ML19337A422

Testimony in Response to Ucs Contention 10 & Sc Sholly Contention 3 Re Safety Sys Bypass & Override.Shows That Operator Intervention in Safety Function Does Not Violate Criteria.Prof Qualifications Encl.Related Correspondence

ML19337A422
Person / Time
Site:	Three Mile Island
Issue date:	09/15/1980
From:	Phyllis Clark, Patterson E, Ross M METROPOLITAN EDISON CO.
To:
Shared Package
ML19332B231	List: ML19332B236 ML19332B237 ML19332B238 ML19332B241 ML19332B243 ML19332B245 ML19332B249 ML19332B260 ML19337A421 ML19337A422 ML19337A423 ML19337A424 ML19337A425 ML19337A426 ML19337A427 ML19337A428 ML19337A429 ML19337A430 ML19337A432 ML19337A434 ML19337A437 ML19337A439
References
ISSUANCES-SP, NUDOCS 8009260394
Download: ML19337A422 (21)

Text

__ -

9  %

'0C#U!c 9 RELATED COIUCGPCNDENGE

'? >;c a 5y Sep

• • ~

O 3 " g ~

! ff LIC 9/15/80

% p UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION BEFORE THE ATOMIC SAFETY AND LICENSING BOARD In the Matter of )

)

METROPOLITAN EDISCN COMPANY ) Docket No. ?0-289 (Three Mile Island Nuclear

) (Restart)

)

Station, Unit No. 1) )

LICENSEE 'S TESTIMONY OF PHILIP R. CLARK, MICHAEL J. ROSS AND E. S. PATTERSON IN RESPONSE TO UCS CONTENTION NO. 10 AND SHOLLY CONTENTION NO. 3 (SAFETY SYSTEM BYPASS AND OVERRIDE) e ef

OUTLINE The purposes and objectives of this testimony are to respond to UCS Contention 10 and Sholly Contention 3, which assert that operator ability to intervene in a safety function following automatic initiation violates standard IEEE 279 as incorporated by NRC regulations and endangers public health and safety. The testimony shows that operator intervention in a safety function, following initiation of a protective system action, does not violate applicable criteria. Further, the testimony describes why such operator intervention is desirable and may be necessary in certain circumstances.

i I

l 1

l 1

l l

l l

i t

INDEX l l

INTRODUCTION .............................................. 1 RESPONSE TO CONTENTIONS * .......... ,** ...........,, ,

i l

l l

(

l I

l I

I

(

INTRODUCTION This testimony, by Mr. Philip R. Clark, Vice President, Nuclear Activities, GPU; Mr. Michael J. Ross, TMI-l Supervisor of Operations, GPU; and Mr. E. S. Patterson, Technical Advisor to Equipment Engineering Section, Nuclear Power Generation Division of Babcock & Wilcox Company, is ado.essed to the following contentions:

UCS CONTENTION NO. 10 The design of the safety systems at TMI is such that the operator can prevent the completion of a safety function which is initiated automati-cally; to wit: the operator can (and did) shut of f the emergency core cooling system prematurely. q This violates 54.16 of IEEE 279 as incorporated in  !

10 CPR 50.55(a)(h) which states:

The protection system shall be so designed that, once initiated, a protection system action shall go to completion.

The design must be modified so that no operator action can prevent the completion of a safety function once initiated.

SHOLLY COETENTION NO. 3 It is contended that as a result of Licensee's Operating Procedures, the emergency core cooling system can be defeated by operator actions during the course of a transient and/or accident at Unit 1, such defeat consisting of either throttling back the high-pressure injection pumps or tripping these pumps. It is further contended that under the conditions of a loss-of-feedwater transient / loss of coolant accident at Unit 1, defeat of.the emergency core cooling system high-pressure injection system by pump throttling and/or pump trip results in significant w

cladding metal-water reaction, causing the production of amounts of hydrogen gas in excess of the amounts required by NRC regulations to be considered in the design and accident analysis of nuclear power plants. It is contended further that such production of hydrogen gas results in l the high risk of breach of containment integrity

due to the explosive combustion of the hydrogen i gas in the containment. Inasmuch as the emergency core cooling system is an engineered safety  :

feature which is relied upon to protect the public I health and safety, and because proper operation of  !

