ML20210N486
| ML20210N486 | |
| Person / Time | |
|---|---|
| Site: | Davis Besse, Oconee, Arkansas Nuclear, Crystal River, Rancho Seco, Bellefonte, 05000000, Crane |
| Issue date: | 02/10/1987 |
| From: | Pollard R, Weiss E UNION OF CONCERNED SCIENTISTS |
| To: | NRC COMMISSION (OCM) |
| References | |
| CON-#187-2490 2.206, NUDOCS 8702130133 | |
| Download: ML20210N486 (60) | |
Text
f Apf@
nemira"=n gg$
r uo u. a um. nc.......I~
(2 M3c...
'87 F210 A3 :15 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION PETITION FOR IMMEDIATE ACTION TO RELIEVE UNDUE RISK POSED BY NUCLEAR POWER PLANTS DESIGNED BY THE BABCOCK & WILCOX COMPANY ELLYN R. WEISS General Counsel Robert D. Pollard Nuclear Safety Engineer Union of Concerned Scientists 1616 P Street, N.W.,
suite 310 Washington, D.C. 20036 l
(202) 332-0900 Dated: February 10, 1987 i
1 h
D
} 56.3 l
l t
. TABLE OF CONTENTS I. SUPetARY 1
II. GROUNDS FOR RELIEF 8
A. The Safety Problems Inherent in the B&W 8
Design Pose Unreasonable Risks to Safety.
1
- 1. Basic elements of the B&W design 8
t j
increase both the probability and consequences of accidents.
4
- 11. The operating history of the B&W plants 14 j.
demonstrates that they pose undue risk to public health and safety.
B. NRC's Actions to Date Provide No Reason to 19 Conclude that the Acknowledged Safety
}
Problems of the B&W Plants Will Be Resolved Within a Reasonable Period of Time.
i j
- 1. The promised re-examination of B&W plant 19 safety has been compromised in scope and i
schedule by NRC's delegation of its regulatory responsibility to the owners of the B&W plants.
l
- 11. The promised B&W safety re-examination is 25 the most recent example of a years-long practice by the NRC of using study after i
study as a means of foresta111ng effective t
action to the B&W problems.
j 111. The NRC lacks the technical capability to 30 accurately predict the complex behavior i
l characteristics of B&W plants in accident g
conditions and has not devoted the resources i.
necessary to acquire that capability.
i C. The Risks Posed by the B&W Plants are Immediate 38 and NRC Has Provided No Reasoned Basis for j
Permitting Them to Operate for an Unlimited i
" Interim" Period Until Necessary Safety
{
Improvements Are Made.
t
}'
III. CONCLUSION AND RELIEF REQUESTED 42 j
i 1
UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION PETITION FOR IMMEDIATE ACTION TO RELIEVE UNDUE RISK POSED BY NUCLEAR POWER PLANTS DESIGNED BY THE BABCOCK & WILCOX COMPANY I.
SUMMARY
1.
This petition to the Nuclear Regulatory Commission (NRC) is filed pursuant to 10 CFR 2.206 by the Union of Concerned Scientists (UCS) and by:
The Arkansas Alliance 8015 Brandon Street Little Rock, AR 72204
Contact:
Bob Bland Citizens for Land & Water Uso, Inc.
2084 Elbur Avenue Lakewood, OH 44107
Contact:
Mrs. James H. Angel, President 1
Concerned Citizens of Ashtabula County l
315 Garfield Street Geneva, OH 44041
Contact:
Ronald O'Connell Concerned Citizens of Goauga County 11210 Hidden Spring Drive Chardon, OH 44024
Contact:
Doidro Francio Concerned Citizona of Lako County 38531 Doddo Landing Drivo j
Willoughby Hillo, OH 44094 i
Contact:
Connie P. Klino Cuyahoga County concerned Citizono 1280 Manor Park Lakewood, OH 44107
Contact:
Christianno Tropal l
c PETITION ON CCW PLANTS Fcbru ry 10, 1987 Frank D. Davis l
200 Gettysburg Pike Mechanicsburg, PA 17055 Ed Deaton Route 7, Box MLC-25 Talahasse, F1 32308 Stan Diorio 4300 Stencar Drive Fair Oaks, CA 95628 Environmental Congress of Arkansas P.O. Box 548 l
Eureka Springs, AR 72632 l
Contact:
Pat Costner, Executive Director l
Fayetteville Peace & Justice Center 322 Watson Street Fayetteville, AR 72701
Contact:
David Druding Nancy Haller, M.D.
j Newton County Health Officer l
HCR 31, Box 16 Jasper, AR 72641 l
Norman P. Hatrick, Vice-Chairman Dauphin County Board of Commissioners P. O. Box 1295 Harrisburg, PA 17108 Kiski Valley Coalition to Save our Children 409 North Eight Street Apo11a, PA 15613
Contact:
Cindee Virostok Maryland Nuclear Safety Coalition P. O. Box 902 Columbia, MD 21044
Contact:
Patricia T. Burnie, Co-Chairperson 1
l 1 l l
PETITION ON C23 PLANTS Fcbrutry 10, 1987 Native Americans for a Clean Environment Route 2, Box 51-B Vian, Oklahoma 74962
Contact:
Jessie Deer in Water, Chairperson Northern Ohio Citizens Against Perry & Davis-Besse 14409 Bayes Avenue Lakewood, OH 44107
Contact:
Debbie Sefcek; Bob Greenbaum People's Action for a Safe Environment 322 Watson Street Fayetteville, AR 72701
Contact:
Annee Littell People Against Nuclear Energy P.O. Box 268 Middletown, PA 17057
Contact:
James B. Hurst, Donald E. Hossier Louis D. Putney I
Attorney at Law 4805 S. Nimes Avenue Tampa, FL 33611 Sacramentans for Safe Energy 331 J Street, #105 Sacramento, CA 95814
Contact:
Nini Redway Save Our State from Radioactive Waste 5505 South Barton Road Lyndhurst, OH 44124
Contact:
Arnold Oleisser Susquehanna Valley Alliance P. O. Box 1012 Lancaster, PA 17604
Contact:
Frances Skolnick, Coordinator Laszlo Trazkovich, M.D.
2623 Rockwood Avenue Baltimore, MD 21215 1
PETITION ON'C") PLANTS Fcbru:ry 10. 1987 Shelley Traskovich, M.D.
2623 Rockwood Avenue Baltimore, MD 21215 Western Reserve Alliance 3817 Bridge Avenue Cleveland, OH 44113
Contact:
Betty Long 2.
The petition requests immediate NRC action to relieve undue risks to public health and safety posed by the operation of nuclear power plants designed by the Babcock & Wilcox Company (B&W).
Specifically, the petition requests the NRC to hold public hearings to determine corrective actions necessary for the B&W plants to achieve assurance of adequate protection for the public health and safety.
The petition further requests that the operating licenses and construction permits for B&W plants be suspended until corrective actions have been fully implemented.
The B&W plants with operating licenses are Arkansas Nuclear Ono Unit 1, Crystal River Unit 3, Davis-Besse Unit 1, Oconee Units 1, 2,
and 3, Rancho Seco, and Three Mile Island Unit 1.
Tho D&W plants with construction permits are Bellefonte Units 1 and 2.
The grounds for these requests are summarized in paragraphs 3 through 12, below, and are discussed fully in the body of the petition.
3.
Unique elements of the B&W plants make thom inherontly more dangerous than other pressurized water reactors.
The evidenco falls into two main categories:
- 1) the operating history of tho l
D&W plants which is punctuated by frequent and repoated accidents l
involving reactor shutdowns, pressurized thermal shock of roactor vessels, opening of reactor and steam generator prosauro rollof l
- devices, actuations of emergency cooling systems, cracking of pipes, partial loss of reactor cooling water and, in the caso of Three Mile Island Unit 2, destruction of the reactor coro, and i. -
PETITION ON B&W PLANTS Fcbrucry 10, 1987
- 2) a host of NRC and NRC-sponsored technical reports produced in the last eight years which identify and discuss B&W plants' unique safety problems, but fail to resolve them. (See paragraphs 13 through 38, below.)
4.
This petition will demonstrate that the NRC has failed to I
take effective action to correct the safety deficiencies at the B&W plants.
Each significant accident at a B&W plant has spawned a new generation of studies, reports, recommendations for safety improvements, and promises of further safety improvements in the near. future.
Some modifications have been made, but the frequency and complexity of accidents at B&W plants has not been reduced.
In other instances, a majority of the NRC commissioners have demonstrated a lack of will to order those changes which are manifestly necessary, despite the recommendat'icns of the NRC staff.
Promises of speedy. resolution of other safety issues have gone unfulfilled because the NRC lacks the technioal capability to analyze the complex behavior of the B&W plants during transients and accidents in detail sufficient to identify the l
modifications necessary to achieve an acceptable level of safety.
l (See paragraphs 39 through 79, below.)
P 5.
The most recent accident demonstrating the inherent safety problems at B&W reactors occurred at the Rancho Seco plant in California on December 26, 1985.
Its cause (loss of power to a "non-safety" control system) and consequences (including violation of pressurized thermal shock limits, damage to plant l
equipment, and inability to manually control plant systems) wore i
essentially identical to those of previous events at Rancho Seco and other B&W plants.
l 6.
Af ter the 1979 accident at Three Mile Island Unit 2,
NRC f
ordered a variety of "short-term" and "long-term" modifications i i l
i l
t
PETITION ON C&J PLANTS Februtry 10, 1987 O
to.the equipment, procedures, and operator training at all B&W j
plants,. on both a plant-specific and generic basis.
The NRC
[
staff now acknowledges that the agency's response to the TMI accident has not been effective in reducing the number and complexity of accidents in B&W plants which result in both a threat to the public health and safety and an economic loss to the utilities and their customers.
7.
The NRC relied upon the utilities' asserted completion of the "short-term" post-TMI fixes as its reason for allowing the B&W reactors to resume operation several months after the TMI-2 accident.
However, safety problems that were believed to have been corrected by the short-term measures continue to occur.
In r
the case of the "long-term" modifications, NRC required utilities l
to demonstrate " reasonable progress" toward their completion before resuming operation and ordered that implementation be accomplished "as soon as practicable" thereafter.
More than I
seven years after those orders were issued, few if any of the B&W plants have completed all of the long-term modifications.
The short and long-term measures ordered by NRC have not succeeded in rectifying the inherent design problems of B&W plants.
I 8.
In response to the 1985 accidents at Davis-Besse and Rancho Seco, the head of the NRC staff in January, 1986, expressed the j
agency's renewed " concerns" over the safety of the B&W planto and
(
promised to complete in 1986 a re-examination of the overall j
safety of the B&W plants, compare that with other plants and j
i determine whether the current requirements for the B&W plants are i
adequate for safety.
The agency asserted, however, that the B&W
(
plants were safe enough to operate "in the interim."
9.
Since January, 1986, the NRC has fundamentally perverted its promises.
NRC delegated the task of performing the initial l [
f t
i
PETITION ON E&'] PLANTS Fcbru ry 10, 1987 aafety assessment to the owners of the B&W plants.
The results of this delegation were predictable.
- First, the owners have narrowed and shifted the focus away from a basic safety reassessment and comparison with other plant designs, deciding instead to concentrate on improving the economic performance of the B&W plants.
Second, the delegation has delayed the whole project to the extent that the B&W owners group now states that its reassesment will not be ready until mid-1987.
NRC review will take months after that.
10.
Even when completed, this reassessment will not bind the owners of the B&W plants.
- First, the D&W Owners Group has informed NRC that compliance with the owners group's "rocommenda-tions" is essentially voluntary on the part of the individual owners.
- Second, should the NRC staff datormino during its subsequent review of the owners group's safety reasoossment that como actions to improve safety are requirod, the agency has already confirmed that it will apply the so-called "backfit" rule, 10 CFR 50.109.
This rule providos for a longthy, multi-tiorod appeal procosa giving licensoon repeated opportunition to argue that the cost-bonofit ratio for each design chango is not bonoficial.
Should como design changos omorgo at the end of this
- process, NRC would only then negotiato a schodulo for their implomontation.
In short, under the NRC's curront program for addrooning the risk posed by oporating D&W planto, oubstantial modifications to improve safety at the D&W plants aro years in the futuro, if they como at all.
11.
Doth the NRC comminolonora and the NRC staff have ancorted that the D&W planto are safo onough to oporato in the undofined and unlimited "intorim,"
i.0.,
beforo correcting their known nofoty dofocto.
