ML19346A182

Proposed Findings of Fact & Conclusions of Law on Plant Design & Procedures Issues,In Form of Partial Initial Decision

ML19346A182
Person / Time
Site:	Three Mile Island
Issue date:	06/01/1981
From:	Baxter T METROPOLITAN EDISON CO., SHAW, PITTMAN, POTTS & TROWBRIDGE
To:
Shared Package
ML19346A179	List: ML19346A178 ML19346A182
References
NUDOCS 8106050337
Download: ML19346A182 (226)

Text

.

i TABLE OF CCNTENTS Page I. INTRODUCTION II. FINDINGS OF FACT A. Natural and Forced Circulation (UCS-1 and 2)

B. Additional LOCA Analysis (BQ UCS-8; ECNP-1(e))

C. Detection of Inadequate Core Cooling (ANGRY-V(B))

D. Abnormal Transient Operating Guidelines (BQ 11) ,,

E. Safety System Bypass and Override (UCS-10; Sholly-3)

F. Systems Classification and Interaction (UCS-14)

G. Equipment Qualification (BQ UCS-12)

H. Pressurizer Heaters (UCS-3)

I. Connection of Press.urizer Heaters to Diesel (UCS-4)

J. Emergency Feedwater Reliability (BQ 6)

K.

Valves and Valve Testing (UCS-5; BQ UCS-6)

L. Integrated Control System (Sholly-6a)

M. Containment Isolation (Sholly-1)

N. Filters (Lewis; ANGRY V(D))

8106050 337

0. Computer (Sholly-13; ECNP-la)

P. In-Plant Instrument Ranges (Sholly-5; ECNP-ld)

Q. Safety System Status Panel (BQ UCS-9; ECNP-1c)

R. Control Room Design-Human Factors Engineering

, (Sholly-15; ANGRY V(C))

S. Accident Design Bases (BQ UCS-13)

T. Staff Review and Recommendations (BQ-1, 2, 3, 5,- 7)

U. Concluding Findings of Fact 4

III. CCNCLUSIONS 0F LAW s

I l

l 2

v- -- - , , - - + ,,-,e-, yt-, -,e--ry3 - - - - .,,e-, y -,%.--w.-+,. ---.~e-y.--i y,----_*- s , w --p -r --w -ye., mwe-ww--,,t+-weve--*e-- e*- "w+

P LIC 6/1/91 UNITED STATES OF AMERICA' NUCLEAR REGULATORY COMMISSION B3 FORE THE-ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

) .

METROPOLITAN EDISON COMPANY ) Docket No. 50-289

) (Restart)

(Three Mile Island Nuclear )

Station, Unit hc. 1) )

CERTIFICATE OF SERVICE I hereby certify.that copies of " Licensee's Proposed Findings'of Fact and Conclusions of Law on Plant Design and Procedures Issues in the Form of a Partial Initial Decisf.on" were served this 1st day of June,1981 by deposit in the U.S.

mail, first class, postage prepaid, to the parties identified on the attached Service List.

l l

[

f -

Thomas A. Baxter l

l l

l l

l

. UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION i

BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

)

METROPOLITAN EDISON COMPANY ) Docket No. 50-289

) (Restart)

(Three Mile Island Nuclear )

Station, Unit No. 1) )

I SERVICE LIST

! Ivan W. Smith, Esquire John A. Iavin, Esquire QCN ' Assistant Counsel Atcmic Safety ard Licensing Pennsylvania Public Utility Ccmnission Board P.O. Box 3265 U.S. Nuclear Pegulatory Cm mission h rrisburg, Pennsylvania- 17120 Washingten, D.C.. 20555 Karin W. Carter, Esquire Dr. Walter H. Jordan Robert Adler, Esquire Atcmic Safety and Licensing Assistant Attorney General

. Board Panel 505 Executive House l 881 West Outer Drive P.O. Box 2357 Oak Ridge, Tennessee 37830 h M ahurg, Pennsylvania 17120 Dr. Linda W. Little John E. Minnich Atcmic Safety and Licensing Omi man, Dauphin 03cnty Board Board Panel of Ccmnissioners 5000 Hemitage Drive Dauphin County Courthouse Raleigh, North Carolina 27612 Front and Market Streets l

• M ahurg, Pennsylvania 17101 l Jams R. '1burtellotte, Esquire Offica of the Executive Iagal Director Walter W. Cohen, Esquire U.S. Nuclear Regulatory C - 4 anion Consuner Advocate Washington, D.C. 20555 Office of Consumer Advocate j 1425 Strawberry Square Docketing and Service Section Harrisburg, Pennsylvania 17127 Office of the Secretary .

U.S.' Nuclear Regulatory " M sion

Washington, D.C. 20535 t

4 y-- e---.. - . . , , - ~ -.,--..,%-+-.. --.-.-.---,,+v .----.-r--- .- .--------.,---..-,,,,--e-r--,..-.-e-.,..--,----w.- >.e..-

Jordan D. Cunningham, Es @ a Ibbert Q. Pollard 2320 North Second Street 609 M:ntpelier Street

, Harrisburg, Pennsylvania 17110 Baltinere, Maryla.vi 21218 Ms. Icuise Bradford Chuncey Kepford DE AIIRT Judith H. Johnsrud 315 Peffer Street Etvi.wital Coalition cn Ntriear Power Harrisburg, Pennsylvania 17102 433 Orlando Avenue State College, Pennsylvania 16801 Ellyn R. Weiss, Esquire Harnen & Weiss Marvin I. Iawis 1725 Eye Street, N.W., Suite 506 6504 Bradford Terrace Washington, D.C. 20006 Pb41aAa11tia, Pennsylvania 19149 Steven C. Shelly Marjorie M. Aamodt thicn of Conmmed Scientists R. D. 5 1725 Eye Street, N.W., Suite 601 Coatesville, Per:nsylvania 19320 Washington, D.C. 2000t5 2 xmas J. Germine, Esquire Gail Pradford Deputy At h ey General ANGKY Divisicn of Iaw - Boca 316 245 West Philadalphia Street 1100 Raymond Boulevard Ycrk, Pennsylvania 17404 Newark, New Jersey 07102 William S. Jordan, III, Esquire Ha2=cn & Weiss 1725 Eye Street, N.W., Suite 506 Washington, D.C. 20006 l

l l

l t

l l

1

LIC 6/1/81 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

)

METROPOLITAN EDISON COMPANY ) Docket No. 50-289

) (Restart)

(Three Mile Island Nuclear )

Station, Unit No. 1) )

l t

l LICENSEE'S PROPOSED FINDINGS OF FACT

! AND CONCLUSICNS OF LAW CN PLANT DESIGN AND PROCEDURES ISSUES IN THE FORM OF A PARTIAL INITIAL DECISION SHAW, PITTMAN, POTTS & TROWBRIDGE l

George F. Trowbridge l Thomas A. Baxter l Delissa A. Ridgway  :

Counsel for Licensee

,.---r--yW-.,-- ym-* -#-w yn,w,, ,,y.,p.m-,, ,y m- , y y*,,4 , vy.,.y y .rwm9.m- -*,y, wg mymp i- ,- gy my-y-9_j9-w -, ,ym_., y -y ,p,.- 9-,y ,

TABLE OF CONTENTS

2. age I. INTRODUCTION .......................................... 1 i

II. FINDINGS OF FACT ...................................... 6 A. Natural and Forced Circulation .................... 6 (UCS-1.and 2)

B. Detection of Inadequate Core Cooling ............. 19 (ANGRY-V(B))

C. Abnormal Transient Operating Guidelines .......... 66 (BQ 11)

D. Safety System Bypass and Override ................ 70 1 (UCS-10; Sholly-3) .

E. Pressurizer Heaters ............................... 95 (UCS-3)

F. Connection of Pressurizer Heaters to Diesels ...................................... 100 (UCS-4)

G. Valves ........................................... 113 (UCS-5)

H. Integrated Control System ........................ 125 (Sholly-6a)

I. Containment Isolation ............................ 147 (Sholly-1)

J. Filters .......................................... 151 (Lewis; ANGRY V(D))

K. Computer ......................................... 161 (Sholly-13; ECNP-la)

L. In-Plant Instrument Ranges ....................... 170 (Sholly-5; ECNP-ld)

• l l

M. Safety System Status Panel ....................... 184 (BQ UCS-9; ECNP-lc)

( N. Control Room Design-Human Factors l Engineering ..................................... 197

[ (Sholly-15; ANGRY V(C))

l t

l 1  !

O. Additional LOCA Analysis .............................

(BQ UCS-8; ECNP-1(e))

P. Systems Classification and_ Interaction ...............

(UCS-14)

Q. Emergency Feedwater Reliability ......................

(BQ 6)

R. Valve Testing ........................................

(BQ UCS-6)

S. Accident Design Bases ................................

(BQ UCS-13)

T. Staff Review and Recommendations .....................

(BQ-1, 2, 3, 5, 7)

U. Equipment Qualification ..............................

(BQ UCS-12)

V. Concluding Findings of-Fact ..........................

t III. CONCLUSIONS OF LAW ......................................

i l

i l

l

1 l

l l

-lii-l

LIC 6/1/81 UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

)

METROPOLITAN EDISON COMPANY ) Docket No. 50-289

) (Restart)

(Three Mile Island Nuclear )

Station, Unit No. 1) )

LICENSEE'S PROPOSED FINDINGS OF FACT AND CONCLUSIONS OF LAW CN PLANT DESIGN AND PROCEDURES ISSUES IN THE FORM OF A PARTIAL INITIAL DECISION I. INTRODUCTION

1. As we have already observed (paragraph 21, t

Introductory Findings, supra), the Board and the parties

! accepted Licensee's proposal to group intervenors' contentions l into the following major categories:

l a. Plant design and procedures;

b. Separation of TMI-l and TMI-2; *

c. Management qualifications of Licensee; and,

d. Emergency planning. c This portion of the Initial Decision includes the Board's i

findings of fact and conclusions of law on plant design and procedures issues.

i

2. The Board's findings of fact on plant design and procedures issues have been organized, in turn, by subsidiary subject matters. Each Board question and-intervenor contention which is addressed under a given subject is quoted in full at the outset of our findings on that subj,ect. Board limitations and clarifications on the scope of the contentions, if any, are also identified at the outset. Some subject matter sections address only one specific question or contention, while others address a number of them which are closely related and gen-erally were the subject of common evidenti;1ry presentations at the hearing.

3. The Board notes that the issues addressed in this portion of the Initial Decision are not among the unique concerns for TMI-1 identified by the Commission as additional to the concerns identified for other B&W reactors. See CLI-79-8, 10 N.R.C. 141, 143-144 (1979). In addition, the Board notes, as our detailed findings below will make clear, that many of the contentions, challenging the sufficiency of

{ actions recommended by the Director of Nuclear Reactor Regulation, call for additional plant modifications which are 3

equally applicable to other operating reactors, and which have not been required for those reactors.

4. The record of the hearing on plant design and-procedures issues includes the written and oral testimony of '

witnesses presented by Licensee, the NRC Staff and intervenor Union of Concerned Scientists ("UCS"). Among the exhibits

received which are relevant to the plant design and procedures isrues are Licensee's " Report in Response to NRC Staff Recommended Requirements for Restart of Three Mile Island Nuclear Station Unit 1" (the " Restart Report"), the NRC Staff's " Evaluation of Licensee's Compliance with the Short and Long Term Items of Section II of NRC Order dated August 9, 1979, NUREG-0680 (June 1980)" (the " Restart SER"),2 and Supplement No. 3 to the NRC Staff's Restart SER. These exhibits assess Licensee's compliance with the short and long-term actions on plant design and procedures recommended by the Director of Nuclear Reactor Regulation and set forth in Section II of the Commission's Order and Notice of Hearing -in this proceeding, CLI-79-8, 10 N.R.C. 141 (1979). Intervenor contentions which challenge the sufficiency of certain of these actions, and Board questions which addressed specific actions, were the subject of additional evidence presented by Licensee and the NRC Staff. To the extent that the necessity or l

sufficiency of the recommended short and long-term actions which relate to plant design and procedures have not been challenged by any party or examined with additional evidence in response to a specific Board question, the Board finds that l such actions are necessary and sufficient and relies upon the 1 Lic. Ex. 1. .

2 Staff Ex. 1.

3 Staff Ex. 14.

l l

_. . .. ,_. . . . . . - . - - - - - - - - - - - - - - - - - - - - - ' ~ - - ' ~ ~ ~ ~ ~ ~ ~ ' - ~ ~ ' ' ~ ~ ~ ~ ~ ~ ~ ~

Staff's assessment in the Restart SER and Supplement 3 that Licensee's plans to cc=plete the short-term actions prior to resumption of operation are satisfactory, and that Licensee has made reasonable progress toward satisfactory completion of the ,

long-term actions.4

5. The Board's findings of fact below do not address issues raised by intervenors UCS and Sholly on hydrogen l

generation and control because their contentions were never brought to trial.5 In the Board's First Special Prehearing '

Conference Order, we ruled that discovery may proceed on these contentions while the Board considered Mr. Sho11y's petition, under 10 C.F.R. $ 2.758,'to waive 10 C.F.R. S 50.44, LBP-79-34, 10 N.R.C.

828 (1979) at 836 (UCS Contention No. 11) and 842 (Sholly Contention No. 11). The Board subsequently

certified to the Commission on January 4, 1980, the questions of whether the provisions of 10 C.F.R. S 50.44 should be waived

! or exceptions thereto made in this proceeding, and whether post-accident hydrogen gas control should be an issue in this proceeding. LBP-80-1, 11 N.R.C. 37 (1980). In a Memorandum

! and order issued on May 16, 1980, the Commission determined i

l 4 There ace only a few actions which have not been the subject of additional evidence. They include short-term action 1.(c) (control grade anticipatory reactor trip),

a few of the IE bulletin items covered by short-term

action 2, and one of the NUREG-0578 recommendations -

(2.1.5.1, dedicated hydrogen control penetrations).

5 ANGRY Contention V(A), on the installation of a hydrogen recombiner, was withdrawn. Tr. 11,033.

t

,e...- ., ..m.g.-.+e-, .,y,we-..~--,--.m .y_, v.~,,-.--,- -,..,_,w.m--e.#,, *w. ..w.-+--+-.e--,-,.w-w--,,._.-__,.--_.e..- w.#- +-.v., ,-.em.-

i that 10 C.F.R. S 50.44 should not be waived or exceptions made thereto, and that post-accident hydrogen gas control may be litigated in the proceeding under 10 C.F.R. Part 100.

CLI-80-16, 11 N.R.C. 674 (1980), motion to reconsider denied, Commission Memorandum and Order (unpublished; September 26, 1C80). The parties then agreed to confer to determine whether an aareed-upon hydrogen control contention could be submitted to the Board. See Board Memorandum and Order, September 30, 1980. No contention was agreed to and submitted by the '

parties. Instead, UCS elected to stand on its original contention and to preserve its right of appeal from the Commission's refusal to waive the provisions of 10 C.F.R.'S 50.44. See, generally, Tr. 4556-86. Consequently, the Board 1

l now rejects UCS Contention 11 as inconsistent with the Commission's rulings. Mr. Sholly withdrew his Contention 11 in a written memorandum dated December 23, 1980. On January 15, i

l 1981, UCS did file an offer of proof on its Contention 11, outlining what it would have attempted to establish if the Commission had waived 10 C.F.R. S 50.44.

l l

II. FINDINGS OF FACT A. Natural and Forced-Circulation UCS Contention No. 1: The accident at Three Mile Island Unit 2 demonstrated that reliance on natural circulation to remove decay heat is inadequate. During the accident, it was necessary to operate i at least one reactor coolant pump to provide forced cooling of the fuel.

i However, neither the short nor long term measures would provide a reliable method for forced cooling of the '

l reactor in the event of a small loss-of-coolant accident ("LOCA").

This is a threat to health and safety l

and a violation of both General Design Criterion ("GDC") 34 and GDC 35 of l 10 CFR Part 50, Appendix A.

UCS Contention No. 2: Using existing equipment at TMI-1, there are only 3 ways of providing forced i cooling of the reactor: 1) the reactor coolant pumps; 2) the residual heat l

removal system; and 3) the emergency

' core cooling system in a " bleed and I

feed" mode. None of these methods meets the NRC's regulations applicable to systems important to safety and is sufficiently reliable to protect public health and safety:

a) The reactor coolant pumps do not have an on-site pcwer supply (GDC 17), their controls do not meet IEEE 279 (10 CFR 50.55a(h))

and they are not seismically and environmentally qualified (GDC 2 and 4). .

b) The residual heat removal system is incapable of being utilized at the design pressure of the primary system.

l 6-P

,-re- . -%-~.....-y- .g.,., -,-,,,,.,.,..,,w.,.,.----~,,,,,-%ym .,-- -.-,-.---,_,,,.w..,.-w.--..,m ,.--wv, ..+-,w.....--..,---,#-.e--,-v.-m,.,---.ve. ,,y.-__ -w,

i

' c) The emergency core cooling system cannot be operated in the bleed and feed mode for the necessary period of_ time because of inadequate capacity and radiation shielding for the storage of the radioactive water bled from the primary coolant system. '

f

6. Contentions 1 and 2 of the Union of Concerned Scientista challenge the adequacy of natural circulation to remove decay heat at TMI-1.0 Contention 1 asserts that the accident at TMI-2 demonstrated the ina'dequacy of natural '

circulation, while contention 2 alleges that the equipment i

available at TMI-1 to provide forced cooling of the reactor '

does not meet NRC regulations and is not sufficiently reliable.7 '

7. Natural circulation is the-normal means of providing core cooling for pressurized water reactors when all reactor coolant pumps are inoperative. The natural circulation phenomenon is an inherent design feature at plants such as TMI-1, whereby a temperature and density distribution promotes 6 While the contentions are directed at TMI-1, the Board has been presented no evidence upon which to believe that TMI-1 is unique, among pressurized water reactors, either in its reliance on and capability to maintain natural circulation, or in-the equipment used to provide forced cooling. -

7 Intervenor UCS presented no direct testimony in support of these contentions.

l

_7_

_ _ , - - - - . . , . . . _ , - ~ - - - _ . . - . . . . . _ . . . . - , _ . . _ , - - , - . . - ~ _ _ . . - - , - . - . . . - . . . _ , - . _ . . _ . _ . _ , . . , _ . _ _ . . - . _ . - . . , , - . , .

a positive pressure drop in the reactor coolant system.

Removing core decay heat from the primary coolant with the steam generators (and thus increasing the coolant density) at a

! higher elevation than the elevation at which heat is added in the core (decreasing the coolant density) produces a force

. (from the density differential) which induces a continuous flow in the primary loop. Keaten and Jones, ff. Tr. 4588, at 3, 4 and Fig. 1; Jensen-1,8 ff. Tr. 4913, at 3. Forceo cooling is

[

not needed to establish natural circulation. Tr. 4623-24 (Jones).

!. 8. Analyses have been performed, utilizing conserva-tive assumptions over a wide range of plant conditions, to determine that natural circulation is adequate to maintain core cooling when all of the reactor coolant pumps are inoperative.

Natural circulation has also been tested at operating B&W plants. The testing confirmed that natural circulation can be initiated and maintained over a wide range of plant conditions, and demonstrated that the design analyses conservatively predict the natural circulation capabilities of the plants.

The analyses and testing show that the primary system fluid will remain subcooled following a loss of all reactor coolant pumps, and that a core coolant temperature difference of between 20*F and 40*F will result. This temperature difference 8 NRC Staff Testimony of Walton L. Jensen, Jr., Relative to Primary System Natural Circulation, UCS Contention 1 f

("Jensen-1").

-g- se a,- n-, ------vem-e-v>wn,-ge- ww,,,w ,,,----r,.- ---w,,m-.--,-n ,-----wv--o--,--,n--- --- ~,-

---

.r---n---w-<r -w~,-r,,-e--- a-, w--,~,--,r-ww-,,---r-

I also occurs in the steam generators, and results in a natural circulation flow rate of between 24 and 4% of the normal value with all four reactor coolant pumps in operation. This natural circulation flow rate is adequate for core decay heat removal.9 Keaten and Jones, ff. Tr. 4588, at 4, 5; Jensen-1, ff. Tr.

4913, at 4, 5; Tr. 4697 (Jones).

9. Unplanned occurrences of natural circulation core cooling have been experienced at B&W operating plants. This experience further demonstrates the adequacy of B&W plants under this condition. In all of these events, in which the reactor coolant pumps were inoperative, natural circulation maintained.the plant in a safe condition. Keaten and Jones, ff. Tr. 4588, at 5; Tr. 4703-05 (Jones).

10. Single-phase (no voids) natural circulation,10 which we have discussed above in paragraphs 7-9, is the normal

{ cooling mode that would occur following the tripping of reactor i

coolant pumps during an anticipated operational transient.

9 The reactor will trip when the reactor coolant pumps stop operation. Consequently, natural circulation is required to remove only decay heat. Decay heat is about 7% of full power ben the reactor is first shut down. This heat level quickly t ..

ays to 4% within 40 seconds, and to roughly 1% in one hour.

Jensen-1, ff. Tr. 4913, at 4; Keaten et al., ff. Tr. 16,552, at 6.

10 Licensee's witnesses used the term " natural circulation" to refer to the single-phase condition. See Tr. 4682-83 (Jones). Staff witness Jensen used the term " natural circulation" to refer.to both the single-prise and two-phase ~

conditions. Tr. 4932, 4940 (Jensen). Thc latter condition was called the " boiler-condenser" cooling mode be Licensee's witnesses. Keaten and Jones, ff. Tr. 4588, at 7.

-g-w - -

, - . , . - , . ---,,--n-.-,, - , m-m-,

l l

'I i

During a small-break loss-of-coola.st accident ("small-break LOCA"), however, voids may form in the reactor coolant system

, and prohibit natural circulation. In fact, for the majority of the accidents in the small-break LOCA spectrum, Licensee's '

analyses predict voiding in the reactor coolant system such that natural circulation cannot be maintained throughout the accident.11 Keaten and Jones, ff. Tr. 4588, at 2-3, 5-6; Tr.

4854 (Jones). It is necessary, then, to address the means for providing adequate core cooling for a small-break LOCA where natural circulation may not be available. This involves both the energy removal from the core und the energy removal from the primary system. See, Keaten and Jones, ff. Tr. 4588, at 6; Tr. 4851 (Jones).

11. Initially in a small-break LOCA, energy stored in the core is transferred into the primary system coolant by the forced circulation cooling inherently provided by the coastdown of the reactor coolant pumps following an assumed l loss of off-site power. Then, as long as the core remains covered by liquid coolant or a two-phase mixture, the cladding temperature will remain within a few degrees of the fluid temperature of the coolant, and adequate core cooling will be maintained. Should the fuel rods become uncovered to a limited ,

extent and/or for a limited period of time, cooling of the 11 The adequacy of Licensee's small-break LOCA analyses is addressed extensively in section II.0, infra.

4 l

l I

l uncovered portion of the core is provided by a two-phase mixture. The emergency core cooling system ("ECCS") is designed to provide the necessary makeup fluid'to the primary system to compensate for the loss of coolant and to assure that sufficient fluid is maintained within the reactor vessel for adequate core cooling. Keaten and Jones, ff. Tr. 4588, at 6.

12. The energy added to the primary system coolant must also be removed in order to prevent the occurrence of excessive system pressures. Secondary heat removal is not required for small-break LOCAs of a size of approximately 0.02 ft 2 or greater, since the energy discharged through the break is sufficient to prevent a pressure increase, whether or not forced or natural circulation occurs. Keaten and Jones, ff.

Tr. 4588, at 6, 7; Tr. 4852 (Jones).

13. For break sizes of approximately 0.01 ft and smaller, only a portion of the decay heat would be removed through the break and natural circulation (single or two-phase) would remove the remainder of-the decay heat.12 Jensen-1, ff.

Tr. 4913, at 5. For breaks of this size, during the period of the transient that the primary system (excluding the pressurizer) remains sufficiently free of voiding, natural circulation flow will be established in the system and the steam generator will remove the added energy if a secondary

! 12 The dividing line for break sizes where sufficient energy is discharged through the break so that secondary heat removal is not required lies between 0.01 and 0.02 square feet. Tr. 4931 (Jensen); Tr. 5079 (Jones).

11-

--e-*v-*n- ---o-ww.-- a.-e --%vs-,-,--,-www wsg-yy,y,.e-hm- wd 4 -W*t" F=-"'twe'*-""Tw-*vw7~mwWtMw9t"-r'W-'rW"WNS 'T Vhvw f- *-'W'**v""' Pvt W-Nw--WwM--M-N'W- 9

• 1 w ww t==w9gi-yww'w- --

heat sink is available. If primary system voids increase to a volume sufficient to fill the 180* inverted U-bends at the top of both of the reactor coolant system hot legs, the natural circulation process would be interrupted. However, assuming continued main or emergency feedwater availability, a boiler-condenser process would then occur. In'this process, steam generated by core decay heat rises through the hot leg and is condensed in the steam generator. The condensed primary

> coolant then returns to the core by gravity flow through-the cold legs to provide further heat removal. Keaten and Jones, ff. Tr. 4588, at 7; Tr. 4852-54 (Jones); Jensen-1, ff. Tr.

4913, at 6. Natural circulation and, if needed, the boiler-condenser cooling process are adequate to remove all of the core decay heat, provided that primary system inventory is maintained. Tr. 4695-96 (Jones). In the opinion of the Staff witness, natural circulation (single or two-phase) is a more reliable cooling mode than forced cooling with reactor coolant pumps. Tr. 4994, 4999 (Jensen).

14. If main and emergency feedwater are not delivered to the steam generators for these smaller LOCAs, heat removal from the primary system can be accomplished by the

" feed and bleed" mode of cooling. In this operational mode, which is a form of forced circulation cooling, the high pressure injection (HPI) system is utilized to " feed" water to the reactor coolant system, and the pressurizer relief and/or safety valves " bleed" the water from the system.1 In this 13 Board questions on the reliability of the feed-and-bleed cooli,ng mode, including any required operator actions and the (continued next page)

- ,_s,_.,. . _~ ,_,_%. . . , _ - - - , , . - . , , . - , _ . ,. .,,.,,,m, ._,.,,,,,y_ _ , _ , , . . . , _ . . , , , - - .,,,y_

manner, the inventory injected by the HPI system is used to assure that the core is covered by liquid coolant or a l two-phase mixture (and, thus, adequately cooled), while the water discharged through the pres urizer relief and/or safety valves removes the energy added to the primary system bv the core. Keaten and Jones, ff. Tr. 4588, at 7, 8; Keaten et al.,

ff. Tr. 16,552, at 8; Jensen-1, ff. Tr. 4913, at-8-9.

i

15. Licensee witnesses Keaten and Jones, who are I both obviously familiar with the accident at TMI-2, responded to the allegation in UCS Contention 1 which asserted that the accident demonstratsd that reliance on natural circulation to remove decay heat is inadequate. They testified that the periods of inadequate core cooling did not occur due to any inherent inability of natural circulation or the other decay heat removal processes described above, but rather were due to premature reduction of HPI flow such that the fuel rods were not covered by a two-phase mixture. After adequate injection flow was restored, and subsequent to the core damage, the core i

was effectively cooled even though natural circulation was not occurring in the primary system. Keaten and Jones, ff. Tr.

i l

i 4588, at 8; Tr. 4854-55 (Jones). This analysis -- that natural circulation did not occur at TMI-2 because of insufficient I

(continued) -

discharge capabilities of the relief valves, and on its role in bringing the plant to cold shutdown, are a part of Board Question 6, " Emergency Feedwater Reliability." See section II.Q, infra.

t l

I k e

_ . . _ , _ _ _ . . _--. --. - _. .. _ .--.. - . - - - - - - - - - - - - - - - - - - - - - - - - - - - - ' " - - " ' ' ~ ~ ' ~ ~ ' ~ * ~~

primary coolant inventory caused by premature HPI termination

-- was unanimously endorsed by two NRC Staff witnesses.

Jensen-1, ff. Tr. 4913, at 7; Tr. 5363 (Johnston).

16. The operation of a reactor coolant pump, which

was initiated at~approximately 16 hours1.851852e-4 days <br />0.00444 hours <br />2.645503e-5 weeks <br />6.088e-6 months <br /> after the start of the accident at TMI-2, was-performed to reestablish a uniform

(

l temperature 61stribution in the primary system by removing voids from the 180* bend in the rea ctor coolant hot legs, and to establish heat removal via the steam generator. The reactor coolant pump was tripped approximately one month after the accident, and since that time natural circulation has provided adequate core cooling even with the cord blockage which is believed to exist. Keaten and Jones, ff. Tr. 4588, at 8, 9.

17. The current General Design Criteria 34 and 35 of-Appendix A to 10 C.F.R. Part 50 require that systems be provided to remove core residual heat and to provide' emergency core cooling, respectively. See Jensen-1, ff. Tr. 4913, at 11-14. The Board finds that, contrary to UCS Cuntention 1,-the accident at TMI-2 did not demonstrate that natural circulation is inadequate to remove decay heat. Rather, the accident demonstrated' that maintaining adequate primary system inventory is essential to adequate core cooling, and that natural 4

circulation cannot be established in the presence of signifi-cant primary system voiding. This is conceded by Licensee in

• l its analyses of small-break LOCAs, where voiding is predicted to interrupt natural circulation in the majority of cases.

t 4

. - - _ _ _ _ - . _ _ , _ . _ . - . . _ _ . . . . _ . _ . . . _ . _ . _ . _ . _ _ . _ _ _ . ~ . _ _ , ~ _ _ _ _ _ _ _ . . . _ . _ , . . . - -

Then the boiler-condenser cooling mode will provide adequate primary coolant heat removal. For these cases the Board finds, on the basis of the uncontradicted evidence, that the emergency core cooling system provides the necessary inventory makeup for adequate core cooling, without forced circulation from the reactor coolant pumps.

18. While our findings on UCS Contention 1 essentially foretell the Board's conclusions on Contention 2 as well, we turn, nevertheless, to the specific allegations of

, deficiencies in the equipment available to provide forced cooling of the reactor at TMI-1.

19. First it is asserted that the reactor coolant pumps do not meet certain NRC regulations applicable to equipment important to safety. See UCS Contention 2, item (a).

There is no evidence that reactor coolant pumps at pressurized water reactors have ever been classified by this Commission or its licensees as equipment " important to safety"l4 within the meaning of the referenced General Design Criteria, excep.t to the extent that the pump casings form part of the reactor coolant pressure boundary. In fact, current regulations require that adequate core cooling be provided assuming a loss of off-site power, with the resultant tripping of reactor 14 The regulatory concept of equipment "important to safety" ~

is explored below in our findings on systems classification and interaction (UCS Contention 14). See section II.P, infra.

+.w.s.--- ,, , - - ,-.----,e- -.-e,--- se --+ , = . , , - , ,,,.rgr w- w- ,.-*~3---w,-y--mv<,,---- --v, -,--~~3---n-- - , - .- - - , -, -

coolant pumps. Analyses have been performed which demonstrate that the required core cooling is assured when forced circula-tion by the reactor coolant pumps is not available. See, paragraphs 8, 10-14, supra, and section II.0, infra .

Therefore, since the reactor coolant pumps are not required to assure adequate core cooling, the regulations cited in UCS Contention 2 are not applicable to pump operation. Keaten and Jones, ff. Tr. 4588, at 9, 10. See also, Jensen-2,15 ff. Tr.

4913. '

20. Second, it is asserted that the residual heat removal system (or the low pressure injection (LPI) system) is not enpable of being utilized at the design pressure of the reactor coolant system. See UCS Contention 2, item (b). This is conceded by Licensee. See Keaten and Jonss, ff. Tr. 4588',

at 10. However, while the LPI system cannot operate at the design pressure of the reactor coolant system, there is no need i for it to do so. The capability of providing forced cooling to the core without reliance on the LPI system, and at the design pressure of.the primary system, already exists in the form of

! the feed-and-bleed cooling mode.

l Consequently, there is no need for the residual heat removal system to be capable of operation at the design pressure of the reactor coolant system.

Id. at 10, 11.

15 NRC Staff Testimony of Walton L. Jensen, Jr., Relative to Primary System Forced Flow Circulation, UCS Contention 2

("Jensen-2').

16-

. - - * , , - , . , . . , , ,e.w,. -~ . - - - , , - ,, y.--,,-..-..w , , y .-e----,-.-my-y., - , - < - - - , . - - - - . . - . - - - - -

21. Finally, it is alleged that feed-and-bleed cooling is unreliable because of inadequate capacity and shielding for the storage of radioactive water bled from the primary system. In the feed-and-bleed operation, fluid ,

discharged from the reactor coolant system is received initial-ly by the pressurizer relief quench tank. If this cooling mode continues, the mass of fluid " bled" from the primary system will exceed the capacity of the quench tank, and will be discharged into the containment. If feed-and-bleed cooling is continued, the borated water storage tank (the initial source of HPI water to the reactor coolant system) will be emptied, and supply for the HPI system will'be changed to the contain-ment sump, via the LPI system. (See Lic. Ex. 14 for an illustration of the fluid flow paths for these system configu-rations, and the accompanying explanation at Tr. 5049-52 (Jones); see also, Keaten et al., ff. Tr. 16,552, at 6.)

Throughout this sequence, the containment, by design, provides adequate capacity and shielding for the discharged fluid.

Keaten and Jones, ff. Tr. 4588, at 11.

22. Although the necessary reactor coolant system cooling water will be stored inside the containment, operation

in the feed-and-bleed cooling mode will result in the transport of some of the coolant through components and piping located outside the containment building. In response to a " lessons .

f learned" recommendation 16 t perform a radiation and shielding i

16 Item 2.1.6.b (Design Review of Plant Shielding), NUREG-0578, TMI-2 Lessons (continued next Learned page) Status Report and Short Term Recommendations l

t i

s

.,.,.4 .-,. y +-,e...-r .,--,.,--,....v.- -

w,.y - ,--. ,,--,_.,,._m,_.,.,,_.,_,-,.--.---.,r- - , , , . . . . . , - - - . , . .-me,._-,, ,

l l

design review of the spaces around systems that may as a result of an accident contain highly radioactive materials, Licensee has performed a study to identify any locations in which personnel occupancy may be unduly limited or safety equipment unduly degraded by the-radiation fields which might exist after an accident. See Lic. Ex. 1, 5 2.1.2.3. The results of thie l study have identified only one concern for use of the feed-and-bleed cooling mode, even if the coolant were highly radioactive. The concern is that a portion of the HPI piping is located in proximity to two motor control centers which perform functions important to safety. Highly radioactive fluid in the HPI pipes would result in radiation levels at these motor control centers sufficiently high that the integ-rity of some of the materials found in the motor. control centers cannot be demonstrated.17 Consequently, Licensee will install, prior to restart, new shield walls between the HPI piping and the motor control centers which will reduce the (continued)

(July 1979). While we are concerned here with the adequacy of radiation shielding specifically for the storage of radioactive water during feed-and-bleed operation, the NRC Staff's review documenting Licensee's compliance with the short-term requirements of this item and demonstration of reasonable progress toward the satisfactory completion of the long-term requirements of the recommendation is documented in Staff Ex. 1 at C8-32, 33, and in Staff Ex. 14 at 35, 36.

17 These radiation levels will not result if feed-and-bleed cooling operates as anticipated, in accordance with the B&W ~

operating guidelines and the TMI-1 operating procedures. The need for additional shielding arises only because of the non-mechanistic assumption, used in the study, of widespread core damage from an unknown cause. Tr. 4752-53 (Jones);

4753, 4761-62 (Keaten).

I I

t -.-. - .-. - .. - - - - -- -. - - - - - - - -

radiation levels at the motor control centers to levels at which material integrity.can be assured. Keaten and Jones, ff.

Tr. 4588, at 12, 13; Tr. 7770-73 (Keaten).

23. To summarize the evidence on UCS Contention 2, the Board finds that: operation of the reactor coolant pumps is not required to assure adequate core cooling; the residual heat removal system is not required to operate at the design pressure of the primary system; and, the emergency core cooling system can be operaced in the feed-and-bleed mode with adequate capacity and radiaticn shielding for storage and recirculation of the radioactive water. In short, reliable means beyond natural circulation already exist to remove core decay heat following a small-break LOCA.

4

~B. Detection of Inadequate Core Cooling

1 ANGRY Contention No. V(B): The NRC Order fails to require as conditions for restart the following modifications in the design of the '

TMI-l reactor without which there can be no reasonable assurance that TMI-l can be operated without endangering the public health and safety:

l (B) Installation of instrumentation providing reactor operators direct information as to the level of primary coolant in

.the reactor core.

l

24. The pre-filed testimony of Licensee and the NRC Staff o' *he detection of inadequate core cooling addressed, in l

addition to the contention (quoted above) of the Anti-Nuclear Group Representing York (" ANGRY"), UCS Contention No. 7 and Mr.

Sholly's Contention No. 6(b). In a written memorandum dated December 23, 1980, Mr. Sholly withdrew his Contention 6(b). By letter dated January 5, 1981, UCS withdrew its Contention 7 and consequently-did not offer the testimony which UCS had already

( filed in support of the contention. Subsequently, no

, intervenor, including ANGRY, participated in the evidentiary sessions at which the Licensee and Staff testimony on this issue was heard.

25. In addition to the contentions raised by intervenors, however, the issue of detecting inadequate core cooling came before the Board because of a dispute between Licensee and the NRC Staff. The Director of Nuclear Reactor Regulation has recommended, among other things, that as "short-term" action 8 Licensee should be required to comply.

with the Category A recommendations of NUREG-0578 18 prior to the resumption of operation, and that as "long-term" action 3 Licensee should be required to comply with the Category B recommendations of NUREG-0578. With respect to the recom-mendations in NUREG-0578, section 2.1.3.b (Instrumentation for Detection of Inadequate Core Cooling in PWRs and BWRs), the

Staff has concluded that Licensee is in compliance with the

\

18 NUREG-0578: TMI-2 Lessons Learned Task Force Status

Report and Short-Term Recommendations (July 1979).

I

~,, -- - - , , - , , - , . r,- , - -.+- .,,-yg . -m-.--yaw-- .,,,-.-r,,--, .,e.m-,mm-,-,,.wr,,v,n--,----.en. .m-+,-,,7,,. w,, e, , - - +r short-term recommendations, but that Licensee has not shown reasonable progress on the long-term recommendations. Staff Ex. 14 at 27-30. This is the only negative find'ing reached by the Staff on the recommended actions (both short-term and long-term) specified in the Commission's Order and Notice of Hearing. See id. at 3.

~

26. Since the Board must not only decide ANGRY contention V(B), but also resolve a very important dispute between Licensee and the Staff, we have devoted a good deal of attention to our findings on the detection of inadequate core cooling. In order to decide this controversy, the Board must determine: (a) whether the'long-term recommendations of section 2.1.3.b of NUREG-0578, as construed and applied by the NRC Staff, are necessary and sufficient to provide reasonable assurance that the facility can be operated for the long-term without endangering the health and safety of the public; and (b) if so, or if another requirement (or another construction and application of section 2.1.3.b of NUREG-0578) is found to be necessary, whether Licensee has demonstrated reasonable progress toward the satisfactory completion of the requirement.

27. The evidence presented by Licensee and the Staff makes it clear that the Board must examine not ;nly the j instrumentation to detect an inadequate core coc14 e uondition, but also the instrumentation available to detect the approach -

of such a condition, and the procedural guidance and training provided to the TMI-1 control room operators to avoid the onset l

---

~--,me. ,e >,,---.~w,s e,--- -- ,n.--m,e---,,---w-,e-,--m~,,---o,- .,,-~~,--v----,en -,e- -,--.-em+- w

of an inadequate core cooling condition and to respond to the condition if it occurs.19 It is the Board's opinion that it is the sum of these parts which must be judged, in the light of both conservative and realistic. projections of system perfor-mance. Consequently, we will first consider the instru-mentation, then the procedures and the operator training provided at TMI-l to avoid the onset of inadequate core cooling and to respond to an inadequate core cooling condition if it occurs. At that point the Board will resolve ANGRY Contention V(B) and decide the necessity and sufficiency of the short-term recommendations in section 2.1.3.b of NUREG-0578. Finally, we will examine the necessity and sufficiency of the long-term recommendations in section 2.1.3.b of NUREG-0578, and Licensee's progress toward the satisfactory completion of any long-term requirement recommended by the Board.

Instrumentation at TMI-l

28. To achieve the goal of assuring adequate core cooling for power operation at TMI-1, the safety analyses which have been performed for the plant have defined the parameters which must be monitored. These important variables -- reactor-power, reactor coolant pressure, temperature and flow; and 19 Recommendation 2.1.9.b of NUREG-0578, which is also relevant here, is to " provide the analysis, emergency procedures, .

and training needed to assure that the reactor operator can recognize and respond to conditions of inadequate core cooling."

- -- --y r- o,,y,----,--,----,,-w-,,y,---.~- ,--ye,,,--e.w w,my,.,-* - , ,. ww v ,- ,we.-m.ww--.,a,-v,,4-w-w.,.-w---- ,,

containment pressure -- are measured directly and input to the  !

Reactor Protection System and/or the Engineered Safety Features Actuation System. That i:s, for power operation the variables appropriate to assure adequate sqfety have been defined and these parameters are directly measured and input to the protection system. Water level in the cora is not a part of the required instrumentation and no incremental protection system action has been identified based on such indication.

