ML20203B321

Forwards Recently Completed Evaluation of Safety Issues at Millstone Unit 3.Strongly Recommends That NRC Implement Strict Enforcement Policy for Millstone If Troubled Plant Allowed to Restart

ML20203B321
Person / Time
Site:	Millstone
Issue date:	08/04/1997
From:	Lochbaum D UNION OF CONCERNED SCIENTISTS
To:	Travers W NRC (Affiliation Not Assigned)
Shared Package
ML20203B320	List: ML20203B316 ML20203B321
References
NUDOCS 9712120417
Download: ML20203B321 (12)

Text

's

(,.

• m-UNION OF CONCERNED SCIENTISTS August 4,1997 Dr. William D. Travers Director-Special Projects Office United States Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

UCS REPORT ON MILLSTONE UNIT 3

Dear Dr. Travers:

The Union of Concerned Scicotists recently completed an evaluation of safety issues at Millstone Unit 3. He resalts of this evaluation are documented in a report released today. A copy is enclosed for your information.

UCS strongly recommends that the NRC implement a strict enforcement for Millstone Unit 3 if this troubled plant is allowed to restart. As documented in our report, its owners have consistently operated this plant in siolation of federal safety regulations. The very existence of the NRC's Special Projects Office indicates that the Conunission feels that Millstone warrants extraordinary oversight. It is UCS's considered opinion that this well-deserved scrutiny should not diminish once the plant is restarted.

He report also documents that both NU and the NRC significantly underestimated the risk from the operation of

-Millstone Unit 3. The plant's risk assessment assumed safety systems were extremely reliable - assumptions which have been demonstrated to be false. He NRC's move towards risk-informed regulation must be tempered by the fact that plants have had, and in all likelihood will continue to have, design flaws that could have prevented safety functions from being performed in event of an accident.

If you have any questions or corrments, please do not hesitate to contet me at (202) 332-0900.

. Sincerely, l (LUId0 David A.

. baum Nuclear Safety Engineer enclosure:

as stated cc:

Chairman Shirley Ann Jackson Mr. Samuel J. Collins Mr. Ilubert J. Miller Washington OfRce: 1818 P Street NW Suite 310 e Washington DC 200341496 e 202 3324900

• FAX: 202-3324906 Comtwidge Headquarters: Two Brattle Square Cambridge MA 02238-9105 e 617-547-5552 e FAX: 617 864-9405 Canforrde Ofnce: 2307 Shattuck Avenue Sute 203 Berkeley CA 947041567 510 843-1872

• FAX: 510$443-3785 9712120417 971204 PDR ADOCK 05000423 P

PDR

- - - - -.-. - - - --.~ --

7a.

fM

~

+

L-MILLSTONE UNIT 3 -

Millstone Power Station in Connecticut is the site of the worst nuclear tragedy in the United States since -

the %ree Mile Island accident in 1979. He reactor did not melt down and radioactivity did not escape, but '

the highly publicized events at Millstone cast a' dark shadow across the nuclear industry. One key player in

' the Millstone saga is a utility company which placed production ahead of safety and was, in the words of its current president, "as close to a dysfunctional organization as I have ever encountered."' De second key player is ~a federal agency w'hich, according to the United States General Accounting Office, " allowed safety problems to persist." De public, which ultimately pays the tab to correct Millstone's problems and would have paid an even greater price had there been an accident, is also a player. There are no winners.

. He many lessons from Millstone mi st be learned and properly applied to prevent future losers.

r Northeast Utilities (NU) shut down Millstone Unit 1 in November 1995 for a planned refueling outage.

