ML20129C521
| ML20129C521 | |
| Person / Time | |
|---|---|
| Site: | Crane  |
| Issue date: | 05/17/1985 |
| From: | Harold Denton Office of Nuclear Reactor Regulation |
| To: | Pollard R, Weiss E UNION OF CONCERNED SCIENTISTS |
| Shared Package | |
| ML20129C528 | List: |
| References | |
| CON-#285-127 OLA, NUDOCS 8506050556 | |
| Download: ML20129C521 (29) | |
Text
- _ _ _ _ _ _ _ _ _ - _ - _ _ _
.e s
)
GAY 1715 Robert D. Pollard Ellyn R. Weiss Union of Concerned Scientists 1346 Connecticut Avenue, N.W.,
Suite 1101 Washington, DC 20036
Dear Mr. Pollard and Ms. Weiss:
I have.been asked to respond to your letter dated April 5, 1985 to the Comissioners dealing with operation of Three Mile Island, Unit 1 (TMI-1) with the repaired steam generators.
In your letter, you allege that such' operation "could pose serious risks that have not been evaluated or brought to the Commission's attention." You further state that "[t]hese risks are unique to TMI-1 and arise from the inability of the steam generators in their degraded condition to withstand the forces that may occur following a steam generator tube rupture accident." You also question the emergency procedures for recovering from a steam generator tube rupture, and the suitability of the analysis for that accident. Attached to your letter is a document entitled " Safety Hazards of Degraded Steam Generators at TMI-1" in which you discuss in further detail' your specific concerns.
Our response to your statements is contained in the enclosed " Response i
to Steam Generator Concerns in UCS letter dated April 5,1985."
In summary, I
we conclude that the risks involved in operation of TMI-1 are not unique and
[
indeed are similar to those of other B&W plants. We previously found, as l
supported by various findings of the hearing Board in the steam generator repair proceeding, that the steam generators, after kinetic expansion repair and plugging of defective tubes, have been restored to their original licensing basis.
Plant operation with the repaired steam generators has been evaluated and a full and complete public record of such evaluation was developed in the steam generator proceedings. We previously found the steam generator tube rupture (SGTR) procedures to be adequate to protect public health and safety and to represent an improvement over earlier procedures.
We also conclude that they are not confusing or unusually complex, and that they do not rely on improvisation.
Our previous conclusions regarding adequacy of the safety classification of the PORV remain unchanged, and we conclude that the previous classification of other components discussed by UCS is adequate. Likewise, the 25 F subcooling margin previously accepted by the staff and the ASLAB in the Restart proceeding, continues to be acceptable. With regard to violation of reactor coolant pump net positive suction head (NPSH) limits, operation with the
. proposed limits continues to be acceptable as we previously found during discovery in the steam generator repair proceeding. Also during that discovery period, we documented our position on the acceptabi.lity of operation outside of the nomal fuel-pin-in-compression limits.
h506050556850517 ADOCK 05000289 p
~' -
. In the discussion on operator training deficiencies, we explain the basis for our belief that operator training is adequate in general and for the steam generator tube rupture event in particular, and that the operators can utilize the present procedures in dealing with that accident.
Regarding the safety evaluation of an SGTR accident at TMI-1, there is no NRC requirement to reevaluate this event at licensed operating plants.
Nevertheless, the staff performed an independent conservative analysis generally following current regulatory practice for plants in the licensing process, and concluded that no unacceptable fuel damage would occur and that offsite doses from an SGTR would not exceed the staff guidelines, and therefore operation of TMI-1 represents no unique risk to the public.
As discussed in the enclosure and summarized above, we see no reason to modify our previous determination that there is reasonable as'surance that operation of TMI-1 with the repaired steam generators would not pose undue risk to the public health and safety.
Sincerely, Oddnd Signed by L H. R. Oenton Harold R. Denton, Director Office of Nuclear Reactor Regulation
Enclosure:
As Stated i
D*
& RR N
4N A
A R:I D:DHFS M
/fi
?*4 DCr field RStarostecki WRussell dO
( o[86
/85 5/9 /85 5/9/85 (y
W/Ay If4:DL 0
L A-
- DL D:D D
gh HSilver;cf JS lz GL6 nas HThompson JKnight REernero Qf V;f'}'
5/g/85 5/ /85 5/g/85 5/y/85 5/t? /85 5
5 5/,g/85 ED0 p
WJDircks 5/g/85 1
)
1 i
o b
Of a
DISTRIBUTION FOR GREEN TICKET # 000538 I
' Docket File.or-Central File w/ orig. incoming ltr.
NRC PDR w/inc.
L PDR w/inc.
EDO #000538 ED0 Rdg WDircks DEisenhut/HDenton HSilver -
(
RIngram
[
MJambor l
HThompson l
OELD l
DNottingham
}
SECY
[
KBowman #000538 f
TSpeis RMattson RVollmer WRussell JTaylor BSnyder l
TMurley GCunningham VStel.lo JRoe RBernero RStarostecki JKnight Green Ticket File w/inc. & Ticket 416 Old Phillips
1 RESPONSE TO STEAM GENERATOR CONCERNS IN UCS LETTER DATED APRIL 5, 1985 s
The concerns expressed by the Union of Concerned Scientists (UCS) in its letter:of April 5,1985 and the enclosure thereto regarding operation of TMI-1 with the repaired steam generators can be grouped into eight issues as noted herein. 'The issues and the staff's response generally follow the sequence of UCS' points, but because UCS in some cases repeated its concerns or provided additional comment on the same concerns at different places in its documents, it may. vary from that sequence.
ISSUE-1:. The steam generators are " degraded" The apparent foundation for the concerns of UCS is that the TMI-1 steam generators are " degraded" and that "the degraded steam generator tubes could
'be pulled apart under the stress of a rapid cooldown," that "the condition of the TMI-1 tubes makes it more likely that ruptures or leaks could occur in
.both steam generators simultaneously," and "the use of the emergency feedwater system, which sprays cold water directly on the steam generator tubes, to cool the plant may cause additional leaks in the degraded tubes."
UCS' connents on the state of the steam generator tubes fail to recognize
-that the steam generators have been repaired, and are directly refuted by the staff's Safety Evaluation Report related to steam generator tube repair and return to operation of TMI-1 (NUREG-1019 and NUREG-1019, Supplement 1),
discovery documentation for the steam generator hearing process, summary disposition motions and the Hearing Board's order on summary disposition,
4 i
' prefiled hearing testimony, the hearing record, and the Hearing Board's initial decision, and responses to TMIA's motion to reopen the hearing record. The conclusion of these documents, supported by findings of the Licensing Board, is that the TMI-1 steam generators have been returned to their original licensing basis, which is the same as for other B&W once-through steam generators (OTSG). Based on its evaluation, the staff concluded in NUREG-1019 "that GDC 1, 14, 15 and 31 have been met and that the staff has reasonable assurance that the public health and safety will be protected." The staff was supported by approximately 15 consultants representing Franklin Research Center, Brookhaven National Laboratory, Pacific Northeast National Laboratory, Ohio State University and Oak Ridge National Laboratory. These consultants provided Technical Evaluation Reports which support the staff conclusions and are incorporated as attachments to NUREG-1019 and NUREG-1019, Supplement No. 1.
Because the TMI-1 steam generators have been returned to their original licensing basis and the applicable GDC have been met, the staff has reasonable assurance that the TMI-1 steam generators are capable of withstanding all normal operating and design basis accident conditions, including axial stresses resulting from rapid cooldown.