There is no known sequence of events which, from a power operation condition, could result in a low water level in the reactor vessel which would not be preceded by a reactor trip -

from the Reactor Protection-System. Keaten et al.,'ff. Tr.

10,619, at 2, 3 (Jones).

29. Should an accident such as a loss-of-coolant accident occur, the ESFAS is designed to actuate the emergency core cooling system upon the following ccnditions: (a) reactor i coolant pressure falls below a minimum level; (b) containment pressure exceeds a maximum level. The ECCS then provides I

sufficient inventory _ to assure that adequate core cooling is maintained.20 Keaten et al., ff. Tr. 10,619, at 3, 4 (Jones).

Reactor vessel water level is not an appropriate input to the l

20 We note that during the TMI-2 accident the Reactor Protection System functioned as designed, tripping the reactor on high reactor coolant system pressure promptly following -

the initiating event -- loss of feedwater. The ESFAS also

functioned as designed, actuating the ECCS on low reactor coolant system pressure. Keaten et al., ff. Tr. 10,619, at 4 (Jones).

l E

--e - - , - - , ---,-e~,- ,-e,-., ,,,------n , . , . . - ,- e ,. , - - - ---,--,~,,,---,-...-.,,~e,..- ---,,,,,.,-,w..n--,,, -,c , -,,-n, -e,m-,

safety injection system since the corrective action is initiated by a low pressure signal well in advance of core ,

uncovery. Phillips-1,21 ff. Tr. 10,807, at 5. Following reactor trip and engineered safeguards actuation, the goal of assuring adequate core cooling is achieved by maintaining subcooled conditions in the reactor coolant system or, in the absence of such conditions, by providing sufficient reactor l

coolant inventory. Keaten et al., ff. Tr. 10,619, at 4 (Jones).

30. During the TMI-2 accident, a condition of inadequate core cooling existed and was not recognized for a long period of time. ~

The NRC Staff's TMI-2 Lessons Learned Task Force concluded, nevertheless, that the as-designed and field-modified instruments at TMI-2 provided sufficient information to indicate reduced reactor vessel coolant ^1evel, core voiding, and deteriorated core thermal conditions.

Existing instrumentation at TMI-l which Licensee has identified as available to the operator to detect readily a reduced coolant level or the existence of core voiding inc]udes the following:

a. Narrow range reactor coolant inlet temperature

b. Narrow range reactor coolant ~ average temperature

c. Reactor coolant outlet temperature (hot leg)

d. Reactor coolant system flow

• I 21 NRC Staff Testimony of Laurence E. Phillips Regarding Reactor Water Level Instrumentation ("Phillips-1").

l -

I

.. . . - - - _ . _ _ _ . . _ . _ . _ . _ . . . - _ - _ - _ _ _ _ . . . - . , ~ . . _ - _ , _ . . . . , _ _ _ - , , _ _ _ , . . . , . _ . . . _ _ . , _ . , , . - _ _ . ,.-,___,-._,.m._s.,.,-. . . ._

l

e. Narrow and wide range reactor coolant pressure

f. Reactor coolant pump motor current l

g. Source range nuclear instrumentation.

Staff Ex. 1 at C8-14; Phillips-1, ff. Tr. 10,807, at 5.

31. Reactor coolant subcooling is asseased by monitoring system temperature and pressure, and it is these parameters which are utilized most often in the TMI-l plant emergency procedures. Keaten et al., ff. Tr. 10,619, at 4 (Jones); Otaff Ex. 1 at C8-14, 15. The indications can be used directly in combination with steam table data to determine system status relative to saturation, or the indications can be processed by a saturation margin meter to display the same information. The temperature instrumentation utilized for this function is located in the reactor coolant system hot legs, and saturated conditions will occur in the hot legs before core fluid conditions degrade below those necessary for adequate core cooling. The existence of a saturated condition is a direct indication of an abnormal condition which requires use of the emergency core cooling system. Keaten et al., ff. Tr.

10,619, at 4, 5 (Jones); Staff Ex. 1 at C8-17.

32. As recommended in section 2.1.3.b of NUREG-0578, Licensee will install a new meter in the TMI-1 control room, prior to restart, which directly indicates the margin to saturation conditions in the reactor coolant system (see Lic. .

Ex. 1, S 2.1.1.6) --

i . e., the margin between the actual primary system temperature and the saturation temperature for w,_w, , - - - ,,y ,--m ++,-,,---w r,y g p-.,---g-yy-r-e.-* .---m-sw- , - - e-w-,-w->- -- , -. - -, --e-- - ~ ----- ,oge.-

1 the existing primary system pressure. Tr. 4891-92 (Jones, l 1

Keaten); Tr. 5206-07 (Broughton). The temperature margin will be displayed in the control room, and an alarm will be initiated if the margin falls below a pre-set value.

Redundancy will be provided by computing the saturation temperature margin independently for each reactor coolant loop.

The plant computer, using the same parameters, can also l

indicate the saturation pressure and temperature, and satu-ration pressure and temperature margins, for logging and alarm.

Keaten et al., ff. Tr. 10,619, at 8 (Keaten); Phillips-1, ff.

Tr. 10,807, at 7; Staff Ex. 1 at C8-16 to C8-19. The NRC Staff has concluded that Licensee has met all the requirements of section 2.1.3.b, NUREG-0578, for the saturation meter. Staff Ex. 1 at C8-19.

33. In addition, instrumentation at TMI-l has been changed since the TMI-2 accident to connect all 52 of the core exit thermocouples to read out in the control room, and to provide an expanded range (120'F-920*F) for the reactor coolant I

system hot leg temperature measurement so that the saturation meter can be used to detect the approach to inadequate core cooling outside the normal operating temperature range. Keaten et al.,

ff. Tr. 10,619, at 9 (Keaten); Lic. Ex. 1, S 2.1.1.6; Phillipr-1, ff. Tr. 10,807, at 7; Staff Ex. 1 at C8-15, 16.

l 34. In order to assess the adequacy of the instru-

• l mentation at TMI-l to detect inadequate core cooling and the approach :o that condition, it is important to define

--o- e-- --w- -,~--e ,--v,, - - - ,e ,---------.w . . , -- e ee+ , .-,m. g --n- - , -,- - , -,,-,,,~.-r ,-,,-,--,-ev- --,---.w-w , . - ,--g g,-ee-,-wg,m,w-

l

" inadequate core cooling." We have already found that in a depressurization event the reactor coolant system must. reach saturation conditions before.there is any danger of inadequate-core cooling. See paragraph 31, supra. If the reactor coolant system inventory subsequently is reduced and uncovery of the core begins, temperatures in the uncovered region will increase, causing superheating of the steam. In the past, the term " inadequate core cooling" has generally been applied I

whenever the core is not covered by either liquid coolant or a two-phase mixture, thus resulting in superheated ccnditions being indicated by the core exit thermocouples. However, core uncovery by itself does not-mean that the core is being inadequately cooled. For example, analyses of design basis, small-break LOCAs result in some core uncovery without any clad.

damage occurring. Keaten et al., ff. Tr. 10,619, at 6, 7-(Jones). As a Staff witness testified, the most direct mea-surement of inadequate core cocling is the fuel temperature or surface temperature of the fuel cladding. Phillips-1, ff. Tr.

10,807, at 3, 4. The Commission has established the maximum fuel element cladding temperature by regulation. See 10 C.F.R.

l S 50.46(b)(1). Consequently, for this decision the Board considers inadequate core cooling to-exist when the fuel is uncovered to an extent and/or for a period of time such that the limits of 10 C.F.R. S 50.46 would be exceeded.22 g,,

Keaten et al., ff. Tr. 10,619, at 7 (Jones).

i i.

22 A Staff witness gave the following testimony:

(continued next page) t

t

35. Since temperature measuring devices at TMI-l are located at the core exit and hot legs above the core, sub-cooling at the core exit and hot legs indicates that the core is covered with water. Jensen et al., ff. Tr. 7548, at 10.

Since saturated conditions must occur in the reactor coolant system hot legs before there is danger of inadequate core cooling, the instrumentation available to the operators to detect a loss in the subcooling margin, including the new saturation meter which was not available at the time of the TMI-2 accident, ptovides information anticipatory to an

! inadequate core cooling condition. Thus, the instrumentation provides the operator with ' knowledge that action should 'be taken to maintain or reestablish the subcooling margin and that an inadequate core cooling condition is being approached. See Keaten et al., ff. Tr. 10,619, at 8 (Keaten); Tr. 10,729-30 l (Keaten); Tr. 10,828-30 (Phillips).

36.~

If an accident occurs which nevertheless results in core uncovery, superheated reactor coolant conditions would (continued)

"When the two-phase froth level begins to drop below the top of the core, the exposed fuel begins to heat i

up and will ultimately reach temperatures at which fuel damage occurs. This is inadequate core cooling."

Phillips-1, ff. Tr. 10,807, at 3. First, the testimony is unworkably vague as to when "this" occurs -- when the two-phase level begins to drop below the top of the core, -

when the fuel begins to heat up, or when fuel damage cccurs..

Second, it does not follow that when the two-phase level drops below the top of the core, fuel damage temperatures necessarily will be reached. Tr. 10,621-22 (Jones). The Board regulation. sees no reason to deviate here from the Commission's 28-

,.,%-- - - e _. - ...-s.- 7.-.,y- -%--._e. , - ~ , . - - - - , . - . ~ , . , - - , , ..%-.. -- .w - - - - , - . - , , . - - , - - - - - .

t be indicated by core exit thermocouples and the expanded r6 actor coolant hot leg temperature instrumentation. Keaten et al.,-ff. Tr.:10,619, at.5 (Jones); Phillips-1, ff. Tr. .5,807, at 4. The Staff testified that the ranges of this instru-mentation used to monitor core cooling are adequate for the.

operator to determine if the coolant in and above the core is subcooled, saturated or superheated. Jensen et al., ff. Tr.

7548, at 9. The Staff has suggested, nevertheless, that while core exit thermocouples can provide an indication of the existence of inadequate core cooling, the measurement of superheated steam temperatures by the core exit thermocouples indicates-inadequate core cooling imminent or already present.

l Staff Ex. 1 at C8-21. Although it is true that superheated

(

steam temperatures indicates core uncovery imminent or already present,23 we have already found that core uncovery, by itself, does not mean that the core is being inadequately cooled. See paragraph 34, supra. As the Board has defined inadequate core cooling, the core exit thermocouples do provide anticipatory indication of inadequate core cooling. The indication is also unambiguous and will not erroneously indicate inadequate core cooling. Keaten et al., ff. Tr. 10,619, at 14 (Keaten, Jones);

Tr. 10,720-21 (Jones); Tr. 10,730 (Keaten),

f 23 Temperature measurements taken above the core which are -

at the boiling temperature (saturated) or below the boiling temperature (subcooled) indicate that the core is covered and adequately cooled. Temperature measurements taken above the core which are above the boiling temperature (superheated) indicate that the core is not covered.

Tr. 7548, at 8, 9.

Jensen et al., ff.

l l

I--y-3v ---ww-yryyy-vw w y e 4, -e-++ wwpeg g*-g-ergy--%wp -wyy ---+-wwy~, ,gy<yw ww-%yWp-r; w r- y -y yy w y yw-gwwey,yte-e-Wa-%* Pt"-a --'T-w?t-e'--'W '-e^*' + ' - " w -*es-'eN

Procedures at TMI-l

.37. In order to avoid the onset of inadequate core cooling conditions, Licensee has taken specific staps at TMI-l to ensure that the operators understand the requirements for adequate core cooling and'are provided the necessary informa-i tion to evaluate core coolant conditions. Plant procedures at TMI-1 have been revised to emphasize the importance of main-taining an adequate saturation margin in the reactor coolant system and to provide guidance for steps to be taken if the saturation margin is less than the required value. Keaten et al., ff. Tr. 10,619, at 7, 8 (Keaten). The revised procedures define the use of the information available from the core exit thermocouples, reactor coolant system temperatures and the new saturation meter in identifying when inadequate core cooling is approaching and to specify the operator action required to promptly enhance core cooling. Id. at 9.

38. For example, in the immediate and follow-up action requirements of TMI-l's procedure for loss of reactor coolant causing high pressure injection (Lic. Ex. 48), strong emphasic is placed on maintaining reactor coolant system pressure-temperature relationships to assure that a subcooling condition of at least 50*F exists. Specifically, the procedure requires that upon automotic initiation of HPI all reactor coolant pumps are tripped and HPI shall not be terminated unless: (1) the low pressure injection system is in operation, 30-

- - , . . . . . -m,, ,,., ,..mw--.- - - - ,, , , ~ -,ven,, -. ..-.,w , . <,

. . =_

l i

flow is at a rate in excess of 1000 gpm in each line, and the situation has been stable for 20 minutes; or (2) the degree of subcooling is at least 50*F (as determined by-the saturation meter or the five highest in-core thermocouple readings) and the action is necessary to prevent pressurizer level from go.ing off scale high. If 50'F subcooling cannot be maintained, the procedure requires that full HPI shall be reinitiated. Lic.

Ex. 48 at 2, 8.

39. The TMI-l procedures, using the instrumentation described above, assure that the operators take the following key actions during any approach to an' inadequate core cooling condition: ,

a. Initiate high pressure injection;

b. Maintain steam generator level;

c. Trip the reactor coolant pumps if the engineered safety features actuation signal is initiated by low reactor coolant system pressure; and,

d. Monitor core exit thermocouple temperatures to assure that adequate core cooling exists.

No further action is required for design basis events. Keaten et al., ff. Tr. 10,619, at 9, 10. ,

40. For non-mechanistic events at TMI-1 beyond the design basis, B&W has developed guidelines for inadequate core cooling which define appropriate actions to prevent significant cladding damage and/or hydrogen generation. These guidelines, which employ instrumentation which will be available at TMI-1 prior-to restart, are based on recognition of core uncovery and

provide guidance to aid in prevention of a situation deteriorating to an inadequate core cooling condition. To develop these guidelinas, a series of calculations were performed to develop a correlation between core exit ther-mocouple temperatures, as a function of pressure, and peak cladding temperatures of 1400*F and 1800*F.24 Using this correlation, two levels of operator actions were identified.

Keaten et al., ff. Tr. 10,619, at 10 and Fig. 1 (Jones); Tr.

10,624-28 (Jones). The 1400*F limit is based on the potential for fuel pin swelling and rupture; the 1800*F limit is based on the metal-water reaction threshold. Staff Ex. 14 at 44,

41. For the first level of elevated temperature conditions, the operator is instructed to take the following steps:

a. Start one reactor coolant pump per loop.

b. Depressurize operative steam generators to 400 psig as rapidly as possible.

c. Open the PORV as necessary to maintain reactor coolant system pressure within 50 psi of steam generator pressure.

d. Continue cooldown by maintaining a 100*F per hour decrease in secondary saturation tempera-ture to achieve 150 psig reactor coolant system pressure.

24 The calculations in support of this correlation are reported in B&W Document 86-1105508-00, " Analysis Summary in Support of Inadequate Core Cooling Guidelines for a Loss of RCS -

Inventory," which is attached to Question 45, Supplement 1, Part 1 of Licensee Exhibit No. 1 (Restart Report). Tr.

10,629 (Jones).

32-

+

-ww - y+ ,.-,m-- --

g- -- w e- + - + - .m-, , - - - y--**-.-.m ,,, -, 4

I Keaten et al., ff. Tr. 10,619, at 10, 11 (Jones); Staff Ex. 14 at 45.

42. If the temperature conditions elevate to the second defined level, the operator is instructed to start all reactor coolant pumps, depressurize the steam generators to atmospheric pressure, and open the PORV to depressurize the primary system and allow the Low Pressure Injection system to restore core cooling. Keaten et al., ff. Tr. 10,619 at 11 (Jones); Staff Ex. 14 at 45. This procedure is based upon a recognition that recovery at the higher pressure is unlikely, and that while depressurization will cause more immediate core voiding,,in the longer term it will result in improved core cooling by increasing reactor coolant inventory. Keaten et al., ff. Tr. 10,619, at 11 (Jones).

43. The NRC Staff has concluded that these i guidelines provide the operator with the correct sequence and actions to respond to an inadequate core cooling event, and l

that they are acceptable as the basis for developing TMI-1 plant specific emergency procedures for inadequate core cooling. Staff Ex. 14 at 45. From these guidelines, Licensee has developed implementing emergency procedures for TMI-1.

Lic. Exs. 48 (Attachment 3) and 51. The Staff has reviewed l

l these procedures and concluded that they adequately incorporate the B&W guidelines and are modified appropriately to incorpor- '

ate plant specific information. Staff Ex. 14 at 28. In fact, the Staff testified that all of the methods available to 1

I G

---,.-.--,%,, - ,, ,,- - ,_.,.__ , . , , , - , , ,-..y.,w. .-,.,.w+ ,- ,- _ , . _ , - - - - . .-,,,,..y , <. v- . - _ _ __ _.

l terminate inadequate core cooling are included in the TMI-1 procedures. Tr. 16,001-03 (D. Ross).

I Training at TMI-l  !

44. Licensee plans that the operations personnel who l will be on duty during TMI-1 power operation and would respond to any approaching inadequate core cooling condition will-include two licensed reactor operators (Control Room Operators), and two licensed senior reactor operators (one Shift Supervisor and one Shift Foreman). Specific steps have been taken at TMI-l to ensure that' operators. understand the requirements for adequate core cooling. Licensed TMI-1 operators during 1979 completed the Operator Accelerated Retraining Program (OARP), which is described in section 6 of Licensee Exhibit 1. This one-time, intensive training program, I

t along with the ongoing requalification training program, was designed to assure chat operators will recognize and respond to reactor coolant conditions approaching and following satu-l ration, using the instrumentation available at TMI-l prior to restart. In addition, each shift will have immediately available a Shift Technical Advisor, who holds an engineering l degree. Keaten et al., ff. Tr. 10,619, at 14, 15 (M. Ross);

l Long et al., ff. Tr. 12,140, at 34-35, 38; Tr. 11,666-69 (Hukill); Staff Ex. 14 at 22, 23. ~

45. Licensee's annual requalification program includes, as did the OARP, approximately 200 hours0.00231 days <br />0.0556 hours <br />3.306878e-4 weeks <br />7.61e-5 months <br /> of classroom l

S y . -.e,-. ,.----,--..*,----,-,--,.ex- ----,e ,---,..,.-.-,.-,,---...m.-~,-c.-,- -..-,..,~,--+-,.-..----.--...----+.,---.--r.w - . - - ,

lectures, discussions and wocking sessions; about 62 hour7.175926e-4 days <br />0.0172 hours <br />1.025132e-4 weeks <br />2.3591e-5 months <br />s-of the OARP alone related directly to the recognition of and

- response to approaching inadequate core cooling conditions.

The annual requalification program, again like the OARP, includes control room and simulator training sessions to permit

" hands on" application of the guidance and training provided to TMI-1 operators. The control room sessions. include a review of l the specific instrumentation and information available in the TMI-1 control room to build an association of the operational concepts and guidance presented in the classroom with the actual system controls. Keaten et al., ff. Tr. 10,619, at 15, 16 (M. Ross); Long et al., ff. Tr. 12,140, at 29-31, 34-35; Staff Ex. 1 at C2-4.

I

46. Training on the B&W simulator, which is also part of the ongoing operator requalification training program, l provides the opportunity for operators to participate in plant operations as control room operators and as supervisors of

, control room operators. The simulator has the capability of l introducing over 60 individual casualties in reactor plant systems. The individual casualties can be combined to create i

I multiple failure accidents, or the instructor may fail equip-ment sequentially. Thus, the simulator gives the operator the opportunity to practice his training and diagnostic skills on complex problems. These problem situations on the simulator .

l include scenarios where core cooling either approaches or reaches saturated conditions, requiring the operators to

,s. , w- -..,,-%-, --r-.--cm.--,,,pe,._, e,,, ,p, m,a,- ._ .,,,-nm,y--, . , ,-pw--- , -.,,,-,m ,..e-mp,m..y ,, , y ym,. ,,-% 9 . , ,, e,.-c.+--wyy ..

1 1

1 recognize and rectify the degraded conditions and assure adequate core cooling. In the simulator training, the operator is required to demonstrate satisfactorily his ability to: (1) i use snd understand applicable emergency procedures; (2) properly manipulate the controls to place and maintain the plant in a safe configuration; (3) use available alarms and indications to evaluate and control the transient; (4) explain i

plant response; and (5) explain plant conditions and recommend sub equent actions to his supervisor. Keaten et al., ff. Tr.

10,619, at 16-18 (M. Ross); Long et al., ff. Tr. 12,140, at 29-31,

47. In addition'to weekly quizz~es, the OARP included a written and oral evaluation of the trainees, administered by an independent consultant in April, 1980, which was equivalent to an NRC initial licensing examination. Licensee's operators since that time have completed another year of requalification training and have taken a second mock-NRC examination adminis-l tered by another independent consultant. Additionally, all TMI-l operators will be required to pass an NRC-administered oral and written license examination. Keaten et al., ff. Tr.

t 10,619, at 18 (M. Ross); Long et al., ff. Tr. 12,140, at 40; Tr. 20,584-85 (Newton). Following the OARP, the senior reactor operators and other plant management personnel participated in l a five-day decision analysis training program, which utilized a workshop technique whereby plant scenarios were presented for i

diagnosis of plant response and for identification of appropri-ate operator responses. Licensee's ongoing operator m--g- , ,. -.g.- y , , , ,, , . , ,, e. ,,, , . _ , .

4 ,. g.,., , , , , , , ..,w---,--g,,<------.,,-.---..-n

-,g.,-,n,-,,-,,,-..,n,,.,-..., ,,y, - , . --.- , , n e--,.,

6 requalification program requires every licensed operator to devote one week out of every six to training. Keaten et al.,

ff. Tr. 10,619, at 18 (M. Ross).

48. All of this training includes many elements which relate directly to the operators' ability to recognize and respond appropriately.to an approaching inadequate. core cooling condition. The training emphasizes that the operators must maintain an adequate reactor coolant saturation margin.

The main points which Licensee stresses repeatedly are: (1) utilization of procedures; (2) verification of critical parameters; (3) proper use, interpretation of and response to saturation meter, core exit thermocouple, and hot leg and cold leg temperature indications; and (4) criteria for throttling HPI flow. Keaten et al., ff. Tr. 10,619, at 18, 19 (M. Ross).

See also, Staff Ex. 1 at C2-8 (personnel awareness of actions taken during TMI-2 accident), C2-10 (training on establishment and maintenance of natural circulation), and C2-17 (training on small-break LOCA procedures).

49. The NRC Staff has reviewed the training material l on the subject of inadequate core cooling, provided as a part i

of the OARP at TMI-1. The Staff found that adequate training has been provided on the causes of, recognition of, and response to inadequate core cooling. Staff. Ex. 1 at C8-16, C8-49. -

l l

l i

s v

-- -- . . . - _ , , . . _ - - - . _ _ ~ , - _ . - _ _ - - - . __ ..,_ --._-_.. .._. ,_.-.--. _ .., - . - _ - -

Short-Term Actions

50. Instrumentation for the detection of inadequate core cooling was'among the subjects considered by the NRC Office of Nuclear Reactor Regulation TMI-2 Lessons Learned Task Force in its Status Report and Short-Term Recommendations (NUREG-0578). -The Task Force, in section 2.1.3.b of NUREG-0578, concluded that it is appropriate to address the problem in two stages and reached two positions, one for each stage. The first position states as follevs:

Licensees shall develop procedures to be used by the operator to recognize inadequate core cooling with currently available instrumentation. The licensee shall provide a description of the existing instrumentation for the operators to use to recognize these conditions. A detailed description of the analyses needed to form the basis for operator training and procedure development shall be provided pursuant to another short-term requirement,

" Analysis of Off-Normal Conditions, including Natural Circulation" (see Section 2.1.9 of this appendix).

In additior, each PWR shall install a primary coolant saturation meter to provide on-line indication of coolant saturation condition. Operator instruction as to use of this meter shall include consideration that it is not to be used exclusive of other related plant parameters.

Keaten et al., ff. Tr. 10,619, at 6.

51. The NRC Staff has concluded that Licensee is in comp 1.iance with these short-term actions recommended in -

NUREG-0578, as well as those in section 2.1.9.b of NUREG-0578, as tu the instrumentation, procedures and training on

inadequate core cooling which should be required prior to resumption of operation at TMI-1. Staff Ex. 1 at C8-16, C8-19 and C8-49; Staff Ex. 14 at 28.

52. There is absolutely no evidence in the record which would support the proposition in ANGRY Contention V(B) that the installation of instrumentation to indicate the level of primary reactor coolant shculd be a condition of restart of 4

the plant. As to the requirements for restart on this issue,_

the Staff testified that its position is that TMI-1 is no different than any other operating reactor, and that the plant can restart with the same requirements imposed for other operating reacto'rs.25 Tr. 10,878 (Ph'illips); Tr. 16,029

l I

(D. Ross). The Staff also testified that there now exists reasonable assurance that the prescurized water reactors l

operating in the United States without reactor coolant level instrumentation do not endanger the health and safety of the public. Tr. 15,956 (D. Ross).

53. The Board concludes, on the basis of the foregoing findings of fact, that adequate instrumentation exists at TMI-1, without reactor water level instrumentation, i

to assess core cooling. The instrumentation, procedures and 25 This is consistent with the Commis .on's position that TMI-l "should be grouped with reactors which have received operating licenses, rather than with the units with pending

• l operating license applications" except where the Board finds to t

the contrary when the record so dictates. CLI-81-3, 13 N.R.C.

__, slip op. at 7 (March 23, 1981).

l l .O

• i operator training provided at TMI-1 assure that operators hsve unambiguous and easy-to-interpret indication of the approach to inadequate core cooling and the necessary guidance to take

appropriate action to enhance core cooling during such an approach or if an inadequate core cooling condition actually occurs. Consequently, we find that these short-term actions 4

are necessary and sufficient to provide reasonable assurance l

that TMI-1 can be operated without endangering the health and

! safety ot the public, and that they should be required before resumption of operation should be permitted, i

54. Having determined that the plant is safe to operate, from the standpoint of the issue of detection of inadequate core cooling, the Board must now turn to the question of whether it is necessary to condition long-term t

operation of the facility upon the installation of additional instrumentation.

Long-Term Actions

55. The second position reached by the Staff's TMI-2 i

Lessons Learned Task Force on instrumentation to detect inadequate core cooling (NUREG-0578, S 2.1.3.b) states as follows:

Licensees shall provide a description of any addi-I tional instrumentation or controls (primary or

backup) proposed for the plant to supplement those -

devices cited in the preceding section giving an unambiguous, easy-to-interpret indication of inadequate core cooling. A description t! ' Se functional design requirements for the sye; shall also be included. A description of the procedures to 40-

- -w. .w- ww--,-w<w--- -,..,m, .,.,.,,.-.,,,,.wa,-

v,-,o+ .r- ,-,,,,.-,w-,-,,..,,e,-y.,rms.,,,,

be used with the proposed equipment, the analysis

, used in developing these p;ocedures, and a schedule i for installing the equipment shall be provided.

4 Keaten et al., ff. Tr. 10,619, at 6.

56. On September 15, 1980, as directed by the Board -

i in its Memorandum and Order of August-15, 1980, Licensee filed

its written direct testimony in response to the intervenor i contentions on detection of inadequate core cooling. In that i

testimony, Licensee took the clear and unequivocal position that reactor vessel water level instrumentation is not needed at TMI-1 and should not be installed, either prior to restart or thereafter- Keaten et al., ff. Tr. 10,619. The Staff did not file its testimony in response to these contentions on September 15, 1980.

j

57. Thereafter, it took considerable effort by the Board and Licensee first to persuade the Staff to file its testimony and then to discern what the Staff's position was.

We review this history here not to chastise or to embarass any party, but because the Board believes it reflects directly on i

the soundness of the posit!on ultimately taken by the Staff at

the hearing, and on the standard to which Licensee should be held in assessing its progress on any further long-term requirements in this area.

58. The subject of delay in the filing of Staff ,

testimony on this and other issues was the focus of several .

discussions at the hearing. On December 1, 1980, the Staff l

filed the testimony of Mr. Phillips in respocce to the

! l i

i..._.-_._._-_.-. . , , _ . , - - .,,_ . ,,, - - ,.._--._-, _.. - _ . _ ., _ ..., , _ _ _ . _ _. .- _ _ _.. - -_-

intervenor contentions on reactor water level instrumentation.

In that testimony, Mr. Phillips neither acknowledged nor l responded to Licensee ~'s pre-filed testimony of September 15, 1980. He reported that the Staff had found Licensee's justifi-cation for no cdditional instrumentation to be " unacceptable,"

and stated that " it is likely that a water level measurement system will be required, but not necessarily prior to restart."

Phillips-1, ff. Tr. 10,807, at 9.

! 59. On December 16, 1980, Licansee raised with the Board, at the hearing, its view that the Staff had been unwi311ng to join issue on whether additional instrumentation should be required in the long term, and that the Staff testimony of December 1, 1980, neither took a position on that question and defended it, nor explained why Licensee's position was unacceptable to the Staff.

After considerable discussion and inquiry by the Board, the Staff agreed to report a position to the Board and to explain it. See Tr. 8459-77.

60. In a second piece of testimony, filed on Dectmber 22, 1980, Staff witness Phillips reported the Staff's belief that reactor vessel level information will enhance the operating safety of PWRs. Phillips-2, ff. Tr. 10,807, at 5.

When he appeared for cross-examination on January 21 and 22, 1981, Mr. Phillips testified that the Staff still had not made 26 NRC Staff Testimony of Laurence E.

Testimony to that of Laurence E. PhillipsPhillips, Supplementary filed December 1, 1980 Regarding Reactor Water Level Instrumentation ("Phillips-2").

42-

-a ,-g- e <- m- - - -*w , - -

-f- -'7er

.. -. -._ ._. = . - - . . . . .

I a definitive determination that additional instrumentation was needed but, incongruously, testified that no additional instrumentation was not an acceptable possibility. Tr. 10,840, 42-43 (Phillips). Neither does our reading-of NOREG-0578 or its regulatory progeny, including NUREG-0737, reveal a firm Staff statement that water level instrumentation is required.

Rather, those documents direct licensees to describe any additional instrumentation proposed supplementing existing instrumentation to provide an unambiguous, easy-to-interpret

( indication of inadequate core cooling. While a letter from the Director of Nuclear Reactor Regulation " clarified" the eval-uation required to include reactor water level indication,

, neither that letter nor NUREG-0737 on their own st te a requirement for the installation of such a system. See Phillips-1, ff. Tr. 10,807, at 8.

( 61. Following observations by the Board, after j hearing the testimony of Mr. Phillips, that it appeared the Staff had not decided water level indication is necessary, and that the Board needed a very careful explanation of precisely what the Staff believes and the reasons for it (Tr. 10,886-88),

the Staff filed on March 11, 1981, the testimony of Dr. Ross --

the third piece of Staff testimony. Ross, ff. Tr. 15,915.

When he appeared for cross-examination on March 19 and 20, l 1981, Dr. Ross acknowledged that prior to the Board's expres-  :

sion of concern during the appearance of Mr. Phillips, the Staff had nog focused on the distinction between "necessary" i

l

. _ - _ . _ . _ . . _ . _ . _ _ ~ . . _ _ _ . . _ _ _ _ _ _ . _ . , _ __ . _ . . . . . . _

and " desirable" in terms of this long-term recommendation. He further acknowledged that his testimony announced for the first

time here the position that water level instrumentation is necessary to provide reasonable assurance of no undue risk to the public health and safety.27 Tr. 15,929-31 (D. Ross). The

, Staff position still is not without ambiguity, however, since elsewhere in his written testimony Dr. Ross states: "The staff I

requirement is for additional instrumentation for detection of ICC. The preferred technique is monitoring of the reactor coolant system inventory." Ross, ff. Tr. 15,915, at 10.

62. Thia history reveals that the Staff did not understand the standard established by the Commission for the imposition of further requirements on this licensee -- includ-ing those listed in the Order and Notice of Hearing as recom-mended by the Director of Nuclear Reactor Regulation. The Staff's reluctance to come forward either to take a position or l

! to defend it also reflects what we perceive as a misapprehen-sion of the Staff's role in this proceeding. The Staff does not sit back and impose requirements. The Staff here merely recow.. ends requirements, as do other parties. The Commission, upon review of this Board's decision, will decide what the l requirements are. Consequently, the Staff has a burden of 27 Dr. Ross's testimony otherwise is slightly misleading where -

he states that the purpose of his testimony is to justify the i Staff position -- as if the position itself were already well I

known and communicated to and understood by all. See Ross, ff. Tr. 15,915, at 2.

{

i l

1 I

persuasion -- at least where it is confronted clearly and forcefully by an opposing position. This is not an initial licensing proceeding and the Commission has imposed a "neces-sity" threshold standard which additional requirements must

meet. Perhaps if this had been understood by the Staff the litigation might have followed a different course. At the least, we expect the evidence would have been presented more efficiently.28

63. We turn, however, to the record on the merits of the dispute. The NRC Staff has not evaluated the possible actions the operator would take based on core level instru-mentation. Phillips-2, ff. Tr. 10,807, at 4. Analyses were performed by both B&W and GPU to determine if any incremental automatic or operator action could be identified on the basis of water level indication. Tr. 10,647-48, 10,658-59, 10,911-15 l

(Jones); Tr. 10,657, 60 (Keaten). Licensee's position is that no additional or earlier action, beyond that already provided for at TMI-1, can be identified to avoid or respond to an inadequate core cooling condition on the basis of water level indication. Keaten et al., ff. Tr. 10,619, at 5, 12, 14 and 19; Tr. 10,661 (Jones).

28 The Staff also seems not to appreciate that our decisions r must be made on the basis of the evidentiary record. See t

10 C.F.R. S 2.760. Consequently, the frequent references, -

in the testimony of Mr. Phillips and Dr. Ross, to Staff correspondence is of no use to the Board (other than to prove that correspondence took place) in understanding the Staff's position, since these letters are not in evidence and were not offered by the Staff.

l

,-,--..,,.--.------y. .

,n-,n---. , ,,.-,. -, , __ - s - - , . - - - . , - - - _ , - - - , . . - - - - , - - , - -,

l

64. The guidelines prepared by a distinguished team of experts (see section II.N, infra) assembled by Licensee to

i perform a human factors review of the TMI-1 control room state,

at the very outset of the operational guidelines

The control room operators who man the main console should be provided with appropriate controls and displays to perform a set of defined functions. Controls and displays, including annunciators, which are not needed to perform those defined functions l

tend to divert the control room operators' l

attention and should not normally be provided to them. It should be an objec-l tive to move out or keep ou' of the control room itself those personnel, controls, and

' displays which are not related directly to the defined. functions.

Lic. Ex. 23. Appendix A at 2. Consequently, we appreciate the testimony by Licensee's witnesses that they are reluctant to install instrumentation for which there is no identifiable use.

Tr. 10,644-45; 10,703 (Keaten); Tr. 10,706 (M. Ross).

65. In addition, Licensee is concerned that reactor l water level indication could mislead the operator into pre-mature throttling of high pressure injection -- one of the key contributors to the TMI-2 accident. The HPI system provides an integrated makeup flow to the primary system such that the time delay to water level in the core may not intuitively reflect the fact that a normal recovery is in progress which will restore inventory. Tr. 10,649-50 (Jones). There is a very wide spectrum of events which the operator must be prepared to meet -- from a very small-break LOCA to a very large break, and at various locations in the primary system. The behavior of l

srm,-=-=-- - w-- m- ---e<---,w-awr* e --n-

s the actual liquid level or the two-phase level varies enormously for these different transients, so that the coolant level and the rate-of-change in the coolant level cannot be categorized simply into a regiue which is safe and one which is not. What may be normal and expected behavior for one break would be abnormal for another. Tr. 10,661-62 (Keaten). This is illustrated by a figure from Licensee's small-break LOCA analyses (ff. Tr. 10,663) which displays 'two-phase mixture height in the core over time for a variety of break sizes. For several breaks the two-phase mixture drops below the top of the active core for a short period of time. Yet, the analysis shows that ECCS is working properly and that the operator should take no corrective action, but continue to rely upon the l

ECCS. Tr'. 10,662-64; 10,674-76 (Jones); Tr. 10,682; 10,700-01 (Keaten). The concern is that the operator will prematurely throttle HPI -- at a time when the analyses predict water level should be high, but also predict that it will drop further into the transient -- so that inventory cannot be recovered; or that l

the operator inappropriately takes drastic action upon observing core uncovery, when level is predicted to recover with just normal HPI flow. Tr. 10,651-52 (Jones).

66. The Staff advanced several reasons why, in its view, operational safety at PWRs would be enhanced with reactor

! vessel water level indication. Mr. Phillips testified that the i saturation meter, while providing a basis for initial actions, does not distinguish between anomalous transients which can

{

, _ , _ . . . ~ ~ . - -_ _ _ _ _ - - - - - - - - - - - - - - - -

drain the pressurizer and cause primary loop saturation due to cooling and shrinkage of primary coolant versus loss of coolant inventory which could lead to inadequate core cooling if it continues. Phillips-2, ff. 10,807, at 2. However, the operator does not need to make an instant diagnosis of these alternative transients and he could not do it with level information. Whether it is an overcooling event or a LOCA, the operators' job is to restore primary system inventory and pressure with HPI. Diagnosis of an overcooling event is not required for the immediate action steps -- which are identical for a small-break LOCA and an overcooling event. Follow-up procedures and instrumentation are adequate to timely diagnose and recpond safely to the particular transient.29 Tr.

10,632-36 (Jones, M. Ross); Tr. 10,641 (Keaten); Tr. 10,677 (Jones). In any case, for a very small-break LOCA the primary system will stay solid for a period of five to ten minutes,

! depending on the size of the break; whereas, a severe over-cooling event can result in a steam bubble within the reactor vessel head region. So that it is simplistic to imply that vessel level is a reliable diagnostic tool for distinguishing these events. Tr. 10,636-37 (Jones). Consequently, vessel level indication may in fact be more ambiguous information in 29 TMI-1 emergency procedures provide specific guidance on diagnosing the secondary side symptoms characteristic

of an overcooling event, as distinguished from a small-break LOCA. Tr. 10,643 (Keaten). See, e.g., Lic. Ex. 48 at 3.

the early stages of a transient than the information operators at TMI-1 already have. Tr. 10,664-66 (Jones).

67. Mr. Phillips also testified that water level indication would provide-indication of the effectiveness of HPI in recovering the system. Phillips-2, ff. Tr. 10,807, at 3.

However, because analyses show that the rate of recovery, including uncovery of the core for some breaks and locations, is transient-dependent, the operator will not be able Lce assess definitively from water level whether HPI is effective. Tr.

10,687-88 (Jones).

68. Staff witnesses Phillips and Ross each cited a natural circulation cooldown event at St. Lucie-1 on June 11, l 1980, as evidence that vessel level indication is desirable.

Phillips-2, ff. Tr. 10,807, at 4; Ross, ff. Tr. 15,915, at 3.

While the Staff provided virtually no description of the event, L

Licensee witness Jones reported that this event at a Combustion Engineering plant involved a loss of component cooling water to the reactor coolant pumps, which were then tripped. During the l cooldown, a void was formed in the upper head of the vessel.

l This was indicated to the operators because the level swing I

i occurring in the pressurizer was rather large and could not be explained by the fact that the injection location was being i changed from the cold legs to the pressurizer as a pressurizer spray.30 Tr. 10,688-89 (Jones). The Staff reports that the -

30 Operators at TMI-l have received training on this event at St. Lucie to enhance their recognition of void formation.

Tr. 10,637-38 (M. Ross).

1

. - - . - - - - . . . ~ _ . . _ , - - - _ . - __~ . . - - - - - _ - - . _ _ _ . . . _ - . . _ . . _ _ _ . - ~ . , - - - _ - - - . . .-

l l

operators initially did not recognize the steam bubble and that unsafe operator action could have been taken; whereas vessel  !

level information would have indicated the void formation in the upper head.31 Phillips-2, ff. Tr. 10,807, at 4; Ross, ff.

, Tr. 15,915, at 3. It is not clear, however, what unsafe operator actions might have been taken. Tr. 10,690-91 (Jones).

69. It is undisputed, however, that the operators took the correct actions to control the plant during the St.

Lucie event cited by the Staff. Tr. 15,966 (D. Ross). Indeed, Licensee cites the same event in support of its position that level information may mislead operators. If vessel level instrumentation had been available'at St. Lucis the operators may well have misdiagnosed the event as a small-break LOCA.

Tr. 10,637 (Jones). We also note that the list of recom-mendations in the written Staff report on the event includes no mention of need for level indication. Tr. 10,691 92 (Jones).

70. Staff witness Ross also cited a loss of coolant event of February 11, 1981, during cold shutdown at Sequoyah-1, a Westinghouse reactor. Ross, ff. Tr. 15,915, at 4; Tr. 15,960 (D. Ross). In this event, the operators lost pressurizer level in two minutes, and reestablished it in ten minutes. Tr.

31 Dr. Ross described this as "an extended period of operator confusion"; whereas Mr. Imbro, the author of the Staff report on the St. Lucie event spoke in terms of " initial puzzle-ment." Compare Ross, ff. Tr. 15,915, at 3, with Tr. 15,965-66 (D. Ross). Dr. Ross had no more information on the event than was available to Mr. Imbro. Tr. 15,966 (D. Ross).