When investigations into alleged safety problems broadened to involve the entire Millstone facility, NU voluntarily shut down Unit 2 in February 1996 and Unit 3 in March 1996. All three units remain shut down while NU corrects numerous safety problems. NU plans to restart Millstone Unit 3 this fall with Units 1 f and 2 following early next year. De Nuclear Regulatory Commission (NRC) must formally give NU permission to restart the Millstone units,

%e Unic i of Concerned Scientists reviewed available documentation on the safety problems at Millstone Unit 3. UCS focused its ermination on the auxiliary feedwater and recirculation spray systems, the station

' blackout provisions, and ac plant's risk assessment (see below for discussion). A UCS ccreening review determined that these areas best illustrate the process breakdowns - at Millstone and at the NRC - which enabled deficiencies to occur yet remain undetected and to be identified yet remain uncorrected.

UCS concluded:

E O NU operated Millstone Unit 3 in violation ofits Technical Specification and other regulatory requirements from the time that the plant received its operating license in January 1986 until it was shut down in March 1996. The numerous inspections and other administrative controls by NU and the NRC failed repeatedly to identify thes11ongstandmg violations.

O Flaws in the original designs for the auxiliary feedwater and recirculation spray systems could have impaired, if not prevented, them from performing their vital safety functions during an accident.

Nuclear power plant safety relics on defense-in depth principles that minimize the chances of an

' accident, mitigate the severity of an accident, and contain any radioactivity released during an

accident. He auxiliary feedwater system is intended to mitigate accidents. De recirculation spray system is intended to contain radioactivity. Since both of these systen's at Millstone Unit 3 wem degraded, the public was probably protected by sheer luck rather than defense-in-depth.

Nuclear Regulatory Commission, Meeting Transcript, " Briefing on Millstone by Northeast Utilities and NRC," January 30,1997.

United States General Accounting Office, " Nuclear Regulation: I'reventing Problem Plants Requires More Effective NRC Action," GAO/RCED-97-145, May 1997.

September 22,1997 Union of Concerned Scientists Page1 S

k-

..~.-

ny,--.

---m-

,--,,,-e-,_---,_-.

.~.. -. _. - - - - - -

.N

. q. - '

s MILLSTONE UNIT 3 O NU and the NRC underestimated the risk to public health from operatwo of Millstone Unit 3 because of these longstandmg design problems.

a O NRC should implement aggressive enforcement policies for Millstone Unit 3. NU's history of -

- violations along with the NRC's identified failure to enforce regulations at Millstone warrant special measures to protect the public until such time that trust is restored in both organizations.

NU is legally obliged to operate Millstone Unit 3 in compliance with federal safety regulations. If the plant

= is restaned, UCS reccerer.cr.ds the NRC hold NU accountable using the following measures:.

. O Conducing its inspections ofthefacilityfor conpliance sofederalsafety regulations.

Millstone Unit 3 operated for so long with so many problems because the NRC audited the plant against NU's procedures and other documents rather than against federal safety regulations. 'Ihese NRC audits determined whether NU conducwd activities consistent with NU's policies without assuring that NU's policies conformed with federal safety regulations. 'Ihe focus of NRC inspections must be to determine if the plant satisfies federal safety regulations.

O Treating every NRC inspectionpnding as tw_g problems - the deficiency itself and the inplicit failure ofNU's quality assurance program to previously identiffcorred the depclency.

Nuclear power plant owners are required to administer quality assurance (QA) programs. Ecse QA programs incorporate the nuclear industry's defense-in-depth philosophy. Safety related work is performed by qualified individuals, cross checked by independent individuals, and inspected by intemal auditors. Safety equipment is inspected and tested on a periodic basis. In theory, an NRC inspector should not find any problems, After all, the plant is supposed to be in compliance with all federal safety regulations and the. QA program is the process intended to guarantee this -

compliance. 'Iherefore, any fmding by an NRC inspector indicates that d of the QA barriers failed to detect / correct the problem. It is as important to mend these QA barriers as it is to repair the -

fmding itself.

F L

O Requiring a mandatory plant shut down when the number of violations exceeds a well-defined.

andpr.-determined value.

