Text

Advises of Completion of Commission Review of Encl Ucs Re Facility & Oeld 850524 Memo Discussing Subj Ltr.Ucs Ltr Does Not Warrant Further Review.Ltr Referred to Dircks for Response to Ucs
	ML20133H563
Person / Time
Site:	Crane
Issue date:	06/25/1985
From:	Chilk S; NRC OFFICE OF THE SECRETARY (SECY)
To:	Dircks W; NRC OFFICE OF THE EXECUTIVE DIRECTOR FOR OPERATIONS (EDO)
Shared Package
ML20133H476	List: ML20133H525; ML20133H563; ML20133H577;
References
	NUDOCS 8508090395
	Download: ML20133H563 (1)
	v • d • e

_

s UNITED STATES 1,

NUCLEAR REGULATORY COMMISSION h

W ASHINGTON, D.C. 20555

\\...../

June 25, 1985

. OFFICE OF THE SECRETARY MEMORANDtM EUR: William J. Dircks Executive rector for Operations FROM:

anuel J.

Secret f the Ccanission

SUBJECT:

MAY 3,1985 UCS IEITER The Ccmnission has reviewed the May 3 letter frm the Union of Concerned Scientists (UCS) regarding Wree Mile Island, Unit 1, and the May 24, 1985 menorandum frm the Executive Ingal Director discussing that letter. We Ccanission does not believe the UCS letter warrants further Comnission review, and is referring it to you for an apprcpriate response by letter to UCS.

cc:

Chairman Palladino Commissioner Roberts Commissioner Asselstine Commissioner Bernthal Commissioner Zech OPE OGC i

I f

8500090395 850006 PDR ADOCK 05000289 P

PDR EDO --- 000758

4 UNION OF CONCERNED SCIENTISTS me c.....i..u.e..e. s.w.. S. noi. wa.hi...... oc 2eo36. <2o23 2*.56o Nunzio J. Palladino, Chairman Thomas M. Roberts, Comissioner

./

James K. Asselstine, Comissioner M

FI 4

Frederick M. Bernthal, Commissioner Lando W. Zech, Comissioner p'[

U. S. Nuclear Regulatory Comission Gw Washington, D. C. 20555 Gentlemen:

On April 17, 1985, the NRC staff briefed the Comission on the status of ihree Mile Island Unit 1 (TNI-1) in preparation for a restart vote.

UCS's comments the following day on the staff's presentation were limited to the subject of the steam generators. We are writing now to address other subjects because the staff's presentation was not complete.

Specifically, the staff's presentation failed to inform you of the following:

1. Some " lessons learned" items (NUREG-0737 items) previously certified by the staff to be complete are, due to new information, no longer complete;

2. Some conditions of the 1NI-1 plant do not conform with the conditions described in sworn testimony during the restart proceeding which were relied upon by the Licensing Board and Appeal Board in deciding contested issues in favor of restart; and

3. Many of the new 1NI-1 technical specifications proposed by GPU and approved by the staff effectively reverse Licensing Board and Appeal Board findings that certain equipment is necessary to protect public health and safety by permitting operation of INI-1 with that equipment inoperable.

Specific examples of each of these safety deficiencies are described in detail in the attachment to this letter.

A brief stmnary of those examples follows.

1.o. A lessons learned requirement was that the pressurizer safety valves be tested to demonstrate acceptable performance under accident conditions.

After tests were brought to the Appea'. Board's attention showing that incor-rect valve adjustments caused valve damage and inadequate relief capacity, GPU comitted to specific valve settings that had been shown to produce acceptable valve performance.

The issue was largely resolved on this basis.

However, GPU later changed the settings, as discoverd by an NRC inspector.

Doctrnenta-tion that purportedly supports the new settings is dated in early 1984 but was not scheduled to be submitted by GPU until March 31, 1985.

UCS has not received that information or the staff's evaluation of it.

b Main Office: 26 Church Street. Cambridge, Mas.achusetts o2238. (617) 547 5552 p

. 1.b. We MI-2 accident demonstrated that additional instrumentation to detect inadequate core cooling was required.

The incore thermocouples are part of that instrumentation and a lessons learned requirement was that the incore thermocouple instruentation must be environmentally qualified.

GPU informed the staff that environmental qualification has not been established, testing is underway, efforts to procure replacement equipment are being pur-sued concurrently, and if replacement is necessary, procurement and installa-tion will take 40 weeks.

On March 29, 1985, the staff approved GPU's request for extension of the March 31, 1985 environmental qualification deadline on the basis that the hot leg temperature detectors (which provide an input signal to the subcooling margin meters) are an adequate substitute for the incore thermocouples.

However, it was apparently overlooked that the hot leg temperature instrtanents can not be used unless the reactor coolant peps are I

running, which they will not be in certain accident conditions. In addition, the MI-1 technical specifications permit plant operation with the subcooling i

l margin instrtsnentation inoperable on the basis that the incore thennocouples are an adequate substitute.

2. Another lesson learned requirement was that provisions to supply emergency electrical power to the presurizer heaters must be made without degrading the capacity, capability or reliablility of the onsite emergency l

power supply. De boards found the WI-1 provisions to be acceptable in large l

part on the basis that two conditions would be satisfied: a) the heaters would not be connected until the load on the emergency power supply was stabilized; j

and b) that the undervoltage trip used to disconnect the heaters to protect i

the power supply from a failure in the heater circuits would be set at a specified voltage and time delay.

GPU has since changed the setpoints for both the voltaale and time delay on the basis that starting of motors on the emergency power supply would result in tripping th'e heaters.

Bis indicates that the heaters will be connected without first stabilizing the load on the power supply.

The staff is aware of this situation but has taken no action other than to classify it as a " closed item."

3. A principal purpose of the restart proceeding was to decide, in view of the MI-2 accident, what new safety equipment was necessary and sufficient to protect the health and safety of the public during operation of MI-1.

Rat process has been completely frustrated by the approval of technical specifications that permit operation of MI-1 with equipment inoperable which the boards found was necessary to protect the public.

For example, the following new safety equipment falls in this category: subcooling margin instrumentation, position indication for the pressurizer PORV and safety valves, emergency feedwater system flow instruments, and reactor coolant system high point vents.