+------.e. .-r,m.,.-,,_m...,-.--. ,.y--

, ~ ---. ,--.- -- ,,-,,- -%%,-.. ~ - , , - . . , , , - - --...,---_,_---,-.w...--,--,,-.---s. -..

-,-,y-, ..

15,962 (D. Ross); Ross, ff. Tr. 15,915, at 4. This restoration of pressurizer level, which from the standpoint of core cooling essentially means that the prim'ary system is refilled, took place as a result of operator actions taken two or three minutes into the event. Tr. 15,962-64 ,D. ( Ross). Conse-quently, it appears to the Board that the operators took very quick and appropriate corrective action without vessel level information. Dr. Ross did not identify any additional action which the Sequoyah operaters might have taken on the basis of level indication.

71. The Staff testified that vessel level informa-tion is important and possibly essential to proper emergency procedures relating to use of the reactor vessel head vent, which is another NRC Staff requirement. Phillips-2, ff. Tr.

10,807, at 4, 5. Licensee reported,.however, that the guidelines under development by B&W for vent use do not rely on water level indication. Tr. 10,692 (Jones).

72. The Board was surprised to learn, during the oral testimony of Staff witness Phillips, that the Staff does not envision providing vessel level information directly to plant operators. The Staff apparently recognizes that level i

information can, for some periods during a transient, provide l misleading information. Consequently, it is proposed that the l

1evel information be fed into some sort of data processing equipment where it will be integrated somehow with other instrumentation to " weed out" false signals. Tr. 10,810-13, l

I

10,818-23 (Phillips). Mr. Phillips testified that it would be unacceptable to base any operator action on level indication alone.32 Tr. 10,849-50 (Phillips). Licensee has described what it considers to be the extreme difficulty of correlating primary coolant inventory versus time with the safety analyses performed for the plant. Tr. 10,684-85 (Jones). We have not been told by the Staff what information, whether on a CRT or other device, ultimately will be displayed to the operator. In this circumstance, the Board finds it at best difficult to view vessel level indication as the " unambiguous, easy-to-interpret indication of inadequate core cooling" called for by section 2.1.3.b of NU'3G-0578. See~Tr. 10,685-86 (Jones).~

73. S.3 Staff provided us with the following review schedule for additional instrumentation to detect inadequate core cooling, based upon licensee submittals on January 1, 1981:

April 1, 1981: Staff issuance of generic positions and acceptance crite-ria.

July 1, 1981: Staff transmits to licensees questions and positions on the generic system (s) adopted.

l September 1, 1981: Licensee submittals in response l to the Staff questions and l positions.

I

December 1, 1981: Staff issuance of generic safety evaluation reports and model technical specifications. -

32 If the data processing system fails, however, the operator would have to rely upon the hard-wired backup instrumentation and to diagnose the plant condition with possibly anomalous vessel level information. Tr. 10,861-62 (Phillips).

l

- - . - - - . . , _ , , , , , , _ , - ,-.._m.- - . , _ . , , , . . + -

January 1, 1982: Equipment installation.

March 1, 1982: Licensee submittals on details of installed system, calibration and test data.

May 1, 1982: Staff issues technical specifica-tions and specific approvals.

July 1, 1982: Staff issues plant-specific safety evaluation reports.

Tr. 10,823-25 (Phillips).

I l

74. Staff witness Phillips testified that: (a) there is still the possibility that the Staff ultimately will conclude that no system -proposed to measure water level is l

acceptable, Tr. 10,833; (b) before the Staff determines whether

~

any system is acceptable it will review the potential use of' l the information provided and weigh it against any detriments, Tr. 10,861-62; (c) in order to be found acceptable a proposed j system will have to be found to provide an overall. enhancement l

to safety, and the Staff will not make such a determination j until the systems are installed, the operating methods have been identified, the calibration and test data is available, and the Staff is certain that these systems are indeed a plus to safety and will not lead to unsafe actions, Tr. 10,811, 10,864, 10,909. In view of this testimony and the Staff review schedule identified above, the Board does not understand how Dr. Ross could bring to this hearing a Staff position that I vessel level instrumentation is now known to be necessary. -

75. It appears to this Board that the Staff is ahead of itself here. A reasonable application of the engineering

method would sequence the selection of functional criteria, the identification of the alternatives and then the optimal choice for fulfilling the criteria, prior to the detailed engineering to apply the alternative, procurement and installation. Tr.

15,957 (D. Ross). The step of identifying the alternatives could include consideration of: reliabilit f; ease of retrofit; in situ verification of calibration; probability of accident-survival; lifetime or long-term survival; accuracy; additional penetrations; simplicity; versatility; performance history; and cost. Tr. 15,958-59 (D. Ross).

76. Yet the Staff schedule would require installa-tion, and obviously detailed engineering and procurement, to precede Staff consideration of these factors. In fact, in order to meet the Staff's schedule for installation, licensees would have to begin installing systems in their plants even before the issuance (scheduled for December 1,1981) of.a generic SER approving even the concept of the system. Tr.

10,838-39 (Phillips); Tr. 15,944 (D. Ross). There is nothing to prevent the Staff from ultimately disapproving such a system.

! 77. On a different subject -- the Interim Relia-bility Evaluation Program -- Staff witness Ross testified that it was best for the Staff, more efficient for industry, and the logical sequence for the' Staff to decide first what it wants ~

and then tell industry to proceed. Tr. 15,620-21 (D. Ross).

Because the Staff had not yet made up its mind which way it l ,

s e -ger.,.4**.my. .

-ev = "'r + y,v-e-*-- -

w--y'm-

wants to go and had developet no review criteria, Dr. Ross testified that it was premature to impose a requirement on TMI

-- which would be-" rushing in too fast." Tr. 15,618 (D. Ross).

We believe the same wisdom should be applied here.

~

Clearly, i

the Staff wants "something" in the way of &_ 'tional instru-i mentation to detect inadequate core cooling. It has rejected as " unacceptable" analyses which do not conclude in support of l additional instrumentation. Yet, the Staff apparently has not ordered the installation of reactor water level instrumentation at any operating plant, and only reluctantly took the position here that it is necessary in the long-term. The Staff does not know how water-level will be used 12 a sound instrument is ,,

developed, and in fact plans to mask the information behind data processing systems which will display something else to I

the operator.

The Board concludes that the Staff does not know what it wants in the way of additional instrumentation, and that at this point it should not know. Until the. Staff proceeds much further down its own decision-making path, it cannot reasonably expect this Board to find that reactor vessel water level instrumentation is necessary to provide reasonable assurance that the public health and safety will be protected.

l l

We cannot even find, with confidence, trat it will be helpful, or that it will be neutral and not detract from operational safety. ~

78. Licensee witness Keaten, who obviously has studied the accident a good deal, testified frequently in this O

hearing that the principal lesson learned from the TMI-2 accident was operator training and procedures, and not hardware changes. See, e.g., Tr. 10,683-84 (Keaten). The Staff, following its conclusion that the detection of reduced coolant level or the existence of coce voiding at TMI-1 can be readily determined with the saturation meter and other existing l instrumentation, stated:

the operacor must be made aware of the exis?.ing information and how to interpret it correctly. The burden of showing a

marked improvement in the operator's ability to quickly reccgnize a condition of inadequate core cooling, and his ability to act upon this information, lies with improvement to the operator's training and instruction rather than the ir.stru-mentation.

Staff Ex. 1 at C8-16. The Board finds that through the procedure changes and substantial training described above, this marked improvement has been achieved at TMI-1. While the desirability of the objective of the Staff in section 2.1.3.b of NUREG-0578 -- development of an easy-to-interpret, unam-biguous indication of inadequate core cooling -- is beyond challenge, it has been accomplished here without the unknown additional instrumentation the Staff would have us require.

79. The Board finds that the long-term actions i

recommended la section 2.1.3.b, as construed by the Staff to require water level indication, are not necessary to provide reasonable assurance that the facility can be operated for the long-term without endangering the health and safety of the

l 3

public. Whether in the future such' instrumentation may be i

proven to provide an enhancement to the safe operation of TMI-1

is a development which we do not foreclose or predict with this decision.

80. Since the Board has determined that this long-term action recommended by the Staff is'not necessary, it follows that we need not address Licensee's progress toward satisfactory completion of such a requirement. Nevertheless, ,

because the Commission will review this decision and may disagree with our findings, the Board believes it is appropri-1 ate and would be useful to the Commission to include the Board's own assessment of Licensee's progress.

j 81. We st.~t with the proposition that fairness and due pre:ess entitle Licensee to challenge, in this' hearing, requirements recommended.by the Staff or by intervenors.

Consequently, we believe Licensee had the right to contest the Staff's position that water level instrumentation at TMI-1 is required in the long term, without jeopardizing the restart of the unit if the Board finds that resumption of operation is otherwise warranted. In view of its strong interest in resum-ing the operation of TMI-1, and based upon the conviction displayed by its witnesses,33 Licensee's objections must be i

! 33 Licensee's witnesses included the Manager of GPU's *

[ Systems Engineering Department, the TMI-1 Supervisor of l

' Operations (a licensed senior reactor operator) and a Supervisory Engineer of 86W's ECCS Analysis Unit. Keaten et al., ff. Tr. 10,619.

67-

viewed as sincere. See, e.g., Tr. 10,703-06 (Kaaten, Jones, M.

Ross). .

82. Licensee, however, did not by any means ignore the long-term recommendations of section 2.1.3.b of NUREd-0578.

Licensee's. Restart Report includes B&W's " Evaluation of Instru-mentation to Detect Inadequate Core Cooling, Prepared for 177 Owners Group," August 15, 1980. The following methods of detecting inadequate core cooling were examined in this evaluation: (1) existing core thermocouples; (2) additional axial core thermocouples; (3) ultrasonic reactor vessel level indication; (4) neutron or gamma beam reactor vessel level indication; and (5) differential pressure transmitters for reactor vessel level indication. The B&W evaluation concluded that none of the proposed methods of detection would meet all of the Staff's criteri'a. The report also concluded that each proposed reactor vessel level measurement system concept fails to provide any additional aid to the operator for detection of

inadequate core cooling, and that the potentially ambiguous information provided by such instrument systems co.1d lead to unsafe and incorrect actions if the operator acted on the level l indication. Lic. Ex. 1, Supp. 1, Part 2, Answer to Q95; Tr.

l

! 10,648 (Jones). In addition, the record includes the testimony of Licensee's witnesses on the shortcomings they perceive in the systems evaluated by B&W and under consideration by

• Westinghouse and Combustion Engineering. See, Tr. 10,709-10 (Jones); Tr. 10,724-25 (Jones); Tr. 10,759-67 (Keaten, Jones);

l N- . .

,.---s,n .,,-,-n,

l l

Tr. 10,915-17 (Keaten, Jones). While the Staff would not accept the ultimate conclusion of Licensee's evaluation, the Board finds that it represents a good-faith and reasonable effort to evaluate the long-term recommendations in section 2.1.3.b of NUREG-0578. 9

83. Licensee has been following the efforts of other elements of the industry, including the Electric Power Research Institute, to investigate potential reactor water level

, instrumentation systems. Tr. 10,707-09 (Keaten). Licensee has

! also expressed its intent to continue to pursue possible '

i methods of measuring level in the reactor vessel if they prove 4

to be reasonable. Tr. 10,919 (Keaten). In addition to working with the other B&W owners on this matter, Licensee has agreed to cooperate with and assist a professor at Pennsylvania State University in developing a proposal to pursue, first on a research reactor, a concept for measuring water level on the i

basis of using existing neutron detectors. Licensee has also sought a proposal from a professor at U.C.L.A. to perform an ,

independent evaluation of the ongoing work to develop reactor l water level instrumentation. Tr. 16,521-23 (Keaten).

[ 84. Both Staff witnesses on this subject testified that the Staff's position is that TMI-1 should be treated no differently than any other operating reactor. Tr. 10,878 i

(Phillips); Tr. 16,029 (D. Ross). In its order of March 23, 1981, the Commission stated that, while it expects the Board to find to the contrary when the record so dictates, it believes 59-0

-e-- _--e.+- ee-a,r,*- n.- ,,se-- -,-mi-,--s-,v+ --e----,-me -- e,m--m.--gre,-%- -yq -. y gvm e- - y www.-w,y--,-,--,g7wi--,-wwe, ,yv wg s v w v---.-y-y v,y---e.3,,-w ,3-.y-,-we,

TMI-1 should be grouped with reactors wh'.ch have received operating licenses, rather than with the units with pending operating license applications. CLI-81-3, 13 N.R.C. , slip op.' at 7 (March 23, 1981). The Board believes strongly that the restart of TMI-1 should not be held hostage to discrimi- ,

natory Staff treatment on this issue. See Tr. 10,879 (Chairman Smith). Consequently, it is highly relevant to consider the progress of other licensees on this issue, which is being applied to them through item II.F.2 of NUREG-0737 (TMI Action Plan), and the Staff's reaction to that progress.

85. Pursuant to item II.F.2 (Instrumentation for the Detection of Inadequate Core Cooling) of NUREG-0737, licensees were to provide documentation on their proposed systems for detection of inadequate core cooling by January 1, 1981. Ross, ff. Tr. 15,915, at 2. A status report prepare.d by the Staff on the submissions received as of January 9, 1981, reported 22 schedule exceptions and 6 technical position exceptions taken j to item II.F.2 out of the 38 PWRs reporting (one plant was i

listed with an exception in each area, leaving 11 PWRs with no exception noted by the Staff). Lic. Ex. 34. Two other PWRs subsequently filed technical position exceptions -- TMI-1 and San Onofre. Tr. 15,969-70 (D. Ross); Lic. Ex. 35.

86. Dr. Ross, in his written testimony filed on March 11, 1981, described the status of other operating PWRs on item II.F.2 of NUREG-0737. Dr. Ross reported that out of eight Combustion Engineering plants, three are committed to a system

- r ~.,,,-,----,,.,-.--,..,..,,,.-.4..-a,-,-m_ ,-,,,,,,,v.-- ,- w,,-..,. --y..-w ---.._,,v.w.. , -...m. -.-u -wv.-.- -.-.y,----

(though only one expects to be on schedule), three are still reviewing available options, one is somewhere beyond that, and one is taking the position that nothing is needed. Ross, ff.

Tr. 15,915, at 11, as amended at Tr. 15,975 (D. Ross). For the three which are still reviewing available options, Dr. Ross could not testify whether or not they had shown " reasonable progress." Tr. 15,973-74 (D. Ross). Dr. Ross described l

4 reasonable progress as something more than a one-sentence commitment to timely installation of an unidentified system.

Tr. 15,974-75 (D. Ross). So that one of the CE plants listed I- by Dr Ross as " committed to a system" (Maine Yankee) could not

~

be viewed, on the basis of its submission to the Staff, to have shown reasonable progress. tr. 15,978-79 (D. Ross). Another l CE plant listed as " committed" in the written testimony, St.

! Lucie-1, merely stated, in its submission, that it is partici-l pating in the CE owners group effort to evaluate water level

indication, and that a detailed description of its plans for i

l inadequate core cooling will be forthcoming upon completion of that effort. Lic. Ex. 39. Dr. Ross admitted that while the Staff believes St. Lucie-1 is going to install a level system, the Staff does not have a commitment as he defined the term.

Tr. 15,977-79 (D. Ross). Consequently, the record does not surport the written testimony that three CE plants are commit-ted to a system, and at least one of the " commit'e'" plants does not even appear to meet the reasonable progress standard articulated by Dr. Ross.

,.o.

, __,-f. _ . , _ _ . _ .-----%,_ - . - - . . , , _ , _ _ , . ,.m_r,_ . , . . . . _ . . , . , ,,,.,,_,,m,_,. ~ . . _ -_,,_c ., , , . . . , , _ , , . , . , _ ,,,_.,_..-~,.--,w_.%,.m.,_.-_

i

87. The distinction Dr. Ross made between three CE plants reviewing available options and one plant taking the position that nothing is needed is also questionable. The licensee of two of those three plants identified as still reviewing available options, Calvert Cliffs 1 and 2, indicated that it does not think a reactor vessel level system is necessary, that it will reevaluate its position when the CE owners group study is completed, and that sometime in 1983 would be the earliest reasonable target date for installation of such a device. Lic. Ex. 40. The third plant listed in this category by Dr. Ross is Consumer Power Company's Palisades Plant. Tr. 15,979 (D. Ross). While in'its submission to the Staff that licensee described the efforts of the CE owners group, it also stated:

Consumers Power Company will not commit to install additional equipment (i.e., reactor vessel level instrumentation) at this time due to the following:

1. The Palisades Plant has existing instrumentation (i.e., subcooling meter) that lets the operator know l when inadequate core cooling is being approached.

2. Presently, there are three' Owners Groups pursuing a solution to this problem. Due to the lack of direction and definition of NRC recommendations, all three groups are moving in different directions. With this type of confusion, we cannot justify any ,

one system at this time. We will continue to stay updated and aware of l developments .'. . .

Lic. Ex. 41. As Dr. Ross testified, his distinction in the written testimony between plants reviewing available options

_ , - - , - . , , , . . . .._,-..,,_.e-,,,,,,_,.m _ m_,. ,,___._,,.-e,__m, ,w,.,..,,,,_m._,7,m, ,,,,-_,w-w ,,.,w .__,. . _ _ . , . . ,,.w. S. _ , _ . . .

and those taking the position that nothing is needed "may overlap a little bit." Tr. 15,981 (D. Ross).

88. With respect to Westinghouse PWRs, Dr. Ross reported in his written testimony that 15 of 29 have committed to systems and expect to meet the schedule for installation,

, and that five others are committed to a system with some delay in the installation schedule. He reported that nine others still have their selection under review and have not committed to a schedule for installation. Ross, ff. Tr. 15,915, at 12, as amended at Tr. 15,992 (D. Ross). None of the Westinghouse plants were reported as having taken the position that no additional instrumentation is needed. Tr. 15,983 (D. Ross).

l Yet Dr. Ross admitted that the licensee of one Westinghouse plant, Kewaunee, has taken the position that existing instru-mentation is adequate. Tr. 15,983-84 (D. Ross). Another licensee of a Westinghouse plant, Ginna, has stated that it will not commit to install a water level device unless and until one is shown to provide useful information to the operator and is successfully demonstrated. Lic. Exs. 43 and

44. The licensee of San Onofre-1, a Westinghouse plant, stated in its filing that no additional instrumentation is needed.

Lic. Ex. 35.

89. Summarizing the status of B&W plants, Dr. Ross reported that three of eight reactors (Oconee 1, 2 and 3) have -

promised a near-term decision on the type of system selected and the schedule for installation. Ross, ff. Tr. 15,915, at w_ ,,--v- r-,, *--g, ,..,,y e ,<p,,-, - - - - ,,.,---m,_,,-,s ,w~ ,,,,+,-.,,--,,e , , ,-,- -

11. The Duke Power Company submission, however, while it describes its technical efforts to review systems under development, takes the clear position that additional instru-mentation is not needed. Lic. Ex. 36. One B&W reactor (Crystal River 3) is reported to have selected a hot leg level instrumentation concept, but it has not provided a detailed description or schedule. Two plants (Davis-Besse 1 and Rancho Seco) are still reviewing currently available systems and have made no decision,34 and two (ANO-1 and TMI-1) have taken the position that additional instrumentation is not needed. Ross, ff. Tr. 15,915, at 11. Dr. Ross could not testify whether or not the licensees of Oconee, Crystal River, Davis-Besse and Rancho Seco have made reasonable progress on this issue. Tr.

15,971 (D. Ross).

90. Stacking up Licensee against these other PWRs, the Board perceives no significant difference between the efforts made by this licensee and many others. The main distinctions are the clarity of Licensee's technical positions and the Staff attention which they have received because of

this proceeding. ree Tr. 16,042 (D. Ross) (Staff has not i

attempted, in the ordinary course of its business, to reach a reasonable progress decision on other operating reactors).

Even though Dr. Ross testified that some plants are in the same l 34 We have reviewed the filings with the Staff by these two licensees and perceive no significant progress beyond the efforts of Licensee. See Lic. Exs. 37 and 38.

I l

l

situation as Licensee (Tr. 15,935), and that some other operaffag PWRs have not made reasonable progress on this item (Tr. 16,030), the Staff has taken no enforcement action against any PWR operating licensee in response to its progress on item II.F.2 of NUREG-0737. Tr. 15,985 (D. Ross). Yet the Staff position here would continue a shut down order.- The Board believes this is discrimination which is unwarranted on the facts as we know them.35 The Staff does not appear to be so inflexible in its overall administration of the program. Mr.

Phillips testified that the January 1,1982 installation date is flexible. Tr. 10,838 (Phillips). Dr. Ross predicted that the Staff would not meer th4 first milest'one on its review schedule -- the issuar_ce of generic acceptance criteria on April 1, 1981.36 Tr. 15,934 (D. Ross).

91. Considering the extended lack of clarity in the Staff's application of the long-term recommundations in section 2.1. 3.b of NUREG- 0578, the good-faith effort Licensee has made and continues to make to evaluate the potential for reactor 35 The Staff itself has endorsed, as a general proposition, that "(r]easonable progress toward completion of the long-term actions required by the Order for TMI-1 will be considered to be a degree of progress consistent with that of the other operating reactors, except as noted in individual evaluations, so that there is reas nable assurance that the action will be completed on the NUREG-0737 schedule as it may be amended."

Staff Ex. 14 at 3; Tr. 21,042-44 (Silver). The Board has been given no cogent reason why we should accept the Staff's -

deviation from that principle here.

36 Those criteria had not been issued as of May 14, 1981.

Tr. 21,436 (stipulation of counsel).

,i_,, ,- .- . .-. y . , , , ,-.w ,r,.7- -%m.

.---.-,~,..,.,_-,--.,c. . , _ , ., -

I water level instrumentation, and the state of progress of the Staff and the rest of the industry, the Board recommends that I

the Commission find Licensee to have made reasonable progress toward any long-term requirement on this subject which the Commission might impose as a condition of operation.37 C. Abnormal Transient Operating Guidelines Board Question No. 11: The board is not satisfied with the staff findings in the SER with respect to F.ecommendation 2.1.9.C (transients and accidents) of NUREG-0578. The

staff concludes that satisfactory i progress has.been made and the item is complete. SER, pp. B-10, C8-49.

According to Table B-2, the analyses and procedures were scheduled for completion by early 1980. We observe

' that in May of this year, it was i reported that "the Staff is performing a generic review of transients and other accidents in accordance with Recommendation 2.1.9 of NUREG-0578" (NUREG-0667, p. 5-26).

I We expect the licensee and the staff to present evidence that the requirements on p. A-45 of NUREG-0578 will be met and to explain the schedule for meeting those requirements. The board, as well as the staff, must have sufficient information to decide whether satisfactory progress is being made.

92. Recommendation 2.1.9.c of NUREG-0578 is to '

I

"[p]rovide the analysis, emergency procedures, and training to 37 After the appearance of its witnesses on this subject, the Staff provided criteria by which Licensee's reasonable progress might be judged. Staff Ex. 14 at 29-30. These criteria had not been identified by the witnesses, and the Board has no evidence that the criteria appeared anywhere prior to late April, 1981, or that they have been supplied to, l or employed in any review of, other licensees. Tr. 21,43S (Jacobs). Consequently, we believe they deserve little weight.

i substantially improve operator performance during transients and accidents, including events that are caused or worsened by-inappropriate operatur actions." Licensee described the program in progress to implement this recommendation at TMI-1.

Broughton, ff. Tr. 10,941.

93. TMI-l is one of six utilities participating in the B&W Abnormal Transient Operating Guidelines (ATOG) program.

This program provides plant specific guidelines which form the bacis for: (1) improved plant procedures, (2) operator-training in tne understanding of plant transient response, and (3) operator training in the use of the procedures. The guidelines enable diagnosis of plant conditions during the transient, emphasize stabilization of plant conditions, and provide guidance to mitigate failures which would interfere with achieving the appropriate plant condition. In developing the guidelines particular attention has been paid to providing a document which could be used by operators during the tran-sient. ATOG incorporates several existing guidelines, includ-ing those for loss-of-coola.'t accidents, and will incorporate

inadequate core cooling guidelines. Broughton, ff. Tr. 10,941, i

at 2. See also, Jensen, ff. Tr. 11,005, at 3.

94. ATOG is based on existing LOCA analysis plus l additional analysis of small steam line breaks, loss of l feedwater, loss of off-site power, excessive feedwater addition -

and steam generator t>be rupture. The analysis of each event began with a collection of data appropriate to the transient J ..

l l

and specific to TMI-1. A diagram was constructed to organize I the data to show how specific plant systems and subsystems are expected to function in various operating modes and in the event of failures. Based on this data an event tree was constructed assuming the particular initiating event and

~

identifying the desired and possible alternative outcomes, considering equipment malfunctions and operator errors. Next, the scenarios were reviewed and grouped as to effect on the plant. Selected representative scenarios were then simulated with computer codes providing best estimates of plant perfor-mance. Broughton, ff. Tr. 10,941, at 2, 3; Tr. 10,978-83 (Broughton). ..

95. This process and the results are the technical in9ut to the guideline training material. The plant response to the basic transient and its alcernate scenarios, the key symptoms necessary to determine the plant condition and the-actions required to stabili. e the plant are then explained in the training material. Broughton, ff. Tr. 10,941, at 3.

96. After analysis of all events, the procedure guideline is developed. A set of instructions is assembled to evaluate the key symptoms which characterize plant conditions.

If abnormal conditions are indicated, instructions are provided to. evaluate additional symptoms, to take action to correct causes of abnormal conditions and/or to take action to achiave .

plant stability. Combining the actions common to these evsnts produces a single procedure, and therefore a single set of l

l operator actions, based on key plant parameters, nithout requiring that the specific initiating event be known.38 Furthermore, by systematically evaluating symptoms, the  ;

procedure aids in diagnosis of the event as the plant is being stabilized. Broughton, ff. Tr. 10,941, at 3, 4.

97. When ATOG is implemented at TMI-1, these guidelines will be used-following reactor trip or when a rapid shutdown from power is required. Since the procedure is applicable during forced or natural circulation, with or without off-site power, and with normal er emergency feedwater, several existing plant procedures will require modification and some may be eliminated. Furthermore, since the approach to event diagnosis is altered by this procedure, a revised program to train operators in this approach, in the use of this specific procedure, and in the use of other modified procedures is required. Broughton, ff. Tr. 10,941, at 4.

i 98. B&W completed a draft ATCG document for Arkansas Power in August, 1980, and has been working on various stages l

l of guideline development for other B&W owners. With respect to TMI-1, Licensee currently expects implementation, including conversion of the guidelines into plant procedures, modifica-tion of interfacing procedures and training of operators to be l 38 In addition to the improved technical content of these -

guidelines, human factors considerations have been included in their development. Presentation of training material, format and level of detail in the guidelines, and the ability of operators to use guidelines during simulated transients have been addressed by a human factors review. Broughton, l ff. Tr. 10,941, at 4.

I

l *

..,___.m. ._.,.--~w.,_y c_, , _ _ . _ . . . , . , . , _ _ . , , . ~

completed in September, 1981. Broughton, ff. Tr. 10,941, at 5.

This long-term item is being implemented for all plants under '

item I.C.1 of NUREG-0737, however, which requires issuance of plant specific emergency procedures under this program by the first refueling after January 1, 1982. Staff Ex. 14 at 46.

99. In Supplement No. 3 to its restart Safety Evaluation Report, the NRC Staff updated its earlier review, cited in Board Question No. 11, and concluded that Licensee has demonstrated reasonable progress on this item. Staff Ex. 14 at

46. The Board finds that this recommendation is necessary and sufficient as a long-term requirement, and finds that its

~

implementation will substantial 1y improve TMI-l operators' performance during transients and accidents, including any approach to inadequate core cooling situations. See section II.B, supra.

1 l

D. Safety System Bypass and Override l

UCS Contention No. 10: The design of the safety system at TMI is such that the operator can prevent the completion of a safety function which is initiated automatically; to wit: the operator can (and did) shut off the emergency core cooling system prematurely. This violates 54.16 of IEEE 279 as incorporated in 10 CFR 50.55(a)(h) which states:

The protection system shall be so designed that, once initiated, a '

protection system action shall go to completion.

The design must be modified so that no operator action can prevent the

- ~ , . - - + . , - , , , - ., - ,e . - , e- -- e ,,y., p- -

-n ~,-,,,,w- , - , , .,---, ,- , -

completion of a safety function once initiated.39 Sholly Contention No. 3: -

It is contended that as a result of Licensee's Operating Procedures, the emergency. core cooling system can be defeated by operator actions during the course of a transient and/or accident at Unit 1, such defeat consisting of either throttling back the high-pressure injection pumps or tripping these pumps. It is further contended that under the conditions of a loss-of-feedwater transient / loss of coolant accident at Unit 1, defeat of the emergency core cooling system high-pressure injection system by pump throttling and/or pump trip results in significant cladding metal-water reaction, causing the production'of amounts of hydrogen gas in excess of the amounts required by NRC regulations to be considered in the design and accident' analysis of nuclear power plants. It is contended further that such production of hydrogen gas results in the high risk of breach of containment-integrity due l to the explosive combustion of the hydrogen gas in the containment.

Inasmuch as tne emergency core cooling system is an engineered safety feature which is relied upon to protect the l public health and safety, and because j proper operation of the emergency core cooling system is required to provide reasonable assurance that Unit 1 can be operated without endangering the public health and safety, it is l

39 In its Prehearing Conference Order of December 18, 1979, the Board limited UCS Contention No. 10 to.the core cooling and containment isolation systems. LBP-79-34, 10 N.R.C.

l 828, 836 (1979). The Board subsequently accepted UCS's specification of the contention to address the emergency core cooling, emergency feedwater and containment isolation systems. Memorandum and Order of Prehearing Conference of August 12-13, 1980, at 6.

l

- , . . _ . . . _ ~ . , . . . . _ . . . . . -

contended that.the emergency core I cooling system operating procedures must be modified in order to ensure compliance with the GDC 35 requirement of1 negligible clad metal-water reaction following a loss-of-coolant accident (LOCA). It is further contended that the emergency core cooling system <

operating, procedures must be appro- l priately modified prior to restart in order to provide for protection-of the public health and safety. '

1 100. During the TMI-2 accident, the operators prevented a safety system which had been automatically initiated from performing a safety function by terminating full flow from the high pressure injection system to the reactor coolant system. This reduction in emergency cooling water flow significantly contributed to the severity of the TMI-2 acci-dent. Pollard, ff. Tr. 6410, at 10-1. Intervenors UCS and Sholly suggest two fundamentally different responses.to the same concern - operator action to bypass and override the emergency core cooling, emergency feedwater or containment isolation systems. UCS, in its Contention No. 10, would have us direct the modification of the design of these systems "so that no operator action can prevent the completion of a safety function once initiated." Mr. Sholly, on the other hand, proposes in his Contention No. 3 that the plant operating procedures governing ECCS should be modified prior to plant -

restart to avoid operator defeat of the ECCS.

101. UCS Contention No. 10 asserts only one basis in support of its proposed design modification: that " [ t] he

design of the safety systems at TMI is such that the operator can prevent the completion of a safety function which is j l

initiated automatically," and that "[t]his violates S 4.16 of i IEEE 279 as incorporated in 10 CFR 50.55(a)(h) which states:

The protection system shall be so designed that, once initiated, a protection system action shall go to completion."

The contention, in short, is that the design of the TMI-1 emergency core cooling, emergency feedwater and containment isolation systems violates a Commission regulation, which

- violation requires that the design must be modified. See also, Pollard, ff. Tr. 6410, at 10-2 (referring to sections of IEEE Std 279 as " requirements of the Commission's regulation").

102. Although, as we will discuss in more. detail below, UCS presented to the Board conflicting views of its own t

construction of Contention No. 10, the contention is disposed of easily if it is construed literally. The Commission's

regulation cited in the contention as having been violated at TMI-1, 10 C.F.R. S 50.55a(h), states that it applies to protection systems at plants for which a construction permit was issued after January 1, 1971. The construction permit for TMI-1 was issued on May 18, 1968. Sullivan, ff. Tr. 6602, at

( 2, 3. Consequently, the regulation cited by UCS does not apply to TMI-1. It follows that the Board cannot find the facility 1

to be in violation of 10 C.F.R. S 50.55a(h) and that UCS -

Contention No. 10 fails on the basis of its language alone.40 40 In this case, the Board would be warranted in halting its consideration of UCS Contention No. 10 at this point. Unlike (continued next page) m wg e <= ,y-..--,y -e4 - vrc eyew m- -a,.--yw--n w--w-f e-g-,_g 9we pw..- 9e,,_, , y--s*<w,w.pierr,-ywypwy*---,igp-- y-myg-c--w.- g-%-- w,e w ww ey,-ew-=+.,----- .g---e & py,*,+-2-r&-+er

l It does not matter,'in deciding violations of a Commission regulation, that the NRC Staff in actual practice may have used IEEE Std 279-1968 in its operating license review of TMI-l protection systems, even though the applicant was not legally required to meet it.41 Cf,. Tr. 6632-33 (Sullivan).

103. Evidence was presented, nevertheless, and the Board will consider, whether TMI-l conforms to IEEE Std 279, i

even though it does not apply under Commission regulations.

There are two versions of IEEE Std 279, which is entitled

" Criteria for Protection Systems for Nuclear Power Generating Stations": IEEE 279-1968 (UCS Ex. 16), which contains proposed (continued) pro se parties which are held to a lower standard in pleading contentions, UCS, with a general counsel and full-time tech-nical staff experienced in NRC proceedings, is presumed to have crafted its contentions here with considerable care and forethought. Licensee, we believe, is entitled to defend itself against the contention as written, and not as the UCS witness chose to modify it at the, hearing. Otherwise, the entire contention requirement in 10 C.F.R. S 2.714, with the requisite specificity, serves little useful purpose.

41 UCS witness Pollard wrote UCS Contention No. 10. Tr.

'6474 (Pollard). Yet, he did not learn the date of issuance of the TMI-1 construction permit -- the key fact in determining the applicability of 10 C.F.R. S 50.55a(h) -- until he heard the testimony of another witness at the hearing. Tr. 6476 (Pollard). He did not bother to check on this fact, relying instead on his recollection that the Staff was using IEEE Std 279 for operating license reviews during the time period when TMI-l was licensed. Tr. 6474-75 (Pollard). We understand now that Mr. Pollard, even though he is a former Staff project manager, does not appreciate that Staff practice is not enforceable here and cannot alter the clear and explicit language of a Commission regulation. Nevertheless, the Board cannot ignore, when considering whether a licensed design violates a Commission regulation, the crucial distinction between law and practice.

criteria; and IEEE 279-1971 (Lic. Ex. 16), the approved standard which revises IEEE 279-1968. Sullivan, ff. Tr. 6602, at 2. The quotation in UCS Contention No. 10 is from seccion 4.16 of IEEE. 279-1968. UCS Ex. 16 at 5.

104. The standard under consideration here_ applies, as its name implies, to nuclear power plant protection systems.

l Section 1 of IEEE 279-1968 defines the scope of.the protection systems addressed by that standard as follows:

For purposes of these Criteria, the nuclear poiser plant protection system encompasses a 1 electric and mechanical devices and

-ircuitry (from sensors to actuation device input terminals) involved in generating

, those signals associated with the protec-tive function. These signals include those that actuate reactor trip and that, in the event of a serious ree.ctor accident, actuate engineered safeguards such as .

containment isolation, core spray, safety injection, pressure reduction, and air cleaning.

UCS Ex. 16 at 3; Clark et al., ff. Tr. 6225, at 3 (Patterson).

Except for the term " plant" (1968) versus " generating station" (1971), both versions of IEEE Std 279 define " system" as follows:

Where not otherwise qualified, the word

" system" refers to the nuclear power plant protection system, as defined in the scope section of the criteria.

l UCS Ex. 16 at 3; Lic. Ex. 16 at 7; Clark et al., ff. Tr. 6225, l

at 4 (Patterson). The definition of the protectioa system given in the Scope section of the standard, quoted above, remained essentially unchanged from the 1968 to 1971 versions.

Id.

C. _ . _ _ _-

. , - , _ _ _ . . . . , . . . , --- . _ . _ . _ - - ~ . . - _ . - .- - - - - - - -

105. Section 4.16 of IEEE 279-1968, which is quoted in UCS Contention No. 10, states that: " The protection system shall be so designed that, once initiated, a protection system action shall go to completion." Clearly, the express language of the standard limits its applicability to initiation of a protective action initiated by the protection system (from sensors to actuation device input terminals). There is a real distinction bere between a safety function (such as the actual pumping of water into the reactor) and the protection system that actuates the equipment (such as motors and pumps) which l performs the safety function. Sullivan, ff. Tr. 6602, at 3.

There'is no basis to apply the standard, as UCS would, to the completion of a subsequent safety function. Clark et al., ff.

Tr. 6225, at 4 (Patterson). Indeed, the words " safety func-tion," " completion of safety function," and " completion of a safety function which is initiated automatically" -- all of which are used in UCS Contention No. 10 -- cannot be found in either version of IEEE Std 279. See UCS Ex. 16 and Lic. Ex.

16.

106. Consequently, IEEE Std 279 on its face does not apply to the situation which concerns UCS -- i.e., operator 1

interference with emergency core cooling, containment isolation l

l l

, - , , , - - - - - --,w.- - , , , -, ,- , r, ,y-- - ~ , ,------,w.- , -----e., , - n

or emergency feedwater system functions once they are initiated

! automatically. The standard simply does not address the motors, pumps and other equipment that actually perform the safety functions. Forthisreason,adesignwhichgivebthe operator the capability of. prematurely terminating a safety function is not in violation of section 4.16 of the standard.

Sullivan, ff. Tr. 6602, at 3, 4. Ra the'. f as in the case of- the l ECCS, the standard requires that for a condition requiring the ECCS, the protection system shall be designed that, once initiated, nothing within the protection system can prevent the signal from completing its specified action, which is actuation of the ECCS. Id,. at 4; Clark et al., ff. Tr. 6225, at 3 (Patterson). In other words,,the actuation circuits are designed to continue to demand the safety function, and to do so until subsequent deliberate intervention by the operator, as provided for in the second sentence of section 4.16: " Return to operation shall require subsequent deliberate operator

( action."- Sullivan, ff. Tr. 6602, at 4; UCS Ex. 16 at 5; Lic.

Ex. 16 at 10.

l 107. The protection system at TMI-l is designed with l the " seal-in" feature such that the protection system action goes to completion in the sense described above. Return to i

=

'* em I

- . . . , . - . . . . . . , , , . . . . , - _ , , _ . . , _ _ . . , . , , , , , . . _ . , . . _ . . _ , - . . - , , . _ . . , , - - . . - , , _ . _ _ . . . _ . . . , . . . , , _ . _ , ~ . . . . _ , - , , , , , . . -

l operation (removal of the " seal") requires subsequent t

deliberate operator action.42 -Thus, the TMI-1 protection system is in conformance with section 4.16 of IEEE 279-1968.4 Sullivan, ff. Tr. 6602, at 4. Consequently, even if 10 C.F.R.

S 50.55a(h) were to be applied, contrary to its terms, to TMI-1, the TMI-l design meets section 1.16 of IEEE 279-1968, I

i and UCS Contention No. 10 still fails. '

i 108. UCS witness Pollard conceded, even in his pre-filed testimony, that the construction of IEEE Std 279 by Licensee and the NRC Staff "has a patina of validity,"'although he characterized their position as-" simplistic" and "legalis-tic." Pollard, ff. Tr. 6410, at 10-4. The Board cannot help but observe the irony in these remarks, since it is Mr. Pollard who drafted a contention whose sole basis is a simple, legal

allegation that a Commisnion regulation is violated.- On cross-examination, Mr. Pcllard also admitted that if you focus 42 Mr. Pollard characterized the position of Licensee and the NRC Staff to be that "the requirements of IEEE Std 279 do not apply to the emergency core cooling, auxiliary feedwater and containment isolation systems because these systems are not part of the protection systems as defined in IEEE Std 279."

Pollard, ff. Tr. 6410, at 10-3. Mr. Pollard acknowledged, i

however, on cross-excmination, that he did not' understand Licensee's position to be that IEEE Std 279 does not apply to the circuitry in the ECCS from sensors to actuation device input terminals. Tr. 6478 (Pollard). Consequently, the direct testimony represents a simplistic overstatement of Licensee's position. .

43 Also, since, as we noted above, the 1971 version of IEEE Std 279 does not differ in its scope and definitions from the 1968 version, it follows that the TMI-1 protection system also meets the related requirements of the later version.

i l -

on the words of the standard, there is no reasonable way of-interpreting the language of the Scope section of the standard as defining the " protection system" to go beyond the actuation device input terminals. Tr. 6479-80 (Pollard).

109. UCS would then have the Board go beyond the plain langnage of IEEE Std 279, however, and attempt to discern the purpose of the standard, the history of its development, the continuing work of IEEE standards committees, and the Com-mission's past policy and practice applying the standard, in order to " properly interpret" IEEE 5td 279 to require the design modifications suggested in UCS Contention No. 10. See, generally, Pollard, ff. Tr. 6410, at 10-4 to 10-16. While our reading of the standard would hardly warrant such an exercise at this point, the Board nevertheless has considered the arguments advanced by UCS.