OTSGs are different from V-tube steam generators in that during cooldown the OTSG tubes are put'in tension. The amount of tube tension is proportional to the rate of cooldown because the tubes cool and tend to shrink much faster than the thick steam generator shell which fixes the tubesheets at each end
c
~
^
.,c I
t
-3 ofTthe tubes'.
If degradation ~ below the allowable technical speciffcation
~
limit exists in an OSTG tube, stresses induced during a cooldown transient or design basis accident will not cause propagation of the degradation that will result in' tube failure. If a circumferential throughwall crack exists in an OTSG tube,' a rapid cooldown will increase tube tension and if the crack is big-
- enough, cause it to open wider and increase primary-to-secondary leakage.
.This condition has been observed at plants with OTSG's during primary-to-secondary
.leakageehents. The effects of cooldown tensions on tubes will be similar
- whether a defect is on the primary side or the secondary side of a tube. The
- TMI-1 OTSGs are not unique among OTSGs in their primary-to-secondary leakage response as a result of tension in the tubes during cooldown. Although prudence played a part in-the selection of the 70 F shell-to-tube temperature
- difference (delta T), this prudence would apply to any steam generator and is not the result of concern over unique degradation at TMI-1.
Indeed, the successful hot test in 1983,' during which a delta T of over 100"F was imposed on the steam generators without evidence of crack propagation, demonstrated that a 70*F delta T is not required to maintain steam generator integrity, as UCS contends.
Specific testimony was presented in the steam generator hearing, and accepted by the hearing board in its initial decision, that single or multiple tube ruptures'are no more likely after the repair than they were prior to the original corrosion problem. Likewise, uncontradicted testimony was offered by the licensee that the use of emergency feedwater (EFW) has insignificant l
effect on local stresses in the tubes due to direct impingement of the EFW on the tubes.
P7:
._n
.j.
With regard to the recently identified grain dropout from previously existing patches of intergranular attack (IGA), tubes with defects exceeding the plugging limit defined.in the Technical Specifications have been-removed from service by plugging. Any tube degradation smaller than the plugging limit is not expected to propagate to rupture or to result in a leak because the defects themselves are not substantially influenced by axial tube stress caused by a cooldown.
To~ summarize the above, the TM1-1 steam generators have been returned to their original licensing basis and meet applicable ~ regulations, rapid cooldown of'the TMI-1 reactor would not pull the steam generator tubes apart,.and additional tube leaks or ruptures are not more likely because of "the condition of the TMI-1 tubes."
ISSUE 2: The present steam generator tube rupture emergency procedures are not adequate UCS notes that one of the principal aims of procedures to recover from a steam generator tube rupture (SGTR) is to rapidly reduce reactor pressure below the lowest pressure at which the steam generator safety valves are set to open, in order to minimize the risk that a safety valve will stick open, which would create a path for an uncontrolled release of radioactivity until the reactor coolant system (RCS) is cooled below the boiling point. UCS states that at a " normal plant", this is accomplished by isolating the broken steam generator and rapidly cooling down the RCS using the intact steam generator. However, UCS notes, such procedures cannot be used at TMI-1 because of the " degraded" condition of the steam generators.
r
t - As we have discussed above, the steam generators have been returned to their original licensing basis, applicable GDC's have been met, and the steam generators are capable of withstanding accident loads.
Staff interest in the SGTR emergency procedures at TMI-1.was primarily based on the lessons learned from the 1982 Ginna tube rupture event (NUREG-0909 and NUREG-0916). Based on some procedural modifications which were considered at Ginna, the staff inquired if the TMI-1 licensee was planning to review its SGTR procedures. GPUN indicated that they were already considering some improveme'nt in'the SGTR procedures and would provide updated procedures if the staff desired. Because the staff considered a review of SGTR procedures prudent, based on the Ginna lessons learned, GPUN agreed to provide its updated procedures. At the time, in early 1982, when the procedures for SGTR were discussed between GPUN and the staff, GPUN had not yet determined whether the steam generators would be repaired or replaced. Therefore, the suggestion that the modified SGTR procedures are based on protecting repaired steam generators is unfounded.
The new SGTR procedures are based on minimizing the risk of large offsite radiation exposures as well as the rate of primary-to-secondary leakage. As noted in NUREG-1019, the reasons for selecting the new procedures include rapid depressurizing without large temperature differences, minimizing RCS leakage, allowing normal cooldown procedures, providing symmetric plant response, and minimizing the complications of cooling the idle steam generator, all of which provide greater assurance against human error or equipment malfunction that could result in large uncontrolled release of radioactivity, and which therefore should result in a more orderly and expeditious cooldown 1
t t -
and lower integrated radiation doses.
As we stated in NUREG-1019, the staff considers the current SGTR p'rocedures at TMI-1 an improvement over the previous procedures. However, the earlier procedures could still have been considered adequate and may have been accepted by the staff had the licensee continued to utilize them, contrary to UCS assertion.
UCS. states that at a " normal plant," the risk of a large release following an SGTR is reduced by emergency procedures that require isolation of the broken steam generator. This statement is not correct. While it is true that most B&W plants may still use procedures which call for isolation of the broken steam generator, B&W Owners Group opinion appears to support procedures similar to those at'TMI-1. The staff-approved ATOG guidelines for Oconee include steaming both steam generators down to approximately 540 F (to avoid lifting steam safety valves) before isolating the broken steam generator, and call for un-isolating the broken steam generator as needed to control pressure and inventory. The staff recently received, but has not yet reviewed, revised ATOG SGTR guidelines for the remaining B&W plants. These guidelines also call for steaming both steam generators down to 540*F, but then offer the option either to isolate the broken steam generator (with subsequent un-isolation as needed) or to continue steaming both steam generators as at TMI-1. GPU has stated that the TMI-1 procedures conform with these revised guidelines.
In sumary, the UCS statements that the TMI-1 steam generators are uniquely degraded and that the modified SGTR procedures are being implemented to prevent catastrophic rupture as a result of that degradation are contrary to
s.
1 7
the record. -The TMI-1 steam generators, as repaired, are not unique compared with other OTSGs. The modified SGTR procedures which have been implemented at TMI-I and are being considered for use at other plants, are based on minimizing offsite exposure and are not related to concerns that the repaired steam generators are somehow degraded in performance capabilities for a design basis SGTR.
With regard to the alleged complexity and confusion in the SGTR procedures, these procedures were reviewed in detail by the staff as reported in AkthoughrecoveryfromanSGTRisadmittedlyacomplexactivity, NUREG-1019.
the actions required as identified by UCS are not markedly different from those required at times at any similar plant, nor are these procedures necessarily more complex than those which require early isolation of the steam generator.
As noted above, the reasons for selecting these procedures include more normal cooldown, symmetric plant response, and facilitation of plant control, which help simplify, rather than complicate, the accident response.
Incorporation of these procedures by GPUN was done only after evaluation at the B&W simulator
~
~
by GPUN Operations and Technical Functions personnel. To contradict the point of UCS that adding to the alleged complexity of the procedures, the operators must calculate the offsite radiation dose to decide whether a steam generator should be isolated, that dose rate is in fact determined by the Radiological Assessment Coordinator, not the operators.
The staff did not find the THI-I procedures confused or unusually complex, and has no reason to expect that competent, well-trained operators will have any unique difficulty in understanding and implementing these procedures. The staff's
. response to Issue 7 below presents additional information related to this Concern.
The UCS concern about improvisation during an accident is an apparent misunderstanding of the purpose of the additional guidance appended to the SGTR procedure at the request of the Commonwealth of Pennsylvania. This appendix, entitled " Emergency Support Directors Isolation Guide," does not affect the procedural operator actions unless the Emergency Director, having obtained concurrence through his approval process, instructs that changes be made.