Ilowevor, the agoncy han boon unable to provido a l
i l l
PETITION ON C&W PLANTS Fcbrucry 10, 1987 convincing factual basis for this assertion.
(See paragraphs 82 through 90, below.)
12.
The continuing operating experience of B&W plants demon-strates that they pose an unacceptable level of risk to public safety.
While acknowledging nine months ago that the NRC's post-TMI efforts to reduce that risk have not achieved their intended results, there has been no appreciable progress since then in improving the safety of B&W plants.
Indeed, the NRC has barely begun the first step in the process of identifying what design changes -are necessary to bring the B&W plants to an acceptable level of safety.
II.
GROUNDS FOR RELIEF A.
The Safety Problems Inherent in the B&W Design Pose Unreasonable Risks to Safety.
1.
Basic elements of the B&W design increase both the probability and consequences of accidents.
13.
B&W developed a plant design intended to be highly responsive to changes in electrical demand and somewhat more efficient than other pressurized water reactors in converting fission heat to electricity.
But the same design elements adopted to enhance responsiveness and thermal efficiency make the plants much more sensitive to small variations and minor malfunc-tions that affect the delicate balance between heat generation and heat removal, increasing both the probability and severity of accidents.
Those components that have repeatedly contributed to the severity of the accidents occurring over the last decade are the once through steam generators, reactor pressurizer, auxiliary PETITION ON CIW PLANTS Fcbrutry 10, 1987 s
feedwater system, integrated control system and non-nuclear instrumentation.
14.
Once Through Steam Generator The once through steam genera-tors (OTSGs) used in B&W plants differ from the inverted U-tube steam generators used in other pressurized water reactors (PWRs).
In B&W plants the steam generator tubes are only partially covered with feedwater and there is a smaller amount of water in OTSGs.
15.
Because of the small volume of the OTSG, a small change in feedwater flow causes a relatively large change in steam genera-tor water level.
Since heat transfer from the reactor cooling system is highest in the portion of the tubes covered with feedwater, water level changes have a marked effect on reactor temperature.
The net result: a change in feedwater flow to the steam generators can cause a large, rapid change in the temper-ature of the reactor cooling system.
This extreme sensitivity to feedwater flow upsets has turned events that would be innocuous at other PWRs into crises for equipment and operators at B&W plants.
16.
Pressurizer The pressurizer, connected to the reactor cooling system, accommodates thermal expansion or contraction of the reactor cooling water, limiting the magnitude of the pressure change in the reactor.
Because the B&W pressurizers are relatively small compared to other PWRs, a given temperature change in the reactor cooling system will cause a much larger change in reactor pressure at a B&W plant.
17.
The combination of the OTSG design and the small prosaurizor makes reactor temperature and prosauro in a B&W plant extremo1y sensitive to a change in feedwater flow.
A decrease or loss of 9
PETITION ON C&W PLANTS Fcbruiry 10, 1987 main feedwater initiates an undercooling event.
Water levels in the steam generators decrease, reducing heat removal from the reactor cooling system.
The resulting increase in temperature causes expansion of the reactor coolant, pressurizer water level increases, and the steam in the top of the pressurizer is compressed.
As pressure in the reactor cooling system increases, the reactor automatically shuts down, the pressurizer relief valve (PORV) opens, and then the pressurizer safety valves open.
If the PORV (or a safety valve) sticks open as it did at TMI, the result is a loss-of-coolant accident.
In the case of a stuck l
open pressurizer safety valve, there is no way for the reactor operator to stop the loss of reactor coolant.
18.
Conversely, excessive feedwater initiates an overcooling event.
Steam generator water levels
- increase, reactor 1
temperature decreases, pressurizer water level falls and reactor pressure drops.
As pressure decreases, the reactor automatically shuts down and safety systems such as the emergency core cooling l
system begin to operate.
The emergency core cooling system injects cold water, creating a stress on the piping and the reactor vessel.
If the temperature drop in the reactor cooling system is large, the pressurizer will empty.
Steam will then collect in the reactor piping and block natural circulation of j
cooling water through the reactor, as happened during the TMI-2 I
accident.
Continued operation of the emergency # core cooling system subjects the reactor pressure vessel to pressurized thermal shock that has the potential to rupture it.
Since there because are no safety systems to mitigate a vessel rupture vessel rupture is beyond the " design basis" for the plants--
l such an accident could have catastrophic consequences.
l 19.
Auxiliary Feedwater System After a reactor shutdown, the i
steam generators continue to be the primary means of removing i
.-,-__._m-
-PETITION ON.C&W PLANTS FCbruDry 10,'1987 heat from the reactor cooling system.
The auxiliary " feedwater system is the only source of water for'the steam generators when the main feedwater system fails.
Loss of main feedwater leads to over-heating of the reactor cooling system if auxiliary feedwater is not delivered in a timely manner.
Conversely, excessive auxiliary feedwater flow can lead to overcooling of the reactor, boiling in the primary system, challenges to the engineered safety features, and stress on piping due to the entry of feedwater into the main steam pipes and the injection of cold emergency cooling water into the reactor cooling system.
All of the above have occurred at B&W plants.
In addition, auxiliary feedwater is much cooler than main feedwater and, in B&W plants, is sprayed directly onto the top of the vertical OTSG tubes.
This can and has exacerbated overcooling of the primary system.
20.
- Thus, as the NRC has long recognized, the auxiliary feedwater system and the instrumentation used to initiate and control its operation must be highly reliable.
This need is particularly acute in B&W reactors because of the severe interactions between reactor temperature and pressure and feedwater flow.
Unfortunately, the NRC originally accepted BGW's proposal to classify auxiliary feedwater as a "non-safety" system.
So-called "non-safety" systems are not required to meet the NRC rules intended to assure high reliability of " safety" L
- systems, e.g.,
redundant components, back-up power supplies, j
quality assurance, and survivability in harsh accident i
environments.
After the TMI-2 accident, the NRC acknowledged the j
vital relationship of the auxiliary feedwater system to safety.
- However, the agency has not enforced its post-TMI "long-term" requirement to upgrade the auxiliary feedwater system (and its l
instrumentation and controls) to safety grade.
l !
PETITION ON D&W PLANTS February 10, 1987 4
21.
Integrated Control System B&W plants are eqif1pped with an Integrated Control System (ICS) that attempts to compensate for the. design's inherent sensitivity to mismatches between the heat generated by the - reactor and the heat removed by the steam generators.
The ICS, which has also been classified as a "non-safety" system, automatically controls such vital equipment as the reactor control rods, the main turbine throttle valves, and the main feedwater system.
Following a reactor shutdown, the ICS also controls the auxiliary feedwater system and the amount of j
steam released from the steam generators through the turbine bypass valves and the atmospheric dump valves.
22.
Failures originating. in either the ICS or its electrical power supplies can initiate severe overcooling or undercooling events and, in fact, such failures have repeatedly occurred.
Thus, although it is designed to mitigate the sensitivity of the i
B&W plants' design, the Integrated Control System has instead heightened it because failures in the ICS cause the equipment it controls to malfunction.
4 23.
Non-Nuclear Instrumentation The Integrated Control System reacts to input signals from a set of instruments referred to as non-nuclear instrumentation (NNI), which also is classified as "non-safety."
In addition to providing inputs to the ICS, the NNI supplies information about the status of the plant to the main control board, plant computer, and alarm indicators.
It also displays information from the reactor protection system and the engineered safety feature systems.
Thus, the NNI is a major
. source of information that the reactor operators use to determine conditions in both the primary and secondary systems.
The NNI also provides signals that control the amount of water in the reactor coolant system and the reactor pressure by use of the pressurizer spray valve, heaters and relief valve. -
PETITION ON B&W PLANTS February 10, 1987 24.
Failures in the NNI or its electrical power supplies have a widespread adverse effect on the plant.
Such failures can send false signals to the ICS, which then directs the plant to respond as if the signals represented actual conditions.
In addition, the false signals are sent to the main control room, and the reactor operators may not recognize that much of the information on which they normally can rely is false.
Thus, failures in the ICS or NNI can and have simultaneously caused an accident and impeded the operators' ability to cope with that accident.
25.
Despite the critical importance of the Integrated Control
- System, non-nuclear instrumentation, and auxiliary feedwater system to the safe operation of B&W plants, the NRC classified all three as "non-safety grade."
Therefore, these systems do not have to meet the strict standards imposed on " safety grade" systems.
26.
In sum, B&W reactors are extremely sensitive to events that would be innocuous in other PWRs.
The inherent instability of reactor temperature and pressure after a disturbance in the main feedwater system results from B&W's unique steam generators and small pressurizer.
The "non-safety grade" auxiliary feedwater system, Integrated Control System, and non-nuclear instrumenta-tion not only have been proven incapable of compensating for this inherent sensitivity, they have themselves been the initiating cause of many events with safety significance.
The combination of these attributes of B&W-designed plants has resulted in severe undercooling and overcooling events that repeatedly challenge the plants' safety systems, make unreasonable demands on the operators and pose undue risks to public health and safety.
l
PETITION ON B&W PLANTS February 10, 1987 11.
The operating history of the B&W plants demonstrates that they pose undue risk to public health and safety.
- 27. -Even before the TMI-2 accident, there was ample evidence of the over-sensitivity of the B&W design and the unreliability of the Integrated Control System, the non-nuclear instrumentation and the power supplies for the ICS and NNI.
Prior to the TMI-2 accident, electrical power failures involving the ICS or NNI occurred repeatedly.
For example, such failures occurred at Arkansas Nuclear One Unit 1 on 12/6/74, 7/8/76 and 11/18/77, at Crystal River on 3/2/77 and 4/21/77, at Davis-Besse on 10/29/75, 2/11/76, 3/11/76, 11/11/76, 5/24/76 and 1/12/79, at Oconee Unit 1 on 7/14/76, 12/14/78 and 12/25/78, at Oconee Unit 2 on 7/11/74 and 9/23/74, at Rancho Seco on 11/22/74, 12/26/74, 12/28/74, 12/31/74, 4/16/75, 3/20/78,-1/2/79 and 1/5/79, and at Three Mile Island Unit 2 on 3/29/78.
" Transient Response of Babcock & Wilcox-Designed Reactors," May 1980, Table B.1.
28.
The causes of the ICS or NN1 power failures, according to NRC documents, included water leakage into equipment, personnel errors, equipment failures, blown fuses, a dropped light bulb and.
" unknown."
Although some of these power loses occurred while the plant was shutdown and therefore had little effect on safety, most occurred during operation.
These power failures resulted in automatic reactor shutdowns caused by high reactor pressure, an unsafe combination of reactor temperature and pressure, or a mismatch between reactor power and reactor cooling.
Many of the ICS and NNI power failures caused feedwater transients, opening of.the pilot operated relief valve (PORV) on the pressurizer, excessive cooldown of the reactor pressure vessel, actuation of the emergency core cooling system, or some combination thereof.
I$ -
.a
PETITION'ON B&W PLANTS February 10, 1987 29.
The history of B&W plant operation prior to the TMI-2 i
accident also illustrated their over-sensitivity to failures other than ICS or NNI power failures, particularly failures in the feedwater. systems.
From October 1974 to December 1978, Arkansas Nuclear One Unit 1 experienced at least 14 automatic reactor trips, including four " loss of feedwater" transients, in which reactor pressure rose so high that the PORV opened.
These reactor " scrams" were initiated by high reactor pressure, low reactor pressure, high reactor power level, an unsafe combination of reactor temperature and pressure, an imbalance between reactor power level and reactor cooling, or manually.
Similar reactor shutdowns occurred repeatedly at the other B&W plants prior to the TMI accident: at least 11 times at Crystal River, including three loss of feedwater transients; at least 17 times at Davis-l Besse, including nine loss of feedwater transients; at least 41 times at Oconee Unit 1,
including 17 loss of feedwater transients; at least 22 times at Oconee Unit 2,
including ten loss of feedwater transients; at least 10 times at Oconee Unit 3, including five loss of feedwater transients; at least 19 times at Rancho Seco, including twelve loss of feedwater transients; at least 9 times at Three Mile Island Unit 1, including three loss of feedwater transients; and at least 10 times at Three Mile Island. Unit 2, including six loss of feedwater transients.
Id.,
Table B.2.
l 30.
The Three Mile Island Unit 2 accident in March 1979 f
evidenced many of the same characteristics as previous accidents at B&W plants, but resulted in much more severe consequences.
The accident began from routine maintenance that led to a failure i
of the "non-safety" main feedwater system, i.e.,
a loss of feedwater transient.
