ML19337A841

Direct Testimony of Rd Pollard on Behalf of Ucs Re Ucs Contention 3

ML19337A841
Person / Time
Site:	Three Mile Island
Issue date:	09/25/1980
From:	Pollard R UNION OF CONCERNED SCIENTISTS
To:
Shared Package
ML19337A840	List: ML19337A839 ML19337A841 ML19337A842 ML19337A843
References
NUDOCS 8009300420
Download: ML19337A841 (18)

Text

• \t'tI;e.

k l' g ,

gy e .. 'cp:

UNITED STATES OF AMERICA w  ;., '

C-NUCLEAR REGULATORY COMMISSION <; I ,ce, # Ci r-AIE:

'#I3 cf 2. e. ' 't /j .~

'4cf.g{yg:7 BEFORE THE ATOMIC SAFETY AND LICENSING BOARD ,

4 Obijg ,

)

In the Matter of )

, )

METROPOLITAN EDISON ) Docket No. 50-289 COMPANY, et al., )

1 )

(Three Mile Island )

Nuclear Station, Unit )

No. 1) )

)

DIRECT TESTIMONY OF ROBERT D. POLLARD ON BEHALF OF THE UNION OF CONCERNED SCIENTISTS REGARDING UCS CONTENTION NO. 3

,.t.

Septe aber 25, 1980 8'O 09300 Q20 i . ... ,

.e ROBERT D. POLLARD ,

OUALIFICATIONS Mr. Pollard is presently employed as a nuclear safety expert with the Union of Concerned Scientists, a non-profit coalition of scientists , engineers and other professionals supported by over 80,000 public sponsors.

Mr. Pollard's formal education in nuclear design began in May , 1959, when he was selected to serve as an electronics technician in the nuclear power program of the U.S. Navy.

After completing the required training, he became an instruc-tor responsible for teaching naval personnel both the theore-tical and practical aspects of operation, maintenance and repair for nuclear propulsion plants. From February, 1964 to April , 1965, he served as senior reactor operator, supervis-ing the reactor control division of the U.S.S. Sargo, a nuclear-powered submarine.

After his honorable discharge in 1965, Mr. Pollard attended Syracuse University, where he received the degree of Bachelor of Science magna cum laude in Electrical Engi-neering in June, 1969.

In July, 1969, Mr. Pollard was hired by the Atomic Energy Commission (AEC), and continued as a technical exoert with the AEC and its successor the United States Nuclear Regulatory Commission (NRC) until February, 1976. After joining the AEC, he studied advanced electrical and nuclear engineering at the Graduate School of the University of New Mexico in Albuquerque. He subsequently advanced to the oositions of Reactor Engineer (I ns trumenta tion ) and Project Manager with AEC/NRC.

As a Reactor Engineer, Mr. Pollard was primarily respon-sible for performing detailed technical reviews analyzing and evaluating'the adequacy of the design of reactor protec-tion . sys tems , control systems and emergency electrical power systems in proposed nuclear f acilities. In September 1974, he und promoted'to the posihion of Project Manager and became responsible for planning and coordinating all aspects of the design and safety reviews of applications for licensen to construct and operate several commercial.. nuclear power plants. .Heeserved as Pro je'c t Manager for t6e review of a

• number of nuclear power. plants includingi 14 dian Point, -

Unit 3, Comanche Peak, Units 1 and 2 g and Catawba, Units 1 and 2. While with NRC , Mr. Pollard.also served on the standards group, participating in developing standards and safety guides, and as a member of IEEE Committees.

t 9

1 OUTLINE - DIRECT TESTIMONY ON UCS CONTENTION NO. 3 This testimony describes why the ability to maintain natural circulation to remove decay heat is important to safety and how the pressurizer heaters are needed to assure natural circulation. It concludes that pressurizer heaters are com-ponents "important to safety" within the meaning of NRC reg-ulations. However, the TMI-l pressurizer heaters and associated controls do not meet the NRC's criteria applicable to the design and fabrication of components important to safety.

Therefore, they cannot be relied upon to function when needed.

