ML17034A179

Samuel Miranda Statement

ML17034A179
Person / Time
Site:	Byron, Braidwood
Issue date:	02/02/2017
From:	Miranda S - No Known Affiliation
To:	Office of Nuclear Reactor Regulation
References
Download: ML17034A179 (15)

Text

Good afternoon.

My name is Samuel Miranda. I submitted the enforcement petition that is under your review. It is submitted under the terms of 10 CFR §2.206, and it concerns the licensing and operation qf the Byron and Braidwood Stations.

I maintain that Exelon, has obtained the NRC's authorization to operate its Byron and Braidwood Stations at an uprated power level, without demonstrating that its plant designs meet all design requirements, specified in their licensing bases. I am requesting, among other things, that the NRC revoke its uprating approvals, and compel Exelon to operate its Byron and Braidwood Stations at their originally licensed power levels until the required demonstration of compliance is made. The petition describes several issues, in Exelon's LAR and in its licensing basis, that support this request.

I will not read you the 'petition. It is on record, and available for your review and discussion, at any time you choose. Instead, I will use my allotted time to augment and elaborate upon the petition. I will also have a couple of handouts for your reference, and the record.

Before I get into the details of these issues, I will provide a brief; but relevant background concerning my education, and experience. I will also list some disclosures that pertain to this petition. If you have any questions, I ask that you hold them until the end of my presentation.

I earned Bachelor's and Master's degrees in nuclear engineering from Columbia University, and hold a Professional Engineer's license in mechanical engineering, in the Commonwealth of Pennsylvania.

I I have more than 40 years of experience in rea~tor safety analysis and licensing at Westinghouse and the NRC.

I worked 25 years at Westinghouse, in their Nuclear Safety Department, where I performed accident analyses of the kind that are under review, today. I also developed standards and methods for use in nuclear safety analysis, and automatic reactor protection systems design, which included the preparation of systems functional requirements, component sizing, and determination of setpoints, time response limits, and Technical Specification revisions.

In the 1980s, I managed a program, for the Westinghouse Owners Group, to reduce the frequency of unnecessary automatic reactor trips. This was known as WOG-TRAP, Westinghouse Owners Group Trip Reduction Assessment Program. Like unnecessary reactor trips, spurious safety injection actuations are very frequent. Sometimes, safety injection actuations accompany unnecessary reactor trips.

After Westinghouse, I worked, as a contractor, at the Salem nuclear plant, where I prepared the LAR for qualifying Salem's pressurizer power-operated relief valves for water relief, improving their automatic control circuitry, revising the plant Tech Specs, and meeting all the other requirements for upgrading the valves to safety grade status. The NRC approved that LAR, in 1997, making Salem the first plant with safety grade, water-qualified power-operated relief valves.

)

I worked for 14 years, at the NRC, in NRR's Division of Safety Systems (DSS). I revised several sections of the Standard Review Plan (NUREG-0800), presented the revisions to the ACRS, and I wrote RIS 2005-029 regarding compliance with the design requirement that is the subject of this Petition.

I retired from the NRC in August, 2014, at grade level GG-15.

I hereby make the following disclosures:

As an NRC employee, I was directly involved in ---

• Imposition of License Condition 2.K for the Seabrook plant, in 2005, regarding compliance with the non-escalation requirement.

• RIS 2005-029, and the first draft of RIS 2005-029, Rev 1

• Reviewed the power uprating LARs regarding the Byron and Braidwood plants, in 2014, and withheld my concurrence My Petition This petition concerns all PWRs, particularly the Byron and Braidwood plants, which are currently operating in Byron and Braceville, Illinois:

Operation RY License Exp To Go Byron 1 \ 9/16/1985 31.4 10/31/2024 7.8 Byron 2 8/2/1987 29.5 11/6/2026 9.8 Braidwood 1 7/29/1988 28.5 10/17/2026 9.7 Braidwood 2 10/17/1988 28.3 12/18/2027 10.9 Total 117.7 38.1 Avg 29.4 9.5 Other PWRs that are operated by Exelon are:

Arkansas Nuclear, 1 & 2 Calvert Cliffs, 1 & 2 Three Mile Island, 1 R.E. Ginna (Beznau used the same PORV design and materials)

This petition concerns three events that are analyzed and reported in Chapter 15 of the Byron and Braidwood UFSAR:

• Inadvertent Operation of Emergency Core Cooling System during Power Operation (IOECCS)

• Chemical and Volume Control System (CVCS) Malfunction

• Inadvertent Opening of a Pressurizer Relief or Safety Valve

These events are categorized as anticipated operational occurrences, or AOOs. AOOs are defined in the General o*esign Criteria as, those conditions of normal operation w~ich are expected to occur one or more times during the life of the nuclear power unit.

In its UFSAR, Exelon commits to meet the following requirements for AOOs:

a. Pressure in the reactor coolant and main steam systems should be maintained below 110% of the design values,

b. Fuel cladding integrity shall be maintained by ensuring that the minimum departure from nucleate boiling ratio (DNBR) remains above the DNBR limit, derived at a 95% confidence level and 95% probability, and

c. An incident of moderate frequency should not generate a more serious plant condition without other faults occurring independently.

Exelon also committed to meet another requirement, which was specified by American Nuclear Society, in 1973. It states that AOOs " ... shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

The first two requirements are easy to meet.

The charging pumps, in.the Byron and Braidwood plants, simply cannot pressurize the reactor coolant system to 110% of its design value. When actuated in an IOECCS or eves Malfunction, they would pressurize the reactor coolant system to their shutoff head, and no more. So, no analysis is necessary to demonstrate compliance with the first requirement. Nevertheless, Exelon provides one.

The second requirement specifies that an AOO may not breach the fuel cladding integrity. When the ECCS is actuated, the reactor is immediately tripped. It is hard to imagine a threat to fuel cladding integrity when the reactor is not generating power. So, no IOECCS analysis is necessary to demonstrate compliance with the second requirement. Nevertheless, Exelon provides one. Predictably, Exelon's analysis results show there is no approach to DNB, at any time during the event.

However, the eves Malfunction does not lead to an immediate reactor trip. An analysis is necessary to' demonstrate that the reactor is automatically tripped before any fuel clad damage can be incurred.

Exelon does not provide one. Instead, Exelon points to another, dissimilar event analysis. The Byron and Braidwood UFSAR states, 15.5.2 Chemical and Volume Control System Malfunction That Increases Reactor Coolant Inventory An increase in reactor coolant inventory which results from the addition of cold, unborated water to the reactor coolant system is analyzed in Subsection 15.4.6, chemical and volume control system malfunction that results in a decrease in boron concentration in the reactor coolant. An increase in reactor coolant inventory which results from the injection of highly borated water into the reactor coolant system is analyzed in Subsection 15.5.1, inadvertent operation emergency core cooling system during power operation.

The CVCS Ma/function that Decreases Boron Concentration in the Re.actor Coolant is a reactivity anomaly, not a mass addition event. It cannot be used to address a mass addition event. Add this reference to an inapplicable analysis to the 11 errors in the Petition.

Exelon does not provide an analysis for the IOECCS or the Inadvertent Opening of a Pressurizer Relief or Safety Valve to demonstrate compi'iance with the third requirement (i.e., the non-escalation requirement).

The Byron and Braidwood licensing basis, as reported in the UFSAR, contains two unnecessary analyses, and lacks three analyses.The missing analyses, are necessary to demonstrate compliance with the non-escalation requirement. Therefore, Exelon has not demonstrated its Byron and Braidwood plants comply with the non-escalation requirement.

Why is it important to demonstrate compliance with the non-escalation requirement?

If risk is defined as the product of consequences and frequency of occurrence, then the risk of an AOO would be about the same as the risk of a LOCA. This principle is at the core of nuclear plant design and licensing. In 1983, the ANS stated, The nuclear safety criteria ... have been established on the premise that: a. Those situations in the plant that are assessed as having a high frequency of occurrence shall have a small consequence to the public, and b. Those extreme situations having the potential for the greatest consequence to the public shall be those having a very low frequency of occurrence.