The appended guidance is intended to provide the Emergency-Director (rather than the operators) information to aid him in assessing overall conditions that could result in his decision for earlier isolation of a steam generator than would be otherwise required by the procedures. Unless the Emergency Director instructs that changes be made, the operator would adhere to the instructions of the procedure only, not the appendix. The procedures
~
themselves do not rely on improvisation.
Issue 3:
Equipment which does not meet safety requirements cannot be relied upon to recover from an SGTR UCS states that "the PORV and its associated control circuits do not meet safety requirements and therefore cannot be relied upon in the safety evaluation of a design basis tube rupture accident."
The issue of the safety classification of the PORV arises for the SGTR accident event because the PORV or the high point vent located on the pressurizer may be used to depressurize the primary coolant systen whenever offsite power is lost. The licensee indicates that TMI-1 procedures call for the use of the safety
r
.r -
1 S:
4
_g.
grade pressurizer vent to reduce RCS pressure with the PORV available as a backup.
If offsite power were available, pressurizer spray operating off the reactor coolant pumps would be used to depressurize the primary system.
. In addit.on to the concern of UCS about the PORV safety classification, a similar issue exists relative to the atmospheric dump valves (ADV). This issue arises primarily in the situation of loss of offsite power in which event the ADVs would be used to vent the secondary system and to minimize the
~
likelihood of ' lifting the steam safety valves.
It is appropriate to review regulatory requirements on this matter. Specific stand-ards used by the staff for systems and components in order for them to be considered sufficiently reliable to be credited in safety analyses are partly identified in the Comission's regulations and partly identified on a case by case basis in applying the general requirment of GDC 1 that "[s]tructures, systems, and components important to safety shall be designed, fabricated, erected, and tested to quality standards commensurate with the importance of the safety functions to he performed."
The importance of the safety functions to be performed is gauged in part by the application of GDC-17 which requires that "...the core is cooled and containment integrity and other vital functions are maintained in the event of postulated accidents..." assuming a loss of offsite power.
For current plants undergoing licensing review, the staff has adopted the approach of identifying " safety-related" systems and components as those having the greatest importance to safety, and applying certain " safety grade"
l-
. standards to such systems and components.
" Safety-related" is a classification given to certain structures, systems and components if they are relied upon
.during accidents to assure one of the following (from Appendix A to 10CFR100):
"(1) The integrity of the reactor coolant pressure boundary, (2) The capability to shut down the reactor and maintain it in a safe shutdown condition, or (3) The capability to prevent or mitigate the consequences of accidents
.which could result in potential offsite exposures comparable to the guideline exposures of this part [Part 100)."
The same criteria are used in 10 CFR 50.49 to define safety related electrical equipment.
l The principal safety-grade standards that may apply in particular situations t
include:
For systems and components -
- Seismic Category I
- Qualification to accident environment in which it must operate
(
For systems -
l
- Meets standard IEEE 279 (electrical)
- Meets single failure criterion Although the PORV and the ADV do not meet safety-related standards in every respect, the staff has determined that the PORV, ADV and associated control circuits meet i
GDC-1 based on the following considerations:
.--__...---.---...--.--------,------n.
- + - - -
n
~
PORV The PORV and block valve are powered from emergency power buses.
The PORY valve body is designed to all ASME requirments governing the primary coolant boundary.
There is valve position indication available in the control room.
EPRI testing has demonstrated increased assurance of operability.
As previously noted, operation of the PORV for the SGTR is a backup rather than a primary function. Primary reliance would be first on main pressurizer spray und'er more probable circumstances (i.e., offsite power available),
and, second, on the pressurizer high point vent, which is safety-grade.
Only if both of these were not available or otherwise did not accomplish the depressurization function would the PORV be used.
Most concerns with PORVs stem from failure to close rather than failure to open.
For the SGTR, the necessary action would be to open on demand.
Atmospheric Dump Valve (ADV)
Valve body is seismically quaiffied.
Valve is designed to fail closed.
Block valve upstream of ADV can be closed from control room in event of stuck-open ADV.
There is automatic transfer of control of the ADV to manual loader station in the control room upon loss of normal power to the Integrated Control System (ICS).
There is remote transfer of control of the ADV to the remove shutdown panel.
The ADV air supply is also provided from the two-hour backup air supply.
Certain components on the valve actuator, while not seismically qualified,
- are considered by the licensee to have been the best availabl'e at the time.
Regarding the PORV classification background, in April of 1983, the staff notified hearing boards of a reliance on PORVs to mitigate SGTR events, along with the fact that most PORVs in older plants are not classified as safety related and not designed to current safety grade standards.
In the board notification, the staff stated that the need to upgrade PORVs on operating reactors would be handled according to accepted procedures for evaluating potential backfits. The issue of PORV and block valve reliability was designated as Generic Issue (GI) 70 and was prioritized with a " medium" priority rating. The staff is currently completing its action plan for evaluating this issue.
In this regard, it should be noted that this study will essentially reexamine the deterministic criteria the staff applies when deciding on the acceptability of PORV/ block valve designs and determine if it netJs to be modified.
In summary, we believe that the Tit!-1 plant meets GDC-1 with respect to the SGTR, and thus complies with this regulatien.
UCS further notes that "the reactor operator cannot call on any instruments meeting NRC's safety requirements to measure [the shell-to-tube] temperature difference."
i
{
r Although safety-grade instrumentat on is provided to measure many ' primary and i
secondary system parameters, safety-grade temperature indication to iraasure shell-to-tube temperature difference (delta T) is not required. With the maximum RCS cooldown rate of 100'F controlled, the shell-to-tube delta T is expected to stay below the licensee's 70'F limit. The 1983 steam generator hot test demonstrated difficulty in attaining shell-to-tube temperature differences as high as 100'F even using EFW.
In the steam generator hot test, for a 90'F/ hour cooldown rate the tube-to-shell delta T was 47'F using main feedwater, and approximately 100'F using EFW with lowered steam generator level. These relationships are repeatable and therefore control of the cooldown rate and steam generator level may be utilized for control of the tube-to-shell delta T without reliance on the steam generator shell thermocouples. Therefore, based on the ability of the tubes to withstand significantly higher delta T's than called for, the difficulty of inadvertently attaining higher delta T's and the availability of other means to control delta T, the equipment used to measure the delta T need not meet more stringent " safety requirements."
UCS further states that the requirement that subcooling margin be calculated and displayed by safety grade instrumentation would be violated in a design basis SGTR.
Thesubcoolingmarginmonitor(SMM)atTMI-1isfullysafetygradeandwould be available during a design basis SGTR. The SM alone is not relied upon whenever the reactor coolant pumps are inoperative because, as in other 88W plants,
~
-s=
there is a time delay in reflecting core conditions at the hot leg location
'where temperature inputs to the SM are measured during natural circulation cooling. Under these conditions, manual calculations utilizing the core exit thermocouples back up the SMM. Procedures require that the most conservative subcooling margin derived from either the SM or the manual calculation be used.
Issue 4:
Violation of Subcooling Margin Criteria T
'UCS states that the subcooling margin should be maintained greater than 50'F to reduce the potential for boiling in the RCS which could interrupt natural circulation.
The 50'F subcooling margin criterion was established to provide sufficient margin to cover instrument uncertainties and plant configuration effects generically for all B&W plants.
It assumes a 45'F instrument error and a 5' configuration factor. Licensees have the option to accept this figure or justify an alternate subcooling margin for each plant. The Oconee ATOG approved by the staff permits subcooling margins less than 50'F.