This poses undue risk to puolic health and safety. TMI-l should not be permitted to restart unless and until the pressurizer heaters and associated controls are found to conform to all applicable safety-grade design criteria.

w

O UCS CONTENTION NO. 3 The staff recognizes that pressurizer heaters and associated controls are necessary to maintain natural cir-culation at hot stand-by conditions. Therefore, this equip-ment should be classified as " components important to safety" and required to meet all applicable safety-grade design criteria, including but not limited to diversity (GDC 22),

seismic and envircnmental qualification (GDC 2 and 4),

automatic initiation (GDC 20) , separation and independence (GDC 3 and 22) , quality assurance (GDC 1) , adequate, reliable on-site power supplies (GDC 17) and the single failure criterion.

The staff's proposal to connect these heaters to the present on-site emergency power supplies does not provide an equiv-alent or acceptable level of protection.

In order to maintain the TMI-1 reactor in a safe condition following a shutdown, it is necessary to remove the decay heat from the reactor. Assuming that the reactor core retains its coolable geometry and that the primary coolant pressure boundary remains intact, there is only one effective method of removing the decay heat at THI-1. Water must be

~

circulated through the reactor, the main coolant piping, and the steam generator tubes. The decay heat transferred from 9

Y

4 3-2 the fuel to the reactor coolant is then transferred to the secondary system through the steam generator tubes.

There are only two methods of providing circulation of the reactor cooling water available at TMI-1. These are forced circulation using one or more of the reactor coolant pumps or natural circulation. Either method of circulation requires that reactor coolant system pressure be maintained high enough to prevent boiling of the water. If a sufficiently high pressure is not maintained, the accumulation of steam will prevent operation of the reactor coolant pumps and will prevent natural circulation in the reactor coolant system.

At TMI-1, the pressurizer is used to control the pressure in the reactor coolant system. Turning on the electrical heaters submerged in the water at the bottom section of the pressurizer will increase pressure in the reactor coolant system. If one or more reactor coolant pumps are operating, opening the pressurizer spray valve results in spraying water water into the steam bubble in the top section of the pressurizer thereby decreasing reactor coolant system pressure. During normal operation, the pressurizer heaters and pressurizer

, spray valve are controlled automatically to maintain reactor coolant pressure in the desired range.

Prior to the TMI-2 accident, the design of TMI-l was such that, in the case of a reactor shutdown together with a

+

.I '-

0 3-3 loss of offsite electric power - a condition that must be designed for in accordance with GDC the reactor coolant pumps and pressurizer heaters would be inoperable. This is because they could not be powered from the onsite emergency diesel generators. After the TMI-2 accident, the staff's

" Lessons Learned" Task Force addressed this demonstrated inadequacy and TMI-l has since been modified to the extent that some of the pressurizer heaters can now be energized from the onsite emergency diesel generators.

The TMI-2 accident demonstrated that the inability to remove decay heat from a shutdown reactor can lead to severe fuel damage. Failure to maintain a sufficiently high pressure in the reactor coolant syster resulted in the formation of steam in that system. This in turn led to severe vibration of the reactor coolant pumps requiring the operator to stop those pumps. This terminated forced circulation in the reactor coolant system. Steam accumulation in the reactor coolant system also prevented the establishment of natural circulation.

As noted above, as a result of the TMI-2 accident, the NRC Staff and Met Ed decided to upgrade the pressurizer heaters to the. extent that some heaters could be connected to the onsite emergency diesel generators. The apparent purpose of this modification was to provide reasonable assurance that the pressure in the reactor coolant system could be maintained

3-4 high enough to permit decay heat removal by natural circulation.

Although I do not believe that an accident such as the TMI-2 accident should have been necessary to cause recognition of the importance of the pressurizer heaters, the following quote from NUREG-0578, page A-2 draws the connection between the TMI-2 accident and the need to assure the operability of the pressurizer heaters:

Maintenance of safe plant conditions, including the ability to initiate and maintain natural circulation, depends on the maintenance of pressure control in the reactor coolant system. Pressure control is normally achieved through the use of pressurizer heaters. Experience at TMI-2 has indicated that the maintenance of natural circulation capability is important to safety, including the need to maintain satisfactory natural circulation during an extended loss of offtice power.