In plants that don't comply with the non-escalation requirement, it is possible to create high frequency, high consequence events. I maintain that this situation is possible in its Byron and Braidwood plants, since 'Exelon has not demonstrated that its plants comply with the non-escalation requirement.

Exe Ion's compliance rationale is found in Chapter 15.5.1, Inadvertent Operation of Emergency Core Cooling System during Power Operation, of its Byron and Braidwood UFSAR, and in its applications for two power upratings. Exelon claims that the non-escalation requirement is met by qualifying its pressurizer safety valves (PSVs) for water relief and operating them in lieu of its power operated relief valves.

Exelon states, the SI flow results in liquid discharge through the pressurizer safety relief valves. In order for the PSVs to open, the PO RVs would have remain closed. This would not be a conservative assumption in analyses that are performed to show compliance with the non-escalation requirement.

This assumption prevents the possibility of failure of a PORV to close. ',

Since the licensing basis does not contain an IOECCS analysis to show compliance with the non-escalation requirement, one must construe this to mean that either (1) it is the overpressure requirement case analysis that is presented to demonstrate compliance with the non-escalation requirement, or (2) the PO RVs are somehow to be kept closed during an IOECCS. Neither of these possibilities is acceptable:

The PO RVs, not the PSVs, are designed to operate during AOOs. The PORVs, as well as pressurizer spray and heaters, comprise the pressurizer pressure control system. They are designed to prevent unnecessary reactor trips, and challenges td the PSVs. The PO RVs are designed to relieve enough pressure to keep the plant on line during AOOs (e.g., turbine trips and partial load rejections). Exelon does not explain how the PSVs, which are intended for accidents that are not expected to occur more

than once in a plant's lifetime, could be reasonably expected to open and reseat as often as several times a year.

{Handout - Limits of AOOs}

Figure 1 AOO Boundary AOOs " ... shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

--- American Nuclear Society, ANS 18.2-1973 1 PORV OR 3 PSVs 1,800,000 1,600,000

..r::

'VI 1400,000

..c

1200,000

~

1,000,000 0

~

800,000 - - 1 PORV (steam)

N

J 600,000 - - 3 PSVs (steam)

VI VI

~ 400,000 a..

200,000 0

2,300 2,400 2,500 2,600 2,700 2,800 Pressurizer Pressure (psia)

The figure shows:

• One PORV is shown to open at 2,350 psia . This is enough to prevent the opening of any PSVs.

• The high pressure reactor trip (marked in red) will occur when pressure exceeds 2,400 psi a.

• The PSV opening setpressure is higher than the pressure boundary that defines an AOO (i.e., the 2,400 psia reactor high pressure trip setpoint).

• If pressure continues to increase, after the reactor is tripped, and a PORV does not open, then one or more PSVs would open at 2,500 psia (set to the RCS design pressure).

• Pressure relief would be provided by the PO RVs or by the PSVs; but not both .

• Three PSVs have more than six times the steam relief capacity of one PORV.

• AOOs would lie to the left of the red reactor trip line (i .e., pressures below 2,400 psia). If pressure exceeds the reactor trip setpoint (i.e., despite th e reactor shutdown), then the reactor shutdown has not accommodated the event. Consequently, the event is not an AOO. So events that lie to the right of the red line are not AOOs. If these events are not AOOs, then they must be Condition Ill or IV events.

• PSVs cannot open until after the AOO becomes a more serious event (i.e., opening of the PSVs cannot meet the non-escalation requirement).

The high pressure reactor trip setpoint is 2400 psia. The opening setpoint of the PSVs is 2500 psia .

Therefore, the PSVs will not open until after the event will have progressed beyond the defining boundary of an AOO. The event is no longer an AOO. Therefore, it must be a Condition Ill event. Worse, it is a Condition 111 event with the frequency of occurrence of an AOO. Worse still, the frequency of occurrence will be the sum of the frequencies of occurrence of all AOOs that pressurize the RCS to the opening setpressure of the PO RVs.