The NRC classifies federal safety regulation violations as Severity I, II, III, and IV with Severity I ~

L being the most serious. The NRC should implement'a point program for Millstone Unit 3 featuring mandatory plant shut downs. For example, a Severity I violation could be 5 points, a Seventy II -

L violation could be 3 points, Severity III,2 points, and Severity IV, I point. If NU accumulates 5 points in any 12 month period for Millstone Unit 3, then the NRC should require en 6 = h shut down. The plant should remain shut down until it has fewer than 5 points in the previous 12 month period. Alternatively, the NRC should fully grant the actions requested in the 10 CFR 2.206

. petition filed on March 3,1997, by Ernest C. Hadley on behalf of Albert A. Cizek. *Ihese actions L

would have the same effect of preventing recurring compliance problems at Millstone Unit 3J Most, f

Jif not all, of the motor vehicle codes in the United States employ a point system to suspend or L

revoke the license of an irresponsible driver. "Ihe NRC should adopt equivalent provisions to..

L

. September 22,-1997 Union of Concerned Scientists -

Page 2 p

t u

i

-~

p, l

P y

r y

4 MILLSTONE UNIT 3 -

protect the public when a nuclear power plant is repeatedly operated in siolation of federal safety

. regulations.

~

' ne extended outage at Millstone has enabled NU to make many necessary repairs and upgrades. However,

~

its cost, estimated to be nearly $1 billion, may provide NU with an incentive for implementmg cost-saving measures which could trigger a relapse of the safety problems'. In addition, NU's efforts to restart Units 1 and 2 may distract the utility from concentratmg on the safe performance of Unit 3. nose possibilities '

make it all the more imperative that the NRC rigorously enforce federal safety regulations if public health is to be adequately protected In 1982, an accident at Millstone Unit 3 was calculated by a Congressional subcom:nittee to cause 23,000 j

fatalities within one year,38,000 subsequent cancer deaths, and a cleanup cost of $174 billion for decontamination, lost property, and relocation expenses.' nese figures do not account for population growth and inflation over the intervening 15 years. A reactor accident at Millstone Unit 3 would be a disaster for the local communities around the plant, for the state of Connecticut, and for the United States.

-After so many years of uocceptable performance at the facility, special measures are warranted to provide reasonable assurance that puidic health is protected until trust in NU, and em% in NRC, is restored

- UCS's specific findings regarding the axiliary feedwater and recirculation spray systems, the station blackout capability, and NU's risk assessnent are described in the following sections.

l-AUXILIARY FEEDWATER SYSTEM AT MILLSTONE UNIT 3 l;

The auxiliary feedwater (AFW) system provides coolitig water to the steam geterators when the normal i

feedwater supply is lost. He steam generators remove the heat produced by the reactor core during normal operation and after the plant is shut down. %c water in the primary loop flows through the reactor core,.

. picks up the heat produced by the fuel, and transports this energy to the steam generators. The heat from

- the primary loop water is transferred through the steam generator tubes to boil water in the ~Wy loop.

ne heat carried by the steam leaving the steam generators is normally transferred in the main E- '=x to l

water drawn from the ocean. Ahernatively, this heat can be dissipated to the atmosphere via the main steam L

safety valves or the atmospheric dump valves when the main condenser is unavailable. De normal ;

j feedwater system supplies water to the steam generators to compensate for the water being boiled away.

I-ne AFW system starts automatically to supply water to the steam generators when the normal feedwater supply is lost.'

l' p

[

U.S. House of Representatives Subcommittee on Oversight & Investigations, " Calculation of Reactor Accident Consequences (CRAC2) for U.S.' Nuclear Power Plants (Heahh Effects and Costs) Conditional on an SSTI Release," November 1,1982.

l Westinghouse Standard Technical Specifications, Bases Section 3.7.5, " Auxiliary Feedwater

.(AFW) System."

September 22,1997 Union of Concerned Scientists Page 3 l

--4 m ma-.