110. UCS asserts that:

[i]n relying on the definition of protec-tion system, Met Ed and the Staff ignore the ourpose of the standard which is to

" establish minimum requirements for the safety-related functional performance and reliability of protection systems. . . .

(IEEE Std 279, " Scope").

Pollard, ff. Tr. 6410, at 10-4. The standard itself does not j state a purpose. In fact, the Scope section quoted by UCS witness Pollard, continues: " Fulfillment of these requirements does not necessarily fully establish the adequacy-of protective -

system functional performance and reliability." UCS Ex. 16 at 3; Lic. Ex. 16 at 7. Hence, the Board rejects at the outset 9

y - - - ,,,,,,v, -

w,--,-wy---,+- ,,.c.,--,._w,,-w..--w,, 9,.,m-,,,,,,.y,._,q,y,,,.9,,.-y,, ,,,,,w.---g,,pr-y.,sw, r .w wwy,,_.--wu y syyw_,-,-- y ,,.n.,w ,,. .,-e_,e.-,, cyg,.ye--

~

l the unstated theory which seems to underlie all of Mr.

Pollard's testimony on this subject -- i.e., that unless IEEE Std 279 can be read to govern the totality of the design of safety systems, then there is nothing by which to guide us in l assessing whether the safety function actually will be com-pleted. The standard does not purport to establish the functional performance of entire safety systems, however, and we reject the notion that such systems need to be governed by an IEEE standard in order to be intelligently appraised and found to be adequate.44 111. Mr. Pollard testified that "[t}he Staff and Met Ed arguments amount to saying that the Commission has imposed a requirement that has no purpose . . . .

Pollard, ff. Tr.

6410, at 10-5. Licensee witness Patterson, from Babcock &

Wilcox, disagr.eed with this observation, and explained the l purpose of section 4.16 of IEEE Std 279. The concern addressed i

by the requirement arose from historical experience which 44 UCS witness Pollard characterizes the Staff and Licensee position as one "that as long as the protection system attempts to initiate operation of a system that could perform the needed safety function, it matters not whether the safety function is actually accomplished." Pollard, ff.

Tr. 6410, at 10-5. We can discern no evidence that this reflects the attitude of Licensee and the Staff. To the contrary, the voluminous evidence we have reviewed, in this decision, on the TMI-1 emergency core cooling, containment l isolation and emergency feedwater systems convinces us that l Licensee and the Staff believe it matters a great deal

• whether safety functions are actually accomplished. The question here, however, is the narrower one of whether IEEE Std 279 governs the achievement of that goal.

l l

l

, ,_ ,. _ _ _ . . _ _ _ _ , , , , , , - . . _ _ _ . - . _ , _ - _ _ . , . _ _ , , _ . - , , , - . . . , ,..-e_.. , _ _ . - , . , , .,.,.._,-,m - -.-m. _

i showed that protection systems could cause reactor trips, followed by a sudden clearing of the situation which left the plant in an undefined state from the operators' viewpoint. The purpose of the requirement, then, was to force the designer to incorporate a latching or reset mechanism in a protection system so that the operator would have to take action to reset l

the system and the system would not be capable of going back to I

an unset state of its own accord. Tr. 6228 (Patterson).

112. Mr. Patterson, we note, has had extensive experience with IEEE standards. He joined the IEEE nuclear standard writing effort in 1967 as the founding chairman of what is now the Subcommittee on Reliability under the Nuclear 1

Power Engineering Committee. He is presently the Chairman of the Editorial Subcommittee and a member of the Nuclear Power Engineering Committee.

l Mr. Patterson was a member of the IEEE Nuclear Science Group Standards Committee during the prepara-tion of IEEE 279-1968, and a member of the Joint Committee on j Nuclear Power Standards of the IEEE Group on Nuclear Science and the IEEE Power Engineering Society during the preparation and approval of IEEE 279-1971. Statement of professional qualifications, E. S. Patterson, attached to Clark et al., ff.

Tr. 6225; Lic. Ex. 16 at 3.

113. UCS witness Pollard, on the other hand, began his service on IEEE standards committees after the publication -

of IEEE 279-1971. Tr. 6498-99 (Pollard). NRC Staff witness Sullivan is the NRC member of the IEEE Nuclear Power Engineer-ing Committee, and participates in the Committee's development

__ - . _ _ . ~ .._._ _ - __. _ . . _ . _ ___ _ _ , . _ _ . . _ __

of standards for nuclear power plants. Professional Qualifications, Donald F. Sullivan, attached to Su!.livan, ff.

Tr. 6602. Mr. Sullivan began his work with IEEE standards committees in March, 1966, and has been continuously involved with the committees' work since then, including the development of IEEE Std 279. Tr. 6675-76 (Sullivan); UCS Ex. 16 at Foreward; Lic. Ex. 16 at 3. Mr. Sullivan, who agrees with Licensee's interpretation of the standard, testified that the purpose of the standard is to govern design capability, and not the operational issue of completion of a safety function. The purpose of the standard, then, is not inconsistent with operator intervention. Tr. 6605-06 (Sullivan).

114. Given their direct, first-hand participation in the development of IEEE Std 279, their extensive experience in IEEE standards committee work, and the complete compatibility of their views of the standard's purpose with the provisions of the document, the witnesses of Licensee and the Staff must be accorded greater credibility than the UCS witness in any j dispute over the purpose of IEEE Std 279. The same allocation of weight must be accorded, with perhaps even greater cer-tainty, to the dispute over the historical reasons for the choice of specific language in section 4.16 of IEEE Std 279.

Compare Pollard, ff. Tr. 6410, at 10-6 to 10-8, with Tr.

l 6229-30 (Patterson). ~

115. Next, UCS would have the Board somehow use the subsequent work of IEEE standards committees in veloping IEEE

.~

. w. , , , ---,,-m y ,,---,.w *-,,,y.-3 m. - ---.,. -,----n- .

- -,. - --- - - - -.y -~+

~~]

Std 603 as a retroactive tool for interpreting IEEE 279-1968.

IEEE 603-1977, entitled " Criteria for Safety Systems for Nuclear Power Generating Stations," was published as a trial-use standard in March, 1977. Pollard, ff. Tr. 6410, at 10-8.

It is in this record as UCS Exhibit 15 (the corrected edition, dated October 25, 1977). UCS witness Pollard testified that the purpose of develoning IEEE Std 603 was.to apply the requirements of IEEE Std 279-1971 to the systems actuated by the protection system.45 Pollard, ff. Tr. 6410, at 10-8, 10-9.

116. Mr. Pollard testified that he served as'the NRC representative on the IEEE standards committee that developed IEEE 603-1977, and that the intent was to have IEEE Std 603 replace IEEE Std 279 after two years of trial use, i.e., in March, 1979. Pollard, ff. Tr. 6410, at 10-8, 10-9. While this was the intent at the time Mr. Pollard was associated with the authoring committee,46 since the time the standard was issued for trial use the committee has reaffirmed IEEE Std 279 for another four years and has revised and approved Std 603 as a full standard without replacing Std 279. Tr. 6231-32 (Patterson). More importantly, draft IEEE 603-1977 has not been codified in the Commission's regulations or endorsed in a i

45 If Mr. Pollard's interpretation of IEEE Std 279 were cor-rect, such an extended application would not be needed.

46 Mr. Pollard's statement of Qualifications also shows that he left the NRC in February, 1976. Pollard, ff. Tr.

6410.

1 l______-__-__.-_..

- - . . - . . - - - - - - - - - - ~ - - - - - - - - - - - - - - - - - - -

Staff regulatory guide, so that it has no regulatory force within this agency. Tr. 6606-07 (Sullivan); Tr. 6232 (Patterson). The Staff today has objections to the full standard IEEE 603-1980. Tr. 6608 (Sullivan).

117. While he quotes extensively from the draft standard (Id. at 10-9 to 10-11), UCS witness Pollard drew from t

IEEE 603-1977 no firm support for UCS Contention No. 10 in his pre-filed testimony, other than to observe from the section on

" operating bypasses" that it illustrates "the widespread technical support for the position that if the protective system determines there is a need for a protective function, every effort should be made to ensure it will be accomplished."47 Id,. at 10-11. Operating bypasses, however, are irrelevant to UCS Contention No. 10. Operating bypasses are devices to physically bypass the engineered safeguards system to keep it from inadvertently actuating during a normal plant transition from one condition to another. Tr. 6233-34 (M. Ross). An operating bypass is placed into effect before a safety system actuation occurs, with the plant in a stable, known condition. Therefore, the fact that the operating bypass is required to be automatically reset or locked out has no relevance to the entirely different situation which exists af ter safety system actuation and the question then of whether 47 Again, Mr. Pollard is battling straw men. The issue is whether the effort need be a design which prevents operator intervention, or some other means.

l l

or not to permit operator intervention on the basis of available information on the existing situation. Tr. 6233 (Clark).

118. Mr. Pollard esserted for the first time, on redirect examination, at the hearing, the view that~ application of IEEE Std 603 would require the design modifications called for by UCS Contention No. 10. Tr. 6573 (Pollard). Staff witness Sullivan flatly contradicted that view, testifying that if applied IEEE 603-1977 would require no change to the TMI-1 design, and would not prevent operators from interfering ~with I the completion of safety functions. Tr. 6609, 6616, 6681-82 (Sullivan).

119. The Board heard considerable testimony on these i conflicting interpretations of IEEE Std 603. Section 4.4 of-IEEE 603-1977, " Completion of Protective Action," provides as follows:

The safety system shall be designed so that, once initiated automatically or manually, the intended sequence of protec-tive actions at the system level shall continue until completion. Deliberate operator action shall be  : ired to return r'.

the safety system to norma.. This require-

, ment shall not preclude che use of equip-l ment protective devices or the provision for those deliberate operator interventions which are identified in 3.10 of the design basis.

UCS Ex. 15 at 14. The terms " safety system," and " protective 1 1

action," used in section 4.4, are each defined in section 2 of the standard. Id. at 10, 11.

I

(

120. In his pre-filed testimony, UCS witness Pollard attempted to apply sections 4.4 and 3.10 of IEEE 603-1977 to operation of Lae high pressure injection system at TMI-1. Mr.

Pollard first equated the procedural criteria for throttling HPI with the " completion of the safety function provided by" that system, as an illustration of applying section 4.4.

Pollard, ff. Tr. 6410, at 10-17. Unfortunately, the term

" safety function" is not used in the standard. This was not a propitious start at assisting the Board to comprehend a complex document, at UCS's request.

121. Section 3 of IEEE 603-1977, entitled " Design Basis," provides, in pertinent part, that the design basin shall document, as a minimum:

3.10 The critical points in time or the plant conditions, after the onset of a

design basis event, including

3.10.1 The point in time by which the protective action at the system level must I

be initiated.

3.10.2 The point in time after which-some protective actions may be manual.

3.10.3 The plant conditions after which a deliberate operator intervention may prevent the completion of protective action at the system level.

3.10.4 The point in time, or plant conditions, which define the proper completion of the protective action at the system level.

UCS Ex. 15 at 11, 13. Mr. Pollard, citing section 3.10.3 l

above, concludes: "Therefore, TMI-1 should be designed such that, until the set of conditions defined above is met, the operator cannot interfere with operation of the high pressure l

l

[

l l

l 1

injection system." Pollard, ff. Tr. 6410, at 10-18. Mr.

Pollard does not indicate, however, whether the " set:of conditions defined above" is the completion of the safety function or the plant. conditions specified in 3.10, after which the operator may intervene.

122. The Board concludes that IEEE 603-1977 specifically contemplates the opportunity for deliberate operator intervention to prevent the completion of protective action at the system level. We cannot see how this standard supports the UCS position that the design should prevent-operator interference. UCS witness Pollard was examined' extensively by Licensee and the, Board in an attempt to discern his application of IEEE Std 603 to UCS Contention No. 10.. See Tr. 6503-6516 (Pollard). The examination did not enlighten the Board on how the standard might be construed to support the UCS t

( position, and Mr. Pollard ccncluded by observing that there is confusion in the wording of the standard which may require a

additional work in IEEE. Tr. 6515 (Pollard). In a further effort to understand IEEE Std 603, the Board permitted Mr.

Pollard to resume the . witness stand and join Staff witness Sullivan, so that there could be parallel examination on their conflicting interpretations of the standard. Neither witness changed his view and this lengthy examination did not lead us to perceive how the apparent meaning of sections 4.4 and 3.10 "

can be construed to preclude, by design, operator interference until completion of a safety function. See Tr. 6720-72 l

=

-l I

(Sullivan, Pollard).  !

In any case, draft IEEE 603-1977 clearly is of very limited use to the Board in considering whether and how to apply IEEE 279-1968, which is the subject of UCS Contention No. 10.

123. UCS also argues that past NRC policy and practice supports UCS's application of IEEE Std 279. See Fe?, lard, ff. Tr. 6410, at 10-12 to 10-16. The examples, however, do not support an expanded construction of the standard itself. For instance, when UCS witness Pollard cites with approval the Staff guidance in Standard Review Plan f

section 7.3 that IEEE Std 279 should not be the only basis for judging the adequacy of the ESFAS design, he supports Licensee's position and not his own. See id. at 10-13. This illustrates that the Board necd not and should not attempt to read into IEEE Std 279 all of the regulatory criteria and review bases used to determine the adequacy of overall safety system design. The SRP recognizes explicitly that the IEEE standard does not cover the functional operability of the entire safety system. UCS could point to no generally appli-cable Staff document, such as a regulatory guide, which advises

, that the Staff applies IEEE Std 279 beyond the scope defined and stated in the standard. Tr. 6502-03 (Pollard).

124. Finally, UCS witness Pollard also cites the lessons learned from the TMI-2 accident as support for UCS

• i Contention No. 10, although again reliance is placed upon IEEE Std 279:

~

,, ~ , . - - , . ,-e,.,,, -

I To meet this requirement [the " proper interpretation" of the Commission's regulations in IEEE Std 279], the TMI-l design must be modified so that the-operator can nc' prevent initiation or completion of the safety function provided by the high pressure injection system.

This could be accomplished, for example, by interlocking the operator's controls for the high pressure injection system with the signals from low pressure injection flow, a 20 minute timer and the saturation meters such - that the controls would be ineffective in stopping high pressure injection until the conditions specified above were met.

The same type of design changes need to be undertaken for the auxiliary feedwater system and the containment isolation system. Met Ed must define completion of the safety function for each system and

' then design the plant so that the operator. .

can not stop the auxiliary feed-water system or open containment isolation valves until it is safe to do so.

l Pollard, ff. Tr. 6410, at 10-18, 10-19 (footnote omitted).

125. Licensee expressed strong and unequivocal dis-agreement with the basic philosophy underlying this proposed design modification, asserting that the provision of automatic

( circuitry to prevent the operator from modifying any protective action once it has been initiated is not only impractical, but i

would seriously complicate the plant and detract from safety.

In Licen5ee's view, the need, and the lesson learned from the TMI-2 accident, is to prepare the operators to correctly diagnose the plant condition and carry out the appropriate actions. Clark et al., ff. Tr. 6225, at 4 (Clark).

126. Licensee witness Clark, who has had a long association with nuclear power in Government and now in private

industry, pointed out that from the very beginning of th'e nuclear power industry the plant operator has been recognized as a required element in correct plant operation. The princi-pal criteria for selecting actions assigned ~to the operators is that they must be actions operators can reasonably be expected to perform and for which they can be adequately trained. Very rapid actions required for immediate response to sudden unanticipated changes P plant conditions, for example, do not meet these criteria. For this reason the immediate actions of

(

l protective systerr (e.g., reactor trip, ECCS actuation and i

containment isolation) are automated and the operator action is simply to verify that the automatic circuitry has functioned properly. Subsequent bypass of such circuits, on the other hand, proceeds on a much more deliberate basis. The operators have ample opportunity to verify that the conditions prerequi-site to bypass are in fact met. They can, as appropriate, refer to written operating procedures and/or consult with their immediate supervisor prior to activating the bypass. It is fully appropriate, therefore, that this type of action remains under operator control. Clark et al., ff. Tr. 6225, at 5, 6 and attached statement of professional qualifications (Clark);

Tr. 6237-38 (Clark).

127. Licensee also asserts that continued addition of automat.ic circuits does not insure greater safety and, in -

fact, may be counter-productive to safety. The goal Licensee supports is to keep the plant sufficiently simple that

operators can understand the plant design, its current configuration, and the appropriate operator actions; so that additional complexities should be added only where the operator cannot reasonably be expected to perform the required actions.

Clark et al., ff. Tr. 6225,-at 6 (Clark). UCS witness Pollard, for example, would add an automatic protection system, on top of the automr'.ic interlock system he proposes, to stop an interlocked safety system operation itself from going too far (failing) and causing damage to the plant. Tr. 6435 (Pollard).

It is clear from the cross-examination that the proponents of such a design modification have given inadequate attention to the potential failure modes and effects of automatic interlock systems. See Tr. 6534-37, 6561-67, 6582-84 (Pollard).

128. In opposition to systems which automatically lock out the operator, Licensee noted that it has always been recognized that it would be impossible to construct a plant which would automatically operate correctly under all condi-l l tions, and that a properly trained operator in control of the plant is the best continuing guarantee of correct operation.

l This is particularly true, Licensee asserts, since it is impossible to foresee every possible condition which could arise. The operator, when properly prepared for his task, is infinitely more flexible in responding to unexpected situations than any possible automatic control mechanisms. Clark et al., -

l ff. Tr. 6225, at 5 (Clark); Tr. 6235-38 (Clark).

l 129. The Staff, which takes the same position as Licensee, does not generally require the designs of engineered l \

l 1

1 e l safety feature systems to be such that the operator cannct interrupt the safety function at any time subsequent tt initiation. One rerson is that the safety advantages of an ESF safety function that cannot be prevented by the operator from going to completion must be weighed against the potentially adverse effects or safety that could, under certain circum-stances, result from continued operation of the r,ystem.

Sullivan, ff. Tr. 6602, at 5. Staff witness Sullivan further testified:

Fully automatic safety systems might in theory be designed which neither permit nor require operator intervention. But to do so would require the determination, a priori, of all possible accident sequences to ensure that operational requirements placed on these systems are adequate. We

consider it unlikely that this objective could be achieved and, therefore, such systems.would be susceptible to misopera-tions during events which might not have been postulated. On balance, the staff believes that it is prudent to rely on a well trained operator, provided with I

adequate information, to function as an integral element of a response to an emergency.

Id.; Tr. 6624 (Sullivan).

130. UCS witness Pollard attempts to counter this position by Licensee and the Staff with the observation that considering all the effort that has gone into trying to analyze accident scenarios and develop operator training and proce-dures,48 the likelihood of the operator interfering correctly -

48 Elsewhere, UCS contends that the accident analyses are inadequate for defining (continued next page) operator actions and that the proper

4 in an. unforeseen event is very low. Tr. 6424 (Pollard). Mr.

Pollard also chastises Licensee and the Staff for considering events beyond the design basis to assess the potential safety disadvantages of the automatic interlock system proposed by

UCS. Pollard, ff. Tr. 6410, at 10-19 to 10-21. Mr. Pollard believ9s it is prudent, however, to consider events beyond the design basis for emergency planning or for the development of procedures and training to cope with inadequate core cooling conditions. Tr. 6518-19 (Pollard). We believe that it is prudent, as well, to consider events beyond those included in the design basis before we direct such a serious step as locking the operator out of safety system operation -- a seemingly irreversible path. See Tr. 6235-36, 6349 (Clark).

The Board believes that Licensee witness Clark reached the heart of this part of the dispute when he testified that it is just as impossible to foresee all possible sequences of events and reduce them to operating procedures as it is to foresce all possible sequences of events and reduce them to automatic circuitry. Tr. 6246-47 (Clark). The operator, however, may j adjust and respond appropriately to the new condition. As l

Staff witness Sullivan put it, consideration of the potential for unforeseen events is not speculation, it is engineering.

foresight. Tr. 6642, 46 (Sullivan).

(continued) regime of accidents has not been established for defining the plant design. See former UCS Contentions 8 and 13.

o.

, . _ . . , , . , , . , - . - , + - - - - , . - - - ' ~ ~ * ' ' ^ ' - * ^ * ' ' ' ' ' ' ^ ~ ' ' ' ~ * ' " " ~ ~ ' ' "' ~ ~ ~ ~" ~"

. - - . .- _ - - . =

)

131. The Board decides against UCS Contention No. 10 1 on a multitude of levels. First, the Commission regulation incorporating IEEE Std 279 does not apply to this facility.

Second, the TMI-1 protection system conforms to IEEE Std 279 and the clear language of the standard does not prevent

. operator interference with safety system operation. Third, i

none of the tools of IEEE standard construction advanced by UCS I persuade us that it is necessary or appropriate to extend application of the standard. Fourth, the lesson learned from the TMI-2 accident is not to automate the plant to eliminate the operator's role, but to enhance the operator's under-standing and capability .o cope with the unusual and unexpected. Common sense alone tells us that we should not deny the operator the capability of using his human intelli-gence to cope with something_ unusual. See Tr. 6648 (Sullivan).

Defense-in-depth envisions multiple barriers. UCS Contention ho. 1d have us remove the flexibility attendant to one of the most important barriers -- the control room operators. It is for good reason that none of the nuclear power plants i

licensed by this Commission have a design which meets UCS's construction of 10 C.F.R. S 50.55a(h).49 See, Tr. 6469-70 1

(Pollard); Tr. 6230-31 (Patterson).

49 UCS witness Pollard went so far as to express his view that all operating reactors should be shut down to implement his proposed modification. Tr. 6470 (Pollard). This broad-brush attack on Commission licensing, then, has no unique relevance to the TMI-l' facility. Yet, UCS apparently has not sought generic relief from the Commission or enforcement action against any other facility. Tr. 6471-73 (Pollard).

, _ , , _ _ . - _ - _ . _ . - . _ _ . _ _ _ _ . . _ _ _ _ ~ . - _ _ . - - - _ . _ . _ . _ , . _ . _ . . . .

132. In contrast, intervenor Sho11y's contention is concerned not with the design capability for operator interven-tion, but rather witu providing the operator the correct information and procedural guidance on which to take subsequent actions. The operators at TMI-1 have been provided with specific instructions as to when it is necessary or allowable to intervene and over-ride the automatic operation of the emergency core cooling, containment isolation and emergency feedwater systems. The operators have been adequately trained on these requirements. Clark et al., ff. Tr. 6225, at 7-11 (M.

Ross). See also, Jensen, ff. Tr. 6600. Consequently, the Board finds that the concerns raised in Sholly Contention No. 3 have already been satisfied at TMI-1.

E.

Pressurizer Heaters UCS Contention No. 3: The staff recognizes that pressurizer heaters and associated controls are necessary to maintain natural circulation at hot stand-by conditions. Therefore, this equipment should be classified as " components important to safety" and required to meet all applicable safety-grade design criteria, including but not limited to diversit:- (GDC 22),

seismic and environmental qualification (GDC 2 and 4), automatic initiation (GDC 20), separation and independence (GDC 3 and 22), quality assurance (GDC 1), adequate, reliable on-site power supplies (GDC 17) and the single failure criterion. The staff's

• proposal to connect these heaters to the present on-site emergency power supplies does not provide an equivalent or acceptable level of protection.

95-

,7 ., _ . . . . - . - . . - , , . . , , .<,m., , , , . _ , , . _ _

133. UCS asserts, in its Contention No. 3, that the pressurizer heaters and associated controls are necessary to maintain natural circulation and, therefore, should be clas-sified as important to safety and meet applicable safety-grade design criteria. Based upon the Board's findings on system classification, the inquiry here is whether the pressurizer heaters are r,equired for the critical accident prevention, safe shutdown, and accident consequence mitigation safety functions identified in 10 C.F.R. Part 100. See paragraph 367, infra.

Since portions of the pressurizer heaters form a part of the reactor coolant pressure boundary, the heaters already conform to safety-grade requirements associated with that function (i.e., maintaining the integrity of the boundary). Keaten and Brazill, ff. Tr. 7558, at 17. The remaining tyc questions, then, are whether the pressurizer heaters are necessary to assure: (a) the capability to shut down the reactor and maintain it in a safe shutdown condition; or (b) the capability to prevent or mitigate the consequences of accidents which I

could resu1* in potential off-site exposures comparable to the guideline exposures of 10 C.F.R. Part 100. See paragraph 366, l infra.

134. First, it is appropriate to consider the basic I

l function of the pressurizer heaters. The pressurizer heaters i

are part of the normal control system which regulates primary -

system pressure. When the pressurizer heaters are activated, boiling occurs within the pressurizer, producing steam which i

l

acts to increase reactor system pressure. The reactor system pressure may be reduced by operation of the pressurizer sprays, which condense the steam in the pressurizer. Jensen, ff. Tr.

8712, at 3.

135. The Board has already concluded, in its findings on UCS Contentions 1 and 2 (paragraph 23, supra), that while natural circulation is the normal mode of cooling if the reactor coolant pumps are not available, it is not recuired because reliable means beyond natural circulation (single or

\

two-phase) already exist to remove core decay heat for condi-tions with loss of reactor coolant pumps or following a small-break LOCA.50 See section II.0, infra; Keater. and Brazill, ff. Tr. 7558, at 16. Core cooling can be accomplished by the feed-and-bleed mode utilizing only safety-grade systems and components -- i.e., the borated water storage tank, the high pressure injection system, the pressurizer safety valves, the containment and the low pressure injection system.51 50 UCS witness Pollard testified that there is only one effective method of removing the decay heat at TMI-1 -- i.e.,

circulating water through the reactor, the main coolant i piping, and the steam generator tubes, and transferring i decay heat from the primary to secondary systems through the steam generator tubes. Pollard, ff. Tr. 8182, at 3-1, 3-2.

While it is agreed that this is one effective method Licensee's I witness identified and described a number of others. Tr.

7559-60 (Brazill).

51 UCS witness Pollard, setting forth his position that

• l feed-and-bleed cooling is not an acceptable substitute for l safety-grade pressurizer heaters, characterizes a loss of l off-site power event which challenges the ECCE or the PORV as "a relatively frequent anticipated operational occurrence,"

and as "U routine event." Pollard, ff. Tr. 8182, at 3-14.

(continued next page) l l

. . _ . . , _ _ _ ~, ,_ _ . _ . - _ _ , , _ . . _ _ . . _ , _ . , . . . . , _ . ~ . . , _ . ~ . . _- . - _ _ _ . . . - ._____

Keaten and Brazill, ff. Tr. 7558, at 16; Tr. 7562-65 (Brazill).

i See also, section II.Q (Board Question 6), infra. Conse-quently, it follows that the pressurizer heaters need not be i

i safety-grade because of their role during the natural circula-tion process.

136. While his testimony purports to describe the role of pressurizer heaters in accident mitigation,LUCS witness Pollard performed no evaluation of that role other than to think about their use in the TMI-1 plant procedures and to review Staff " lessons learned" reports. He did not even examine the B&W small-break LOCA analyses to 'detarmine if any credit was taken for the pressurizer heaters. Tr. 8233-36 j (Pollard). In any case,=UCS's own witness does not take the position that the pressurizer heaterr are required to maintain pressure centrc1. In his pre-filed testimony, Mr. Pollard concurs in a statement attributed to the Staff to the effect

( that the availability of pressurizer heaters is "important" to pressure control. Pollard, ff. Tr. 8182, at 3-7. On (continued)

This represents instead, an extremely rare combination of events.

First, there has never bee,n a loss of off-site power at.Three i Mile Island, Tr. 7566 (Brazill), Tr. 8032 (Keaten), and the re-l liability of that system is sufficiently high that such an event is not expected to occur during the lifetime of the plant.

Capodanno et al., ff. Tr. 5642, at 14. Further, Mr. Pollard's scenario presumes: (a) an extended lose of off-site power (i.e.,

no recovery for a long period of time); ( b ,' that the pressurized -

heaters are not manually connected to the diesel generators; and-(c) that the HPI and makeup systems are unavailable to maintain pressure. Tr. 7567 (Brazill).

l l

l cross-examination, Mr. Pollard admitted that natural circulation can work withcut the pressurizer heaters, that one can mitigate a loss-of-coolant accident without the pressurizer heaters, and that the core can be adequately cooled without the pressurizer heaters. Tr. 8238, 43 (Pollard).

137. In fact, credit for operation of the pressurizer heaters is not assumed in the safety analysis of design basis accidents. Jensen, ff. Tr. 8712, at 6; Tr.

8717-18 (Jensen). In addition to the fact that natural circulation is not required, natural circulation cooling, in turn, can be accomplished by maintaining reactor coolant system pressure with two methods in addition to the normal mode of utilizing the pressurizer heaters: (a) solid water operation with the Makeup and Letdown System; or (b) solid water opera-tion with the High Pressure Injection System.52 Keaten and Brazill, ff. Tr. 7558, at 17; Tr. 7923-24 (Brazill).

138. Neither is operation of the pressurizer heaters necessary to sht,down the reactor and maintain it in a safe chutdown condition. Jensen, ff. Tr. 8712, at 4. Consequently, l

i it is clear that the pressurizer heaters -- under the tests set l for determining whether structures, systems, and components must l be safety-Jrade -- are not required to assure the health and safety of the public.53 Nevertheless, they are the normal and 52 This latter method is functionally equivalent to the feed-and-bleed operation, except that the equipment may be operated for pressure control rather than for core t cooling per se. Keaten and Brazill, ff. Tr. 7558, at 17.

53 There are no PWRs licensed to operate in the United States for which the pressurizer heaters are designed (continued next page)

~ - - - - ~ ,,-,,,,y e, >.-n , e.,n. y --- ,m -

r p;ererred equipment for use in reactor coolant system pressure control, so that the Board views as prudent the steps taken to improve the reliability of the power supplies to the heaters.54 See Jensen, ff. Tr. 8712, at 6, 7. For the same reasons we advanced in the disposition of UCS Contention No. 14, the E 2rd rejects the UCS thesis that the Staff is limited to directing that the pressurizer heaters be fully safety-grade, or .'mple-

! menting no improvements whatsoever. See paragraph 370, infra.

F. Connection of Pressurizer Heaters to Diesels UCS Contention No. 4: Rather than classifying the pressurizer heaters as safety-grade, the staff has proposed simply to add the pressurizer heaters to the on-site emergency power supplies. It hac not been demonstrated that this will not degrade the capacity, capability and reliability of these power supplies in violation of GDC 17 Such a demonstration is required to assure protection of public health and safety.

l 139. Licensee has made provision, in accordance with short-term No. 8 of the Commission's Augus*. 9, 1979 Order and Item No. 2.1.1 of Table B-1 of NUREG-0578 referenced therein, l

(continued) to safety-grade criteria. Tr. 8229 (Pollard). Yet, UCS has sought from the Commission no enforcement action or generic relief as to other plants with respect to the upgrading of pressurizer heaters. Tr. 8231 (Pollard). ,

54 Whether or not this modification may in fact detract from safety is the subject of UCS Contention 4. See section II.F, infra.

l l -100-l

- , ~ - - , , -.----n--m- - - , - - , . , -- -,,m,- e ._ -w

~

1 to enable Licentde to connect either of two groups of non-safety-grade pressurizer heaters to the plant's emergency power supply in the event of a loss of off-site power. UCS's l

principal claim is that Licensee's design does not melt the single failure criterion of General Design Criteria 17 govern-ing the design of the on-site power supply.

140. UCS postulates several scenarios under which it 4

claims the single failure criterion is not met. Each of the scenarios postulates the failure of one of the two safety-grade emergency diesels. Each scenario also postulates a fault in the pressurizer heater connected to the other diesel, the failure of the pressurizer heater circuit breakers to tripfthe ~

pressurizer heater load, the consequent trip of the main breaker of the 480 volt safety bus to which the pressurizer 1

heater load is connected, and therefore the loss, at least i

temporarily, of power to safety-related equipment connected to the same bus. Pallard, ff. Tr. 9607, at 4-3, 4-4; Tr. 9333-37 (Torcivia), 9675-76 (Pollard).

141. It is UCS's position that these scenarios involve the failure of only one piece of safety-grade equipment (one of the diesels) and that the single failure requirements of GDC 17 are therefore not met. Licensee and the Staff disagree. Before addressing this diupute further, we examine first the physical arrangements for connecting the pressurizer -

heaters to the emergency power supply and the protection provided by Licensee against the propagation of a pressurizer heater fault.

-101-

. . . - - g y_ 9--., --.r - p.n, _.

7, ,, . y p. ,e, , , , , - ,y. , . . - , -,.e,....r., , , , , ,.,,. _.,w..., w.-

142. In the event of a loss of off-site power either of two pressurizer heater groups can be connected to the emergency power supply. Pressurizer heater group 8 can be connected to a 480 volt emergency bus IP which is in turn supplied power from diesel A. Similarly, pressurizer heater group 9 can be connected to a 480 volt emergency bus 15, which receives its-power from diesel B. Administrative procedures prohibit the simultaneous connection of both pressurizer heater loads. Torcivia and Shipper, ff. Tr. 9098, at 2-4,. Fig. 1.

143. Two circuit breakers are provided between each pressurizer heater group and the main breaker of the 480 volt bus to whica it is connected to assure isolation of the pressu-rizer heater from the bus and to prevent actuation of a main bus breaker in the event of a fault in the pressurizer heater.

The first circuit breaker downstream of the main bus breaker is denominated the " main feeder breaker." A second circuit breaker downstream of both the main bus breaker and the'nain feeder breaker is denominated the " distribution breaker."

Torcivia and Shipper, ff. Tr. 9098, at 4, 5, Fig. 1; Tr. 9101-02 (Torcivia).

144. The distribution breaker, i.e., the breaker closest to the pressurizer heaters, is designed and set to trip in the event of a fault current in the range of 900 to 1100 i

amps. The breaker trip would occur in approximately 0.2

• i seconds or less. Tr. 9104 (Torcivia).

145. The main feeder breaker is designed and set to trip on three different signals:

-102-

,v -----e-- - - ,-- * - - - - - . , - ,,,.,,.,,-.,,-.,w-,y r --- , , ,, - . --w,,,-w ,.ww ,,,w -,..,,e.,.w,--,,,. , w-,-.-,.,7-y---- ---gy.- e- ->m,.------. -,..--..---e. s ---. w &

1. An overcurrent or fault current in excess of 1250 amps.- A current of this magnitude would trip the main feeder breaker in approximately i

0.2 seconds. Tr. 9104 (Torcivia).

2. Undervoltage occurring as a result of a major fault in the pressurizer heater. Licensee has not decided the exact trip setting for this breaker but the setting will be in the neigh-borhood of 430 volts with a 1 1/5 second time delay. Tr. 9425-26 (Torcivia). At this setting-a fault approaching the size of a " bolted" fault (4000 amps) would produce an undervoltage low enough and long enough in duration to trip the main feeder breaker. Tr. 9489-91 (Torcivia).

Thus for major faults the undervoltage trip is a backup to the overcurrent trip.

3. Any of the three ES signals which actuate the engineered safeguards systems, _f.e., two signals based on low reactor coolant pressure (1600 pounds and 400 pounds) and one signal based on high reactor building pressure (4 pounds). Torcivia and Shipper, ff. Tr, 9098, at l

4, as corrected at Tr. 9427-29 (Shipper).

146. In contrast to the distribution and main feeder '

breakers, the main bus breaker would trip only at overeurrents in excess of 1250 amps and then only after a lapse of up to 15.

-103-

..~9 - . , - -+-.,_3 _y -,y, . , , .. ..,,g. ,..,__,.,..-,___,y., -,,__ ,, .m.,y,_ m. , ,,. ,-y,,..,,,._.....,,e._w ,

seconds. A trip of either the distribution or main feeder breaker within this time period would cut off the fault current to the main bus breaker and thus prevent a trip of that breaker. Tr. 9104-06 (Torcivia).

147. The principal dispute between UCS on the one hand and Licensee and the Staff on the other boils down to whether Licensee's circuit breakers for the isolation of a fault in-the pressurizer heaters conform to NRC requirements and, more particularly, whether one or both circuit breakers l should be considered cafety-grade. Tf so, the scenarios postulated by UCS would involve at least two failures of safety-grade equipment (one safety-grade diesel and a safety-grade circuit breaker) rather than the single failure pro-scribed by GDC 17.

148. Licensee testified that the main feeder breaker is fully safety-grade and that the distribution breaker is also fully safety-grade except for being situated in a structure that has not been seismically qualified. Tr. 9111-12, 9121-22 l (Torcivia). UCS did not challenge Licensee's testimony except l

to argue (1) that Licensee is required under NUREG-0578, referenced in the Commission's August 9, 1979 Order, to meet the requirements of Regulatory Guide 1.75, (2) that Licensee does not meet the requirements of Regulatory Guide 1.75, and (3) that an isolation device not meeting the requirements of -

Regulatory Guide 1.75 cannot be considered to be safety-grade.

Pollard, ff. Tr. 9607, at 4-5 to 4-10; Tr. 9610-18, 9641-45 l

-104-l I

I

,---.--,,,-----,,,,..,y .,-.-_._,m-, . , ~ , , _ . , _ , , _ , _ _ .,.--.,,__,,y--.we,,-,, , . , _ e ,, , __ . , , , , , . _ . , , , , , - , .

. ~ .--.._y

(Pollard). Since we conclude below that Licensee does meet the requirements of Regulatory Guide 1.75, it is not necessary for the Board to pass on the merits of UCS's first and third legal propositions.

149. Regulatory Guide 1.75 prohibits reliance on breakers which rely solely on a fault current or its effects, but recognizes that the addition of other isolation signals may wake the breaker acceptable. The pertinent sentence of Section C.1 of the Guide reads in its entiraty as follows:

Breakers that trip on receipt of a signal other than one derived from the fault current or its effects (e.g., an accident signal) are accept-able since the downstream circuits would already be isolated from their respective power sources under accident conditions and could pose no threat to these sources.

UCS acknowledges that there are isolation signals in addition to the overcurrent signal which would trip the TMI-l main feeder breaker, i.e., undervoltage and ES signals. UCS argues, however, that no credit can be taken for the undervoltage trip because undervoltage is itself an "effect" of the fault l

current. Pollard, ff. Tr. 9607, at 4-7; Tr. 9612 (Pollard).

l It argues further that the ES signal cannot be counted upon in certain scenarios, i.e., scenarios in which the pressurizer i

heater fault occurs after the ES signal has already tripped the main feeder breaker and the pressurizer hcater is thereafter connected to the emergency power supply after the ES signal is -

no longer present or has been deliberately bypassed by the operator. In effect, UCS reads into Regulatory Guide 1.75 a

-105-l

l

\

)

i requirement (nowhere expressed in the guide) than an accident j signal is an acceptable isolation signal only if the breaker '

cannot thereafter be closed by operator action. Tr. 9626, 9672-78 (Pollard).

150. As to the acceptability of undervoltage trips, generally, the Staff witness pointed out that undervoltage is not a consequence of the fault current but of the fault itself, and is not an "effect" of a fault current within the meaning of Regulatory Guide 1.75. Tr. 9707-08, 9725-31, 9784-86 (Fitzpatrick). In the particular case of TMI-1, however, the Staff did not rely on the undervoltage trip in reviewing the acceptability-of the main feeder breaker. As noted above, testimony by Licensee and the Staff established that an undervoltage trip would only occur in the case of a large fault; lesser faults would not drop the voltage low enough or-for a long enough period to trip the main feeder breaker. The Staff testified that for this reason it did not in fact give Licensee any credit for the undervoltage trip in assessing the adequacy of Licensee's isolation devices, although noting at the same time that the undervoltage trip added a plus to the devices not pre.9ent in other B&W J icensed operating reactors.

Tr. 9731-33, 9785-86 (Fitzpatrick).

151. Instead, the Staff relied on the addition of the ES signal to trip the main feeder breaker as satisfying the .

requirements of Regulatory Guide 1.75. The Staff explained that the critical purpose of Regulatory Guide 1.75 in requiring

-106-

-. . _ . y , , , , . , , . . _ . . _ _ _ - - - - - ., , . - . - , . . . _ - , . . , - ~ _ . .,

j a second isolation signal was to assure that during the initial critical phase of an accident there be no possible interference.

with the loading of the essential safety systems on the emer-gency power supply. It has been Staff policy, in accordance with its interpretation of Regulatory Guide 1.75, to allow the connection of other non-safety loads to the' emergency power supply once accident conditions have been stabilized, even though such non-safety loads would be isolated in the event of a fault only by. properly coordinated overcurrent circuit breakers. Tr. 9701-03, 9710, 9770-74 (Fitzpatrick).

152. We accept the Staff's testimony as the official NRC interpretation of Regulatory' Guide 1.75.' The Board notes in this connection that neither the Commission's August 9, 1979 Order nor NUREG-0578 to which it referred contained any refer-ence to Regulatory Guide 1.75. The reference to Regulatory Guide 1.75 was subsequently added by the Staff as a "clarifica-tion" of NUREG-0578 and subsequently incorporated into its.