Exelon's compliance strategy, which prevents the PORVs from opening, allows the RCS pressure to exceed (by 100 psi) the reactor trip setpoint in order to open the PSVs. This pressure level is beyond the defining boundary of an AOO . Therefore, it becomes necessary to generate a more serious plant condition in order to open any of the PSVs. In this respect, Exelon begs the question. In other words, Exelon claims that certain ANS Condition II events must be allowed to progress to more serious ANS Condition Ill events in order to demonstrate that those ANS Condition II events will not progress to more serious ANS Condition Ill events!

Invalid comparison between two dissimilar events Exelon claims that, if the pressurizer safety relief valves do not reseat, then the transient will proceed and terminate as described in Section 15.6.1, "Inadvertent opening of Pressurizer Safety or Relief Valve." This event is also classified as an event of moderate frequency.

It is not true that both events are events of moderate frequency (i.e., AOOs or Condition II events).

There isn' t even a common basis for comparison. Consider the differences:

The Inadvertent opening of Pressurizer Safety Valve:

(a) PSV relief occurs at 2250 psia .

(b) This is an AOO, or Condition II event.

(c) The analysis of this AOO, in Section 15.6.1, is performed to demonstrate compliance with the DNB requirement . Consequently, the analysis is ended after only a few seconds, when the automatic reactor protection system (RPS) detects a reduction in core thermal margin, and trips the reactor before the calculated DNBR can drop below its safety limit value.

(d) ECCS is not actuated . The analysis of this AOO, in Section 15.6.1, is ended before the ECCS can be actuated by a low RCS pressure condition . The "Inadvertent opening of Pressurizer Safety or Relief Valve", of Section 15.6.1, cannot be compared to the IOECCS, because its analysis is ended too soon .

The IOECCS, with a stuck open PSV:

(a) PSV relief occurs at 2500 psia. {If this were a stuck open PORV, then the initial pressure would be 2350 psia)

(b) If a PSV sticks open, it would be a consequential failure, due to the IOECCS. The result is a Cond ition Ill event (a hot leg LOCA) with the frequency of occurrence of an IOECCS.

(c) A stuck open PSV would not be diagnosed, by the operators, until after the RCS has de pressurized to below the PSV closing setpressure . If they have already shut off the ECCS flow, then the situation could be worse than that of Three Mile Island accident (i .e., a stuck open PORV with no ECCS flow), since a PSV is about twice the size of a PORV. In this scenario, it is

possible to open, and stick open, three PSVs. Three open PSVs create the equivalent of a 3.7 inch hot leg LOCA.

(d) It is necessary for the operators to somehow restore ECCS flow, since stuck open PSVs are not isolable . One can argue that only one operator error separates this event from a TMI scenario .

ECCS flow will not match PSV water relief rate Exelon claims that the flow through a stuck-open PSV would be a minor RCS leak. It states, American Nuclear Society standard 51.1/NlB.2-1973 ... describes ... a condition II event as a "minor reactor coolant system leak which would not prevent orderly reactor shutdown and coo/down assuming makeup is provided by normal makeup systems only." ... normal makeup systems are defined as those systems normally used to maintain reactor coolant inventory under respective conditions of startup, hot standby, power operation, or coo/down, using onsite power. Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak).

The situation that Exelon describes, wherein the flow through the open PSV would be matched by the flow that is delivered by the ECCS flow, would be true only after RCS pressure has dropped to very low levels, late in the IOECCS scenario; long after the non-escalation requirement has been violated . At high RCS pressures, the critical (choked) water flow, through the PSV, will be much greater than the ECCS flow that is delivered. Here is an illustration of this relationship for one PSV. This is a conservative depiction, since (1) ECCS flow is high (i.e., the maximum ECCS flow rate is represented), and (2) the PSV relief rate is low (i.e., there could be as many as three stuck open PSVs). At worst, as many as three PSVs could stick open, and create a hole that is equivalent to a 3.7 inch hot leg LOCA.