the emergency core cooling system is required to t provide reasonable assurance that Unit I can be operated without endangering the public health and 1 safety, it is contended that the emergency core cooling system operating procedures must be -

modified in order to ensure compliance with the GDC 35 requirement o.t negligible clad metal-water reaction following a loss-of-coolant accident l (LOCA). It is further contended that the emergency core cooling system operating procedures must be appropriately modified prior to restart in order to provide for protection of the public health and safety.

j RESPONSE TO CONTENTIONS BY WITNESS PATTERSON:

UCS Contention 10 asserts that operator ability to intervene in a safety function following automatic in.itiation violates NRC regulations and that system design must be changed to prevent such operator action. The UCS interpretation of the cited requirement - Section 4.16 of IEEE 279, as incorporated in 10 CFB Part 50, Section 50.55a(h) - is not valid.

-6 7

BY WITUESSES CLARK AND ROSS:

Contrary to the thrust of these contentions, the ability for the operator to control a safety function following initiation serves to enhance safety.

, BY WITNESS PATTERSON:

Section 1 of IEEE 279-1968, from which the above portion of Section 4.16 is extracted, defines the scope of the protection systems addressed by that standard as follows:

For purposes of these Criteria, the nuclear power plant protection system encompasses all electric and mechanical devices and circuitry (from sensors to actuation device input terminals) involved in generating those signals associated with the protective function. These signals include those that acttaate reactor trip and tha t , in the event of a serisus reactor accident, actuate engineered safeguards such as containment isolation, core spray, safety injection, pressure reduction, and air cleaning.

The requirement of Section 4.16 of IEEE 279 as cited by UCS is therefore applicabi.e only in the context of this protection system scope. For example, for a condition requiring the Emergency Core Cooling System (ECCS), the protection system shall be so designed that, once initiated, nothing within the protection system can prevent the signal frem completing its specified action, which is actuation of the ECCS. .

In support of this position it should be noted that the 1971 issue of IEEE 279 clarified the portion of Section 4.16 cited by UCS to read :

The protection system shall be so designed that, once initiated, a p*otective action at the system level shall go to spletion. (Emphasis added.)

Except for the term " plane" (1968) versus " generating station" (1971) both versionr of IEEE 279 define " system" as follows:

Where not otherwise qualified, the word " system" refers to the nuclear power plant protection system, as defined in the scope section of the criteria.

The definition of the protection system given in the scope, Section 1, of the standard as quoted above cemained essentially unchanged from the 1968 to the 1971 versions.

Clearly, the contended application of IEEE-279 is without a factual basis. The standard is directed at initiation of a protective action, and not at completion of the subsequent safety function.

BY WITNESS CLARK:

Licensee absolutely disagrees with the basic philosophy underlying this contention. The contention implies that it is necessary to provide automatic circuitry to prevent the operator from modifying any protective action once it has been initiated. Not only is this impractical, but attempts to carry out this philosophy would seriously complicate the plant and detract from safety. Contrary to this philosophy, the real need is to prepare the operators to correctly diagnose the plant condition and carry out the appropriate actions.

From the very beginning of the nuclear power industry, the plant operator has been recognized as a required element in correct plant operation. This parallels the philosophy in other industries, such as transportation, where the operator is also highly important. It has always been recognized tha t it would be impossible to constt..a a plant which would operate correctly under all conditions, and that a properly trained operator in control of the plant is the best continuing guarantee of correct operation. This is particularly true since it is impossible to foresee every possible condition which could arise.. The operator, when properly prepared fo r his task, is infinitely more flexible in responding to unexpected situations than any possible automatic control s

mechanisms.