This caused reactor pressure to increase, opening the pressurizer relief valve (PORV) and automatically shutting down the reactor on high pressure.
The auxiliary i i
PETITION ON B&W PLANTS Februtry 10, 1987 feedwater system did not function properly, the PORV stuck open, the operator shut off the emergency core cooling system, steam formed in the reactor cooling system which blocked natural circulation cooling, and the reactor core became uncovered, partially melted and was destroyed.
In sum, a complex combination of equipment failures and operator errors combined with the unique and highly sensitive B&W plant design to produce the worst commercial nuclear plant accident in U.S.
history.
31.
The history of B&W plant operation since the TMI-2 accident provides no basis to conclude that the hazards inherent in their design have been corrected.
The characteristics of past accidents continue to be evident in the recurring accidents at B&W plants, despite the post-TMI fixes that have been implemented to varying degrees in the operating plants.
32.
The principal problems evident in the B&W plants involve the inability to control, within safe limits, the temperature, 4
pressure and amount of water in the reactor coolant system and the pressure and amount of water in the once through steam generators.
The B&W owners group defines an " abnormal transient" as one in which one or more of these five plant conditions reaches a limit that requires action by the plant's safety systems and operators.
BAW-1919, "B&W Owners Group Safety and Performance Improvement Program," Rev.
1, August 1986, p.
VI-3.
Using this definition, there have been at least 10 " abnormal transients" at B&W plants since the TMI-2 accident.
These accidents, which the owners call
" events,"
and the plant condition (s) that required safety system and operator response are listed below:.
- PETITION ON B&W PLANTS Fsbruary 10, 1987-s Plant Date Condition Requiring Action Crystal River 02/26/80 RCS temperature, RCS pressure,'
RCS inventory, OTSG pressure, and OTSG inventory.
' Arkansas Unit 1 04/07/80.
RCS pressure and RCS inventory.
Crystal River 06/16/81 RCS temperature, RCS pressure, OTSG pressure and OTSG inventory.
Rancho Seco
-06/17/81 RCS temperature.
Davis-Besse 03/02/84 OTSG pressure.
Rancho Seco 03/19/84 RCS temperature, RCS pressure'and OTSG pressure.
Davis-Besse 06/09/85 RCS pressure, OTSG pressure and OTSG inventory.
Rancho Seco 10/02/85 RCS temperature and OTSG pressure.
Crystal River 10/09/85 OTSG inventory.
Rancho Seco 12/26/85 RCS temperature, RCS pressure, OTSG pressure and-OTSG inventory.
Id.,
Table VI-1.
33.
The most recent accident demonstrating the inherent safety problems in B&W plants occurred at the Rancho Seco plant at 4:14 a.m.
on December 26, 1985.
A loss of power to the "non-safety" Integrated Control System (ICS) caused a reduction of main l
feedwater flow to the steam generators.
Steam generator-levels f
decreased, reactor temperature and pressure increased, and the reactor automatically shut down on a high pressure signal.
The atmospheric dump valves and the turbine bypass valves on the main steam system opened.
34.
Feedwater valves controlled by the ICS remained open end could not be operated from the main control room.
A rapad, severe overcooling of the reactor ensued, which was exacerbated l
PETITION ON B&W PLANTS-February 10, 1987 by the. startup of the auxiliary feedwater system.
One steam generator was overfilled; the limits for pressurized thermal shock of the reactor vessel were exceeded; an operator error l
severely damaged one of the high pressure injection pumps, which released several hundred gallons of radioactive water outside the containment; and one of the senior reactor operators collapsed from exhaustion in front of the control panel and was taken t:o the hospital.
In all, the NRC identified over eleven malfunc-tions and safety problems that occurred in less than an hour.
(The January 31, 1986, NRC Information Notice which briefly describes this event is attached as Enclosure 1.)
35.
Perhaps most remarkably, the failures and consequences of this event were essentially the same as those of previous events at Rancho Seco and other B&W plants.
Many of the safety problems were in fact identical to those which the NRC claimed had been adequately resolved by the "short-term" modifications imposed on all B&W plants after the TMI accident.
36.
For example, in May 1979, the NRC issued an order directing Rancho Seco (and every other B&W plant) to remain shut down until l
a series of actions had been satisfactorily completed.
The NRC ordered.that procedures be developed and training conducted to ascure that steam generator levels could be controlled if ICS l'
level control fails.
About a month later, on June 19, 1979, the 1
l NRC staff reported to the Commission that the utility had I
developed a procedure "that describes the symptoms that would i
result from a loss of main-feedwater control that may have been cause,d by an integrated control system (ICS) failure," and that I
"the.' procedure has been reviewed by the NRC staff."
The staff 3
a l s d. s t a t e d that it Isad " conducted an audit of the operator training and verified -that the operators have been trained to carry out those procedures."
The NRC staff concluded that "the i
)
PETITION ON B&W PLANTS Fcbruary 10, 1987 licensee has developed adequate procedures and operator training to control AFW [ auxiliary feedwater]-flow to the steam generators to specific values independent of the ICS, should failure of the ICS occur, and therefore, is in compliance with this part of the Order."
Memorandum for NRC Commissioners from H.R. Denton, June 19, 1979, enclosed safety evaluation, pp.5, 6, emphasis added.
37.
However, the events on December 26, 1985, proved that the NRC staff's conclusion was wrong.
The Rancho Seco plant had a failure of the Integrated Control System, but the operators were unable to control feedwater flow to the steam generators.
38.
The NRC's response to this latest event is eerily similar to its pronouncements after the TMI accident.
In January 1986, the NRC staff said that it believes that B&W plants can be operated safely for the short term while the NRC undertakes a year-long review to determine whether those plants can be operated safely over the long term.
The subjects of this re-review -- the thermal-hydraulic design, instrumentation, controls and power supplies in B&W plants, as well as their operating experience and are identical to the subjects the NRC operator training claimed to have evaluated thoroughly almost seven years ago.
B.
NRC's Actions to Date Provide No Reason to Conclude that the Acknowledged Safety Problems of the B&W Plants Will Be Resolved Within a Reasonable Period of Time.
1.
The promised re-examination of B&W plant safety has been compromised in scope and schedule by NRC's delegation of its regulatory responsibility to the owners of the B&W plants.
39.
In response to the Rancho Seco accident and the prior accident in June 1985, at the Davis-Besse plant in Ohio, NRC - --
f PETITION ON B&W PLANTS February 10, 1987 informed the B&W owners group that it is time to reconsider the adequacy.of the " basic design requirements" for B&W plants:
~
recent events at B&W designed reactors h' ave reinforced l
our concerns regarding these designs and lead. us to conclude that there is a need to re-examine the basic design requirements for B&W reactors.
While we recognize that utilities are now and have been making modifications to their plants, the number and complexity of events has not decreased as expected.
Victor Stello, Acting Executive Director for Operations, to Hal Tucker, Chairman, Babcock & Wilcox Owners Group, Jan. 24, 1986.
40.
The NRC staff stated that it would " reassess the overall safety of B&W plants and determine whether the present set of j
requirements for B&W are appropriate for the long term and lead to a level of safety at B&W plants that is comparable to other 1
pressurized water reactors. "
The NRC stated that its schedule was "to develop a detailed program plan by mid-February and com-plete the reexamination this year,"
1.e.,
by the end of 1986. Id.
41.
Shortly af ter NRC's January 24, 1986 letter to the owners group, the NRC staff concurred with the utilities' proposal that the owners of the B&W plants, rather than the NRC, would " assume the lead role" in the assessment of the safety of the B&W plants.
B&W Owners Group Safety and Performance Improvement program, presentation to the NRC Commissioners, November 6, 1986. Slide 8.
I-In essence, the NRC has delegated to B&W and the owners of B&W plants the job of determining whether their own plants are safe enough.
The prcnouncement on February 19, 1986, of the Senior Vice President of B&W that the company is "very confident" that i
its reactors are " perfectly safe as designed,"
demonstrates that the review will not be unbiased and disinterested.
NRC response I
to March 27, 1986 letter from Congressman Edward Markey, 4 l 1
PETITION ON C&W PLANTS Fsbrutry 10, 1987 Chairman, Subcommittee on Energy Conservation and Power, April 15, 1986, Question 20.
42.
In fact, subsequent reviews of the B&W owners group's plan for the reassessment by both the NRC staff and the Advisory Committee on Reactor Safeguards (ACRS) found the owners' initial proposal did not have safety as its main emphasis.
The NRC staff told the B&W owners group that "[d]ue to the lack of specificity and the programmatic goals you have set for the BWOG [B&W owners group] program, the staff is unable to conclude that your program will fully respond to our concerns on the B&W design by [ year-end]."
D.
Crutchfield, NRC, to Hal Tucker, B&W Owners Group, as
~
cited in INSIDE N.R.C.,
June 9, 1986, pp. 7-8.
According to the ACRS:
At the time of our Subcommittee meeting the BWOG program's main emphasis seemed to be directed at improving plant on-line performance, rather than addressing the safety objectives of the NRC-B&W reassessment initiative.
Our review of this program indicates that it may lead to improved plant on-line performance,
- however, we are concerned that plant safety does not appear to be its central focus.
We believe it should be.
While it is true that improved plant performance could represent safer operation, that is not an inescapable outco.ne.
David A.
Ward, Chairman, ACRS, to Victor Stello, Jr.,
Executive Director for Operations,
- NRC,
Subject:
ACRS Comments on the Babcock & Wilcox (B&W) Owners Group Safety and Performance Improvement Program, July 16, 1986, p.
1, emphasis added.
43.
- Moreover, fundamental disagreements over the scope and content of the safety reassessment program between NRC and the B&W owners group effectively preclude any substantive progress in safety improvements at the B&W plants for the foreseeablo future... _ _ _.
PETITION ON B&W PLANTS Fcbruary 10, 1987 a.
In its January, 1986, description of the work necessary to assess the B&W safety problems, the NRC staff stated that an objective of the "B&W Design Reassessment Program" is to " compare the overall safety of B&W reactors to other PWRs."
Seven months later, the owners of the B&W plants asserted that "this objective cannot be achieved because of a lack of criteria upon which the comparison can be made."
G. R. Skillman, B&W Owners Group, to D.
M.
Crutchfield, NRC,
Subject:
B&WOG Comments on Draft NRC "B&W Design Reassessment Program," August 29, 1986.
b.
As part of its plan to evaluate the overall safety of B&W plants to that of other pressurized water reactors (PWRs),
NRC stated that. it would compare the results of probabilistic risk assessments (PRAs) for B&W plants with those for other PWRs.
The B&W owners group's position is that "a
comparison of PRA l
results will not be appropriate."
Id.
c.
The NRC stated that it will " determine whether the present set of requirements for B&W plants are appropriate for the long-term and lead to a level of safety at B&W plants that is comparable to other PWRs. "
Remarkably, the owners replied that i
"it is unclear to what the 'present set of requirements' refers."
Xd.
d.
In its draft description of the safety reassessment plan, the NRC stated that " areas needing improvement which are defined by the [NRC] staff will be forwarded to the BWOG [B&W l
Owners Group]
for consolidation into their program."
In its L.
comments on NRC's draft, the owners group changed this sentence to read:
" Areas needing improvement which are defined by the staff will be forwarded to the BWOG for consideration and potential consolidation into their program."
I_ d.,
emphasis added.
PETITION ON B&W PLANTS February 10, 1987 e.
The owners group further informed NRC that the inclusion of recommendations in its reports does not mean that the recommandations will actually be implemented in the B&W plants:
It should be noted that the inclusion of recommendations in the various project reports does not indicate that the recommendations will each be implemented.
These recommendations must be reviewed, evaluated, and dispositioned by the B&W Owners Group Steering Committee and each Utility's management.
G.
R.
Skillman, B&W Owners Group, to D.M.
Crutchfield, NRC,
Subject:
B&W Owners Group Safety and Performance Improvement Program, Revision 01, August 29, 1986.
44.
In other words, two of the most fundamental cbjectives of the safety reassessment program promised by the NRC in January, 1986, have not been included in the reassessment as proposed by the B&W plant owners:
- 1) a comparison of the overall safety of B&W plants to other designs and 2) a determination of whether current NRC design requirements for B&W plants provide an adequate level of safety.
In addition, the B&W owners have not committed even to implementing the recommendations of their own owners group.
45.
The schedule for completing the safety reassessment, originally promised for 1986, has also been delayed in consequence of the delegation of responsibility to the B&W owners.
