Text

Citizens Awareness Network'S Formal Request for Enforcement Action Against Vermont Yankee.* Requests That OL Be Suspended Until Facility Subjected to Independent Safety Analysis Review,Per 10CFR2.206
	ML20206T973
Person / Time
Site:	Vermont Yankee
Issue date:	05/27/1998
From:	Block J; CITIZENS AWARENESS NETWORK
To:	; NRC COMMISSION (OCM)
Shared Package
ML20206T924	List: DD-98-13, Forwards Director'S Decision DD-98-13 Denying 980527 Petition to Suspend OL Or,In Alternative,Modify License Requiring Util to Certify That All Safety Sys & All Security Sys Are Fully Operable Before Restart; ML20206T973;
References
	2.206, DD-98-13, NUDOCS 9902120111
	Download: ML20206T973 (50)
	v • d • e

__ _

' ~

00CKETED USHRC UNITED STATES OF AMERICA Before the NUCLEAR REGULATORY COMMISSIONsu OFT l.e;IE r 3 ;

ADJUE E nF in the matter of Vermont Yankee Nuclear Power Sution Docket no. 50-271 (Petition for Enforcement Action)- ,

May 27,1998 CITIZENS AWAREN6SS NETWORK'S FORMAL REOUEST FOR ENFORCEMENT ACTION AGAINST VERMONT YANKFR Due to chronic systemic mismanagement of the Vermont Yankee Nuclear Power Station which has resulted in diminished engineering consenation adversely affecting safety margins and security, Citizens Awareness Network, Inc.

(CAN), pursuant to 10 CFR 2.206, formally requests the United States Nuclear Regulatory Commission (NRC), to take immediate enforcement action by suspending the operating license for Vermont Yankee until the entire facility has been subjected to an independent safety analysis review similar to the one conducted at Maine Yankee Atomic Power Station. In the altemative, CAN requests that the NRC immediately act to modify the operating license for the facility by requiring that, prior to restart: (1) Vennont Yankee management must certify under oath that all back-up safety systems and all security systems are fully operable, and all safety systems and security systems meet and comply with NRC requirements; (2) Vermont Yankee be held to compliance with3]l of the restart N

9902120111 981207 PDR G

ADOCK 0500o271 PDR y

A $

' O M

2 criteria and protocols in the NRC manual; (3) Vennont Yankee only be allowed to resume operations (following refueling) after the NRC has conducted a " vertical slice" examination of the degree to which the new design basis documents (DBDs) and updated Final Safety Analysis Report (FSAR) accurately describe at least two of the primary safety systems for the Vermont Yankee reactor; and (4) that, once operation has resumes, Vennont Yankee only be allowed.to continue

' operation for so long as it adheres to its schedule for coming into compliance and completing the DBD and FSAR project. Additionally, CAN requests, (5) that the NRC hold a public hearing prior to restart to discuss the changes to the torus, Vermont Yankee's DBD and FSAR projects, and Vermont Yankee's scheduled completion of these projects in relation to operational safety.

Supporting this request for enforcement action and appropriate relief, CAN

! sets forth as follows:

1. Single-Failure Criterion Challenged. 1 Vermont Yankee Nuclear Power Station, like all nuclear power reactors i under the NRC's regulatory authority, relies upon " defense-in-depth" principles to assure adequate protection of public health and safety. The sine qua non of this approach is the maintenance in good working order of redundant emergency equipment and multiple barriers to the inadvertent release of radioactivity.

i i

f i .

3 The NRC applies what it calls a " single-failure criterion" in order to determine how much redundancy and how many barriers are necessary to assure safe operation of a nuclear reactor facility. Under NRC regulations implementi

the " single failure criterion" approach, facilities such as Vermont Yankee must be P

designed so that the failure of any single emergency component or Any single

~

operator error will not have an adverse impact upon public health.and safety.

Under NRC regulations, the application of the term " safety margin" implicitly relies upon the fact that there are a pre-existing failures of(or deficiencies in) safety-related equipment.'

Unfortunately, Vermont Yankee's volume oflong-standing deficiencies in safety-related equipment strongly suggest that the single-failure criterion may have been violated.2 This results in a lack of engineering conservation in the safety j

systems. Such a lack of conservation completely undermines the assumptions of defense-in-depth by eroding necessary safety margins implicit in this approach to safeguarding occupational and public health and safety.

3 Nuclear engineer David Lochbaum of the Union of Concerned Scientists provides an instructive analysis of the effects of eroded safety margins in relation to operation with degraded fuel cladding. David Lochbaum, Union of Concerned Scientists, " Potential Nuclear Safety Hazard: Reactor Operation with Failed Fuel Cladding" at 2-4, 6-7, 8-15, unnumbered attachment to Letter from D. Lochbaum, Union of Concerned Scientists, Washington, D.C., to Debby Katz, President, CAN, et al., (May 14, 1998), attached hereto.

8 See id., David Lochbaum's analysis of Vermont Yankee DERs and other material prepared for CAN, Letter from D. Lochbaum, Union of Concerned Scientists, Washington, D.C., to Debby Katt., President, CAN, (May 14,1998), attached hereto.

}

)

4 CAN's analysis of the Vermont Yankee Daily Event Reports (DERs)

(prepared by nuclear engineer David Lochbaum of Union of Concerned Scien reveals many degraded conditions existing simultaneously with degraded conditions in other safety-related systems. CAN was not able to find my evidence that Vermont Yankee considered the impact of the cumulative effect of so ma concurrent degraded conditions on the safety margins at the plant. CAN believes that there is an " unsafety in numbers" given how many degraded conditions have been found in the DERs we examined. Numerous pre-existing failures of safety related equipment are documented in the Vermont Yankee DER analysis attached to this pe:!

in. For this reason, the NRC should intmediately suspend Vermont Yankee's operating license until Vermont Yankee has completely resolved these problems, or, at a mmimum, in the alternative, modify Vermont Yankee's operating license to require that Vermont Yankee management certify under oath that all of these problems have been resolved, and implement the other for ofrelief suggested throughout this petition

2. Inadequate Safety Evaluations.

i NRC regulations at 10 CFR f 50.59 require licensees to evaluate proposed changes to a nuclear facility and its procedures to detemiine if such changes may increase the probability and/or consequences of an accident or introduce a previously unanalyzed accident scenario. If so, the licensee must seek and obtain

5 NRC approval before implementing such changes. 10 CFR i 50.59. There is evidence that Vermont Yankee performed inadequate safety evaluations.'

CAN contends that it is significant that inadequate safety evaluations are a common factor in troubled nuclear reactor facilities-such as Millstone, Connecticut Yankee and Maine Yankee-prior to closures accompanied by extremely expensive safety problems. Because of this pattem, the NRC should take immediate action in this case to assure that Vennont Yankee's safety evaluations are adequate prior to allowing a restart. Failure to have adequate j safety evaluations is an adequate reason for suspending Vermont Yankee's license l

to operate until compliance with regulations is assured. At a minimum in this

. I 1

regard, the NRC should enforce against Vermont Yankee the complete restart '

criteria contained in the NRC manual, and require that Vermont Yankee management certify under oath prior to restart that all safety evaluations prepared for Vermont Yankee are correct, adequate, and meet NRC's regulatory requirements. The NRC should also implement the other alternative remedies suggested herein.

3. Potential Over-Reliance on Yankee Atomic Electric Company Analyses.

1 i

8 See /d. Several of the DERs indicated that the Vermont Yankee licensee perfomied inadequate safety evaluations. For example, refer to DERs 31906, 31949, 32106, and 34005. .

6 In late 1995, Robert Pollard, nuclear safety engineer for the Union of Concerned Scientists, turned over to the NRC an anonymous allegation contendin that a safety analysis which Yankee Atomic Electric Company engineering services prepared for Maine Yankee Atomic Power Company was seriously flawed. In the spring of 1997, the NRC issued a show-cause order to Yankee Atomic demanding that the companyjustify why it should be allowed.to continue providing engineering services to nuclear utilities. The NRC based this action on a pattern of errors and weaknesses within Yankee Atomic Electric Company's organization revealed in the course of the NRC's investigation of the Maine Yankee allegations.

There is evidence that Vermont Yankee has been relying upon Yankee Atomic Electric Company to conduct engineering analyses.d This situation means that there is a potential that Vennont Yankee may have the same kind of serious compromises in safety systems that existed at Maine Yankee and other facilities which relied upon Yankee Atomic Electric Company's engineering analyses. The kind ofloss of engineering conservatism which took place at other (now closed) facilities using Yankee Atornic Electric Company's engineering analyses

' See id A number of Vermont Yankee's DERs refer to analyses which Yankee Atoinic Electric Company apparently did for Vermont Yankee. Although the DERs do not specify who prepared these analyses, it is quite possible that Yankee Atomic was involved. Refer to DERs 31915,32106,33259,33502, and 34145.

T 7

necessitates that the NRC suspend Vennont Yankee's license to operate until assurance may be obtained that al_l analyses which Yankee Atomic prepared for Vermont Yankee have been reviewed by the NRC staff to be certain that they have been done properly. At a minimum, the NRC should require that Vennont Yankee certify under oath that all of the engineering analyses on file for Vermont Yankee are correct, accurate, and in complete compliance with NRC regulations, and implement the other alternative reliefrequested herein.

4.

Inadequate Operational Experience Review Program.

Following the accident at Three Mile Island in 1979, the NRC required all nuclear power reactor licensees to develop and implement an operational experience review program. The purpose of this program is to require that each licensee regularly look at an industry-wide sample of events, and evaluate whether changes are necessary at a particular facility.

There is evidence strongly suggesting that Vermont Yankee does not have an adequate operational experience review program.5 Failure to conduct an adequate operational experience review program is a violation of NRC regulations.

Based upon the TMl experience, such a failure inexorably leads to compromised engineering conservation in safety systems, and the eventual failure of such s See /d Several of the DERs suggest that the Vennent Yankee licensee has an inadequate dpeiational experience review program. For example, refer to DERs 31923, 32016, and 33789. ,

8 systems during a serious emergency event. Vermont Yankee's operating license should be suspended until it has provided the NRC with adequate evidence that it has a fully-functional and adequate operational experience review program in place. At a minimum, prior to restart, the NRC should require that Vermont Yankee certify under oath that it has an adequate operational experience review program in place, and implement the other attemative relief requested herein.