UCS believes that the Comission should take the following actions:

1. Direct the staff to identify any additianal " lessons lea.ned" require-ments or other items that the staff has certified to the Comssion as complete but which are no longer complete.

2. Direct the staff to identify any additional instances where the present status of TMI-1 does not conform with the GPU commitment and/or board-imposed license condition that was relied upon in the adjudicatory decisions favorable to restart.

. For items 1. and 2. above, the staff should also be directed to propose a method and schedule for resolving each safety issue identified, giving due consideration to the rights of the other parties.

3. Direct the staff to review the WI-1 technical specifications end amend them as necessary to require, as " limiting conditions for operation,"

the operability of all equipment relied upon by the boards as a basis for decision that MI-I can be operated without endangering the health and safety of the public. In addition, the staff should be directed to serve the parties with a complete set of the amended technical specifications and solicit the parties' coments on whether the amended technical specifications contain all such required limiting conditions for operation.

In sum, UCS believes that there are more items requiring resolution prior to a Comission vote on restart than were identified by the staff in its April 17, 1985 presentation to the Comission.

We anticipate the charge that these questions are being raised at the last minute.

On the contrary, these are not new questions.

They are issues which were purportedly settled during the restart proceedings but which have become unraveled by either inadvertent or intentional lack of attention to the conditions of restart imposed by or implicit in the ASLB and Appeal Board decisions.

Sincerely, Robert D. Pollard Muclear Safety Engineer s

Ellyn. Weiss General Counsel encle Additional Safety Issues Requiring Resolution Prior To WI-1 Restart cct M I-1 Service List i

ADDITICNAL SAFETY ISSUES REQUIRING RESOLUTION PRIOR TO THI-1 RESTA,RT Union of Concerned Scientists May 3, 1985

1. " Lessons Learned" Requirements That Are Incomplete

a. NUREG-0737. Item II.D.1, Performance Testing of Boiling-Water and Pressurized-Water Reactor Relief and Safety Valves (NUREG-0578, Section 2.1.2)

One of the lessons learned requirements was that reactor coolant system safety valves had to be tested under the full range of expected operating con-ditions for design basis transients and accidents, which would include solid-water and two-phase flow conditions. (Ref. 1.]

As discussed below, data from testing Dresser Industry safety valves, including the specific model used as pressurizer safety valves at INI-1, showed that certain plant modifications and adjustments 1 to the safety valves were necessary to prevent valve chatter that could reduce relief capacity and damage the valve internals.

GPU commit-ted to these changes, which were relied upon by the Appeal Board to resolve the issue.

Recent information indicates that GPU will not utilize the valve settings relied on by the Board.

1/ These adjustments are called ring settings.

Although there is some inter-action between the three separate ring settings, the principal effect of each ring setting is as follows: the lower ring setting affects the rate at which the valve opens and adjusts " accumulation," the pressure above the preset opening pressure at which the valve is fully open; the middle ring adjusts " blowdown," the pressure below the opening pressure at which the valve is fully reclosed; the upper ring setting is used to compensate for the effects of backpressure downstream of the valve.

Accumulation and blowdown are generally expressed as a percentage of the pressure setpoint.

For example, a safety valve set to open at 2500 psi with 3% accumulation ar.d 10% blowdown should open at 2500 psi, be fully open at 2575 psi and reclose at 2250 psi. [Ref. 2.]

r

- B&W provided the following evaluation of the results from the testing pert,rmed on the safety valves:

Recent review of the EPRI test data indicate that for certain combinations of lower and middle ring settings the safety valves could chatter (rapid cycle valve opening and closing).

Two consequences of valve chattering have been noted during valve testing: a reduction in safety valve capability to relieve pressure while chattering and subsequent damage to valve internals.

During the EPRI tests, this chattering phenomenon was noted only with valves with long inlet piping configurations.

However, present understanding of the effect of ring settings on valve operation indicates that even with the valves mounted directly on the pressurizer nozzles, valve chatter could be postulated for a combination of ring settings significantly different from those used during the EPRI tests.

[Ref. 3.]

During the restart hearings conducted by the Licensing Board, UCS assert-ed, inter alia, that appropriate qualification testing of the safety valves had not been performed to verify the capability of these valves to function during normal, transient, and accident conditions. (Ref. 4.]

In resolving this question, the Licensing Board found that a valve testing program being conducted by the Electric Power Research Institute (EPRI) was adequate to reveal any design deficiencies in the safety valves used at THI-1. (Ref. 5.]

This subject was revisited during the reopened hearings held by the Appeal Board in March 1983.

GPU testified that as a result of the EPRI tests

"[t]he safety valves were shown to be acceptable under all modes of operation after certain modifications were made." (Ref. 6.]

The modifications which GPU testified were necessary in order to assure acceptable safety valve perform-ance were to change "the safety v.lve inlet piping from a long inlet to a short inlet arrangement" (Ref. 7.], and to readjust the safety valve ring set-tings to "the final EPRI ring settings which we used in the last five tests."

(Ref. 8.] GPU's comitment to the latter modification has been abandoned.

. l During an NRC inspection of MI-1 conducted on January 21-24, 1985 (but not reported until March 18, 1985), the inspector noted that GPU had changed the safety valve ring settings.

GPU furnished the inspector with documenta-tion from B&W dated in February and May of 1984 that purportedly supports the revised ring settings.

However, the inspector concluded that since the l

staff's safety evaluation report had been based on the earlier ring settings, there was a need to inform the Office of Nuclear Reactor Regulation (NRR) of the details.

GPU representatives agreed "and committed to furnish the ring setting information to MRR by 3/31/85." [Ref. 9.]

To date, UCS has not received that information or any staff evaluation of it.

UCS believes that this safety issue must be resolved before restart.

The safety significance of the ring settings for the pressurizer safety valves is illustrated by the fact that after reviewing their safety valve ring settings against the EPRI test results, Duke Power Company declared the safety valves inoperable and shut down Oconee Unit 2.

[Ref. 10.]

The Oconee plants and MI-1 utilize the same model of Dresser safety valves. [Ref. 11.]

Further-more, as discussed above, incorrect ring settings can result in inadequate relief capacity and damage to the safety valves.