- -.m.m

-m s

=v mm

-,.<-%,v-w

._.7 f y,y

g-.e.

v.

. MILLSTONE UNIT 3 The AFW system performs an accident mitigating fonction for the following design bases events:.

.O-steam piping failure'.

' O ~ inadvertent opening of a steam generator reliefor safety valve

- O - loss of normal feedwater flow O: feedwater system pipe break L O steam generator tube failure:

-O loss of coolant accidents resulting from piping breaks within the reactor coolant pressure boundary O - loss of nonemergency ac power to station auxtharies 4

Problem In December 1996, NU notified thi NRC that the piping and associated supports for tie Unit 3 AFW

. system inside the containment building was not designed for its maximum temperature. & containment building's maximum temperature is 280*F while the AFW system was designed for M.ycr.tures up to

.100*F. NU concluded that temperatures ranging up.to the containment building's maximum temperature L may have created stresses above AFW system design limits which could have caused the piping or supports to fail. According to N'J, the AFW system "has not been in compliance with design basis requirementa -

since the initial operation of the plant."'

Conclusion

. Had an accident occurred which caused temperature inside the containment building to approach 280*F, the AFW piping or its supports may have failed. If the piping had failed, the consequences could have been twofold. First, the AFW system might not have been able to fulfill its safety function ~ of providmg water to the steam generators to remove the decay heat produced by the irradiated fuel in the reactor. The sustained inability to cool the reactor core could have led to fuel meltdown and containment failure. Second, the ruptured AFW piping could have provided an uncontested pathway for radioactivity to escape.-

Radioactivity released into the containment building during an accident could enter the broken section of AFW piping and travel through the piping to the atmospherec T he AFW system is one of the nat risk-significant systems at Millstone Unit 3. As such, it has been inspected, tested, and evaluated many times by NU and NRC since construction. Yet, despite all this attention, the faut that the system's original design was fundamentally and potentially fatally flawed went yea *~i for over 10 years. *Ihis system did not break or wear out - it has been impaired since the day the plant first operated.1hc plant's risk assessment prepared by NU and accepted by the NRC estimated the

. probability that the AFW system would be unavailable at 1 in 13,335.* Both NU and the NRC considered P

the AFW system to be highly reliable. In reality, the AFW system's originsi piping design was degraded to

' Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 96-044-00, December 4,1996.

. Letter from E. L Mroczka, Senior Vice President, Northeast Nuclear Energy Company, to Nuclear Regulatory Commission, " Millstone Nuclear Power Station, Unit No. 3 / Response to Generic

' Letter 88 20 / Individual Plant Examination for Severe Accident Vulnerabilities Summary Report Submittal," August 31,1990l September 23.1997 Union of Concerned Scientists ~

Page 4 t

.. -. = - - -

a n,

ow

.,n,-

l6:

.y 4 e

Q.

• 1 gp 1

- MILLSTONE UNIT 3 s

y.

the~ point wherti the system may have been unable to fulfill its safety' mission during an mech Even

~

worse, the failure of so vital a system could have increased an accident's severity by transporting radioactivity to the atmospheie.

RECIRCULATION SPRAY SYSTEM AT MILL 3 TONE UNIT 3:

The recirculation spray system, operating in conjunction with the quench spray system, is designed to limit the containment building's pressure and temperature' aAer an accident. In addition, these systems are_-

' designed to depressurize the containment buildmg to a subatmospheric pressure followmg an accident. The reduction in pressure limits the release of radioactivity to the environment. The recirculation spray system consists of two separate trains, each capable of meeting'the design and accident analysis bases.1he recirculation spray system pumps water taken from the containment sump and discharges it through heat

exchangers to the spray huders located in the upper regions of the containment building.'

Problems

~ NU informed the NRC in December 1996 that the recirculation spray system piping and supports were not.