ECCS is not a normal RCS makeup system The charging pumps, when actuated by an SI signal, cannot be considered to be a normal makeup system. This charging flow is not controlled by a pressurizer level program or by letdown flow rates. It operates, simply, at maximum capacity, and it does not shut down until the operator shuts it down . That is, when they're actuated by an SI signal, the function of the charging pumps is to supply emergency core cooling, not to maintain a programmed pressurizer water level.

{Handout - ECCS Flow}

Figure 2 Flow in ~ Flow out Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak}.

--- Byron & Braidwood UFSAR, and NSAL 93 -013 IOECCS and eves Malfunction 1,400,000

~

OJ

~ 1,200,000 Qi 0 1,000,000 Vl -

u .s:::.

u 'VI 800,000 UJ ..0 "O -

c- 600,000 - - ECCSFlov 3

...... 0

• -OJ -...... 400,000 - - 2 Open PORVs Water OJ ex:

200,000 ----- Charging Flow

~

0 0 - - 2 Open PORVs Steam a..

500 1,000 1,500 2,000 2,500 Pressurizer Pressure (psia)

The figure shows that (1) ECCS (i.e ., charging) flow rate will not exceed the PORV steam relief rate until the RCS pressure drops to about 2,000 psia, (2) ECCS flow rate will not exceed the PORV water relief rate until the RCS pressure drops to about 1,300 psia, and (3) Charging flow rate will not exceed the PORV water relief rate until the RCS pressure drops below the accumulator injection setpoint (about 600 psia).

(4) One PSV has about twice the steam relief capacity of a PORV, and there are three of them. To estimate the steam relief rate of three stuck-open PSVs, triple the depicted steam relief rate of two stuck-open PORVs.

The pressurizer, during mass addition AOOs (e.g., IOECCS and CVCS Malfunction), is not an open system, like a bucket that is running over. It is a closed, pressurized system with a hole in it. The flow exiting through the hole is determined by the size of the hole, and the pressure of the system, not by the flow that may be entering the system . The NSAL's mass-balance argument (i.e ., what goes in, comes out) contradicts the basic principles of fluid mechanics. Exelon has adopted this rationale, and copied it into its license amendment requests (LARs), and submitted it to the NRC under Oath and Affirmation.

Water qualification and added functional requirements Exelon substitutes PSVs for PORVs to address the non-escalation requirement. To do this, it becomes necessary to show that all the PSVs will reseat after having relieved water. Exelon claims its PSVs are qualified to relieve water, based upon valve tests that were conducted, in 1988, by the Idaho National Engineering Laboratory (INEL) . IN El's report of the valve test results contains this entry:

Section 4.2.3, Extended High Pressure Injection Event The limiting extended high pressure injection event is the spurious actuation of the safety injection system at power .... For a four-loop plant, both the safety valves and PORVs will be challenged. Both steam and water discharge are expected. In this event, however, the safety valves or PORVs open on steam and liquid discharge would not be observed until the pressurizer becomes water solid. .... This would not occur until at least 20 minutes into the event which allows ample time for operator action.

Thus the potential for liquid discharge in extended HP/ events can be disregarded.

INEL is wrong when it states that, both the safety valves and PORVs will be challenged. The opening of one PORV will provide enough relief capacity to prevent the opening of any safety valves.

PSVs must relieve water, and then reseat When Exelon assumes the PSVs will relieve water, and then reseat, it effectively imposes two new design requirements on the PSVs. Currently, the PSVs are designed to operate during Condition IV accidents, like feedline breaks, and beyond design basis events, like anticipated transients without scram (ATWS), where RCS overpressure is the sole issue. Once opened, the PSVs will have fulfilled their RCS overpressure safety function. It is not necessary to require the PSVs to relieve water, and then reseat, unless they are intended to open during AOOs.

Failure to meet GDC 21 When Exelon re purposed the PSVs, for use during AOOs, it became necessary to consider the possibility of a PSV failing to close . GDC 21 becomes a requirement for closure of PSVs as well as opening of PSVs.