Since the staff claims that j

the " limiting transient" for MI-1 is a subcritical rod withdrawal [Ref. 12.]

and such an accident could occur early in the restart process, resolution of this safety issue can not be postponed until after restart.

b.

NUREG-0737, Item II.F.2, Attachment 1,

Design and Qualification Criteria for Pressurized-Water Reactor Incore Thermocouples.

One of the " lessons learned" requirements was that additional instrumen-tation was needed for detection of inadequate core cooling.

One requirement applicable to incore thermocouples that measure core exit temperatures was that "[t]he instrumentation should be environmentally qualified

" [Ref.

-13.]

~

. A GPU submittal to the staff dated May 20, 1983 stated that no extension cf the March 31, 1985 deadline in 10 CFR 50.59 for environmental qualification of electrical equipment would be needed.

In a submittal dated December 11, 1984, GPU " identified nine (9) 19. ems of equipment that were not qualified,"

including the incore thermocouple :nstrumentation. [Ref. 14.]

On February 12, 1985, GPU applied for an extension of the deadline for qualifying the thermo-couples. GPU gave as its " reason for scheduler (sic] extension" the following:

1 1

Qualification testing of the existing cables and connectors is planned to be complete in April 1985 based on vendor bids.

The final report is due out in May 1985.

Pending the outcome l

of the testing, replacement may be necessary.

GPUN is pro-l ceeding in a parallel path with the testing to procure environmentally qualified replacement cables....

i (Ref. 15.]

i GPU offered as a "JIO" (Justification for Interim Operation) # the asser-(

tion that "[t]he safety function (of the incore thermocouple instrumentation]

can be accomplished by alternate qualified instrumentation with existing procedural guidance." [Ref. 16.]

GPU asserted that the hot leg resistance temperature detectors (RTDs) are the " alternate qualified instrumentation" to be used in determining the subcooling margin of the reactor coolant system.

l However, GPU also correctly informed the staff, albeit in a footnote, that

"[wlith reactor coolant pumps running, the subcooling margin is calculated from the hot leg RTDs.

If the RCPs are off, the subcooling margin is calcu-lated from the incore thermocouples." [Ref.17. ]

2f Previously, such information has been termed a "JC0" (Justification for Continued Operation).

The criteria for an acceptable justification for equipment not shown to be qualified require, inter alia, either a) the equipment would perform its function before failing or b) there is other redundant, qualified safety-grade equipment available to perform the same safety function.

.- The staff appears to have overlooked GPU's footnote.

In a letter to GPU dated March 29. 1985,1 the staff stated that "[w]e have reviewed the JI0s and conclude that they are sufficient to support operation during the requested extension period," and granted GPU's requested extension of the March 31, 1985 environmental qualification deadline. [Ref. 18.]

However, even assuming, arguendo, that the instrumentation used to determine subcooling margin from the hot led RTDs is environmentally quali-ficd, that intrumentation can not substitute for the incore thermocouples because it can not be used unless the reactor coolant pumps are running.

Under design basis accident assumptions, the reactor coolant pumps will not be running.

The Commission's regulations (GDC-17) require postulating the loss of offsite electrical power, which is the only source of power for the pumps.

Furthermore, even if offsite power is not lost, the TMI-1 reactor operators have been trained and instructed to shut off the reactor-pumps in certain accident situations.

Thus, UCS concludes that NUREG-0737 Item II.F.2 is not complete because the incore thermocouples are not environmentally qualified.

UCS also concludes, contrary to the staff, that GPU has not provided a valid justification for operation of INI-1 without environmentally-qualified incore thermocouple instrumentation.

One or the other must be done before operation of INI-1 can go forward uunder the rules that apply to all plants.

2. GPU Commitments or License Conditions That Are Not Met One of the lessons learned requirements was that provisions to supply emergency electrical power to the pressurizer heaters must be made without degrading the capacity, capability or reliability of the onsite emergency

}/ UCS received a copy of this letter at 4:00 p.m., Friday, April 15, 1985.

,.. power supply.

During the restart proceeding, UCS contended that the provi-sions at THI-1.to protect against the loss of the emergency electrical power supply as a result of an electrical fault (e.g.,

short circuit) in the non-safety grade pressurizer heaters or their circuits were inadequate. [Ref. 19.]

This safety issue was resolved by the Boards relying upon, inter alia, GPU's commitments that two conditions would be satisfied at THI-1.

First, the Boards relied upon GPU's testimony that "[t]he undervoltage relays will trip open the [ pressurizer heater circuit] breaker if the voltage on the ES

[ engineered safegurrds] bus drops to 430v for 1.5 seconds." [Ref. 20.]

Second, the Boards relied upon GPU's testimony that the pressurizer heaters will not be connected to the emergency power supply unless " adequate diesel generator capacity is available and all systems have stabilized." [Ref. 21.]

GPU apparently has no intention of adhering to these two conditions.

During routine safety inspections of THI-1 conducted on January 3 February 3, 1984, NRC inspectors noted that GPU had changed both the voltage and time delay setpoints for the undervolt..ge trip.

The inspectors reported that the setpoints were changed from those relied upon by the Appeal Board to avoid tripping of the pressurizer heater circuit breakers "due to motors starting on the class 1E bus."

(If motors are being started, then the load on the power supply has not been stabilized.)

Although aware that the Appeal Board decision was based on different setpoints, the inspection report states that "[t]his item is closed."

The relevant portion of the inspection report follows:

The setting specified in the Licensee [ sic] Board Hearing ALAB-729 was 430 volts at 1.5 seconds.

The setting by the licensee is 420 volts at 1 second.

'- The ALAB-729 relay setting of 430 volts would protect the class 1E system.

However, the purpose of CLI-79-8 would not be achieved due to undesired tripping.

This setting is 90% of normal [ voltage] which would be reached due to motors starting

on the class 1E bus.

The setting of 42O volts is 85% of normal which allows 805 for motor starter coil pickup plus 5%

voltage, drop through the control transformer and control wires.

The time setting has been reduced from the ALAB-729 requirement of 1.5 seconds to 1 second.

The 855 voltage setting at 1 second assures the primary objective of pro-tecting the class 1E system.

This item is closed. [Ref. 22.)