For THI-1 the ASLAB approved the licensee's proposed 25'F subcooling margin, assuming an instrument error of less than 20'F and a configuration factor of 5'F.
There was no objection from the other parties, including UCS. The staff has since verified that the subcooling margin monitor instrument error is less than 20'F, and that the error for manual subcooling margin calculations is about 20.5'F.
l.
With a worst case configuration factor of 1.4'F. the 25'F indicated subcooling margin assures several degrees of subcooling for the worst case uncertainties.
Therefore no interruption of natural circulation is expected. The staff's certification of this issue to the Commission is in preparation.
I t
k
4 The worst case conditions mentioned above occur at low reactor system pressure and environmental conditions of elevated containment temperature and pressure. For an SGTR, containment conditions would not be affected and the maximum instrument error would be less than 10*F, providing additional margin to saturation. At higher RCS pressures where most tube leakage would occur, the error would be still less.
UCS then questions the subcooling meter inoperability permitted by the Technical Specifications. The present Technical Specifications for TMI-1 permit co'ntinu'ed plant operation with only one of the two channels of the subcooling margin monitors operable; corrective actions are required only when both channels become inoperable. Since the subcooling margin meters perform no automatic safety function and since a backup method is available using core exit thermocouples and steam tables when the subcooling margin meters are inoperable, the staff found that plant operation is justified up to seven days, which is a limiting condition of operation (LCO) in the Technical Specifications. Surveillance requirements of Technical Specifications include a check each shift and a monthly test when the plant is hot, i.e.,
T average is greater than 525'F. The surveillance requirements are consistent with those required for safety-related equipment.
However, the operability requirements of the present Technical Specifications are not consistent with the Standard Technical Specifications which require that both channels be operable at all times, and that corrective action be taken within 7 days if any one of the two channels should become inoperable.
If both channels should become inoperable, corrective action would be l
i -
i required within 48 hours5.555556e-4 days <br />0.0133 hours <br />7.936508e-5 weeks <br />1.8264e-5 months <br />. These more restrictive requirements for the
- subcooling margin monitors, among other things, are currently being considered by the staff for generic backfit to four B&W plants, including TMI-1.
Based on the Staff's evaluation of the present Technical Specification discussed above, the staff concludes that pending the decision on this generic backfit, the present Technical Specification does not represent a public health or safety concern that would justify immediately effective enforceme'nt ac' tion.
With regard to UCS' allegation that the subcooling meters cannot be relied upon when the RCS temperature is below 300*F, the staff knows of no such temperature limit and has concluded that the instrument is adequate at this temperature. We note that at one time the hot leg RTD which is utilized by the subcooling monitor for temperature determination had a lower limit of f
300*F. The instrument has since been upgraded.
In any case, the instrument is backed up by the core exit thermocouples and reactor system pressure I
indication for manual subcooling evaluation.
\\
Issue 5:
Violation of Reactor Coolant Pump NPSH Limits UCS states that the proposed NPSH limits violate those applicable to similar plants, and that the lower limits were selected because of the reduced subcooling margin since continued operation of the pumps would not otherwise be permitted and there is doubt that protection against an SGTR is adequate '
C without operation of the pumps, i
1
.m-
r-E This matter has previously been addressed in the January 30, 1984 staff response to TMIA Interrogatory 92 in the steam generator repair hearing discovery process, as follows:
"The required pressure / temperature limits for RCP operation, i.e.,
the RCP NPSH limits, are affected by a steam generator tube rupture.
For this event, the emergency RCP NPSH limits are used. These limits allow operation of the RCPs with decreased subcooling margin in the primary system relative to the normal RCP NPSH limits. Use of the emergency RCP NPSH limits does not result in violation of any plant safety limits.
Thi emergency limits allow for operation of the RC pumps for a wider range of plant conditions while still providing NPSH protection for the RC pumps. As a result of the use of the emergency limits, continued RC pump operation is expected for the design basis double-ended rupture of a single steam generator tube. Continued operation of the RCPs for tube rupture events have obvious safety benefits such as the availability of normal pressurizer spray for RCS pressure control, decreased primary-to-secondary leakage for a given RCS subcooling margin, and symmetric plant cooldown."
!ssue 6:
Violation of Fuel-Pin-in-Compression Limits UCS asserts that the RCS pressure sho,sid be high enough to assure that the fuel pins are always in' compression above 425'F, which would prevent use of the lower subcooling margin. According to UCS, violating this limit would either cause swelling of the fuel pins or cracking of the fuel rods, increasing radioactive release to the environment.
The VCS concern addresses two different fuel failure mechanisms, cladding swelling and rupture, and fuel rod " cracking." The 425'F is associated only with the latter concern of fuel rod " cracking" or brittle fracture, i
I
F, i
As noted previously by the staff in the January 30, 1984 response to TMIA Interogatory No. 91 in the TMI-1 steam generator hearing discovery process, in the design basis SGTR, the fuel rods do not experience departure from nucleate boiling (DNB). Therefore, the cladding is not heated above its nominal operating temperature.
In fact, following reactor trip, which occurs early in the event for the derign basis case, the power is reduced to decay heat levels and, in the case of a SGTR, the coolant temperature is decreasing. Therefore, even though the fuel rod internal pressure may be greater than the reactor coolant system pressure, no swelling (ballooning) or rupture of the fuel rods is expected since a prerequisite for swelling is a significant increase in cladding temperatures which would reduce the yield stress sufficiently for swel'ing to occur.
As also discussed in TMIA Interrogatory 91, the " limit" of assuring fuel rods are in compression above 425'F assures the proper orientation of hydrides platelets in the Zircaloy crystal structures. The fuel rod cladding is manufactured so that hydrides will be oriented in a circumferential direction.
If the cladding were in tension rather than compression (fuel rod internal pressure exceeds RCS pressure), the hydrides might, if other conditions were unfavorable, be reoriented into a radial direction which makes the cladding more brittle. We do not consider the 425'F temperature to be a safety limit, as suggested by UCS, or a Specified Acceptable Fuel Design Limit (SAFDL)asspecifiedinGDC10andtheStandardReviewPlan. Limiting the fuel rod internal pressure to less than system pressure above 425'F is a very conservative approach to preclude hydride reorientation. However, because of the large degree of conservatism in this approach, the fuel rod
f.
O
_1g_
internal pressure can exceed the system pressure without causing ' hydride reorientation.
In the particular case of the design basis steam generator tube rupture, the resulting combination of cladding stresses and temperatures are not sufficient to cause hydride reorientation. Even if such reorientation were to occur, this does not imply immediate failure of the cladding.
It would be a concern for restart following the event rather than during the event itself.
J-It should be noted that at other reactors there have been numerous reactor coolant system depressurization events including several SGTRs, and fuel failure due to these events has not been observed. Therefore, an increase in coolant activity during the SGTR event due to fuel failure does not appear to be a realistic concern.
5 Issue 7: Operator Training Deficiencies
^
UCS alleges that operator training in SGTR accidents in particular, and in other unspecified areas, is deficient, and gives e'xamples.
It also asserts that because of the complexity of SGTR procedures, reactor operators may not have the ability to understand and follow them.
