ML19338E966

Direct Testimony Re Ucs Contention 14.Explains Significance of Distinction Between Safety & nonsafety-grade Sys & Components.Prof Qualifications & Certificate of Svc Encl. Related Correspondence

ML19338E966
Person / Time
Site:	Three Mile Island
Issue date:	10/02/1980
From:	Pollard R UNION OF CONCERNED SCIENTISTS
To:
References
ISSUANCES-SP, NUDOCS 8010070015
Download: ML19338E966 (15)

Text

.

~,Iam

, . -- g HRt.KrEUCu w ay; Gg::33 y O)

Q  ? .,w, SY , , ~:$$

UNITED STATES OF AMERICA  ;;7 ," M A .77 NUCLEAR REGULATORY COMMISSION -

, 0;hy ee 9

BEFORE THE ATOMIC SAFETY AND LICENSING BOARD C, E' 10 '

)

In the Matter of )

)

METROPOLITAN EDISON ) Docket No. 50-289 COMPANY, et al., )

)

j (Three Mile Island )

Nuclear Station, Unit )

No. 1) )

)

DIRECT TESTIMONY OF j ROBERT D. POLLARD ON BEHALF OF THE UNION OF CONCERNED SCIENTISTS REGARDING UCS CONTENTION NO. 14 4

October 2, 1980 i

80.100700/6-

ROBERT D. POLLARD OUALIFICATIONS Mr. Pollard is presently employed as a nuclear safety expert with the Union of Concerned Scientists , a non-profit coalition of scientis ts , engineers and other orofessionals supported by over 80,000 public sponsors.

Mr. Pollard's formal education in nuclear design bega..

in May , 1959, when he was selected to serve as an electronics technician in the nuclear power program of the U.S. Navy.

After completing the required trair,ing, he became an instruc-tor responsible for teaching naval personnel both the theore-tical and practical aspects of operation, maintenance and repair for nuclear propulsion plants. From February, 1964 to April, 1965, he served as senior reactor operator, supervis-ing the reactor control division of the U.S.S. Sargo, a nuclear-powered submarine.

! After his honorable discharge in 1965, Mr. Pollard attended Syracuse University, where he received the degree of Bachelor of Science magna cu m laude in Electrical Engt-neering in June, 1969.

In July, 1969, Mr. Pollard was hired by the Atomic Energy Commission (AEC), and continued as a technical exoert with the AEC and its successor the United States Nuclear Regulatory Commission (NRC) until February, 1976. After joining the AEC, he studied advanced electrical and nuclear engineering at the Graduate School of the University of New Mexico in Albuquerque. He subsequently advanced to the cositions of Reactor Engineer (Ins trumen ta ti on ) and Project Manager with AEC/NRC.

As a Reactor Eng i nee r , Mr. Pollard was primarily respon-sible for performing detailed technical reviews analyzing and evaluating the adequacy of the design of reactor protec-tion systems, control systems and emergency electrical power systems in proposed nuclear facilities. In September 19 74, he was promoted to the position of Project Manager and became responsible for planning and coordinating all aspects of the design and safety reviews of applications for licenses to construct and operate several commercial nuclear power -

plants. He served as Project Manager for the review of a number of nuclear power plants including: Indian Point, .

Unit 3, Comanche Peak, Units 1 and 2, and Catawba, Units i 1 and 2. While with NRC, Mr. Pollard also served on the '

standards group, participating in developing standards and safety guides, and as a menber of IEEE Committees.

i

+

OUTLINE - DIRECT TESTIMONY ON UCS CONTENTION NO. 14 The testimony explains the fundamental significance in nuclear safety regulation of the distinction between safety and non-safety grade systems and components. It then demonstrates how the TMI-2 accident showed three shortcomings in past practice: 1) certain systems previously classified as non-safety are, in fact, impcrtant to safety; 2) some systems known to be safety-related do not meet all of the requirements applicable to such systems; 3) the design basis for judging the capability of safety systems has not been properly specified. The Staff has acknowledged, in fact, that despite an NRC requirement that failure of non-safety grade equipment should not initiate or aggravate an accident, there is no comprehensive and systematic demon-stration that this has been accomplished. In other words, the elaborate structure for ensuring diverse and redundant safety systems remains vulnerable to unforeseen failures of non-safety equipment, just as during the TMI-2 accident.

No systematic or comprehensive review has been made of TMI-l in the aftermath of the accident; the staff proposes a long-term study to address the problem. The promise of a study, .

l i

l

l while it may offer hope for future improvement, does nothing to solve the safety hazards demonstrated by the TMI-2 accident.

