ML20079J133

Petition for Order to Show Cause Re Emergency Feedwater Sys. OL Should Be Suspended Unless & Until Facility Emergency Feedwater Sys Complies W/Nrc Rules Applicable to Sys Important to Safety

ML20079J133
Person / Time
Site:	Three Mile Island
Issue date:	01/20/1984
From:	Weiss E HARMON & WEISS, UNION OF CONCERNED SCIENTISTS
To:	NRC COMMISSION (OCM)
Shared Package
ML20079J135	List: ML20079J133 ML20079J149 ML20079J179
References
NUDOCS 8401240224
Download: ML20079J133 (31)

Text

_

DOCKETED USMP.C

'84 JAN 23 Pl2:53 CFFICE OF E' t CRtita 00CKEilliG A 5ED BRANCH UNITED STATES OF AMERICA BEFORE THE NUCLEAR REGULATORY COMMISSION UNION OF CONCERNED SCIENTISTS' PETITION FOR SHOW CAUSE CONCERNING TMI-1 EMERGENCY FEEDWATER SYSTEM ELLYN R. WEISS Harmon, Weiss & Jordan 1725 I Street, N.W., Suite 506 Washington, D.C. 20006 Counsel for Petitioner Dated: January 20, 1984 8401240224 8 gDRADOCKO c

TABLE OF CONTENTS JURISDICTION AND INTRODUCTION Jurisdiction 1 Description of the Petitioner 3 Introduction 3 FACTS The TMI-1 EFW System Is Not Environmentally Qualifed 5 The TMI-1 EFW System is Not Seismically Qualified 9 The TMI-1 EFW System Can Be Disabled By A Single Component Failure 19 4

-The EFW Flow Instruments Are Inaccurate 21 i The Main Steam Line Rupture Detection System Is Inadequate 25 29 RELIEF REQUESTED 1

ATTACHMENTS Union of Concerned Scientists Response to GPU Letter of December 6,1983, Regarding Emergency Feedwater Flow Instrumentation, December 9,1983.

UCS Rebuttal to Licensee's Reply Regarding EFW Flow Instrumentation, J anuary ' 6, 1984.

Affidavit of Robert D. Pollard i

l i

i

. . UNITED STATES OF AMERICA BEFORE THE NUCLEAR REGULATORY COMMISSION UNION OF CONCERNED SCIENTISTS' PETITION FOR SHOW CAUSE CONCERNING TMI-1 EMERGENCY FEEDWATER SYSTEM JURISDICTION AND INTRODUCTION Jurisdiction This petition is filed pursuant to 10 CFR 2.206,10 CFR 2.202, and the Commission's inherent supervisory authority to oversee all aspects of the regulatory and licensing process and its " overriding responsibility for assuring public heal th and safety in the operation of nuclear power facili ties."1/ The action requested is an order suspending the operating license for Three Mile Island Nuclear Station Unit No.1 ("TMI-1") unless and until the plant's Emergency Feedwater ("EFW") System complies with the NRC rules applicable to systems important to safety (including safety-grade, safety-related, and engineered safety feature systems).

The material which follows demonstrates that there is not reasonable L

l assurance that TMI-1 can be safely operated due to numerous deficiencies in l

the EFW system. The deficiencies in the EFW system discussed in detail below cut a broad swath across the spectrum of safety requirements. It might be

-1/ Consolidated Edison Co. of N. Y., (Indian Point Units 1, 2 and 3),

! CLI-75-8, NRCI 75/8, 173, (1975). See also U. S. Energy & Development l Admin., (Clinch River Breeder Project), CLI-76-13, NRCI 76/8, 67, 75-76, l (1976); Consumers Power Co., (Midland Units 1 and 2), CLI-73-38, i RAI-73-12, 1084, (1973); Public Service Co. of N. H., (Seabrook Nuclear Power Station, Units 1 and 2), CL1-//-8, 5 NRG 503, 515-517, (1977).

t I

, . argued that one or more of the deficiencies taken individually does not pose an intolerable risk. In the aggregate, however, they thoroughly compromise the reliability of one of the most important safety systems in the plant and destroy the fundamental principle of defense-in-depth espoused by the NRC.

The issues enumerated below have not been resolved in the TMI-1 restart proceeding, eitner:because of the narrow scope of that proceeding which was limited to consideration of the EFW response to only loss of main feedwater and small break loss of coolant accidents or because the information was-not available until recently.

Both the TMI-1 Licensee, GPU Nuclear, and the NRC staff have failed to resolve the safety issues which have arisen outside the scope of the hearing.

While the jurisdiction of the TMI-1 restart proceeding was limited,2/ -

that fact does not in any way diminish the NRC's general responsibility to ensure that all facilities which it regulates, including TMI-1, pose no undue risk to public health and safety.

This petition is lodged with the Commission directly because the NRC staff has recommended restart of TMI-1 with full knowledge of the EFW deficiencies discussed herein and because the Commission now has under consideration action which would allow TMI-1 to operate by lif ting the "immediate effectiveness" of its orders of July and August, 1979. Before allowing TMI-1 te operate, it is vital that the Commissioners address and resolve these safety issues. The Commission's inherent authority is explicitly recognized in 10 CFR 2.206(c)(1):

--2/

The NRC staff's review and conclusions in the restart proceeding were carefully' circumscribed. No overall safety judgment was made. The staff stated: . . . we find that there is reasonable assurance that, with regard to the items covered by NUREG-0680 and its supplements, TRUf can resume operations without undue risk to the public health and safety."

NUREG-0680, Supp. No. 3, TMI-1 Restart, April 1981, p. 3, emphasis added.

, . This reviewing power [over staff decisions regarding petitions under 10 CFR 2.206] does not limit ir, any way either the Commission's supervisory power over delegated staff actions or the Commission's power to consult with the staff on a formal or informal basis regarding the institution of proceedings under this section.

In the face of the information presented herein, authorization of restart by the Commission would violate its statutory mandate to ensure the public health and safety.

Description of the Petitioner The Union of Concetned Scientists (UCS) is a non-profit, public corporation which conducts scientific and technical research concerning advanced technologies, concentrating on issues concerning nuclear safety, energy choices and arms control . The organization grew out of an informal facul ty group at the Massachusetts' Institute of Technology in the late 1960's. It has grown into a national group whose work is supported by over 100,000 citizen sponsors. UCS has published many technical reports on various aspects of nuclear safety and has participated as a party in a variety of NRC proceedings.