The NRC staff stated in August, 1986 that,
"[a]s a result of the current BWOG [B&W owners group] schedule," it will not be able to complete the B&W design reassessment program in 1986.
The NRC staff therefore established a new " projected" l
completion date of June, 1987.
Dennis Crutchfield, Assistant Director, Division of PWR Licensing-B, to Hal Tucker, Chairman, B&W Owners Group, August 21, 1986.
However, on November 6, 1986, _. _ _
PETITION ON C&W PLANTS Fsbruary 10, 1987 the B&W owners told the NRC Commissioners that they would not complete their assessment until mid-1987.
This will presumably push the final date back at least six months to allow for NRC review.
Moreover, there is no schedule at all for implementing any results of the safety reassessment and, as noted above, the B&W owners group has made it clear that compliance with its i
internal recommendations are strictly at the discretion of each individual utility.
46.
- Finally, should an overall safety assessment ever be completed and reviewed by the NRC, and should it contains recommendations for correcting the basic design flaws in B&W plants, the NRC's so-called "backfit" rule provides that, prior to requiring any such changes to actually be made to any plant, it must be proven that the economic costs outweigh the safety benefits. 10 CFR 50.109.
The NRC has stated that it will apply the "backfit" rule in this case.
NRC response to March 27, 1986 letter from Congressman Edward Markey, Chairman, Subcommittee on Energy Conservation and Power, April 15, 1986, Question 16.
The rule provides for a drawn-out multi-tiered appeal process by which licensees can repeatedly challenge the cost-benefit i
analysis.
Assuming that some design changes should emerge at the end of this bureaucratic tunnel, the NRC would only then negotiate a schedule for their implementation.
Considering that some of the requirements imposed on B&W plants in 1979 after the TMI-2 accident have not been completed after seven years, any l
actual correction to the B&W design is a prospect at best dimly in the future.
I l l
i
-,. _ _. ~ _ - _ _
PETITION ON C&W PLANTS FCbrusry 10, 1987 11.
The promised B&W safety re-examination is the most recent example of a years-long practice by the NRC of using study after study as a means of forestalling effective action to solve the B&W problems.
47.
A detailed chronology of NRC actions pertaining to the safety problems at B&W plants is appended to this petition as Appendix A and is summarized in paragraphs 48 through 64, below.
It demonstrates that the NRC has, for the past eight years, done study after study identifying and discussing the unique B&W problems and has repeatedly promised to resolve them.
The NRC's promises have not been kept.
48.
On January 1, 1978, the NRC published NUREG-0410, its first annual report to Congress on the agency's schedule for resolving the so-called " Unresolved Safety Issues."
NRC defined Category "A"
unresolved safety issues (USIs) as those which " warrant priority attention" because their resolution could " provide a significant increase in assurance of the health and safety of the public."
49.
Among these top priority safety issues was USI A-17, Systems Interactions in Nuclear Power Plants.
Systems interaction is defined as actions or consequences in one system that can adversely affect the redundancy or independence of safety systems or other plant systems.
The B&W Integrated Control System, classified as a non-safety system (see paragraphs 21 and 22, l
above),
was known to be one of the prominent examples of unresolved systems interaction questions.
NRC stated that "[t]he problem to be resolved by this task is to establish a systematic l
process to review plant systems to deter-mine their impact on various other plant systems."
Appendix A to this petition (hereinafter, App. A.),
para.
1.
f
- l l
PETITION ON C&W PLANTS Fcbruary 10, 1987 4
50.
NRC told Congress in January, 1978 that USI A-17 would be resolved by December 30, 1978.
On August 11, 1978, NRC reported that the completion date had slipped to May 1, 1980.
- 51..
On March 28, 1979, the Three Mile Island accident occurred.
Six weeks later, the NRC ordered all B&W owners to submit, "as soon as practicable,"
a " failure modes and effects analysis" of the Integrated Control System.
App.
A, para.
3.
Such an analysis would identify the ways in which the "non-safety related". Integrated Control System could fail and analyze the t
effects of these failures on other plant systems.
52.
In October,
- 1979, the. NRC issued NUREG-0585, the "TMI-2 Lessons Learned Task Force Final Report."
The report concluded 4
that the " systems interaction" problem was more serious than previously understood and recommended broadening the scope of l
Unresolved Safety Issue A-17.
The NRC Task Force stated:
1 The interactions between non-safety-grade and safety-grade equipment are numerous, varied, and complex and have not been systematically evaluated.
Even though 1
there is a general requirement that failure of non-safety grade equipment or structures should not initiate or aggravate an accident, there-is no comprehensive and systematic demonstration that this has been accomplished.
App. A, para. 5.
j i
f 53.
On October 10, 1979, the NRC Operations Team investigating the TMI-2 accident from the agency's Office of Inspection and 3
Enforcement concluded that a " problem" highlighted by the i
accident was that the " Integrated Control System (ICS) is not
[ classified] Class IE safety-related."
It recommended that in the'"near term" NRC determine the requirements for a safety-grade ICS and evaluate the safety of continued plant operation without j
a safety-grade ICS.
App. A, para. 6.
I i ;
A l
~.. - -
. __ =
PETITION ON C&W PLANTS Fsbrumry 10, 1987 t
54.
In October 1979, the NRC staff and its contractor, Oak Ridge National Laboratory, evaluated a " generic" failure modes and effects analysis of the ICS submitted by the B&W owners group.
Among the many criticisms raised was the a priori exclusion by B&W of failures caused by loss of electrical power to the ICS from the scope of the study.
Oak Ridge noted that " events of much more significance than those analyzed [by B&W) have occurred at operating plants."
B&W responded:
" Power supplies and their reliability is a problem for the customer which needs to be resolved on a plant by plant basis."
In addition, when asked by Oak Ridge to justify the failure to consider multiple failures although they "may have a significant probability of occurrence,"
1 B&W replied: "this type of analysis was considered too extensive for the time available."
App. A, para. 7.
55.
On October 25, 1979, NRC informed the holders of construc-tion permits for B&W plants that it was "beginning to look more i
deeply" into the B&W designs and was initiating a six-month program to " focus on the risk implications of the sensitivity of the B&W design and on the potential for interactions arising from the Integrated Control System."
App. A, para. 8.
56.
In April, 1980, the NRC's Advisory Committee on Reactor Safeguards (ACRS) published its review of the agency's plans to j
prevent recurrence of accidents as serious as TMI-2.
The ACRS noted that an accident at Rancho Seco a year before TMI-2 "had I
provided an important illustration of how control systems can both cause and aggravate transients. "
The ACRS continued: "The more recent transients at Oconee on November 10, 1979 and Crystal River on February 26, 1980 add further emphasis." The ACRS called for "a
broad study which re-evaluates in a systematic way the regulatory approach to what have been previously considered non-safety systems, controls and instrumentation."
App. A, para. 9.
i i f i
- _,..., _. _ -.. _ -. ~,.,,, _ _ _ _,, _. _. _, _ _. -. _ -. _
_,,,..y-
PETITION ON C&W PLANTS Februcry 10, 1987 57.
In August, 1980,'NRC issued the final version of "NRC Action Plan Developed as a Result of the TMI-2 Accident," NUREG-0660.
The agency stated that, after evaluating the recommendations of a task force on the transient response of B&W plants it would
" direct" licensees "to make required changes," without specifying what those might be.
The report noted that completion of the changes should result in, inter alia:
- new requirements for 'nonsafety' systems important to safety;
- requirements to address the B&W reactor sensitivity issue;
- requirements for modifications emanating from the studies in USI A-17, to be issued by August 1980.
App. A, para. 11.
58.
In November, 1980, NRC issued NUREG-0737, a " clarification" of the TMI Action Plan requirements.
With regard to the B&W Integrated Control System issues, the clarification stated that the agency had received B&W's analysis in August 1979 (See paragraph 51, above),
had sent a request for additional information to B&W owners on November 7, 1979, and were (as of November, 1980) reviewing the responses.
No action was directed "pending completion of [NRC) staff review."
App. A, para. 12.
59.
On November 17, 1980, John Ahearne, then Chairman of the
- NRC, in response to a letter from Congressman Morris Udall concerning control system failures, stated: "since such failures may have severe consequences, the NRC staff has begun to better 1
define their safety significance."
Ahearne further noted that NRC was considering establishing a separate, new Unresolved Safety Issue entitled " Safety Implications of Control Systems" so that the problem "may be resolved expeditiously."
Ahearne assured the congressman that, depending upon NRC's evaluation, i i
PETITION ON C&W PLANTS Fcbru:ry 10, 1987 the agency "will take whatever actions are necessary to continue to assure adequate protection of the public health and safety."
App. A, para. 13.
60.
In March,
- 1981, NRC informed Congroco that it had escablished a new Unresolved Safety Issue, USI A-47,
" Safety Implications of Control Systems," with a " preliminary estimate for completion" of April, 1984.
App. A, para. 15.
61.
In September, 1981, the Nuclear Safety Oversight Committee, a presidentially-appointed follow-up to the Kemeny Commission on the TMI-2 accident, published the report of its Reactor Safety Research Group.
It found, inter alia:
In recent years, several severe or potentially severe transients in LWRs [ light water reactors] have been initiated by control system failures.
Research is needed to better define the role of the plant control systems in LWR safety so that those changes which are important to safety can be made.
App. A, para. 16.
62.
In February, 1983, the ACRS reported to Congress, expressing the following concerns about NRC's progress on Unresolved Safety Issue, USI A-47,
" Safety Implications of Control Systems" (the "new" USI created two years earlier):
Our concern is that the [NRC research] programs appear to focus almost exclusively on detailed computer modeling of existing plant systems.
We saw no evidence of effort to define the risk contributed by existing systems or to specify appropriate performance criteria on a risk or reliability basis.
Secondly, the importance of this USI is such that we urge more emphasis on its early resolution, and less emphasis on broad and not yet well-defined areas.
App.
A, para. 17.. - _.
h PETITION ON B&W PLANTS Februcry 10, 1987 4
63.
In February, 1984, NRC reported that the date for completion of Unresolved Safety Issue USI A-17 (the first " systems j
interaction" USI) had slipped to March 30, 1986.
The original completion date had been December 30, 1978.
(See paragraph 50, above.)
In addition, the completion of the new USI A-47, " Safety Implications of Control Systems," then slated for January 30, 1986, was changed to "Not Scheduled."
App. A, para. 18.
Neither Unresolved Safety Issue A-17 nor Unresolved Safety Issue A-47.has i
vet been resolved.
i 64.
The above is-just a partial listing of the numerous studies, reports and task forces over the years which have acknowledged, I
j identified and assessed the unique safety hazards posed by B&W j
plants.
The repeated studies have been accompanied by and i
followed by promises to resolve those hazards, but the NRC has i
yet to take effective action.
On the contrary, the studies seem l
to have become a substitute for action rather than a means to l
achieve it.
Indeed, in recent years, the NRC has moved backward rather than forward, as in its failure to set and enforce any deadlines for implementing the "long-term" safety modifications stemming from analyses of the TMI-2 accident.
The latest I -
" reassessment" of B&W plant safety announced by NRC in January, 1986 falls into the same pattern of inexcusable delay.
i iii.
The NRC lacks the technical capability to accurately I
predict the complex behavior characteristics of B&W plants in accident conditions and has not devoted the resources j'
necessary to acquire that capability.
L l'
65.
Although the safety hazards inherent in the B&W design have f
been identified in many NRC reports and by the recurring accidents at B&W plants, NRC has allowed the B&W plants to f_
continue operation with a set of ineffectual band-aid fixes and 1
PETITION ON C&W PLANTS Fcbrutry 10, 1987 repeated unkept promises to get to the root of the hazards.
A major factor contributing to NRC's failure to develop solutions to the long-standing unresolved safety issues affecting B&W plants is that the agency lacks the technical capability to analyze the complex behavior characteristics of their designs in sufficient detail to predict the outcome of operational transients and accidents.
Furthermore, the NRC has failed to devote the resources necessary to acquire the capability to analyze, in the same level of detail as other pressurized water reactor designs, the unique aspects of the B&W designs.
66.
The fact that the NRC staff lacks the technical capability to analyze the behavior of B&W plants to the same level of detail as other pressurized water reactors has long been evident. During the agency's evidentiary hearings on the restart of Three Mile Island Unit 1 (TMI-1),
the NRC staff failed to demonstrate a factual basis for its claim that B&W plants can achieve adequate core cooling using two methods of cooling called the " boiler-condenser mode" and " feed and bleed" cooling.