5. High Potential for Other Serious Safety Problems.

Vermont Yankee has a number of serious problems in additional to those described above which, when taken in conjunction with the systemic problems, warrant the NRC's immediate enforcement action. Vermont Yankee has experienced a large number of cable separation issues, several problems with high energy line break events in the turbine building, and several problems with intemal flooding. Given that Vermont Yankee's safety evaluation and operational experience review programs do not seem adequate, and given that it is likely that Vermont Yankee relied on Yankee Atomic Electric Company's engineering analyses for many years,ilig reasonable to exnect that there are many more desien and licensine bases nroblems yet e to be dealt with 31 Vermont Yankee. Such problems are a direct result of these defective programs.

For many years, Vermont Yankee used these defective programs for all systems at the reactor facility, not just the ones implicated by the DERs reviewed

9 for this petition. Therefore it is reasonable to conclude that the problems and deficiencies noted in this regard apply to all safety-related systems at Vermont Yankee.

The NRC required the Salem and Millstone reactor licensees to certify that the safety-related systems at these facilities were within their design and lic bases before pennitting them to be' restarted when pervasive ar>d systemic problems very similar to those at Vermont Yankee were identified at these facilities. David Lochbaum of Union of Concerned Scientists conclud analysis of Vermont Yankee's DERs indicates that similar assurance may well be warranted in this matter. Thus, the NRC should suspend Vermont Yankee's license to operate until it has adequate assurance that the safety-related systems Vermont Yankee are within their design and licensing bases. At a minimum, the NRC should implement the restart criteria in its manual prior to allowing Vermont Yankee to restart, the NRC should require that Vermont Yankee management certify under oath that the safety-related systems at Vermont Yankee are within their design and licensing bases, and the NRC should implement the other altemative forms of reliefrequested herein.

6. Lack of Adequate Perimeter Security.

Evidence of Vermont Yankee's completely lax perimeter security shows that management did not adequately respond to all of the implications of the recent A

10 incident involving a former Vennont Yankee contractor's major psychotic episode culminating in a murderous shooting spree, suicide, and the discovery of his booby-trapped farm filled with deadly weapons, munitions, and explosives.' NRC inspectors caused a major breech in the securitv system by having 5 out of 8 successfully invade the security perimeter, including one inspector who got through the metal detector with a gun. This shows that not only does Vermont Yankee lack the ability to screen-out potentially dangerous psychotics from its i

workforce, it also cannot protect the facility from acts .of terrorism and/or 1

sabotage. After all, the NRC inspectors were not real invaders, nor were they l

armed with intent to invade the facility at any cost. The recent test of seemity, even without consideration of the past experience with inadequate screening of employees, boldly highlights Vennont Yankee's inadequate perimeter security.

For this reason, the NRC should suspend Vermont Yankee's license to operate until Vennont Yankee can demonstrate compliance with NRC regulations on security and pass the attempted entry test. At a minimum, prior to restan following the current refueling outage, the NRC should require that Vermont Yankee management certify under oath the' have a security system in place

' See NRC Inspection Repon No. 50-271/98-05 dated April 13,1998, discussed in item l 44 in the attached analysis.

11 which meets all of NRC's regulations and requirement, and implement all other alternative relief requested herein.

7. Operation Should Be Conditioned On The DBD And FSAR Schedule.

Vermont Yankee should be allowed to operate only if it meets the scheduling obligations it set up for completing Design Basis Documents (DBDs) and updating the FSAR for the facili'y. t Vermont Yankee's operating license should be modified to impose license conditions to the effect that Vermont Yankee must meet the deadlines for approval ofits Design Basis Documents established by Vermont Yankee as follows:

23 DBDs approved in Fall'98; 10 DBDs validated by early 1999; e

All 23 DBDs validated by year end 1999; e

Completion of the FSAR verification process by year end 1998 Vermont Yankee The limiting condition should specify that in the event Vermont Yankee fails to meet any one of these cbligations, the facility must immediately shut down until such time as that obligation has been met.'

' As an alternative to imposition of a license condition, the NRC couldissue an order to this effect. Vermont Yankee's lagging efforts at regulatory compliance easily justify the issuance of such an order. During ths March enforcement conference. Vermont Yankee t

confessed hal 11 had tied a rather latse number ofitsms to its "Imorovsd. Technical Specifications Proiect", hul did aqi revisit the individual ilsms Ehtn they deferred ihn salits proiect The use, in this case, of either a license condition or an order merely l

12 8.

A " Vertical Slice" Safety Assessment Is Necessary To Be Certain That Vermont Yankee's DBD and FSAR Project Has Accurately Captured The Actual Operating Condition of the Facilities' Safety Systems.

The NRC should conduct a " vertical slice assessment" for at least two o the systems covered by the first ' DBDs which Vermont Yankee approved and validated. Throughout the course of the March 2,1998, enforcement conference, Vermont Yankee insisted that they had achieved " rigor" in conducting this process. At the Enforcement Conference, Vermont Yankee's CEO, Mr. Barkhurst, told the NRC that their (NRC staff's) conclusion that Vennont Yankee was una to find the problems identified by the A/E team inspection was "a little harsh."

Perhaps he is right. Perhaps the NRC is right. There is only one rational way to find out: NRC must now go in, after Vermont Yankee found " rigor" in the DBD process, and actually take a look at one of the " rigorous" DBDs in the context of supponing two safety systems. In the event the NRC team finds problems similar to those iden'.ified during the A/E inspection, Mr. Barkhurst will be proven wrong, and the reactor should be immediately shut down until the NRC has adequate assurances that they really have "found rigor." To date, the only " rigor" Vennont Yankee has demonstrated is the rigorous defense of their " honor" during ensures that Vermont Yankee will keep all of its promises in a matter crucial to maintaining adequate engineering conservation throughout all of its safety systems.

Vermont Yankee developed the schedule. See, e.g. Vermont Yankee's Slide 'resentation, Region I Enforcement Conference at Slide AV-29 (March 2,1998). CAN's petition only asks that the NRC take reasoncble steps to hQld Vermont Yankee to its promises.

13 the enforcement conference. Unfortunately," honor"is not a component of one of 1

the safety systems which Vermont Yankee needs to rigorously document and maintain in good working order to assure public and occupational health and safety. In order to effectively assure public and occupational health and safety due to Vermont Yankee operations, this alternative request for relief should be implemented, and also all other alternative reliefrequested herein. .

9.

The NRC should conduct a public hearing in Brattleboro, Verment, to inform the public about changes to the torus, compliance with the DBD and FSAR process, results of the A/E evaluation,.results of an NRC

" vertical slice" analysis of Vermont Yankee's first sets of DBDs, and the implications for public health and safety of Vermont Yankee's schedule for complying with the requirement that it verify and update all DBDs and the FSAR.

Vermont Yankee's schedule 8 shows that 5 DBDs will be approved and validated before the FSAR verification process has even begun. Many other DBDs will be approved and validated during and after the FSAR verification process. Even if one assumes that the fidelity and consistency of both of these projects (DBD development and FSAR verification) is unimpeachable, nothine in Vermont Yankee's presentation to the NRC shows that the two projects ge linked together in any way. Although the two projects are crucially interdependent, Vennont Yankee has not shown how they are linked. He FSAR is Vennont

' Vermont Yankee's presentation at Region I Enforcement Conference at Slide AV-29 (March 2,1998).

14 Yankee's primary licensing document which indicates how the reactor's design meets all regulatory requirements (safety, security, etc.). The DBDs will be the primary design documents for Vennont Yankee's systems which indicate how the designs meet all design requirements. During either project, any single discrepancy has the very real potential for negatively affecting the quality and consistency of the other project. Yet, Vermont Yankee has not identified how it will interface the two projects in order to cross confinn the results. This matter warrants suspension of the operating license until Vennont Yankee explains how it intends to integrate these system. At a minimum, it warrants a robust public discussion and the other alternative reliefrequested herein.

10.

CAN also requests that the NRC hold the public hearing, conduct a vertical slice analysis, and issue a Final Director's Decision on this petition before allowing Vermont Yankee to restart from the current refueling outage. .

There is a crucial need for the public to have reasonable assurance that, at a minimum, Vermont Yankee has adequately addressed in a timely manner the concerns the NRC's identified during the A/E inspection. CAN asks that the NRC be prepared to address at the public meeting' the following questions for all of the

)

' CAN requests that the NRC staff continue, throughout the rest of the schedule for completion of the DBDs and FSAR, to review the LERs and DERs to monitor whether these questions have proper ar.d adequate answers. Such NRC monitoring may be complemented by any similar efforts to adequately and effectively monitor this process along the suggested lines which might suitably be undertaken by Vermont's State Nuclear Engineer William Sherman.

l

15 Licensee Event Reports (and Daily Event Repons) issued during the current projects:

1. Has a DBD been approved and validated for this system?

2. Ifyes, why didn't the DBD effort uncover / prevent the problem? -

This request is a logical extension of those preceding it, and should be implemented along with the other alternative relief requested herein. .

Conclusion.

For the reasons set forth above, the NRC should immediately commence enforcement action against Vermont Yankee Nuclear Power Station under 10 CFR 2.206, and provide the requested relief.

Respectfully submitted:

Deborah B. Katz, President, Citizens Awareness Network,Inc.

P.O. Box 3023 Charlemont, MA 01339-3023 (413) 339-5781 (voice)

(413) 339-8768 (fax)

Jonathan M. Block, Attorney Main Street P.O. Box 566 Putney, VT 05346-0566 (802) 387-2646 (voice)

(802)387-2667 (fax)

B h

/ Jonathan M. Block,

/ Attomey for CAN

UNION OF CONCERNED SCIENTISTS May 14,1998 Ms. Rosemary Bassilakis Mr. Jonathan Block Ms. Debby Katz Citizens Awareness Network PO Box 566 54 Old Tumpike Road Citizens Awareness Network Putney, VY 05346-0566 PO Box 83 Haddam, CT 06438 Shelbume Falls, MA 03170

Dear Rosemary,

Jon, and Debby: '

Per your request, I reviewed Vermont Yankee Daily Event Report (DER) information for the past year.