It is not clear what evaluation, if any, was done by the staff to support the conclusion that revised undervoltage trip setpoints achieve "the primary objective" of protecting the onsite emergency power supply.

It is clear, however, that the revised setpoints are not equivalent to those relied upon by the Appeal Board.

For example, an electrical fault that caused the voltage to drop to between 420 and 430 volts would not result in tripping of the circuit breakers no matter how long the fault persisted if the unauthorized setpoints are used.

In contrast, the same fault would result in tripping the breaker if the setpoints relied upon by the Appeal Board are used.

Thus, to some degree, the revised setpoints degrade the capability and reliability of the emergency power supply.

In any event, the staff and GPU can not unilaterally change commitments relied upon by the Boards.

UCS considers the abandonment of the commitment not to connect the pres-surizer heaters to the emergency power supply unless the loads have stabilized to have even more safety significance because a failure of the emergency power system at this stage could imperilall of the plant's safety systems.

Further-more, if that commitment had not been abandoned, there would apparently have been no need to depart from the specific voltage and time delay setpoints for the undervoltage trip which were relied upon by the Appeal Board.

3. TMI-1 Technical Specifications That Negate Board Decisions A principal purpose of the restart proceeding was to decide, in view of the THI-2 accident, what new safety equipment was necessary and sufficient to

.' protect the health and safety of the public during operation of MI-1.

That process has been completely frustrated by the approval of license technical specifications that permit operation of INI-1 with equipment inoperable, even though the Boards found that equipment to be necessary to protect the public.

Examples of instances where this has occurred are as follows:

a. Subcooling Margin Instrumentation.

A lessons learned requirement was that primary coolant saturation meters should be installed to provide online indication of coolant saturation condition. [Ref. 23.]

GPU testified that this requirement was met by the installation two "subcooling margin monitors,"

one for each loop.

However, the technical specification permit unrestricted operation of THI-1 with one subcooling meter inoperable all the time and permit operation for an additional week after failure of the second. [Ref. 24.]

The purported basis for this technical specification is that "[allternate indications are available for Saturatior Margin Monitors using hand calcula-tions." [Ref. 25.]

However, the use of " hand calculatio1s," which were avail-able during the INI-2 accident, obviously does not meet the lessons learned requirement to install instrumentation "to provide on-line indication of coolant saturationcondition." [Ref. 26.]

Furthermore, the only temperature indications available for such hand calculations, other than the hot leg resistance temperature detectors which provide the temperature input to the subcooling meters, are the incore thermocouples.

As discussed above, the i

staff has proposed allowing THI-1 to operate without environmentally qualified incore thermocouple instrumentation on the grounds that the incore thermocouples are backed up by the subcooling meters.

In any event, the lessons learned requirements specified that both the incore thermocouples and saturation meters must be provided and GPU tesimony during the restart proceeding wa-

,st ' th would b

_9-

b. Direct Indication of PORV and Safety Valve Position.

A lessons learned requirement was that reactor system relief and safety valves shall be provided with reliable positive indication of their position in the control room. [Ref. 27.]

GPU testified that this requirment had been met by the installation of redundant position indicators for the PORV and by a single position indicator for each safety valve.

Specifically, discharge flow from the two pressurizer code safety valves Lat. the PORV is measured by differen-tial pressure transmitters connected across elbow taps downstream of each valve.

In addition, an acoustic monitor is provided to detect flow in the PORY discharge line.

However, the technical specifications permit operation of TMI-1 with either one of the PORV instruments continuously inoperable and permit con-tinued operation for a week following the failure of the other PORY instrument and both safety position indications. [Ref. 28.]

The basis purported to justify this re?.axation of the lesson learned requirements is that alternate indicat'an of the position of the safety valves and the PORV is available from the thermocouples in the valves' discharge pipes.

It is precisely these downstream thermocouples that proved inadequate during the TNI-2 accident and led to the requirement for reliable position indication.

c.

Emergency Feedwater System Flow Indicatior..

A lessons learned requirement was that "[s]afety-grade indication of auxiliary feedwater flow to each steam generator shall be provided in the control room." [Ref. 29.]

GPU testified that this requirement was met by the installation of redundant EFW flow instruments for each steam generator.

However, the technical specifications permit operation of THI-1 with one flow instrument for each steam generator inoperable all the time and permit continued operation for a week following failure of the other EFW flow instru-

,., ments. [Ref. 30.]

Allowing operation with one flow instrument inoperable does not meet the requirement for s. fety-grade instrumentation because the single failure criterien is not met with only one flow indicator per steam generator.

The availability of local EFW flow indication does not satisfy the requirement that the indication be in the control room.

d. Reactor Coolant System High Point Vents.

A lessons learned require-ment.was that high points vents be installed inorder to vent non-condensible gases from the reactor coolant system which could otherwise block natural circulation cooling of the core.

The lessons learned requirements applicable to the high point vents specified that although each vent path need not meet the single failure criterion, a " degree of redundancy should be provided by powering different vents from different emergency buses." [Ref. 31.]

The evidentiary record indicates that THI-1 complied with this require-ment by installing four vents - one on each loop, one on the pressurizer and one on the reactor vessel.

The design is such that the vents on the vessel, pressurizer, and loop B are powered from one electric power supply and the vent on loop A is powered from a redundant power supply.

However, the technical specifications permit operation of TMI-1 with one loop vent inoperable all the time and permit continued operation for 30 days following failure of another vent. [Ref. 32.]

Thus, if THI-1 is operating with the loop A vent inoperable, a single failure of the power supply for the pressurizer, vessel and loop B vents would render all high point vents inoper-able.

The technical specifications therefore violate the lesson learned requirement that the vents collectively should meet the single failure criter-ion.

Furthermore, since the vents on the pressurizer and the vessel can not remove gas fran the high point of the loops, the same situation (i.e., the inability to restore natural circulation) would prevail if INI-1 were in oper-

. j ation with the loop B vent inoperable.

That is, an accident accompanied by a single failure of the power supply for the loop A vent would leave THI-1 with no operable loop vent.

The basis for this technical specification provides no justication either for allowing operation with one loop vent continuously inoperable, or for 30-days continued operation with both loop vents inoperable.