The principal criteria for selecting actions assigned to the operators is that they must be actions operators can reasonably be expected to perform and for which they can be adequately trained. Very rapid actions required fo r immed ia te response to sudden unanticipated changes in plant conditions, for example, do not meet these criteria. For this reason the immediate actions of protective systems (e.g., reactor trip, ECCS actuation and conts.l.nent isolation) are automated and the operator action is simply to verify that the automatic circuitry has functioned properly. Subsequent bypass of such circuits, on the other hand, proceeds on a much more deliberate

'. basis. The operators have suple opportunity to verify that the conditions prerequisite to bypass are in fact met. They can ,

as appropriate, refer to written operating procedures and/or consult with their immediate supervisor prior to activating the bypass. It is fully appropriate, therefore, that this type of action remains under operator control.

It should be noted that continued addition of automatic circuits does not insure greater safety. Additional com-plexities may in fact be counter-productive to safety. The goal must be to keep the plant sufficiently simple that plant operators can understand the plant design, its current configu-ration, and the appropriate operator actions. Additional complexities should be added only where the operator really requires them to perform his job.

Deliberate operator intervention is desirable and necessary after appropriate conditions exist in an accident sequence, as illustrated by the following examples. (1)

Following a small-break loss of coolant accident, if the primary system is subcooled and a pressurizer water level is ind ica ted , the operator may throttle ECCS flow. In this manner the operator ,can properly continue the required safety func-tion, i.e.,

assuring adequate core cooling, while placing the plant into a preferred shutdown condition. Without this action, large quantities of water containing some amount of radioactivity would be released to the reactor containment building. requiring cleanup actions and some degree of personnel exposure. (2) It may also be necessary for the operator to open containment isolation valves after their automatic closure to take samples of the primary coolant or containment atmosphere in order to assess post-accident conditions. This may be desirable or necessary to determine the appropriate actions related to continued containment and cleanup of radioactive products. (3) Operator intervention is desirable to prevent the Emergency Feedwater System from feeding a damaged steam generator following a steam line break in the intermediate building. Stopping the steam flow from the break serves to reduce the hazard to personnel who may be located near the break. (4) It may also be necessary to secure emergency feedwater to prevent overfilling a steam generator if a control valve malfunctior.s. This minimizes the l possibility of generating a water hammer in the main steam lines, with possible damage to equipment. (5) Under all  ;

1 conditions following inadvertant actuation, the ability to bypass the protective action promptly is desirable to avoid unnecessary plant transients or to protect personnel.

l BY WITNE5_ ROSS:

As pointed out in NUREG-0578 and in Sholly Contention No.

3, the concern is not with the capability for the operator intervention, but rather with providing the operator with the 1

(

correct information and procedural guidance on which to take subsequent actions. Additional instrumentation added to TMI-l to provide the operator better information on the primary system conditions is discussed in Licensee's testimony on Detection of Inadequate Core Cooling. In addition, the operators have been provided with specific instructions as to when it is necessary or allowable to intervene and over-ride the automatic operation of the ECCS systems. The procedure covering loss of reactor coolant / loss of reactor coolant pressure contains the following guidance:

CAUTION: Do not throttle HPI unless one of the following three conditions exists:

a. The LPI system is in operation and flowing at a rate in excess of 1000 gpm in each line and the situation has been stable for 20 minutes.

b. All hot and cold leg temperatures are at least 50*F below the saturation temperature for the existing RCS pressure, and the action is necessary to prevent the indicated pressuizer level from going off-scale high. If 50*F subcooling cannot be maintained, full HPI shall be reactivated.

c. Or, all indicated hot and cold leg temperatures are at least 50*F below the saturation temperature for the indicated RCS pressure and continued full HPI injection will result in RCS pres-sure/downcomer temperatures within the Restricted Region of Figure 2 (which presents the allowable pressure-temperature relationship for avoidance of brittle fracture of the reactor vessel].

In "hort, the TMI-l emergency procedure governinr, ECCS ope-ration has been modified as recommended in Sholly Contention No. 3.

Similarly, the following guidance is given for the Con-tainment Isolation System:

o Containment isolation valves may be open?d to obtain samples in accordance with approved proced ures . The isolation valves shall be reclosed after the sample is obtained.

o other containment isolation valves automatically closed shall remain closed until the following conditions are met:

a. Reactor building pressure is less that 2 psig, b.