My review did not include every DER submitted by the Vermont Yankee licensee for this period, but it covered the majority of the reports. I also reviewed a recent NRC Inspection Report on a problem at the plant. My comr:,ents on individual DERs and this Inspection Report are provided on the attachment. I have the following general observations and conclusions:

O Single-Fallure Criterion Challenged: Nuclear power plants like Vermont Yankee rely on defense-m-depth principles to provide adequate protection ofpublic health and safety. These principles feature redundant emergency equipment and multiple barriers. In order to determine how much redundancy and how many barriers are necessary, a single-failure criterion is applied. The plants must be designed so that the single failure of any emergency component or any single operator action will not adversely affect public health and safety. In other words, the oft-cited term " safety margin" when applied to any nuclear power plant is implicitly based on po pre-existing failures of safety related equipment.

The volume oflongstanding deficiencies at Vermont Yankee strongly suggests that this single-failure criterion may have been violated. Many of these DERs involve degraded conditions that existed at the same time as the degraded conditions in the other DERs. It is not apparent that this licensee has considered the impact of the cumulative affect of so many concurrent degraded conditions on the safety margins at the plant. There may be " unsafety in numbers" of degraded conditions in these DERs. Thera were numerous pre-existing failures of safety related equipment.

O Inadequate Safety Evaluations: Part 50.59 to Title 10 of the Code of Federal Regulations requires all licensees to evaluate proposed changes to their plants or its procedures to determine if the changes could increase the probability and/or consequences of an accident or could introduce a new accident scenario. If so, then the regulation requires the licensees to seek and obtain NRC approval before implementing the changes.

Several of the DERs indicated that the Vermont Yankee licensee performed inadequate safety evaluations. For example, refer to DERs 31906,31949,32106, and 34005. Inadequate safety evaluations are a common factor in troubled nuclear plants such as Millstone and both Connecticut Yankee and Maine Yankee before their closures.

Washington Office: 1616 P Street NW Suite 310 . Washington DC 20036-1495 e 202 332 0900 . FAX: 202 332 0905 Carnbridge Headquarters: Two Bratue Square . Carnbridge MA 02238 9105 617 547-5552 . FAX: 617 864 9405

May 14,1998 Page 2 of 2 D

Potential Over-Reliance on Yankee Atomic Electric Company:In late 1995, an anonymous allegation contending that a safety analysis prepared by Yankee Atomic for Maine Yankee was tumed over to the NRC. In spring 1997, the NRC issued a show-cause order to Yankee Atomic demanding that the companyjustify why it should be allowed to continue providing engineering services to nuclear utilities. The NRC based this action on a pattem of errors and weaknesses within Yankee Atomic's organization revealed in its investigation of the Maine Yankee allegations.

Several of the DERs involve defective analyses for Vermont Yankee. The DERs do not specify who prepared these analyses, but it is possible that Yankee Atomic was involved. Refer to DERs 31915, 32106,33259,33502, and 34145.

O Inadequate Operational Experience Review Program: Following the accident at Three Mile Island in 1979, the NRC required all licensees to develop and implement an operational experience review program. The objective of this program is for each licensee to look at industry events and evaluate whether changes are necessary at its facility.

Several of the DERs suggest that the Vermont Yankee licensee has an inadequate operational experience review program. For example, refer to DERs 31923,32016, and 33789.

There were also a large number of cable separation issues, several problems with high energy line break events in the turbine building, and several problems with intemal flooding. Given that this licensee's safety evaluation and operational experience review programs appear inadequate and this licensee may have relied on Yankee Atomic for many years, it would not be surprising that there will be many more design and licensing bases problems remaining at the facility. These problems are products of these defective programs.

Since these defective programs were used by the Vermont Yankee licensee for many years for all systems at the plant, not just the ones implicated by these DERs, it is reasonable to conclude that the problems and deficiencies apply to all safety related systems at the plant. When very similar pervasive and systemic problems were identified at the Salem and Millstone plants, the NRC required those licensees to cenify that the safety related systems at these facilities were within their design and licensing bases before permitting them to be restarted. The DERs for Vermont Yankee suggests that similar assurance may be warranted.

If you have any questions or comments, please do not hesitate to contact me.

Sincerely,

! 0401 0 David A. Loch aum l

Nuclear Safety Engineer

Attachment:

Comments on Vermont Yankee DERs

Enclosures:

UCS Report dated April 2,1998 i UCS Letter dated January 29,1998 UCS Letter dated May 5,1997 May141996 l

i UCS Comments on Vermont Yankee DERs

1. DER No.31531, Failure to Provide Appropriate Guidance to Assure That Actions to Separate From the Grid Are Carried Out Within the Committed Time According to this DER, the licensee committed to the NRC to take specific actions in event of degraded voltage to protect safety related equipment, but those actions were not incorporated into procedures and thus may not have been taken. The licensee indicated that this commitment was part of the Technical Specification basis.

The licensee retracted this DER because the degraded voltage condition did not occur and the need for the missing procedure never arose. That's a lame excuse. The "no blood, no foul" rule has no place in nuclear safety. The NRC should review this matter and determine whether this licensee is satisfying 10 CFR 50.72 and 50.73. (See DER No. 31925)

2. DER No.31663, Reactor Core Isolation Cooling (RCIC) System Declared Inoperable Due to Broken Drain Line Hanger The licensee declared the RCIC system inoperable after discovering a broken pipe hanger on the I pump casing drain line. Subsequent engineering evaluation determined that the broken hanger did not affect the RCIC system pressure boundary and did not affect the seismic qualification of the system piping. The DER was retracted on that basis.

The licensee's declaring the system inoperable appears proper and conservative. The retraction e appearsjustified and proper.

l 3. DER No. 31744, Short Circuit of Contacts Could Lead to Failure of Valves to Close Resulting i in a Release Pathway t

The licensee discovered that a short circuit could prevent closure of containment atmospheric control system valves. These valves, if open during a loss of coolant accident, provide a pathway from the torus to the drywell. The short circuit could not cause the valves, if closed, to open. The short circuit would not prevent the operator from manually closing the valves from the control room hand evitches.

The consequences of this deficiency are relatively minor. The potential bypass pathway is serious,

! but could be isolated by operator action from the control room. The operator has valve position indication available in the control room and procedures which direct hirlher to verify isolation valve closures. Thus, it is reasonable to assume that the operator would detect and corTect this problem was it to occur.

4. DER No. 31906, Licensee Discovered a Condition that Could Compromise the RHR Operability and Accident Mitigation Capability This DER reports that the altemate method used for keeping the RHR system piping filled with water, namely use of the condensate transfer system, presents a problem in that the makeup piping is not seismically designed m,r protected with check valves. Thus, the makeup piping could fail as a result of an earthquake and RHR flow could be diverted out through the break.

This DER suggests that the licensee performed a faulty 50.59 safety evaluation when the procedure authorizing the condensate transfer system as an attemate keepfill method was approved. The DER STdu1Yft

UCS Comments on Vermont Yankee DERs does not specify when this altemate method was first introduced, but it is reasonable to assume that it was at least 5 years ago based on experience at other BWPa.

5. DER No.31915, Turbine Building Pressurization During a Main Steam Line Break The licensee discovered that a high energy line break in the turbine building could increase the turbine building pressure to the point where the wall to the HVAC room could be knocked down.

The licensee expects that this would disable the control room HVAC system.

The DER does not indicate who performed the original HELB analysis. Yankee Atomic Electric Company performed considerable engineering work for this licensee and may have been responsible for this analysis. .

See also DER No. 31926 on a closely related degraded condition.

NOTE: He Maine Yankee plant had a large number of non-conservative HELB analyses, including that for the turbine building.

6. DER No. 31923, Maximum Flood Level of Switchgear Room nis DER reports that water could back up into the switchgear room from the floor drains to a depth l greater than documented in the VY FSAR. The DER does not indicate if that higher depth will disable equipment powered from the switchgear. If so, this problem could affect multiple safety-related systems.

)'

The NRC issued Information Notice No. 83-44, " Potential Damage to Redundant Safety Equipment as a Result of Backflow Through the Equipment and Floor Drain System," to ajll licensees, including this ,

licensee, on July 1,1983. This 15 year old Info Notice described a virtually identical problem at the Calvert Cliffs plant. It appears that VY's operational experience review program may be weak.

)

7. DER No. 31925, Commitment to Seal Four Equipment Hatches I his DER reports that the licensee failed to seal four equipment hatches in the RHR rooms. The hatches permit access between the RHR pump rooms on the 213' elevation and the upper rooms on the 232' and 252' elevations. According to this DER, sealing these hatches was a commitment.

This licensee retracted DER No. 31531, which also involved an unfulfilled commitment, because the event that the commitment mitigated did not occur. This logic appears to apply to DER No. 31925.

Since DER 31925 was not retracted, this licensee is wrong - either for retracting DER 31531 on unjustified grounds or for not retracting DER 31925. The NRC should look into these DERs to arbitrate a correct determination.

8. DER No.31926, Turbine Building High Energy Line Break The licensee discovered that a high energy line break in the turbine building could increase the turbine building pressure to the point where steam could enter the switchgear rooms through duct work. He switchgear room is defined as a mild environment, which means that the breakers and electrical equipment inside it may not function properly when exposed to a steam environment. The switchgear room houses electrical equipment for many safety-related systems.

UCS Comments on Vennont Yankee DERs The DER does not indicate who performed the original HELB analysis. Yankee Atomic Electric Company performed considerable engineering work for this licensee and may have been responsible for this analysis.

See also DER No. 31915 on a closely related degraded condition.

NOTE: The Maine Yankee plant had a large number of non-conservative HELB analyses, including that for the turbine building.

9. DER No. 31949, PotentialInternal Flooding Outside Design Basis of Plant This DER involves the finding that a break in the fire system piping in the front office building could affect electrical equipment in the switchgear rooms due to water flowing under the west switchgear room door. The piping break could cause a flow rate ofnearly 5,000 gpm causing a flood depth of about 14 inches in the lower level of the front office building within 10 minutes. The licensee estimated that approximately 20 to 30 minutes later, there could be an inch of water on the floor of the switchgear room due to flow under the door. Since the switchgear bus' sits directly on the floor, the licensee indicated that its operability could be affected by an inch of water.