In response to an NRC concern regarding the true status of the knowledge and skills of the licensed operators at TMI-1, efforts were initiated to conduct oral interviews and plant walk-throughs for all available licensed operators. The effort was intentionally scheduled to coincide with the implementation by GPU of the recently-approved Abnormal Transient Operating Procedures (ATOP) for B&W facilities. Accordingly, steps were taken to
r s
20-monitor performance of each shift undergoing the ATOP training. This resulted in an NRC team interview of 26 of the 38 licensed individuals in February 1984. The review team was comprised of the former Senior Resident Inspector, a license examiner, a Senior Resident Inspector from another BAW plant, an instructor from the NRC Chattanooga Training Center, and the supervisor of the Region I operator licensing staff. The results of the interviews indicated that the licensed personnel were knowledgeable and well trained. Some deficiencies were identified and were related to a decline in operational skills as a result of the prolonged shutdown. Most of the deficiencies were associated with the training received by the reactor operators, with a small number of the deficiencies attributed to the training for the Senior Reactor Operators. These were recorded in an inspection report issued in April 1984.
Subsequently, The Office of Nuclear Reactor Regulation (NRR) also sent a team of people to observe the training and individual performance of some of these same operators on the B&W simulator in Lynchburg.
Training and performance were judged acceptable.
GPUN developed a specific training program for each of the deficiencies identified during the interviews. The results of the supplemental training were followed up by dedicated inspections during the next twelve months. By late August 1984, all of the deficiencies except two were satisfactorily resolved. The two outstanding items were not related to SGTR but involved the prediction of the approach to criticality and the electro-hydraulic control system used to con *.rol the main turbine.
In April 1985, a Region I examiner observed three candidates from TMl-1 on the B&W simulator at L
- s
- Lynchburg in handling six casualty scenarios, one of which was a steam generator tube rupture. No significant problems in handling the casualties were observed.
In mid-April 1985, the final two deficiencies identified during the April 1984 assessment were resolved.
Based on our interaction with the operators over the last several years and specifically the more recent observation of their performance on the simulator which included handling of the steam generator tube rupture event, we have reasonable assurance that the operators have the requisite knowledge, skill, and abilities to respond to potential off-nomal plant conditions including the steam generator tube rupture event..
With regard to UCS' statements about its questioning a small sample of operators regarding projected offsite dose rates at which the steam generator should be isolated and method of determination of tube leak rate, the staff
~
has no direct knowledge of the nature of the specific questions, the context in which the questions were posed, or the criteria used to judge the adequacy of the responses. We have, however, read the licensee's response to this issue addressed to the Commissioners dated April 18, 1985 and we have no information that contradicts the statements of GPUN.
However, we would note that because the action to isolate the steam generator based on dose rate is a follow-up action rather than an imediate action, the operators are not required to memorize these steps.
Indeed, the premise of written procedures is to minimize reliance on memory except where imediate action is necessary. The specific isolation criteria are identified
O in the procedure.
We responded above (in Issue 2) to the UCS comments regarding the complexity of the SGTR procedures.
In the context of training, we believe that the abilities, training, state of knowledge, and performance on the simulator, of the TMI-1 operators are such that they do understand and could readily implement these procedures in th*' event of an SGTR.
e Issue 8:
SGTR Safety Evaluation UCS statis "that a safety evaluation of a steam generator tube rupture accident at TMI-1 has not been performed in accordance with the Commission's safety requirements for design basis accidents," that " safety limits" on core damage and radiation dose may be violated, and that this unique risk should not be tolerated. Morespecifically,UCSnotes"[t]hefactthatNRC regulations require that adequate protection against steam generator tube rupture accidents be demonstrated assuming that no reactor coolant pumps are operating (because of the loss of offsite electrical power) appears to have l
o been ignored by both GPU and the NRC staff."
l f'
The licensee's analysis for a steam generator tube rupture (SGTR) accident was evaluated during the operating license review of TMI-1 and is documented in chapter 14 of the Final Safety Analysis Report. As was the case with many similar plants of that vintage, the analysis assumed the availability of offsite power with the reactor coolant pumps (RCP's) operating to facilitate the depressurization of the primary system to permit isolation of the faulted steam generator and to maintain the use of the
r t
condenser, through the turbine bypass, as a path for discharge from the plant.
The SGTR analysis and its results conformed to the staff guidance and practice at the time. Offsite doses were calculated by the licensee to be well within the staff dose guidelines.
There is no NRC requirement to generically reevaluate PWR operating plants for SGTR accidents in accordance with current guidance used by the staff for an operating license applicant, i.e., Section 15.6.3, NUREG-0800, Revision 2, NRC Standard Review Plan. No analyses have been submitted by the licensees of operating B&W plants regarding the radiological consequences of a SGTR accident assuming loss of offsite power pursuant to the staff's current practice in implementing GDC-17 requirements.
Nevertheless, the staff performed an independent analysis of the system response and radiological consequences of a SGTR accident generally following the assumptions and methods that would be employed by the staff for an operating license application in the current SRP (Section 15.6.3). Plant data believed to be applicable to the TMI-1 design were employed, as well as TMI-1 site-specific meteorological data. We note, however, since no licensee analysis has been submitted following the Standard Review Plan, staff estimates cannot be completely verified.
The analyses included analyses of an SGTR at TMI-1 using the TRAC code and at a generic B&W plant similar to TMI-1 using the RELAPS code. Loss of offsite power was assumed, requiring depressurization using the PORV. A minimum primary system subcooling margin of 25'F was maintained in the
y
~L e
-24 analysis, and steaming of both steam generators was assumed. Both generators were assumed to steam down to 540 F at which time, in accordance with TMI-1 procedures, the damaged steam generator was isolated.
For the SRP-postulated SGTR, no core uncovery and no departure from nucleate boiling would occur. As a result, no fuel damage is predicted for this event.
Two cases were conservatively analyzed.
For the first case, the coolant was presumed to be contaminated as a result of an iodine spike prior to the accident. The dose acceptance criteria for this case is that the Exclusion Area Boundary (EAB) and Low Population Zone (LPZ) doses should be within the staff dose guideline values (300 rem thyroid and 25 rem whole body). The results of our analysis for TMI-1 were about 200 rem to the thyroid and 0.5 rem to the whole body.
For the second case, the coolant was assumed to be at its maximum activity value permitted by the Technical Specifications (to be
~
issued) prior to the accident, and that the accident produces an additional increase (iodine'" spiking') in coolant concentration. The dose acceptance criteria for this case is that the doses should be small fractions (no more than 10 percenti of the staff dose guideline values. The doses for this case were estimated to be about 20 rem thyroid and 0.3 rem whole body.
We conclude that the offsite doses are within the acceptance criteria.
Furthermore, the magnitude of these doses is higher than would realistically be expected because of the many conservative assumptions in the staff's methodology, particularly with respect to iodine spiking behavior and meteorology. That is, coolant iodine concentration levels generally are
7
'i t~
small fractions of equilibrium technical specification levels, iodine spiking does not always occur coincident with transients, the iodine spiking concentrations assumed to occur are well in excess of any level recorded at an operating reactor, and the probability of better meteorological conditions is l
quite high. Other assumptions such as the steam mass released, the duration of steaming, and iodine attenuation are considered more realistic. A more realistic analysis would yield dose estimates about 1/100 or less of the values noted above.
-With regard to SGTRs generally, the Commission has recently approved issuance of Generic Letter 85-02 dated April 17, 1985 to all PWRs, to obtain information on its overall program for steam generator tube integrity and SGTR mitigation. The generic letter sumarized the results of the analysis of the lessons learned from four domestic SGTR events and the initial recommendations from the Unresolved Safety Issues A-3, A-4 and A-5 regarding steam generator
~
tube integrity. These analyses indicate that while SGTR's are an important contributor to the probability of significant non-core melt releases, and that steam generator tube degradation is a major contributor to occupational radiation exposure of PWR's, events involving SGTR's are not a major contributor to total core melt probability.