67.
For some accidents, including small break loss-of-coolant accidents, all PWRs rely on natural circulation of the reactor cooling water to transfer heat from the reactoa
're to the steam generators.
However, because of the unique arrangement of the reactor coolant system piping in B&W plants, a steam bubble will form in the high point of the piping and block natural circula-tion of water through the core.
68.
During the TMI-1 restart hearings, the NRC staff acknowledged that liquid natural circulation cooling would be interrupted, but claimed that a two-phase (liquid water and steam) mode of natural circulation, called " boiler-condenser" cooling, would eventually be established.
However, the NRC staff PETITION ON C&W PLANTS Fcbruary 10, 1987 also testified "there are
- n_o, experimental data from a test facility geometrically similar to the B&W reactor design confirming the boiler condenser mode of natural circulation."
NRC Staff Testimony of Brian W. Sheron and Walton L.
Jensen, Jr.,
in response to Appeal Board Questions 2, 4,
5, 6,
7, 9,
10 and 11, p.
8, ff. Appeal Tr.
83, March 7,
1983, emphasis added.
Furthermore, UCS proved that, contrary to the staff's written testimony, the NRC's computer calculations "do not show the establishment of the boiler-condenser process."
ALAB-729, 17 NRC 814, 842 (1983).
When the NRC staff attempted to explain the physical phenomena occurring in the boiler-condenser process, the NRC's Appeal Board found that the staff's explanation " appears to us to be contrary to some basic laws of physics."
I_d.,
n.
- 118, at 845.
69.
Despite these gaps in the NRC staff's know1cdgc, the Appeal Board relied on B&W computer calculations, in combination with the NRC staff's endorsement of the heat-transfer equations used by B&W, as its basis for concluding that "the boiler-condenser method will satisfactorily remove decay heat at TMI-1."
- However, the Appeal Board noted that "[f]uture experimental work is planned to investigate the boiler-condenser mode of cooling" and recommended "that this cooling process be studied further as part of continuing research in order to increase the current knowledge of thermal-hydraulic behavior during small break loss of coolant accidents."
ALAB-729, 17 NRC 814, 842 - 844, 848.
70.
With regard to this future testing of the boiler-condenser mode, the NRC staff had testified that "[t]he purpose of the testing is not to confirm the effectiveness of boiler condenser decay heat removal."
NRC Staff Testimony of Brian W.
Sheron and Walton L.
- Jensen, Jr.,
- supra, p.
9, emphasis added.
- However, well after the TMI-1 hearings had ended, the NRC delineated f
PETITION ON C&W PLANTS Fcbrutry 10, 1987
" Issues and Concerns Regarding Adequate Decay Heat Removal i
Capability in TMI-1 Restart (Applicable to all B&W Designed Plants)."
The NRC stated that testing "to assess the effectiveness of the boiler-condenser process to re:nove heat from the reactor coolant and maintain natural circulation" was among 3
the " areas where continued research is needed."
Enrico F. Conti, Office of Nuclear Regulatory Research, to Thomas Rehm, Office of the Executive Director for Operations, March 13, 1985, enclosure, 4
" Areas Where Continued Research is Needed," p. 2, emphasis added.
71.
The NRC Appeal Board also was troubled by the lack of experimental verification of the asserted alternative backup cooling mode called " feed and bleed. "
The theory advanced by the NRC staff was that the core could be adequately cooled by j
using the high pressure emergency core cooling pumps to " feed" water into the reactor coolant system and using the PORV or the pressurizer safety valves to " bleed" water out.
t 72.
At NRC's request.if?J contractor, EGGG, " conducted experi-ments to investigate the feasibility of primary coolant system feed and bleed as a means of rejecting decay heat in the absence i
of steam generator heat removal."
P.
North, EG&G, to R.
- Tiller, i
DOE, " Primary Coolant System Feed and Bleed - PM-137-82," August l
6,
- 1982, p.
1.
Although the NRC staff had maintained in the TMI restart hearings that the capability-of feed and bleed to cool the core was shown by computer analyses, these subsequent
" confirmatory tests" cast serious doubt on the validity of the j
computer predictions.
In fact, the tests showed a continuous
{
loss of prin.ary coolant inventory which led to uncovery of the simulated reactor core and premature termination of the tests to prevent overheating of the simulated core.
Id.,
pp. 7-8; NRC l
l memorandum, R.
Mattson to D.
- Eisenhut,
" Board Notification I
l i
4 1 !
i
' PETITION ON C&W PLANTS FCbrutry 10, 1987 Concerning Recent Semiscale Test Results," August 30, 1982; See also Board Notification BN-82-93, September 14, 1982.
73.
After reopening the record to receive additional testimony and evidence on feed and bleed cooling as a consequence of the EG&G tests and additional computer analyses, the NRC Appeal Board found the NRC staff's assertion that feed and bleed "has been shown analytically to be effective" to be without merit.
The conclusions of these analyses lend some support for the position that feed and bleed can provide adequate core cooling at TMI-1.
- However, because of the uncertainties involved in the analyses and the failure of the staff witnesses to adequately address those uncertainties in their testimony, we are unpreparad to-state conclusively that feed and bleed will successfully provide core cooling at TMI-1.
As noted by UCS, staff witness Sheron testified at the reopened hearing that the adequacy of feed and bleed is within the range of experimental uncertainty.
Additional investigation of the uncertainties inherent in the analyses would be needed before a definitive statement on the viability of feed and bleed cooling could be made.
ALAB-729, 17 NRC 814, 852, emphasis added.
74.
These Appeal Board findings had no effect on the decision to l
restart TMI-1 only because the accidents for which feed and bleed cooling is relied on to protect the public were outside the limited scope of the TMI-1 restart hearing set by the NRC Commissioners.
However, they are applicable to this petition.
I As the NRC Appeal Board noted in 1983:
We consider the EFW (emergency feedwater) system sufficiently reliable for events within the limited i
scope of this proceeding.
- However, the staff has indicated that feed and bleed is relied upon for those events for which the EFW system is not fully safety-grade, such as main steam line break.
Furthermore, the staff testified that the EFW system function following
. 4 i
i PETITICN CN C&W PLANTS Fcbrunry 10, 1987 a safe shutdown earthquake has not been demonstrated since portions of the system piping and controls are not Seismic Category I.
While these events (such as a main. steam line break and a severe earthquake) are outside our purview, it is necessary to note our concerns over the possible reliance upon feed and bleed.
If the staff wishes to rely on feed and bleed, regardless of whether the event postulated is within the scope of the [TMI-1] restart proceeding, then it should promptly complete its analysis of the feed and bleed process to assure its reliability.
Id.,
at 855, emphasis added.
75.
The NRC staff's lack of technical capability to analyze the
" boiler-condenser" and " feed and bleed" modes of core cooling, as well as other aspects of B&W plant behavior during accidents, still exists and is handicapping the current safety reassessment.
On February 5, 1986, the NRC's research staff met with Department of Energy staff to discuss what help DOE might be able to provide to the NRC review of the B&W design.
One " area of NRC need" was described as follows:
" Determine the state of applicability and goodness of the NRC thermal hydraulic safety analysis codes (TRAC and RELAP) as currently configured as far as their ability to analyze operational transients now being experienced in B&W reactors and as far as their ability to model B&W hardware configurations."
T.
A.
Rehm, Assistant for Operations, NRC, to the NRC Commissioners, Weekly Information Report, February 12, 1986, enc 1. E,
- p. 2.
76.
When asked in early 1986 for the basis for confidence in the ability of current NRC computer codes to model the unique hardware configurations in B&W plants and to predict D&W plant behavior during accidents or operational transients, the NRC acknowledged a number of significant problems.
The thermal-hydraulic computer codes used by NRC to analyze D&W plants were developed and assessed against data from test facilities PETITION ON C&W PLANTS Fcbrucry 10, 1987 patterned after Westinghouse, Combustion Engineering and General Electric' designs.
According to NRC, when these computer codes are used to analyze complex transients in B&W plants, the codes operate "in regions where they remain Jargely untested," and
" confidence in the calculated results rests largely on assessment against data in geometries which do not model B&W designs, and on engineering judgement."
NRC added: "We currently believe that a continuing systematic evaluation is needed to determine whether the codes are capable of modeling complex transients involving systems such as the Integrated Control System, the auxiliary feedwater injection, secondary-side heat transfer, and the balance-of-plant, and that follow on efforts will be required to get data on these other transients."
NRC response to March 27, 1986 letter from Congressman Edward Markey,
- Chairman, Subcommittee on Energy Conservation and Power, April 15, 1986, Question 28.
77.
The NRC has made little progress since the TMI-2 accident in gaining a basic understanding of the behavior of B&W plants under abnormal (transient and accident) conditions.
Despite acknowledging wide gaps in basic understanding, the NRC has cut its research budget in the areas needed to fill these gaps and the nuclear industry has not stepped in to do the needed work itself.
78.
In an April, 1986, report assessing the impact of these budget cuts on the agency's ability to assure safety, the NRC staff focused on those areas which have the greatest implications for B&W plants:
The NRC research program addresses the ability to understand and predict the behavior of power plants as a result of transients and accidents.
This information is used to help reduce the potential for accidents.
The focus of this research is the understanding and i
PETITION ON B&W PLANTS Fcbruary 10, 1987 l
modeling of thermal hydraulics.
All integral experimental facilities in the United States will have been shut down by the end of 1986.
U.S.
industry people have taken the attitude that the plants are safe enough and industry has shut down or plans to shut down its integral test facilities.
This inability to conduct experiments to examine the safety implications of important plant transients, which typically occur at the rate of one or so per year, may present real problems.
" Impacts of Budget Cuts on NRC's Ability to Assure Safety (Overview)," enclosure to memorandum for Samuel J.
- Chilk, Secretary, from Victor Stello, Jr.,
Executive Director for Operations, April 30, 1986, pp.
1-2, emphasis added.
79.
With particular regard to the B&W plants the NRC staff noted its continuing " limited ability" to predict plant behavior under accident conditions:
Operational transients in B&W plants (Rancho Seco, Davis-Besse, Crystal River) have indicated that B&W reactor systems are significantly more sensitive to system upsets than other PWR's.
NRC safety analysis codes now have a limited ability to predict the outcome of B&W plant transients and accidents.
Id.,
p.
8, emphasis added.
Moreover, the NRC noted that B&W and the B&W owners had " indicated that they see no regulatory or safety need" to participate in the testing program cut out of NRC's budget.
PETITICN:CN E&W PLANTS Fcbrusry;10, 1987 C.
The Risks Posed by the B&W Plants are Immediate and NRC Has Provided No Reasoned Basis for Permitting Them to Operate for an Unlimited " Interim" Period Until Necessary Safety Improvements Are Made.
80.
We'have shown above that: 1) the B&W plants present grave safety hazards; 2) NRC's promised re-examination of B&W plant safety has been compromised in scope and schedule by NRC's delegation of its regulatory responsibility to the owners of the B&W plants; 3) the promised safety re-examination is the most recent example of a years-long practice by the NRC of using study after study as a means of.foresta111ng effective action to solve the B&W problems; and 4) NRC lacks the technical-capability to accurately predict the complex behavior characteristics of B&W plants in accident conditions and has not devoted the. resources necessary to acquire that capability.
81.
NRC nonetheless has allowed the B&W plants to continue operation with a set of ineffectual band-aid fixes and repeated unkept promises to get to the root of the hazards.
As long as the plants are allowed to operate, they pose an undue risk to the health and safety of the public.
While the NRC asserts that the plants can continue to operate safely in the
" interim,"
paragraphs 82 through 90, below, demonstrate that there is no technical basis for this NRC assertion.
82.
In its January 24, 1986 letter to the B&W owners announcing the "new" safety reassessment of the B&W plants, the NRC asserted that, while this reassessment is ongoing, B&W reactors can safely continue to operate "in the interim."
V.
Stello to H.
- Tucker, supra, Jan. 24, 1986, p.1.
No temporal limitation to the term
" interim" was provided, nor did the NRC present any technical justification whatever for concluding that the risk posed by the B&W reactors is acceptable.
PETITION ON B&W PLANTS February 10, 1987 83.
On January 29, 1986, Congressman Matsui asked NRC to explain its position on continued operation of the B&W plants in view of NRC's belief that the repeated " incidents" at B&W plants were serious enough to require a year-long safety review.
NRC replied on April 23, 1986, stating the NRC staff's view that the plants can continue to be 6perated safely while the reassessment is underway.