The DER also indicates that the floor drains in the room were intentionally plugged (at some unspecified dated) due to extemal flooding concems. This is another example of a deficient 50.59 safety evaluation in that correcting one problem (extemal flooding) increased the probability and/or consequences of another problem (intemal flooding).

10. DER No.32016, Design Basis LOCA in Conjunction with Containment Purge Would Damage the Standby Gas Treatment System (SBGTS)

His DER involves the standby gas treatment system being disabled due to ove1 pressurization if a loss of coolant accident occurred while the toms was being vented. The SBGTS is an integral part of secondary containment and must function to ensure that releases from the plant are filtered and controlled following an accident. This DER indicates that this vital SBGTS function could be disabled by the very event it must mitigate - namely, the loss of coolant accident.

SUBJECT:

VERMONT YANKEE HPCI/RCIC WATERHAMMER, DER NO,33545

Dear Mr. Vito:

I reviewed NRC daily event report (DER) 33545 dated January 15,1998, at the request of the Citizens Awareness Network. This DER summarized the report made by Vermont Yankee ofits discovery for the potential of a waterhammer in the HPCI and RCIC turbine exhaust lines during operation with elevat'ed suppression pool pressure. By letter dated January 23,1998, I addressed concerns from my review of this DER to Mr. David McElwee at Vermont Yankee: Mr. McElwee informed me today that Vermont Yankee Nuclear Power Corporation was not interested in opening a dialogue with the Citizens Awareness Network or its associates (i.e., me). Hence, I am referring my concerns to the NRC.

The follewing discussion ofmy concerns is taken verbatim from my !ctter to Mr. McElwee:

From reading the DER, it appears that the potential waterhammer condition is pnmarily a concem for HPCI during a small break LOCA and for RCIC during a station blackout. Does W's analyses for these events assume that either HPCI or RCIC starts and stops? If so, is the suppression pool pressure such that the conditions for the potential waterhammer exist? I reviewed the analyses presented in Chapter 14 of the W FSAR, but was unable to answer these questions myself based on this information.

1 From reading W's FSAR (latest version in the NRC's Public Document Room is Revision 14, submitted April 30,1997), I found no discussion of the riesign or licensing bases for the vacuum breaker installed in the HPCI and RCIC turbine exhaust lines. By letter dated November 30,1971, l WNPC provided the NRC with the reason for the installation of these vacuum breakers.1 note '

that W FS AR Figure 6.4 1 for the HPCI system does not show the vacuum breaker in the exhaust line. Should the FSAR text and figures be updated to reficct installation of the vacuum breakers? If yes, have prior safety evaluations performed per 10 CFR 50.59 involving the HPCI and RCIC systems been reviewed to confirm that they were not affected by this missing information?

The DER mentions that the potential waterhammer condition'could challenge containment integrity. Since W is currently operating with a known fuel leaker, it would seem appropriate for the LER on this matter to discuss the increased risk to the public from two barriers being degraded

- the fue.1 cladding and the primary containment boundary.

Washington Office: 1816 P Street NW Suite 310 e Washington DC 200361495 e 202 332 0900 e FAX: 2024324606 Cambridge Headquarters: Two Brattle Square e Cambridge MA 02238 9105 e 617-547-5552 FAX: 617 464-94o5 Califomie Office: 2397 Shattuck Avenue Suite 2o3 e Befkeley CA 94704-1567 e 510443-1872 FAX: 5104433765

k

, January 29,1998 Page 2 of 2 The licensee is ur. der no legal obligation to respond to safety concerns from a public interest UCS or a local citizens gicap like CAN and has consciously elected not to meet its moral obligatio Despite my extreme reluctance to initiate another allegation, I cannot ignore my moral obligation a therefore notifying the NRC aboat my concerns. I advised Ms. Deborah Katz of the Citizens Aware Network along to theof my inability to get the licensee to address my concerns and that these concerns NRC.

1 Sincerely, D -

~ i k' & G.

David A. Lochbaum '

i Nuclear Safety Engineer

{

cc: Mr. Paul Gunter Ms. Deborah Katz Mr. William K. Sherman

l l

8

UNION OF CONCERNED SCIENTISTS May 5,1997 Chairman Shirley A.' Jackson Commissioner Kenneth C. Rogers Commissioner Creta J. Dieus j Commissioner Nils J. Diaz l Commissioner Edward McGafligan, Jr. l United States Nuclear Regulatory Commission l Washington, DC 20555-0001

SUBJECT:

MISLOCATED FUEL BUNDLE LOADING ERROR

Dear Chairman and Commissioners:

The Oyster Creek licensee reported by letter dated May 24,1972,8 that the plant had operated a cycle with a fuel assembly miseriented 90' from its proper position. At the time, Mr. Stephen H. Hanauer of the NRC (then AEC) staff reported that General Electric had been asked about such a misloadi event during the Browns Ferry licensing process and had responded, "They swore it couldn't happe and would surely be detected if someone was out of his mind and violated the obvious symmetry o the layout."2 Eight years later, the Tennessee Valley Authority informed the NRC that Br-wns Ferry Unit I had in fact gone through its third operating cycle with two fuel assemblies misoriented 90' from their proper positions.' According to the TVA report, the vedfication process after loading the core for Cycle 3 had identified the miseriented bundit:s, but their misorientation had not been corrected.

By letter dated Sepnmber 27,1993,' GE reported the revised probability of a rotated bundle as 6.0x104

' The low probability was justified on empirical data which indicated that no misoriented fuel bundles had been experienced since licensees incorporated the high level TV scan and independent checker features into their core verification procedures. Last year, the Hope Creek licensee reported Ivan R. Finfrock, Jr., Manager . Nuclear Generating Stations, Jersey Central Power & Light Company, to A.

Giambusso, Deputy Director for Reactor Projects, Atomic EnerEy Commission, " Docket No. 50-219 / Oyster C Station / Fuel Assembly 1.oading Error," May 24,1972.

8 Stephen H. Hanat.cr, Director - Onice of Technical Advisor. Atomic Energy Commission, to Roger S. Boyd, Assistant Director for Boiling Water Reactors, Atomic Energy Commission, and Donald E. Knuth, Assistant Director for Reactor Safety, Atomic Energy Commission, " Mis-Orientation of a General Electric Fuel Element,' June 1,1972.

3 1.icenso Event Report 50 260/80-037, September 26,1980.

J. F. Klapp-oth, Fuel t.icensing Manager, General Ele-tric Company, to Nuclear Regulatory Commission,' Additional Information on the Rotated Fuel Bundle Event,* September 27,1993.

Washbgbn Omoe: 1 16 P Street NW Sube 310 Washhgton DC 20036-1495 202 332 0900 FAX: 202 332 0f05 CambMge Omce: Two Brattle Square

CambMge MA o2238-9105

617-547 5552

FAX: 617 464-94o5 CaMomie Omce: 2397 Shattuck Avenue Suite 203 Berkeley CA 947o4-1567 510-843-1858

FAX:01. M 785

O

May 5,1997 Page 2 of 2 by letter dated March 25,1996,5 that the plant had operated a cycle with a fuel assembly misoriented 180* from its proper position. According to the PSE&G report, " bundle orientation was reviewed by looking at four bundles at a time (a fuel cell) during a continuous scan of the core by the refueling ,

bridge camera" and "the independent verification processes failed to identify the error."

By letter dated February 10,1993/ GE informed the NRC that it was performing a mislocated bundle analysis for plants where the resAant critical power ratio response may establish the operating limit minimum critical power ratio. GE also indicated these analyses were an interim measure until the NRC concurred with a request to revise the acceptance criteria for the event.

Given GE's longstanding history ofinvalidated assumptions regarding the mislocated~ fuel bundle loading error,it seems highly imprudent to pretend that such events cannot happen. Despite repeated assurances and enhanced core verification procedures, the event still occurs far more often than indicated by GE's estimate ( probability of 6.0x104 per reactor year.

UCS urges the NRC to revisit the miseriented fuel bundle loading error issue for operating boiling water reactors and for the advanced BWR design. In addition, the NRC staff should investigate GE's submittals to the staff regarding the probability of this event to determine if GE has been candid and forthcoming in its characterization of the probabilities. The apparent non-conservatisms that GE applied to generate such an unrealistically low probability value should cause the NRC concern. If GE low balled the NRC on other probabilities, the NRC cannot even hope to make risk-informed decisions.

Sincerely, 7

WL5)0 David A. Lochbaum Nuclear Safety Engineer s

M. E. Reddeman, General Manager Hope Creek Operations, Public Service Electric & Gas Company, to Nuclear Regulatory Commission. ' Hope Creek Generating Station / Licensee Event Report No. 95-042-00,' March 25,1996.

J. F. Klapproth, Manager Fuels and Facilities Licensing, General Electric Company, to Nuclear Regulatory

U N IO.N O F CONCERNED SCIENTISTS Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding The Union of Concerned Scientists has identified a potential safety hazard at nuclear power plants that operate with smell cracks and holes in the metal tubing, also called cladding, containing their fuel. The fuel cladding is a vital barrier between highly radioactive materials and the environment. From a review of available documentation, UCS concludes that federal regulations require this banier to be intact during plant operation. There is a good reason for these regulations - the public cannot be harmed as long as the fuel cladding remains intact. Ifit is not intact, radioactivity will be released to the plant and the environment. Such a release could affect the health of plant workers and members of the public. In addition, fuel rods with degraded cladding may break apan during an accident and prevent safety equipment from functioning.

Despite these potentially serious consequences, nuclear plants routinely operate with defective fuel cladding. In fact, many, if not all, nuclear plants have operated with damaged fuel cladding.

UCS recommends that the Nuclear Regulatory Commission (NRC) enforce federal regulations which prohibit nuclear plants from operating with defective fuel cladding. These regulations allow the NRC to permit nuclear plants to operate with defective fuel cladding, but only when their owners establish acceptable boundaries based on studies of both normal operating and accident conditions. Until these safety concerns are resolved, UCS considers nuclear plants operating with fuel cladding failures to be potentially unsafe and to be violating federal regulations.