Introduction A highly reliable emergency feedwater (EFW) system is essential for safe r operation of Three Mile Island Unit 1 (TMI-1). EFW must function properly in i

order to cool the reactor following both anticipated operational occurrences, such as routine reactor shutdowns accompanied by loss of offsite electrical power, and design basis accidents, such as a small break loss of coolant accident and a main steam line break accident. For accidents of the type which occurred at TMI Unit 2, the only viable method of decay heat removal is natural circulation of the reactor cooling water through the steam generators,

. ~ , - - , . - - -- ..- ~ , - - . . -, -- ,- -. --.,.n ~.

+3

. . in either the single-phase (liquid) or two-phase (boiler condenser) mode. The TMI-1 EFW system must function properly or natural circulation will not be ef fective.3_/ If the EFW system fails to deliver water or if it fails to properly control water level in the steam generators, TMI-1 is vulnerable to precisely the same consequences seen in the TMI-2 accident.

In_ the NRC staff's words, "[t]he need for an emergency feedwater system of high reliability is a clear lesson learned from the TMI-2 accident."1/

Despite this fact, the NRC staff has voiced no opposition to GPU Nuclear's proposal to operatr TMI-1 with a demonstrably unreliable EFW system that does not remotely approach meeting the Commission's requirement applicable to a system important to safety or a safety-related system.

By Licensee's own admission, the TMI-1 EFW system needs to be upgraded "to a safety grade system in order to provide increased reliability in its capability to mitigate the effects of design basis accidents when the main feedwater system is unavailable."5_/ According to GPU Nuclear, "[t]he modifications being implemented as part of this upgrade include mechanical system configurations changes, mechanical (seismic) and electrical (environmental) equipment qualification upgrades, changes to the control system for EFW components and seismic upgrade of piping sections in the Main Steam, Emergency Feedwater and Main Feedwater Systems."6/ - However, the only

-3/ Metropolitan Edison Co. (Unree Mile Island Nuclear Station, Unit No.1),

ALAB-729, 17 NRC 814, 822, May 26, 1983.

-4/ NUREG-0578, "TMI-2 Lessons Learned Task Force Status Report and Short-Term Recommendations," July 1979, p.10.

-5/ H. D. Hukill, Director, TMI-1 to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG 0737 II.E.1.1),"

August 23, 1983.

6/ Id.

r-

. . 5-conunitment is that these modifications "be completed prior to starty from the Cycle 6 refueling,"2/ i.e., the first refueling after restart.

The present status of the TMI-1 emergency feedwater system is that it is not qualified to survive a steam line or other high energy line break when it would be required to function, is not qualified to withstand either a relatively mild earthquake or the so-called safe shutdown earthquake an'd is not immune to single failures in many respects. The newly-installed EFW flow measurement instruments (required as a result of the TMI-2 accident) are not accurate, EFW flow is not automatically initiated on low steam generator level or a main feedwater line rupture, there are no qualified intruments to measure water level in the condensate storage tanks which are the principal source of water for the EFW system pumps, and the main steam line rupture detection system is not adequate to prevent overpressurization of the containment. In short, the TMI-1 EFW system is not capable of assuring safety for design basis accidents when the main feedwater system is unavailable. Under these circumstances, NRC does not have reasonable assurance that TMI-1 can operate without posing undue risk to public health and safety.

FACTS l

1. The TMI-1 EFW System Is Not Environmentally Qualified

! NRC regulations require that structures, systems and components important to safety be designed to accommodate and function during accidents.8_/ It must l be demonstrated that such components and systems are capable of functioning in the environment (e.g., high temperature, pressure, humidity and radiation) l caused by postulated accidents.

7/ Id.

8f 10 CFR Part 50, App. A, General Design Criterion 4.

. . One of the " postulated accidents" is a steam line break outside of the reactor containment building. In the event of such an accident, EFW is required to deliver water to the steam generators. However, GPU recognizes that the TMI-1 EFW system is not qualified for the hostile environmental conditions resulting from a main steam line break.1/ In addition, several pipes carrying steam or high temperature water are located in the Intermediate Building that also houses vital components of the EFW system which are not qualified to survive the environmental conditions created by a break in those pipes. The construction of the Intermediate Building is such that the steam can permeate to all the redundant components of the EFW system. Thus the EFW system could be disabled at the precise time it is needed. Moreover, the high temperature would prevent or at least delay plant operators from entering the area to repair the damage or to attempt to manually operate the damaged EFW components.10_/ GPU's analysis of the temperature profile in the Intermediate Building after a steam line break is that the temperature peaks at 337 F, decreases below 2000 F after 70 minutes and does not return to ambient conditions for over two hours.1_1_/

-9/ H. D. Hukill, Director, TMI-1 to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG 0737 II.E.1.1),"

August 23, 1983, enclosure, p.11.

--10/ This situation has already occurred in Unit 2. On January 1,1979, failure of the bellows on the atmospheric steam dump valves allowed steam to enter the area containing the steam-driven EFW pump. The adjacent area containing the two motor-driven EFW pumps also contained a steam environment. Although a review of plant documentation did not disclose any equipment damage as a result of that event, "[t]emperatures were too high to enter the area at the time of the steam release." See B&W Exhibit 727 (Draft NUREG-0600), p. 55. This information was deleted from NUREG-0600 prior to its publication.

---11/ System Component Evaluation Worksheets for TMI-1 EFW system, GPU, p. 3A of 28, dated 1/22/81. This material was prepared by GPU as part of the ongoing NRC efforts to determine the status of environmental qualification of safety components.