UCS concludes that the THI-1 Technical specifications must be amended to require, as " limiting conditions for operation," the operability of all equip-ment relied upon by the Boards as a basis for the decision that THI-1 can be operated without endangering the health and safety of the public.

In addition, we believe that another requirement should be added to the technical specifications.

The technical specifications permit continued operation for some period of time following failure of safety equipment that is subject to a limiting condition for operation.

If repairs can not be made with the specified time, the technical specif. cation require that the plant be shut down.

UCS believes that GPU should be required to assess, within 24 hours2.777778e-4 days 0.00667 hours 3.968254e-5 weeks 9.132e-6 months after detecting the failure, whether the equipment can be restored to an operable status within the time continued operation is permitted without that equipment.

When it is concluded that repairs can not be accomplished within the allowable time period, the plant should be immediately shut down.

There is no justification for continued operation, even for a limited time, if it is known that the equipment can not be repaired prior to the time the plant will be required to shut down.

4. References. See next page.

. References 9

1.

NUREG-0737, Item II.D.1.

SUBJECT:

MAY 3,1985 UCS IEITER The Ccmnission has reviewed the May 3 letter frcm the Union of Concerned Scientists _ (UCS) regarding Three Mile Island, Unit 1, and the May 24, 1985 mmorandum frun the Executive Iagal Director discussing that letter. The Ccmnission does not believe the UCS letter warrants further Ccxtmission review, and is referring it to you for an appropriate response by letter to UCS.

cc:

Chairman Palladino Commissioner Roberts Commissioner Asselstine Commissioner Bernthal Commissioner Zech OPE OGC 7

EDO --- 000758

- 5"*

' UNION OF

. CONCERNED SCIENTISTS me c

..tu.t ue..e. s.w.. s. noi. w. si.,t... oc 2oo36. <202> 296 56eo Mal 3, 1985 Nunzio J. Palladino, Chairman Thomas M. Roberts, Comissioner d ' (4t"g

,M James K. Asselstine, Comissioner t

Frederick M. Bernthal, Comissioner

[

Lando W. Zech, Comissioner U. S. Nuclear Regulatory Comission Gw Washington, D. C. 20555 Gentlemen:

On April 17, 1985, the NRC staff briefed the Comission on the status of Three Mile Island Unit 1 (TNI-li in preparation for a restart vote.

UCS's coments the following day on the staff's presentation were limited to the subject of the steam generators.

We are writing now to address other subjects because the staff's presentation was not complete.

Specifically, the staff's presentation failed to inform you of the following:

1. Some " lessons learned" items (NUREG-0737 items) previously certified by the staff to be complete are, due to new information, no longer complete;

2. Some conditions of the 1NI-1 plant do not conform with the conditions described in sworn testimony during the restart proceeding which were relied upon by the Licensing Board and Appeal Board in deciding contested issues in favor of restart; and

3. Many of De new TMI-1 technical specifications proposed by GPU and approved by the staff effectively reverse Licensing Board and Appeal Board findings that certain equipment is necessary to protect public health and j

safety by permitting operation of 1MI-1 with that equipment inoperable.

Specific examples of each of these safety deficiencies are described in detail in the attachment to this letter.

A brief stenary of those examples follows.

1.a. A lessons learned requirement was that the pressurizer safety valves be tested to demonstrate acceptable performance under accident conditions.

After tests were brought to the Appea'. Board's attention showing that incor-rect valve adjustments caused valve damage and inadequate relief capacity, GPU comitted to specific valve settings that had been shown to produce acceptable valve performance.

The issue was largely resolved on this basis.

However, GPU later changed the settings, as discoverd by an NRC inspector.

Doctznenta-tion that purportedly supports the new settings is dated in early 1984 but was not scheduled to be submitted by GPU until March 31, 1985.

UCS has not received that information or the staff's evaluation of it.

6 - J-pry,A o - ?

b3W Q uf D u lh Main Office: 26 Church Street. Cambridge, Massachusetts o2238. (617) 547-5552

1.b. We MI-2 accident demonstrated that additional instrumentation to detect inadequate core cooling was required.

We incore thermocouples are part of that instrumentation and a lessons learned requirement was that the incore thermocouple instrumentation must be environmentally qualified.

GPU infomed the staff that environmental qualification has not been established, testing is underway, efforts to procure replacement equipment are being pur-sued concurrently, and if replacement is necessary, procurement and installa-tion will take 40 weeks.

On March 29, 1985, the staff approved GPU's request for extension of the March 31, 1985 environmental qualification deadline on the basis that the hot leg temperature detectors (which provide an input signal to the subcooling margin meters) are an adequate substitute for the incore thermocouples.

However, it was apparently overlooked that the hot leg temperature instrments can not be used unless the reactor coolant pumps are running, which they will not be in certain accident conditions. In addition, the TMI-1 technical specifications permit plant operation with the subcooling margin instrumentation inoperable on the basis that the incore thermocouples are an adequate substitute.

2. Another lesson learned requirement was that provisions to supply emergency electrical power to the presurizer heaters must be made without degrading the capacity, capability or reliablility of the onsite emergency power supply. De boards found the WI-1 provisions to be acceptable in large part on the basis that two conditions would be satisfied: a) the heaters would not be connected until the load on the emergency power supply was stabilized; and b) that the undervoltage trip used to disconnect the heaters to protect the power supply from a failure in the heater circuits would be set at a specified voltage and time delay.

GPU has since changed the setpoints for both the voltage and time delay on the basis that starting of motors on the emergency power supply would result in tripping the heaters.

Bis indicates that the heaters will be connected without first stabilizing the load on the power supply.

We staff is aware of this situation but has taken no action other than to classify it as a " closed item."

3. A principal purpose of the restart proceeding was to decide, in view of the WI-2 accident, what new safety equipment was necessary and sufficient to protect the health and safety of the public during operation of WI-1.

Dat process has been completely frustrated by the approval of technical specifications that permit operation of WI-1 with equipment inoperable which the boards found was necessary to protect the public.

For example, the following new safety equipment falls in this category: subcooling margin instrmentation, position indicatio'n for the pressurizer PORV and safety valves, ernergency feedwater system flow instrm ents, and reactor coolant system high point vents.