As a result sf tha TMI-2 accident, the Staff developed a list of short-term actions that, in the Staff's view "would provide substantial, additional protection required for the public health and safety." (NUREG-0578, page 3. ) The Commission subsequently ordered that "[t]he licensee shall comply with the Category A recommendations as specified in Table B-1 of NUREG-0578." -(Order, item 8). I agree that changes in the TMI-l design are needed "to increase the availability of the reactor ,

pressurizer for pressure control in the event of loss of offsite power, thus decreasing the frequency of challenges to [the]

3-5 emergency core cooling systems." (NUREG-0578, page 6) . I conclude that such changes will provide substantial, additional protection which is required for the public health and safety.

However, for the reasons discussed below, I conclude that the measures described in Section 2.1.1.3.1, "Pressurizar Heaters," of the Restart Report and on page C8-7 of the Staff's TMI-l Restart Evaluation, are not sufficient to ensure the availability of pressurizer heaters when needed and thus do not provide the protection required for public health and safety. Fur thermore, as discussed in my testimony on UCS Contention 4, I conclude that the present design of TMI-l poses an additional hazard to public health and safety that was not present prior to the TMI-2 accident. To correct both of these problems, I conclude that the pressurizer heaters must be classified as components important to safety and the design of THI-l must be modified and tested to demonstrate conformance with the Commission's regulations that apply to components important to safety. .

In order to assure that systems needed to prevent or mitigate accidents can be relied upon, the Commission has developed the requirements contained in Appendix A to 10 CFR Part 50. The General Design Criteria set forth the minimum requirements for those structures, systems, and components i

I

3-6 that provide reasonable assurance that a nuclear power plant can be operated without undue risk to the health and safety of the public, i.e., those structures, systems, and components important to safety. The requirements of the General Design Criteria establish minimum necessary design, fabrication, construction, testir', and performance requirements for struc-tures systems, and components important to safety. The specific requirements address subjects such as the redundancy and independence of safety systems, the ability of safety systems to remain functional during and following events such as fire, earthquakes and loss-of-coolant accidents, the need for automatic operation, the ability to detect failures by periodic tests, and the ability to provide necessary emer-gency electric power. In short, the General Design Criteria set forth the Commission's definition of what is required to assure that a structure, system, or component can be relied upon to protect the public. The Commission's policy is that, in assessing the adequacy of a plant design, only those systems that meet the GDC can be assumed to function. Therefore, if a system is needed to prevent or mitigate an accident, conformance with the General Design Criteria is mandatory. Systems that meet the General Design Criteria are commonly called safety-grade.

F e

3-7 Prior to the TMI-2 accident, the pressurizer heaters were not classified as components important to safety and, therefore, were not required to comply with the General Design Criteria. The TMI-2 accident demonstrated the importance of pressure control and the Staff concluded that availability of the pressurizer heaters is important to pressure control.

I concur. In my opinion, the proper application of Commission policy upon this situation compels classification of the pressurizer heaters as components important to safety and the consequent requirement that the pressurizer heaters conform to the General Design Criteria prior to restart of TMI-1.

Neither the Staff nor Met Ed classify the pressurizer heaters as components important to safety. However, the Staff believes that requiring the provision for connecting the heaters to the onsite power supply "in effect constitutes reclassification of the pressurizer heaters as ' components important to safety' in the context of the discussion in GDC-17." (Staff Response to UCS Interrogatories 26 & 31, Met Ed Response to UCS Interrogatory 31). Both the Staff and Met Ed apparently conclude that the TMI-l design complies with the " position" on pressurizer heaters in Section 3.1 ,

of Appendix A to NUREG-0578 as modified by the Staff's seven

" clarification" items on page CS-6 of the Staff's TMI-l Restart l

l

3-8 Evaluation (NUREG-0 68 0) . Basically, the modification that has been made to THI-1, in accordance with that position and its " clarification", now permits the pressurizer heaters to be connected to the emergency power supplies by operator action.