1 Before the plant is permitted to resume operation, all systems currently classified as non-safety which can in fact either cause or aggravate an accident or can be called upon to mitigate an accident must be identified and required to meet safety-grade criteria.

C 4

e p .

UCS CONTENTION NO. 14 f

The accident demonstrated that there are systems and components presently classified as non-safety-related which can have an adverse effect on the integrity of the core because they can directly or indirectly affect temperature, pressure, flow and/or reactivity. This issue is discussed at length in Section 3.2, " System Design Requirements," of NUREG-0578, the TMI-2 Lessons Learned Task Force Report (Short Term). The following quote from page 18 of the report describes the problem:

There is another perspective on this question provided by the the TMI-2 accident. At TMI-2, operational problems with the condensate purification system led to a loss.of feedwater and initiated the sequence of events that even-tually resulted in damage to the core. Several nonsafety systems were used at various times in the mitigation of the accident in ways not considered in the safety analysis; for example, long-term maintenance of core flow and cooling with the steam generators and the reactor coolant pumps.

The present classification system does not adequately recognize either of these kinds of effects that nonsafety system can have on the safety of the plant. Thus, require-ments for nonsufety systems may be needed to reduce the frequency of occurrence of events that initiate or adversly affect transients and accidents, and other requirements may be needed to improve the current capability for use ,

of nonsafety systems during transient or accident sit-uations. In its work in this area, the Task Force will include a more realistic assessment of the interaction between operators and systems.

The Staff proposes to study the problem further. This is ,

not a sufficient answer. All systems and components which can either cause or aggravate an accident or can be called 1

14-2 upon to mitigate an accident must be identified and classified as components important to safety and required to meet all safety-grade design criteria.

My testimony on UCS Contention 14 addresses the following subjects: 1) the commission's scheme for classifying plant structures, systems, and components as either safety or non-

! safety equipment; 2) the types of errors made in applying the Commission's classification scheme which contributed to the TMI-2 accident; and 3) the relationship between the long-term study to develop requirements for non-safety systems (See NUREG-0578, Section 3.2 and NUREG-0585, Section 3.2) and the Commission's present classification scheme. In my opinion, this testimony demonstrates that the present TMI-l design poses undue risk to public health and safety'because: a)the non-safety system demonstrated to be important to safety by

the TMI-2 accident have not been fully upgraded to safety grade;

b) the safety systems demonstrated by the'TMI-2 accident to be in violation of certain safety grade requirements have not been upgraded to meet all safety grade requirements; and c) the j adverse interactions between non-safety and safety systems have not been identified and corrected. ..

14-3 Classification Scheme The Commission's licensing process involves assessing whether the plant's structures, system, and components can be relied upon to protect public health and safety in the event of occurrence of any of the selected design basis events, i.e., accidents or anticipated operational occurrences.

The commission has developed regulations that define the minimum requirements for design, fabrication, construction, testing and performance which must be met if a structure, system or component is rolied upon to protect the public. These require-ments are set forth in the General Design Criteria of Appendix A to 10 CFR Part 50, industry standards such as IEEE Std 279 which are incorporated in 10 CFR 50.55a, and other sections of 10 CFR Part 50.

Commission policy and practice has been to apply these requirements to those structures, systems, and components that provide the requisite reasonable assurance that the nuclear plant can be operated without undu'e risk to public health and safety. This equipment is variously referred to The inadequacies of the Commission's method of choosing des;gn basis events will be discussed in connection with 4 UCS Contention 13. .

s

14-4 as safety-related, safety grade or important to safety. The method of applying these requirements is to assume that only safety grade systems function during a design basis event.

Non-safety grade systems are assumed to be unavailable and, therefore, their functioning is not credited in evaluating the protection available to mitigate the consequences of a design' basis event.

TMI-2 Errors in Applying the Classification Scheme The TMI-2 accident demonstrated three types of errors that were made in applying the Commission's classification scheme. First, the accident showed that some systems that

' had been classified as non-safety should have been classified as systems important to safety. Second, some systems that had been classified as important to safety did not meet all the requirements' appl'icable to safety grade systems. Third, the design basis events for systems classified as important to safety had been incorrectly specified. I will now explain each of these errors.