Containment radiation levels have been assessed based on radiation monitor readings or samples,

c. The integrity of the system outside the reactor building has been assessed.

(Stable surge tank level, visual inspection or pressure test should be considered to verify integ rity) .

d. The Shif t Supervisor or Emergency Director shall give permissian to reopen containment isolation valves.

e. Installed radiation monitors or portable monitors shall be available to detect any l

release that may result from opening the valve.

In its final specification of this contention UCS included the emergency feedwater system along with emergency core coolant systela and containment isolation system. As with the ECCS and containment isolation system, guidance is provided for operating the emergency feedwater system in the event a transition to natural circulation is required:

o Take hand (manual) control of startup feedwater regulatory valves and slowly increase steam generator level to 50% on the operating range level indicator.

o Start the motor driven emergency feedwater pumps, and establish control of the steam generator level by taking hand control and opening the emergency feedwater regulating valves.

It should be noted that if emergency feedwater has automati-cally started due to loss of main feedwater, the steps for manual raising of steam generator level with the emergency feedwater regulating valves are still applicable.

I have previously described in Licensee's testimony on the Detection of Inadequate Core Cooling, some aspects of operator training at TMI-1. The training emphasizes the importance of following procedures. The training and testing of operators, however, also provides assurance that operators are coinizant of procedural requirements without aid of the procedures.

These personnel are required to demonstrate during testing that the immediate action requirements of emergency procedures are kno wn . Subsequent portions of emergency procedures that require signoff by operators contain requirements for re-verification of immediate action steps.

During the Cperator Accelerated Retraining Program training, the importance of consultation and communication between individuals on shif t has been stressed for significant operations, such as the manual acticas of reducing ECCS flow, overriding containment isolation on specific lines and manipulating steam generator secondary level.

BY WITNESS PATTERSON:

In summary, the interpretation of IEEE-279 contended by UCS is not valid. Following initiation of a protection system action, subsequent operator intervention in the safety function does not violate applicable criteria.

BY WITNESSES CLARK AND ROSS:

Further, operator intervention in a safety system operation is desirable and may be necessary in certain circum-stances. Appropriate instrumentation, procedural guidance and training have been provided to TMI-1 operators on the t

situations in which they should intervene in the automatic operation of the ECCS, containment isolation and emergency feedwater system.

1 i

1 h

I 4

1 c

i i

1 4

l l

. . - .- .. -. . _ . _ _ - . . = . . . _ . . . _..- - - . - . . . - - .

IHILIP R. CLARK, SR.

Business Address: GPU Service Corporation 100 Interpace Parkway Parsippany, New Jersey 07054 Education: B.C.E. (Cum Laude), Civil Engineering, Polytechnic Institute of Brooklyn, 1951. Graduate courses, Civil Engineering, Polytechnic Institute of i Brooklyn, 1951 to 1953. Oak Ridge School of Reactor Technology, 1953 to 1954. '

Experience: Vice President, Nuclear Activities, GPU Service Corporation, January 1980 to present. Responsibilities include:

Directing and monitoring of the opera-tion, maintenance and testing of TMl-1, TMI-2 and Oyster Creek; direc-ting and monitoring of support ac-tivities for these plants including design, manufacturing, quality con-trol, training, and radiological and environmental controls; representing the GPU Nuclear Group by way of con-tacts, negotiations and discussions with vendors, contractors, governmen-tal agencies, other utilities, industry organizations and citizens groups; establishing policies and pro-cedures relating to the GPU nuclear plants; reviewing and approving staffing and budget proposals.

Associate Director, Reactors, Naval Reactors Division, U.S. Department of Energy and Chief, Reactor Engineering Division, Nuclear Power Directorate, Naval Sea Systems Command, Department of the Navy, 1964 to 1979. Responsi-ble for the direction of a major ele-ment of the U.S. Naval Nuclear Propulsion Program. Retired U.S.

Government August 1979.

U.S. Navy, 1954 to 1964. Held various positions within the Navy Nuclear Power Program.

Naval Architect, New York Naval Shipyard, 1951 to 1953.

