of the emergency feedwater system because it sprays water directly onto the tubes and is not as effective as main feedwater in cooling the steam generator shell.

t

]

] Controlling the shell-to-tube temperature difference is ' complicated by i

the fact that the reactor operator cannot call on any instrtments meeting l NRC's safety requirements to measure this temperature difference. %e-tempera-l ture difference can be obtained by calculating a weighted average of the read-

ings from five thermocouples to determine the . temperature of .the steam genera-

! tor shell, and by using the reactor coolant system cold leg temperatures to-f . determine tube temperature. %is process would be further complicated if the

, plant computer were inoperative, -if some shell thermocouples had failed, or if j one or more reactor coolant pumps were not. running.

J W

~ Additional hazards will be presented .if offsite electrical power is lost, an assumption required by General Design Criterion -17 when ' evaluating the l- adequacy of protection against a design basis accident. We main condenser i

l

_ . . _ . , _ _ _ . - _ . _ _ _ _ - _ _ . _ _ _ . . _ - _ _ . . . _ . _ _ _ _ _ . ~ . _ _ . . - _ _ _ _ _ . _ . _ _ . ,

a

-A-will be unavailable and steam release must be through the atmospheric dmp valves which discharge directly into the outside atmosphere. Also, with the reactor coolant pumps inoperative because of the lack of offsite electrical power, the reactor cannot be depressurized using the pressurizer spray.

Instead, the pilot-operated relief valve (PORV) on the pressurizer would have to be used. However, the PCRV and its associated control circuits do not meet safety requirements and therefore cannot -be relied upon in the safety evalua-tion of a design basis tube rupture accident. Finally, after a loss of offsite power, the main feedwater system would probably be unavailable, requiring the use of the emergency feedwater (EfW) system. Use of the EfW system poses the risk of increasing the shell-to-tube temperature difference and causing additional tube leaks or ruptures.

2. Violation of Subcooling Margin criteria. Subcooling margin is the difference between the temperature at which boiling will occur in the reactor coolant system (RCS), which is determined by the BCS pressure, and the highest temperature in the RCS.

One of the lessons learned from the MI-2 accident was that the subcooling margin should be maintained greater than 50 F, that is, the highest temperature in the RCS should be at least 50 degrees below the temperature at which boiling will occur. We purpose of this requirement is to reduce the potential for steam formation in the reactor coolant system which could interfere with core cooling. A related " lessons learned" require-ment was that safety grade instrtmentation should be capable of calculating and displaying the subcooling margin. Both of these requirements wuld be violated at MI-1 during a design basis steam generator tube rupture accident.

As discussed above, the degraded condition of the steam generator tubes precludes a rapid cooldown of the reactor coolant system. %erefore, in an attempt to reduce the flow of reactor coolant into the broken steam generator (and thus reduce the amount of radioactivity released to the envirornent), GPU proposes to reduce the pressure in the reactor coolant system. However, reduc-

, ing RCS pressure also reduces the subcooling margin, thereby increasing the risk of boiling in the reactor coolant system which could interfere with cooling of the reactor core.

r

)

Rather than maintaining the . required 50-degree margin, GPU proposes to reduce the subcooling margin to 25 F, as indicated on the subcooling meters.

Although we have not received GPU's final error analysis, it appears that the l accuracy of the subcooling meters is approximately +_ 20 to 25 F. Bus, if the indicated subcooling margin is 25 F, the actual subcooling margin may be anywhere between zero (meaning boiling is occurring in the reactor) and 50-degrees (meaning the rate of leakage of reactor coolant into the enviroment is greater than desired) .

Additional safety hazards are posed because the proposed technical specifications would permit unrestricted operation of 'IMI-1 with one of the tw subcooling meters inoperative and permit continued operation for another week following the failure of the second subcooling meter. Finally, because of the design of the subcooling meters, they cannot be relied upon by the reactor operator when the reactor coolant temperature is below 300 F or when the reactor coolant pumps are not running, which they muld not be under the required design basis accident assmption of loss of offsite electrical power.

In summary, because of the degraded condition of its steam generators,

'IMI-1 is the only plant knich will violate the 50-degree subcooling margin safety requirement. Violation of this safety limit can result in boiling in the reactor which could interrupt natural circulation cooling of the core, and may not achieve the intended goal of reducing radiation exposure to the public because of the inaccuracy and/or unavailability of the instrments used to measure the subcooling margin.

- 3. Violation of Reactor Coolant Pump Operating Limits. Limits on reactor coolant pump operation, referred to as net positive suction head limits, speci-fy the minimm RCS pressure required for operation of the pumps. We minimm RCS pressure required is determined by the temperature in the RCS. %e pur-pose of these limits is to prevent vibration and damage to the main reactor coolant pumps and the seals on the pump shafts. %e proposed limits at 'IMI-1 violate the limits applicable to every other similar plant. %ese limits are violated at 'IMI-1 because, with the reduced subcooling margin discussed above, continued operation of the reactor coolant pumps would not.normally be permit-

e O

ted. However, since there is substantial doubt that protection against a steam generator tube rupture accident in 'IMI-1 is adequate without operation of the reactor coolant pumps, GPU proposes to relax the normal limits applicable to pump operation. In addition, continued operation of the reactor coolant pumps can reduce the primary to secondary leak rate through the leaking tubes by allowing a further reduction in RCS pressure while still maintaining the indicated 25 F subcooling margin (because the core delta-T is l smaller with the peps running). '

'Ihe fact that NRC regulations require that adequate protection against steam . generator tube rupture accidents be demonstrated assuning that no

reactor coolant pumps are operating (because of the loss of offsite electrical power) appears to have been ignored by both GPU and the NRC staff.