UCS believes that the Cemnission should take the following actions:

1. Direct the staff to identify any additional " lessons lea.ned" require-ments or other items that the staff has certified to the Comssion as complete but which are no longer complete.

2. Direct the staff to identify any additional instances where the present status of TMI-1 does not conform with the GPU commitment and/or board-imposed license condition that was relied upon in the adjudicatory decisions favorable to restart.

For items 1. and 2. above, the staff should also be directed to propose a method and. schedule for resolving each safety issue identified, giving due consideration to the rights of the other parties.

3. Direct the staff to review the MI-1 technical spebifications and amend them as necessary to require, as " limiting conditions for operation,"

the operability of all equipment relied upon by the boards as a basis for decision that WI-1 can be operated without endangering the health and safety of the public.

In addition, the staff should be directed to serve the parties with a complete set of the amended technical specifications and solicit the parties' comments on whether the amended technical specifications contain all such required limiting conditions-for operation.

In sum, UCS believes that there are more items requiring resolution prior to a Comission vote on restart than were identified by the staff in its April 17, 1985 presentation to the Ccumission.

We anticipate the charge that these questions are being raised at the last minute.

On the contrary, these are not new questions.

They are issues which were purportedly settled during th:

restart proceedings but which have become unraveled by either inadvertent or intentional lack of attention to the conditions or restart imposed by or implicit in the ASLB and Appeal Board decisions.

Sincerely, Robert D. Pollard Muclear Safety Engineer s

Ellyn. Weiss General Counsel encl: Additional Safety Issues Requiring Resolution Prior To N I-1 Restart ec: M I-1 Service List 1

e E

ADDITIONAL SAFETY ISSUES REQUIRING RESOLUTION PRIOR TO TMI-1 RESTART 4

Union of Concerned Scientists May 3, 1985

1. " Lessons Learned" Requirements That Are Incomplete

a. NUREG-0737, Item II.D.1, Performance Testing of Boiling-Water and Pressurized-Water Reactor Relief and Safety Valves (NUREG-0578, Section 2.1.2)

One of the lessons learned requirements was that reactor coolant system safety valves had to be tested under the full range of expected operating con-ditions for design basis transients and accidents, which would include solid-water and two-phase flow conditions. [Ref. 1.]

As discussed below, data from testing Dresser Industry safety valves, including the specific model used as pressurizer safety valves at IMI-1, showed that certain plant modifications W o the safety valves were necessary to prevent valve chatter t

Ond adjustments that could reduce relief capacity and damage the valve internals.

'iPU commit-ted to these changes, which were relied upon by the Appeal Board to resolve the issue.

Recent information indicates that GPU will not utilize the valve settings relied on by the Board.

1/ These adjustments are called ring settings.

Although there is some inter-action between the three separate ring settings, the principal effect of each ring setting is as follows: the lower ring setting affects the rate at which the valve opens and adjusts " accumulation," the pressure above the preset opening pressure at which the valve is fully open; the middle ring adjusts " blowdown," the pressure below the opening pressure at which the valve is fully reclosed; the upper ring setting is used to compensate for the effects of backpressure downstream of the valve.

Accumulation and blowdown are generally expressed as a percentage of the pressure setpoint.

safety valve set to open at 2500 psi with 3% accumulation For example, a and 105 blowdown should open at 2500 psi, be fully open at 2575 psi and reclose at 2250 psi. [Ref. 2.]

B&W provided the following evaluation of the results from the testing performed on the safety valves:

Recent review of the EPRI test data indicate that for certain combinations of lower and middle ring settings the safety valves could chatter (rapid cycle valve opening and closing).

Two consequences of valve chattering have been noted during valve testing: a reduction in safety valve capability to relieve pressure while chattering and subsequent damage to valve internals.

During the EPRI tests, this chattering phenomenon was noted only with valves with long inlet piping configurations.

However, present understanding of the effect of ring settings on valve operation indicates that even with the valves mounted directly on the pressurizer nozzles, valve chatter could be postulated for a combination of ring settings significantly different from those used during the EPRI tests.

[Ref. 3.]

During the restart hearings conducted by the Licensing Board, UCS assert-ed, inter alia, that appropriate qualification testing of the safety valves had not been performed to verify the capability of these valves to function during normal, transient, and accident conditions. [Ref. 4.]

In-resolving this question, the Licensing Board found that a valve testing program being conducted by the Electric Power Research Institute (EPRI) was adequate to reveal any design deficiencies in the safety valves used at TMI-1. [Ref. 5.]

This subject was revisited during the reopened hearings held by the Appeal Board in March 1983.

GPU testified that as a result of the EPRI tests

"[t]he safety valves were shown to be acceptable under all modes of operation after certain modifications were made." [Ref. 6.3 The modifications which GPU testified were necessary in order to assure acceptable safety valve perform-ance were to change "the safety valve inlet piping from a long inlet to a short inlet arrangement" [Ref. 7.], and to readjust the safety valve ring set-tings to "the final EPRI ring settings which we used in the last five tests."

I

[Ref. 8.] GPU's commitment to the latter modification has been abandoned.

_3-During an NRC inspection of TNI-1 conducted on January 21-24, 1985 (but not reported until March 18, 1985), the inspector noted that GPU 'had changed the safety valve ring settings.

GPU furnished the inspector with documenta-tion from B&W dated in February and May of 1984 that purportedly supports the revised ring settings.

However, the inspector concluded that since the staff's safety evaluation report had been based on the earlier ring settings, there was a need to inform the Office of Nuclear Reactor Regulation (NRR) of the details.

GPU representatives agreed "and committed to furnish the ring setting information to NRR by 3/31/85." [Ref. 9.]

To date, UCS has not received that information or any staff evaluation of it.

UCS believes that this safety issue must be resolved before restart.

The safety significance of the ring settings for the pressurizer safety valves is illustrated by the fact that after reviewing their safety valve ring settings against the EPRI test results, Duke Power Company declared the safety valves inoperable and shut down Oconee Unit 2.

[Ref. 10.3 The Oconee plants and TMI-1 utilize the same model of Dresser safety valves. [Ref. 11.]

Further-more, as discussed above, incorrect ring settings can result in inadequate relief capacity and damage to the safety valves.