=. adequately designed for thermal loads resulting from accident temperatures. The higher w..f seres would create stresses above design limits which could cause the piping to fail. In 1985, before the plant was -

initially licensed to operate, Stone & Webster, the architect / engineering firm for Millstone Unit 3, notified -

? NU that recirculation spray system temperatures higher than design values could result from a loss of servic.7 water system flow to o.c or more heat exchangers. According to NU, the " resolution of the loss'of

[ service water] condition wu overlooked."' NU subsequently determined that =*ecap*able stresses for c

recirculation spray system piping and supports could also result from the high terrperatures inside the containment building following an accident.'1hc recirculation system p! ping or supports could have failed L

due to either of these two mechanisms.

p After Millstone Unit 3 shut down in the spring of 1996, NRC inspectors observed temporary I-beams installed above three of the four recirculation spray system heat exchangers.. The NRC determined that the 0

. I beams might shake loose during on earthquake and fall onto the heat exchangers, thus creating the r

potential for rendering at least one heat exchanger in each recirculation spray system train inoperable. The I beams were also located above the recirculation spray system suction valves from the contamment sump creating the potential for a breach of the containment building's integrity during an carthquake NU - '

- estimated that the I-beams had been installed for several years.

. Westinghouse Standard Technical Specifications, Bases Section 3,6.6E, " Recirculation Spray (RS) p

System (Subatmospheric)."

L l

i --

. Northeast btilities to Nuclear Regulatory Commission, Licensee Event Report 96-007 02, December 13,1996.

L

^

Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 96-007-02,-

December 13,1996.

l

[ Nuclear Regulatory Commission, Special Inspection of Engineering and Licensing Activities at p

- Millstone Nuclear Power S4 tion, September 1996, t

1L September 22i1997:

Union of Concerned Scientists Page 5 n

-.-.i

MILLSTONE UNIT 3 In November 1996, NU informed the NRC that the containment sumps were considered inoperable due to gaps in their screens. He containment sump is separated by a mesh screen into an "A" and a "B" train sump. NU discovered two gaps in the screen measuring % inch by 4 feet and 2 inches by 2 inches. He gaps in the mesh screen created the potential for debris in the containment sump to block the flow in both of the recirculation spray system trains."

In February 1997, NU informed the NRC that a water hammer could occur in the recirculation spray system if the recirculation spray system pumps were operated in accordance with the Emergency Operating Procedures for an accident, it could also occur if the pumps started, stopped runnmg, and were then restarted. Under these conditions, water could drain from system piping after the pumps stopped running.

When the pumps resumed operating, water would nish to fill the empty piping natil it encountered, ane!

" hammered," the first closed valve or filled segment of piping. NU concluded that a water hammer of this kind could brutk the recirculatioa spray system's piping. He damage could create a pathway for radioactivity to escape the containment building, which would necessitate closure of the containment isolation valves in the recirculatien spray system. Rese valves may also be adversely affected by the water hammer and its consequences, potentially inhibiting their ability to block a release pathway. In additica, NU detennined that a harsh environment could be created in the Emergency Safety Features Building if high temperature water from the containment sump flooded the building as a result of recirculation spray system pressure piping failure."

In April 1997, NU informed the NRC that bubbles could fonn in the piping to the recirculation spray system pumps if the water in the containment sump was at high temprature such as could occur following an accident. If this condition occu Ted, the recirculation spray system would not be capable of supplying the minimum volume of cooling water assumed in the containment analysis."

Conclusion ne Millstone Unit 3 risk asse:sment indicated that failure of the recirculation spray system is a major contributor to the chances of core meltdown." It is one of the most risk-significant systems at Millstone Unit 3. Like the AFW system discussed earlier, it has been inspected, tested, and evaluated many times by NU and tae NRC since construction. Yet, also like the AFW systeru, the fact that the original design wn fundamentally and potentially fatally fla,ved went undetected for over 10 years.

NRC Daily Event Report Event No. 31290, November 7,1996.

Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 97-003-00, February 11,1997.

NRC aily Event Report Event No. 32166, April 16,1997.