Honors: Navy Distinguished Civilian Service Award, 1972.

U.S. Energy Research and Development Administration Special Achievement Award, 1976.

t tb d

l l

l

-2_

MICHAEL J. ROSS Business Address: Metropolitan Edison Company Three Mile Island Nuclear Station P.O. Box 480 Middletown, Pennsylvania 17057 Education: U.S. Navy Nuclear Power School, 1961. U.S.

Navy Nuclear Power Prototype School, 1961.

Excerience: Supervisor of Operations, Three Mile Island Unit 1, Metropolitan Edison Company, 1978 to present. Responsible for directing the day-to-day operation of the plant to ensure compliance with the conditions of the plant operating license and technical spe-cifications, including supervision of the Radioactive Waste Processing and Shipment Group and coordination of operations and related maintenance activities with the Superintendent of Maintenance.

Shift Supervisor, Three Mile Island Unit 1, Metropolitan Edison Company, 1972 to 1978.

Responsible for the management of all operations and maintenance activities, including the manipulation of any controls, equipment or components in physical plant systems on his shift.

Shift Foreman, Three Mile Island Unit 1, Metropolitan Edison Company, 1970 to 1972.

Responsible for performance of various pre-operational activities, including preparation of procedures and start-up equipment checks.

Reactor Plant Technician, Saxton Nuclear Experimental Corporation, 1968 to 1970.

Held position of reactor operator; addi-tionally, was responsible for training operations staff.

i l

U.S. Navy, 1960 to 1968. Positions held include reactor operator aboard USS Haddo, Instructor at the Nuclear Power Training Unit, and AEC Field Representative at the Nuclear Power Training Unit Professional Affiliations: Babcock & Wilcox Owner's Group, Fuel Handling Subcommittee.

l l

l

E.S. PATTERSON Business Address: Babcock & Wilcox Company Nuclear Power Generation Division P.O. Box 1260 Lynchburg, Virginia 24505 Education: B.A., Physics, University of Nebraska at Omaha, 1956.

Experience: Technical Advisor, Babcock & Wilcox Company Nuclear Power Generation Division, 1973 to present. Advises Equipment Engineering Section on instrumentation matters.

Instrumentation and Control Design Engineer, Babcock and Wilcox Company, 1957 to 1973. From 1957 to 1966, responsibilities included the design of nuclear instrumentation and safety systems for'various nuclear ships, including the N.S. Savannah and the Otto Hahn, design and procurement of instrumentation and control systems for five test reactors and for the Babcock & Wilcox CNSG. From 1966 through 1969, was responsible for the design of Oconee-type plant reactor protection systems. From 1970 to 1973, performed various assignments relating to the design and procurement of instrumentation and control systems for the B&W NSSS.

Project Engineer, Materials Test Reactor, Idaho, 1956 to 1957.

Professional Affiliations: Member IEEE Nuclear Science Group Standards Committee during the preparation and of IEEE 279-1968. Member Joint Committee on Nuclear Power Standards of the IEEE Group on Nuclear Science and the IEEE Power Engineering Society during the preparation and approval of IEEE 27 9-1971.

e

l Joined the IEEE Nuclear Standard writing effort in 1967 as the founding Chairman of what is now the Subcommittee on Reliability under the Nuclear Power Engineering Committee.

Presently the Chairman of the Editorial Subcommittee and member of the Nuclear Power Engineering Committee.

Member, U.S. Delegation to the International Electrotechnical Commission Committee on Nuclear Instrumentation, 1970-1979.

Chaired 1976 IAEA session on Software i for Protection Systems, meeting on the Use of Computers for Protection Systems and Automatic Control. I l

Chaired 1979 IAEA session on l Man-Machine Communication, meeting on Procedures and Systems for Assisting ~

an Operator during Normal and Anamolous Nuclear Power Plant Operation Situations.

Registered Professional Engineer, California.

Publications: "A Typical Incore Monitoring System,"

IAEA, Ontario, May 1974.

"The Need for Criteria and Philosophical Development for Human Factors Accountability in Nuclear Power Plants," IAEA, Munich, December 1979. i I