Furthennore, the A-3, A-4 and A-5 dose and probability assessments (see Table 9, NUREG-0844) indicate that realistic evaluations of SGTR events of the type postulated in the staff's TMI-1 analysis pose low public risk.
The staff also has under review the Steam Generator Tube Rupture Chapter b
r------------
L.
4 III-E of the B&W Owners Group Emergency Operating Procedures Technical Bases Document (Doc. No. 74 - 1149184-03, March 1985). These guidelines are for 1
all operating B&W plants and cover actions designed to keep overall integrated offsite dose limits for all tube leak rates at low levels. GPU has stated that its procedures are consistent with this document.
Based on our previous evaluation of the licenses's analysis and of procedures to handle an SGTR, on our determination (see Issue 3 above) that for an SGTR the PORV meets GDC-1, on our analyses as discussed above, on Generic Letter 85-02, and on Section 1.10, Basis for Continued Plant Operation and Licensing, of NUREG-0844 enclosed with that Generic Letter, we conclude that:
- 1) there is reasonable assurance that an analysis of an SGTR event at TMI-1 performed in accordance with the Commission's current criteria and requirements would not result in unacceptable fuel damage, and 2) the offsite doses resulting from an SGTR would not exceed the dose acceptance criteria of the SRP, and t
that operation of TMI-1 represents no unique risk to the public with regard to an SGTR.
i
s 5
' f R%q'g, UNITED STATES r
'g NUCLEAR REGULATORY COMMISSION si E
WASHINGTON, D. C. 20555
'8 s,*****/
q EDO PRINCIPAL CORRESPONDENCE CONTROL
<j A
FROM:
DUE: 04%26785 EDO CONTROL: 000538.
DOC DT: 04/05/85 0
ROBERT D. POLLARD A
FINAL REPLY:
j}
ELLYN R. WEISS, UNION OF CONCERNED SCIENTISTS 1
TO:
COMMISSIONERS f
FOR SIONATURE OF:
OREEN SECY NO: 85-303 DENTON 9
DESC:
ROUTINO:
REQUEST DEFER OPERATIONS OF TMI-1 UNTIL SUCH TAYLOR 2
-OPERATION WILL NOT POSE UNDUE RISKS TO HEALTH 8.
MURLEY SAFETY OF THE PUBLIC OCUNNINGHAM qe DATE: 04/12/85 ASSIGNED TO: NRR CONTACT: DENTON
{
SPECIAL INSTRUCTIONS OR REMARKS:
j Received NRR: 4/12/85
- E o
Contact:
Thompson - J W ia b/b b
cc: Eisenhut/Denton PPAS estE 5
9o0
- p,qu
?.
.905
.ii ScotC I
jl O
BEO
/
BOU
?
- l ss>* \\/k fl e$90'.
!p
]!
_j r
$998 "*
,/
3
,,o MN#"
!l O ** ""*" ece oe of g
veg?g r'
j u
s a
Robert Pollard Ellyn Weiss CORRESPONDENCE CONTROL TICKET SECY nth 8ER.85-303 LOGGING OATE: 4/10/85 s
0FFICE OF_THE SECRETARY ACTION OFFICE:
ED0 AUTHOR:
Robert Pollard /Ellyn Weiss AFFILIATION:
Union of Concerned Scientists LETTER DATE:
Rec'd 4/8/85 FILE CODE:
ADDRESSEE:
Palladino
SUBJECT:
Urges the Comm to defer operation of TMI-l until health and safety of public has been demonstrated ACTION:
Appropriate DISTRIBUTION:
Chm,Cmrs,PE,GC,0I,01A,SECY f,:[ ' f S / >;," fs,(,
7' ~: ~
'S.k.,......,
SPECIAL HANDLING:
(Docket distribution)
SIGNATURE DATE:
FOR THE COP 91ISSION:
Billie r
=sk
- .. f y. _,9 g.
q-[. ;.
y } J:7 '.. _ ; ;:.g-}
v.
- .r
- .,
t:
-UNION OF CONCERNED m.
SCIENTISTS m. C... tie.u.e
- e. s.w.. S. noi. we.higit. oc 2.o3.. (2 23 2, 5.oo
- 85 APR -8 All :01
.r.re = :rfv
!a3(ill 5)hlf78'$Z t,,r:A ?.
Nunzio J. Palladino, Chairman Romas M. Roberts, Commissioner James K. Asselstine, Comissioner Frederick M. Bernthal, Comissioner
. Iando W. Zech, Comissioner U. ~S. Nuclear Regulatory Commission
- . Washington, D. C. 20555 Gentlemen:
he Union of Concerned Scientists' believes that operation of Three Mile
- Island Unit 1- (1MI-1). with its degraded steam generators could pose serious
_ ris_ks that have not _been evaluated or. brought to the Commission's attention.
1hese risks are unique to TMI-l and arise ' from the inability of the steam generators in their degraded condition to withstand the forces that may occur following a steam generator tube rupture accident.
We previously discussed this subject in our August 24, 1984 filing with the Conmission.
[ Union of Concerned Scientists' Cbjection to Waiver of Sub-cooling Criteria and Comments on NRC Staff's Safety Evaluation of Subcooling Criteria for Actuating or Throttling High Pressure Safety Injection (SECY 237), August 24, 1984, pp. 10 - 13]
GPU Maclear's currently pending request p
to relax the criteria applicable to plugging of degraded steam generator tubes and the scheduled April 19th Commission briefing on the TNI-l steam generators prompt UCS to provide a more detailed explanation of our safety concerns.
Having decided to seek permission to operate TMI-1 without replacing the steam generators, GPU Nuclear is attempting to prevent catastrophic rupture of i
the steam generators by adoptirg emergency procedures that violate a number of safety limits applicable to every other similar plant.
The TMI-1 emergency procedures for accidents involving leakage or rupture of one or more tubes in l
either or both steam generators are untried, remarkably complex and confusing, rely fundamentally on improvisation, and would result in unavoidable radiation exposure to the public.
Moreover, there has been no demonstration that, even if these procedures are correctly interpreted and followd, the fuel damage limits specified in the ECCS criteria and the radiation exposure limits for the public muld be met for a design basis steam generator tube rupture l
accident.
Attached is a more detailed explanation of the unique risks arising from the degraded steam generators at TMI-1.
There are numerous specific safety questions that remain unanswered.
These specific questions are related to one 9O
\\
Mai. Office: 26 Church Street. Cambridge. Menachusetts o2238. (617) 547 5552
- w. ' '
=
principal concern: Is there reasonable assurance that the health and safety of
- the public will be protected in the event of a design basis steam generator tube rupture accident?
In the face of these questions, we urge the Connissioners to defer oper-ation of 'IMI-1 unless and until it has been demonstrated that such operation will not pose undue risks to the health and safety of the public.
Sincerely, Robert D. Pollard Nuclear Sefety Engineer
..m....--
f _ y,
..y
- 7,
- r =.
/~
- [b)%
Q,f.h
. EllynA. Weiss
-3 General Counsel
-:+=-
- +. :-- s ::s ::: 41::: -
1 := t - = - -
Enclosure:
g.---
-- -. ; 3,-
-fn-,
Safety Hazards of Degraded Steam Generators at 'IMI-1 ~
~
cc w/ enc 1:
'INI Service List e
M
SAFETY HAZARDS OF DEGRADED STEAM GENERAERS AT WI-I I. St.munary of Safety Hazards During normal power operation of MI-1, the pressure in the reactor coolant system (inside the steam generator tubes) is about 1000 psi higher than the pressure in the steam generators (outside the tubes).