__ _ ._ _ , _ _ . ~ _ _ _ , . _ _ _

4 - The components of the TMI-1 EFW system which are located in the Intermediate Building include the three EFW pumps, motor-operated isolation valves, flow control valves, electric / pneumatic converters for the flow control valves, EFW flow instruments, terminal' boxes, and power and control cables. The available information demonstrating that much of this equipment has not been shown to be capable of functioning in a steam line break environment includes the Staff's Safety Evaluation Report for Environmental Qualification of Safety-Related Electrical Equipment for TMI-1, dated December 10, 1982, and the associated Technical Evaluation Report, dated November 5, 1982, prepared by the Staff's contractor, Franklin Research Center.12_/

The Technical Evaluation Report concluded that environental qualification had not been est;blished for many EFW system components, including the following: EFW pumps' discharge header isolations valves (EF-V-2A, -2B), EFW pumps' suction valves (EF-V-1A, -18), solenoid valves (SV1, 2, 3, 4) used for the EFW flow control valves (EF-V-30A, -308), EFW pumps' minimum flow valves (SY/EF-V-8A, -88, -8C), the steam supply valves (SY/MSV-13A, -13B) for the steam-driven EFW pump, the motor-driven EFW pumps (EF-P2A, -P28), the electro-pneumatic transducers (converters) for the EFW flow control valves, the

position indication devices for the steam supply valves (MSV-6, -13A, -138) l l for the turbine-driven EFW pump, and the EFW flow instruments (FI-S-77,

-78,-79)13_/

l I

-12/ These documents were the subject of Board Notification 82-133, December 27, 1982.

---13/ These flow instruments have recently been replaced, but there is no evidence that the new devices are environmentally qualified. However, it is known that new instruments are inaccurate. See pp. 21-25, infra.

. . 8 The exact, current status of all these components is not known, but it is known that many vital components in the TMI-1 EFW remain incapable of functioning properly during a steam line break. At a meeting held by the NRC staff on October 5,1983, the licensee was unable to resolve the environmental qualification deficiencies identified in the Technical Evaluation Report with regard to, for example, the motor-driven EFW pumps, the steam supply valves for the steam-driven EFW pump, and the EFW flow control valves. At another meeting held on December 16, 1983, GPU told the NRC staff that of the 120 types of equipment identified as having environmental qualification deficiencies, there still remain 60 typesb of equipment for which GPU does not have resolution.

It is al so known that GPU plans to operate TMI-1 until the first refueling after restart with the existing EFW flow control valves. As noted above, manual control of these valves will be precluded by the high tempera-ture in the area following a main steam line break. Thus, this potential alternative to environmental qualification, which was endorsed by the Licensing Board and Appeal Board in the restart proceeding for a small break loss-of-coolant accident (17 NRC 814, 833), is not a viable one for a steam line break accident.

j In summary, the TMI-1 Emergency Feedwater System is not environmentally qualified as required by NRC regulations. As a result, the EFW system may i

fail at precisely the time it must function properly to mitigate the effects l

of design basis accidents. Therefore, operation of TMI-1 would pose an undue risk to the health an.1 safety of the public.

14/ It must be noted that for each type of equipment, there generally are several individual components of that type utilized in various safety systems. Thus, the number of defective components is much larger than

60. However, we assume that not all are used in the EFW system; the remainder are used in other systems important to safety and those systems are not within the scope of this Show Cause petition.

o _ _____

. . 2. The~ TMI-1 EFW System Is Not Seismically Qualified NRC rules require that structures, systems and components important to safety be designed to withstand the effects of earthquakes without losing the

}

capability to _ perform their' safety functions.E/ For each licensed plant, a postulated " Safe Shutdown Earthquake" (SSE) is' established and systems whose i

safety functions are- necessary during _ and following an earthquake must be shown to have the capability of withstanding the pertinent stresses in functioning order. This is referred to as " seismic qualification."

The TMI-1 EFW system is not seismically qualified and GPU does not intend to make it so before operating the plant.El In contrast, it has been AEC and NRC practice, from as early as 1972, to require seismic qualification for auxiliaryoremergencyfeedwatersystems.EI In 1982, as part of NRC's industry-wide review of the seismic qualifica-1 tion of. EFW systems, Lawrence Livermore National Laboratory, NRC's contractor, determined 18 ,/ that the TMI-1 EFW system is not qualified to withstand even a less severe " Operating Basis Earthquake,"El much less a " Safe Shutdown Earthquake."

l l 15/ 10 CFR Part 50, App. A, General Design Criterion 2.

l 16/ H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG-0737 II.E.1.1),"

August 23, 1983.-

. -17/ See Safety Guide 29, Seismic Design Classification, June 7,1972. This evolved into Regulatory Guide 1.29.

18/ Technical Evaluation Report, Three Mile Island Nuclear Station, Unit 1, i

~

Seismic Qualification of Auxiliary Feedwater System, Lawrence Livermore Laboratory, October 29, 1982. Hereinafter "TER."

4 19/- An " Operating Basis Earthquake" is defined as "that earthquake which could reasonably be expected to affect the plant site during the operating life of the plant." 10 CFR Part 100, App. A, para. III(d).

~

i

.. o There are many vital components in the TMI-1 EFW system which are not seismically qualified, including:

a. Recirculation lines of the EFW pumps;El

b. Portions of the EFW suction piping to the condenser hotw' ell, for which there are no double isolation valves between the seismic Class 1pipingandthenon-seismicClass1 piping;El

c. EFW pumps' minimum flow valves (recirculation valves) and their controlling flow switches and associated circuitry;2_2/

d. Electro-pneumatic converters for the EFW flow control valves,

'EF-V-30A and EF-V-30B;2_3/

e. Condensate storage tank low level alams;E/

f. Circuitry for main steam dump isolation valves MS-V2A, MS-V2B, MS-V8AandMS-V8B;E/

g. Circuitry for condensate storage tank isolation valves C0-V10A, CO-V108,C0-V14AandC0-V14B;EI

h. Circuitry for condensate storage tank cross connect valves C0-V11A andCO-V11B;EI

-20/ Reference No. 3 cited in the" TER, p. 1. Hereinafter, the TER References are cited as "TER Ref. .

21/ TER Ref. 3, enclosure, unnumbered page 2.

l 22/ TER Ref. 5, enclosure, Table A.

23/ Id.

24/ Id.

25/ Id.

26/. Id.

l 27/ Id.

l

1. Control systems for the atmospheric relief valves MS-V4A and MS-V4B;28/

j. Vent stacks for both the main steam relief e.nd atmospheric dump valves;2_9/

h. Main steam isolation valve circuitry.EI It must be emohasized that the above list of EFW components (and components which are necessary for EFW to function properly) which are not seismically qualified is probably incomplete. In preparing the TER, the NRC's contractor evaluated "those items identified by the licensee as not being fully seismically quali fied ... ."3_1/ Where GPU claimed that components were that seismically qualified, the contractor made no independent evaluation of assertion. For example, GPU claimed that valves in the EFW system would remain functional during and after a safe shutdown earthquake. That claim was based on a " static analysis" which calculated "the seismically induced deformations of valve and [ valve] operator parts which raay impede valve operation and compar[ed] these calculated deformations to the available part clearances."El The total discussion of this information in the TER was as J

follows:33/ -

Valves / Actuators - All valves were designed such that the OBE stresses would be below yield and SSE stresses would be within ultimate strength. The valve functional operability during and Based on after an SSE has been assured based on calculations.

the given information, we judge that the valves / actuators presently have a seismic capability equivalent to the SSE level.