Action Plan and in NUREG-0737. The only reasonable conclusion is that the reference to Regulatory Guide 1.75 was intended as 4

a reference to that Guide as currently interpreted and applied by the Staff. Further, the Staff's interpretation of Regula-tory Guide 1.75 is reinforced by the Staff's testimony as to actual regulatory prectice. Thus the Staff has approved pres-surizer heater connections for other reactors which rely on the ~

same combination of overcurrent and ES trip signals as TMI-1.

Tr. 9759-61, 9784-85 (Fitzpatrick). The Staff has also 1

-107-

-, e-.-+--+ y,.,e. ,,-,--,...g.,r--3 -,y+<, .....y ,,,,- ,, -w +y --y w.-, , . , _ , ..r+r+-e,--,,,,,-..-----,--=-,4---m,--.----,,.-,e--y,-,,--, ,,r.%-. -,-

,v.- ---

followed the practice of allowing the reconnection of other non-safety loads which have been tripped by an E.* signal, once reactor conditions have stabilized, where the loads have only overcurrent isolation devices. Tr. 9771 (Fitzpatrick).

153. Deciding the proper interpretation of Regulatory Guide 1.75 does not, however, end the Board's broader responsibilities. We have therefore made our own assessment of the adequacy of the isolation devices in ques-tion. The following are among the considerations that 1-Jad the Board to conclude that Licensee's design is satisfactory:

A. There are two c_dundant circuit breakers (the main feeder breaker and the distribution breaker) which would isolate the pressurizer heater group in the event of a fault. Both are safety-grade, except for the location of the distribution breaker in a non-seismically qualified structure.

B. The trip points on the distribution and main feeder breakers are set far below the trip point on the i main bus breaker, especially as to the time setting of the 1

l breakers. As previously stated, the distribution and main feeder breakers are set to trip within approximately 0.2 seconds, while the main bus breaker would not trip for up to 15 seconds and would not trip at all upon the opening of the downstream breakers. Licensee's witness Torcivia expressed i

great confidence in the reliability of the coordination between the main feeder breaker and main bus breaker with settings so 1

far apart. Tr. 9601 (Torcivia). The breakers conform fully to

-108-

~

the requirements of IEEE-384 (1977). Further, there are no commercially available circuit breakers which do not rely on a fault current or its effects as the tripping mechanism.

Tr. 9113-17 (Torcivia).

C. Regulatory Guide 1.75 recognizes that proper coordination between the distribution and main feeder breakers with the main bus breaker would preclude tripping of the main bus breaker and gives as its only reason for adding another isolation signal tne possibility tnat "because the main breakers are in series with the fault and could experience momentary currents above their setpoints, it is prudent to preclude the use of interrupting devices actuated only by fault current." (Regulatory Gdide 1.75, Rev. 2, Section C.1-Basis.)

UCS witness Pollard's attack on Licensee's isolation device

, rested only on his literal application of Regulatory Guide 1.75 i

I without any technical discussion of the adequacy of Licensee's specific design to prevent " momentary" fault currents from tripping the main bus breaker. When asked for his technical, rather than legalistic, assessment of the isolation devices, i

Pollard was able only to refer in generalities to instances at other plants, where, despite an attempt to have proper breaker coordination, a fault subsequently resulted in tripping the

" equivalent of the main breaker." Tr. 9652 (Pollard). He was able to provide only a single example and was unable even as to .

that example to give any indication of the margin between the setting of the main breaker and of the downstream breaker.

Tr. 9654 (Pollard).

-109-

-y *- - , - , - > - - . , -- - --,,m - - - , , _ , , - , - -~r.-- -

,.--.-,-- r

D. Finally, the Board believes that substan-1 tial additional protection is provided by the undervoltage trip on the main feeder breaker in a circumstance which has been of particular concern to the Board, namely a loss of off-site power and the failure of one-of the diesel generators to start.

In that case a fault in the pressurizer heater connected to the other diesel, if followed by a failure of both isolation breakers and therefore the tripping of the main bus breaker would result in loss of the emergency bus. However, in that situation the undervoltage trip on the main feeder breaker would immediately isolate the pressurizer heater due to lack of voltage. The main bus breaker could therefore be'reclosed by resetting the switch at the breaker and then turning a switch in the control room. This would result in the immediate rest'> ration of emergency power supply to the emergency bus while the pressurizer heater remained isolated. Tr. 9106-07, 9681-88 (Torcivia), as corrected by stipulation ff. Tr. 21,099.

154. In addition to its claim that connection of the pressurizer heaters to the on-site emergency power supply violates the single failure criterion of GDC 17, UCS advanced two other complaints about the arrangements for the connection.

l 155. UCS's first complaint, which it did not seriously pursue in cross-examination or otherwise, was that Licensee relies upon operator action rather than automatic -

controls both to connect up the pressurizer heaters and to disconnect other loads if that should become necessary to I

-110-4 m

, 4 - -_,. , . , , - , - - , , , - - - , _ , , , . . . _ - - . - - - - - - - , - , , - .- - -

prevent overloading of the diesel. Pollard, ff. TI- 9607, at 4-10 to 4-11. In view of the fact that pressurizer heaters would not be needed for at least two hours alcer a loss of off-site power and that Licensee has well-defined procedures for transferring the pressurizer heaters from normal' power supply to the emurgency power supply, we find that reliance on operator action is entirely appropriate. Tr. 7565-66 l

l (Brazill); Torcivia and Shipper, ff. Tr. 9098, at 3, 4. UCS cited no regulatory guides or industry design practices to support its position, except GDC 20. Pollard, ff. Tr. 9607, at 4-10. GDC 20, however, refers only to automatic initiation of reactor protection systems and'has no bearing on UCS's cont ~en-tion.

156. UCS's second complaint is that Licensee has not 1

performed " qualification tests" to demonstrate the reliability and capability of the diesels to carry the additional load represented by the pressurizer heaters. Pollard, ff. Tr. 9607, at 4-11 to 4-12. UCS did not question I-icensee's testimony ,

l that each diesel has a rated capacity of 3,000 KW, that at the time of purchase the diesels had been properly qualified at this rating, and that the diesels had been tested at their rated capacity on a monthly basis during the operation of

.aI-1. Tr. 9130 (Torcivia). Instead, UCS claims that proper qualification of the diesels requires that a " reliability goal" .

be established and that tests then be performed to determine that the reliability goal has been met. Pollard, ff. Tr. 9607, l

1

-111-l l

-_ _ _ . _ _ - _ _ _ - _ _ . . _ . . . _ . ~ . . . . _ _ _ _ . . - . _. _..,--___. _ _-.~._-_ _ _ . _ . _ _ - -

. - _ _ . - . - . . = . = . - . - - -- - .

4 at 4-11. . Again UCS cited no regulatory requirements or 1

i industry practice in support of its thesis and presented no testimony other than Pollard's unsupported conclusions.

157. At the request of the Board, Licensee presented i testimony on the loading ~ sequence and cumulative load on a diesel generator (assuming only one diesel generator to be l available) in the. case of a loss of off-site power only and in the case of a loss of off-site power accompanied-by a small break LOCA. This testimony demonstrated that a single diesel generator has sufficient capacity to accommodate connection of the pressurizer heater lead in addition to all safety-related loads required in each of the two cases and remain within its 1

original qualified rating. Hartman and Torcivia, ff.

L Tr. 16,493, at 1-7.

158. It is, of course, physically possible to add additional non-safety-related loads to the diesel to the point where the subsequent connection of the pressurizer heaters would add enough load to exceed the rated capacity of the diesel. Licensee's cporating procedures therefore prohibit j connection of the pressurizer heaters until other loads have i been reduced, if necessary, to the point where overloading ,

would not occur. .Torcivia and Shipper, ff. Tr. 9098, at 4; Tr. 9122-24 (Torcivia),

159. The Board is satisfied that the connection of

• the pressurizer heater load will not degrade the capacity or capability (as required by GDC 17) nor the reliability of the i diesels.

i

-112-9

,_...,,..m._. . . - - , ---~~ - - --- - - - - - - - - - - - -~

I G. Valves i

UCS Contention No. 5: Proper operation o'f power operated relief valves, (PORV's) associated block valves and the instruments and controls of these valves is essential 4

to mitigate the consequences of acci-4 dents. In addition, their failure can cause or aggravate a LOCA. There-fore, these valves must be-classified as components important to safety and required to meet all safety-grade design criteria.

160. UCS asserts, in its contention No. 5, that the pressurizer power operated relief valve ("PORV"), its associated block valve,55 instruments and controls should be modified to meet all safety-grade design criteria. The PORV i

and two safety valves are connected to the top of the pres-surizer. See Lic. Ex. 17. If reactor coolant system pressure increases to their respective setpoints, the PORV and the safety valves are designed to open, thereby releasing steam J

and/or water from the reactor coolant system and limiting further pressure increase. When reactor coolant system pressure decreases below their respective setpoints, the PORV and safety valves are designed to reclose.56 The PORV is l

l 55 UCS Contention No. 5 refers to PORV block " valves,"

whereas there is only one block valve. UCS witness Pollard,

• in his pre-filed testimony on UCS Contention No. 5, occasionally i referred to the pressurizer safety " valve," whereas there l are two such valves. Pollard, ff. Tr. 9027, corrected at l Tr. 9022-23 (Pollard).

56 The safety valves actually are expected to close at a pressure lower than their opening setpoint. Tr. 8750 (Urquhart);

Tr. 8864 (Zudans).

l

-113-

electrically controlled by an actuation signal derived from a t measurement of reactor coolant system pressure.57 The safety valves are opened by reactor coolant system pressure acting directly on the valves, dollard, ff. Tr. 9027, at 5-2, 5-3; Tr. 8917-18 (Zudans); Tr. 8933 (Correa); Tr. 9013 (Urquhart).

Tha safety valves are set to open at 2500 psig. Pollard, ff.

Tr. 9027, at 5-3.

161. The original design function of the PORV was to provide a pressure relief capability which, in conjunction with plant control system actions to reduce reactor power and/or adjust steam generator feedwater flow, would prevent a reactor trip on high primary system pressure during various operational transients.58 In this manner, unit availability would be enhanced. The relief capability of the PGRV was not designed to fulfill a safety function. The high pressure trip function of the Reactor Protection System and the pressurizer safety valves provide the required over-pressure protection for the reactor coolant system. The Reactor Protection Syrtem and the pressurizer safety valves are safety-grade equipm.ent. Correa et al., ff. Tr. 8746, at 2, 3 (Jones).

57 A manual key lock switch, which is administrative 1y controlled, provides for remote manual operation'of the valve.

The PORV cannot be operated independently of its control system. Tr. 8764-66 (Correa).

58 The chief transient the plant was designed to handle without a recctor trip was a turbine trip. A direct, anticipatory reactor trip on turbine trip has now been installed at TMI-1, as recommended in the Commission's Order l and Notice of Hearing. Tr. 8773-74 (Jones); Staff Ex. 1 at l

Cl-12, C2-12'to C2-14.

-114-

162. UCS witness Polla: d reported, in his pre-filed testimony:

There is a history of relief and safety valve failures in operating plants. The failures experienced have included opening below the set point, not opening at the set point, and not reclosing after pressure has decreased below the opening set point. (See NifREG-0578, p. A-7).

Pollard, ff. Tr. 9027, at 5-3. Later it is stated that "[b]oth relief and safety valves have an alarming history of failing to reclose." Id,. at 5-4. Elsewhere, Mr. Pollard refers to "the relatively high probacility of PORV failure," id. at 5-6, and to "the history of PORVs failing to reclose." 13. at 5-12.

163. While there have been occasiens when the

pressurizer safety valves have opened below their setpoint, this is not a valve failure. A failure of the valve would be not performing its overpressure protection function -- to open and relieve the system overpressure. Tr. 8748-49 (Urquhart).

There have been no instances identified where the safety valve, when called upon, has opened at a pressure exceeding the setpoint, or where it has not reclosed after pressure has decreased below the design tolerance for closing (which is somewhat below the opening setpoint; see n.56, supra). Tr.

8749-50 (Urquhart). See Tr. 8851 (Zudans) (no occurrences where safety valve did not perform its function of overpressure protection). Consequently, there is no reliable evidence to support the UCS representation that there is any history, let alone an " alarming" one, of safety valve failures in operating plants.

-115-V

._-.-._.,-a ~ . . ~ , _ - .--- .--. _

4 t

164. Licensee's witness has reviewed the actual i

history of PORV failures. On Babcock & Wilcox operating plants, there have been three instances when the plant was at '

power when the POK*.' has failed to reclose. Considering the number of times the PORV has been actuated at power, this should not be considered to be an alarming history of failure.59 As to Dresser manufactured PORVs, which is the i

i design of the PORV at TMI-1, the last failure-to-close incident prior to the TMI-2 accident was in November, 1975, although t

there were in excess of 60 actuations during the intervening

, time period. Tr. 8751-52 (Urquhart). The NRC Staff has also examined the failure rates of PORVs in the operating history of B&W plants, and reported 9 failures out of 300 challenges, with '

a number of these during plant startup and testing-(not at power). Tr. 8831-32 (Jensen).

165. The opening of the PORV and its failure to reclose were key factors in the TMI-2 accident. In addition,.

for several hours t'1e operator failed to detect the open PORV and terminate the loss-of-coolant accident by closing the block valve.60 As a result of these events, the Commission l 59 While UCS witness Pollard referred to NUREG-0578, his

! pre-filed testimony includes no discussion of or citation to operating data to support his statements on *.he history of valve failures. NUREG-0565 was cited, during cross-examination, in cupport of this testimony. Yet, of the I ten instances reported there of PORV failures to close

• at B&W plants, six instances were at preoperational p'ower levels, one was at hot standby, one at 9% power, one at 12% power, and one at 97%. power. Tr. 9038-59 (Pollard);

Board Ex. 4 at 3-1 (Table 3-1). -

l 60 The PORV block valve worked properly when control was exetcised by the operator, however, and it was cycled (continued next page) l .

-116-

1 generically has directed that certain improvements or upgrading  !

be made to the PORV, the block valve and the instrumentation and controls for these valves.61 Pollard, ff. Tr. 9027, at 5-1.

166. Since the TMI-2 accident the setpoints for PORV actuation and high pressure reactor trip have been inverted.

In the original design and operation of TMI-1, the opening pressure for the PORV was 2255 psig and the high pressure reactor trip setpoint was 2355 psig. These setpoints are now 2450 psig and 2300 psig, respectively. As a result, actuation of the PORV is not now expected during operational transients provided that main or emergency feedwater is delivered to the steam generators in a timely manner. Thus, the frequency of PORV actuation has been reduced. Correa et al., ff. Tr. 8746, at 3 (Jones). In fact, the Staff has concluded that this l change significantly reduces the likelihood of automatic PORV actuation. Staff Ex. 1 at C2-11.

167. UCS witness Pollard argued that this setpoint change directed by IE Bulletin 79-05B, coupled with the l

l statement in the Bulletin that the changes should not result in increased frequency of pressurizer safety valve operation for I

(continued) several times during the TMI-2 accident. Tr. 5406-10 (Johnston). ,

61 At TMI-1, the PORV and block valve were already sup-plied by the emergency power system. See paragraph 171, infra.

i

-117-l I

L

I anticipated transients, "

. . . reflects a basic recognition of the inherent unreliability (or inadequate qualification) of the valves shown through a history of valve failure." Pollard, ff.

Tr. 9027, at 5-9. This conclusion, which appears to be '

attributed to those responsible for the. modification, actually belongs to witness Pollard alone. The setpoint changes,

, directed by the NRC Staff shortly after the TMI-2 accident, were made to reduce the frequency of actuation of the PORV as a 4

prudent measure because it had stuck open during the TMI-2 i accident. It was . based upon any study or analysis which concluded that the PORV was an unreliable valve. Tr. 8753-54 (Jones). Neither was the change instituted because of any concern with the reliability or qualification of the safety valves. It was desired, however, to provide additional defense j in depth, and to provide an additional buffer to the safety valve setpoint -- in order to avoid challenges to a safety system, a goal UCS appears to support.62 Tr. 8754-55 (Jones).

168. The PORV in fully qualified (i.e., to GDC 1, 14, 15 and 30) as a reactor coolant system presaure boundary device. Tr. 8770, 8779, 8805-06 (Urquhart). There are still circumstances, however, where the PORV can be actuated and

potentially remain open, creating or aggravating 3 l

62 It is more desirable to open the PORV than the safety valves since the PORV is provided.with an upstream block valve to isolate the PORV in the event that the PORV fails to reseat, whereas safety valves do not have an isolating block valve. Jensen, ff. Tr. 8821, at 3; Tr. 8976 (Jones).

l 1

-118-l

.pe.y 4m. w *-pa9 r f 49 *'"'W~

loss-of-coolant accident, as asserted in UCS Contention No. 5.

Correa et al., ff. Tr. 8746, at 3 (Jones); Jensen, ff. Tr.

8821, at 4. UCS witness Pollard, on this point, stated as follows in his pre-filed testimony:

The Staff has previously. acknowledged that the probability of failure of the PORV in the open position " contribute (s] signifi-cantly to the probability of a small break LOCA." (NUREG-0565, p. 3-7). Thus, the relatively high probability of PORV failure is a significant contributor to the risk of a LOCA. Met Ed has taken no exception to this observation.

Pollard ff. 9027, at 5-6 (footnote omitted, which cites to Licensee's September 2, 1980 response to UCS's letter of August 19, 1980, as support for the last sentence).63 First, the statement in NUREG-0565 is irrelevant teday, and when Mr.

Pollard pre-filed his testimony, to an assessment of the probability of PORV failure because the statement was directed at the valve experience prior to the TMI-2 accident and the change in setpoints. Tr. 8752-53 (Jones). Second, on cross-examination Mr. Pollard acknowledged tnat the Licensee document cited in support of Met Ed's tacit agreement could be interpreted only to concede that UCS had accurately quoted the Staff. Tr. 9055-56 (Pollard). Licensee's witness testified that the probability of PORV failure now would not contribute 63 The phrase "this observation" was clarified during j cross-examination to refer only to the first sentence (the Staff statement) and not to the second sentence (witness Pollard's statement). Tr. 9053-55 (Pollard).

-119-1 -

I - . . - , , - - - - - - - - - - - - - ~ ~~ ~~

significan"ly to the probability of a small-break LOCA. Tr.

8752-53 (Jones).

169. In any case, analyses have been performed to I

demonstrate that these transients (stuck open PORV) can be safely mitigated (as defined by 10 C.F.R..S50.46) with the Emergency Core Cooling System. These analyses included both a stuck-open PORV case (i.e., the PORV causes a LOCA), and a scenario in which a small-break LOCA occurs simultaneously with a loss of all feedwater and results in a subsequent stuck-open PORV (i.e., the PORV aggravates a LOCA).64 See paragraphe 347, 348 and 353, infra. Correa et al., ff. Tr. 8746, at 3 (Jones);

Jensen, ff. Tr. 8821, at 4, 5. In addition, the B&W small-break LOCA analyses do not rely on the PORV'or its block valve to mitigate the accident. Jones and Broughton, ff. Tr.

5039, at 14; Tr. 5254-55 (Jones). Consequently, proper operation of the PORV, its associated block valve, instruments and controls is not required to mitigate the consequences of any design basis accidents. Jensen, ff. Tr. 8821, at 3.

l 170. Nevertheless, there have been several changes made at TMI-l to enhance the operator's ability to recognize and terminate a transient caused by a stuck-open PORV.

! 64 In the event that the PORV were to open inadvertently following a small break in the primary system piping, the effect on the reactor. system would be equivalent to increasing The effect of an increase in break size the break size. ~

would fall within the spectrum of small-break sizes already analyzed for TMI-1. Jensen, ff. Tr. 8821, at 4.

-120-i

Specifically, an accelerometer which senses discharge line flow and discharge line flow measurement instrumentation are being provided. These, along with PORV position demand indication and PORY discharge line temperature measurement, will pecvide additional assurance that PORV position wi31 be recognized.

4 Correa et al., ff. Tr. 8746, at 3, 4 (Jones). -See also, Staff

Ex. 1 at C8-ll to C8-14; Staff Ex. 14 at 26, 27. Thus, a

stuck-open PORV accident would be terminated by closure of the block valve, which is an immediate a.chion to be taken by the operator in the event of a small-break LOCA. Even if the block valve were not isolated, as discussed above the capability of

che HPI system is sufficient to permit safe shutdown of the .

reactor with no core uncovery or core damage. Jensen, ff. Tr.

8821, at 4.

171. The PORV and block valve have power supplied by

the emergency power system. Correa et al., ff. Tr. 8746, at 4 (Jones); Staff Ex. 14 at 24. This provides the capability for

! closing the block valve upstream of the PORV in the event of a l stuck-open PORV and loss of off-site power. Correa et al., ff.  ;

Tr. 8746, at 4 (Jones). The PORV is designed to close upon loss of power. Tr. 8765, 69 (correa).

172. The Stati states that the post-TMI-2 accident l modifications to the PORV and block valve are intended to

) reduce the. number of challenges to tne emergency core cooling .

system and the safety valves during operation, noting that repeated unnecessary challenges to these systems are undesir-able. Jensen, ff. Tr. 8821, at 5. UCS witness Pollard

-121-

{ '

, +

A

- . . = , , .. , , . . . . , - - - , - . . - . ~ - _ - _ . - - , , - . . , . . - - , . - - - , , - . . , , , . , . . . , - , . - , . , , - . - . . . , - . . , - . _ - , . - - . , . - - - .

l concludes that the ordered improvements are necessary, but not sufficient to provide adequate protection for the public.

Pollard, ff. Tr. 9027, at 5-1. He bases this conclusion on, among other things, his opinion that the goal of reducing challenges to the ECCS is, in itself, important to safety. Id.

at 5-12. While everyone appears to agre= chat it is desirable to avoid unnecessary challenges to the ECCS, this appears to be an operational concern rather than a safety concern. Plants are designed to have a given number of safety equipment actuations, including some which may be inadvertent. As long as-the number of design cycles for the ECCS is not exceeded, there is no violation of any safety limits. There are,.in fact, no regulatory criteria on how often safety systems may be challenged. Tr. 8756-59 (Jones).

173. UCS witness Pollard asserts, as another reason for upgrading the PORV and block valve to safety-grade, that during low temperature operation (such as start-up, shutdown, i

and recovery from accidents) the PORV performs a safety function -- i.e., protection against overpressuring the reactor vessel. Pollard, ff. Tr. 9027, at 5-10, 5-11. While the PORV

is set at a low pressure setpoint when in low temperature operation, the licensing basis for mitigating transients in l

this rcie was operator action -- i.e., that there is more than ten minutes available for the operator to terminate an over-

• pressure transient at low temperatures. The PORV serves only as a back-up to th'e operator action, and its use was not given credit as a licensing basis for TMI-1. Tr. 8756 (Jones).

-122-

i 174. Mr. Pollard also argues that the " bleeding" function in the feed and bleed coolina mode is a safety function, and that "[w]hile it may be true that the safety valves can be relied on during bleed and feed, their use has significant disadvantages compared to-use of the PORV," so that the POhV should be safety-grade. Pollard, ff. Tr. 9027, at i 5-15, 5-16.

While Licensee will use the PORV for feed and bleed cooling if it is available, reliance is placed on the safety valves only. The analyses'that have been performed to demonstrate the capability of feed and bleed cooling have been done using the safety valves only, which are safety-grade, and not the PORV. Tr. 8761 (Jones). See also, paragraph 14, supra. As the Board has already found, the test for deter-mining what systems and components must be designed to meet safety-grade criteria is not one of availability or operator prefarence, but whether the system or component is required (in the sense that its unavailability is unacceptable) for specific critical safety functions. See paragraphs 369 and 373, infra.

It is the pressurizer safety valves which perform the critical safety function during feed and bleed cooling. The PORV is not required.

1753 Finally, UCS witness Pollard. states that use of the PORV to depressurize the reactor coolant system ander inadequate core cooling conditions is a safety function for wnich no alternative using safety-grade equipment is available.

Pollard, ff. Tr. 9027, at 5-17. While the PORV is an

-123-

additional means for depressurizing the plant, it is much less significant than the method of depressurizing with the opera-tive steam generator. Tr. 8761-62 (Jones). In any case, procedures for inadequate cooling conditions address events  !

l beyond the design basis of the plant. Because adequate l measures have been taken to avoid such events, the PORV must be I considered to be an advantageous tool which is not required.

See Tr. 8762-63 (Jones).

176. The pressurizer PORV and its block valve are not designed to meet safety-grade criteria at any pressurized water reactor licensed to operate in the United States.

Consequently, UCS Contention No. 5 applies generally to all PWRs, and the UCS witness proposes that they all be shut down to accomplish the requisite design upgrade.65 Tr. 90'50 (Pollard). Contrary to the contention, however, proper operation of the PORV and associated block valve, and the instrumenta and controls for these valves is not required to mitigate tbe consequences of design basis LOCAs and, although the failure of the PORV can create or aggravate a LOCA, the consequences of such an accident can be safely mitigated by safety-grade equipment. See Correa et al., ff. Tr. 8746, at 4 65 Mr. Pollard has given little attention to the question of what it would take to re-design the TMI-l PORV and block valve to meet safety-grade criteria.

(Pollard). We nato, in addition, thatSee Tr. 9068-72 he could identify nc single failure which would cause the existing PORV to fail open and prevent the existing blocx valve from being closed. Tr. 9047 (Pollard).

-124-

(Jones). Tl:e Board finds, therefore, that the PORV and its block valve should not be required to meet all safety-grade design criteria, except for those applicable to their role as a part of the reactor coolant system pressure boundary:. The Board also finds that the NRC-imposed requirements for the PORV and block valve are both necessary and sufficient to provide reasonable assurance that the public health and safety will not be endangered by the operation of TMI-1.

H. Integrated Control System Sholly Contention No. 6(a): It is contended that the short-term actions identified in the Commission's Order and Notice of Hearing dated 9 August 1979 are insufficient to provide the requisite reasonable ac-surance of operation without endanger-ing public health and safety because they do not include the following items:

a. Completion of a failure mode and effects analysis (FMEA) of the Integrated Control System.

177. The Commission, in its August 9, 1979 Order and Notice of Hearing in this matter and in its confirmatory shut-down orders issued to all licensees owning B&W reactors, re-quired as a long-term action the submittal of a failure modes .

and effects analysis ("FMEA") of the integrated control system

("ICS") to the NRC Staff as soon as practicable. Ross, ff. Tr.

15,855, at 3; 10 N.R.C. 141, 145 (1979).

-125-l .

178. Sholly Contention No. 6(a), on its face, would require the completion of the'FMEA prior to restart of the unit (i.e., as a short-term 3ction). As we discuss in paragraph

{

184, infra, B&W's report, ' Integrated Contro1' System {

Reliability Analysis" (Lic. Ex. 18), a portion of which consists of a failure modes and effects analysis of the ICS responsive to the Commission Order, was submitted to the Staff on August 17, 1979 and was later determined to be. applicable to TMI-1. Ross,_ff. Tr. 15,855, at 3. Therefore, the relief requested in Sholly Contention 6(a), i.e., that an-ICS ? MEA be

completed prior to restart has been granted.66 However, as explained by Mr. Sholly during the course of cross-examination of the witnesses presented by the Staff and Licensee on this

issue, the intent of the contention goes to whether Licensee Exhibit 18 is adequate in addressing the concerns regarding the  !

ICS raised by the Staff following the TMI-2 accident. Tr. i l

7294, 7328 (Shally).

179. Prior to addressing the concerns which gave rise to the performance of the ICS FMZA, the Board believes it  ;

I would be helpful first to examine the functions performed by the ICS. The basic purpose of the ICS is to match the-unit's i

power generation to power demand via a feed-forward control i l

1 t

66 Tne Staff has viewed reasonable progress towards the com- .

pletion of this long-term item as encompassing both the sub- i mittal of the ICS FMEA and the actions taken by Licensee in re-sponse to the recommendations contained in B&W's analysis. See Paragraph 197, infra.

l

-126-

system and to assist in increasing the unit's generating capacity by preventing reactor trips for'many anticipated plant upsets-(i.e., load changes, loss of a single reactor coolant pump, etc.). Broughton et al., ff. Tr. 6949, at 2; Thatcher, ff. Tr. 7122, at 2, 3.

180. The TMI-l ICS is composed of five subsystems:

the unit load ~dem.2nd control, the integrated master control, turbine control, steam generator control and reactor control.

The unit load demand control serves as an interface between the operator and the integrated master control; the operator inputs to the unit load demand control the demand for megawatts electric required from the nuclear' steam supply system

("NSJS"). The unit load demand control then signals this power demand information to the integrated master control. The unit load demand control also senses operating conditions that limit power production (i.e., status of the reactor coolant pumps):

these limiting conditions would cause the unit load demand control to decreese the operator demand, if necessary. The integrated master control, in turn, processes this information i

to determine the output required by three separate component sydtems: turbine control, steam generator control and reactor i

control. The turbine control manipulates the atmospheric dump l valves, turbine throttle valves and the turbine bypass valves-in order to control steam pressure at a constant value. The .

steam generatc r control manipulates the startup and main

[

-127-l

, . - - - - -,, - - - , , - - , . - - , . - , ~ , .n,_..e,_., . , - - . . . , , . . . , . - - _ , , . , . . w

feedwater valves and the main feedwater pumps in order to control the flow of water to the steam generators.67 The function of the reactor control is to control the regulating rod groups in the reactor core by issuing a signal to the control red drive system to insert or withdraw rods from the core, thereby controlling neutron flux. Broughton et al., ff.

( Tr. 6949, Figure 1; Tr. 6950-59 (Joyner). The control system thus provides limiting actions to ensure proper relationships between generated power, steam-pressure, feedwater flow and reactor power. Thatcher, ff. Tr. 7122, at 3.

181. We turn now to the bases for the inclusion of the ICS FMEA requirement in the commissi~on's August 9, 1979 Order. Following the TMI-2 accident, the Staff undertook a study of the sensitivity of B&W reactors to feedwater tran-sients and the role that control and safety equipment might play in such a transient. The preliminary results of this study raised the following concerns with respect to the ICS:

(1) Was the reliability of the ICS satisfac-tory?

(2) The failure modes and effects of the ICS had not been systematically analyzed.

(3) The ICS may initiate 10-15% of all feed-water transients.

(4) The ICS controls the emergency feedwater system in some plants and could thus contribute to a total loss of feedwater.

1 .

67 Following a reactor trip, if main feedwater is not avail-able, the ICS is capable of automatically supplying emergency feedwater to the steam generators. Tr. 7104 (Broughton).

l

-128-i l

l I . . . . .. - .- .- - - . - - . - - _ . . - _.

(5) Even when the ICS works well, there may be, in response to a feedwater tran-sient, wide _ swings in reactor pressure, pressurizer level, and average reactor coolant temperature.

Ross, ff. Tr. 15,855, at 1, 2. The information which served as the basis for these concerns was gathered in a short time span and, as pointed out by Staff witness Ross, was incomplete and in some instances incorrect. Tr. 15,862 (D. Ross).

182. In view of the concern regarding the possibil-ity that an ICS failure could lead to a loss of emergency feedwater ("EFW"), the Commission required, as a short-term action, that Licensee develop and implement operating proce-dures for initiating and controlling EFW independent of ICS-control. Short-term action 1(b),' Commission Order and Notice of Hearing, CLI-79-8, 10 N.R.C. 141, 144 (1979). Pursuant to this requirement, Licensee will implement, prior to restart, automatic initiation of the EFW pumps,00 which is completely independent of the ICS and, further, will provide separate manual EFW flow control capability'in the control room, which will allow the operators to manually control EFW flow to the steam generators in the event of an ICS malfunction. The NRC Staff has reviewed Licensee's designs for these modifications and has concluded that Licensee has met the requirements for 68 The original EFW system design provided an automatic ~

initiation of the turbine driven pump; as modified, the turbine driven pump and both motor driven pumps will be provided with automatic start signals. Lic. Ex. 15 at 6.

-129-l l

this short-term item. Ross, ff. Tr. 15,855, at 6; Staff Ex. 1

, at Cl-1, Cl-11. Additionally,. Licenses has committed, as a long-term action, to provide a safety-grade automatic steam generator level control system for EFW independent of~the ICS (see section II.Q., infra, for details of Licensee's long-term EFW upgrade program). These short-term and long-term actions are identical to those approved by the Staff for the other B&W operating reactors. Ross, ff. Tr. 15,855,.at 6; Staff Ex. 1 at Cl-12. The Board, therefore, concludes that these actions taken by Licensee meet.the short-term requirement in the Commission's Order and will alleviate the Staff's concern regarding the effect of the ICS upon EFW operability.

183. On the basis of the remaining concerns ~ raised by the Staff, B&W agreed, in a formal submission to the Staff dated April 28, 1979, to perform a reliability study'of the ICS. Ross, ff. Tr. 15,855, at 2, 3; Sholly Ex. 2, App. B at

29. The study agreed to by B&W and the Staff was to include:

(1) a survey of the field performance of the ICS: (2) a failure medes and effects analysis of the ICS (the boundary of

( which was defined by B&W and agreed to by Mr. Thatcher, the l Staff's reviewer for this project -- see Tr. 7126 (Thatcher));

i and, (3) B&W recommendations for improvements based on the l study. Tr. 7050-51 (Joyner); Sholly Ex. 2, App. B at 29.

184. Pursuant to its agreement, B&W submitted '

BAW-1564, " Integrated Control System Reliability Analysis" l

(Lic. Ex. 18), consisting of both an FMEA and an operating

-130-I

experience review of'the ICS, to the Staff on August 17, 1979.

Thatcher, ff. Tr. 7122, at 5; Ross, ff. Tr. 15,855, at 3.

Licensee has reviewed the B&W generic ICS study, by comparing the inputs, outputs and functional description of the system as described in BAW-1564 to the existing system at TMI-1, and han determined that the study is applicable to the TMI-l ICS.

( Broughton et al., ff. Tr. 6949, at 3; Thatcher, ff. Tr. 7122, at 5; Ross, ff..Tr. 15,855, at 3; Tr. 7011-12 (Broughton).

185. The failure modes and effects analysis of the ICS, Section 4 of Licensee Exhibit 18, was performed according to the guidance of IEEE Standard 352 in order to determine the effects upon the nuclear steam supply system from single failures of ICS inputs, outputs and internal modules. In order to analyze the failures which would cause the most drastic transient, each input and output to the ICS was assumed to have failed high and low. (An input high failure would be the maximum transmitter output, a low failure would be the minimum transmitter output; for the ICS outputs, high would be the output signal that fully opened valves, caused pumps to reach maximum speed, pulled control rods, etc., while the low failure would cause the opposite of these actions.) Tr. 6963-66 (Joyner); Lic. Ex. 18 at 4-19, 4-20.

186. In addition to considering ICS input and output failures, B&W developed a functional block diagram of the ICS -

(Lic. Ex. 18, Figure 4-3) and analyzed high and low failures of each major functional point of the ICS. (The high and low

-131-4 r,- - - , ---r - - , - . , , , - - - -

._, , -4p. -- ,.., _ ,,,,e ,y, n - - , . , , . , , - - , . - - , - , . ,w-,- .., - - - - -

1 l

failures of the functional blocks are similar to those for ICS outputs. A high failure will cause final control elements such I as feedwater valves and pumps to open or increase speed, while a low failure would cause the valves and pumps to close or decrease speed.) Tr. 6964-65 (Joyner);,Lic. Ex. 18 at 4-4, 4-20.

187. A hybrid computer simulation, utilizing the POWER TRAIN IV computer code simulation of a B&W 177-Fuel Assembly NSSS, in combination with an in-depth understanding of the ICS and NSSS, was used to analyze each failure outlined in Paragraphs 185 and 186, supra, in order to determine the effects upon the NSSS. Lic. Ex. 18 at 4-21. The analysis of postulated ICS failures found that.three categories of failures could be assumed:

o Category one failures -- essentially those which would not cause a significant upset in the NSSS and which have a very low-probability of causing a reactor trip.

o Category two failures -- those failures which cause system upsets which could cause the RPS to trip-the reactor but which would not affect NSSS control following the trip.

o Category three failures -- those failures which might cause a reactor trip and which, following '

reactor trip, could require HPI or EFW to control the effect of the failure unless the operator intervenes.

-132-

- .-*,-w , , . - - , . . - -.. ..-n,, , - - - . . , - n.--v v ,n-., .,m_ ~ - . - ,m-r.,-em,, - - - , - ,.,w-, y v --- gy - q -

Tr. 6967 (Joyner); Lic. Ex. 18 at 4-22. Only.a small proportion of the identified postulated-failures fell into Category 3 -- 15 out of an approximate total number of 115 l

possible failures. See Lic. Ex. 18 at 4-61 to 4-64. While the  ;

FMEA and system simulation identified a, number of ICS failures which could cause reactor trips, the operating history of the ICS shows that only a few of these potectial failures have been experienced (see paragraphs 188 and 189 below). Further, no failures were identified which affected operation of the safety systems. Tr. 7006 (Joyner).

188. Licensee Exhibit 18 also includes a review of ICS operating experience. Reactor trip data from each operating B&W reactor (including TMI-1) was analyzed and sorted on the basis of initiating events. Six major categories of initiating events were identified: ICS response; ICS internal failures; ICS input failures; ICS actuated equipment failures; operator / technician action; and, other plant events, usually balance-of-plant (" BOP") failures. Tr. 6965 (Joyner); Lic.

Ex. 18 at 5-1, 5-2. The operating data showed that ICS hardware failures caused only a small percentage of reactor trips (6 out of 310 trips or 1.9%), while operator / technician actions and failures in BOP equipment a: counted for the majority (two-thirds) of the trips experienced at B&W reactors.

Lic. Ex. 18, Figure 5-1 't 5-18. Further, data available from ~

one plant damonstrates that the ICS performed some 47 success-ful " runback" operations (preventing reactor trips) compared to

-133-

-.

37 trips (from all causes) experienced during 5.5 years of operation, thereby enhancing plant operability and reducing challenges to plant safety systems. Lic. Ex. 18 at 2-2, 5-6, Table 5-7 at 5-14.

189. On the basis of the FMEA and the analysis of ICS operating experience, B&W concluded that: the reactor core remains protected throughout any of the ICS failures studied and the safety systems operate independently of the ICS ma1 functions; and, the ICS hardware performance has not led to a significant number of reactor trips (6 trips out of a total t

of 310 trips analyzed) and, indeed, has prevented more reactor trips than it has caused. Broughton et al, ff. Tr. 6949, at 3; Thatcher, ff. Tr. 7122, at 5; Lic. Ex. 18 at 2-1, 2-2, 5-6.

The only event which could potentially cause a loss of main and emergency feedwater is an NNI/ICS power supply failure or malfunction. Ross, ff. Tr. 15,855, at 8; Lic. Ex. 18 at 5-7.

Mitigative measures for this event are being undertaken by Licensee as described in paragraphs 191 and 192, infra.

190. Based upon its analyses, B&W did identify l generic improvements to systems or components which interface I

I with the ICS (not to the ICS itself) and which could contribute to improved plant operation, and recommended that these l improvements be evaluated by B&W owners on a plant specific basis. B&W has divided these recommendations into two cate- ~

{ gories: those which are related to the ICS and those which pertain to other balance of plant (" BOP") equipment. Thatcher,

-134-e a-e , er- m- ---,a,-- - w,- e + . , es- ,,y -p, re-g, + w,,-- -- , ,- ,,e,_,r- s , -- -w. -

I ff. Tr. 7122, at 5; Tr. 15,865-66'(Capra);1Lic. Ex. 18 at'3-1.

Each B&W recommendation, and Licensee's response to the recommendations, is discussed below.

191. As noted in paragraph 189, supra, B&W identi-fled the loss of NNI/ICS power supplies as a significant initiator or contributor _to transient events. On this basis, B&W recommended that licensees evaluate the reliability of these power sources on a~ plant-specific basis.69 Lic. Ex. 18 at 3-1.

Purusant to_this recommendation,-Licensee has per-formed an evaluation of the effects of a loss of power to the .

ICS/NNI system.

Tr. 7005 (Sadauskas). As depicted in Licensee Exhibit 19, the power supply to the ICS/NNI is fed through distribution panel ATA via six sub-feeders. In performing the-evaluation of the ICS/NNI power supply, the effect upon' plant

operation of the failure of each sub-feeder, as well as the total failure of distribution panel ATA, was analyzed.- Tr. .

6971, 6992 (Sadauskas), 7032-33 (Broughton). The evaluation identified the components (i.e. , indicators, transmitters, valves, etc.) which would fail due to the loss of each power supply; additionally, prior to restart, Licensee will conduct a 1 test of the ICS under controlled conditions to simulate a loss of power, in order to verify the results of the evaluation.

69 Additional recommendations with regard to power supply re- .

liability were made by'the Staff in IE Bulletin 79-27 and in fol-lowup actions to the Crystal River 3 transient. Tr. 15,892-93~

(Capra); see also Staff Ex. 9.

-135-1 I

. - - - - - - _ . . _ . _ _ . . . _ . . _ _ _ _ , . _ . . ,__. ~ - _ _ _ _..._ -...-._ _ ,_. _ __ _

Procedures will then be developed in order for the control room operator to be aware of which instruments are affected by each particular failure. The operator is informed of the power loss by both visual and audible annunciators; additionally, indicat-ing lights for sub-feed failures will be installed prior to restart, enabling the operator to determine the appropriate action to be taken. Tr. 6994-98 (Sadauskas), 7034 (Broughton).