Background

The following sections discuss: design and licensing bases requirements for nuclear plants; their specific application to nuclear fuel design; the use of multiple barriers in protecting the public; the role of the fuel cladding as a barrier; the experience with fuel cladding failures, and the potential safety hazards from fuel cladding failures.

Design and Licensing Bases Reauirements Design and licensing bases requirements establish safe operating boundaries which are supponed by extensive safety analyses. Operating within the boundaries provides reasonable assurance that the public will be protected if there is an accident. The safety or danger of operating outside the boundaries has not been analyzed. As a result, safety margins may be compromised when boundaries are crossed, increasing the risk to the public. Therefore, federal regulations do not permit plants to operate in unanalyzed conditions.

Fuel Desien Nuclear plant are powered by fuel rods which contain uranium dioxide pellets roughly the size and shape of a large pencil craser stacked within 12 to 14 feet long metal tubes sealed at each Washington office: 1616 P Street NW Suite 310 e Washington DC 200361495 e 202 332 0900

FAX: 202 332-u905 Carnbridge Headquarters: Two Brattle Square e Cambridge MA 02238-9105 e 617 547-5552 e FAX: 617-864 9405 Cahfornia Office: 2397 Shattuck Avenue Suite 203 e Berkeley CA 947041567 e 510-843-1872 FAX: 510-843 3785

, Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding end with welded metal caps.' A simplified drawing of a fuel rod is shown in Figure 1. The fuel tubes are also called the fuel cladding. Fuel cladding is like the gas tank in a car - if the tank is breached, highly volatile gasoline can spill out to threaten the safety of its passengers and innocent bystanders, as well as degrading the environment. When fuel cladding is breached, highly radioactive material spills out to threaten the safety ofplant workers and the public.

All operating US nuclear power plants use fuel assemblies containing square arrays of fuel rods.

A typical fuel assembly is illustrated in Figure 2. As shown in this figure, the fuel rods must remain intact to provide the overall structural integrity of the fuel assemblies. The fuel design bases ensure that "the fuel is not damaged as a result of normal operation and anticipated operational occurrences." 2 The phrase "not damt.ged," as used by both the NRC and nuclear plant owners, means that the fuel rods are not dam' aged to the point where they would fail.3 Thus, I' the fbel design bases includes the explicit requirement that fuel cladding remains intact during normal operation.

l Defense in-Deoth Barriers

{

The splitting, or fissioning, of uranium atoms in the fuel rods releases energy that heats water -

nuclear energy that powers the plant. Byproducts of the fission process include radioactive gases and solids. Plutonium is also produced by the nuclear reactions. These radioactive materials emit gamma tays along with alpha and beta panicles which can cause damage to the human body. The fuel cladding keeps the radioactive materials contained. If the cladding is defective, radioactive materials will leak into the water which surrounds the cladding and keeps the fuel rods cooled.

This water is contained within the reactor vessel and the piping connected to it, which form a second barrier to contain the radioactive materials. If the piping fails, contaminated water spills into the reactor containment building. The reactor vessel and its piping are located within a reactor containment building which forms a third barrier. Because the reactor containment building is not leak tight, it reduces, but does not eliminate, the possibility that radioactive material would escape. Figure 3 shows a simplified drawing of these three barriers.

Three barriers between the radioactive material and the environment imply that one barrier can be breached during plant operation leaving two intact barriers to protect the public. However, the safety analyses assume that all three barriers are intact prior to any accident. Let's assume the rupture of a pipe connected to the reactor vessel breaches one of the barriers. If the pipe rupture occurs when the fuel cladding is defective, then two of the barriers are breached. The remaining barrier, the reactor containment building, only reduces the amount of radioactive material released to the environment. Thus, all three barriers must be intact during plant operation for the public to be protected.

l

' Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.3.2.1. " Fuel Rod Mechanical Design," and General Electric Company, " Licensing Topical Report / General Electric Standard Application for Reactor Fuel," NEDO-240!!.A-4, January 1982.

8 Nuclear Regulatory Commission. NUREG-0800, Standard Review Pltn. Sectia 4.2, Fuel Syr'em Design.

3 Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan. Section 4.2, Fuel Systeni Design. :nd GPU Nuclear Corporation, Oyster Creek Nuclear Generating Station Updated Final Safety Analysis Repon. Section 4.4.2.-Description of Thermal and Hydraulic Design of the Reactor Core."

April 2.1998 Page 2

Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding I

\

l The fuel cladding is the most important of the three barriers. If the fuel cladding remains intact, the other two barriers can completely fail and the public will still be protected. The intact fuel cladding contains the radioactive gases and solids and prevents them from being released to the atmosphere. The public cannot be harmed from a nuclear plant accident in which the fuel cladding remains intact. But, as the next section indicates, nuclear plants routinely operate with this vital barrier seriously degraded.

Fuel Cladding Failure Experience Numerous fuel cladding failures from various causes have been reported over the years. For example, the water flowing through the reactor core has caused fuel rods to sway back and fonh.

In this situation, the fuel rods vibrate against the grid (shown in Figure 2) and damage the cladding. At other plants, debris in the reactor water, such as metal flakes from msted piping, has lodged against the grid. The friction from the vibration of this debris damaged the cladding.

Another failure mode results when fuel pellets expand faster than the fuel rod cladding (see Figure 1) as their temperatures increase. The expanding pellets stretch the cladding, sometimes until it cracks or splits. Finally, the welds holding the upper and lower end plugs to the fuel rod cladding (see Figure 1) have sometimes been defective, causing pinhole leaks or even cracks to form. Other failure modes have been experienced too. Many, if not al:, nuclear plants have experienced fuel cladding failures during their lifetimes. Few plants have shut down early to remove failed fuel rods.

Leaking fuel rods are detected by increased radioactivity levels in the reactor vessel's liquid and gaseous releases.' Not surprisingly, the radioactivity levels rise significantly when fuel cladding fails. The causes of fuel cladding failures cannot be determined until the plant is shut down and the leaking fuel rods examined.

The following repons illustrate recent fuel cladding failure incidents and include some serious events.

The Vermont Yankee plant recently operated with at least one failed fuel rod for many months.5 Its owners elected to operate with the leaker (s) until the plant's next scheduled refueling outage in the spring of 1998 rather than incur the cost of an unscheduled shut down.' The Brunswick Unit I plarit in Nonh Carolina operated during 1997 with fuel cladding failures that its owners tolerated.' The Surry plant in Virginia also operated in 1997 with failed fuel cladding.8 These incidents demonstrate that nuclear plants continue to operate with fuel cladding failures.

' Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 4.2.4.2,"Online Fuel System Monitoring," and Section i1.5.2.2.1," Main Steam Line Radiation Monitoring System."

8 Nuclear Regulatory Commission, Daily Event Report, DER No. 33152, October 28,1997.

' Vermont Yankee Nuclear Power Corporation, Presentation to Vermont State Nuclear Advisory Panel, December 3, 1997.

'Johan Blok and Roger Assy, Centec XXI," Pinpoint fuel leaks to improve nuclear economics." Powce, January / February 1998.

April 2,1998 Page 3

Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding

~

A few years ago, the owner of the Point Beach Nuclear Plant in Wisconsin reported a significant event in which "The fuel cladding was failed to the extent that fuel pellets could be seen thro the hole in the clad. However, no pellets escaped from the rod." The fuel rod failure was detected '

when the radioactivity levels of the reactor water rose to a level that was "10 percent of that allowed by [ Point Beach Nuclear Plant's operating license]."' In other words, the plant's

)

operating license would have allowed it to remain running with up to nine other similarly failed fuel rods. This event suggests that the restrictions on reactor water radioactivity levels are too j

)

high to prevent operation with gaping holes in fuel rod cladding.

)

At the Palisades plant in Michigan, three portions of a broken fuel rod were discovered in different parts of the reactor. One segment, nearly 5% feet long, was missing about one-third of its fuel pellets. A second segment,4% feet long, and a third segment,1% feet long, appeared to i

contain all their fuel pellets.' This event is disturbing because it highlights how fragile the cladding can become during normal operation. At Palisades, this fuel rod literally fell cpan as it was being removed from the reactor core and radioactive material was lost, including highly l toxic plutonium.

Fuel Cladding Failure Consecuences i

What is the safety threat from a nuclear plant operating with fuel cladding failures? The fact that many plants have operated for many years with failed fuel cladding could be taken to imply an ,

acceptable safety record. However, that is not the case. That fact demonstrates, at most, that the l public is protected with fuel cladding failures during normal plant operation. It does not provide any reason to believe that the public will be protected in the event of an accident. It also does not provide any reason to believe that nuclear workers will be protected during normal plant operation with failed fuel cladding. l I

What might happen if a nuclear plant with failed fuel cladding had an accident? A common accident scenario involves breaking a large pipe connected to the reactor vessel. Water and steam rush out of the reactor vessel through the broken pipe. The water flow in the reactor core, instead of flowing from the bottoms of the fuel assemblies to their tops, may flow across the fuel assemblies. This cross-flow ' pushes' the fuel rods to the side rather than towards the top.

Cladding that is weakened may fail under this side force. The plant's response to the pipe break is to shut down. Control rods are automatically insened into the reactor core to stop the fissioning process. Fuel rods which fail and shift out of their venical alignment may prevent the insertion of control rods. The safety analyses assume that the control rods can be insened and shut down the reactor. Can fuel cladding failures cause such problems during this accident scenario? No one knows. Pre-existing fuel cladding failures have not been considered in the 8

Nuclear Regulatory Commission, inspection Repon 50-280/97-10, December 15,1997.

' Wisconsin E'ectric Power Company. Licensee Event Repon No. 85-002-01," Failed Fuel Rod in A Point Beach Nuclear Plant Unit 1." May 19.1986.

United States Nuclear Regulatory Commission. Information Notice 93 82. "Recent Fuel And Core Performance Problems In Operating Reactors." October 12,1993.

I April 2.199E l Page 4 I

1 l

Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding safety analyses for this accident or any other accident. Yet, nuclear plants routinely operate with such fuel cladding failures.