28/ TER Ref. 7, Encl .1, Table A-A and unnumbered pp. 6, 8.

29/ TER Ref. 9, p.1.

30/ TER, p. 4.

31/ Id., p. 2, emphasis in original.

32/ TER Ref. 8, p. 1-2.

3_3 3 / TER, p. 3.

_ _ _ . ____m . _ _ -_ ____m _.

} However, use of such a static analysis to establish seismic qualification of valves was rejected as early as 1974:EI A test program is required to confirm the ability of all seismic Category I mechanical equipment to fun' cion as needed during and after an earthquake of magnitude up to and including the SSE.

Analysis without testing is acceptable if structural integrity alone can assure the intended function. When a complete seismic test is impracticable, a combination of test and analysis is '

acceptable.

The lack of seismic qualification of the TMI-1 EFW system could cause y failure of the safety function following an earthquake as a result of damage to EFW components. The lack of seismic qualification could also result in a

! situation where' there is insufficient water available to cool down the reactor. NRC practice requires that the plant must be able to safely survive an earthquake assuming a loss of offsite electrical power, the failure of all

, equipment which is not seismically qualified, plus a single failure of any l t

i seismically qualified component. The TMI-I EFW system cannot meet these requirements, as revealed in' two scenarios prepared by GPU itself:35/

Seismic Event Coincident With Loss of Offsite Power With a Single Failure of an Active Component i During this event, a postulated failure of either valve C0-V-14A or C0-V-14B to isolate the CST [ Condensate Storage Tank] from the non-seismic line will drain the water inventory of both tanks through the broken lines at an approximate rate of 4,400

,- GPM. A low level (Technical Specification level) alarm of each l tank will alert the operator to take action. The operator has L sufficient time (20 minutes) to access the Intermediate Building to manually close either of the motor operated valves so that a I sufficient quantity of water will be available from both CSTs for EFW system operation and sufficient to cool to the point of

. . Decay Heat Removal initiation. However, if the valve is stuck open or the ' operator cannot access the building to manually 34/ U.S. Atomic Energy Commission, Regulatory Standard Review Plan, November 1974, pp. 3.9.2-3, -4. '

35/ TER Ref. 7, Enclosure 2, " Evaluation of the TMI-1 Condensate Supply for Emergency Feedwater," pp. 3-4, emphasis added.

i 1

close the valve, water in both tanks will be drained out and cause a loss of water inventory for EFW system function. Thus, in order to mitigate or prevent this gross loss of water Tnventory a modification to the Condensate System and Condensate Storage-Tank is required.

The foregoing scenario, claiming that an operator could manually close a valve to stop water loss from the condensate storage tanks, represents wishful thinking based upon selective perceptions of the facts. First of all, the low level alarms on the condensate storage tanks are themselves not seismically qualified. Therefore, they can not be relied upon to alert the operator to take action following an earthquake. In addition, the valve could very well stick open because its seismic qualification was based on a static analysis, as discussed above. Finally, it is very likely that the operator will not be able to enter the Intermediate Building to isolate the leak following an earthquake because of steam released to the building by failure of equipment which is not seismically qualified. For example, the vent stacks (discharge paths) for safety relief valves MS-V-22A/B and atmospheric dump valves MS-V4A/B are routed through the Intermediate Building floors. G7'l plans to modify these vent stacks to meet Seismic Class I requirements in order to

" prevent the release of main steam to the Intermediate Building as a result of vent stack failure due to a seismic event. 3_6,/ However, these modifications are not planned until the first refueling after restart.

Another accident scenario described by GPU is the following:EI

-36/ H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG-0737 II.E.1.1),"

August 23, 1983, enclosure, p. 4.

3_7/ TER Ref. 7, Encl. 2, p. 3, emphasis added.

- n m4- e. - A+ a  %,e A D A -&>e- -

.m- 64A ._JwA-mb -+4-- as4-e 4&- b-,Lk-mmm.m4&L ,,\ A. kn.ALsm. -.. a 14-Seismic Event Coincident With Loss of Offsite Power Without a Single Failure of an Active Component During a postulated seismic event coincident with a loss of offsite power, a line break in the non-seismic piping downstream of either valve C0-V-14A or valve C0-V-14B could drain the water

, from both tanks through the broken lines to the. Turbine Building t

Sump or Intermediate Building depending on the location of line '

break. However, the motor operated valves C0-V-14A&B, which are powered from Class IE sources, can be remotely controlled from the control room to isolate the broken non-seismic lines. This maintains a sufficient water inventory for the EFW system safety function from both CSTs if the seismic event did not sever the power supply for these valves in the non-seismically designed '

portion of its cable routing. It assumes that both CSTs are at the Tecnnical spectrication water inventory levels and allows 20

. minutes for an operator action.

! Once again, GPU's scenario does not take account of all the relevant f facts. Seismic qualification of valves CO-V-14AaB was based on an invalid static analysis. Thus, even if their power supply cables are not severed, the l

l operator may not be able to close them. In any event, GPU identified these '

l circuits as unqualified to withstand earthquakesEl and there is no -reason presented to believe that they will not be severed. The result would be

insufficient water in -the condensate storage tanks to complete the EFW

- function, i.e., there would be insufficient water to cool the core.

Having incorrectly concluded that the loss of water could be stopped by f operator action, GPU apparently performed no evaluation of the potential l

effects of flooding the Interwediate Building from failure of the non-seismic EFW system. This is a significant omission because much essential safety equipment is located in that building and could fail as a result of being submerged or sprayed. In addition to the ErW system, other safety equipment which is located in the Intermediate Building includes the main feedwater isolation valves and valves (needed for containment isolation or other safety t

1 4

38/ TER Ref. 5, enclosure, Table A.