One failed-open PSV would create a Condition Ill LOCA that violates the non-escalation requirement.

The PSVs are connected in parallel, and not isolable. This system can readily meet the GDC 21 single failure requirement when the PSVs are required to open; but cannot meet it when the PSVs are required to close . Exelon' s plan to substitute PSVs for PO RVs cannot meet the GDC 21 single failure requirement.

New accident is created and not addressed the no significant hazards statement Recall that the PO RVs are designed to prevent unnecessary challenges to the PSVs. Exelon's compliance strategy prevents the PO RVs from opening, and relies upon the PSVs to open in lieu of the PO RVs. This creates a new accident. For the purpose of this Petition, it can be called an unnecessary challenge to the PSVs {UCPSV) . This is an AOO that pressurizes the RCS, past the reactor trip setpoint (2400 psia) to the PSV opening setpoint (i.e., the RCS design pressure) . The frequency of occurrence for this AOO would be the sum of the frequencies of occurrence of the several AOOs would cause the PO RVs to open. A PSV, if it were to stick open, as required by GDC 21, would be about twice the size of a PORV, and it would not be isolable.

Safety significance, as per 10 CFR §50.92 10 CFR §50.92, Issuance of amendment. Section (a) states, in determining whether an amendment to a license ... will be issued to the applicant, the Comm ission will be guided by the considerations which govern the issuance of initial licenses ... to the extent applicable and appropriate.

It goes on to state, (c) The Commission may make a final determ ination ... that a proposed amendment to an operating license ... involves no significant hazards consideration, if operation of the facility in accordance with the proposed amendment would not:

{1} Involve a significant increase in the probability or consequences of an accident previously evaluated; or (2) Create the possibility of a new or different kind of accident from any accident previously evaluated; or (3) Involve a signif icant reduction in a margin of safety.

I would answer these questions in the following manner:

All systems w ill not continue to be operated in accordance w ith current design requirements . New design requirements have been imposed upon the PSVs, when operated during the IOECCS, and any other AOOs that pressurize the RCS to the PORV opening setpoint. Now, the RCS will have to pressurize to the PSV opening setpoint (i.e ., the RCS design pressure) during each of these AOOs. The PSVs will also be requ ired to reseat, after having relieved water. Therefore, a new failure mode has been introduced :

failure of a PSV to reseat . If this occurs, the result will be a small, hot leg LOCA. This LOCA will be more frequent than the currently analyzed LOCA. The probability of the previously analyzed Condition Ill LOCA will increase to equal the sum of the probabilities of all the AOOs that currently cause the RCS to pressurize to the PORV opening setpoint.

The consequences of the init iating AOOs are also increased, since operation of the PSVs, at 2500 psi a, will always be required during instances in which the PORVs would currently open . The consequences of stuck open PSVs, if they occur, would be greater than the consequences of stuck open PO RVs.

Operation of the PSVs during AOOs is not in their design basis. Frequent pressurization of the RCS to its design pressure could also be outside the RCS design basis.

(2) Create the possibility of a new or different kind of accident from any accident previously evaluated A new accident is created. Call it an unnecessary challenge to the PSVs (UCPSV}. This is an AOO that pressurizes the RCS to the PSV opening setpoint (i.e., the RCS design pressure). The frequency of occurrence for this AOO would be the sum of the frequencies of occurrence of the several AOOs in which PSVs are opened, in lieu of PORVs. Note that, in the 1980s, the NRC was concerned with the safety implications of the high frequency of unnecessary automatic reactor trips that were incurred at operating plants. I worked with the Westinghouse Owners Group (WOG) to reduce the incidence of these trips (see patent no . 4,832,898) . The UCPSV could pose a greater th reat to the public healt h and safety than the unnecessary automatic reactor trip, since the consequences of this event could be potentially greater. For example, a stuck open PSV would have a about twice the relief capacity of a

PORV, and it would not be isolable . It could also exceed the number of allowable pressurizations of the RCS.