192. Licensee is also installing an additional ICS power supply transfer switch, which will assure the availabil-ity of power to distribution panel ATA. This panel is normally fed from either the red battery through an inverter or from the 480 volt engineered safeguards bus. If the inverter fails, the static automatic transfer switch automatically transfers power from the inverter to a separate 120 volt single-phase regulated bus. Based upon an incident at Oconee Unit 3, where the static auto transfer switch failed, Licensee is installing a remote operated manual transfer switch downstream of the static auto transfer switch which will allow the control room operator to manually transfer the power supply to the 120 volt regulated bus. The operator will be informed of the failure of the i

automatic switch to transfer by an alarm in the control room.

r i

The addition of this new transfer switch will thereby improve L the reliability of the power to the ICS. Tr. 7013-19

( (Sadauskas); Lic. Ex 1, Supp. 1, Part 2, Response to Question -

38; Lic. Ex. 19.

193. The second recommendation made by B&W in the ICS Reliability Analysis concerned the reliability of input l

-136-

~.~.

signals from the nuclear instrumentation / reactor protection system to the ICS, and in particular, the reliability of the RCS flow signal. Lic. Ex. 18 at 3-1. Prior to the tim'e that '

B&W performed its analysis, the TMI-l RCS flow signal input to

.the ICS from the RPS tad been modified from a jumper and plug arrangement that connected the output of the RPS cabinec to the input of the ICS cabinet, by replacing t.his arrangement with a solid wire signal path internal to the cabinets. Additionally,.

the RCS flow signal can be taken from one of two different channels, so that upon a loss of power to one channel, an autcmatic transfer occurs for the ICS input to be transferred to a channel which still has a valid flow signal. Tr. 6976-78 (Broughton).

194. The third ICS-related recommendation concerned the ICS and BOP tuning, particularly between the feedwater condensate systems and the ICS controls. Lic. Ex. 18 at 3-1.

TMI-l has in place a comprehensive program of ICS maintenance and alignment which assures that the ICS inputs and outputs are properly calibrated and operating. The maintenance program also includes an operability check of the components actuated by the ICS. Tr. 6979-80 (Broughton); 7091-92 (Joyner). The Board notes that TMI-l has not experienced the system tuning problems which have occurred at other B&W reactors; indeed, Dr.

Joyner, one of the authors of the B&W reliability study, stated that he did not believe this generic recommendation was applicable to TMI-1. Tr. 6980-81 (Broughton, Joyner).

-137-

195. The remainder of the B&W recommendations, which are derived from the results of the FMEA, deal with BOP  !

systems. The first of these concerns the minimum speed control for the main feedwater pump turbine and the possibility that these pumps would trip (causing a loss of main feedwater) at low speed settings.

The TMI-l main feedwater pumps are equipped with a mechanical low-speed stop (completely separate from the ICS signal) which allows a minimum speed to be maintained; the TMI-1 low-speed setting has proven to be optimum during five years of operation. Tr. 6981-82 (Broughton); Lic. Ex. 1, Supp. 1, Part 3, Response to Question 12.b.1; Lic. Ex. 18 at 2-1, 3-1.

196. The two remaining BOP recommendations suggest that means be developed to prevent or mitigate the consequences of stuck-open main feedwater startup valves and stuck-open turbine bypass valves. Lic. Ex. 18 at 3-1. With respect to the main feedwater starcup valve, TMI-1 has a separate motor-operated valve independent of the ICS which can be utilized to block the flow in that line. Similarly, there are two motor operated valves in series with the turbine bypass valve which could be shut in order to isolate steam flowing through the turbine bypass valve. Therefore, both of these events could be terminated without the need for further

! modifications. Procedural guidance to the control room l

operators for mitigating these events will be included in Licensee's A10G program (see, section II.C, supra). Tr.

i I

-138-

4 6982-83 (Broughton); Lic. Ex. 1, Supp. 1, Part 3, Response to Questions 12.b.2 and 12.b.3.

197. The Staff has reviewed Licensee's response to the Commission requirement and has concluded that the submittal of Licensee Exhibit 18, in conjunction with the actions taken by Licensee pursuant to the recommendations contained therein, have constituted sufficient reasonable progress towards completionoof this long-term item to allow restart. Staff Ex.

1 at Dl-1; Staff Ex. 14 at 49. The Board concurs in the Staff's assessment that the actions being undertaken by Licensee are an acceptable response to the recommendations contained in Licensee Exhibit 18.

198. The Board, however, must now examine whether the " Integrated Control System Reliability Analysis" and the resultant actions taken by Licensee have adequately addressed and alleviated the concerns regarding the ICS expresced by the Staff after the TMI-2 accident. Initially, the Board notes that, while the TMI-2 accident may have raised questions by the l

l Staff concerning the role of the ICS in a similar transient, l the ICS was not a factor in the TMI-2 accident and it performed as required throughout the time that it was called upon. Tr.

7053 (Broughton).

199. The detailed review of the B&W analysis was subcontracted by the Staff to Oak Ridge National Labratory .

("ORNL"). ORNL made the following conclusions, in which the Staff has concurred, on the basis of its review: the ICS l

I

-139-l i

l

itself has a low failure rate and does not instigate a significant number of plant upsets; failures of and within the ICS are adequately mitigated by the-RPS; many potential ~ICS failures would be mitigated by the cross-checking features of the system without challenging the RPS; and, that the ICS is failure tolerant to a significant degree. Further, ORI!L agreed with B&W that the ICS prevents or mitigates many more upsets than it creates and that the ICS is superior to fragmented or manual control schemes. Thatcher, ff. Tr. 7122, at 6; Ross, ff. Tr. 15,855, at 3; Sholly Ex. 2 at 14-15.

200. ORNL did, however c criticize the scope of the B&W report, stating that "...the B&W analysis is more notable for what it does not include than for what it does include."

Sholly En. 2 at 3. Prior to consideration of the criticisms raised by ORNL, the Board notes that the Staff did not provide ORNL with specific guidance as tc the scope of the FMEA required by the Commission orders. Staff Witness Thatcher did prc,ide ORNL with a copy of NUREG-0560, "

Staff Report on the Generic Assessment of Feedwater Transients in Pressurized Water Reactors Designed by the Babcock & hilcox Company," and, indeed, ORNL references NUREG-0560 as encompassing the concerns to which ORNL believed the FMEA was required to respond.

NUREG-0560 was issued after B&W had begun work on its study, and, as Mr. Thatcher notes, NUREG-0560 included a number of '

concerns which arose after B&W had committed to perform the ICS reliability analysis. Tr. 7247, 7265 (Thatcher); Sholly Ex. 2

-140-Y

.- -e .--.,,.. ~ - -r ,. ,.,,. ,,_,w,.-%.,--,,-e-- -

.we- m c. r y 3 -.w,-

c-m.. ,,m, -ewy, , - , ,- --

at 2. The Board, therefore, while considering the ORNL criticisms, remains cognizant that these criticisms are not

, completely appropriate in that ORNL. measured the B&W study against standards it was not intended to meet.

201. Among the concerns raised-by ORNL regarding the B&W reliability analysis are the following: the study did not consider multiple failures or mid-scale-failures; the study did not investigate possible interacticns between the ICS and other contrcl or safety systems; and, the FMEA was performed using a functional block diagram rather than a component bicek diagram or a fault tree analysis. See generally, Sholly Ex. ;!.

202. Multiple failures are considered in the plant safety analysis and the effects of such multiple failures would be bounded by the events analyzed in the FSAR, Tr. 7041-44 (Joyner). A FMEA is a technique for analyzing single failures in an effort to determine where failures in the system under consideration might occur. Tr. 7041-42 (Joyner). Detailed fault trees which will allow the assessment of the effects of l multiple failures will be developed as part of the B&W ATOG l

j program. Ross, ff. Tr. 15,855, at 5. Finally, the Board notes l that- while ORNL was critical of the FMEA's failure to include f

multiple failures and of the methodology employed by B&W, it concluded that further analysis of the ICS using a different l methodology in order to assess multiple ICS failures might not ,

i be economically justifiable in that failures within the ICS do i

not constitute a significant threat to plant safety. Ross, ff.

tr. 15,855, at 5; Sholly Ex. 2 at 15.

t

-141-l L

l 203. ORNL criticized 'che FMEA for not including consideration of mid-scale failures. However, as pointed out in paragraphs 185 and 186, supra, B&W chose to ascess the

, impact of high and low failures in an effort to produce the most severe plant response -- i.e., these high and low failures would produce a more drastit NSSS response than mid-scale

' failures. Tr. 7029 (Joyner). In addition, as discussed at page 21 of Sholly Exhibit 2, mid-scale failures are most likely to result frcm h3I/ICS power supply failures; the studies being perfo'rmed by Licensee of the effects of c loss of NNI/ICS power supplies (see paragraph 191, supra) will include mid-scale

, instrument failures. Tr. 7030-31 (Joyner, Broughton).

204. ORNL also critized the FMEA for not considering the effects of an ICS failure upon related systems. This

, criticism appears to be based upon ORNL's rev hw of NUREG-0560, 4

which recommended an identificat_on of plant interactions-resulting from failures in non-safety systems, safety systems and operator actions. Sholly Ex. 2 at 2,-3. The ICS FMEA'did

consider failures of associated systems in that the analysis of the failures of the ICS inputs and outputs (see paragraph 185, supra) considered these failures in the same manner as if the connecting systems themselves had failed. Additionally, the effect of the ICS upon other systems was encompassed by failure of the ICS outpsts to the final control elements; these -

failures could occur only from ICS malfunctions. Tr. 7086-88 I (Joyner). While ORNL may have preferred a complete systems-in-l teraction analysis, the Board views this cricicism as.outside

-142-i

the scope of the FMEA required by the Commission Order and beyond the study needed to address the Staff's concerns; further, we note that a methodology for conduct'ng studies such as recommended by NUREG-0560 has not yet been fully developed

~

by the Staff, but is being pursued in the course of the Staff's IREP program. See section II.T, infra.

205. The ORNL reviewers were of the opinion that the functional block technique utilized by B&W in performing the FMEA providas little basis for estimating failure probabil-ities, citing the fact that the FMEA does not reflect the' beneficial features of the ICS as evidenced by the operating data. ORNL suggested that if further study of the consequences of ICS failures was desired, then a fault tree analysis using an equipment block 6 agram should be developed for the " top" event of loss of feedwater. However, as we discussed in paragraph 202, supra, ORNL also concluded that further analysis of this sort may not be economically justified. The Staff has agreed with ORNL's conclusions on this point and has elected not to pursue additional studies directly associated with the ICS. Ross, ff. Tr. 15,855, at 5; Sholly Ex. 2 at 8, 10, 15.

206. The Staff, in determining the adequacy of the B&W ICS study, did consider the concerns expressed by ORNL, and concluded that the ICC Reliability Analysis as performed by B&W served the purpose for which it was intended. Ross, ff. Tr. -

15,855, at 4, 5; Tr. 7126-27 (Thatcher). The Board therefore finds, in light of both the Staff's review and its own assess-ment of the scope of the E&W analysis, that the Integrated

-143-

- - - - - - e , ., , . - , - - ,- -, ~ - , . , ,.w. - - , - ---m -..n-

Control System Reliability Analysis (both the Fh?A and the operating experience review) is adequate to determine the reliability of the ICS and meets the second concern expressed in paragraph 181, supra. '

207. We have previously determined in paragraph 182, supra, that the modifications being implemented by Licensee for the independence of emergench feedwater from the ICS addresses the~ Staff's fourth concern listed in paragraph 181. The Board's conclusions on the remaining concerns expressed by the Staff are addressed below.

208. "Was the reliability of the ICS satisfactbry?"

~

As discussed in paragraphs 187 and 188, supra, the FMEA portion of the B&W study found only a small percentage of postulated ICS failures which could result in a challenge to the RPS, while the operating history of the ICS shows that ICS hardware failures caused only 1.9% of all reactor trips experienced by B&W reactors. Further, the Staff has found no ev'ience that the ICS causes more frequent or more severe challenges to the protection system than other control schemes. Ross, ff. Tr.

15,855, at 4; Tr. 15,901 (D. Ross). The Board therefore finds that the reliability of the ICS is satisfactory.and. sufficient to permit -estart.

209. 'The ICS may initiate 10 to 15% of all feed-water transients." At the time that the Staff developed its ~

concerns regarding the ICS, preliminary data indicated that ICS l

failures caused 9 out of 73 feedwater transients. Tr. 15,861

-144-l

(D. Ross). Later, the operating experience review conducted by B&W determined-that, of the 310 reactor trips examined, only 6 (1.9%) were directly attributable to ICS internal failures (see paragraph 188, supra). However, 30.6% of the remaining reactor trips were initiated by ICS control responses, input failures (for tha most part, power supply or NNI failures) or by i

failures of ICS actuated equipment. Ross, ff. Tr. 15,855, at 5, 6; Lic. Ex. 1, Figure 5-1 at 5-18. On the basis of these results, B&W recommended that the licensees review the areas discussed in paragraphs 191 through 196, supra. Lic. Ex. 18 at 2-1, 2. The Staff views th'3 concern as being catisfied in

~that the ICS contribution to feedwater transients is less than originally thought. Further, the Staff is of the opinion that the modifications being implemented at TMI-1, particularly the separation of EFW from ICS control, will minimize the effect of ICS and associated system failures upon the operability of the feedwater systems. Ross, ff. Tr. 15,855, at 5, 6; Tr. 15,864 (O. Ross). The Board believes that the modifications being implemented by Licensee will serve to mitigate the impact of ICS associated failures upon initiation of reactor trips and feedwater transients, and therefore adequately address this l Staff concern.

210. "The ICS may cause, in response to a feedwater transient, wide swings in reactor pressure, coolant temperature ~

and pressurizer level." This sensitivity of B&W reactors is due to the close coupling of the primary system to the second-ary system.

The Staff believes that the B&W recomendations

-145-

- - - . . - - . .. _, , _ . ,  % ~ , . . - - , - - . , , . , - - - - -

concerning ICS/ BOP tuning and the main feedwater startup and tutbine bypass valves (see, paragraphs 194 and 196, supra) will minimize this sensitivity by reducing the possibility of steam flow / feed flow mismatches. Ross, ff. Tr. 15,855, at 7. The Board concurs with the Staff's views and finds that these recommendations, and the resultant response by Licensee,_

alleviate this concern.

211. In summary, then, the Board finds that long-term action 1 of the Commission's Order and Notice of Hearing of August 9, 1979, is necessary and sufficient in order to 1

provide reasonable assurance that the long-term operation of TMI-1 will not endanger the public health and safety. The Board believes that the submission of the B&W report (which, in conjunction with the actions taken by Licensee pursuant to thL report's recommendations, we find to be responsive to the concerns expressed by the Staff regarding the ICS) complies fully with the requirements of long- term action 1,70 and we agree that, under the Staff's interpretation of this item, the actions taken by Licensee constitute reasonable progress toward completion of this requirement. Further, the Board finds that the completion of short-term action 1(b) of the Commission's Order and Notice of Hearing of August 9, 1979 is necessary and 70 The Board takes note of another licensing board's -

finding that this same FMEA prepared by B&W "was adequate and complete for its purpose." Sacramento Municipal Utility District (Rancho Seco Nuclear Generating Station) LBP-81-12, 13 N.R.C. , slip op at 19 (May 15, 1981).

l

-146-t b

l l

sufficient to provide reasonable assurance that the public health and safety will not be endangered upon plant restart and, as we found in paragraph 182, supra, the modifications being implemented by Licensee are in compliance with the requirements of short-term action 1(b).

I. Containment Isolation Sholly Contention No. 1: It.is contended that in order to adequately protect the public health and safety, the containment isolation signals for TMI-l must include the following:

1. A safety-grade high radiation signal for the reactor building vent and purge system.

2. A safety-grade high radiation signal for the reactor building sump discharge piping.

It is further contended thct such additions to the containment isolation signals must be made prior to the Restart of TMI-1 in order to adequately protect the public health and safety.

212. At the time of the TMI-2 accident, containment l

isolation at both TMI-l and TMI-2 occurred upon receipt of a high containment building pressure (four pounds) signal. Based upon concerns engendered by the TMI-2 accident that significant fuel damage can occur in the absence of high reactor bu;1 ding ,

pressure, the NRC Staff required that all containment isolation systems comply with the provisions of Standard Review Plan

-147-l

4 s=

l Section 6.2.4,- requiring diversity in the parameters sensed for the initiation of containment isolation. Lanese, ff._Tr.'7349, at 3; Tr. 7392 (Hearn); Staff Ex. 1 at C8-21.

213. In response to this requirement, Licensee has chosen to install an autoratia isolation initiation upon receipt of a reactor protection system trip signal, in addition to the pre-existing high containment building pressure signal, both of which are safety-grade. These parameters will assure automatic isolation prior to the release of radioactivity from the reactor building under all postulated accident conditions.

Lanese, ff. Tr. 7349, at 3; Hearn, ff. Tr. 7376 at 3; Tr. 7393 (Hearn). The Staff has ag' reed that the reactor trip signal is an acceptable parameter to initiate containment isolation.

Staff Ex. 1 at.C8-23. ,

214. All lines which are directly connected to the containment atmosphere or the reactor coolant system (including the containment purge system and the reactor building sump) are closed automatically upon reactor trip, with the exceptien of' the containment air sample line. The diverse signal for this line, which is required to be available following reactor trip, is 1600 pounds reactor coolant system pressure. Tr. 7367-72 (Lanese).

215. Sholly Contention No. 1 is based, in part, upon Recommendation c of NUREG-0667, "

Transient Response of Babcock Wilcox-Designed Reactors", which recommended the installation ~

of a safety-grade high radiation isoli. tion signal for the 148-

~~ . . , - - _ . , .,n ,+.,.,-,,ee.-.,,- p.- ,---..,,---y m.-r- v, e, , aw ,. g,- .w - w.-.,. ,y , e.

-r-- - - _ _ - - _ _ _ _ _ _ . _ _ _ _

_

l k.

VD xxf4Mb W+4 4 >;>,

<0'4 TEST TARGET (MT-3) 1.0 M EM

~

Plj y IGE l.lQ'SEE

-! l.8 1.25 1.4 1.6

~

c

/ < 6"

\

1. 4 #'

4%

4

+%g Axxx)/ 4 3,,,

'4+A.

@+N;>, // 'M e+ . .e. ...<e 1,.

[se+ 4 TEST TARGET (MT-3) 1.0 ' BE EM d "E m m E22 l,l ' $,* flbb

~

4

/ l I.8 i-1.25 1.4 111.6

,I _ in -

/ e 6" > .

t

• r4 4+4 4;#yf?

r

'*b 4A,p<> ,

g,,, -

> _ - - _ _ _ _ - _ _ _ _ _ _ _ - _ _ _ _ _ . ~

containment building vent and purge lines. Tr. 7380-81 (Sholly). This recommendation was based upon a concern that during a containment vent and purge operation, the PORV or pressurizer safety valves may be actuated and release radioac-tivity prior to reaching the high containment building pressure isolation setpoint. Tr. 7351-52 (Sholly).

216. The reactor trip isolation signal chosen by Licensee, however, will provide timely and effective contain-ment isolation in the event of such a scenario. The high pressure-reactor trip setpoint (2300 pounds) is well below the PORV and safety valves setpoints (2450 and 2500 pounds, respectively); therefore, containment isolation would occur prior t any release from these valves. Tr. 7353-54 (Lanese);

7383 (Hearn). In the event of a spurious PORV opening causing a release to the reactor coolant drain tank, a low pressure reactor trip (and containment isolation) would occur prior to the drain tank relieving water to the reactor building sump.

Tr. 7355-56 (Lanese). In both cases, a reactor trip signal would be generated before radioactivity could be released to the containment and trigger a radiation monitor signal to i

initiate containment isolation. Tr. 7354 (Lanese).

217. In addition to the two safety-grade isolation signals identified in paragraph 213, the following lines are

equipped with non-safety-grade high radiation isolation -

signals

o Containment purge system i

o Reactor building sump drain

(

-149-oe

2 I

o Steam generator, pressurizer _and reactor coolant system sample lines o Reactor coolant drain tank vent and liquid discharge lines.

Both the Licensee and Staff witnesses testified that an operator's response to a-non-safety-grade radiation signal would be no different than to a safety-grade signal; further, there are safety-grade containment radiation monitors which could serve to confirm the non-safety-grade signals. Lanese, ff. Tr. 7349, at 4; Tr. 7356 (Lanese); 7386-87 (Hearn). Thus, while the two systems cited in Sholly Contention No. 1 are'not equipped with safety-grade radiaticn isolation signals, the non-safety-grade signals in combination with the reactor trip and containment building pressure signals _ provide adequate

assurance that containment isolation will occur prior to any release of radioactivity.

218. Mr. Sholly has also expressed a concern over the effect of bypassing the reactor trip isolation signal while the HPI system may still be operating. If the reactor coolant system pressure should rise above the 1900 psig reactor trip j setpoint following a low pressure ESFAS actuation and reactor trip isolation, the reactor trip isolation signn1 would not be automatically cleared, but would require a deliberate operator action in order to clear it, as dictated by plant operating '

procedures. Lanese, ff. Tr. 7349, at 3, 4.

219. Should the isolation signal be reset or bypassed, the containment isolation valves themselves will'not

-150-

reopen automatically. Reopening of these valves again requires a deliberate operator action in accordance with conditions set out in operating procedures, including permission of the shift supervisor or emergency director and an assessment of contain-ment radiation levels. Id. at 4; Tr. 6368-71 (M. Ross).

220. In summary, then, we find that the diverse isolation signals implemented by Licensee are sufficient to provide adequate protection against the possible release of radioactivity to the atmosphere and that the further addition of safety-grade high radiation isolation signals is not required. Additionally, as addressed in section II.D (Safety System Bypass and Override) supra, Licensee's procedural controls are sufficient to prevent bypassing or resetting of containment isolation signals and to prevent inappropriate opening of closed isolation valves.

J. Filters Lewis Contention: Filters: There are new filters on the auxiliary building of TMI #2. There are i

no similar structures on the auxiliary building of TMI fl. Further, preheaters must be placed on the filters of the auxiliary building because they got wet during the accident on 3/28/79 in l TMI #2. To mitigate a similar accident

in TMI #1, preheaters on the filters in the auxiliary building of TMI #1 are l

necessary. There are many design errors

! in the filter system and design of same.

i I am presenting the above as examples of a larger problem.

l

-151-I L

ANGRY Contention No. V(D): The NRC Order fails to require as conditions for restart the following modifications in the design of the TMI-l reactor without which there can be no reasonable assurance that TMI-l can be operated without endangering the public health and safety:

(D) Installation in effluent pathways of systems for the rapid filtration of large volumes of contaminatea gases and fluids.71 221. The Lewis contention asserts the need to increase the capacity of the filtration systems for gaseous radioactive releases outside the reactor building. In order for such radioactive material (which is produced in the reactor fuel) to be released from the reactor building, one must postulate that the material had penetrated the' fuel cladding and been transported from the containment to the auxiliary building via a plant auxiliary system. Therefore, the concerns 71 In our first Special Prehearing Conference Order of Decem-ber 18, 1979, the Board accepted ANGRY Contention V(D') with the understanding that ANGRY must further specify the contention.

during the course of discovery. 10 N.R.C. 828, 843 (1979). On October 3, 1980, ANGRY pre-filed the dir?ct testimony of Dr. Jan Beyea in support of this contention, which testimony proposed that a controlled filtered venting system for the containment building be installed at TMI-l prior to restart. The Board, in denying the admission of Dr. Beyea's testimony due to the pendency of a rulemaking pr:ceeding in which the need for controlled filtered venting systems will be considered, also stated that ANGRY Conten-tion V(D) deals with the capacity of filters in conventional ef-fluent pathways in the event of an accident. Memorandum and Or-

• der Denying Admission of Testimony of Beyea in support of ANGRY Contention V(D), March 12, 1981, at 2-3 and n.2. Therefore, we consider here only the need to supplement existing filtration sys-tems in conventional pathways.

-152-

'T $ v- V w apV --

• a-

4 addressed herein deal with the capability of the filtration systems to minimize the radioactive releases from these auxiliary systems. Itschner et al., ff. Tr. 9919, at 2 (Moore).

I 222. The primary method for controlling the no'rmal i release of gaseous radioactive material at TMI-1 and TMI-2 is j to' collect the gas in the waste gas disposal system ("WGDS")

I where it is compressed and stored in tanks until the radioac-tivity from the noble gases has decayed to an acceptable level.

At that point, the gas is released at a controlled rate-(defined by the plant Technical Specifications) to the plant filter system, in the following stages: a pre-filter or

, roughing filter; a high efficiency particulate air ("HEPA")

filter; and finally through impregnated charcoal adsorbers (or filters). Itschner et al., ff. Tr. 9919, at 2 (Moore);

Stoddart-1, 2 ff. Tr. 9963, at 5; Stoddart-2, 3 ff. Tr. 9963, at 5, 6.

223. The combined efficiency of the pre-filters and HEPA filters is nearly 100% for particulate matter; the l charcoal filters at TMI-1 have a design rating efficiency of 90% or greater for all forms of radiciodine; and, by storage 72 "NRC Staff Testimony of Phillip G. Stoddart regarding Need for Heaters on Ventilation Exhaust Filters for TMI-l (Lewis Contention)" ("Stoddart-1"). -

73 "NRC Staff Testimony of Phillip G. Stoddart Regarding T.M.pid

, Filtration for Large Volumes of Contaminated Gases ang Fluids j

in Effluent Pathways (ANGRY Contention V(D))" ("Stoddart-2").

153-e

- se -y--* e w-----ty*. y-tw PNT -t* u-*'+ rTv F-1 y --W 9 'e-M 4 --7 'r--'-P-ww-T 77'*'-'-*ww

for up to 90 days in the WGDS tanks, approximately 99.8% of the noble gases initially removed from the primary system will have decayed away. The only remaining radioactive noble gas is Krypton-85, which is released to the atmosphere, after passing through the filter syste:a, under carefully controlled meteorological conditions. Stoddart-2, ff. Tr. 9963, at 7-9.

224. a significant source of radioactive gas l releases during the first week of the TMI-2 accident occurred l

when, ir the process of transferring gas from the makeup tank to the WGDS for storage, leaks in the pipe flanges and a compressor released gas to the auxiliary building atmosphere.

This gas was then collected by the auxiliary and fuel handling building ventilation systems, processed through the filter system described in paragraph 222, supra, and then released.

Itschner et al., ff. Tr. 9919, at 3 (Moore). This venting resulted in the release of short-lived noble gases and some iodine directly to the atmosphere; however, it should be noted that the radiological consequences to the hypothetically most l

l exposed individual from all accident sources amounted to 76 millirems, a small fraction of the 10 C.F.R. Part 100 l guidelines, and less than a one-year exposure to background radiation. Itschner et al., f f . 1_ , 9919 at 5 (Pelletier);

! Stoddart-1, ff. Tr. 9963, at 3.

225. During the early stages of the TMI-2 accident, -

there were indications that the charcoal adsorbers in the auxiliary and fuel handling building ventilation system were

-154-

not removing as much iodine as they should have. Initial laboratory tests, using 100% methyl iodide at 95% relative humidity, showed that the efficiency of the auxiliary building charcoal adsorbers for removing this form of iodine was between 56% and 69.5%. These test results are viewed as conservative, in that methyl iodide (the form of iodine with the most filter penetriting capability) accounted for only 10% to 30% of the iodine in the air at TMI-2. Secondly, the high humidity (which lowers the efficiency for retaining methyl iodide in the filters) utilized in these tests was not reprecentative of actual conditions at TMI-2, where the humidity experienced was believed to be approximately 30%. Itschner et al., ff. Tr.

9919, at 5, 6 (Pelletier); Tr. 9929-31, 9955-57 (Pelletier).

This view is confirmed by subsequent analysis, which showed that the auxiliary building charcoal adsorbers removed approxi-mately 90% of the iodine (methyl and elemental) to which they were exposed. Itschner et al., ff. Tr. 9919, at 5 (Pelletier);

Tr. 9986-87 (Stoddart).

226. Based upon the ccacerns regarding the efficien-cy of the auxiliary and fuet handling building ventilation system for removing iodins>, and to minimize potential future releases, Licensee installed four trains of a supplemental gaseous effluent treatment system, on the roof of the TMI-2 auxiliary building, which were connected in series to the .

pre-existing ventilation system. This supplemental system was successful in reducing the amount of iodine released following P

-155-9

, , , , , - - --,. - - --.e-.. , .- ,,, , - ~ -- , n n -s .-

its installation. The supplemental system has since been disconnected following the release of all iodine and after the pre-accident ventilation system charcoal had been changed out.

Itschner et al., ff. Tr. 9919, at 7 (Itschner); Stoddart-1, ff.

Tr. 9963, at 2, 3.

227. In order to prevent releases of the sor'.

l l

experienced during the TMI-2 accident, Licensee has *aken the actions described below in paragraphs 228 and 225 to assure the effectiveness of the TMI-1 charcoal filters and to minimize the amount of gas leakage from the auxiliary systems. In addition-to these actions, the type of charcoal used in the ventilation and filtration systems will be changed prior to restart from potassium iodide impregnated charcoal to a co-impregnant of potassium iodide and triethylenediamine, which is more effective in retaining organ c (methyl) iodide. . Stoddart-1, ff. Tr. 9963, at 4; Tr. 9933-34 (Barley, Itschner), 9985-86 (Stoddart).

228. As described in paragraph 224, supra, one of the sources of radioactive gas during the TMI-2 accident was leakage from auxiliary systems. Licensee has implemJnted a leak reduction program for systems outside containment, which I will serve to significantly reduce the liquid and airborne radioactive contamination leveJ3 in these areas. Itschner et al., ff. Tr. 9919, at 8 (Barley). Prior to restart, and at each refueling interval, tests of these systems will be conducted under normal operating pressure and temperature

-156-

,_ , . - , . , , , , . . . - , . . ,--- _._ _.m y _. ,-.....w.. ..y_.,., . . - . , , . .,-.,,-c , .<, ,w.

conditions to identify and quantify any leakage, and necessary corrective maintenance will be performed to reduce any such leakage to as low as reasonably achievable amounts. The Staff has reviewed Licensee's leak reduction program and has found that this program meets the requirements of Item 2.1.6.a of NUREG-0378 and is adequate to assure the safe operation of TMI-1. Tr. 9935-42 (Barley); Lic. Ex. 1, S 2.1.1.8; Staff Ex. 14 at 33-35. As a long-term action, TMI-l will also be modified to permit the venting of radioactive gases from the ,

reactor coolant system high points to the reactor building atmosphere, thus reducing the amount of radioactive material transported outside containment for processing by the WGDS.74 Itschner et al., ff. Tr. 9919, at 4 (Moore); Ross, ff.-Tr.

15 T a .- 2 2; Tr. 15,553, 15,598-99 (Capra); Staff Ex. 14 at 52-53, 229. Licensee has also implemented improved testing and maintenance requirements far the auxiliary and fuel handling building ventilation system filters and for the WGDS.

In accordance with the plant Technical Specifications, the charcoal filters in these systems will be tested for their I

efficiency in removing iodine at every refueling outage or i

74 The long-term requirements (currently scheduled for imple-mentation by July, 1982) for RCS high point vents are contained in NUREG-0737, item II.B.1. While the primary purpose of these vents will be to vent nonconde',.ible gases from the RCS, they will also provide the additional advantage described above. See Staff Ex. 14 at 52-53 and B-7 through B-10.

-157-l

every 18 months, whichever comes first, as well as following any_ event which may reduce the charcoal's capability (i.e.,-

significant fires or painting). Itschner et al., ff. Tr. 9919, at 7, 8 (Itschner); Tr. 9948 (Itschner). This Technical Specification requirement is beyond criteria imposed by the Staff (which only requires testing of ESF system filters);

however, the NRC Staff will audit and enforce Licensee's compliance with this Technical Specification. Tr. 9926-27 (Barley), 9969-71 (Stoddart).

230. The Board finds that Licensee has taken suffi-cient action at TMI-l to identify and compensate for the deficiencies encountered during the TMI-2 accident in the systems for filtering radioactive releases to the environment.

The actions outlined above will minimize any possible release of radioactive gu. from containment and will assure that the efficiency of the systems for filtering such releases are adequate to maintain contamination levels as low as reasonably achievable. Therefore, we do not believe that the installation of a supplemental filter system is required in order to provide reasonable assurance that the public health and safety will not be endangered.

231. Mr. Lewis also urges that preheaters be added to the auxiliary and fuel handling building ventilatior system, alleging that these filters became wet during the TMI-2 -

accident. There has been no evidence presented that the TMI-2 filters were wet during the accident. Even if such had been

-158-3 -, ----c --

,e . - ~~ ,.m-.

. . . , ..--y- , +ar-v-= y - m

the case, a.preheater does not have sufficient heat exchange capacity to remove entrained water from the filter or incoming air. Itschner et al., ff. Tr. 9919, at 6, 7 (Pelletier);

Stoddart-1, ff. Tr. 9963, at 6, 8.

232. Preheaters are useful and required only where the influent air has a humidity of greater than 70% for.an f

extended period of time, thereby allowing iodine releases to exceed guide _ines during accident conditions. Stoddart-1, ff.

Tr. 9963, at 8. As discussed in paragraph 225, supra, the-humidity to which the TMI-2 filters were exposed during the accident is thought to have been approximately 30%; further, there has been no suggestion on the record that the TMI-l filters would be exposed to such high levels of humidity for extended periods of time. Therefore,.the Board finds that the installation of preheaters on the TMI-l auxiliary and fuel handling building ventilation system is not nececsary to i

provide reasonable assurance that the health and safety of the rtblic will not be endangered.

233. ANGRY Contention V(D) asserts that an un-specified rapid filtration system for contaminated gases and fluids should be installed in the effluent pathways at TMI-l prior to restart. Initially, it should be noted that, with

{ respect to those radioactive gaseous effluent pathways which were a significant source of releases at TMI-2, these same .

pathways at TMI-1 are currently provided with exhaust air filtration systems which have  : he capacity for the rapid

-159-t vvw-- y ww- v-vv--neur w=m.g--,- ,---m-v-v--m--r + -ew,ya 9w v*e-==r--'w --+v Fv r vmee -v-'- --"vrP v'- w e+ .w e --- ~*--'wr'--#w -

filtration of radioactive gas which could be released.

Stoddart-2, ff. Tr. 9963, at 2. See also, Itschner et al., ff.

Tr. 9919, at 3, 8 (Moore, Barley). Therefore, the Board considers ANGRY's proposal for the-addition of an unspecified rapid filtration system-for gaseous effluents to be unneces-sary.

234. Filtration of radioactively contaminated liquid effluents is considered to be only a marginally effective method of decontamination, and, in fact, the Staff assumes that such filters are ineffective in removing radioactivity from a liquid stream prior to its release. Rapid filtration of liquid effluents would have an adverse effect in its potential for the release of large quantities of soloble radioactive wastes which would not be removed by filtration. Further, the currently installed liquid radioactive waste treatment systems at TMI-l utilize storage and processing methods which have been shown to be effective in management and removal of radioactivity from liquid effluents. Stoddart-2, ff. Tr. 9963, at 2-4. See also, paragraphs 40-44, of our Findings of Fact on Separation of TMI-1 and TMI-2. In view of these facts, the Board finds that i

a liquid effluent rapid filtration system is not required at l

l TMI-1, and indeed, such a system would be detrimental to the health and safety of the public.

235. In summary, then, the Board finds that the ~

systems in place at TMI-l for minimizing the release of radioactive materia!..s are sufficient to protect the public health and safety, and require no further modifications.

-160-

K.- Computer Sholly Contention No. 13: It is contended that the Unit 1 computer system does not meet.the requirements for instrumentation and control specified in GDC 13, and is inadequate to insure proper operation of the Unit 1 reactor under all conditions of normal operation, including an--

ticipated operational occurrences and

' postulated accident conditions. It is-further contended that the lack of real-time printout capability!during accident conditions and the lack of sufficient-redundancy in the computer system place the public health and safety at significant risk during accident conditions, especially if~

computer function is lost.and no.

back-up unit is available. It is contended that until the Unit 1 computer system is upgraded to meet the standards of GDC 13 and until suitable redundancy is provided within the computer system to assure real-time printout capability at all times, permission for restart must be denied on the basis of risk to public health and safety due to inadequate availability of operational informa-tion to Unir 1 operators.

ECNP Contention

! No. 1(a): The plant computer for TMI-l is old, l obsolete, and inadequate to respond appropriately in emergency situations.

, During the accident at the adjacent l

TMI-2, the alarm printer on the similar computer at Unit 2 had a delay

time of over two and one-half hours at

( one point, and ran more than an hour t

behind events for over seven hours.

This delay cannot be viewed as having adequately served the needs of the operators of TMI-2, and there is no reason to believe that a similar accident situation, with as severe or worse consequences, cannot occur at TMI-1 and be severely aggravated by

-161-t

.. _ ., . _ _ . , , . _ _ _ , . - . _ . . . _ , _ . . , - . . . . . . . . . . . _ _ , _ . , . . . _ _ , _ . . _ _ . _ . , , . . . . . ~ . . . . . _ _ _ _ _ _ . _

slow and ambiguous computer alarm printer readings.75 236. Sholly Contention No. ~3 and ECNP Contention No. 1(a) imply that the TMI-l process computer is required in order to operate the plant safely and in conjunction with the concerns' expressed by the Staff in their human factors review of the ThI-l control room (see Staff Ex. 2 at 7), inquire generally into the adequacy of the TMT-1 plant computer system.

However, prior to judging the adequr;y of the computer to perform its intended functions, we must first examine the uses.

made of the computer.

237. Control room operators will normally utilize the plant computer during steady-state operations to perform certain nuclear calculations, such as heat balance, power level and power tilt and imbalance. It may also be used to obtain 75 At the August 12-13, 1980 prehearing conference, intervenors agreed to adopt a lead intervenor plan, whereby the party acting as lead intervenor would have the major responsibility for devel-oping cross-examination of the Staff's and Licensee's witnesses j and, where applicable, presenting direct testimony. With respect

to Sholly Contention No. 13 and ECNP Contention No. 1(a), ECNP agreed to act as lead intervenor.

Conference of August 12-13, 1980, atMemorandum and Order of Prehearing l

3. Two days prior to the date on which testimony on this issue was presented, the Board was informed by Mr. Sholly that representatives of ECNP would be l

unable to attend the hearing; Mr. Sholly, however, agreed to act as lead intervenor on these two contentions. Tr. 6942-43. Subsequently, the Staff and Licensee presented their witnesses on the capability of the TMI-l process computer; ECNP representatives failed to attend and avail themselves of the opportunity to cross-examine these witnesses and develop a record in support of their contention.

-162-t . . _ _ _ __ . .- - .- - -- -- -

the status of individual plant parameters. If the computer is-not available, alternate instrumentation or manual procedures are available and utilized by the operator in order.to perform these functions. Hamilton and Keaten, ff. Tr. 7397, at 3; Tr.

7418, 7441-42, 10,542 (Keaten).

238. The computer is also designed to record alarm conditions as they occur in the plant. This alarm record is output on printers at the speed of the printer. The alarm record is not used to direct operator actions, but as an historical record of plant activity. Hamilton and Keaten, ff.

Tr. 7397, at 5.

239. The TMI-1 computer system performs no control or safety functions. The functions. performed by the plant control systems, i.e., the ICS and ESF system, are totally independent from the computer system. ICS and ESF system status is monitored by the computer and is also displayed on the hard-wired annunciators. Hamilton and Keaten, ff. Tr.

7397, at 4.

240. During the course of cross-examination of the witnesses on this issue, and of the witnesses presented on the Control Room Design / Human Factors contentions, concerns were expressed regarding the extent to which operators might rely upon the computer during transient conditions. Initially, the Board notes that the type of information which the operator would normally access via the computer (see paragraphs 237-239, suora) is not the same type of information which the operator l

-163-l 1

I

I ould be seeking during an upset condition. Tr. 10,547-48 (Keaten), 10,588-89 (Prica).

241. In taking the immediate actions dictated by the plant emergency procedures during transient conditions, the control room operator would not rely on the computer, but would rely upon the hard-wired instrumentation on -the main control boards and upon the main alarm annunciators. Tr. 7413 (Keaten), 7479-80 (Joyce). This has been confirmed by the Staff in their human factors evaluations of TMI-l and other reactor control rooms. In conducting " walk-throughs" of emergency procedures, operators have not utilized, nor attempted to utilize, the plant computer to perform actions required by the emergency procedures. Tr. 7475 (Joyce),

10,550-51 (Ramirez).

242. Although the computer is not relied upon in determining immediate actions to be taken during a transient, it can provide helpful information to operations personnel during the later stages of the transient and in reconstrt -ting the historical record of the event. Hamilton and Keaten, ff.

Tr. 7397, at 4-6. For example, during the TMI-2 accident, the computer was accessed in order to verify readings received from hard-wired instrumentation, to monitor current plant informa-tion and, at a later point in the sequence, to obtain, in a convenient format, readings from diverse parameters. Hamilton and Keaten, ff. Tr. 7397, at 4, 5; Tr. 10,594-605 (Keaten, Walsh).