Letter from E. J. Mroczka, Senior Vice President, Northeast Nuclear Energy Company, to Nuclear Regulatory Commission, " Millstone Nuclear Power Station, Unit No. 3 / Response to Generic Letter 88-20 / Individual Plant Examination for Severe Accident Vulnerabilities Summary Repost l

Submittal," t.ugust 31,1990.

September 22,1997 Union of Concerned Scientists Page 6 i

- ~. - -

p.s= Q

a g

MILLSTONE UNIT 3 m

NU's own assessent of the severity of the piping design problem was that, "Had the plant expesr.ced a i design basis accid.mt in containment such as a LOCA or a HELB, then the potential existed that these i

systems may not Iave been able to fulfill their required safety function.""

According to the'NRC, 'The as-found condition of the temporary I beams could have had a significant c

impact on the safe operation of the facility by creating a common cause failure of both trains of the RSS." '

1 If the recirculation spray system survived the falling I-beams, the NRC concluded that gaps in the-

containment surnp screen created the possibility that all of the recirculation spray system pumps would be disabled by debris."

The recirculation spray system was tested and inspected by NU and the NRC from the time that the plant was licensed in 1986 until it was shut down in March 1996. The system passed all the tests and inspections, yet might have failed to perform its intended function if an accident had occurred. 'Ihe system

- has only one function - to mitigate an accident - yet tim success of that vital furstion was not assured.

STATION BLACKOUT PROVISIONS FOR MILLSTONE UNIT 3 In 1987, the NRC required NU to take actions to enhance Millstone Unit 3's ability to cope with a -

postulated station blackout event. *Ihis action was taken aAct the NRC reviewed a probabilistic risk -

- assessment provided by NU which showed that station blackout was the Lighest contributor to a serious -

reactor accident at the plant." A station blackout, such as the event experienced at the Vogtle nuclear plant

,in March 1990, involves the loss of the normal DC power supply and the emergency AC power supply with 1the results that only DC power from the station's batteries is available. Because many safety systems rely on AC power cither directly or indirectly (e.g., for support systems), a station blackout disables most of the

_ plant's safety systems." i L

In August 1990, NU submitted an Individual Plant Examination (IPE) for the riske from Millstone Unit 3 1

7 NU concluded: " Station blackout seauences were found not to be major contribmors to core melt frequency in the (plant safety study], but have been shown to be important contributors to larne scale fission oroduct releases and nublic risk."'"(emphasis added]

Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 96-007-02, December 13,1996, Nuclear Regulatory Commission, Special Inspection of Engineering and Licensing Activities at Millstone Nuclear Power Station, September 1996..

NRC Daily Event Report Event No. 31290, November 7,1996.

. Nuclear Regulatory Commission Press Release No. 87-29, "NRC Staff Asks For Additional Measures to Protect Against Station Blackout at Millstone 3 Nuclear Plant," February 24,1987.

Nuclear Regulatory Commission, NUREG-1560 Vol. 2, " Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant Performance," November 1996.

Letter from E. L Mroczka, Senior Vice President, Northeast Nuclear Energy Company, to Nuclear September 22,- 19971 Union of Concerned Scientists Page 7 h

1

-m-

- - - ~

~ * -.

eu

-m c=

m-,

r,,

.c..-

-,-w-,1m,

3,,.

- *y r

MILLSTONE UNIT 3 The initiating event in most station blackout scenarios is loss of power from the electrical grid, which is the normal AL pcwer supply. Of the 21 plants like hiillstone Unit 3 (e g., Westinghouse pressurized water reactors with four primary coolant loops), Millstone Unit 3 has the second h!ghest probability for loss of grid power."