(3) Involve a significant reduction in a margin of safety When the PORVs are applied, the margin of safety, to RCS overpressure is 400 psi (2750 psi minus 2350 psi). When the PSVs are applied, the margin of safety, to RCS overpressure is reduced to 250 psi (2750 psi minus 2500 psi). The margin of safety is thus reduced by 37.5%.

It is possible, in the Byron and Braidwood plant designs, for ANS Condition Ill events to occur with the combined frequencies of occurrence of certain AOOs. This increase in the total frequency of occurrence for ANS Condition Ill events (e.g., from once in the plant's lifetime to one or more times per year of operation) is an unquantified reduction in safety margin.

I maintain that Exelon's responses, as given in its no significant hazards statements, are not true.

Exe Ion's responses may be false statements of the kind that could violate the federal false statement statute (18 U.S.C. §lOOl(a)). According to the courts, a conviction under this Act would require proof of five elements:

First- The defendant made a statement; Second- The statement was false; Third- The statement was material; Fourth- The statement was within the jurisdiction of a government department or agency; and Fifth- The statement was made knowingly and willfully.

Proving the first four elements would not be difficult. Proving the fifth element, that the statement was made knowingly and willfully, could be facilitated by improving the NRC's communication with licensees, for example, by revising the applicable standard review plans, and by issuing relevant generic letters or regulatory issue summaries. Then, if any false statements are subsequently submitted to the NRC, they could be reasonably construed to have been made knowingly, and willingly, and possibly in violation of the federal false statement statute (18 U.S.C. §lOOl(a)).

Summary and Conclusion The licensing basis of Exelon's Byron and Braidwood plants contains at least 12 errors. Westinghouse shares in some of these errors, and the NRC fails to detect 11 of them in at least three reviews .

Exelon relies upon the PSVs to open, in lieu of the PO RVs, relieve water, and then reseat. Exelon claims that no PSVs will fail open due to water relief, and therefore would not create a LOCA at the top of the pressurizer. To reach this conclusion, it is necessary to repurpose the PSVs for service during AOOs, and to disregard the GDC 21 single failure requirement.

To rely upon the PSVs, Exelon assumes that the PO RVs will not open. A PORV that does not open cannot fail open, and so the non-escalation requirement is satisfied, by assumption. Exelon's conclusion begs the question. In the process, Exelon creates a new accident, the UCPSV.

The PSVs will not open until after the RCS pressure, during an AOO, rises beyond the pressure for which the AOO is defined (i.e., after the high RCS pressure reactor trip setpoint is reached). By the time the

PSVs open, the AOO will have escalated to a Cond ition Ill event. Exelon focuses upon qualifying the PSVs for water relief duty, in order to substitute them for PORVs; but qualifying valves that will not open before the non-escalation requirement is violated makes no difference, whatsoever, with respect to meeting the non-escalation requirement.

Exelon does not recognize the basic difference between PORVs and PSVs, and their respective functions in the plant. If the Byron and Bra idwood plants we re automobiles, then the PO RVs would be seat belts, and PSVs would be air bags. PORVs, like seat belts, are used often, to protect the driver during abrupt stops and occasiona l fender benders. PORVs, like seat belts, can be engaged, disengaged, and even disconnected (i .e., isolated) . The PSVs, on the other hand, are used once (maybe) in a car' s useful lifetime, to protect the driver du ri ng a head-on coll ision.

Exelon's compliance rationale does not (and cannot) demonstrate that its Byron and Braidwood plant designs will prevent AOOs from developing into more serious events. Therefore, there is no assurance that Cond ition Ill events will not occur at the frequency of Condition II events, in the Byron and Bra idwood plants. Fu rthermore, Exe lon cannot t ruthfu ll y assert that there are no significant hazards in its Byron and Braidwood plant designs.

So, I must request the NRC staff to take the following enforcement action w ith respect to the Byron and Bra idwood plants:

(1) Revoke Exelon' s authorizations to operate its Byron and Bra idwood Stations at any uprated power level.