Since the staff claims that the " limiting transient" for TNI-1 is a suberitical rod withdrawal [Ref. 12.]

and such an accident could occur early in the restart process, resolution of this safety issue can not be postponed until after restart, b.

NUREG-0737, Item II.F.2, Attachment 1,

Design and Qualification Criteria for Pressurized-Water Reactor Incore Thermocouples.

One of the " lessons learned" requirements was that additional instrumen-tation was needed for detection of inadequate core cooling.

One requirement applicable to incore thermocouples that measure core exit temperatures was that "[t]he instrumentation should be environmentally qualified

" [Ref.

13.3

~

_y_

A GPU submittal to the staff dated May 20, 1983 stated that no extension cf the March 31, 1985 deadline in 10 CFR 50.59 for environmental qualification of electrical equipment would be needed.

In a submittal dated _ December 11, 1984, GPU " identified nine (9) items of equipment that were not qualified,"

including the incore thermocouple instrumentation. [Ref. 14.]

On February 12, 1985, GPU applied for an extension of the deadline for qualifying the thermo-couples. GPU gave as its " reason for scheduler (sic] extension" the following:

Qualification testing of the existing cables and connectors is planned to be complete in April 1985 based on vendor bids.

The final report is due out in May 1985.

Pending the outcome of the testing, replacement may be necessary.

GPUN is pro-ceeding in a parallel path with the testing to procure environmentally qualified replacement cables....

[Ref. 15.3 GPU offered as a "JIO" (Justification for Interim Operation)E the asser-tion that "[t]he safety function [of the incore thermocouple instrumentation 3 can be accomplished by alternate qualified instrumentation with existing procedural guidance." [Ref. 16,3 GPU asserted that the hot leg resistance temperature detectors (RTDs) are the " alternate qualified instrumentation" to be used in determining the subcooling margin of the reactor coolant system.

However, GPU also correctly informed the staff, albeit in a footnote, that

"[wlith reactor coolant pumps running, the subcooling margin is calculated from the hot leg RTDs.

If the RCPs are off, the subcooling margin is calcu-lated from the incore thermocouples." [Ref.17.3 2/ 'Previously, such information has been termed a "JC0" (Justification for Continued Operation).

The criteria for an acceptable justification for equipment not shown to be qualified require, inter alia, either a) the equipment would perform its function before failing or b) there is other redundant, qualified safety-grade equipment available to perform the same safety function.

. TI)e staff appears to have overlooked GPU's footnote.

In a letter to GPU dated March 29,.1985,E the staff stated that "[w]e have reviewed the JIOs and conclude that they are sufficient to support operation during t.he requested extensio1 period," and granted GPU's requested extension of the March 31, 1985 environmental qualification deadline. [Ref. 18.]

However, even assuming, arguendo, that the instrumentation used to determine subcooling margin from the hot led RTDs is environmentally quali-fied, that intrumentation can not substitute for the incore thermocouples because it can not be used unless the reactor coolant pumps are running.

Under desig1 basis accident assumptions, the reactor coolant pumps will not be running.

Tae Commission's regulations (GDC-17) require postulating the loss of offsite electrical power, which is the only source of power for the pumps.

Furthermore, even if offsite power is not lost, the THI-1 reactor operators have been trained and instructed to shut off the reactr pumps in certain cccident situations.

Thus, UCS concludes that NUREG-0737 Item II.F.2 is not complete because the incore thermocouples are not environmentally qualified.

UCS also concludes, contrary to the staff, that GPU has not provided a valid justification for operation of INI-1 without environmentally-qualified incore thermocouple instrumentation.

One or the other must be done before operation cf INI-1 can go forward uunder the rules that apply to all plants.

2. GPU Commitments or License Conditions That Are Not Met One of the lessons learned requirements was that provisions to supply cmergency electrical power to the pressurizer heaters must be made without degrading the capacity, canability or reliability of the onsite emergency i

1/ UCS received a copy of this letter at 4:00 p.m.,

Friday, April 15, 1985.

y

. power supply.

During the restart proceeding, UCS contended that the provi-sions at INI-1.to protect against the loss of the emergency eleef.rical power l

1 supply as a result of an electrical fault (e.g.,

short circuit).. in the non-safety grade pressurizer heaters or their circuits were inadequate. [Ref. 19.]

This safety issue was resolved by the Boards relying upon, inter alia, GPU's commitments that two conditions would be satisfied at THI-1.

First, the Boards relied upon GPU's testimony that "[t]he undervoltage relays will trip open the [p.essurizer heater circuit] breaker if the voltage on the ES

[ engineered safeguards] bus drops to 430v for 1.5 seconds." [Ref. 20.]

Second, the Boards relied upon GPU's testimony that the pressurizer heaters

~

will not be connected to the emergency power supply unless " adequate diesel

. generator capacity is available and all systems have stabilized." [Ref. 21.]

l GPU apparently has no intention of adhering to these two conditions.

During routine safety inspections of THI-1 conducted on January 3 February 3, 1984 NRC inspectors noted that GPU had changed both the voltage end time delay setpoints for the undervolt..ge trip.

The inspectors reported l

that the setpoints were changed from those relied upon by the Appeal Board to cvoid tripping of the pressurizer heater circuit breakers "due to motors starting on the class 1E bus."

(If motors are being started, then the load on the power supply has not been stabilized.)

Although aware that the Appeal Board decision was based on different Aetpoints, the inspection report states that "[t]his item is closed."

The relevant portion of the inspection report follows:

The setting specified in the Licensee [ sic] Board Hearing ALAB-729 was 430 volts at 1.5 seconds.

The setting by the licensee is 420 volts at 1 second.

The ALAB-729 u setting of 430 volts would protect the class 1E systs4 However, the purpose of CLI-79-8 would not be achieved due to undesired tripping.

n:4 setting is 90% of normal [ voltage] which would be reached ca to me,ters starting

_7 on the class 1E bus.

The setting of 420 volts is 855 of normal which allows 805 for motor starter coil pickup plus 5%

voltage. drop through the control transformer and control wires.

The time setting has been reduced fram the ALAB-729 requirement of 1.5 seconds to 1 second.