- .- .- - _ __ - . .- . . . ~ . . - . - - - . - - - . _ - - _ - - - - . - _ . -

. . fun (.tions) in the reactor building purge line, containment monitoring isolatio1 system, emergency cooling river water system, and nuclear services closed loop cooling system.39/ GPU has acknowledged that modifications are needed to cope with Intermediate Building flooding caused by a main feedwater line break,S/

but we are aware of no detailed analysis of the effects of flooding from the EFW system.

On December 20, 1982, GPU responded to the TER, claiming "that with the minor modifications noted in our responses, at restart the existing EFW system will be able to perform its safety function af ter the occurrence of earthquakes up to and including the SSE." GPU also stated that the "[1]onger term upgrades that are scheduled for the first refueling after restart will further simplify the plant response to seismic events and reduce the potential for implant [ sic]

fluid mills."S/ This response was inaccurate and disingenuous.

After consideration of GPU's response, the TER was revised on July 7, 1983, and concluded that the TMI-1 EFW system will not be seismically qualified until the modifications planned for the next refueling outage are completed.S/

On August 23, 1983, the licensee confirmed the validity of this conclusion (and simultaneously contradicted its earlier claim of seismic qualification at

-39/ The location of this equipment was determined from the System Component Evaluation Worksheets submitted to NRC by GPU in response to IE Bulletin 79-018.

40/ At present, the Intermediate Building will flood to Elevation 295 feet in 86 seconds following a main feedwater line break. Modifications scheduled for the first refueling after restart would extend this time to approxi-mately 25 minutes. See H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG-0737 II.E.1.1)," August 23, 1983, enclosure, p. 5.

-41/ H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, " Emergency Feedwater System - Seismic," December 20, 1982, p. 1.

g/ TER, Revised July 7,1983, p. 5, 6, 7, 8.

l l

.. .' restart) by specifying the modifications needed (but not scheduled to be completed until the next refueling) to seismically qualify the EFW system.S/

The NRC staff recognized that the revised TER "does not discuss and draws no conclusion as to whether the AFW [EFW for TMI-1] system will be able to withstand a postulated SSE and perform its safety function during Cycle 5 operation which precedes the seismic upgrades."El Nonetheless, the staff attempted to justify allowing operation of TMI-1 with an EFW system which both its contractor and GPU conclude cannot withstand a Safe Shutdown Earthquake.

The staff claimed that "[r]eview of the [ revised] TER indicates that the consultant considers the AFW system in place for Cycle 5 to be acceptable with the exception of the Initiation / Control Systems."$/ A careful review of the revised TER by UCS disclosed that the consultant relied upon assertions by GPU which we have demonstrated above are invalid. For example, the consultant accepted as valid GPU's claim that flooding caused by failure of unqualified pipes "would only cause an inplant spill and not a loss of safety function."5/ In addf tion, the consultant continued to rely on GPU's invalid static analysis of valves as a basis for claiming seismic qualification and accepted GPU's claim that operators could enter the Intermediate 53uilding to manually operate EFW components without considering the effects of steam released by failure of other equipment in the area which is not seismically qualified.El l

t l -43/ H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, "Three Mile Island Nuclear Station, Unit 1. . . Long Term EFW Mods (NUREG-0737 II.E.1.1),"

August 23, 1983.

l --~44/ Safety Evaluation Report, Three Mile Island Unit 1, Seismic Qualification of the Auxiliary Feedwater System, undated, p. 2. (This SER was attached

to a letter from John F. Stolz, NRR, to Henry D. Hukill, Vice President, GPU Nuclear Corporation, dated August 12,1983.)

j

_45/ _I_d .

46/ TER, Revised July 7,1983, p. 3.

47/ Id., pp. 4, 7.

L

• ^

_17 In summary, the revised TER does not provide a valid basis for the staff's assertion that the TMI-1 EFW system "will be able to withstand a Safe Shutdown Earthquake and perform its safety function."El There can be no serious question that the TMI-1 EFW system should be fully seismically qualified before operation. On June 10, 1980, more than three and a half years ago, the Advisory Committee on Reactor Safeguards (ACRS) wrote a letter to Mr. Dircks, NRC Executive Director, expressing concern that the staff's level of effort in reviewing the seismic qualification of EFW systems might be insufficient to ensure timely resolution. The ACRS recommended that the necessary manpower be committed "to assure completion of the staff's short-term review in two or three months."El Four months later, the ACRS again wrote to Mr. Dircks, concluding that the staff's estimates of the risk associated with interim operation of plants pending full seismic qualification of EFW systems "are large enough, if accurate, to warrant considerable priority by the NRC and the affected utilities." The staff estimated the risk of a loss of shutdown heat removal from a seismic event to be six to fifteen times the estimated risk of core melt due to all causes for the PWR examined in WASH-1400. The ACRS concluded that "high priority should be given to resolutionofthismatter."El The staff subsequently sent a letter to all PWR licensees which contains thefollowing:51/

l l

48/ Safety Evaluation Report, Three Mile Island Unit 1, Seismic Qualification of the Auxiliary Feedwater System, undated, p. 3. (This SER was attached to a letter from John F. Stolz, NRR, to Henry D. Hukill, Vice President, GPU Nuclear Corporation, dated August 12,1983.)

49/ See Milton Plesset, to William J. Dircks, June 10, 1980.

50/ See Milton Plesset to William J. Dircks, October 10, 1980.

. s . After the accident at Three Mile Island (TMI), a large amount of our attention focused on the capability of plants to rel1 ably remove shutdown decay heat. The NRC Action Plan (NUREG-0660, section II.E) Identifies post-TMI actions that are underway con-cerning this genaral subject. While we recognize that alternate ways may be available for removing decay heat following antici-pated transients or accidents, removal of heat through the steam generators would be the first choice for accomplishing a safe plant shutdown. For this reason, the design of auxiliary feed-water ( AFW) systems should satisfy the same standards applied to other safety related systems In the plant. Accordingly, the current acceptance criteria for AFW systems which are applied to construction permit and operating license reviews are contained in Section 10.4.9 of the NRC's Standard Review Plan (SRP), which treats the AFW system as an engineered safety feature. However, only the most recently licensed facilities have been reviewed against this section of the SRP. *** The purpose of this letter is to identify our generic concerns related to the seismic design capabilities of AFW systems in operating PWRs and to describe a program which we Intend to undertake in reviewing

~

the capability of operating PWRs to remove decay heat following an earthquake.