(2) Impose a license condition, on current operations, requiring Exelon to provide an acceptable demonstration of compl iance with the aforementioned design requ irement . See the Seabrook example of 2005 for a precedent.

(3) Require Exelon to file a 10 CFR §21 report and revise its no significant hazards statement.

Figure 1 AOO Boundary AOOs " ... shall be accommodated with, at most, a shutdown of the reactor with the plant capable of returning to operation after corrective action.

-American Nuclear Society, ANS 18.2-1973 1 PORV OR 3 PSVs 1,800,000 1,600,000

2

'VI 1,400,000

=

..c

.~

1,200,000 Q) 1,000,000 a:

800,000 - - 1 PORV {steam) 600,000 - 3 PSVs (steam) 400,000 200,000 0

2,300 2,400 2,500 2,600 2,700 2,800 Pressurizer Pressure (psia)

The figure shows:

• One PORV is shown to open at 2,350 psia. This is enough to prevent the opening of any PSVs.

• The high pressure reactor trip (marked in red) will occur when pressure exceeds 2,400 psia.

• The PSV opening setpressure is higher than the pressure boundary that defines an AOO (i.e., the 2,400 psia reactor high pressure trip setpoint).

• If pressure continues to increase, after the reactor is tripped, and a PORV does not open, then one or more PSVs would open at 2,500 psia (set to the RCS design pressure).

• Pressure relief would be provided by the PORVs or by the PSVs; but not both.

• Three PSVs have more than six times the steam relief capacity of one PORV.

• AOOs would lie to the left of the red reactor trip line (i.e., pressures below 2,400 psia). If pressure exceeds the reactor trip setpoint (i.e., despite the reactor shutdown), then the reactor shutdown has not accommodated the event. Consequently, the event is not an AOO. So events that lie to the right of the red line are not AOOs. If these events are not AOOs, then they must be Condition Ill or IV events.

• PSVs cannot open until after the AOO becomes a more serious event (i.e., opening of the PSVs cannot meet the non-escalation requirement).

Figure2 Flow in '#. Flow out Since the cause of the water relief is the ECCS flow, the magnitude of the leak will be less than or equivalent to that of the ECCS (i.e., operation of the ECCS maintains RCS inventory during the postulated event and establishes the magnitude of the subject leak).

- Byron & Braidwood UFSAR, and NSAL 93-013 IOEees and eves Ma lfunction 1,400,000

~

<11

-~ 1,200,000 a;

0 1,000,000 V'l -

u .r:::.

u 'ill 800,000 UJ ..0 "O -

c- 600,000 - ECCSFlow 3

....vro -

0 400,000

• - u.. - - 2 Open PORVs Water

<11 a::

200,000 ----- Charging Flow ii:

0 0 - - 2 Open PORVs Steam a.

500 1,000 1,500 2,000 2,500 Pressurizer Pressure (psia)

The figure shows that (1) ECCS (i.e., charging) flow rate will not exceed the PORV steam relief rate until the RCS pressure drops to about 2,000 psia, (2) ECCS flow rate will not exceed the PORV water relief rate until the RCS pressure drops to about 1,300 psia, and (3) Charging flow rate will not exceed the PORV water relief rate until the RCS pressure drops below the accumulator injection setpoint (about 600 psia).

(4) One PSV has about twice the steam relief capacity of a PORV, and there are three of them. To estimate the steam relief rate of three stuck-open PSVs, triple the depicted steam relief rate of two stuck-open PORVs.

The pressurizer, during mass addition AOOs (e.g., IOECCS and eves Malfunction), is not an open system, like a bucket that is running over. It is a closed, pressurized system with a hole in it. The flow exiting through the hole is determined by the size of the hole, and the pressure of the system, not by the flow that may be entering the system. The NSAL's mass-balance argument (i.e., what goes in, comes out) contradicts the basic principles of fluid mechanics. Exelon has adopted this rationale, and copied it into its license amendment requests (LARs), and submitted it to the NRC under Oath and Affirmation.