What happens if fuel cladding failures increase the severity of nuclear plant accidents? Since plant safety analyses assume that fuel cladding is undamaged when accidents occur, the failures may cause more radioactivity to be released to the environment than has been previously considered. After all, a key barrier confming this highly radioactive material is already breached when the accident begins. Under no circumstances will less radioactivity be released. Thus, it is imperative from a public health standpoint that nuclear plants do not operate with fuel cladding failures unless safety analyses are performed which demonstrate that the consequences from accidents under these conditions are acceptable.

Summarv -

The fuel cladding is the most important of the three barriers between highly radioactive material and the environment. As long as the fuel cladding remains intact, no nuclear plant accident can threaten public health and safety. Yet, nuclear plants routinely operate with damaged fuel cladding.

Safety analyses assume that the fuel cladding is intact when accident scenarios begin. Operation with pre-existing fuel cladding failures may mean that a nuclear accident will have more severe consequences than predicted by the invalidated safety analyses. Thus, UCS considers a nuclear plant operating with defective fuel cladding to represent an increased risk to the public.

The fuel design bases require the fuel cladding to remain intact during normal plant operation.

Federal safety regulations require that plants operate within the boundaries established by their design bases. Therefore, UCS concludes that operating a nuclear plant with failed fuel cladding violates federal safety regulations.

See Attachment I for details of UCS's assessment of reactor operation with failed fuel cladding.

ALARA Issue Nuclear plant owners are required by federal regulations to keep the release of radioactive materials "as low as reasonably achievable" (ALARA)." According to the NRC, "a plant operating with 0.125 percent pin-hole fuel cladding defects showed a general five-fold increase in whole-body radiation exposure rates in some areas of the plant when compared to a sister plant with high-integrity fuel (<0.01 percent leakers). Around certain plant systems the degraded fuel may elevate radiation exposure rates even more."i2 The " sister plants" were virtually {

identical because they were built at the same time by the same owner on the same site. The l

" Title 10 of the Code of Federal Regulations, Sections 50.3 la," Design objectives for equipment to control releases of radioactive material in effluents - nuclear power reactors." and 50.36, " Technical specifications," and Title 10 of l

the Code of Federal Regulations. Part 50. Appendix I," Numerical Guides for Design Objectives and Limiting Conditions for Operation to Meet the Criterion "As low As Reasonably Achievable" for Radioactive Materialin Light-Water-Cooled Nuclear Power Reactor Effluents." I

" United States Nuclear Regulatory Commission. Information Notice No. 87 39. " Control Of Hot Particle Contamination At Nuclear plants," August 21.1987.

April 2,1998 Page5 1

Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding I

significant variation in radiation exposure rates is nni due to thicker concrete or other desig) differences - it is due to the failed fuel cladding. UCS is troubled by this NRC evidence because it shows a significantly increased risk to nuclear plant workers at a facility operating with just 0.125 percent fuel cladding failures. Many plants consider it permissible to operate with eight times as many fuel cladding failures (up to 1.0% failures).

Fuel cladding defects release radioactive materials into the reactor water. The water carries them to all pans of the plant, contaminating equipment throughout the facility. Workers conducting equipment inspections and maintenance receive higher radiation exposures. Indeed, some plant workers have received radiation doses far greater than allowed by federal regulations from highly radioactive maerial released through fuel cladding defects.

it is a well documented fact that plant operation with defective fuel claddirig significantly increases personnel exposures. Federal regulations requires nuclear plant owners to keep the release of radioactive materials as low as reasonably achievable. Therefore, it is both an illegal activity and a serious health hazard for nuclear plants to continue operating with fuel cladding damage. '

Conclusions And Recommendations Conclusions It is UCS's considered opinion that existing design and licensing requirements do not allow i

planb to operate with known fuel cladding failures. In addition, federal regulations require j formal NRC approval prior to any nuclear plant operating with fuel cladding failures. Such !

approval has neither been sought nor granted.

UCS's evaluztion (see attachment 1) suggests that both the probability and consequences of postulated accidents may be increased when nuclear plants operate with pre existing fuel cladding failures. Thus, operation with fuel cladding failures is a violation of federal regulations l which represents a potential threat to public health and safety.

UCS's assessment was generic. Consequently, this conclusion does not explicitly apply to any operating plant. However, UCS's assessment identified the strong potential for operation with fuel cladding failures to be an illegal activity unless the plant's owners performed a plant-specific safety evaluation which established such operation as acceptable and the NRC has formally reviewed and approved this safety evaluation. Absent both of these conditions,it seems highly probable that any plant operating with fuel cladding failures is violating its design and licensing bases requirements, a condition not allowed by federal safety regulations. It further appears that such illegal operation may have serious safety implications. Finally, operation with fuel cladding damage also seems to violate the ALARA concept mandated by federal regulations, thus exposing plant workers to undue risk.

" United Stres Nuclear Regulatory Commission. Information Notice No. 87 39. " Control Of Hot Particle Contamination At Nuclear plants." August 21,1987.

April 2.1998 Page 6

Potential Nuclear Safety Hazard Reactor Operation with Failed Fuel Cladding UCS's research for this assessment did not locate any information which suggests that operation with failed fuel cladding has been previously evaluated pursuant to fed:ral regulations. There is considerable documentation on fuel cladding failure events, on inspections of failed fuel rods, and on various fuel damage mechanisms. Despite extensive, focused efforts, UCS was unable to find any indication that the safety implications of plant operation with failed fuel cladding have been considered by the fuel vendors, the NRC, or nuclear plant owners. This non-existent data further reinforces UCS's conclusions that operation with failed fuel cladding has not been properly analyzed by the industry, has not been approved by the NRC, and is both potentially unsafe and illegal.

Recommendations -

UCS recommends that the Nuclear Regulatory Commission take appropriate steps to prohibit nuclear power plants from operating with fuel cladding damage until the safety concerns raised in this report are resolved. These appropriate steps include, but are not limited to, the following:

Plant owners should be required to shut down their facilities upon detection of a fuel cladding failure. The plants must not restart until the failed fuel rods a're removed.

Plant owners should be required to evaluate the safety implications of operating with failed fuel cladding in accordance with federal regulations. If these safety evaluations are unable to justify continued operation, the plants should be shut down.

For the long term resolution of the safety concerns raised in this repon, UCS recommends that the Updated Final Safety Analysis Reports (UFSARs) be revised. These revisions would establish safe boundaries for operation. After these boundaries are drawn and incorporated into the UFSARs, plants could continue to operate with failed fuel cladding as long as the failures rems;ned within the previously analyzed region. If the amount of failed fuel cladding exceeded the boundaries, then the plant should face the options recommended above.

April 2,1998 Page 7 m

1 I

Attachment 1 Unreviewed Safety Question Assessment Unreviewed Safety Question Assessrnent This attachment contains UCS's evaluatior. for eactor operation with failed fuel cladding. Our evaluation applied federal regulations for determining when a proposed mode of operation crosses the plant's authorized boundaries and thus requires prior NRC approval. As the results clearly indicate, reactor operation with failed fuel cladding requires NRC approval. Yet, such approval has neither been sought nor granted.

The NRC issues an operating license for a nuclear power plant after reviewing its design and procedures. The plant's owners may modify the facility and revise its procedures as long as the changes do not alter the bases for the NRC's approval of the operating license. A change which alters the operating license bases is called an unreviewed safety question (USQ). For example, a proposed change that reduces the plant's safety margin is an unreviewed safety question because the NRC may have relied on the greater margin in granting the plant's operating license.

Likewise, a proposed char,ge that maintains the existing safety margin but does so by operator actions instead of automatic equipment operation is also an USQ because the NRC's approval may have relied on the automatic protective features. When a proposed change involves an USQ, NRC approval must be obtained in advance. Federal regulations specify that a proposed change involves an USQ if: l (1) the probability of occurrence or the consequences of an accident or malfunction of equipment important to safety previously evaluated in the safety analysis report may be increased; or (2) a possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report may be created; or (3) the marg"in of safety as defined in the basis for any technical specification is reduced.

Federal regulations require nuclear plant owners to obtain NRC permission prior to conducting any activity for which the answer to one or more of these questions is anything but "NO." As UCS's nuclear safety engineer, I reviewed publicly available documentation to determine if these criteria are satisfied for plants operating with fuel cladding failures. Prior to joining UCS, I worked in the nuclear industry for over 17 years where i developed, reviewed, and assessed literally thousands of USQ determinations.

I divided the first criterion above into the " probability" and " consequences" elements for clarity. i The scope of this evaluation was limited to four types of documentation: 1) the Updated Fmal Safety Analysis Repons (UFSARs) for four of UCS's focus plants (the Calvert Cliffs plant in Maryland, the Oyster Creek plant in New Jersey, the River Bend plant in Louisiana, and the Millstone Unit 3 plant in Connecticut); 2) the non-proprietary version of the fuel design topical repon submitted by a vendor (General Electric); 3) the standard technical specifications prepared by all four reactor manufacturers (Westinghouse, General Electric, Babcock & Wilcox, and I

{

l

" Title 10. " Energy," of the Code of Federal Regulations, Section 50.59," Changes, tests and experiments," '

April 2,1998 Page8

Attachment 1 Unreviewed Safety Question Assessment Combustion Engineering); and 4) NRC correspondence on fuel cladding failure events. The results from this evaluation follow.

Criterion la: May the probability of occurrence of an accident or malfunction of equipmen imponant to safety previously evaluated in the safety analysis report be increased by operation with failed fuel cladding?

The standard technical specifications prepared by Westinghouse, General Electric, Combustion Engineering, and Babcock & Wilcox (vendors for all of the plants operating in the United States) specify that "The fuel cladding must not sustain damage as a result of normal operation."" The NRC considers fuel cladding to be damaged when its integrity is lost." The detection of fission products outside the fuel rods is irrefutable evidence that fuel cladding integrity has been lost. -

The standard technical specifications are the templates from which individual plant operating licenses were derived. Since these specifications establish zero defects as the minimally acceptable standard, operation with fuel cladding failures increases the probability of

" malfunction of equipment important to safety," namely the fuel itself, to 100%. For this reason alone, the answer to this question is Y.ES.