-164-

- ~ , - ,. , , - - , - , , , . . , , . , , , , , - - .------e,,-,,,-n,._,- , - - - ,, -,, . . . , , -

243. As an aid to the control room operator which is not required to mitigate design basis events, the TMI-1 process computer is not required to comply with General Design Criterion ("GDC") 13, nor is it required to provide the operator with information on a real-time basis in order to safel3 cope with plant conditions. Indeed, the Staff does not require licensees to install computer capability in order to meet any regulatory requirement. Joyce, ff. Tr. 7467, at 3, 4.

The requirements for plant instrumentation and control, as specified in GDC 13, are met at TMI-l by the hard-wired, safety-grade instrumentation. This instrumentation, in conjunction with other non-safety-grade, hard-wired instru-mentation, provides real-time information to the operator during normal, transient and accident conditions. The TMI-1 computer was designed to augment this hard-wired instru-mentation, and is not required for safe start-up, operation or shut-down of the plant. Hamilton and Keaten, ff. Tr. 7397, at 2, 8; Joyce, ff. Tr. 7467, at 3, 4. The Board, therefore, finds no basis upon which to require that the TMI-l computer must meet the criteria of GDC 13.

244. Having identified the types of functions which can be expected to be performed by the computer, we now address the specific concerns raised regarding the ability of the computer to perform these functions and the actions being taken '

by Licensee to upgrade the capability of the computer system.

-165-

- _ - - . _ _ . . ~ . _ - -

245. Licensee had recognized, prior to the TMI-2 accident, that advances had been made-in the area of computer capability which could assist the control room operator, and l had implemented a phased program to replace the current Bailey 855 computer with a state-of-the-art Mod Comp IV computer system. A portion of this program, the Mod Comp hardware installation and a portion of the extended software functions (high-speed storage and retrieval functions, reactivity functions, high-speed input and output, and nuclear calculation functions), was completed prior to the accident. The com-pletion of this program has been expedited, although it is thought that not all of the functions will be operational prior to restart. Hamilton and Keaten, ff. Tr. 7397, at 7, 8; Tr.

7454-55, 10,536-40 (Keaten). The new system, when fully implemented, will incorporate state-of-the-art computer advances and will be comparable, if not superior, to the computer systems being implemented at new reactors. Tr.

10,532-34 (Ramirez).

246. ECNP Contention 1(a) asserts that, during the TMI-2 accident, the computer alarm .,rinter ran too far behind current plant conditions to adequately serve the needs of the control rcom operators. The Staff, on the basis of its human factors review of the TMI-1 control room, also expressed concern about the speed of information output from the -

computer. Tr. 10,510-13 (Ramirez, Price). During a transient situation, alarms may occur at a rate faster than the printer

-166-t

,_ - , . . . _ _ . . - - - w ~ - - * -

can respond; ~ in such a situation, the alarm record is stored in the computer buffer memory and output as the speed of the printer allows. The buffer memory is capable of recording an alarm point every twelve and one-half milliseconds; therefore, while the printed alarm record may be lagging, there is never a lag in the recording of alarm data in the buffer memory.

l i

Further, at any point during a transient ~ sequence, the operator has the ability to call up a current alarm status on the CRT.

The TMI-2 operators chose not to utilize this function during the accident. Hamilton and Keaten, ff. Tr. 7397, at 5.

247. As discussed in paragraph 238, supra, the main

, purpose of the computer alarm record is to serve as an after-the-fact record of plant activity, not as a tool to direct operator actionc. Following a reactor trip, the operator would make essentially no use of this historical record, but would rely on his main annunciators. Tr. 7413 (Keaten). Therefore, a delay in obtaining the alarm record would not impact safe operation of the plant. Further, Licensee's witness Keaten testified that, based on discussions with the TMI-l control room operators, the speed of the computer (both the output devices and the computer itself) is perfectly adequate for the uses made of the computer. Tr. 10,542 (Keaten).

248. As part of its program to upgrade the TMI-1 computer system, Licensee has installed new printers which are able to output information at a faster rate than the Selectric printers which were in place at both TMi-1 and TMI-2 at the

-167-w .- w- ._ 7,-,-~ _ _ . - , _ _ ,w -.,_ . - -y,,. .,---w -y

time of the TMI-2 accident (150 characters per'second vs.aus 12 characters per second).76 The new printers are also less susceptible to mechanical failures due to paper characteris-tics, environmental changes and high usage. Ham 21 ton and Keaten, ff. Tr. 7397, at 6; Tr. 7404-05 (Hamilton).

249. The Staff's human factors .eview team has star.ed that the current CRT display is of poor quality in terms of its readability. Staff Ex. 2 at 7. Licensee has concurred that the CRT display is unsatisfactory from a human factors standpoint and will, prior to restart, either install one or more CRTs driven by the new Mod Comp system or, if difficulties

~are encountered in installing this portion of the Mod Comp system, upgrade the CRT driven by the existing Bailey 855 computer. Tr. 10,510-12 (Ramirez), 10,536-39 (Keaten).

250. The Staff's human factors review team also questioned the "reliab'lity" of the information presented to the operators. Staff Ex. 2 at 7. The Board and parties conducted extensive examination of Staff witnesses Ramirez and Price (see generally, Tr. 10,470-72, 10,509-18, 10,543-47, 10,554-57) in an effort to determine the exact basis of the Staff's concern. Essentially, the Staff's concern centered on 76 Licensee is in the process of developing plans for additional improvements to the printers. A new, high-speed line printer having a capability of printing either 300 or 600 lines per minute *

(essentially outputting the alarms on a real-time basis) is being considered for installation in the TMI-1 control room. Tr. 7452 (Hamilton); 10,539-40 (Keaten).

-168-k

-- -- .- . - , - ~ , , - - . - - - , - - . - , - - --

the speed and availability of information presented'to the operators, based on an apparent belief that the delay in outputting the information would lead the operators -to make inaccurate conclusions regarding plant status, and that the combination of the CRT, printers and process. computer may have presented inaccurate information. The Staff's concern does not appear to be based upon evidence that the actual data produced by the computer was in errrr. Tr. 10,543-45-(Price), 10,546 (Ramirez). However, as we have previously discussed (see, for example, paragraphs 241 and 247, supra), the control room operators do not rely upon the computer for operating direc-I tions and, therefore, the speed of the computer output, while not currently optimal, is adequate. In terms of the computer availability, Licensee's witnesses testified that, while certain portions of the equipment (i.e., one or more printers or the CRT) may have been occasionally out of service, the computer system as a whole has had a very high' availability and has seldom failed during plant operations. Hamilton and i

Keaten, ff. Tr. 7397, at 2; Tr. 10,343-44 (Walsh), 10,536-37 (Keaten).

251. To summarize the evidence presented, it has l been shown that: TMI-l meets the criteria of GDC 13 through i

the use of safety-grade, hard-wired instrumentation and controls, and the plant computer need not be qualified to this criterion; real-time information is available to the operators via the hard-wired instruments; the speed of the information i

j -169-e- . .r -.m, .,y ._. ,%,.,,.,em,v,,-m , ,,%,--.,-e- t* * *- - r -

i--*v-.--*- - ~ + - - mv- - - - ' - - -e--+w

4 output has been increased by the installation of new printers and is adequate to meet the needs of the operators; and, certain improvements will be made to the computer system prior to restart, and additional improvements will be made on a long-term basis thereafter. Therefore, the Board finds that the TMI-l computer system is sufficiently adequate to permit restart of the unit.

L. In-Plant Instrument Ranges Sholly Contention No. 5: It is contended that Licensee has not provided radiation monitoring instruments in effluent discharge pathways which are capable of remaining on-scale during i

anticipated operational occurrences, postulated accidents, and Class 9-accidents as specified in Contention #17.77 It is further contended that the insuf-ficiency in range of these instrwments prevents the Licensee from making suf-ficiently accurate predictions of the-quantities of radiation which are being.

released from TMI-1, and that this places the public health and safety at significant risk because such information is required by public officials and plant operators to provide the basis for decisions on the need

( for protective actions.

t It is further contended that protection of public health and safety requires that the 77 Mr. Sholly withdrew Contention No. 17 in a written memoran-dum dated December 23, 1980. Therefore, the Board, in consider-ing Sholly Contention No. 5, does not address the capability of-the radiation monitoring instruments to remain on-scale for the specific scenarios described in Sholly Contention No. 17, but examines generally the ranges in which these instruments will

, function.

l

-170-

, _ , _ _ _ , . _ ,, , - -r-- A---+0' -- *~~w'- 'Y

' ' " " ' ~ ' ' " ~ " '

-I

high-range eff1'uent monitoring system be I installed prior to Restart of TMI-1, and that the high-range effluent monitoring system be capable of. remaining on-scale q under conditions specified in this '

contention.

ECNP Contention No. 1(d): The TMI-2 accident showed that many monitoring instruments were of insufficient-indicating range to' properly. warn control room operators of ambient conditions. For example, the " hot-leg" thermocouples went off-scale at 620*F and stayed off-scale for over 8 hours9.259259e-5 days <br />0.00222 hours <br />1.322751e-5 weeks <br />3.044e-6 months <br /> for reactor coolant loop A and about 13 hours1.50463e-4 days <br />0.00361 hours <br />2.149471e-5 weeks <br />4.9465e-6 months <br /> for reactor coolant loop B. A higher temperature limit would have provided impor. ant information to the reactor operators. This situation is unchanged at TMI-1. All monitoring-instruments for TMI-l must be calibrated to provide full and accurate readings of the complete range of possible conditions under both normal and worst-case conditions.

In addition, it is reported that the radiation monitors went off-scale during the TMI-2 accident. It should be noted here that this eventuality was predicted in 1974 by the TMI-2 Intervenors, but dutifully denied by.

the NRC Staff and the Applicant during the TMI-2 licensing hearings.

Needless to say, the TMI-2 Licensing Board accepted the assurances of adequate monitoring offered by the l- Staff and Applicant. Yet a similar i

situation still exists at TMI-1. All radiation monitoring equipment must be capable of recording the maximum c possible releases of radiation in the l

event of a worst-possible accident (Class 9) in excess of Design Basis Accidents.78 I

! 78 During the Special Prehearing Conference session of

November 10, 1979, ECNP limited Contention 1(d) to all l

important safety-related monitoring instruments and to important safety-related radiation monitoring equipment. In our First Special Prehearing Conference Order, the Board l (continued next page)

-171-l L ..

252. Prior to examining the substantive issues raised by these two contentions, the Board is compelled to discuss in this Initial Decision the effect of ECNP's lack of participation in developing a full record on the adequacy of the in-plant instrument ranges. As with the Computer conten-tions (see n.75, supra), ECNP had agreed to act as lead intervenor on Sholly Contention No. 5 and ECNP Contention No.

1(d), but failed to notify the Board and parties until shortly before this issue was scheduled to be heard that its represen-tatives would be unable to attend the hearing sessions on these contentions. Tr. 6942-43.

253. Upon learning of ECNP's intentions, Mr. Sholly and counsel for the Commonwealth Leviewed the direct testimony pre-filed by the Staff and Licensee and identified only limited areas on which they would cross-examine Licensee's witnesses with respect to Sholly Contention No. 5, dealing with radiation monitoring. Neither Mr. Sholly nor the Commonwealth had any examination on the distinct issues raised in the first para-graph of ECNP Contention No. l(d), nor did they believe it was (continued) further limited the scope of the first paragraph of this contention to core cooling nd containment isolation systems and rejected the references in both paragraphs to " worst-case" and " worst-possible" accidents. LBP-79-34, 10 N.R.C. 823, 844 (1979). The Board provided additional specificity to ECNP Contention 1(d) by our June 12, 1980 Memorandum and Order on l Licensee's Motion for Sanctionu Against Environmental Coalition -

i on Nuclear Power, LBP-80-17, 11 N.R.C. 893 (1980), wherein we limited this contention to the instrumentation addressed in ECNP Contention No. 1(c), i.e., Class lE control room instrumentation needed following a feedwater transient and small break LOCA, 11 N.R.C. 893, 905.

i l

l -172-l l

necessary to have any of the Staff witnesses who sponsored testimony in response to these two contentions appear for cross-examination. Tr. 7055-61, 7218.- The Board also reviewed the pre-filed testimony and determined that, while we would have no examination of the Staff's witnesses, the Staff and Licensee's testimony in response to our. modification of L NP Contention 1(d) (see n.78, supra) should be placed in the hearing record. Tr. 7219. Although ECNP failed to effectively prosecute its Contention 1(d), and no examination was conducted of Licens'ae's witnesses on the distinct issues raised by ECNP Contention No. 1(d), the Board does consider below the adequacy of the ranges of the instrumentation needed following a feedwater transient and small-break LOCA.

254. Sholly Contention No. 5 and the second para-graph of ECNP Contention No. 1(d) assert that the radiation monitoring systems used at TMI-1 must be capable of remaining on-scale for anticipated operational occurrences and transient l conditions. Radiation monitoring syste'S used at TMI-l can be classified as follows: gaseous effluent monitors (which include radiciodine and particulate monitoring instruments);

liquid gasecus effluent monitors; and, area radiation monitors.

l The capability of these instruments are addressed seriatim i

below. We also consider the radiation monitoring of spaces outside containment which could contain LOCA fluids. -

t 255. During the initial phases of the TMI-2 acci-dent, the ncble gas readings from the main plant gaseous

-173-l l-

\

l l

effluent monitor were off-scale; actual release concentrations have been estimated to-have been on the order of 1 uCi/cc.

Subsequently, as part of its TMI-2 Lessons Learned review, the Staff has required all licensees to increase the range of their noble gas effluent radiarion monitors. .Stoddart-1,79 ff. Tr.

7548, at 4-6.

256. Licensee has committed to install, prior to restart,80 supplemental high-cange radiation monitors for the gaseous effluent discharge paths at TMI-1, in accordance with the requirements of Item 2.1.8.b of NUREG-0578. The radiation monitors installed at the time of the TMI-2 accident for the condenser off-gas, auxiliary and fuel handling building exhaust and containment exhaust pathways were capable of monitoring noble gas concentrations of up to 10 -1 uCi/cc; the main steam line discharge path was not equipped with a gaseous effluent monitor. The supplemental extended range monitors will be 79 NRC Staff Testimony of Phillip G. Stoddart Regarding Capacity of Radiation Monitoring Equipment for Containment, Effluent Discharge Paths and Plant Environs (Sholly Contention

5) and (ECNP Contention 1(d), in part) ("Stoddart-1").

80 NUREG-0737 relaxed the implementation date for the in-stallation of the long-term radio-effluent monitors required by item II.F.1 until January 1, 1982. Licensee expects to have the extended range gaseous effluent monitors and radiciodine instrumentation installed prior to restart; however, if Licensee becomes unable to install this final monitoring equipment prior to restart, the Staff will assure that acceptable interim methods, procedures and evaluations are sub- ,

mitted and reviewed prior to restart. Staff Ex. 14 at 40-42; see also, Ross, ff. Tr. 15,555, Table 2; Lic. Ex. 1 at 2.1-46 to 2.1-48.

-174-

- -,- -m- ,. ,, ,-- - - - , ,w =-r ,r --w- - + - ,

l l

l capable of measuring noble gas concentrations up to 105 uCi/cc in the condenser off-gas and containment exhaust pathways, and up to 10 3 uCi/cc in the auxiliary and fuel handling building exhaust and main steam line discharge parths. Broughton et al., ff. Tr. 7509, at 4.

257. As noted in paragraph 255, supra, the noble gas releases during the TMI-2 accident were thought to have been approximately 1 uCi/cc; therefore, the new, extended range monitors will be capable of measuring noble gas release rates of at least a factor of 10 3 times greater than that experienced during the TMI-2 accident. Broughton et al., ff. Tr. 7509, at

5. The Staff has reviewed Licensee's design for the extended range gaseous effluent radiation monitors and has concluded that the design meets the Staff's preoperational requirements and is therefore acceptable. The Staff will review the installed equipment and associated operating procedures prior to restart. Staff Ex. 14 at 42.

258. The range of the previously existing gaseous effluen; radiation monitors is suitable for monitoring an-ticipated transients and tne postulated accidents analyzed in the TMI-1 Final Safety Analysis Report (FSAR). The extended range monitors will be able to provide accurate estimates of off-site radiation releases for anticipated operational occur-rences and for accidents significantly beyond those analyzed in the FSAR. Broughton et al., ff. Tr. 7509, at 3-5. The new monitors are capable of measuring noble gas concentrations

-175-

.. = .

equivalant to the source term of Regulatory Guide 1.4, which assumes a 1G0% release of the noble gases from the core. ' Tr.

7520-21 (Willems). By comparison, the TMI-2 accident is estimated to have released from the core only 40 to 50% of the

core noble gases. Stoddart-2,81 ff Tr. 7548, at 3.

259. The TP!-l liquid effluent discharge path from the plant is through the plant discharge line to the river.

This discharge line is monitored by a continuous liquid monitor. In addition, the principal source of radioactive effluent to the discharge line, the liquid waste disposal system, is separately monitored and automatically isolated whenever pre-established limits are exceeded. These monitors are designed to provide adequate sensitivity and rance for I

releases associated with normal operation and anticipated operational occurrences. Broughton et al., ff. Tr. 7509, at 4, 5.

The Board notes that no assertions have been made that the liquid effluent monitors failed to adequately perform their function during the TMI-2 accident.

260. The TMI-l containment building atmosphere is currently monitored for normal operation and anticipated i

operational occurrences by three Area Gamma Detectors. A wide-range Area Gamm Monitor (capable of monitoring concentrations 6

up to 10 R/hr),' located in the reactor building, provides t

81 NRC Staff Testimony of Phillip G. Stoddart Regarding Capacity of Radiation Monitors in Containment (In part, ECNP Contention 1(d)) ("Stoddart-2").

i l -176-s v , e,,- - +-c= 7 ye.e. y -+----n-,,<+w, ,py e- ve ,,, s,, --ye v.-, y -w

--w9 --.-,,-y -,q, +.a-. - + - e w - --y-4

information on post-accident conditions. Additionally, pursuant to the long-term requirements of Item 2.1.8.b. of NUREG-0578, Licensee will install, in accord with the~ schedule set forth in NUREG-0737 for all operating reactors (currently January 1, 1982; but see section II.T, infra), two additional safety-grade, high-range, post-accident Area Gamma Detectors in the reactor building.82 Broughton et al., ff. Tr. 7509, at 9; Stoddart-2, ff. Tr. 7548, at 3; Tr. 7523 (Willems); see also, Staff Ex. 14 at 41.

261. The two additional in-containment monitors, which will be provided with readout and recording displays in the control room, will be capable of monitoring radiation concentrations up to 10 7 R/hr and will detect' low-energy photon radiation down to 60 Kev. Lic. Ex. 1, S 2.1.2.1.1. The upper range capacity of these detectors is adequate to measure an instantaneous 100% release of all TMI-l reactor core noble gases, accompanied by a release of 25% of the core radioiodines. This capacity is well in excess of the releases experienced at TMI-2 (40 to 50% of the cor.e noble gases and.a small fraction of the radiciodines). The design of the in-containment, wide-range monitor installed at TMI-2 at the time of the accident was not responsive to much of the low I

82 The Board notes that., unlike the gaseous effluent radiation '

l monitors, the TMI-2 wide-range containment building monitor did l not go off-scale during the TMI-2 accident. Stoddart-2, ff. Tr.

l 7548, at 3.

l

-177-

energy radiation that was present. Thus, the new monitors' ability to detect low energy photon radiation will provide assurance of the capability to accurately measure in-containment radiation while staying on-scale. Stoddart-2, ff. Tr. 7548, at 3, 4.

262. The Staff has reviewed Licensee's design for the new wide-range containment building monitors and has concluded that Licensee has made reasonable progress in meeting the long-term requirements of this item. The Staff has taken exception, however, to Licensee's proposal to locate these two monitors adjacent to each other and has recommended that Licensee must widely separate the monitors in order to fully meet this requirement. Staff Ex. 14 at 41. The Board concurs that Licensee's actions constitute reasonable progress; we leave it to the Staff to appropriately resolve with Licensee the issue of the separation of these monitors.

263. The release of radiciodine and particulate matter is continuously monitored for each release point at TMI-1 and is indicated and recorded in the control room. This

) type of direct reading is suitable to monitor reutine releases during normal operations; however, in a TMI-2 type accident, i such direct measurements can be interfered with by a number of factors. Therefore, under accident conditions, the only practicable method of measuring radiciodine and particulate "

concentrations is to remove the sample media te a high level radiation measurement facility for an analysis of the sample media. Stoddart-1, ff. Tr. 7548, at 5; Tr. 7519 (Dubiel).

-178-

4 264. In recognition of the impracticality of obtaining accurate radiciodine and particulate measurements via a direct monitor, the Staff, in Item 2.1.8.b of NUREG-0578, required all licensees to develop the capability to collect and analyze samples of radioactive iodines and particulates in plant gaseous effluents during and following an accident.

Licensee has committed to install, prior to restart,83 three additional sampling stations and to expand the capability of the sampling system by the addition of silver zeolite sample cartridges. The cartridges will be analyzed by a sodium iodide detector connected to a single or dual channel analyzer (with '

settings appropriate for the gamma energy' levels associated wita I-131), or by use of an intrinsic germanium detector in conjunction with a multi-channel' analyzer. Additionally, for very high levels of radioiodines and particulates, i censee has the capability of performing a dose rate calculation at a specific distance from the cartridge by analyzing the radiation release related back to the number of curies or microcuries on the cartridge. Lic. cx. 1, S 2.1.2.1.1; Tr. 7512-17 (Dubiel).

265. The expanded sampling system will have the capability of monitoring radiciodine and particulate concen-trations up to 102 uCi/cc; this value is a factor of more than 100,000 times greater than the radiciodine and particulate releases observed during the TMI-2 accident. The range of the 83 See n. 80, supra.

-179-I

expanded sampling system provides on-scale capability for any conceivable accidant. Stoddard-1, ff. Tr. 7548, at 7. The Staff has reviewed Licensee's proposed design and procedures for the expanded sampling system and has concluded that Licensee is in compliance with the Staff's preoperational requirements. Staff Ex. 14 at 42.

26G. Components needed for the recirculation of LOCA fluids are located in the TMI-1 containment and auxiliary buildings. The capacity of the in-containment radiation monitors is discussed at paragraphs 260 and 261, supra. The components located in the auxiliary building are shielded by concrete and access to these areas is controlled. These 4

shielded areas are monitored for radioactive particulates, iodine and noble gases during normal operation, anticipated occurrences and accident conditions by the radiation monitors in the auxiliary building ventilation system (see paragraphs 256 and 263, supra). A high radiation signal from these monitors results in automatic isolation of the auxiliary building ventilation system or the waste gas disposal system.

Additionally, radiation in the vicinity of, but external to, the shielded spaces is monitored by the Area Gamma Monitors.

The Staff views these methods of monitoring spaces containing LOCA fluid recirculation components as acceptable and sat-isfying the requirements of General Design Criterion 64.

Broughton et al., ff. Tr. 7509, at 10; Stoddart-1, ft. Tr.

7548, at 6.

-180-

> - , - -~ ~g. m-- -,w e - ' ,m- - - , y -r

267. Based upon our review of the evidence presented, the Board finds that, with the modifications being implemented by Licensee, the systems for monitoring radioactive concentrations at TM-1 have sufficient capability for accu-rately measuring radioactive concentrations during-accident conditions in excess of those experienced at TMI-2 and that the monitor readings will remain on-scale for such events.

268. The Board now turns to the consideration of the distinct allegations of ECNP Contention 1(d), not relating to radiation monitoring capability. As discussed in n.78, supra, the Board, in previous rulings, defined the scope of this portion of the contention as questioning the range of Class 1E control room instruments for the core cooling and containment isolation systems needed following a feedwater transient and small-break LOCA. Licensee and the Staff, in their pre-filed testimony, did not limit their responses to Class 1E equipment, but chose instead to address the adequacy of the instru-mentation used to monitor core cooling and containment isola-tion status.

l 269. ECNP Contention No. 1(d) asserts that inaccu-I rate instrument readings caused important information not to be available to the operators, citing the TMI-2 hot leg tempera-ture indications which went off-scale at 620*F.84 However, the The hot leg temperature instruments are being modified to 84 indicate temperatures from 120* to 920*F. Broughton et al.,

ff. Tr. 7509, at 8.

l -181-

- , - - , , , - ~ - - - + - - , , , , , , - , --_ ,. .-

,. -, , ,e, ,, ,q , w n .-- ,. .-.. ,

, Board notes that, at RCS pressures below 1000 psig (the stabilized pressure following the early sequence of events at TMI-2), temperatures above 550*F indicate superheated condi-tions. Therefore, adequate indications of superheated steam in the RCS were available to the operators, despite the hot leg

. temperature indicators being off-scale high. Further,' reviews of the TMI-2 accident have concluded that sufficient informa-tion was available to indicate deteriorated-heat transfer conditions, voiding and inadequate RCS water inventory.

Broughton et al., ff. Tr. 7509, at 7.

270. Following a feedwater transient and small-break LOCA, operator action is not necessary to initiate containment i

isolation. The operator need only verify that the containment isolation valves are closed. Jensen et al., ff. Tr. 7548, at 12 (Hearn). As discussed'in paragraphs 289 and 290, infra, Licensee has verified that the control room indications.for containment isolation valve position are based upon direct valve position indicators and therefore would not provide misleading information to the operators.

1 271. The adequacy of the instrumentation relied on 4

by the operators to determine whether the core is being adequately cooled is discussed in detail in section II.B, supra. The Board will briefly discuss here the sufficiency of the ranges of these instruments. Essentially, the instruments

• needed to monitor core cooling are the in-core thermocouples, hot leg and cold leg temperature sensors, hot leg pressure

-182-

$ R*

• sensors and the subcenling meter. The Staff has compared the ranges of these instruments to the information needed by the operator and has found the ranges to be sufficient to allow the operator to determine if the RCS is subcooled, saturated or super heated. Jensen et al., ff. Tr. 7548, at 7, 9-10 (Jensen).

272. In addition to monitoring core cooling, the operator murt take the following actions following a small-break.LOCA (whether or not preceded by a feedwater transient):

trip the reactor coolant pumps when the RCS pro 5sure decreases to the 1600 psig ESF initiation setpoint; maintain / adjust HPI flow to assure 50*F subcooling; and, increase steam generator level to 95% (oper'ating range) by the addition of emergency feedwater. RCS pressure is continuously indicated and recorded in the control room;-further, ESF initiation is annunciated on-the alarm panel, thereby providing the operator with both visual and audible indication of RCS pressure. The subcooling meter hcs a range of 100*F superheat to 400*F subcooling ar.d is therefore more than sufficient to monitor 50*F subcooling. The level sensors for the steam generators range from 0 to 600 inches; 95% of the operate range corresponds to 380 inches of water, well within the range of the level sensors. Jensen et al., ff. Tr. 7548, at 10, 11 (Jensen).

273. In view of the foregoing evidence, and in consideration of our findings in sections II.B and II.M, the Board concludes *that the instrumentation available to the

-183-w -

r- w- -,p+--9 -g -,m-- ,i--,+ w +9 ,,.%- rc.:.- p y , . , , - - . . . . -p-,,--~ +,---ww--..<. --wm y-.,-.w,,--,

i control room operators in order to monitor core cooling and containment isolation following a small-break LOCA is of sufficient range to assure that the operators are provided with the information needed to operate the plant safely.

M. Safety System Status Panel Board Question /UCS Contention No. 9: The accident at TMI-2 was sub-stantially aggravated by the fact that the plant was operated with.a safety system inoperable, to wit:

two auxiliary feedwater system valves were open.

closed which should have been The principal reason why this condition existed was that TMI does not have an adequate system to inform the operator that a safety system has been deliberately disabled. To adequately protect the health and safety of the public, a system meeting the Regulatory Position of Reg. Guide 1.47 or providing equivalent protection is required.85 ECNP Contention No. 1(c): The electronic signals sent to'the control room in many cases record the wrong parameters and may, thereby, mislead the reactor operator. For instance, in the case of the Electromatic

, 85 In our First Special Prehearing Conference Order of December 18, 1979, we limited the scope of this contention to the core cooling and containment isolation systems. 10 N.R.C. 828, 836 (1979).

By letter dated January 5, 1981, UCS withdrew its sponsorship of this contention. The Board then adopted UCS Contention No. 9 as its question and ,

ordered Licensee and the Staff to prese t their witnesses on this contention. Tr. 9434. UCS dic not present its pre-filed direct testimony on this issue, or appear to cross-examine the witnesses for Licensee and the Staff.

-184-w- -r-- - ,r- n - . . - - - - - , -

l I

Relief Valve ("ERV", the Metropolitan Edison designation is RC-RV2), the  !

, signal sent to the control room to indicate a closure of this valve indicates only the electrical ener-gizing of the solenoid which closes the valve, not the actual physical valve closing its21f. This misleading signal aggravated the. accident at TMI-2. There is no reasonable assurance that this same problem, or comparable ones, cannot arise many times over at TMI-1.

It is the obligation of the Suspended Licensee to provide sufficient information on the performance capability of all pertinent components of the control system to reasonably ensure that electronic signals will record, accurately and in a timely manner, all necessary and correct parameters.86 274. It is appropriate, initially, to address'the allegation raised in UCS Contention No. 9 which apparently served as the basis for this contention, i.e., the assertion that the TMI-2 accident was "substantially aggravated" by the l

86 In accepting ECNP Contention 1(c), we limited this Contention to (1) those signals sent to the control room, i

and (2) the core cooling systems and containment isolation systems and observed that this contention is parallel to and complementary to UCS Contention No. 9. First Special Prehearing Conference Order, 10 N.R.C. 828, 844 (1979).

! In our June 12, 1980 Memorandum and Order on Licensee's l Motion for Sanctions Against Environmental Coalition on Nucl. ear Power, the Board further reduced.the scope of ECNP Contention 1(c) to the adequacy of the Class lE con-trol room instrumentation following a feedwater transient and small break LOCA. LBP-80-17, 11 N.R.C. 893, 905 (1980). ~

ECNP presented no testimony on this issue, nor did its representatives even appear at the hearing to participate in cross-examination of the witnesses presented by the Staff and Licensee.

i

-185-e

fact that two EFW valves were closed which should have been open. Rather, as shown by analyses performed by Licensee and other invest tatory groups, the unavailability of EFW for a short period at the beginning of the accident had no signifi-cant el cc on its outcome. Nominal steam generator design conditions were achieved twenty minutes after reactor trip (or approximately twelve minutes following discovery of the closed EFW valves); plant conditions following this time were no different than they would have been had EFW been available from the onset of the transient. Core damage did not occur until approximately 100 minutes following reactor trip, after the reactor coolant pumps had teen tripped -- well after the time EFW was restored. Walsh and Toole, ff. Tr. 9840, at 2-4. We therefore reject this hypothesis advancej;by UCS, but proceed to examine the substantive allegations in the contention.

275. The control room operator at TMI-l is informed of the operability of safety systems through a variety of means, including both electronic displays and administrative controls. The existing automatic indicators (described in paragraphs 276 and 277), in conjunction with the additional administrative controls being implemented by Licensee (described in paragraphs 278 through 282) will serve to verify the operational readiness of systems important to safety.

Walsh and Toole, ff. Tr. 9840, at 5.

276. The main control console in the control room incluces indicating lights for the Engineered Safety Features

-186-9

Actuation System (ESFAS), which indicate whether the high 4

, pressure injection (HPI) and low pressure injection (LPI) systems are enabled and whether the actuation bistables are reset or bypassed. These indicators are supplemented by annunciators which, in the event that either of these actuation systems is disabled, provide information to the operator on the i

nature of the 6inabling condition (i.e., indicating "not reset,' "not bypassed," or "ES actuation trouble"). Additional annunciators are also available to inform the operator if the core flood tank isolation valves, a component within the emergency core cooling system, are in an off-normal configura-tion. Nalsh and Toole, ff. Tr. 9840, at 4, 5.

277. The TMI-1 control room is also equipped with an "ES Status Panel," a dedicated control panel that automatically indicatas the status (actuated /non-actuated), by means of color coded display lights, of all individual components which are required to start upon receipt of an ESFAS signa _. Walsh.and Toole, ff. Tr. 9840, at 5; Tr. 9865-66 (Toole), 9869 (Walsh).

For example, if the LPI system were actuated by an ESFAS signal, the display lights for the LPI pumps would c.".ange from yellow to blue, indicating that the pump had reached the 1

position needed to support an ESFAS actuation. Tr. 9869 (Walsh). Thus, by monitoring the display. lights, the operator is able to determine any exception to an automatic ESFAS .

actuation.0 Walsh and Toole, ff. Tr. 9840, at 5.

87 See also paragraph 321, infra, for a description of-modifications being made to the ES Panel.

-187- '

I

4 278. At the end of each eight-hour shift, the off-going control room operator and'his shift foreman complete the Engineered Safety Features (ESF) Checklist, which docur ents the readiness of the ESF and emergency feedwater (EFW) system components by verifying the control room valve position and control switch positions for these systems. Walsh and Toole, ff. Tr. 9840, at 5; Tr. 9858 (Toole); Boger, ff. Tr. 9893, at

7. The oncoming licensed operators are required to. sign the checklist, verifying that they understand the condition of the '

plant and are aware of the status of all safety-related systems. Walsh and Toole, ff. Tr. 9840, at 5; Boger, ff. Tr.

9893, at 7; Tr. 9858-59 (Toole).

279. The proper positioning of critical valves in the ESF and EFW systems is assured by either physically locking these valves in the position needed to support a system actuation, or by placing the valve under routine surveillance to verify correct positioning. Those valves which are locked into position are also visually inspected at defined intervals j (based on their importance and frequency of use) to be certain 1

they are still locked in the correct position. Additionally, for those valves equipped with manual overrides, the overrides

l are either locked or the manual override status is routinely

! checked by an Auxiliary Operator as part of his shift log sheet

, entries. Walsh and Toole, ff. Tr. 9940, at 5; Tr. 9871 (Toole). For those ESF and EFW valves located in the main flow path and whose position is not indicated in the control room,

{

-188-

, , - ee, , - - - - -,r., - - . , . _ , - . . - - - - --

i Licensee has instituted a procedure whereby these valves will be checked at defined frequencies (on a shift or daily basis, depending on~ location) to assure correct positioning. Walsh and Toole, ff. Tr. 9840, at 6; Tr. 9848 (Toole).

280. Item 5 of Inspection and Enforcement Bulletin- i a

79-05A required all licensees to "... review all safety-related valve positions and positioning requirements to assure that 4

, valves are positioned (open or closed) in a manner to ensure-the proper operation of engineered safety features...". The Staff, in its review of Licensee's compliance with this requirement, found that the procedural controls being imple-

mented ensure that proper valve positions in safety-related .

systems are consistent with the process flow diagram and are maintained in proper position during power operations and following maintenance and testing. Boger, ff. Tr. 9893, at 6; I

Staff Ex. 1 at C2-5. As an additional method of ensuring that valves in ' safety-related systems have been properly positioned, i

Licensee will, prior to restart of the unit, perform a complete review of the safety-related system valve lineup to verify valve position in accordance with the systems' operating

! procedure lineup checklist. The Staff will perform an indepen-dent verification of.this valve lineup to ensure proper positioning of all safety-related valves. Subject to perfor-1 i

ming this verification, the Staff has determined that Licensee ~

is in compliance with Item 5 of IE Bulletin 79-05A. Boger, ff.

Tr. 9893, at 5, 6; Staff Ex. 1 at C2-6.

-189-L

_ , _ . _ . _ _ _ _ _ - - ~ ~ . - --- - - - - - - - - - * - " ~ ~ ~ ~ ~ ~ ' " " ~ " ~ ~ ~ ~

281. Licensee has also revised its procedures to assure that, prior to and following the performance of surveil-lance testing and/or maintenance, all components in the ESF and EFW systems affected by testing or maintenance are in the proper positicn. Prior to taking a system out of service for testing or maintenance, the operator must verify that compo-nents in the redundant system are in position to support a system actuation. Following completion of the required activity, the operator who performed the test or maintenance must verify that he has restored the components to',their proper position; a second operator would then perform an independent verification that all components manipulated or affected by the activity are in the proper position to support system actuation. Walsh and Toole, ff. Tr. 9840, at 6; Boger, ff. Tr.

9893, at 8-11; Tr. 9857-58 (Toole). Further, knowledge that a safety system has been taken out of service is assured by Licensee's revised " tagging" procedures, which require the Shift Foreman to approve the performance of surveillance testing on safety-related systems and to approve all appli-cations for the removal from or return to service of these J

systems. Additionally, control room log entries (which are reviewed by oncoming shift personnel) must be made when I

equipment required by the Technical Specifications is taken out of or returned to service, the:reby assuring that the operators will be alerted to changes in the status of this equipment.

Boger, ff. Tr. 9893, at 4-5, 9-10; Staff Ex. 1 at C2-7, 8.

-190-t e ,, v -c -n ~ ..-,,n, -

-y--,,. . . . , , , , - . - . . , , . , , ,,,, , , - , e, _ , - . - - , - - , , , -

282. Item 10 of Inspection and Enforcement Bulletin 79-05A required all licensees to:

Review and modify as necessary your maintenance and test procedures to~ ensure-that they require:

a. verification, by inspection, of the operability of redundant safety-related systems. prior to the removal of any safety-related system from service;

b. verification of the operability of all safety related systems when they are returned to service following maintenance or testing; and,

c. a means of notifying involved reactor operating personnel whenever a safety-related system is removed from and returned to service.

In determining Licensee's compliance with this item, the NRC

+

Staff reviewed the administrative controls described in paragraph 281, supra. The Staff has verified that these administrative controls satisfy, and are in compliance with, the requirements imposed by this item. Staff Ex. 1 at C2-7, 8; Boger, ff. Tr. 9893, at 3-5.

283. The major thrust of UCS Contention No. 9 is that Licensee's methods of determining the operability of rafety systems is inadequate in that they do not meet the regulatory position of Regulatory Guide 1.47. Regulatory Guide 1.47 was issued in May, 1973; only those plants whose construc-i tion permits were granted after that date are required to comply with the provisions of Regulatory Guide 1.47. Further, no action has been taken by the Staff to backfit this regula-tory guide to plants not originally subject to its provi-sions.88 - Since the granting of the construction permit for l 88 This matter is currently under Staff review. See

n. 90, infra.

-191-

._ = _

i TMI-1 predates the issuance of Regulatory Guide 1,47 by five years, TMI-1 is not required to comply with.its previsions.

Su111 van-1,89 ff. Tr. 9894, at 3.

284. Regulatory Guide 1.~47 was develdped on the basis of experiences at operating reactors, which showed that the then-current administrative procedures used'to inform operators that a safety system was inoperable or bypassed went only to the operability of a specific component within the system, without a direct indication of system operability available to the operator. Su111 van-1, ff. Tr. 9893, at 2, 3.

Regulatory Guide 1.47 would require that system status be indicated to the operator via continuous automatic visual indication, supplemented by alarms. - However, continuous automatic indication provides no guarantee that the operator

)

will recognize and maintain awareness of the abnormal configu-rativn; therefore, administrative controls would still have to

be depended on and would require the operator to overtly note system status on a status list or record system. Walsh and l Toole, ff. Tr. 9840, at 7.

i l 285. The administrative controls being implemented by Licensee, in conjunction with the present automatic dis-plays, provide the operator with sufficient information to determine the operability of plant safety cystems. The 89 NRC Staff Testimony of Donald F. Sullivan Regarding

, Bypass and Inoperable Status Indication (UCS Contention 9) l ("Sullivan-1").

-192-

.. . r ,. -.,,._--,,.y,-, _.,m._ . , . - , , . - _ _ ., ,,._-.~..-,--,-c. _.y---., .-, ~ - - - - . ~- ,y.- -

J administrative controls described in paragraphs 278 through 282, suora, inform the operator of safety system (not just component) status on a periodic basis (i.e., at the beginning and end of each shift), as well as each time a safety system becomes unavailable due to testing or maintenance, and require that the operator acknowledge that a safety system is disabled.

Walsh and Toole, ff. Tr. 9840, at 7; Boger, ff. Tr. 9893, at 8.

Thus, the administrative controls provide a more effective' means of keeping the operator actively involved in determining, and therefore aware of, current plant conditions. Tr. 9,46 8

(Walsh). Both the Staff's and Licensee's witnesses agree that the administrative controls provide a functional equivalent to 2

Regulatory Guide 1.47 in terms of the operators' knowledge of

system availab'lity. i Tr. 9848 (Toole), 9894-95 (Boger).

286. Neither Licensee nor the 'tR2f have performed a detailed evaluation of the backfitting actions which would be necessary for TMI-1 to comply with Regulatory Guide 1.47.

However, Licensee's witnesses testified that the implementation-4 of a status panel meeting the requirements of this regulatory guide would require extensive hardware modifications to the plant, would increase the complexity of indicators to which the operator must respond, and would still require the operator to continue to rely on administrative, controls. Tr. 9843-46 (Toole, Walsh). Staff witness Sullivan, while unable to -

comment upon the need for hardware modifications, agreed that administrative controls would still be required. Tr. 9897 (Sullivan).

i

-193-e r ,- , - -- , + . ~ . -,%, ,-w.---, e -.r.. . , .-,,,.--,----.,--+---,c - m m-, v --, - -r--. -- - , ,-t -v -"w'

6 287. Pending any decision on backfitting Regulatory Guide 1.47,90 the Staff has required all licensees and appli-cants to upgrade their administrative controls for monitoring and verifying system status. Item I.C.6 of NUREG-0660, as clarified by NUREG-0737, " Clarification,of TMI Action Plan Requirements," requires review and revision, as necessary, of procedures to assure that an effective system of verifying the correct performance of operating activities is provided at each reactor. Included within this item are requirements that operators be informed of changes in equipment status and the effects of such changes, and that independent verification be made of system alignment following return-to-service. The NRC Office of Inspection and Enforcement will review Licensee's compliance with this item prior to restart. Boger, ff. Tr.