This is apparently an attempt to meet that oortion of GDC-17 requiring that the onsite electric power system

" permit functioning of structures, systems, and components important to safety," assuming that the offsite electric 1

power system is not functioning. Neither the Staff nor Met Ed proposes to apply any other requirements in the GDC applicable to functioning of the pressurizer heaters as components important to safety, apparently not even GDC 15 and 20, which are among the requirements the Position in NUREG-0578 is supposed to satisfy. (NUREG-057 8, page A-4) . I find the Staff and Met Ed's position to be totally inconsistent with Commission policy and the TMI-l design to be incapable of providing d

reasonable assurance that the health an'-safety of the public l

will be protected. Providing a means of connecting the pressurizer heaters to the onsite electric power system, but not providing independence between the two groups of pressurizer heaters, not demonstrating that the heaters can function following .

a safe shutdown earthquake, steamline break, a loss of coolant O

s

3-9 accident, not providing automatic load shedding and connection of the heaters and not meeting any of the other Commission regulations applicable to functioning of the heaters can have two dangerous results. At best, heaters that are not operable may be connected to the onsite emergency power supply. At worst, connecting non-safety grade heaters may result in failure of the onsite emergency power supply.

In neither case would the objective of assuring reactor coolant pressure control be achieved.

The logical inconsistency of the Staff and Met Ed's position can be illustrated in several ways.

Neither the Staff nor Met Ed propose that the heaters should be designed to remain functional following an earth-quake, as required by GDC-2 for components important to safety. A short discussion will illustrate the illogic of their position. TMI is required to withstand the occurrence of a safe shutdown earthquake without endangering the public.

~

The occurrence of a safe shutdown earthquake could, and in r

my opinion most,likely would, result in.a loss of offsite power. Without offsite power, reactor cooling will be adequate only if natural circulation is established. Maintaining the .

reacto

r coolant pressure is necessary to achieve natural circulation This aspect is discussed in my testimony on UCS Contention 4.

4 e I

3-10 and the pressurizer heaters are important to maintaining the pressure. However, since the heaters are not seismically qualified as required by GDC-2, they must be assumed to be inoperable following the earthquake.

The Staff and Met Ed's position regarding GDC-2 is also inconsistent with the Staff's previous position in Regulatory Guide 1.139, " Guidance for Residual Heat Removal." The following information was provided in Regulatory Guide 1.139:

1. The Reactor Safety Study found that " systems or equipment failures that led to the inability to remove decay heat resulted in a higher probability of a core melt than that predicted for a large

[ loss-of-coolant accident] for both [ pressurized water reactors and boiling water reactors.]"

2. " [A] significant safety benefit will be gained by upgrading those systems and equipment needed to maintain the [ reactor coolant system] at the hot-standby condition for extended periods or those needed to cool and depressurize the [ reactor coolant system] so that the [ residual heat removal]

system can be operated."

3. "Furthermore, . . . experience shows that there have been events that required eventual cooldown and long-term cooling until the [ reactor coolant system] was cold enough to perform inspection and repairs."

4. "It is therefore obvious that the ability to transfer heat from the reactor to the environment af ter a shutdown is an important safety function

... (emphasis added.)

5. "These accident conditions [in which it is essential to remove decay heat] can, conceivably -

include a safe shutdown earthquake (SSE) and 5

e l

4 3-11 an extended loss of offsite power that may have resulted from that SSE."

6. "In that case, all components and equipment that are not seismic Category I...would be assumed inoperable."

7. "Under these circumstances, a plant shutdown (including cooldown) within a reasonable time requires systems designed to safety grade standards and operable from the control room. However, limited operator actions outside the control room may be permitted if suitably justified."

8. "Without offsite power, reactor cooling depends solely on natural convection circulation..."

In my opinion, there should be no question that the pressuri=er heaters must meet GDC-2.

Another example of the illogical position adopted by the Staff and Met Ed is the failure to require conformance with GDC-4 by demonstrating that the pressurizer heaters will remain operable following a small loss-of-coolant accident. It is certainly ironic as well as illogical that a " lesson learned"

~

by the Staff and Met Ed from the TMI-2 accident, which.was a small loss-of-coolant accident, is that th.e pressurizer heaters must be upgraded, but that such upgrading need not include a demonstration that the heaters are capable of functioning in the environment created by a loss-of-coolant accident. In 4

GDC-4 requires, in part, that structures, systems, and components important to safety be designed to operate under ,

normal and accident env.ironmental conditions, including loss '

of coolant accidents.

c.