- Probleen In December 1996, NU notified the NRC that it had comphted a review of the options available to ensure the availability of the station blackout (SBO) generator at any time during the postulated 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> loss of off-site power (LOOP) and had determined that the best solution was to modify the design of the SBO system. -

As proposed, the modification will require operator actions within the first hour after a I.OOP to power the SBO auxiliaries from either the SBO generator or from another diesel generator his modification would ensure that the design of the SBO system is adequate for the entire postulated 8 hour9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> SBO case. NU conunitted to completion of this procedure revision prior to restarting the plant."

Conclusion NU and NRC have long recognized station blackout as being a procursor to a serious reactor accident at Millstone Unit 3. Despite knowledge of the importance of mitigating a station blackout event,,NU operated the plant for years without reasonable assurance that the station blackout generator would function when needed. Despite knowledge of the importance of the station blackout generator to risk reduction at Millstone, the NRC did not ensure that NU fulfilled its licensing commitments.

RISK ASSESSMENT FOR MILLSTONE UNIT 3 In Novernber 1988, the NRC required all licensees, including NU, to perform an Individual Plant Examination (IPE). De IPE is a probabilistic risk analysis (PRA) of postulated internal events (e.g.,

equ:pment failures, etc.) leading to reactor core damage. The IPE/PRA results r:an proside the foundation for the increased use of PRA in risk-informed regulations "

According to the NRC, a quality PRA assumes that the plant is operating within its Technical Specifications and other regulatory requirements and that the design and construction of the plant are adequate."

Regulatory Commission, " Millstone Nuclear Power Station, Unit No. 3 / Response to Generic Letter 88 20 / Individual Plant Examination for Severe Accident Vulnerabilities Summary Report Submittal," August 31,1990.

Nuclear Regulatory Commission, NUREG-1560 Vol. 2, " Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant Performance," November 1996.

letter from M. H. Brothers, Director - Millstone Unit No. 3, Northeast Nuclear Energy Company, to Nuclear Regulatory Commission, December 20,1996 Nuclear Regulatory Commission, NUREG-1560 Vol.1, " Individual Plant Examination Program:

Perspectives on Reactor Safety and Plant Performance," November 1996.

Nuclear Regulatory Commission, NUREG-1560 Vol. 2, " Individual Plant Exam' ation Prog:am:

m September 22,1997.

Union of Concerned Scientists Page 8

)

~_. ___.. - _ _ _ _. _.. _. _ _ _ _ _..... _. _. _ _.

'k_ O i 7,

^

MILLSTONE UNIT 3-

in August 1990,' NU submitted its IPE/PRA for Millstone Unit 3 to the NRC with these statements;"

"Accordingly, we hereby certify that: (1) MNo. 3 Level Ill "Livinn" -

'~

234 in conjunction with this submittal, meets the intent of the generic letter, especially concermng utility staffinvolvement; (2) it reflects current plant desima and oneration. and (3) results re.

being submitted as soon as completed, on a shorter schedule than 3 years, as committed in the July

- 27,1989 initial m."(emphasis tdded] -

and-i

' " Based on numerous updates to the PRA model, the living PRA program, and ws.eAMon of reviewer comments, is a reasonahta renresentation of the actual risk nrefile at MP3."[ emphasis added]

Probinas Afbr Millstone Unit 3 shut down in the spring of 1996, NRC inspectors conducted a special inspection.

_1h s spec al nspect on d scovered; i

i i i

i O " operating, surveillance, and maintenanco practices or procedures that were inconsistent with the -

descriptions in the UFSAR"[ Updated Final Safety Analysis Report]

O " installed equipment or actual plant configurations that differed from the UFSAk isriptions" O 'uc licensee [NU) failed to identify necessary changes to the Technical Specifications (TSs),

resulting in plant operation with inoperable equioment" O "the licensee failed to consider [ vendor technical manual] information in the design application of angle type [ solenoid operated _ valves) as conwnment isolation valves" with the result that "the

[ solenoid operated valves] were inoperable since initial installation until this design issue was

^

identified on March 30,1996" O "the licensee found that 106 [Rosemount] transmitters installed in MP3 and 35 transmitters installed in MP2, still had shipping caps" which had not been removed prior to their use 4

Pntrectives on Reactor Safety and Plant Performance," November 1996.