To apply the above generic assessment to a specific plant, UCS looked at available documentation for the Oyster Creek Nuclear Generating Station in New Jersey, A design basis for Oyster Creek is "to ensure that no fuel damage will occur in normal operation or operational transients caused by reasonable expected single operator error or equipment malfunction."" Fuel rod damage "is defined as a perforation of the cladding which would permit the release of fission product to the reactor coolant."" Thus, the detection of failed fuel rod (s) at Oyster Creek would be an equipment malfunction placing the plant outside its design basis. Again, the answer to this question is XES.

A fuel cladding defect may allow gases within a fuel rod to leak out. A defect may also allow water to leak in. It appears that leakage in either direction may also increase the probability that the fuel cladding will not perform its necessary safety function.

" Babcock & Wilcox Company, Standard Technical Specifications, Section B 2.1.1.," Reactor Core SLs,"

Combustion Engineering, Standard Technical Specifications, Sectica B 2.1.1," Reactor Core SLs," General Electric Company, BWR/4 Standard Technical Specifications, Section B 2.1.1," Reactor Core SLs," and Westinghouse Eicetric Corporation, Standard Technical Specifications, Section B 2.1.1," Reactor Core SLs."

Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2," Fuel System

" GPU Faclear Corporation, Oyster Creek Nuclear Generating Station Updated Final Safety analysis R Section 4.4.1,"[ Thermal and Hydraulic Design) Design Basis."

" GPU Nuclear Corporation. Oyster Creek Nuclear Generating Station Updated Final Safety Analysis Repo Section 4.4.2," Description of Thermal and Hydraulic Design of the Reactor Core."

April 2,1998 Page 9 L

Attachment 1 Unreviewed Safety Question Assessment A fuel cladding defect which allows gases to leak out of a fuel rod has at least two pote adverse consequences. The fuel rods are pressurized with helium during their fabrication to minimize a problem called cladding creep-collapse. The pressure inside a 6uclear plant from 960 to 2,100 pounds per square inch at full power. The difference between a fuel rod's external pressure and internal pressure can exert sufficient inward force to cause the cladding fill the gaps between fuel pellets." The stress .on the cladding can cause it to break. The le of helium from a fuel rod reduces its intemal pressure, thus potentially increasing the prob of fuel rod damage from cladding creep-collapse.

Inadequate cooling of the fuel is another potential consequence from gases leaking out of a fue rod. Helium is used to pressurize fuel rods because of its high thermal conductivity.2 The leakage of helium through a fuel cladding defect may slow down the transfer of heat from the fuel to the water. When heat cannot be dissipated from the fuel as quickly as ass'umed, the fuel temperature will increase and may reach the point at which it begins to melt. The leakage of helium from a fuel rod may reduce heat transfer rates, thus potentially increasing the prob that the fuel is seriously damaged during a loss-of-coolant accident.

A fuel cladding defect which allows water to leak into a fuel rod also has at least two potentiall adverse consequences. During plant operation, high fuel temperatures prevent water from leaking in through a cladding defect. However, water can enter defects when the plant is shut down and cause fuel rods to become waterlogged. If the plant increases power quickly, the r fuel temperature may cause the water inside the fuel rods to evaporate and perhaps even boil.

The water vapor and steam produced inside the fuel rods, unless it is able to leak out through thi defects, increase their pressure. This pressure buildup is suspected to have caused the " burst of fuel rods at the Point Beach plant in Wisconsin. Sections of the cladding and i pellets could not be located when the damaged assemblies were later inspected. '

There is another potential adverse consequence from water leaking into fuel rods. The high operating temperature dissociates the water into hydrogen and oxygen gases. The hydrogen gas interacts with the cladding to form blisters. The blisters embrittle the cladding, leading to perforations.:2 To minimize the moisture content, the fuel pellets are dried prior to being loaded l

" Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Repor 3.7.1.1.a. " Clad Creepdown/ Creep-Collapse."

" Baltimore Gas & Electric Company, Calven Cliffs Nuclear Plant Updated Final Safety Analysis Rep 3.3.2.1. " Fuel Rod Mechanical Design."

2' B. Siege' '4uclent Regulatory Commission," Evaluation of the Behavior of Waterlogged Fuel Rod Failures LWRs.~ r4UREG-0303. March 1978.

2 Baltimore Gas & Electric Company, Calven Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 3.7.2.1."Bumable Poison Rod Design Evaluation.'

April 2.1998

, Page 10 t

Attachment 1 Unreviewed Safety Question Assessment into the fuel rods.23 Thus, water leaking into a fuel rod may increase the probability that fuel cladding suffers this type of damage, which is called hydriding.

In fact, failure propagation due to hydriding has already been identified. Recent inspections of failed fuel rods at the Salem plant in New Jersey, the Beaver Valley plant in Pennsylvania, and the Wolf Creek plant in Kansas revealed that, "In some of the affected assemblies, secondary hydriding also was evident."2' A fuel rod at the Perry Nuclear plant in Ohio experienced a cladding crack measuring 20 inches long, or neady 13% of the fuel rod's length, caused by secondary hydriding.25 In these events, the initial fuel cladding failures were caused by other mechanisms. These failures later propagated due to hydriding.

Thus, operation with fuel cladding failures has the potential for increasing the probability that an important barrier protecting the public, namely the fuel cladding itself, fails to adequately confine radioactive materials during a postulated accident. The fuel cladding is considered

" equipment imponant to safety." A fuel cladding failure is therefore a malfunction of equipment important to safety. For this reason, too, the answer to this criterion is XES.

Finally, the NRC's Standard Review Plan states that the fuel design bases ensure that " fuel damage is never so severe as to prevent control rod insertion when it is required." 26 Nuclear plant operation with failed fuel cladding has caused individual fuel rods to break into segments during fuel handling evolutions. If degraded fuel cladding were to ,similarly break during an accident, the fuel rod segments might interfere with control rod insenion. Thus, for this additional reason, the answer to this criterion is .YES.

Criterion Ib: May the consequences of an accident or malfunction of equipment imponant to safety previously evaluated in the safety analysis report be increased by operation with failed !

fuel cladding?

The NRC reponed that the nuclear fuel's design bases are intended to " provide assurance that the fuel system is not damaged as a result of nonnal operation. 'Not damaged,' as used in the above statement, means that fuel rods do not fail. Fuel rod failure is defined as the loss of fuel rod

[ integrity]."2' Thus, the fuel system, including the fuel cladding, must remain undamaged during normal operation.

" Baltimore Gas & Electric Company, Calven Cliffs Nuclear Plant Updated Final Safety Analysis Repon, Section 3.3.2.1," Fuel Rod Mechanical Design. and Nuclear Regulatory Commission, NUREG-0800, Standard Review Plan, Section 4.2," Fuel System Design."

" United States Nuclear Regulatory Commission,Information Notice 93 82,"Recent Fuel And Core Performance Problems In Operating Reactors," October 12,1993.

" United States Nuclear Regulatory Commission,Information Notice 93 82,"Recent Fuel And Core Performance Problems In Operating P: actors." October 12,1993.

2* Nuclear Regulatory Commission. NUREG-0800. Standard Review Plan, Section 4.2, Fuel System Design.

2' Nuclear Reguistory Commission, NUREG-0800. Standard Review Plan, Section 4.2," Fuel System Design."

April 2,1998 Page1I e

Attachment 1 Unreviewed Safety Question Assessment The safety analysis for the recirculation flow control failure with increasing flow event2s at the River Bend Station in Louisiana concluded that "An evaluation of the radiological consequences is not required for this event since no radioactive material is released from the fuel."2 If this event were to occur with pre-existing fuel cladding failures, this analysis would be rendered invalid. Since this analysis assumes that the fuel cladding remains intact, its conclusions are invalidated when there are fuel cladding failures.

The safety analysis for the feedwater controller failure maximum demand event 30 at River Bend concludes that fuel and pressure vessel " barriers maintain their integrity and function as designed."3' Obviously, this analysis's conclusion is invalidated when the plant operates with pre-existing fuel cladding failures.

The safety analysis for the rod withdrawal error event 32 at River Bend specifies that "An evaluation of the batrier performance was not made for this event since this is a localized event with very little change in the gross core characteristics."33 Fuel cladding damage is a localized event. The failed fuel rod has a pinhole leak or a hairline split in its cladding or a cracked weld at its end cap. If the rod withdrawal error occurs in the vicinity of the fuel cladding defect, the big change in local characteristics could propagate that defect. Thus, this analysis's conclusion is invalidated when the plant operates with a fuel rod defect.

The safety analysis for a control element assembly ejection event" at the Calven Cliffs Nuclear Plant concluded that "the site boundary [ radiological] dose guidelines will be approached." 35 28 This potential accident is comparable to a mistake using a bellows to flame a wood fire. If too much air is supplied, the fire may blaze up out of control. Likewise. puning too much water through the River Bend reactor core can cause it to run out of control.

' Entergy Operations, River Bend Station Updated Final Safety Analysis Repon, Section 15.4.5.5,"[ Recircu Flow Control Failure with increasing Flow) Radiological Consequences."

" This potential accident is similar to the recirculation flow control failure with increasing flow event in that too much water to the reactor core results in an uncontrolled power increase.

" Entergy Operations, River Bend Station Updated Final Safety Analysis Report, Section 15.1.2.4,"[Feedwa Controller Failure Maximum Demand) Barrier Performance."

" This potential accident involves the inadvertent withdrawal of a control rod causing the power produced adjacent fuel assemblies to increase significantly.

".Entergy Operations. River Bend Station Updated Final Safety Analysis Report, Section 15.4.2.4,"[ Rod Withdrawal Error) Barrier Performance."

" This potential accident is comparable to car engine throwing one ofits pinons. The piston may break the engi casing. Likewise. the ejected control element assembly may break the reactor coolant pressure boundary and allow reactor water to leak out.

" Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report, Se' 14.13.2," Sequence of Events [ Control Element Assembly Ejection)."

April 2.1998 Page 12

Attachment 1 Unreviewed Safety Question Assessment The analysis found the postulated event acceptable because the plcnt's design features "will prevent fuel clad failure, will prevent exceeding the [ reactor coolant system] Pressure Upset Limit, and will therefore limit the radiological site boundary dose [i.e., the radiation levels experienced guidelines." g a member of the public at the plant's fence] to below the criteria in 10 C Since this analysis assumes that fuel cladding failures are prevented, its conclusions are invalidated when there are pre-existing fuel cladding failures.