The NRC offered two reasons:
first, that the " events" at B&W plants "have had little or.no offsite consequences" and
- second, that post-TMI changes "are be'1'ng incorporated at the facilities."
Nunzio J.
Palladino, Chairman, NRC, to Robert T.
Matsui, Enclosure, p.
1, April 23, 1986.
/84.
Neither rationale provides a technical basis for the staff's position.
As to the first, the NRC appears to be suggesting that there must be "offsite consequences". (i; e., deaths,
- injuries, land contamination or all of these) a1E a B&W reactor before it can conclude that 'the plants pose sufficisnt risk to call for immediate corre'ction of recognized safety hazards.
In fact, the evidence discussed above demonstrates that, in the absence of fundamental safety improvements, there will ~at the very least be more close calls at B&W plants like those in the past.
The agency's failure to take effective action constitutes a gamble that the next accident will not be catastrophic.
85.
As to the second reason given to Congressman Matsui -- the unspecified reference to po$t TMI design changes the NRC itself acknowledges, as noted above, that these changes have not had the desired effect of reducing either the number or complexity of the " events" at B&W reactors.
Indeed, the planned i
reassessment of the basic design of B&W plants is predicated on the acknowledgment that these fixes have been ineffective in resolving the fundamental B&W safety problems.
t.
i m
PETITION ON B&W PLANTS Fgbruary 10, 1987
'86.
On March 27, 1986, Congressman Markey also attempted to determine the NRC's technical basis for allowing continued operation of the B&W plants "while the NRC reassesses
'the overall safety of B&W plants (to) determine whether the present set of requirements lead to a level of safety that is comparable to other pressurized water reactors.'"
Edward J.
Markey, Chairman, Subcommittee on Energy Conservation and Power, to Nunzio J. Palladino, Chairman, NRC, March 27, 1986, enclosure, Question 18.a.
87.
NRC responded on April 15, 1986, stating that the recent
" events" at Davis-Desse and Rancho Seco "have concerned the [NRC]
staff."
The NRC went on: "However, in the case of the Davis Besse plant, the NRC Incident Investigation Team concluded that the root cause of the event was 'the licensee's lack of attention to detail in the care of plant equipment.'
This was a plant-specific finding."
With regard to the Rancho Seco event, the NRC stated that information provided by the B&W Regulatory Response Group demonstrated that the same event at other B&W plants would not have as severe results.
The NRC also repeated its statement that these "these recent events had little or no offsite j
consequences.
Therefore, neither event posed an undue risk to the public health safety."
NRC response to March 27, 1986 letter from Congressman Edward Markey, Chairman, Subcommittee on Energy L
Conservation and Power, April 15, 1986, Question 18.a.
88.
In other words, NRC's reason for allowing continued operation of the B&W plants is that the very events that caused NRC to initiate a safety reassessment of all the B&W plants are not applicable to the other plants.
This is fundamentally j
l
- inconsistent with the agency's January 24, 1986 letter to the B&W
\\
i
- owners, where the NRC cited re c ent events at B&W designed reactors" as the cause for its initiation of an examination of s
, }
l
- PETITION ON BGW PLANTS February 10, 1987 the basis design requirements for B&W plants.
It is clear that NRC has no technical basis for allowing the L&W plants to continue operating.
Furthermore, the second part.of NRC's 3
response, equating " undue risk" with the occurrence of offsite consequences, indicates that NRC will never make the finding that 1
the B&W plants. pose undue risk to the health and safety of the public until after there are severe offsite consequences.
Such a i
crabbed interpretation of its mandate to protect public health and safety is inconsistent both with NRC precedent, e.g.,
Petition for Emergency and Remedial Action, CLI-78-6, 7 NRC 400, 4
404 (1978), and with any reasonab]s interpretation of the Atomic Energy Act's mandate to prevent undue risk to the public.
89.
In sum, B&W plants pose unique and unacceptable safety hazards.
Despite the continued persistence of these hazards, as
- most recently demonstrated at Davis-Besse and Rancho Seco, the NRC has failed to take effective - action to make these plants safe, nor has the NRC presented any technical justification for its. unsupported assertion that B&W plants are safe to operate "in 4
the interim."
90.
Instead of requiring the B&W plants to chut down until a level of safety comparable to other pressurized water reactors is i
demonstrated, the NRC has once again embarked on the same course of inaction that has already proven ineffectual.
Unless and until fundamental modifications are completed, B&W plants will certainly continue to undergo transients similar to those that have occurred in the recent past.
Even if an event does not result in another melted core, each such incident degrades the safety margin available for the next event.
B&W plants, like all reactors, were designed to survive only a limited number of severe pressure and temperature cycles.
Each " event" increases the likelihood that the next will be catastrophic.
The B&W 4,
mu
,.m.
,y_
.,_,-,,-.-.,_,_-m,_-m--,_r,,
,,_,,,_,~..mm,,,,,....,,y,,,,
,,,,,,,,,,.,,,,,w.,_,,,.,,.
,.,m._,,r..,
-.-.,,,,,.r..-
PETITION ON B&W PLANTS Fcbrumry 10, 1987 plants should be shut down unless and until it can be shown that their fundamental problems have been corrected and that their operation does not pose undue risk to public health and safety.
III.
CONCLUSION AND RELIEF REQUESTED 91.
The NRC's obligation to ensure the safety of the public does not stop when a license is issued.
To the contrary, the United States Supreme Court has held that "public safety is first, last, and a permanent consideration in any decision on the issuance of a construction permit or a license to operate a nuclear facility.
Power Reactor Development Corp.
v.
Int'l Union, 367 U.S.
- 396, 402, 81 S Ct. 1529, 1532 (1961).
92.
The Supreme Court emphasized in Power Reactor that, even after a plant is licensed to operate, the Commission will retain jurisdiction "to ensure that the highest safety standards are maintained."
(367 U.S.
402, 81 S.Ct.
1532).
- Indeed, it is precisely this assurance of continued vigilance after licensing on the part of the Commission, combined with the fact that permittees proceed at their own risk, which is the alleged justification for issuing permits and licenses pending final resolution of outstanding safety issues.
If, after licensing, a grave safety problem is disclosed, the explicit promise of the Commission to continually assure the safety of operating reactors cannot be avoided.
93.
The Commission reiterated the nature of its continuing responsibility in response to a 1977 petition filed by the Union of Concerned Scientists:
l The Commission's responsibility does not cease with the l
issuance of a license.
If, in the Commission's i i
o
. PETITION ON B&W PLANTS F brucry 10, 1987 judgment, the public health and safety so requires the Commission may take action to revoke, suspend, or modify licenses, impose civil penalties, or issue cease-and-desist orders.
Petition for Emergency and Remedial Action, CLI-78-6, 7 NRC 400 (1978).
Moreover, the Commission noted that "if public health or safety so requires, such actions may be taken with immediate effect." I_d.
Where the information demonstrates an undue risk to public health and safety, the Commission will, of course, take prompt remedial action, including shutdown of operating facilities, as it has in the past.
Id.,
at 405, emphasis added.
94.
In a subsequent decision in the same case, the Commission applied a standard which has relevance here.
In deciding whether plants could continue to operate in the face of a substantial safety question that had been raised but not conclusively proven, the Commission directed the NRC staff, on a case by case analysis, to atake the determinations on the basis of a " technical judgment."
Petition for Emergency and Remedial Action, CLI 21, 11 NRC 707, 715 (1980).
In other words, once a serious safety question is raised regarding an operating plant, it is not sufficient for the agency to simply assert that the plant is safe enough to operate -- it must provide a sound technical reason why this is so.
The NRC clearly has not done so for the operating B&W plants.
95.
The facts discussed above demonstrate that the B&W plants pose undue risks to the public health and safety, that they are more dangerous than other pressurized water reactor plant designs, that the NRC's action to date in addressing that risk has been dilatory and ineffective, that NRC lacks the technical PETITION ON B&W PLANTS February 10, 1987 capability to analyze the accident behavior of B&W plants, and that there is nothing to be done on the reasonably foreseeable horizon to correct the B&W safety deficiencies.
The promise of more " study" is an insufficient response to a demonstrable current risk, particularly where the facts demonstrate that this study will not result-in meaningful change within a time frame commensurate with the risk.
96.
Therefore, the following relief is requested:
- a. suspension of the operating licenses for Arkansas Nuclear One Unit 1, Crystal River, Davis-Besse, Oconee Units 1, 2,
and 3, Rancho Seco and Three Mile Island Unit 1; b.
suspension of the construction permits for Bellefonte Units 1 and 2; c.
prior to reinstating these operating licenses and construction permits:
- 1) the NRC should complete its safety reassessment program of the B&W plants and identify the specific corrective action to be taken at each B&W plant;
- 2) a public adjudicatory hearing on each plant should be held to determine whether these corrective actions are sufficient to achieve a level of safety that ensures that operation will not pose undue risk to public health and safety; and
- 3) all changes found by the hearing board to be necessary to achieve that level of safety should be fully implemented at the B&W plant or, in the case of the Bellefonte plants, should be incorporated as conditions in the construction permits.
l l
_44
PETITION ON C&W-PLANTS Februtry 10, 1987 d.
unless the conditions enumerated in paragraph c.
above are met, the operating licenses and construction permits for the B&W plants should be revoked.
Respectfully submitted, t
Elly R.
Weiss General Counsel
/
Robert D.
Pollard Nuclear Safety Engineer Union of Concerned Scientists 1616 P Street, N.W.,
Suite 310 Washington, D.C. 20036 (202) 332-0900
_, - -. _. - ~.
APPENDIX A 1.
I PARTIAL CHRONOLOGY OF NRC ACTIONS PERTINENT TO B&W PLANT SAFETY
- 1) January 1, 1978 NRC issues NUREG-0410, "NRC Program for the Resolution of Generic Issues Related to Nuclear Power Plants."
This is the first. of the annual reports to Congress on NRC's plans for resolution of " Unresolved Safety Issues" required by. Section 210 of the Energy Reorganization Act of 1974, as amended.
NRC reports that it has established an unresolved safety issue (USI) designated as A-17, " Systems Interaction in Nuclear Power Plants." The " A" designates NRC's highest priority category of unresolved safety issues, defined as issues that " warrant priority attention in terms of manpower and/or i
funds to attain early resolution." Category A issues include those whose resolution could " provide a significant increase in assurance of the health and safety of the public." (Ref. 1, Appendix B.)
f NRC describes the problem to be resolved by USI A-17 as follows:
"[T]here is some question regarding the interaction of various plant systems, both as to the supporting roles such systems play and as to the effect one system can have on other systems, particularly with regard to whether actions or I
consequences could adversely affect the presumed redundancy and independence of safety, systems.
The problem to be resolved by this task is to establish a systematic process to review plant systems to determine their impact on various other plant systems. For purposes of this task, systems interaction is defined as actions or consequences in one system that could adversely affect the redundancy or independence of safety systems in another j
system or, systems."
i j
NRC tells Congress that this Unresolved Safety Issue will be resolved by December 30, 1978.
(Ref. 1, enclosure, Task Action Plan, Task A-17.),
j
- 2) August 11, 1978 i
NRC reports that the scheduled completion date for Unresolved Safety Issue A-17, " System Interactions in Nuclear Power Plants," has slipped from i
j!
December 30, 1978 to May '1, 1980.
(Ref. 2 at 1-30.)
l 3)
May 7-17, 1979 I
j As a result of the March 28,.1979,' accident at Three Mile Island Unit 2 (D1I-2), a B&W-designed reactor, the Commission orders all licensees of B&W plants to, inter alia, " submit a failure modes and effects analysis of the j
Integrated Control System to the NRC staff as soon as practicable." NRC notes 4
9 9
4.
~
v
-.,,--.r-_c,-,,__.,-.,-.,,,rm.,,%-
m
,,-,--_w.r.-r,yn,.,y-mm,-
--.e.%,..r%-_,-r.--wy-ey--.
,-,-,my.m..
~
that'"[t]he licensee stated that this analysis is now underway with high priority by B&W."
( See, e. g., Ref. 3. )
.4)
July 1979 NRC issues NUREG-0578, "MI-2 Lessons Learned Task Force Status Report and Short-Term Recommendations." The NRC " Lessons -Learned Task Force" was the group charged with identifying the changes needed in nuclear plants as a result' of the Three Mile Island accident.
The Task Force recommends that the systems used to initiate and control operation of auxiliary feedwater systems be upgraded to meet General Design Criterion 20 by January 1, 1980, and to meet all' safety-grade requirements by January 1,1981.