In the event of steam generator tube leakage or rupture, water will flow from the higher pressure reactor coolant system into the secondary side of the steam generator, causing the steam generator water level and pressure to rise. -
r_;. _ Sere are nine safety valves. associated: with each steant. generator -that protect the steam generators against high pressure.
nese-safety valves are preset -to open automatically at various pressures between approximately--1000 and -1100 psig and to reclose when pressure decreases.
Se steam generator safety valves are designed to relieve steam but not liquid, cannot be control-led by the reactor operator, and discharge directly to the outside atmosphere.
If liquid is discharged through a safety valve, there is a strong possibility that the valve will stick open.
If a safety valve sticks open for whatever reason, nothire can be done to terminate flow through it until the entire plant is cooled below about 212 F.
As long as a steam generator safety valve is open on the broken steam generator, radioactive material from the reactor coolant system will be discharged directly into the outside envirorsnent.
At a normal plant, the risk of a large radioactive release following a steam generator tube rupture is reduced by emergency procedures that require j
isolation of the broken steam generator and rapid cooldown of the reactor coolant systen using the intact steam generator.
he aim is to rapidly reduce reactor pressure below the lowest pressure at which the steam generator safety valves are set to open.
Once this is accomplished the danger of an uncontrolled radioactive release through a steam generator safety valve is removed.
l '..., s '.
~
'Ihe crucial point here is that such procedures cannot be used at MI-l because: 1) the degraded steam generator tubes could be pulled apart under the stress of a rapid cooldown; 2) the condition of the MI-l tubes makes it more likely that ruptures or leaks could occur in both steam generators simultane-ously; and 3) the use of the emergency feedwater system, which sprays cold water directly on the steam generator tubes, to cool the plant may cause addi-tional leaks in the degraded tubes.
Because rapid cooling of the MI-l reactor could cause additional tube leaks or ruptures, GPU proposes to attempt to hold down ' steam generator pres-sure (and thereby prevent-opening of-the steam ~ generator safety valves) by continuing to release-steam from the : secondary side of the broken steam gener-ator(s) and by reducing the pressure in the reactor coolant system.
Iowering the pressure in the reactor reduces the amount of water flowing through the broken or ruptured' t'ubes _into ' ** **= ganarator. ~ ~ ~However," Towering the pressure also reduces the. saturation' margin and-thus-increases the potential for-boiling in the reactor - coolant -system. r4his' could--result ine loss -of natural circulation cooling of-the-core because the steam would collect in high points of the reactor coolant system piping.
II. Specific Safety Hazards In order to implement the emergency procedures proposed by GPU for steam generator tube leakage / rupture accidents, ntanerous safety limits and precau-tions applicable to every other similar nuclear power plant would have to be violated.
In addition, the degraded condition of the SI-1 steam generators has already resulted in a significant reduction in some of the safety margins that exist at all other similar plants.
Some of the factors unique to MI-1 because of the degraded condition of its steam generators and the safety limits violated at MI-l are discussed below.
- 1. Limiting Steam Generator Tube Stresses. The steam generator tubes are Y
subjected to a tensile stress when the tube temperature is less than v.he temperature of the steam generator outer shell.
As the reactor coolant sys[.em temperature decreases during cooldown, tube temperatur$t decreases.
At sjxne 4
=1 wwe
-.,e,e=.--e.ne r
-,c-.-
e.--.--m---
.---..,---,------,--,r,,
,-.,-m,,--,,m,,-
+------------e-
-*,-w,---.-----,----es
4 point the temperature difference be. tween the warmer shell and the colder tubes creates a force that is sufficient to pull apart a leaking tube.
Se allowable shell-to-tube temperature difference for other B&W plants is 100 F for a normal cooldown and 150 F in an emergency.
(2e 100 F limit is based on the assumption that any cracks in the tubes are less than 40%
through the tube wall.)
& wever, the limit on the shell-to-tube temperature 4
difference for 1MI-1 is 70 F,~ less 1.vn half that allowed in a plant without corroded steam generator tubes.
his 1/duced limit slows the cooldown of the reactor and is necessary to prevent prcpagation of cracks in tubes that are 1eaking at a rate less than is detectable.
c i
-' te shell-to-tube temperature difference can be controlled by reducing the'cooldown rate of the reactor coolant system (and' thus the cooldown of the tbtisis)~ and by cooling the steam generator shell. - te shell-can be cooled by l
releasing steam from the steam generator and by supplying feedwater to the steam generators using the main 'feedwater system which delivers water into the downcomer section of the steam generator.
In contrast, isolation of a leaking l
steam generator can increase the shell-to-tube temperature difference.
%e shell-to-tube temperature difference would also be increased by use of the emergency feedwater system because it sprays water directly onto the tubes and is not as effective as main feedwater in cooling the steam generator shell.
l Controlling the shell-to-tube temperature difference is complicated by t
the fact that the reactor operator cannot call on any instruments meeting
+
NRC's safety requirements to measure this temperature difference. Se tempera-l ture difference can be obtained by calculating a weighted average of the read-ings from five thermocouples to determine the temperature of the steam genera-tor shell, and by using the reactor coolant system cold leg temperatures to determine tube temperature.
%is process would be further complicated if the plant computer were inoperative, if some shell thermocouples had failed, or if one or more reactor coclant pumps were not running.
Additional hazards will be presented if offsite electrical power is lost, an assumption required by General Design criterion 17 when evaluating the adequacy of protection. against a design basis accident.
)
[
will be unavailable and steam release must be through the atmospheric dmp I
valves dich discharge directly into the outside atmosphere.
Also, with the reactor coolant pumps inoperative because of the lack of offsite electrical l
power, the reactor 'cannot be depressurized using the pressurizer spray.
l i
Instead, the pilot-operated relief valve (PORV) on the pressurizer would have to be used.
However, the PGW and its associated control circuits do not meet I
safety requirements and therefore cannot be relied upon in the safety evalua-tion of a design basis tube rupture accident.
Finally, after a loss of offsite power, the main feedwater system would probably be unavailable, f
requiring the use. of the emergency feedwater (EEW) system.
Use of the EFW system poses the risk of increasing the shell-to-tube temperature difference and causing additional tube leaks.or ruptures.....
.....=,s
~
- . - c.
- 2. Violation of Subcooling Margin Criteria.
Subcooling margin is the difference between thertemperature_at_eictL boiling will occur in-the reactog coolant system (RCS),;4ich.is determined.by..the RCS pressure,. and. the. highest, j
temperature in the.RCS.
One of the lessons:-learned from the 'DtI-2 accident was that the subcooling margin should be maintained greater than 50 F, that is, the highest temperature in the RCS should be at least 50 degrees below the temperature at which boiling will occur.
' Die purpose of this requirement is to reduce the potential for steam formation in the reactor coolant system which could interfere with core cooling.
A related " lessons learned" require-i ment was that safety grade instrtmentation should be capable of calculating and displaying the subcooling margin.
Both of these requirements would be violated at 'DtI-1 during a design basis steam generator tube rupture accident.
As discussed above, the degraded condition of the steam generator tubes precludes a rapid cooldown of the reactor coolant system.
'Iher.efo re, in an 4
attempt to reduce the flow of reactor coolant into the broken steam generator (and thus reduce the amount of radioactivity released to the envirornent), GPU proposes to reduce the pressure in the reactor coolant system. However, reduc-ing RCS pressure also reduces the subcooling margin, thereby increasing the risk of boiling in the reactor coolant system which could interfere with cooling of the reactor core.
-,--,,+.-r--n-.