9893, at 3; Tr. 9908-09 (Boger). This requirement, in combina-tion with previous requirements imposed by the_ Staff (see, paragraphs 280 and 282, suora, and Staff Ex. 1 at C8-54, 55),

serve to verify the adequacy of the administrative controls implemented by Licensee to monitor system status.

288. Based upon ou' review of the evidence pre-sented, and in specific response to the concerns expressed in 90 The Staff has been directed (by Item I.D.3, NUREG-0660, "NRC Action Plan Developed as a Result of the TMI-2 Acci-dent") to study the need for all licensees and applicants to implement an automatic status monitoring system similar

, to that prescribed by Regulatory Guide 1.47. This study is l not expected to be completed until 1982 or later. Boger, i ff. Tr. 9893, at 2.

-194-i=, -e ,, . - - - - - -,g _ . a-~i-- - - - - - -

y ~p,-- , - --- -a

UCS Contention No. 9, the Board finds that the administrative controls being implemented by Licensee, in conjunction with its currently-existing automatic monitoring capability, are sufficient to provide reasonable assurance that the TMI-1 operations personnel are informed of the operability of those safety systems needed to respond to plant upsets. Further, in view of testimony presentc/ that Licensee's methods of moni-toring system status are functionally equivalent to Regulatory Guide 1.47 and, in fact, result in greater operator recognition of plant status, and in recognition of the Staff's generic program to examine the need to require backfitting of Regula-tory Guide 1.47, we find that tk.ere is no basis upon which to i

order Licensee to install, at this time, an actomatic moni-toring system such as that proposed by Regulatory Guide 1.47.

289. We now turn to consideration of ECNP Contention No. 1(c), which alleges that signals sent to the control room record incorrect core cooling and containment isolation system parameters and may lead the control room operator to take l

improper actions, citing the TMI-2 PORV position indicator as l an example of such a misleading signal. Licensee has performed i

i l

a review of signals sent to the control room for the EFW, ECCS l and containment isolation systems and has found no position indication that could mislead the operator by a demand indica-tion (similar to the TMI-2 PORV signal) rather than direct l position indication. Walsh and Toole, ff. Tr. 9840, at 9.

i l

290. Position indication for valves in the EFW, ECCS and containment isolation systems were verified by Licensee to

-195-12 -e ,- , ss, er_.-- - ..--g , . . , - . -p. v.-., r--. - , , ,- - y r.,-,

derive from limit switches driven by the valve stem, and not from demand signals sent to the valve. Additionally, other major components within these systems (e.g., EFW motor driven and steam driven pumps, decay heat removal system pumps and HPI

. a s) have direct performance. indications. Walsh and Toole, ff. Tr. 9840, at.9, 10.

291. Of the instrumentation used by an operator to perform necessary functions and monitor important variables following a small-break LOCA or feedwater transient, only 20RV and safety valve position and subcooling' indications are derived from signals that are not direct measures of the desired variables. Measurement of primary syster subcooling (the difference between coolant temperature and the liquid boiling point at a given system pressure) cannot be directly measured; however, the temperature and pressure inputs to the subcooling meter are direct measurements, thereby providing highly reliable readings to the operator. Sullivan-2,91 ff.

Tr. 9893, at 5, 6.

292. The position of the PORV and the safety valves is not indicated by a direct valve measurement, but is deter-mined by discharge line flow indications in conjunction with l discharge line temperature measurement, In addition, the PORV is equipped with a position demand indication and will be l 51 NRC Staff Testimony of Donald F. Sullivan Regarding l

Derivation of Instrument Input Signals (ECNP Contention 1(c))

("Sullivan-2").

l i

l

-196-I r - - e -- -g .w- e # ya + + ,e ,-e- w p-+

9 , w. t- -r=-

equipped with an accelerometer which senses discharge line-flow. The combination of these indicators will provide assurance that the position'of these valves will be recognizad by the operator. Correa et al., ff. Tr. 8746, at 4; Sullivan-2, ff. Tr. 9893, at 5; Tr. 9882-83 (Walsh); see also, paragraph 170, supra.

293. In response to ECNP Contention 1(d), we find that the signals sent to the control room which monitor core cooling and containment isolation parameters are derived from direct inputs and would not provide misleading information to the operators. Further, we find that the actions taken by Licensee to monitor PORV and safety valve discharge provide the operator with sufficient information to determine the position of these valves.

N. Control Room Design - Human Factors Engineering Sholly Contention No. 15: It is contended that the design of the Unit 1 Control Room, instrumentation, and controls is such that operators cannot maintain systen variables and systems within crescribed operating ranges during feedwater transients and LOCA's. It is further contended that this violates the provisions of GDC 13 regarding instrumentation and con-l trols. It is contended that in view of the numerous operating difficulties ,

encountered with Unit 2, and the similarities in design and construc-tion between Units 1 and 2, a thorough human factors engineering review of Unit l's Control Rocm is called for in order to provide assurance that the

-197-l l

1

operator-instrumentation interface is

such that the operators can exercise-adequate control over the' reactor and prevent off-site consequences from anticipated. operational occurrences.

.and postulated accidents. It is further contended that in order to '

4 assure maximum protection for the public. health and safety, the human

factors engineering review and any necessary changes recommended as a result of this review must be com-pleted prior to restart.

ANGRY Contention 4

No. V(C): The NRC Order fails to require as conditions for restart the following modifications'in-the design of the-TMI-1 reactor'without which-there can, '

be no reasonable assurance that TMI-1 can be operated without endangering the public health and safety:-

(C) Performance of an analysis of and implementation of modifications

in the design and layout of the TMI-1 control room as recommended in NUREG-0560.92 I .

! 92 Mr. Sholly, as lead.intervenor on this issue, conducted ex-tensive cross-examination of the Staff's and-Licensee's witnesses,

. assisted by ANGRY's representative (who attended parts of'the' l evidentiary hearing on this issue, compare Tr. 10,244-45.and i

Tr. 10,458-59) and by counsel for the Commonwealth, who also con-ducted extensive cross-examination on behalf of the Commonwealth' in its own right. Tr. 10,486. Although, in the course ~of the  :

hearings on management issues, the'Aamodts generally. criticized the human factors upgrading planned'for-TMI-1, the Aamodts did-not attend the evidentiary session at which the Staff's witnesses on' human factors presented their testimony. Mr. Aamodt did appear 4

at the close of the presentation of Licensee's outstanding human '

factors panel, but asked only one question, unrelated.to either the. ,

j prefiled testimony and-the exhibits on this issue,:or to the parti-cular concerns expressed by the Aamodts in the hearings on manage -

l ment issues. Tr. 10,394-95; Tr. 10,412 (Smith). The intervenors presented no direct testimony on this issue.

-198-

,,--,,,,-_-..,d... . . - - , - _,.,._,y,.-, , ,. ,_., - ,,,,- < .-,,.,_ -- m . ,..,y _ . , _ , ~ , , . . . - , - , , , .r.. ,.r..,, , , , .

294. The single most pervasive theme in this proceeding has been the importance of the human element in the operation of a nuclear power plant. The general conclusion which the Board has consistently reached is that the real lessons learned from the TMI-2 accident.are in the plant software -- operator training and procedures -- rather than in the plant hardware, which was capable of preventing core-damage. A well-trained operator carefully integrated into the plant hardware is an integral and indispensable source of flexibility, reason, redundancy and positive action. See generally, Tr. 10,370-72 (Christensen).

In a sense, then, Sholly Contention No. 15 and ANGRY Contention'No. V(C),.which focus on human factors engineering -- the integration of plant-software and plant hardware -- are a variation on this recurrent theme. Though human factors considerations in the control room is not a concern unique to the TMI units, the TMI-2 accident brought human factors engineering to the forefront of the nuclear industry. Tr. 10,373 (Christensen).

Consideration of Sholly Contention No. 15 and ANGRY Contention No. V(C) is therefore particularly appropriate in this pro-l ceeding.

295. The bases for Mr. Sholly's Contention No. 15, reproduced in the Appendix to the First Special Prehearing Conference Order, include three specific examples of TMI-2 Contro) Room design inadequacies which purportedly impacted the operators' ability to control the sequence of events during the

-199-m e-A-- -g e i, y,._.--w gp %.. .p -,,ea. - w ,i - we m,-,e- w ww -

wm --- , ,yr, ya=-- - ,

TMI-2 accident. One example, the lac' of positive indication of valve closure, is addressed supra, in sections II.G'and II.M. A second example, positive indication of inadequate core cooling, is addressed supra, in section II.B.

296. The Board therefore begins by addressing the merits of the third statement of basis for Mr. Sho11y's contention. We next discuss, seriatim, the major. elements of Sholly Contention No. 15, which include the general concerns expressed by ANGRY. These are, first, the assertion that the design of the TMI-l Control Room instrumentation and controls is such that operators cannot maintain system variables and systems within prescribed operating ranges during feedwater transients and LOCAs. Next, we examine the allegation that the design of the TMI-1 Control Room violates the provisions of General Design Criterion 13 of Appendix A to 10 C.F.R. Part 50.

Third, we consider the recommendations of the contentions that a thorough human factors engineering review of the TMI-l Control Room be conducted; we here review the extensive studies

performed by the Staff and by Licensee. Finally, the Board assesses the Licensee's response to the recommendations included in its own report and in the report of the Staff.

l 297. The third statement of basis for Sholly Contention No. 15 asserts that the inability of the TMI-2 operators to view an increasing trend on the fuel handling ~

building exhaust monitors at 18 minutes into the accident affected the operators' ability to control the sequence of 200-

---u - - -,e --w- -yt--- ,* + - -- --y<- ty7m

events. The monitor detected an increase of approximately 20%,

stabilized at that reading, and then decreased slowly for several hours. The important information that the operator needed to know, however, was that a primary system relief valve was open. It is unlikely that the operators would have deduced that the increased, reading was caused by a leak in the waste gas system, which is connected to a header that vents the reactor coolant drain tank (RCDT), which was receiving a greater than normal volume of water from a stuck open relief valve.93 In any case, the high alarm setpoint for the monitors was not reached until after 0700, and the system design relies principally upon monitar alarms to alert the operator to sudden increases, and upon periodic logging of readings to detect slower trends. Walsh et al., ff. Tr. 10,234, at 2, 3 (Walsh);

Tr. 10,243-44 (Walsh). We therefore reject the assertion that the TMI-2 operators' inability to view an increasing trend on the monitors affected the operators' ability to control the sequence of events. Nevertheless, we note that the recorders in the TMI-1 Control Room are located higher on the back panel than they are in the TMI-2 Control Room, and are therefore more visible from the front console. Walsh et al., ff. Tr. 10,234, f at 3 (Walsh).

93 In fact, operator interviews indicate that the operators -

' believed the conditions in the RCDT were due to the initial lifting of the relief valve at the onset of the transient. Walsh et al., ff. Tr. 10,234, at 3 (Walsh).

-201--

e - , ,.g. , , ,, - , . , . -. ,n .- ,n - -..~ , , , - , - , . - - - , , - - - - - , . . . - , ~n a,.. ., , ,

298. The first of the four major elements of Sholly Contention No. 15 asserts that the design of the TMI-1 Control Room instrumentation and controls is such that operators cannot maintain system variables and systems within prescribed operating ranges during feedwater transients and LOCAs. The assertion is contradicted by the operating history of TMI-1, which operated at power for over 30,000 hours0 days <br />0 hours <br />0 weeks <br />0 months <br /> from 1974 to 1979, with few operational upsets in this period. A number of feedwater transients did occur, during which plant control systems maintained system variables and the systems themselves within prescribed operating ranges.94 Walsh et al., ff. Tr.

10,234, at 4 (Walsh); Tr. 10,244 (Walsh). See also, Lic. Ex.

23 at 1.

299. The TMI-I startup test program, in 1974, rigorously tested the capability of the control systems and the operators to maintain control of the plant during transient conditions. These tests measured the ability of the feedwater system, as well as the entire plant, to respond to transient conditions. The tests included load changes at design ramp rates at 40, 76 and 100% power, main feedwater pump trip at 94 In five years of operation, TMI-1 experienced 17 reactor trip transients. Three were intentionally induced for test purposes; ten were experienced during the startup test phase over the first three months of operation. Only two reactor trips can be directly attributed to feedwater system upsets. During both of these tran-sients, the operators returned the plant to a stable shutdown condi-tion and system instrumentation remained within the indicating range. Walsh et al., ff. Tr. 10,234, at 5 (Walsh); Tr. 10,244 (Walsh). TMI-1 has ne'er experienced a LOCA. Tr. 10,245 (Walsh).

-202-

100% power and turbine trip at 76% power, as well as reactor trip tests. Throughout these tests, the operators were able to control the plant and return it to a stable steady state condition without violating safety limits and with plant '

instrumentation remaining in the indicating range. Walsh et al., ff. Tr. 10,234, at'4, 5 (Walsh).

300. Moreover, all the TMI-1 operators.have had extensive training on transient conditions, including simulator training, procedure walk-throughs, and classroom instruction.

A high percentage of the operators also have experience in normal operations, including startup and shutdown, in which the feedwater system is ramped up and down (though not at design rates). Tr. 10,249 (Walsh). Our review of all these factors the operating history of TMI-1, the TMI-l startup test results, and the training and experience of the TMI-l operators

-- along with our observation of the significant differences between the TMI-l and TMI-2 Control Rooms (discussed below at paragraphs 303 and 304), lead us to reject the assertion that the design of the TMI-I Control Room instrumentation and controls is such that operators cannot maintain sys*em varia-bles and systems within prescribed operating ranges during feedwater transients end LOCAs. We nevertheless proceed, at paragraphs 326 and 327, infra (in conjunction with our assess-ment of Licensee's planned control room modifications), to specifically review the improvements in controls and displays which will enhance the ability of the TMI-1 control room operators to respond to feedwater transients and LOCAs.

-203-5 e -.

,, - , . . . - - - ,- - ,. , - , . - , , . , .-.--,.v. , e -

301. The second major element of Sholly Contention No. 15 states that the design of the TMI-l Control Room violates the provisions of General Design Criterion 13 (GDC 13) of Appendix A to 10 CFR Part 50, which provides:

• Instrumentation shall be monitor variables and systems'provided over theirto anticipated ranges for normal operation,-

for anticipated operational occurrences, and for accident condit!ons as appropriate to assure adequate safety, including those variables and systems that can affect the fission process, the integrity of the reactot core, the reactor coolant pressure boundary, and the containment and its associated systems. Appropriate controls shall be provided to maintain these variables and systems within prescribed operating ranges.

It is undispuced that the instrumentation and controls of any power plant should meet the intent of this criterion (although, at the time TMI-1 was designed, the criterion did not exist in its present form). The criterion is simply a general require-ment for the provision of instrumentation and controls neces-sary for normal and emergency operations. Ramirez and Price, ff. Tr. 10,452, at 6; Walsh et al., ff. Tr. 10,234, at 12 l

l (Walsh, Meek, Estrada). There is no evidence whatsoever to suggest that GDC 13 itself imposes human factors engineering standards.95 The recommendations resulting from the control l

l 95 Phile it might be possible to actually " provide" instru-l mentation and controls, yet to position them so that the l operator is effectively and completely precluded from using

! them, there is no evidence that this is such an extreme case.

None of the deficiencies asserted by the Staff as a result of l its control room design review constituted a violation of GDC l 13. Ramirez and Price, ff. Tr. 10,452, at 6.

-204-l

room reviews of the Staff and Licensee turn on much finer, more subtle standards and principles of human factors enginearing, which GDC 13 does not address. Ramirez and Price, ff.- Tr.

10,452, at 6; Tr. 10,273-74 (Walsh)-.

302. The TMI-l Control Room was designed using methodical engineering techniques, with operations input.

First, the basic design of the material and fluid handling systems was developed, and decisions made as to which param-eters should be displayed and where they should be displayed (locally or in the control room), as well as which items should be locally controlled and which should be remotely controlled.

Next, the design engineers physically arranged the various controls and displays. A mock-up of the basic console was prepared, and paper facsimiles of controls and displays, known as " paper dolls," were used to place the various components on the mock panel. Through a series of conferences and mock operations, the design engineers and representatives of Licensee's operational staff carefully reviewed-the instru-t mentation and controls to ensure that adequate instrumentation 1

and controls were available for normal and emergency opera-tions, and to determine the anost logical operational arrange-ment for the various indications and controls. Finally, a designer prepared a drawing of the agreed-upon arrangement, for use by the panel manufacturer in the fabrication of the actual TMI-l panels. Walsh et al., ff. Tr. 10,234, at 12-15 (Walsh, l

Meek, Estrada); Tr. 10,239-42, Tr. 10,274 (Meek); Ramirez and

-205-l

Price, ff. Tr. 10,452, at 6. The Board therefore finds that the TMI-l Control Room complies with GDC 13 by providing the operators with adequate instrumentation and appropriate controls to monitor and maintain variables and systems for normal and emergency operations. Moreover, though we decline to read specific human factors engineering standards into.GDC 13, we note that careful consideration was given at the design stage to the logical operational arrangement of instrumentation cnd controls in the TMI-l Control Room.

303. Nevertheless, as with all technologies, improvements can and should be considered. The-Board therefore turns to consider the recommendations of Mr. Sholly and i.dGRY that a thorough human factors engineering reviewlof the TMI-l Control Room be performed prior to restart. We initiall.y observe that, contrary to the implication of Sholly Contention No. 15, there are significant differences'between the control rooms of TMI-l and TMT-2, both in the arrangement of the

, controls and displays and in the physical dimensions of the

! rooms themselves. For example, the overall size of the TMI-l Control Room is 58' x 40', compared to the 75' x 56' TMI-2 Control Room. The operating area of the TMI-l Control Room is

(

also significantly smaller than that of TMI-2 -- 39' x 25' at TMI-1 versus 42' x 36' at TMI-2. Similarly, there are 107 linear feet of control boards in the TM1-1 Control Room, and 168 linear feet in the T:4I-2 Control Room. Finally, the TMI-l Control Room has only approximately 600 annunciators, while the

-206-

.k

- ,- ,,w , - . - , < - , - - - - - - , , - - ~n - - - - , . , , - , . , - --- en , , 1 - .. , - , , -,- , - -

TMI-2 Control Room has approximately 1,020. Walsh et al., ff.

Tr. 10,234, at 15 (Walsh, Meek, Estrada); Ramirez and Price, ff. Tr. 10,452, at 5. The compactness of the TMI-1 Control Room arrangement enhances operator response during transient conditions. Walsh et al., ff. Tr. 10,234, at 15 (Walsh,

~

Estrada, Christensen and Sheridan).

304. The arrangement of panels in the two control rooms also differs significantly. For example, panels con-taining reactor coolant drain tank parameters and alarms, Reactor Building temperature recorders and Reactor Building high temperature and high pressure alarms are not visible in the TMI-2 Control Room from the operating area. In the TMI-l Control Room, these panels are located in the operating area, and the indicators and alarms are visible to the operators.

Walsh et al., ff. Tr. 10,234, at 15, 16 (Walsh, Estrada, Christensen and Sheridan,.

305. Even though the TMI-l Control Room differs l

significantly from that of TMI-2, Licensee undertook a thorough review of the TMI-l Control Room. While the lessons learned from the TMI-2 accident were considered in Licensee's review, the review was not limited in scope to the prevention of another TMI-2 accident. Rather, the review was a comprehensive one, based upon the full spectrum of human factors engineering principles. Tr. 10,298-99 (Walsh).

306. Licensee's human factors engineering review of the TMI-l Control Room began in F.bruary, 1980. The basic

-207-

review ended in late December, 1980, with the issuance of the review team's report (Lic. Ex. 23). Tr. 10,251 (Walsh). The review team included: members of the GPU' engineering staff; TMI-l operating personnel; engineers from MPR Associates, Inc.,

a firm with expertise in the design and. operation of power plants; Dr. J. M. Christensen, a consultant in human factors in aerospace and other industries; and Dr. T. B. Sheridan, Professor of Engineering and Applied Psychology at the Massachusetts Institute of Technology. Walsh et al., ff. Tr.

10,234, at 6 (Walsh, Estrada, Christensen, Sheridan); Lic. Ex.

23 at 1.

307. The first step of Licensee's review was the development of guidelines and objectives for v.ne evaluation of the TMI-l Control Room. Tne guidelines were formulated by developing operational guidelines defining operator responsi-bilities and functions specific to control of the TMI-1 power plant, and searching appropriate human factors literature and adapting references to a form suitable for evaluation of an existing nuclear plant control room. Thus, the guidelines used were based on generally accepted military and industrial standards for control design, including those utilized in the study performed by the Electric Power Research Institute (EPRI Report #NP309) of human factors engineering in nuclear power plant control rooms, which was cited by Mr. Sholly as a basis for Sholly Contention No. 15, and EPRI Report #NP1118, to which Mr. Shelly referred in cross-examination. Military Standard

-208-m..

- , - . . - . , , __ , - . . . _~ _ ._- - ,. . - , _.

MIL-STD-1472B, which was used in the Staff study of the TMI-1 Control Room, described infra at paragraphs 313 through 315, was also used as a source for the guidelines developed. Walsh et al., ff. Tr. 10,234, at 3-4, 6 (Walsh, Estrada, Christensen, Sheridan); Tr. 10,250-53 (Christensen, Estrada, Sheridan); Lic.

Ex. 23 at 3, 32.

308. A full-scale control room mock-up was con-structed to allow evaluation of all aspects of operator / machine interface. The displays and controls for the mock-up panels were reproduced by a combination of photographic and duplicated enlargements of a grid work of high quality photographs. Walsh et al., ff. Tr. 10,234, at 6 (Walsh, Estrada, Christensen, Sheridan); Lic. Ex. 23 at 3, Figures 1 and 2.

309. The review team observed as qualified-TMI-l operating personnel walked through key operating and emergency procedures using the control room mock-up. A " talk-through" technique was generally used in the operating procedure walk throughs. However, both " talk-through" and real time

" walk-through" techniques were used to evaluate interface in emergency evolutions.96 From these walk-throughs, the review team developed a clear understanding of how, when, by whom and 96 Operator actions in normal operations evolutions are gen-erally deliberate and slow paced. For such evolutions, real time simulations are considered uninformative. However, in emergency evolutions, events often unfold at a pace determined not by the operators, but by the plant, so that an understanding of the tasks imposed on the operators, in real time, is most desirable. Lic.

Ex. 23 at 3-7.

-209-

^3 t

in what ways, controls and means of communication are used-in the Control Room, and what changes would'be desirable. Dis-

. plays and controls on the-principal panels and consoles were.

individually reviewed, to ensure that items cuch as scale divisions, selections of units and legend readability -- which might.not be picked up in the walk-throughs -- were evaluated.

Walsh et al., ff. Tr. 10,234, at 7 (Walsh, Estrada, l

Christensen, Sheridan); Lic. Ex. 23 at 3-7.

310. Next, the alarm system was reviewed to evaluate the usefulness of the information presented to the operator by the several control room annunciator systems in both normal and o12-normal situations, and to develop-improve =ents in the presentation of alarm information to the control room opera-tors. Walsh et al., ff. Tr. 10,234, at 7 (Walsh, Estrada, Christensen, Sheridan); Lic. Ex. 23 at 7.

311. Finally, the environmental conditions in the TMI-l Contrrl Room were surveyed to evaluate whether they adequately support the operators and the-equipment therein.

The conditions evaluated included, among others, temperature, humidity, normal and emergency lighting, noise, kitchen and bathroom facilities, and arrangement of equipment and facil-

! ities. Walsh et al., ff. Tr. 10,234, at 8 (Walsh,-Estrada, Christensen, Sheridan); Lic. Ex. 23 at 7.

312. The review team concluded that the present

• Control Rocm arrangement and the controls and displays therein have a number of significant strengths,97 and thac TMI-l can be ,

97 Most controls and displays are arranged in logical groups, except where regulatory requirements (particularly separation)

(continued next page)

-210-

,g , -- . . - . . - .

K safely operated with.the. existing Control Room.- The review team also identified areas in which the design of the;TMI-1 Control-Room could be enhanced,._and made a total of 36 specific

~

findings with' corresponding specific' recommendations. Walsh et.

al., ff. Tr.'10,234, at 8,~9 (Walsh, Estrada, Christensen, Sheridan); Lic. Ex. 23 at 9, Table III-1.

313. From July 21 through July 25,-1980,- the Staff conducted its own human factors review-of the TMI-l Control i Room. The Staff review team consisted'of members of the Human Factors' Engineering Branch -- including an architect, a' systems-engineer, an instrumentation and control systems specialist, and a human environment specialist -- and Mr. Harold Price,.a human factors engineering consultant to the Staff. Ramirez and Price, ff. Tr. 10,452, at 4; Tr. 10,486-87 (Ramirez).

314. The Staff's review began with a presentation by Licensee's human factors review team, which was by then more i

l. (continued) ,

i dictate otherwise. The console and panel are generally unclut-tered, as compared to other control rooms with which Licensee's team was familiar. The division of operational responsibilities between operators in the Control Room and auxiliary operators'in machinery spaces is' workable. The control and display hardware.

have proven to have satisfactory reliability. The displays as-sociated with use of a particular control are usually both visi-ble and recognizable from the station where the operator uses that control. The alarm annunciators for specific systems are gener-ally located above the console section where the controls and analog displays associated with that system are located; and, the main alarm panels are essentially dark when the plant is op- ,

erating-normally at power, enhancing the ability of the operator to recognize an off-normal condition. Walsh et al., ff. Tr.

10,234, at 8, 9 (Walsh, Estreda, Christensen, Sheridan).

-211-l

--y + - - + - . ,+,,w-w-, ,,,--,-,.,----,-,.we, , - - - . , y. - - , - , - , . . - - ,--,,-,,<e,-- - + - - - , -orr~,v,. --e, * , . w-,-w,., e=--e4.

than five months into its own review. In that presentation, Licensee's review team discussed its preliminary findings, and identified many of the-items later asserted as human factors deficiencies by the Staff. The Staff's control r'oom design review encompassed a total of 17 different areas, such as controls, displays, annunciators, workplace layout, and human environment, as well as special areas such as the process computer.98 Staff Ex. 2 at 1; Tr. 10,488 (Price). The review team focused on improvements in the safety monitoring and human factors enhancement of controls and control displays, and on the adequacy of information (including alarm system informa-tion) presented to the operator to reflect plant status for normal operation, anticipated operational occurrences, and accident conditions. Ramirez and Price, ff. Tr. 10,452, at 4.

315. The Staff's review was performed by means of comprehensive evaluations of control room layout and environ-ment; detailed inspections of control consoles and panels; l interviews with TMI-l control room operators; observation and videotaping of TMI-1 control room operators walking through selected emergency procedures in the TMI-l Control Room; and an escorted walk through of the TMI-2 Control Room. Ramirez and Price, ff. Tr. 10,452, at 4; Staff Ex. 2 a t 1, 2; {r. 10,487-91

_ (Price). See also, Tr. 10,550-53 '

Ramirez, Price).

98 We discuss the process computer in section II.K, supra.

l l -212-l t

, , .- - ,.,____ _.c. . - - _ _ - , . _ _ _ _ , _ - - , , . ~ . . - .

316. The Staff's design review team,'like Licensee's review team, found that the TMI-1 Control Room was generally designed to promote effective operator actions.49 The Staff's -

review team also identified a number o'. human factors defi-ciencies. The Staff described the ar,serted deficiencies, and corresponding corrective measures, in its initial report (Staff Ex. 2) and in its supplemental report (Staff Ex. 15). The

-Staff would require correction of most of the asserted human-factors deficiencies prior to restart of TMI-1,-but believes that' correction of a number of minor deficiencies can be deferred until after restart. Staff Ex. 2 at-2-5;-Staff Ex. 15 at 12, 13; Ramirez and Price, ff. Tr. 10,452, at p-7.

317. There is some confusion surrounding the stan-dard applied by the Staff review team in its review of the TMI-l Control Room. The Staff witnesses variously testified that the implementation of modifications which the Staff proposed as restart requirements would "make the TMI-1 control room comparable with the control rooms of newly licensed plants" and would " bring TMI-l on a comparable basis with the i

I other operating plants." . Compare Ramirez and Price, ff. Tr.

l i

99 The control panels are generally not overcrowded with con-trols and displays. The organization of controls and displays l are generally consistent with plant and stereotypical convention.

Annunciator panels are, in most instances, located above systems panels which they monitor. The normal lighting of the main con-trol console is good. Switches on the SS-1 panel are all guarded -

l against inadvertent actuation. The ambient background noise level is low. The process computer alarm will sound until an operator acknowledges the alarm; and the alarm and utility printers pro-i vide clear, legible displays. Staff Ex. 2 at 2, 3.

-213-l 1 -

10,452, at-5, with Ramirez and Price, ff. Tr. 10,452, at 7 (emphasis supplied). Later, one of the Staff witnesses testified, on cross-examination, that NRC management had directed the Staff design review team "to review TMI-1 as-if-it were an NTOL" (near-term operating lice,nse), though the witness knew neither the technical basis for that position nor even who l had made the decision. Tr. 10,525-27'(Ramirez) _ (emphasis supplied).

318. The Board need not h'ere determine whether, as Licensee's review team concluded, TMI-l can be safely operated

, prior to implementation of any modifications to the ontrol Room. Nor must we reach the issue as to whether the TMI-1 Control Room should be reviewed for restart _a an operating plant, or an NTOL, or something else (i.e., a newly licensed plant). By letter dated January 21~, 1981 (Lic. Ex. 33),

Licensee committed -- with a few noted exceptions -- to implement prior to restart the modifications proposed by the Staff.100 Licensee's letter further stated its specific positions in exception to Staff proposals. The Staff's supplemental control room design review report (Staff Ex. 15) evaluated Licensee's exceptions to the proposed requirements, modified certain of the proposed requirements, and summarized the Staff's proposals and Licensee's commitments, identifying 100 In some instances, Licensee committed to implement the Staff's proposals on a longer-term basis.

-214-

~

, - - ,a ee- --g ,- m -<g . ,,,e rm n-

-w-> , - , - , - .e

the remaining open items. Staff Ex. 15 at 13. Subsequently,

, counsel for Licensee reported that Licensee had decided to make-the commitmenta requested in the Staff's supplemental-control room design review report. Tr. 21,431-32-(Baxter). Thus, Licensee has committed to implement, on the schedules of Staff Exhibit 2 as modified by Staff Exhibit 15, all modifications which the Staff's design review team identified as proposed requirements.

319. Licensee's January 21, 1981 letter-(Lic. Ex.

33) also documented Licensee's commitments to implement each of the 36 actions recommended in the report of-Licensee's human factors review team (Lic Ex. 23). Most of the recommendations of Licensee's review team were also identified as restart modifications by the Staff, and will be implemented prior to restart. A number of the modifications recommended by Licensee's team are scheduled for completion during the first refueling outage following restart, though some may be com-pleted prior to restart. Two items, which can be pursued while l the plant is in operation, are expected to be completed by the l

end of 1981, and several items require detailed engineering studies, which are expected to begin in 1981. Lic. Ex. 33 at 3.

320. Thus, based on the recommendations of both the l Staff design review team and Licensee's review team, extensive l

modifications to the TMI-1 Control Room will be implemented.

l For example, every back panel and free console, as well as the 1

-215-t l

i heating and ventilating and-liquid waste disposal system panels will be relabeled and demarcated to indicate system, subsystem' an.d functional groupings of controls and displays. Tr. 10,309 (Estrada). Makeshift labels will be replaced'with permanent label plates-with consistent color coding and letter size. A hierarchical system of labeling-will be implemented, including labeling at the group, function, system and panel levels, as well as the component level. Staff Ex. 2 at 11, 12; Lic.-Ex.

33. Scale faces will be replaced on selected; indicators, to r

make scale markings consistent and to enhance readability.

Lic. Ex. 23 at 25; Lic. Ex. 33 at 3; Walsh et al., ff. Tr.

10,234, at 10 (Walsh, Estrada, Christensen, Sheridan).

321. The engineered safeguards features system panel-will be redesigned, so that -- from the operator's normal station at the console -- each segment of.the system related to i

i a specific actuating signal will be visible to the operator, I

enhancino rapid verification of system status'after actuation.

Tr. 10,282-84 (Walsh, Estrada). The blue status light windows will be modified to improve brightness and contrast, for e0sier operator recognition. Tr. 10,282, 10,348-49 (Walsh). The redesigned panel will include indicators with " push to test" capability, to facilitate testing of the indicator lamps on that panel. Tr. 10,354 (Walsh).

l 322. Licensee's present alarm system lacks separate acknowledge / silence controls and permits operators to acknowl-edge alarms without reading alarm windows. Licensee is evalu-ating an alarm suppression system, with separate acknowledge i

-216-

, , , , . , e r 9- . - , . - - . . - -

- - ~, , . - - - - , ,, , - , - . - , . - , . . . - . - < - . . - . .

and silence controls, and will install a system which will allow operators to effectively use alarms for diagnostic purposes. Tr. 10,256-57 (Estrada); Tr. 10,292-93 (Walsh);

Staff Ex. 2 at 6; Lic. Ex.~33. In the interim, Licensee will ensure, through administrative controls, that' alarms are not acknowledged until operators have reviewed and understood the significance of each alarm and flashing tile. Tr. 10,294-95 (Walsh); Tr. 10,464-65 (Price); Staff Ex. 2 at 6; Lic. Ex.

33.101 Licensee will also increase annunciator prioritization, color coding the more important safety alarms to enhance rapid operator recognition. Tr. 10,257 (Walsh); Tr. 10,468 (Ramirez); Staff Ex. 2 at 6; Lic. Ex. 33.

323. Controls which are operated during the first few minutes after a reactor trip will be relocated as neces-sary, and procedures revised, to. permit operators to remain at-their normal station facing the control console in the short term following reactor and turbine trips. This will enable the operators to concentrate on the response of key process variables and maintain them within prescribed limits. Walsh et al., ff. Tr. 10,234, at 13 (Walsh, Meek, Estrada),

101 The Staff has observed a dramatic change in >perator attitudes with respect to acknowledging alarms, .s a result of the TMI-2 accident. Operators are now highly sensitive to the problem of perfunctory response to alarms. While this sensi-tivity may diminish over time, the combination of administra-tive controls, prioritization of alarms, and the additional training which operators now receive on the subject will en-sure proper operator response to alarms at TMI-1 until the completo alarm suppression system has been implemented. Tr.

10,466-68 (Ramirez, Price).

-217-g ., ,,-

- r - - , , a - - - . ,e .

4 324. Licensee will install an automatic reset-feature for high pressure injection actuation logic circuit ~on increasing pressure, which will minimize necessary operator i

action and allow closer monitoring of the process in transients in which pressure recovers. Walsh et al., ff. Tr. 10,234, at 14-(Walsh, Meek, Estrada); Tr. 10,325 (Walsh).

325. Licensee will increase the use of mimic.

arrangements of controls and displays in the TMI-l' Control Room, particularly for systems which are complex or used infrequently. Systems'which will be arranged in mimic fashion include the decay heat removal system, parts of the nuclear services cooling system, the hydrogen recombiner, and the emereency feedwater (EFW) system. Tr. 10,321-24 (Estrada);

Walsh et al., ff. Tr. 10,234, at 11 (Walsh, Estrada, Christensen, Sheridan).

326. The mimic arrangement of the controls and 4

displays of the EFW system will clearly indicate the flow path from water sources through the pumps and major. valves to the steam generators. An EFW flow meter has been installed to measure the flow of emergency feedwater to each steam generator, and the displays have been integrated into the EFW system mimic. The mimic arrangement will be labeled clearly to 102 The makeup system and parts of the in-plant power distri- '

bution system were mimicked on the original design of the TMI-l Control Rocm, and will continue to be arranged in mimic fashion.

Tr. 10,322 (Estrada, Meek).

l

-218-

differentiate between the A and B pumps and other controls on the. console, and will directly enhance operator response in-feedwater transients and LOCAs, the-transients to which Sholly Contention No. 15 is specifically addressed.- Walsh et al., f f.-

Tr. 10,234, at 11 (Walsh, Estrada, Christensen, Sheridan),

13-14-(Walsh, Meek, Estrada); Tr. 10,300-01 (Estrada).

327. Additional modifications which will directly enhance operator response in feedwater transients and LOCAs include: (1) attachment of an accelerometer to each primary relief valve, along with the installation of downstream flow measuring devices, with indicators on the main control boards; Tr. 10,242-43 (Walsh, Estrada); (2) installation of wide-range reactor building sump level instrumentation, with indicators in the Control Room; Tr. 10,301 (Estrada); (3) installation of an unambiguous indicator of margin to saturation for both reactor J

hot legs; Tr. 10,327 (Estrada); and (4) modification of the engineered safeguards features system panel, discussed sucra in paragraph 321, to increase the brightness of the blue status light windows; Tr. 10,282, 10,348-49 (Walsh). See cenerally, Walsh et al., ff. Tr. 10,234, at 11, 12 (Walsh, Estrada, Christensen, Sneridan).

l

{ 328. Other modifications, such as the installation of humidity control and duct filtration systems, will generally enhance the Control Room envi onment. The TMI-l Control Room floor will be carpeted to reduce noise, minimize glare, and improve operator comfort and morale. Lic. Ex. 23 at 28; Lic.

Ex. 33 at 3; Tr. 10,388-89 (Christensen, Sheridan).

-219-

329. The Staff office of Inspection and Enforcement will audit the TMI-l Control Room prior to restart, and prior to escalation beyond 5% of rated power, to ensure that Licensee has implemented all human factors engineering improvements to'

, which Licensee has committed. The Human' Factors Engineering Branch Staff will itself assess the implementation of those 4

modifications which require the judgment of a human factors engineering specialist. Staff Ex. 15 at-13;-Tr. 10,501-04 (Ramirez. Price). See also, Tr. 10,465, 10,497 (Ramirez).

330. Finally, the human factors review of the TMI-1 Control Room is not a "one time" process that will be essentially complete-with the restart of TMI-1. Rather, all further changes to the TMI-l Control Room will routinely be reviewed by Licensee's human factors engineering specialist, using the methods and criteria developed by Licensee's human factors review team. The human factors aspects of the Control Room will thus be maintained in the future. Tr. 10,251-52, 10,303 (Walsh); Walsh et al., ff. Tr. 10,234, at 17'(Walsh, Estrada, Christensen, Sheridan).

331. The Board therefore finds that the Staff and Licensee have each performed a thorough human factors engi-neering review of the TMI-l Control Room. Further, Licensee has committed to implement each of the recommendations of both the Staff's design review team and its own human factors engineering review team, on schedules proposed and approved by che Staff.103 We conclude that, with the modifications being 103 Neither Mr. Sholly nor ANGRY contended that any carticular human factors modifications were required prior to restart.

-220-

implemented prior to restart and prior to escalation beyor.d 5% -

power, the TMI-l Control Room is at least comparable to'those of other operating reactors, and'the_ potential for_ operator error leading to serious consequences as a result-of human

'f actors considerations in the Control ~ Room is sufficiently low to permit: restart and full power operation of TMI-1.

332.. In summary, then, the Board rejects as a basis for Sholly Contention No. 15 the assertion that the-inability of the TMI-2 operators to view an increasing trend on the fuel

. handling building exhaust monitors at 18 minutes into the accident affected the operators' ability to control-the sequence of events. We'similarly reject the assertion that the design of the TMI-l Control Room instrumentation and controls precludes the operators from maintaining systems and variables j within_ prescribed operating ranges during feedwater transients r

and LOCAs. We decline to read specific human factors engi-neering ;tandards into GDC 13, and find that.TMI-1 complies with GDC 13 as generally interpreted. We further find that, though the TMI-l Control Room differs significantly from that of TMI-2, both Licensee and the Staff conducted extensive human factors engineering reviews of the TMI-1 Control Room, in satisfaction of the specific proposals of Sholly Contention No.

15 and ANGRY Contention No. V(C). Finally, the Board concludes that, with the modifications being implemented prior to restart and prior to escalation above 5% power, the potential for I

operator error leading to serious consequences as a result of

-221-

, , . , - - -- m ew-- , ww .-. . , -- ,y -y ,,.-w-ww c ,<--r-,-- p- c y+----- . ee, e w -,- , , , . , , - ,,,,y y -..,+--- - -

human factors considerations in the.TMI-l Control Room is sufficiently low to permit restart and full power. operation of TMI-1.

Respectfully submitted, SHAW, PITTMAN,' POTTS & ~TROWBRIDGE George F. Trowbridge

' Thomas A. Baxter Delissa A. Ridgway Counsel for Licensee 1800 M Street, N.W.

Washington, D.C. 20036' (202) 822-1000 Dated: June 1, 1981 j

I

-222-

_ . - _ . _ _ _ . _ _ , , . . - - ._ _