( Ref. 4 at A-30, A-31, B-4. ) ~ Safety-grade requirements are the set of rules NRC traditionally applies to plant systems important to sa fety.
Rey are intende'd to assure the high reliability of these systems by governing design, construction, quality assurance, testing, etc. For B&W plants, this upgrading would include the integrated control system (ICS) or would require.new instrumentation and controls independent of the ICS.
- 5) October 1979 NRC ' issues NUREG-0585, "MI-2 Lessons Learned Task Force Final Report."
The report concludes that the " systems interaction" problem is more serious than previously thought, and recommends changing the ' scope of the previously established unresolved safety issue, A-17. (See item 1 above.)
he Task Force states: " he interactions between non-safety-grade and safety-grade equipment are numerous, varied, and complex and have not been systematically evaluated. Even though there is a general requirement that failure of non-safety-grade equipment or structures should not initiate or aggravate an accident, there is no comprehensive and and systematic demon-stration that this has been accomplished."
(Ref. 5 at 32.) ne integrated control system in B&W plants is one of the most noted examples of such non-safety grade systems and was addressed in the Commission orders discussed above in item 3 The Task Force concludes: " comprehensive studies of the interaction of.
non-safety-grade components, systems and structures with safety systems and the effects of these interactions during normal operation, transients, and accidents need to be made by all licensees and license applicants.
Bis would constitute a significant alteration of the current unresolved safety issue concerning systems interaction."
(Ref. 5 at 33.)
- 6) October 10, 1979 The ' NRC Operations Team Office of Inspection and Enforcement, investigating the M I-2 accident concludes that one " problem" highlighted by the accident is that "the Integrated Control System (ICS) is not Class IE sa fety-related."
It recommends for "near-term implementation" that the NRC:
_ - *. Provide the requirements for a safety-related ICS.
- Evaluate the continued operation of B&W plants without
- safety-related ICS.
- Consider extra ' shift personnel assignments and procedural ccntrols to provide ICS backup during loss of power conditions and/or loss of the ICS situations.
The team states that it believes these actions are "already in progress."
(Ref. 6 at 1, 18, 19.)
- 7) October 23, 1979 NRC and its contractor, Oak Ridge National Laboratory, meet with B&W and B&W plant owners to discuss the ICS failure modes and effects analysis done by B&W (see item 3 above) which was submitted to NRC in August 1979.
Among the many criticisms raised by Oak Ridge and NRC is that B&W has excluded power supply failures from the scope of the study. This is important "especially considering that events of much more significance than those analyzed have occurred at operating plants."
B&W responds: " Power supplie[s]
and their reliability is a problem for the customer which needs to be resolved on a plant by plant basis." (Ref. 7 at 6.)
~
Dak Ridge and NRC also note that the B&W ar.alysis excluded multiple failures, although "it appears that multiple failure situations may have a significant probability of occurrence."
B&W is asked how it " justified" the omission of multiple failures. The B&W response:. "This type of analysis was considered too extensive for the time available."
(Ref. 7 at 7.)
Oak Ridge and NRC conclude that "... although the (B&W) report appears to be accurate, it does not appear to go far enough." (Ref. 7 at 9.)
- 8) October 25, 1979 NRC informs all holders of construction permits for B&W plants that the agency is "beginning to look more deeply" into B&W designs and is initiating a research program to " focus on the risk implications of the sensitivity of the B&W design and on the potential for interactions arising from the integrated control system." NRC estimates that this program will "be completed in about i
six months."
l NRC states that "a review of operating experience suggests that the ICS often is a contributor to feedwater transients.
In some cases the ICS 4
appeared inadequate to provide sufficient plant control and stability."
It notes that a " safety quality ICS" could reduce this problem in B&W plants.
(Ref. 8 at 1, 2 and encl.1, section IV.)
t t
2 e
- -,,.,, - -,., nn
<,-.,--,,,,m...,,,,n,.,,,-,.
,,,-e
,,,,,,,,,,,-~,,--,,.,,.,,---,-n-n
~_r,,,,nnrn,
,m,n.,,,,,,,
.,,,,,,,nn,,,c,,--
. 9) April 4, 1980 The Advisory Committee on Reactor Safeguards ( ACRS) reports on its review of the NRC's TMI Action Plan (NUREG-0660), which contains the agency's determination of the actions required to prevent recurrence of accidents as.
serious as TMI.
The ACRS notes that the Rancho Seco transient of March 20, 1978 "provided an important illustration of how control systems can both cause and aggravate transients. The more recent transients at Oconee on November 10, 1979 and Crystal River on February 26, 1980 add further emphasis." It adds: "the ACRS wishes to reiterate its belief that there is also need for a broad study which reevaluates in a systematic way the regulatory approach to what have been previously considered non-safety systems, controls and instrumentation."
(Ref. 9 at 3.)
10)
May 1980 NRC issues another official report on the safety of B&W plants, NUREG-0667, " Transient Response of Babcock & Wilcox-Designed Reactors."
Twenty-two recommendations are made to improve the safety of B&W plants, including the following:
- The Task Force strongly recommends that the auxiliary feedwater system ( AFW) on operating B&W plants be classified as an engineered safety feature system, and as such be upgraded as necessary to meet safety-grade requirements.
e Tne AFW system should be automatically initiated and controlled by engineered safety featut es (safety-grade) that are independent of the Integrated Control System, Non-Nuclear Instrumentation, and other nonsafety systems.
8 Installation of a diverse-drive auxiliary feedwater pump should be expedited at the Davis-Besse 1 facility.
- B&W plants should improve the reliability of the plant control systems, particularly with regard to undesirable failure modes of power source, signal source, and the integrated control system itself.
Specific recommendations in this regard included: elimination of "mid-scale" failure modes of instrumentation; unambiguous indication to the reactor operator of multiple instrument failures; automatic defensive action in the event of control system failures that could cause substantial plant upsets; and prompt followup actions on the ICS failure mode and effects analysis produced by B&W in August 1979 (discussed in items 3 and 7, above).
e Modifications shoud be made so that following a reactor trip, pressurizer level remains on scale and reactor pressure remains above the pressure at which high pressure injection
. s (emergency ~ core cooling] -is actuated. Meeting these objectives should be independent of all manual operator actions.
a The B&W licensees should evaluate possible modifications to reduce plant sensitivity _ to feedwater perturbations.
- , Hodifications shoul'd be made to reduce or eliminate the need for immediate manual actions in emergency procedures'
- Licensees should develop and implement promptly procedures concerning the loss of NNI/ICS power to enable the operator to bring the plant to a safe shutdown condition.
(Ref. 10 at 2 2-12.)
- 11) August 1980 NRC issues the final version of NUREG-0660, "NRC Action Plan Developed as a ' Result of the THI-2 Accident," which was originally issued in May 1980.
It notes that the report on B&W plants (discussed in item 10 above) was the result of a "short-term" assessment of the safety of B&W plants, and that among the three areas covered were the " effects and consequences of mal-functions and failures in the Integrated Control System (ICS) and non-nuclear
- instrumentation (NNI)."
NRC says it will evaluate the recommendations made by its task force on the transient response of IM4( plants and " direct" licensees
' of B&W plants "to make required changes."
(Ref. 11 at II.E.5-1.),
Among the other results NRC expects from completion of the Action Plan-requirements are:
- Improved systems-oriented approaches to safety reviews;
- Improvements in reliability requirements and the single failure criterion; New requirements for "nonsafety"' systems important to risk; Requirements to address the B&W reactor sensitivity issue;
- Requirements to address incidents of excessive feedwater flow; and
.a Requirements for modifications emanating from the studies in USI A-17, to be issued by August 1980.
(Ref. 11 at II.C-1 II.C-3, II.C-7.,)
- 12) November 1980 NRC issues NUREG-0737, a " clarification" of the TMI Action Plan requirements. With regard to the B&W integrated control system issues, it b*
. notes that it received the B&W analysis of the ICS in August 1979 (see item 7 above), sent a request for further information to B&W licensees on November 7, 1979 and that now (one year later) the responses from the licensees "have been received and are under review." No action is directed "pending completion of staff review." (Ref. 12 at II.K.2.9-1.)
13)
November 17, 1980 NRC Chairman John Ahearne respor.ds to a letter sent June 11, 1980 by Congressman Morris Udall, Chairman of the House Interior and Insular Affairs Committee, which sought the NRC's consideration of control system failures.
Chairman Ahearne states that "since such failures may have severe conse-quences, the NRC staff has begun to better define their safety significance."
He notes that the NRC is considering designating the control system failure issue as an Unresolved Safety Issue which "would assure priority for resources needed for timely and effective resolution of this issue."
(Ref.13 at 1.)
As the agency's basis for believing that B&W plants are now safe enough to operate in the face of this problem, Ahearne states:
At the present time, the Commission is relying on the consensus engineering judgement of senior staff thst the risk associated with control system failures is not sufficient to require immediate corrective actions such as power derating.
(Id.)
Chairman Ahearne concludes with the following sentence:
Please be assured that the Commission is evaluating the safety significance of control system failures and, depending on our findings, will take whatever actions are necessary to continue to assure adequate protection of the public health and safety.
(Ref.13 at 2.)
Ahearne's letter has enclosures outlining the future program to address control system failures.
It includes the creation of a new branch to focus on system interactions, continuation of the Interim Reliability Evaluation Program, and consideration of the licensees' responses to NRC's 1979 Bulletin 79-27. " Loss if Non-Class IE Instrumentation and Control System Bus During Operation."
The enclosures also note that NRC is considering establishing a separate, new Unresolved Safety Issue entitled " Safety Implications of Control Systems," so that the problem "may be resolved expeditiously."
(The NRC's THI Lessons Learned Task Force had essentially recommended the establishment of this Unresolved Safety Issue in October 1979, more than a year earlier.
See item 5 above.)
- 14) February 1981 NRC's quarterly report to Congress on " abnormal occurrences" notes that "as previously reported, the NRC is studying the question of sensitivity of Babcock & Wilcox (B&W)-designed plants to transient response and failures of the instrumentation and control systems on a generic basis."
NRC is also e
- -. ~. -
r still " reviewing the licensees' responses" to the 1979 Bulletin 79-27. These reviews are now scheduled to be completed by March 1981.
(Ref. 14 at 21.)
- 15) March 1981 NRC informs Congress that it has established a new Unresolved Safety Issue, USI A-47, " Safety Implications of Control Systems." The NRC's " primary goal" is "the development of a comprehensive and consistent set of require-ments and design criteria" to " improve the reliability of control systems,"
" reduce the effects of control system failures," and " improve the capability of coping with the effects of control system failures," including procedural and training improvements. NRC tells Congress that "a preliminary estimate for completion of this program is April 1984."
(Ref. 15 at A A-11. )
16)
September 1981 The Nuclear Safety Oversight Committe, the Presidentially-appointed follow-up to the Kemeny Commission, publishes the report of its Reactor Safety Research Review Group. This Group notes:
In recent years, several severe or potentially severe transients in LWRs (light water reactors) have been initiated by control system failures.
n a a Research is needed to better define the role of the plant control systems in LWR safety so that those changes whoich are important to safety can be made.
(Ref. 16 at I-7.)
17)
February 18, 1983 The Advisory Committee on Reactor Safeguards reports to Congress on the NRC's safety research program. The ACRS expresses two concerns about the NRC work related to resolution of USI A-47, Safety Implications of Control Systems:
"Our first concern is that the (NRC research ] programs appear to focus almost exclusively on detailed computer modeling of existing plant systems. We saw no evidence of effort to define the risk contributed by existing systems or to specify appropriate performance criteria on a risk or reliability basis. *
- Secondly, the importance of this USI is such that we urge more emphasis on its early resolu-tion, and less emphasis on broad and not yet well-defined areas.", (Ref.17 at 22, emphasis added.)
18)
February 17, 1984 NRC reports that the date for completion of Unresolved Safety Issue A-17,
" Systems Interactions in Nuclear Power Plants," has slipped to March 30, 1986.
(The original completion date was December 30, 1978; see item 1 above.)
NRC also reports that the date for completion of Unresolved Safety Issue A-47, " Safety Implications of Control Systems," was originally scheduled for J anuary 30, 1986, but its current completion date is "Not Scheduled."
(Actually, NRC's original estimate of the completion date for A-47 was April 1984; see item 15 above.)
(Ref. 18.)