The 855 voltage setting at 1 second assures the primary objective of pro-tecting the class 1E system.

This item is closed. [Ref. 22.]

It is not clear what evaluation, if any, was done by the staff to support the conclusion that revised undervoltage trip setpoints achieve "the primary objective" of protecting the onsite emergency power supply.

It is clear, however, that the revised setpoints are not equivalent to those relied upon by the Appeal Board.

For example, an electrical fault that caused the voltage to

. drop to between 420 and 430 volts would not result in tripping of the circuit breakers no matter how long the fault persisted if the unauthorized setpoints cre used.

In contrast, the same fault would result in tripping the breaker if the setpoints relied upon by the Appeal Board are used.

Thus, to some degree, the revised setpoints degrade the capability and reliability of the emergency power supply.

In any event, the staff and GPU can not unilaterally change commitments relied upon by the Boards.

UCS considers the abandonment of the commitment not to connect the pres-surizer heaters to the emergency power supply unless the loads have stabilized to have even more safety significance because a failure of the emergency power system at this stage could imperilall of the plant's safety systems.

Further-more, if that commitment had not been' abandoned, there would apparently have

}

been no need to depart fran the specific voltage and time delay setpoints for the undervoltage trip which were relied upon by the Appeal Board, i.

3. TMI-1 Technical Specifications That Negate Board Decisions A principal purpose of the restart proceeding was to decide, in view of the TNI-2 accident, what new safety equipment was necessary and sufficient to

- 1 i

protect the health and safety of the public during operation of INI-1 That process has been completely frustrated by the approval of license technical specifications that permit operation of TNI-1 with equipment inoperable, even though the Boards found that equipment to be necessary to protect the public.

l Examples of instances where this has occurred are as follows:

a. Sutcooling Margin Instrumentation.

A lessons learned requirement was that primary coolant saturation meters should be installed to provide online indication of coolant saturation condition. [Ref. 23.]

GPU testified that this requirement was met by the installation two "subcooling margin monitors,"

one for each loop.

However, the technical specification permit unrestricted operation of TNI-1 with one subcooling meter inoperable all the time and permit i

operation for an additional week after failure of the second. [Ref. 24.]

The purported basis for this technical specification is that "[a]1 ternate indications are available for Saturation Margin Monitors using hand calcula-tions." [Ref. 25.]

However, the use of " hand calculatio1s," which were avail-1 able during the TNI-2 accident, obviously does not meet the lessons learned 4

requirement to install instrumentation "to provide on-line indication of coolant saturationcondition." [Ref. 26.]

Furthermore, the only temperature i

indications available for such hand calculations, other than the hot leg resistance temperature detectors which provide the temperature input to the subcooling meters, are the incore thermocouples.

As discussed above, the staff has proposed allowing IMI-1 to operate without environmentally qualified incore thermocouple instrumentation on the grounds that the incore thermocouples are backed up by the subcooling meters.

In any event, the l

1essons learned requirements specified that both the incore thermocouples and saturation meters must be provided and GPU tesimony during the restart proceeding was that both would be.

4 h

b. Direct Indication of PORV and Safety Valve Position.

A lessons learned requirement was that reactor system relief and safety valves shall be provided with reliable positive indication of their position in the control room. (Ref. 27.]

GPU testified that this requirment had been met by the installation of redundant position indicators for the PORV and by a single position indicator for each safety valve.

Specifically, discharge flow from the two pressurizer code safety valves and the PORY is measured by differen-tial pressure transmitters connected across elbow taps downstream of each valve.

In addition, an acoustic monitor is provided to detect flow in the PORV discharge line.

However, the technical specifications permit operation of THI-1 with either one of the PORV instruments continuously inoperable and permit con-tinued operation for a week following the failure of the other PORV instrument and both safety position indications. (Ref. 28.]

The basis purported to justify this relaxation of the lesson learned requirements is that alternate indicatbn of the position of the safety valves and the PORV is available from the thermocouples in the valves' discharge pipes.

It is precisely these downstream thermocouples that proved inadequate during the TMI-2 accident and led to the requirement for reliable position indication.

c. Emergency Feedwater System Flow Indication.

A lessons learned requirement was that "(slafety-grade in'dication of auxiliary feedwater flow to cach steam generator shall be provided in the control room." (Ref. 29.]

GPU testified that this requirement was met by the installation of redundant EFW flow instruments for each steam generator.

However, the technical specifications permit operation of TNI-1 with one flow instrument for each steam generator inoperable all the time and permit continued operation for a week following failure of the other EFW flow instru-

~

ments. [Ref. 30.]

Allowing operation with one flow instrument inoperable does not meet the r,equirement for se fety-grade instrumentation because the single failure criterion is not met with only one flow indicator per steam generator.

The availability of local EFW flow indication does not satisfy the requirement that the indication be in the control room.

d. Reactor Coolant System High Point Vents.

A lessons learned require-ment.was that high points vents be installed inorder to vent non-condensible gases from the reactor coolant system which could otherwise block natural circulation cooling of the core.

The lessons learned requirements applicable to the high point vents specified that although each vent path need not meet the single failure criterion, a " degree of redundancy should be provided by powering different vents from different emergency buses." [Ref. 31.]

The evidentiary record indicates that THI-1 complied with this require-ment by installing four vents

-- one on each loop, one on the pressurizer and one on the reactor vessel.

The design is such that the vents on the vessel, pressurizer, and loop B are powered from one electric power supply and the vent on loop A is powered from a redundant power supply.

However, the technical specifications permit operation of THI-1 with one loop vent inoperable all the time and permit continued operation for 30 days following ' failure of another vent. [Ref. 32.3 Thus, if TNI-1 is operating with the loop A vent inoperable, a single failure of the power supply for the pressurizer, vessel and loop B vents would render all high point vents inoper-able.

The technical specifications therefore violate the lesson learned requirement that the vents collectively should meet the single failure criter-ion.

Furthermore, since the vents on the pressurizer and the vessel can not remove gas fran the high point of the loops, the same situation (i.e.,

the inability to restore natural circulation) would prevail if THI-1 were in oper-

- ation with the loop B vent inoperable.

That is, an accident accompanied by a single failure of the power supply for the loop A vent would leave 114I-1 with no operable loop vent.