The NRC's Standard Review Plan states that the fuel design bases ensure that "the number of fuel rod failures is not underestimated for postulated accidents."" Yet, the previous accident analyses underestimated the number of fuel rod failures if those plants operated with fuel cladding failures. Thus, the answer to this criterion is YES.

The Wolf Creek plant recently experienced fuel cladding failures affecting 44 fuel rods in three fuel assemblies. According to an NRC report on the problem, "The most severely degraded fuel rod fragmented into three segments during fuel handling operations while offloading the core."38 Fuel handling operations include removing a fuel assembly from the reactor core, placing it in a device called an upender, lowering the assembly to a horizontal position, transferring it through the reactor containment wall into the fuel handling building, raising the assembly to a vertical position, and moving it to a storage location in the spent fuel pool. These manipulations put dead load force (i.e., gravity) on the fuel assembly and its fuel rods. Fuel assemblies are designed to withstand the force associated with these handling evolutions, at least when their fuel cladding is undamaged. Apparently at Wolf Creek, the force of gravity was sufficient to cause the structural failure of a fuel rod with previously damaged cladding.

What if an accident occurred when the fuel assemblies with the damaged cladding still resided in the reactor core? For example, consider the hydrodynamic forces inside the reactor vessel following a break of a large pipe connected to it. The high energy water escaping through the break exerts considerable force. The side force on the fuel rods may approach, or even exceed, the dead load force during fuel handling. The weakened fuel cladding may experience structural failure as was encountered during fuel handling. Fuel rod structural failure could have very serious consequences during an accident. Tha dislodged fuel rod segments could interfere with the insertion of control elements attempting to shut down the reactor. Fuel assemblies are tightly packed into the reactor vessel. The clearance between fuel assemblies and control elements is fractions of an inch at most. Fuel rod segments would not have to move much in order to interfere with control elements. Thus, the consequences of previously analyzed accidents could be increased by operation with fuel cladding failures. The answer to this criterion is Y.ES.

Baltimore Gas & Electric Company, Calven Cliffs Nuclear Plant Updated Final Safety Analysis Report, Section 14.13.4," Conclusion [ Control Element Assembly Ejection)."

Nuclear Regulatory Commission, NUREG-0800. Standard Review Plan. Section 4.2, Fuel System Design.

United States Nuclear Regulatory Commission, Information Notice 93 82,"Recen: Fuel And Core Performance Problems in Operating Reactors," October 12,1993.

April 2.1998 Page 13

Attachment 1 Unreviewed Safety Question Assessment e

Criterion 2: May the possibility for an accident or malfunction of a different type than any evaluated previously in the safety analysis report be created by operation with failed fuel cladding?

After residing in the reactor core for one or more cycles of operation, fuel assemblies are moved to the spent fuel pools. " Spent" fuel assemblies continue to generate considerable amounts of heat and release deadly amounts of radiation for many years. The worst-case spent fuel pool accident is typically assumed to be a fuel handling event. The analysis for this event assumes that a fuel assembly is dropped onto another fuel assembly." Fuel rods in both assemblies are assumed to fail to evaluate the radiological consequences of the event. The spent fuel pools are also analyzed for possible damage resulting from an earthquake. These analyses generally assume that no fuel damage occurs as long as the fuel storage racks remain structurally intact.

Some spent fuel pool accident analyses take credit for operation of the spent fuel building's ventilation system. This system routes the building's exhaust air through filters, thus lowering '

the radiological dose to the public. At many plants, the ventilation system only perfonns this safety function when fuel handling operations are underway. -

{

Spent fuel assemblies with cladding failures may have those failures propagate when subjected to earthquake forces. Radioactive gases released from spent fuel assemblies following an eanhquake may cause radiological consequences which exceed those for the fuel handing event if(a) the inventory from more than the fuel rods in two assemblies is released, or (b) credit is taken in the fuel handling event analysis for operation of the spent fuel building's ventilation system but the system is unavailable. Consequently, the answer to this criterion is M AYBE.

Criterion 3: May the margin of safety as defined in the basis for any technical specification be reduced by operation with failed fuel cladding? {

The standard technical specifications prepared by Westinghouse, General Electric, Combustion Engineering, and Babcock & Wilcox (vendors for all of the operating plants in the United States) specify that "The fuel cladding must not sustain damage as a result of normal operation and

[ anticipated operational occurrences]."' The NRC considers fuel cladding to be damaged when its integrity is lost. The detection of fission products outside the fuel rods is irrefutable evidence that fuel cladding integrity has been lost.

" Baltimore Gas & Electric Company, Calvert Cliffs Nuclear Plant Updated Final Safety Analysis Report. Section 14.18.2," Method of Analysis [ Fuel Handling Accident)."

" Babcock & Wilcox Company, Standard Technical Specifications, Section B 2.1.1.," Reactor Core SI.s,"

Combus' ion Engineering, Standard Technical Specifications, Section B 2.1.1," Reactor Core SLs," General Electric {

Company, BWR/4 Standard Technical Specifications T.ection B 2.1.1," Reactor Core SLs," and Westinghouse Electric Corporation, Standard Technical Specifications, Section B 2.1.1," Reactor Core SLs." j

" Nuclear Regulatory Commission, NUREG-0800 Standard Review Plan, Section 4.2," Fuel System Design."

April 2,1998 Page 14

e . .

\

Attachment 1 i Unreviewed Safety Question Assessment The standard technical specifications are the templates from which individual plant opera licenses are derived. Since these specifications establish zero defects as the minimally accep standard, operation with fuel cladding failures clearly represents a safety margin reduction.

Consequently, the answer to this question appears is XES. ;

l Conclusion !

Federal regulations specify that an unreviewed safety question is indicated when the answer to )

any one of the criteria is non-negative. UCS's assessment determined that none of the answers is negative. Three of the answers are unequivocally YES and a fourth is MAYBE. Thus, nuclear power plant operation with failed fuel cladding is clearly an unreviewed safety question. NRC approval is required for a plant to continue operating with fuel cladding failures.

l Performed by: O "-

otet98 David N Lochbaum )

Nuclear Safety Engineer l

April 2,1993 Page 15

Figure 1 Fuel Rod Schematic n-UPPEM END Ptuo 12JMCALOV-23

(

PISIlON CLAS PLENuts -

PLEMUM SPRING

/ '

437A8NLE33 STEELI 4 *.

MYOROCENIOUS IMPURTTY i g carTen rencoNeuw Auov:

1 4 / -

.'tgi:.:s.+.

f.:.:15:::* .:+~.

.:iiffi.?#:{Y.. *:

fic, r u st. P r a r ra mi N r a n s o

>.*:.*..- uO,ORuo +ogod

'.:;:*:*:*s.*

*? *::,

I ,. *. . . . . '

[*l*.~.*t *.*.*.***#I * . *'. - *

c. . . .. .

CH:MFuMIDFIkkIII "

2:..**::....::: ::.: . $

.* *.*:*::::::.*.:v:::.:'

. : ! *:t*.* I *,v. "

\

lt * \

>v

. ::::..:::::t*<

.v *

.v,.:.v::.:*:.:27.: ..

PutI., TuaE 121ACALOT 23 l:.

.::.v .v. ::::P*;

~.y. .'v.t *- -

. .h. . . '..'.' :a.'

T::;;*::::::' 9:

=

+.....

.3:.;;#.::

. f.f*.7,.7 s .

v::::.,;.:'*

.v. . .

f::.* ...* * . u:.:.:.:.,

,:z.:::::: .

( \

/ LOWER ENC PLUG (Z1RCALOY 23 V '

I April 2.1998 Page 16

l . . .

Figure 2 Fuel Assembly Schematic ROD CLUSTER 3 '

TI CONTROL -

t g a . ;

y -

\j'E-[_j-E's V .

. L\ 3 P - / ..

TOP '

.. 4 NOZZLE- HOLD DOWO 4 .g SPRING , .

w ad,llllIl FU$L- . ;

ROD , ' */

CONTROL j!!j]

Ts l)ll ROC . l

.e i I

, -THIMBLE. '.

$ )- I, l TUBE_,

.lg,.[

1_ R u .

1 .

GRID jlf! ..e ,

" ' l

l ,,

.J.kijy!

e I l ii' p:, .'

.. :!s!.A .yging VANES s., !){ '~f, 1 '

.!k! kT .

l rf g .

-'i l f i f

s. I . DASHPOT

. GRID - ! !

. REGION llp SP, RING - , f p DIMPLE. *

- - l BOTTOM ,t -

I

NOZZLE # 'I/ $

R 1

,x

?

April 2.1998 P8Ee 17

e Figure 3 Defense-in-Depth Barriers

~

/ PRIMARY / .

/ CONTAINMENT / - -

VESSEL .

SkAM LIE '

.. . g.:.:. . . . . . . . . .. .

. . . . . .;.9 REACTOR

/ N '

4 m _2 _q

.:!:i::

j:

i:3 VESSEL

j;

,, FUMP3 i: l TURBIE .

4 .'l 3, lSOLATION @ !l GEERATOR A IQQQQ!

CORE VALVES -

E i : :. - '

D)i PUMP i

/ . E g

=

! !i.i .: :: :%:: iib.0"!]

jjij :. g.;;;;;;;;;;;;;s g JET PUMP ,,,\ E '

!:::: 'e---- = ~ :::r ( CONDENSEE

i:i.:!":::a-a COOLING CONTROL RODS E:#

==:::: k WATER p

f PRESSURE SUPRESSION N ' ' "

~~ ~ .

_ POOL . .

April 2.1998 Page 18

ML20206T973

Contents

Text

Dear Rosemary,

Attachment:

Enclosures:

SUBJECT:

Dear Mr. Vito:

SUBJECT:

Dear Chairman and Commissioners:

Background

Navigation menu

ML20206T973

Text

Dear Rosemary,

Attachment:

Enclosures:

SUBJECT:

Dear Mr. Vito:

SUBJECT:

Dear Chairman and Commissioners:

Background

Navigation menu

Search