19)
August 16, 1985 NRC reports that completion date for Unresolved Safety Issue A-17 has
- slipped to July 31, 1986 and the completion date for Unresolved Safety Issue A-47,has slipped to October 1, 1986.
(Ref. 19.)
20)
January 24, 1986 Victor Stello, NRC's Acting Executive Director, writes to the B&W owners group that a series of recent operating events at B&W reactors, including most prominently the Rancho Seco transient of December 26, 1985, has led the NRC to conclude that "there is a need to re-examine the basic design requirements for B&W reactors." Stello states that, despite modifications, "the number and complexity of events has not decreased as expected" and this has renewed NRC's concerns about the sensitivity of B&W plants.
NRC plans to complete its re-examination of B&W plant safety by the end of 1986.
Meanwhile, says Stello, NRC believes the B&W plants can be operated safely.
(Ref. 20.)
21)
January 31, 1986 NRC sends Information Notice No. 86-04 to all nuclear plants describing the event "resulting from a loss of power to the integrated control system" which occurred at the B&W-designed Rancho Seco plant on December 26, 1985.
(A copy is attached.)
It identifies eleven separate equipment failures, malfunctions and other " problems" which occurred during less than an hour, including overcooling, violation of the reactor pressure vessel limits, failures in the auxiliary feedwater system, and inability to control valves.
(It is also noted that one senior reactor operator collapsed from exhaustion at a control panel and was taken to the hospital.)
Licensees are told by NRC that they are " expected" to review the information in the notice and to " consider" taking actions to prevent similar
" problems" in their plants.
"However," NRC says, " suggestions contained in this notice do not constitute requirements; therefore, no specific action or written response is required."
(Ref. 21 at 1.)
w.
- _ _ _ _. References 1.
NUREG-0410 "NRC Program for the Resolution of Generic Issues Related to Nuclear Power Plants," January 1, 1978.
2.
Status Summary Report, Data for Decisions, Generic Technical Activities, August 11, 1978.
3.
44 Fed. Reg. 27779-27780, May 11,1979.
4.
NUREG-0578, "TMI-2 Lessons Learned Task Force Status Report and Short-Term Recommendations," July 1979.
5.
NUREG-0585, "THI-2 Lessons Learned Task Force Final Report," October 1979 6.
R. D. Martin, Memorandum to J. M. Allan, " Operations Team Recommendations," October 10, 1979.
7.
Summary of Heeting Held on October 23, 1979 with Representatives of Babcock & Wilcox (B&W) Owners Group, B&W and Oak Ridge National Laboratory to Discuss the " Integrated Control System Reliability Analysis,"
(BAW-1564), December 19, 1979, NRC Docket Nos. 50-269, 270, 287, 289, 302, 312, 313, 346.
8.
H. R. Denton, letter to S. H. Howell, Consumers Power Company, with enclosures, NRC Docket Nos. 50-329, 50-330, October 25, 1979 (Similar letters were sent to all holders of contruction permits for B&W plants.)
9.
Milton S. Plesset, ACRS Chairman, letter to John F. Ahearne, NRC Chairman, "NUREG-0660, 'NRC Action Plans Developed as a Result of the TMI-2 Accident,' Draft 3," April 17, 1980.
- 10. NUREG-0667, " Transient Response of Babcock & Wilcox-Designed Reactors,"
May 1980.
_ _... - - -. - _. - - - - -. - _ _ _ _ _ _ _ _ _ _ - - -. _. - _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ - - - - - - - - - - - --__ _ _ _ _ - - - - - 11. NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Accident,"
August 1980.
4
- 12. N'JREG-0737, " Clarification of TMI Action Plan Requirements," November 1980.
4
- 13. John Ahearne, NRC Chairman, letter to Congressman Morris Udall, November 17, 1980.
- 14. NUREG-0900, Vol. 3, No. 3. " Report to Congress on Abnormal Occurrences, July - September 1980," February 1981.
i
- 15. NUREG-0705, " Identification of New Unresolved Safety Issues Relating to Nuclear Power Plants," Special Report to Congress, March 1981.
6
- 16. Rasmussen, et al, Report of the Reactor Safety Research Review Group, Nuclear Safety Oversight Committee, September 1981.
I
- 17. Advisory Committee on' Reactor Safeguards, A Report to the Congress of the United States of America, NUREG-0963, " Review and Evaluation of the Nuclear Regulatory Commission Safety Research Program for Fiscal Years i
1984 and 1985," February 18, 1983.
- 18. NUREG-0606, Vol. 6, No.1, " Unresolved Safety Issues Summary," February l
17, 1984.
- 19. NUREG-0606, Vol. 7, No. 3, " Unresolved Safety Issues Summary," August 16, 1985.
l
- 20. Victor Stello, Jr., Acting Executive Director for Operations, letter to Hal Tucker, Chairman, Babcock & Wilcox Owners Group, January 24, 1986.
i i
- 21. IE Information Notice No. 86-04, " Transient Due to Loss of Power to Integrated Control System at a Pressurized Water Reactor Designed by Babcock & Wilcox," January 31, 1986.
i e
t JEB 10 M1 SSINS No.: 6835 j
IN 86-04 UNITED STATES NUCLEAR REGULATORY COMMISSION 0FFICE OF INSPECTION AND ENFORCEMENT WASHINGTON, DC 20555 Ja'nuary 31, 1986 IE INFORMATION NOTICE NO. 86-04:
TRANSIENT DUE TO LOSS OF POWER TO IN1EGRATED
~
CONTROL SYSTEM AT A PRESSURIZED WATER REACTOR DESIGNED BY BABCOCK & WILC0X Addressees:
All"nuclia"r pow'er facilities ho'iding an. operating license (OL) or a construction-permit (CP).
Purpose:
wateF rea. ice is to inform recipients of a recent event at an-operating pressurized This not ctor resulting from loss of power 'to 'the integrated control system.
Recipients are expected to review the information in this notice for applicability to their facilities and consider actions, if appropriate, to preclude similar problems from occurring at'their facilities. However. suggestions contained in thte natice do not constitute NRC requirements: therefore, no speciric action or wHtta- ::;: ; " g ic,.4
~
j f
^
Description of Circumstances:
~
On December 26,"1985, Rancho Seco was operating on automatic control at a constant power level of 710 MWe (76% of licensed power). At 4:14 a.m., power to the integrated control system (ICS) was lost. The annunciator alarm for
" Loss of ICS or Fan. Power" sounded. As designed, ICS demand, signals went to
~idscale. The main feedwater valves closed to 50%, and the atmospheric dump m
valves", turbine bypass valves, and one set of auxiliary feedwater valves opened to 50%.
The main feedwater pump speed was reduced to minimum.
Low discharge pressure,at the main'feedwater pump caused the motor-driven auxiliary feedwater pump to start automatically.
The net decrease in feedwater flow caused the reactor.to trip on high~ reactor coolant system (RCS) pressure.
Af ter the reactor trip, the above ICS valves remained at 50% (i.e., could not be operated fror. the control room) causing excessive cooling of the RCS which, was exacerbated by autostarting of the dual-drive auxiliary feedwater pump.
During the 26 minutes required to restore ICS power, operators acted to mini-mize the resulting transient.
However, difficulties were experienced with manipulation of. valves, operation of pumps, and control of various liquid levels, pressures, and temperatures.
RCS pressure decreased to a minimum of 1064 psig at 4:21 a.m.
At 4:40 a.m., the lowest RCS temperature (386*F) during the cooling transient was reached.
RCS pressure at that time was 1413 psig.
Eventually, a senior reactor operator discovered that switches which supplied 4601290048
IN 86-04 Page 2 of 3 January 31, 198G power to the ICS de power supplies were in the off position and set them to the on position. Although manual (i.e., hand) operation was now possible in the control room, the valves initially received a 100% demand signal. Opera-tors quickly shut the valves. At 5:00 a.m., RCS pressure and temperature were stabilized at 716 psig and 433*F and maintained there for 3 hours3.472222e-5 days <br />8.333333e-4 hours <br />4.960317e-6 weeks <br />1.1415e-6 months <br />. This unusual event, which was declared at 4:30 a.m., was terminated at 8:41 a.m.
Before the event was terminated, a large number of problems were experienced,
~
including:
The RCS was cooled 180'F in 24 minutes violating the technical specifications limit of 100*F in 1 hour1.157407e-5 days <br />2.777778e-4 hours <br />1.653439e-6 weeks <br />3.805e-7 months <br />.
Recommended pressure / temperature limits for pressurized thermal shock were exceeded; however, nil ductility temperature limit in the,'
technical specifications was not violated.
Pressurizer level was low and off scale.
After loss of ICS power, ICS controlled valves could not be. manually
~
operated from the control room.
One auxiliary feedwater isolation valve could not be closed.
One auxiliary feedwater flow control valve was overtorqued us'ing'
~
the manual handwheel, and the manual operator failed.
Operators had considerable difficulty determining (locally) the 2...
position of the auxiliary feedwater flow control valves.
One steam generator was overfilled.
A main feedwater flow recorder in the control room failed at midscale G'
because of the loss of ICS power although main fee.dwater flow was essentially zero.
An RCS makeup pump was run without water (i.e., suction valve ' shut) and severely damaged, specifically, seals for the makeup pump failed and approximately 450 gallons of water were spilled in the auxiliary building.
A containment radiation monitor was damaged because it continued to run after the suction valve had been shut by a Safety Features -
Actuation Signal.
Four senio.r reactor operators were present during the event.
At 5:01 a.m., one of them collapsed from exhaustion in front of a control panel. He was trans-ported by ambulance to a loc'al hospital and subsequently released in satisfactory condition at 7:00 a.m.
IN 86-04 Page 3 of 3 January 31, 1986 6T scus'sion:-
The NRC sent an incident investigation team (IIT) to Rancho Seco shortly after the event.
The licensee has agreed to hold in abeyance any work in progress or planned (except as required by plant safety considerations) until the licensee and the NRC have had an opportunity to develop detailed trouble-shooting plans for failed equipment.
Further, the licensee has agreed to maintain the unit in a shutdown mode until NRC concurs with the licensee that
.the unit can be returned to power safely.
Review by the IIT is continuing.
As additional information about the event is obtained, this notice will be supplemented, if appropriate.
No specific action or written response is -required by this information notice.
If you have any questions about this matter, please contact the Regional Administrator of the appropriate NRC regional office or this office.
1
~
- f l
Mard ordan, I)f rector Divisi n f Emergency Preparedness and gineering Response Office of Inspection and Enforcement Technical
Contact:
'R'N' Woodruff, IE (301)492-8597
Attachment:
List of Recently Issued IE Information Notices O
O e
e e
,a a r..i t t,
UNITED STATES OF ANERICA NUCLEAR REGULATORY CONNISSION 87 FEB 10 A8:15 SUPPLEMENT #1 TO O
PETITION FOR IMMEDIATE ACTION TO RELIEVE UNDUE RISK POSED BY NUCLEAR POWER PLANTS DESIGNED BY THE BABCOCK & WILCOX COMPANY 1.
The following names should be added to the list of petitioners in paragraph 1. of the Petition for Immediate Action to Relieve Undue Risk Posed by Nuclear Power Plants Designed by the Babcock & Wilcox Company, dated February 10, 1987:
Coalition for a Nuclear Free Great Lakes P.O. Box 331 Monroe, MI 481161
Contact:
Michael Keegan, Acting Chairperson Senator Linda Furney Ohio State Senate, District 11 State House Columbus, OH 43215 Ed Green Route 7, Box MLC-25 Tallahassee, F1 32308 Timothy F. Hagan, Commissioner County of Cuyahoga County Administration Building 1219 Ontario Street Cleveland, OH 44113 Larry J. Hochendoner, Commissioner Dauphin County Board of Commissioners P.O. Box 1295 Harrisburg, PA 17108
SUPP. #1 TO PETITION ON B&W PLANTS FE'RUARY 10, 1987 Three Mile Island Alert 315 Peffer St.
Harrisburg, PA 17102
Contact:
Erio Epstein Toledo Coalition for Safe Energy P.O. Box 4545 Toledo, OH 43620
Contact:
Mike Ferner Honorable Peter C. Wambach State Representative House P.O. Box 130 The Capitol Harrisburg, PA 17120 Jean White R.D. #1, Box 1330 Felton, PA 17322 Respectfully submitted,
/
I i
Ellynit. Weiss Genera'L Counsel Union of Concerned Scientists 1616 P Street, N.W.,
Suite 310 Washington, DC 20036 (202) 332-0900 Dated:
February 10, 1987
. 4 I