1. Improper Classification of Systems During the course of the TMI-2 accident, several systems that had been classified as non-safety systems were used to mitigate the accident. For example, the reactor coolant pumps In an Advance Notice of Proposed Rulemaking, " Consideration of Degraded or Melted Cores in Safety Regulation," September 26, 1980, the Commission described current practice as follows: "Further-more, in reviewing reactor plant designs using the ' design basis accident' approach, the NRC does not review all structures, sys-tems, and components but rather reviews, in varying levels of detail, only those considered ' safety grade' by the applicant submitting a Safety Analysis Report. Items considered by the applicant to be outslae the scope of design basis accident analyses

[ Footnote continued on following page]

14-5

,' wero used at various timas to accomplish coro cooling. Had the accident included the loss of offsite power, the reactor coolant pumps would have been unavailable. The loss of offsite power during an accident is an event that must be considered in accordance with the provisions of GDC-17. However, since the reactor coolant pumps were classified as non-safety components, the lack of an onsite emergency power supply to operate the pumps was not required. The TMI-l design remains unchanged. Despite the need for the reactor coolant pumps to mitigate the TMI-2 accident, the Staff and Met Ed take the position that the pumps are not important to safety.

Other examples of systems classified as non-safety which affected the course of the TMI-2 accident are the pressurizer level instruments, the PORV and its associated block valve and the auxiliary feedwater system. The failure of the pressurizer level instruments required termination of reactor coolant pump operation. However, at TMI-l the class-ification remains unchanged. As a result, although provisions have been made to supply onsite power to the pressurizer level instruments, the design is such that a single failure will result in loss of power to all three pressurizer level instru-ments.

The inability to recognize an open PORV led to core damage. However, at TMI-l the ability to isolate an open

( Footnote continued from previous page) are generally not considered to be ' safety grade' and are not reviewed by the NRC to see whether they will perform as intended or meet various dependability criteria. This method of classification is based on the notion that things credited in the analysis of a design basis event or specified in the regulations are important to safety and thus are ' safety grade' while all else is 'non-safety grade.'

Non-safety grade items do not receive continuing regulatory super-vision or surveillance to see that they are properly maintained or I that their design is not changed in some way that might interact negatively with other systems. Instead, these items simply receive l

what attention may be dictated by routine industrial codes and by desires to enhance plant availability."

14-6 PORV apparently remains classified as not important to safety.

A single failure can result in the inability to close the single PORV block valve. Similarly, recognition of the vital importance of auxiliary feedwater to core cooling has not resulted in requiring that all safety grade requirements be met before TMI-l restarts. (See the Staff's TMI-l Restart Evaluation, page C8-37).

2. Systems Important to Safety Did Not Meet All Safety Grade Requirements The second type of error disclosed by the TMI-2 accident is the failure to require that systems classified as important to safety meet all the requirements applicable to safety grade equipment. For example, the emergency core cooling system was not designed to prevent operator interference with completion of its safety function. The protection system signals used to initiate ECCS operation were not derived from direct measurements of the desired variable-reactor vessel water level. -The contain-ment isolation system was not initiated bp diverse parameters.

Except for the last example, these deficiencies remain uncorrected at TMI-1.

3. The Design Basis for Safety Systems Was Inadequate The third type of error disclosed by the TMI-2 accident -

14-7 is the inadequate determination of the severity of the design basis event for which safety grade systems must provide pro-tection. For example, during the TMI-2 accident an attempt was made to use the decay heat removal (DHR) system for core cooling. This attempt was unsuccessful for two reasons.

First, the design basis did not require the DHR system to be operable up to the design pressure of the reactor coolant system. Second, the DHR system leak rate and radiation shielding was found acceptable on the basis that it would always be carrying water with a relatively low level of radioactive contamination. Because of the extensive core damage at TMI-2, the DHR system could not be used because its leak rate and radiation shielding were inadequate to prevent excessive radiation exposure and reactor coolant system pressure was higher than the DHR system design pressure.

These deficiencies remain uncorrected at TMI-1.

The above demonstrates that the licensing review of TMI-1, while based on a fundamental distinction between

" safety" and "non-safety" equipment, was not adequate to identify all equipment important to safety, to define the design bases for such equipment, or to identify and prevent adverse interactions between non-safety and safety equipment which can compromise the ability of safety systems to perform j

14-8 their necessary functions. There does not seem to be serious .

disagreement over this. In the TMI-2 Lessons Learned Final Report, the Staff acknowledged that there are myriad inter-actions between non-safety grade and safety grade equipment which have not been systematically evaluated.

"The interactions between non-safety grade and safety grade equipment are numerous, varied, and complex and have not been systematically ovaluated. Even though there is a general requirement that failure of non-safety grade equipment or structures shoqld not initiate or aggravate an accident, there is no comprehensive and systamatic demonstration that this has been accomplished." (NUREG- 05 8 5,

p. 3-3) .

The Staff has also acknowledged that some non-safety grade systems have a direct effect on core cooling.

1 "The Staff agrees that some systems and components presently classified as non-safety related can have an effect on the core because they can directly or indirectly affect temperature, pressure, flow and/or reactivity."

(Response to UCS Interrogatory 156).