In summary: 1) the importance of a seismically qualified EFW system is a direct lesson learned from the TMI-2 accident, if it was not sufficiently appreciated before, 2) the risk associated with plant operation without a seismically qualified EFW system is relatively high, and 3) this is a high priority safety problem repeatedly stressed by the ACRS. However, the TMI-1 EFW system is not seismically qualified. Therefore, operation of TMI-1 would pose an undue risk to the health and safety of the public.

~~-51/ D. G. Eisenhut to All Operating Pressurized Water Reactor Licensees,

" Seismic Qualification of Auxiliary Feedwater Systems," October 21, 1980, emphasis added.

l

, s . _19_

3. The TMI-1 EFW System Can Be Disabled By A Single Component Failure NRC rules require that systems important to safety be designed with sufficient redundancy of components so that the system safety function can be ,

accomplished, " assuming a single failure. 5_2/ This single failure criterion is a cornerstone of NRC's philosophy to ensure enough redundancy (i.e., back-ups) in important safety equipment such that no one random equipment failure in a safety system occurring in conjunction with an accident can prevent accomplishing the required safety function.

The TMI-1 EFW system does not meet the single failure criterion because there is only a single flow control valve in the pipe used to deliver EFW to each steam generator. During a main steam line break, steam generator tube rupture, or feedwater line break accident, the affected steam generator must be isolated53/ and the plant cooled down using EFW flow to the unaffected steam generator. However, as GPU stated, "[u]nder steam line or feed line break 52/ 10 CFR Part 50, App. A, General Design Criteria, Criterion 17, Electric power systems, Criterion 21, Protection system reliability and testability, Criterion 34, Residual heat removal, Criterion 35, Emergency core cooling, Criterion 38, Containment heat removal, Criterion 41, Containment atmosphere cleanup, and Criterion 44, Cooling Water.

5_3/

3 For a steam generator tube rupture accident, GPU proposes to delay isolating the broken steam generator until the measured or projected radiation dose rate to the public reaches 50 mrem /hr whole body or 250 mrem /hr thyroid. These dose rates were chosen on the basis of meeting the limit specified in 10 CFR Part 20, i.e., 0.5 rem. See GPU Nuclear Technical Data Report, "SG Tube Rupture Procedure Guidelines," dated 8/12/83, pp. 1, 9, 37, 60. (This document was attached to a letter from H. D. Hukill to J. F. Stolz dated September 30, 1983, re: Comments on NRC SER Concerning TMI-1 Steam Generator Repair.)

= _-- . - _ - . .

l

. ( . I conditions,'when both main and auxiliary [i.e., emergency] feedwater is [ sic]

isolated to ,the affected steam generator, a single failure of the unaffected auxiliary feed line control valve will produce unacceptable results."El The

" unacceptable results" GPU refers to are that failure of the single control valve in the EFW pipe to the intact steam generator would preclude delivery of EFW and prevent decay heat removal through that steam generator. Thus, there would be no decay heat removal through either steam generator.5/ In addition,

. each EFW flow path contains only a single block (isolation) valve. Failure of- .

this valve would prevent isolation of EFW flow to the steam generator with the i'

broken main steam line or ruptured tube.

Another way in which the EFW system does not meet the single failure

criterion is that the EFW flow control valves are presently controlled by the 1

Integrated Control System (ICS) which is not safety grade. Failure of the ICS could disable the EFW system.

During the next refueling outage, GPU plans to correct the above deficiencies so that the design of the EFW system will meet the single failure Redundant safety grade EFW flow control and block valves will be criterion.

installed in the. flow path to each steam generator. The purpose of these modifications, according to GPU, is "to prevent a single active failure from

! preventing the addition of EFW to an OTSG [0nce Through Steam Generator] and to ensure the capability to isolate EFW flow to a ruptured 0TSG."El Thus, GPU recognizes that the TMI-1 EFW system as currentl.y designed does not meet the single failure criterion.

I 54/ Lic. Ex. 1, Am. 22, p. 2.1-25.

- 55/ For a tube rupture accident, decay heat removal via the affected steam ger.erator might be possible if EFW was still available to it, but this would involve additional, unacceptable radiation dose to the public.

-56/ H. D. Hukill to' J. F. Stolz, August 23, 1983, enclosure, " Emergency ,

Feedwater Long Term Safety Grade Modifications," p. 3.

, s .

GPU also plans to "[p]rovide a safety grade automatic control system independent of the Integrated Control System (ICS) that permits the Emergency Feedwater System to control OTSG level without control interaction with the main feedwater system." GPU's requirements for the new control system inc;ude the following: "The control systems shall be designed so that no single activeEl failure will prevent delivery of the required emergency feedwater to anOTSG."SE/

In summary, the TMI-1 emergency feedwater system is vulnerable to single failures which would prevent accomplishing the required safety function, i.e.,

removing decay heat to cool the core. Therefore, operation of TMI-1 would pose an undue risk to public health and safety.

4. The EFW Flow Instruments Are Inaccurate One of the short-term requirements stemming from the TMI-2 accident was that TMI-1 (and other Babcock & Wilcox plants) had to install two safety grade EFW flowrate instruments for each steam generator. The implementation schedule established by NRC was that final design information was to be submitted to NRC by January 1, 1981, and int.tallation of the flow instruments was to be completed by July 1,1981.59_/

57/ Although this requirement is certainly an improvement over the existing design, it is not adequate to meet NRC rules. Single failures of both active and passive components must be considered in evaluating whether electrical systems meet the single failure criterion. 10 CFR Part 50, App. A, " Definitions and Explanations."

58/

H. D. Hukill to J. F. Stolz, August 23, 1983, enclosure, " Emergency Feedwater Long Term Safety Grade Modifications," pp. 6,10. -

-59/ NUREG-0737, " Clarification of TMI Action Plan Requirements," November 1980, pp. II.E.1.2-4, -5.

. s . During the TMI-1 restart hearing, the requirements applicable to the EFW flow instrumentation included a requirement that each flow instrument "should provide an analog indication of feed flow with an accuracy on the order of

+10%."60/

The NRC staff testified that the licensee had committed to installing two safety grade sonic flow devices on each of the two EFW supply lines to the steam generators and that the licensee " indicated that the new flow devices have an accuracy of better than +5%, which is acceptable to the staff."S/ Based on its review and evaluation of this information, the staff concluded that TMI-1 was "in compliance with all the requirements of NUREG-0578, item 2.1.7.b, subject to submittal of the vendor environmental qualification certification. 6_2/ The Licensing Board relied upon the information provided by GPU and the staff's conclusion "that Licensee is in compliance with the NUREG-0578 recommendation, in item 2.1.7.b, for emergency feedwater flow indication to the steam generators."S/

However, all this testimony (and the Licensing Board's findings based on the testimony) was mooted when the sonic flow instruments proved to be unacceptable, contrary to the confident assurances of both GPU and the staff.