-4. Violation of Fuel-Pin-in-Compression Safety Limits. The reactor coolant system pressure should be sufficiently high to assure that the fuel pins are always in compression above 425 F. 'Ihe fuel-pin-in-compression limits require a high subcooling margin for RCS pressures ranging from 1350 psi to 550 psi. Thus, these limits wuld prevent the proposed reduction in subcooling margin discussed above. One safety hazard posed by violating these limits is that the fuel pins could swell (called " ballooning") and reduce the flow of cooling water through the fuel. Another possibility is that the fuel

, rods could crack, .thereby releasing additional radioactive material into the reactor coolant flowing through the broken tubes and being discharged to the environment through the atmospheric dump valves or the ~ steam generator safety valves.

l S. Operator Training Deficiencies. The new emergency procedures proposed by GPU for steam generator tube leak / rupture accidents are a result of the -

; ' degraded condition of the 'IMI-1 steam generators. Although GPU claims that its operators have ' received additional tre ting on these new procedures, UCS's i

questioning of 'IMI-1 reactor operators c21 sed doubts that the training was adequate. :Indeed, ' because of the complexity of- the emergency procedures and

' their reliance -on improvisation at the time of an accident, /it' is unlikely .

l l

<v , _ ,....y

4 that any amount of training will be adequate to assure protection of the health and safety of the public.

For example, the procedures specify that steam releases from the broken steam generator (s) should be stopped den the measured or projected offsite dose rate to the public is 50 millirem / hour whole body or 250 millirem / hour thyroid dose. During discovery for the reopened ASG hearing on training, UCS questioned four 7MI-l personnel who had passed the training program. Although this was a small sample, it is nevertheless disturbing that only one operator knew the correct dose rates at which the steam generator (s) should be isolated. Another reactor operator believed that it is acceptable to continue steam release until the offsite dose rates reach I rem / hour whole body or 5 reWhour thyroid dose. His indicates a deficiency in the training program far greater in scope than simply the adequacy of training for steam generator tube rupture accidents.

Another indication of inadequate training is that not one of the four individuals could adequately explain how they could determine whether the leakage through the tubes was greater or less than 50 gallons per minute.

Bis determination is important because the emergency procedures specify different actions depending on whether the leak rate is above or below 50 gpn.

%e emergency procedures are exceedingly complex and may be beyond the ability of any reactor operators to reasonably understand and follow during a real accident (rather than practice drills on a simulator) . %e reactor operator must manually control several parameters simultaneously, including the reactor coolant system cooldown rate, reactor coolant system pressure,

. pressurizer level, emergency or main feedwater flow rate to both steam generators, the water level and pressure in both steam steam generators, the reactor coolant system subcooling margin, and the shell-to-tube temperature difference in both steam generators. %e operators must also monitor the reactor coolant pump net positive suction head pressure to avoid violating even the relaxed limits. 'In addition, the operators must calculate the offsite radiation dose rates to decide whether a steam generator should be isolated.

-8 -

i, -

A final example of why we doubt that there is adequate protection for the 4-public is that the emergency procedures rely on improvisation during the accident. Revision 3 of GPU Nuclear's Technical Data Report TDR-406, "SG 'Ibbe Rupture Procedure Guidelines," contains an- appendix entitled, " Additional Steaming and Isolation Criteria for. Reduction of Radiological Release." His l

- appendix essentially overrules the precautions in the emergency procedures  !

concerning isolation of a steam generator when offsite dose rates exceed the '

t

limits discussed earlier. Rather -than giving specific procedures, thought-out

in advance, for the operators to follow, it simply lists the factors that need I to be considered during the accident'.

I III. Conclusions.

We fundamental safety problem is that neither GPU nor the NRC has given any serious consideration to whether replacement of the steam generators is now necessary to assure an adequate level of safety. Instead, having decided to operate MI-1 with uniquely degraded steam generators, GPU is seeking to make the best of a bad situation.

Based on the information available to us, UCS has concluded that a safety evaluation of a steam generator tube rupture accident at- MI-1 has not been performed in accordance with the Commission's safety ' requirements for design basis-accidents. Se existing emergency procedures for a . steam generator tube rupture accident at MI-1 apparently reflect the fact that there are only two rossible outcomes: a controlled radiation exposure to the public or an uncon-trolled radiation exposure to the public. We have found no ' evidence that, in either case, the Comission's safety limits on core damage and radiation dose to the public will not be violated. Were is no justification for permitting this risk to the public at MI-1 when it would not be tolerated at any other plant.

, -_# . , -- * . - - - - - - , - , - . - ,.----4 . - - n .,