...--me.,--,.,,,nn,-.-,---,,.,,mm,,,--,--,--,,,en,ea--m,v.,,,
_,ww,-
,--,,,c.,,,,----
,---.-,e--e-
5 Rather than maintaining the required 50-degree margin, GPU proposes to reduce the subcooling margin to 25 F, as indicated on the subcooling meters.
Although we have not received GPU's final error analysis, it appears that the accuracy of the subcooling meters is approximately + 20 to 25 F.
%us, if the indicated subcooling margin is 25 F, the actual subcooling margin may be anywhere between zero (meaning boiling is occurring in the reactor) and 50-degrees (meaning the rate of leakage of reactor coolant into the envirorsnent is greater than desired).
Additional safety hazards are posed because the proposed technical specifications would permit unrestricted operation of 1MI-1 with one of the tw hling meters inoperative and permit continued operation for another week following the failure of the second subcooling meter.
Finally, because of-the design of the subcooling meters, they cannot be relied upon by the reactor operator when the reactor coolant temperature is below 300 F or when the reactor coolant pumps are not running, which they would not be under the required design basis accident asseption of loss of offsite electrical power.
In summary, because of the degraded conditilon of its steam generators, 1MI-l is the only plant which will violate the 50-degree subcooling margin safety requirement.
Violation of this safety limit can result in boiling in the reactor which could interrupt natural circulation cooling of the core, and may not achieve the intended goal of reducing radiation exposure to the public because of the inaccuracy and/or unavailability of the instrments used to measure the subcooling margin.
- 3. Violation of Reactor Coolant Pung Operating Limits.
Limits on reactor l
coolant pep operation, referred to as net positive suction head limits, speci-fy the minimum RCS pressure required for operation of the peps.
%e minimm l
RCS pressure required is determined by the tenperature in the RCS.
%e pur-pose of these limits is to prevent vibration and damage to the main reactor coolant peps and the seals on the pep shafts.
%e proposed limits at IMI-l violate the limits applicable to every other similar plant.
Rese limits are violated at IMI-1 because, with the reduced subcooling margin discussed above, i
l continued operation of the reactor coolant peps would not normally be permit-l r
. _ _. ~ ~ -..
.- -. m.
r o.
. ted.
However, since there is substantial doubt that protection against a steam generator tube rupture accident in 'IMI-1 is adequate without operation of the reactor coolant peps, GPU proposes to relax the normal limits applicable to pump operation.
In addition, continued operation of the reactor coolant pumps can reduce the primary to secondary leak rate through the leaking tubes by allowing a further reduction in RCS pressure while still maintaining the indicated 25 F subcooling margin (because the core delta-T is smaller with the pumps running).
2e fact that NRC regulations ' require that adequate protection against steam generator tuh-rupture accidents be demonstrated assaing that no reactor coolant peps are operating (because of the loss of offsite electrical power)-appears-to have been ignored by both GPU and the NRC staff.
c
~
---2' ni a -., :-d=
1
-.c-u- +c :::
4.' Violat' ion oF~puel-pin-irikom6ression"5afdty dim'its.
The reactor U
~
~
~
~
5dolant system press 0N ' shou 1dEsufficient1[Iligh toTasure that the fuel
~~
pins are always in compression above 425-f.
%e ' fuel-pin-in-compression l'imits require a high subcooling margin for RCS pressures ranging from 1350 psi to 550 psi.
%us, these limits muld prevent the proposed reduction in subcooling margin discussed above.
One safety hazard posed by violating these limits is that the fuel pins could swell (called " ballooning") and reduce the flow of cooling water through the fuel.
Another possibility is that the fuel rods could crack, thereby releasing additional radioactive material into the reactor coolant flowing through the broken tubes and being discharged to the erivirornent through the atmospheric dump valves or the steam generator safety valves.
- 5. Operator Training Deficiencies.
The new emergency procedures propsed by GPU for steam generator tube leak / rupture accidents are a result of the degraded condition of the 'IMI-1 steam generators.
Although GPU claims that its operators have received additional training on these new procedures, UCS's questioning of 'IMI-1 reactor operators raised doubts that the training was adequate.
Indeed, because of the complexity of the emergency procedures and their reliance on improvisation at the time of an accident, it is unlikely
.-0,*
r that any amount of training will be adequate to assure protection of the health and safety of the public.
For example, the~ procedures specify that steam releases fran the broken steam generator (s) should be stopped when the measured or projected offsite dose rate to the public is 50 millirem / hour whole body or 250 millirem / hour thyroid dose.
During discovery for the reopened ASIR hearing on training, UCS qaestioned four 1MI-1 personnel who had passed the training program.
Although this was a small sample, it is nevertheless disturbing that only one operator knew the correct dose rates at which the steam generator (s) should be isolated. Another reactor operator believed that it is acceptable to continue steam release tmtil the offsite dose rates reach 1 rem / hour whole body or 5 renVhour thyroid dose.
21s indicates a deficiency in the training program far greater in scope than simply the adequacy of training for steam generator tube rupture accidents.
Another indication of inadequate training is that not one of the four individuals could adequately explain how they could determine whether the leakage through the tubes was greater or less than 50 gallens per minute.
%is determination is important because the emergency procedures specify different actions depending on whether the leak rate is above or below 50 gpn.
Se emergency procedures are exceedingly complex and may be beyond the ability of any reactor operators to reasonably understand and follow during a real accident (rather than practice drills on a simulator).
We reactor operator must manually control several parameters simultaneously, including the reactor coolant system cooldown rate, reactor coolant system pressure, pressurizer level, emergency or main feedwater flow rate to both steam generators, the water level and pressure in both steam steam generators, the reactor coolant system subcooling margin, and the shell-to-tube. temperature difference in both steam generators.
%e operators must; also monitor the reactor coolant planp net positive suction head pressure to avoid violating even the relaxed limits.
In addition, the operators must calculate the offsite radiation dose rates to decide whether a steam generator should be isolated.
1
n
, 'f. 1*
~
fA final example of dy we doubt that there is adequate protection for the
'public is that the emergency procedures rely on improvisation during the accident. Revision 3 of GPU Maclear's Technical Data Report ER-406, "SG ' Ribe Rupture Procedure Gu'idelines," contains an appendix entitled, " Additional 1
Steaming and Isolation Criteria for Reduction of Radiological Helease."
his j
appendix essentially overrules the precautions in the emergency procedures concerning isolation of a steam generator den offsite dose rates exceed the limits discussed earlier.
Rather than giving specific procedures, thought-out in advance, for the operators to follow, it simply lists the factors that need
.)
to be considered during the accident.
III. Conclusions.
2e fundamental safety problem is that neither GPU nor the ISC has given i
any serious consideration to dether replacement of the stem generators is now necessary to assure an adequate level of safety.
Instead, having decided to operate MI-1 with uniquely degraded steam generators, GPU is seeking to make the best of a bad situation.
Based on the information available to us, UCS has concluded that a safety evalunion of a steam generator tube rupture accident at MI-1 has not been performed in accordance with the Gommission's safety requirements for design basis accidents.
Se existing emergency procedures for a steam generator tube rupture accident at MI-1 apparently reflect the fact that there are only two l
possible outcomes: a controlled radiation exposure to the public or an uncon-
)
trolled radiation exposure to the public.
We have found no evidence that, in either case, the Commission's safety limits on core damage and radiation dose to the public will not be violated.
%ere is no justification for permitting this risk to the public at MI-1 den it would not be tolerated at any other plant.
l 1
a i
-,-.,,-.m-
-n.,-n..,,___,__,,m.c_~,. -,,,, - -
,,-,n-,,--,-
.--,,nw,,,--e--,-,--