In a letter dated May 24, 1983, GPU advised the staff that two of the four installed EFW sonic flow devices would be replaced with differential pressure transmitters. In a subsequent letter dated August 25, 1983, GPU notified the l 60/ Staff Ex.1, NUREG-0680, "TMI-1 Restart," June 1980, p. C8-38.

-61/ Id., p. C8-39. Actually, the staff exaggerated licensee's claim. GPU only said that the EFW flow instruments would have an " accuracy of better than or equal to 5%." Lic. Ex. 1, Am. 22, p. 2.1-23, emphasis added.

l

! 62/ Id., p. C8-40. The staff subsequer.'ly addressed the environmental

! qualification of the sonic flow devices. See Staff Ex. 14, NUREG-0680,

! Supp. No. 3, April 1981, pp. 38-39.

l l -63/ Metropolitan Edison Co., (Three Mile Island Nuclear Station, Unit 1),

j LBP-81-59, 14 NRC 1211, 1362, December 14, 1981.

l l

l

4

.- . staff that further testing had shown the remaining sonic flow devices to be unsatisfactory and that, by restart, all of the sonic flow devices would be replaced with differential pressura transmitters.

The staff promptly approved the new differential pressure flow devices in a letter to GPU dated September ?2,1983. However, in a letter dated November 23, 1983, GPU notified the NRC that its August 25, 1983, assurance that these instruments "are reliable and accurate and are designed to monitor the full range of system fl ow requirements," was incorrect. Tests disclosed

" oscillations at low flow conditions (less than approximately 100 gpm) outside the + 10% criteria."S/ Nonetheless, GPU concluded that the EFW fl ow instrumentation as currently installed at TMI-1 "is acceptable and meets the requirements of NUREG 0737 and our commitment as reflected in the Partial Inital Decision of December 14, 1983. "$/ This does not, contrary to GPU's assertion, meet the criterien and commitment relied upon by the Licensing Board, i .e., a criterion of +10% accuracy, and a commitment to an actual accuracy of better than or equal to 5%.

Based on the information in GPU's November 23, 1983 letter, it is clear that the lessons learned requirements for EFW flow indication have not been met at TMI-1. The bases for this conclusion were set forth in detail in previous I

UCS filings in the TMI-1 restart proceeding

" Union of Concerned Scientists j Response to GPU Letter of December 6, 1983, Regarding Emergency Feedwater Flow Instrumentation," dated December 9,1983; and "UCS Rebuttal to Licensee's Reply l

Regarding EFW Flow Instrumentation," dated Janauary 6,1984. We hereby incor-l porate those two filings in this Show Cause petition. (Copies are attached.)

-64/ H. D. Hukill, Director of TMI-1, to J. F. Stolz, NRC, "EFW Flow Devices (D/P) Testing," dated November 23, 1983, p. 1, emphasis added.

65/ Id. , p. 2.

, . The following is a summary of the principal points made in our previous filings on the existing EFW flow instrumentation.

GPU's attempts to justify operation of TMI-1 with the existing EFW flow intruments amounts to a request for exemption from the short-term lessons learned requirement for safety grade EFW flow instruments. There is no justification for granting such an excmption because operation of TMI-1 with the existing instruments would pose an undue risk to public health and safety.

The existing EFW fl ow instruments do not meet the +10% accuracy requirement in effect during the restart hearing and GPU has proposed no other acceptable accuracy criterion in accordance with the requirements of IEEE 279-1971 incorporated in NUREG-0737.5/ GPU does not know how the EFW flow instruments will perform over the full range of possible EFW flow rates. The lack of reliable EFW flow indication can adversely affect situations requiring prompt operator action, such as inadequate flow to cool the EFW pumps. Locking open all the valves in the EFW pump recirculation flow lines (which may not be possible in the case of check valves) does not resolve the problem that prompt operator action may be needed to prevent EFW pump damage because GPU has a history, prior and subsequent to the TMI-2 accident, of failing to assure that valves are in their correct positions. Furthermore, locking open the valves creates an additional safety hazard because the recirculation lines and valves are not seismically qualified and their failure following an earthquake could leave insufficient water remaining in the condensate storage tanks to cool the plant down. The existence of instrumentation to measure steam generator level and pressure does not obviate the need for reliable EFW flow indication, particularly in a Babcock & Wilcox plant like TMI-1 which utilizes a 66/ See NUREG-0737, pp. 3 3-83, and IEEE 279-1971, Sections 4.1 and 3(9).

,y o once-through steam generator design. Finally, the existing, inaccurate EFW flow instruments have not been shown to meet the requirement that the EFW flow instruments "not increase the potential for operator error."El In summary, the lessons learned from the TMI-2 accident specifically require what TMI-1 does not nave -- emergency feedwater flow instruments meeting strict, detailed performance criteria to ensure that operators can rely on them. Faced with the reality that it lacks sufficient technical competence to design accurate EFW flow instruments despite two attempts, GPU essentially has attempted to argue that accurate instruments are unnecessary.

Such an argument was not advanced by GPU during the restart hearing. Its advancement at this late date does not cure its fundamental defect -- it has no merit.

5. The Main Steam Line Rupture Detection System Is Inadequate The Main Steam Line Rupture Detection System (MSLRDS) is used to detect a main steam line break and to signal valves to close to isolate feedwater flow to the affected steam generator. One purpose of isolating feedwater flow is to prevent overpressurization of the reactor containment building. If a main i steam line break occurs inside the containment building, continued delivery of i

i feedwater to the affected steam generator would continue to produce steam l which would be released to the building. This would cause pressurization 1

above the design pressure and could result in loss of containment integrity and the release of unacceptable amounts of radioactive material to the environment.

l During the restart hearing, the design of the MSLRDS was such that both l

main and emergency feedwater were cut off to a given steam generator when a l

pressure of less than 600 psig was detected within that generator.j8/ Al though g/ Id. , p. 3-83.