Long-Term Study of Non-Safety System Requirements Sections 3.2 of both NUREG-0578 and NUREG-0585 discuss a long-term study to address the problems I have discussed above. Met Ed will be required to " evaluate the interaction of non-safety and safety grade systems...to assure that any interaction will not result in axceeding the acceptance criteria for any design basis event." (NUREG-0585, page A-14). One question presented, then, is'how this Board can find reasonable 6

1 l

14-9 l

l l

assurance that public health and safety is protected until that long-term study identifying adverse interactions is completed and its results implemented. The period of time until the latter is accomplished appears to be open-ended.

The second question presented is perhaps a clearer one.

Where the accident showed clearly that particular equipment presently classified non-safety is, in fact , important to safety or where the accident showed that equipment important to safety does not meet all safety grade requirements, what is the basis for finding reasonable assurance that the plant is safe enough to permit resumption of operation?

~

In my opinion, the answer to both questions is that neither the Staff nor Met Ed have provided any evidence upon which one could find a reasonable basis for concluding that the plant is safe enough to operate in the face of the lessons learned from TMI-2.

O

$ 6 = me +ememeenam - a ema.-. = ,emommmm me - = we e--- **= g- = = = = .e =

e r ,

. UNITED STATES OF AMERICA .\'

NUCLEAR REGULATORY COMMISSION -

f.\

y i4 BEFORE THE ATOMIC SAFETY AND LICENSING BOARD j!', ,. C. !

r 2,

. EJ4-d, $

p, . ) 'E; /;'

C, '65h,

)

D j E In the Matter of ) 90l l -

)

METROPOLITAN EDISON ) Docket No. 50-289 COMPANY, _et _al., )

)

(Three Mile Island )

Nuclear Station, Unit )

No. 1) )

)

CERTIFICATE OF SERVICE I hereby certify that copies of the " Direct Testimony of Robert D. Pollard on Behalf of the Union of Concerned Scientists Regarding UCS Contention No. 9," and " Direct Testimony of Robert D. Pollard on Behalf of the Union of Concerned Scientists Regarding U S Contention No. 14" have been mailed postage pre paid this 2nd day of October, 1980 to the following parties:

Secretary of the Commission (3) Mr. Steven C. Sholly U.S. Nuclear Regulatory Commission 304 South Market Street Washington, D.C. 20555 Mechanicsburg, PA 17055 Attn: Chief, Docketing & Service Section James A. Tourtellotte, Esq. Jordan D. Cunningham, Esq.

Office of the Exec. Legal Director Fox, Farr & Cunningham U.S. Nuclear Regulatory Commission 2320 North Second Street Washington, D.C. 20555 Harrisburg, PA 17110 Karin W. Carter, Esquire Frieda Berryhill Assistant Attorney General Coalition for Nuclear Power 505 Exec'utive House Postponement P.O. Box 2357 2610 Grendon Drive Harrisbur,g, PA 17120 Wilmington, Delaware 19808 .

Daniel M. Pell Walter W. Cohen, Consumer Adv.

' 32 South Beaver Street Department of Justice York, Pennsylvania 17401 Strawberry Square, 14th Floor Harrisburg, PA 17127 i

?

Cert. of Service  :

Docket No. 50-289 p..

Chauncey Kepford Robert L. Kaupp, Esquire Judith H. Johnsrud Assistant Solicitor Environmental Coalition on .

County of Dauphin Nuclear Power h P.O. Box P 433 Orlando Avenue State College, PA 16801 407 North Front 17108 Street Harrisburg, PA Levin, Esquire Robert O. Pollard John A. Chesapeake Energy Alliance Assistant Counsel 6.19 Montpelier Street Pennsylvania Public Utility Ealtimore, Maryland 21218 Commission Harrisburg, PA 17120 Marvin I. Lewis Theodore Adler 6504 Bradford Terrace Widoff, Reager, Selkowitz Philadelphia, PA 19149

& Adler 3552 Old Gettysburg Road Camp Hill, PA 17011 .

Ivan W. Smith, Chairman Ms. Marjorie Aamodt Atomic Safety & Licensing Board -

RD #5 U.S. Nuclear Regulatory Commission 20555 Coatesville, PA 19320 Washington, D.C. i Linda W.-Little Dr.  ;

Dr. Walter H. Jordan 5000 Hermitage Drive 27612 881 W. Outer Drive Raleigh, North Carolina Oak Ridge, Tennessee 37830 Ms. Jane Lee George F. Trowbridge, Esquire R.D. #3, Box 3521 17319 Shaw, Pittman, Potts & Etters, Pennsylvania Trowbridge 1800 M Street, N.W.2't36 Wa shis . ; '- on , D.C.

w 9