1

3-12 addition, the Staff's position is inconsistent with its position prior to the TMI-2 accident as expressed in Regulatory Guide 1.139 "The design should be r;uch that the reactor can be taken from normal operating ',anditions to cold shutdown using only safety-grade systems that satisfy General Design Criteria 1 through 5."

One final example of the illogic of the Staff's position involves GDC-20, " Protection System Functions." The Staff claims that the measures recommended in NUREG-0578 are "[c]on-sistent with satisfying the requirements of General Design Criteria.. 20...." (Page A-4) . GDC-20 states: "The protection system shall be designed L1) to initiate automatically the operation of appropriate systems...to assure that specified acceptable fuel design limits are not exceeded as a result of anticipated operational occurrences...." (emphasis added) i l

In contrast, the Staff's position in NUREG-0578 specifically )

calls for operator action to connect the pressurizer heaters  !"

to the emergency power supply and to shed loads from the ,

emergency power supply to provide sufficient capacity for connection of the heaters. Thus, although the Staff claims otherwise, it is clear that a system which is initiated manually does not satisfy a criterion requiring automatic l

initiation.

I will now address those portions of the Staff's and Met Ed's positions which are apparently put forward to justify l

l

3-13 failing to require the pressurizer heaters to be classified as safety-grade.

Both the Staff and Met Ed refer to a " bleed and feed" l mode of reactor cooling using the emergency core cooling system and the power operated relief valve which can, they say, be used if natural circulation can not be established. However, I note that in response to UCS interrogatory 32, the Staff acknowledged'that it has not attempted to determine whether .

the combination of the " bleed and feed" mode and pressurizer heaters needed for natural circulation is safety-grade. For example, the Staff did not attempt to determine whether the

" bleed and feed" mode or the combination of the pressurizer heater and " bleed and feed" meets GDC-3, " Fire Protection,"

GDC-22, " Protection System Independence" and the single failure criterion. It is clear that neither system alone conforms t safety-grade criteria. Two non-safety grade systems do not add up to one safety grade system. This is not a matter-of the exercise of engineering judgment; i.t is the clear purport of NRC regulatory policy.

I also believe that even if the " bleed and feed" mode were demonstrated to be an affective heat removal method and were designed to meet the requirements applicable to systems important to safety (neither of these conditions is now met in my opinion) it would not be an acceptable substitute for

3-14 classifying the pressurizer heaters as safety grade. My reasoning is as follows:

• 1. One principal lesson of the TMI-2 accident is that the pressurizer heaters should be upgraded to reduce the challenges to the ECCS as a result of relatively frequent anticipated operational occurrences such as loss of offsite power. To suggest that an inadequate upgrading of the heaters can be compensated for by challenging the ECCS during an anticipated operational occurrence is completely contrary to the lesson supposedly learned.

2. Another principal lesson learned from the TMI-2

~

accident is that the frequency of events that lead to opening the PORV should be reduced and that the  :

methods of assuring that a stuck open PORV can be isolated should be improved. To suggest that an anticipated operational occurrence should be handled by deliberately opening the PORV and turning a routine event such as loss of offsite power into a loss-of-coolant accident is contrary to the lesson supposedly learned.

In summary, I have described why the ability to maintain -

natural circulation to remove decay heat is important to safety 4

k

3-15 and how the pressurizer heaters are needed to assure natural circulation. This leads me to conclude that the pressurizer heaters are "important to safety" within the meaning of NRC regulations. I have also described the Commission's regulatory policy with regard to equipment important to safety and shown how the Staff's position in this proceeding contravenes that policy. In my opinion, the reason why the Staff's position produces untenable and illogical results is that although the Staff recognizes the vital importance of pressurizer heaters in providing reasonable assurance that operation of TMI-1 will not pose undue risk to public health and safety, they fail to understand that non-conformance with the General Design Criteria precludes a finding that the pressurizer heaters will be available when needed.

e" t

9

. , - - - - ,- <