68/ 14 NRC 1211, 1362, (1981)

, e,, ,

26-the licensee had committed to upgrading the MSLRDS to a safety-grade system in the long term, the concern was that actuation of the main steam line rupture ,

detection system could isolate all feedwater flow to both steam generators.SI Therefore, the Licensing Board ruled in 1981 that, prior to restart, the licensee was required to submit for staff approval a long-term solution to this problem for implementation as soon as possible after restart and the staff was required to certify to the Commission that the licensee has made reasonable progress in implementing the solution.70,/

In a submittal to the NRC staff dated August 2, 1982, the licensee proposed the addition of cavitating venturis in the EFW lines and removal of the MSLRDS signal from the EFW valves. On November 10, 1982, the staff found the proposed solution acceptable and concluded that the Licensing Board condition was satisfied. In a Safety Evaluation Report attached to its November 10, 1982, letter to GPU, the staff " concluded that there was no potential for containment overpressurization resulting from a MSLB [ Main Steam Line Break] with continued emergency (auxiliary) feedwater addition because the main feedwater system isolates and emergency feedwater flow restrictors (cavitating venturis) limit flow to the affected steam generator."7Il However, as we discuss below, the assumption that main feedwater would be isolated was unwarranted and therefore the conclusion that there is no potential for containment overpressurization is invalid.

I 69/ Id. at 1364, 1373, 1373-1374.

70/ Id. at 1374.

--71/ John F. Stolz, NRR, to Henry D. Hukill, GPU, November 10, 1982, enclosure, Safety Evaluation Report, p. 2, emphasis added.

. un e The Appeal Board subsequently addressed the issue of the adequacy of the MSLRDS.72/ With regard to the Licensing Board's original concern about inadvertent isolation of feedwater, the Appeal Board "believe[d] that it is safe for the plant to restart while a long-term solution is developed."El However, the Appeal Board noted the following: "While this appears to solve the problem of inadvertent feedwater isolation, there still remains the concern for overpressurization of the containment if the nonsafety-grade MSLRDS failed to isolate main feedwater during a steam line break accident. Prior to acceptance of [the licensee's proposed solution], we recommend that the potential for containmentoverpressurizationbeevaluated."El Furthermore, the Appeal Board ruled that since the development of a solution may " involve the resolution of disputed matters," the licensee's " proposal should be submitted for Commission, rather than staff, approval ." The Appeal Board continued as follows: "The Commission can then consider whether the licensee's proposal is reasonable and whether the licensee has made reasonable progress toward initiating its program. It can also decide whether, or to what extent, it is necessary to accord the parties an opportunity to address the licensee's proposal and its implementation."El Thus, it is already the Commission's obligation to determine whether the TMI-1 MSLRDS proposal is acceptable, whether reasonable progress toward implementing it has been made and whether UCS is entitled to participate in the resolution of these questions. Neither the Licensing Board nor the Appeal Board resolved these issues.

~~~72/Metropolitan Edison Co., (Three Mile Island Nuclear Station, Unit No.1),

ALAB-729, 17 NRC 814, 834-835, 887-888, (1983).

73/ Id. at 834-835.

74/ Id. , n. 59, at 834.

75/ Id. at 888.

l l

.o. . The next event was the licensee's submittal to the staff on August 23, 1983, of its proposed " Emergency Feedwater System Long Term Safety Grade Modi fications." Portions of that submittal relevant to the main steam line rupture detection systems include the following:d/

Requirements Main feedwater isolation shall also be initiated on a feedwater line break . . . by the Main Steam Line Rupture Detection System (MSLRDS). The MSLRDS also utilizes a 2 out of 4 (2/4) logic for detection of main steam pressure below 600 psig.

Modifications Deletion of the Main Steam Line Rupture Detection System (MSLRDS)

Signals to the emergency feedwater control valves EF-V-30A/B.

(Complete)

The deletion of the MSLRDS signals to the EFW System improves the availability of the OTSG's as a heat sink and improves the reliability and capability of EFW flow to the OTSG(s) during loss of normal feedwater flow.

Upgrade the controls for the Main Steam Line Rupture Detection System to safety grade such that a single failure of the control system will not prevent isolation when required. The probability of a single failure causing inadvertent actuation shall be minimized.

The MSLRDS shall identify a ruptured 0TSG when the main steam pressure falls below 600 psig and shall automatically isolate the main feedwater to that OTSG.

By letters dated September 15 and September 27, 1983, licensee's counsel sent to the Commission GPU's letter of August 23, 1983, detailing the long-term modifications stating that the letter was "potentially relevant and material to matters under adjudication in the plant design and procedures phase of this proceeding, which is now before the Commission." Licensee's counsel did not point out that the information on the MSLRDS was required to be submitted to the Coamission for review by the Appeal Board.

-~~76/ H. D. Hukill, Director, TMI-1, to J. F. Stolz, NRR, August 23, 1983, enclosure, Emergency Feedwater System Long Term Safety Grade Modifications, pp. 9-10.

AE In summary, the licensee recognizes that the MSLRDS is not safety grade and requires modifications so tha a single failure will not prevent isolation of main feedwater to the steam generator affected by a main steam line break.

The NRC staff ignored this fact and concluded (incorrectly) that there is no potential for overpressurization of the containment building following a main steam line break because the staff assumed main feedwater would be isolated.

Because the main steam line rupture detection system is not safety grade, there can be no assurance that the containment will not be overpressurized following a main steam line break inside containment. Therefore, operation of TMI-1 would pose an undue risk to public health and safety.

CONCLUSION Based on the information provided above, the Union of Concerned Scientists requests that the operating license for Three Mile Island Nuclear Station Unit No. 1 be suspended urless and until the pl ant's Emergency Feedwater System complies with the NRC rules applicable to systems important to safety (including safety-grade, safety-rel ated, and engineered safety feature systems). This means that the TMI-1 EFW system must, among other l

l things, be seismically and environmentally qualified, meet the single failure criterion, have adequate, reliable safety-grade instrumentation, and have a MSLRDS that is safety grade. In addition, there must be adequate emergency procedures and operator training to operate such an EFW system.

Respectfully submitted, L L Ellyry Gener'fR. Weiss al Counsel Union of Concerned Scientists Harmon, Weiss & Jordan 1725 I Street, N.W., Suite 506 Washington, D.C. 20006 Dated: January 20, 1984

.