Letter from E. J. Mroczka, Senior Vice President, Northeast Nuclear Energy Company, to Nuclear Regulatory Commission, '_' Millstone Nuclear Power Station, Unit No. 3 / Response to Generic Letter 88 20 / Individual Plant Examination for Severe Accident Vulnerabilities Summary Renot t Submittal," August 31,1990.

Nuclear Regulatory Commission, Special Inspection of Engineering and Licensing Activities at Millstow Nuclear Power Station, September 1996.

September 22,1997 -

Union of Concerned Scientists -

Page 9

,-w,--

ern-a,.-

e,

-.~

v

% -ep-w,-

-r-e 4

i y.; ;y :

j

~

s

-MILLSTONE UNIT 3 AAer Millstone Unit 3 was shut down, NU informed the NRC that:'

O "the 18 month [125 volt] battery surveillance procedure did not include checking the torquing of batterj connection against the manufacturer's is.o.T.er.ded torque value as required" by the Technical Specifntions and that "the 125 volt batteries should have been declared inoperable""

i O ' "the 125 voit battery charger surveillance testing was being performed in a manner that was not in verbatim compliance with the TS" [Tec!mical Specifications] and that because "previously.

performed surveillance were not acceptable, the 125 voit battery chargers should have been i

declared inoperable and the appropriate Limiting Condition for Operation (LCO) should have been entered *

O "the performance of 480 volt molded case circuit breakers (MCCB) surveillance testing was being performed in a manner not in verbatim compliance with the Technical Specifications" and that the failure "could haw resulted in a loss of safety function" by this safety equipment" O "the RHR [ residual heat removal] System Suction Containment Isolation Valves had been opened in Mode 4 in accordance with the uait operatirg procedures to provide a flow path for cooldown to cold shutdown as required by plant design, No allowance is provide in [ Technical] Specification 3,6,1,1 for these valves to be opened in Mode 4'#

Conclusions From initial opc* ration in 1986 until shut down in March 1996, NU did not operate Millstone Unit 3 within its Technical Specifications, Operating License, and other regulatory requirements, The NRC's special

. inspection report and NU's licensee event reports document numerous violations dating back to initial plant startup.

'Ihe design and construction of Millstone Unit 3 are inadequate. The NRC's special inspection report and

- the problems affecting the service water, recirculation spray, and auxiliary feedwater systa.ms suggest numerous design flaws dati4 ack to original plant construction.

b l-Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 97-001-00, February 3,1997, l-Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 97-002-00, February 7,1997, Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Report 97-004-00, February 11,1997.

Northeast Utilities to Nuclear Regulatory Commission, Licensee Event Repost 97-006-00, February 17,1997, September 22,1997 :

Union of Concerned Scientists Page 10 Ip

--J w-6* d T w.esw.4-

w. &

y_

c nmq.

g

-.Hu--.

q w

.~

p w,,.

p

., -+e T

W W

T T'

" T P

fr f-y 7

er

4r* t

+

?.flLLSTONE UNIT 3 Because Millstone Unit 3 was not operated within its Technical Spinats; and had design and can xtion inadequacies, the plant's Individual Plant Exandnation/Probabilistic Risk Assessment was 53 -

(Meu y risk assessment according to the NRC's own standards. However, this flawed risk assessment was

~

avafod by the NRC,

- NU certified to the NRC that the Millstone Unit 3 risk assessment reflected current plant design and operatica. Documentation by NRC and NU demonstrates this certification was questionable.

NU also informed the NRC that it was confident that the risk assessmer.t was a reasonable representation of the risk from operating the facility, Documentation by the NRC and NU suggests that NU was presumptuous.

t t

i r

i l

L September 22,1997 -

Union of Concerned Scientists Page11 r

i

.