ML20062L051

Testimony of TB Cochran on Contentions 1a,3b & 3d Re Core Disruptive Accidents & DBAs & Contentions 2 & 3c Re Site Suitability Analysis Under 10CFR100

ML20062L051
Person / Time
Site:	Clinch River
Issue date:	08/16/1982
From:	Cochran T National Resources Defense Council
To:
Shared Package
ML20062L054	List: ML20062L051 ML20062L069 ML20062L091 ML20062L111
References
NUDOCS 8208180115
Download: ML20062L051 (169)

Text

m ,. .

g ..

+t

' - DOCKETED . -

~

uamc

'82 le016 PS :57 y _.-, -1 ,y BEFORE THE -- ';

UNITED STATES NUCLEAR REGULATORY COMMISSION ATOMIC SAFETY AND LICENSING BOARD

) -

In the Matter of )

)

UNITED STATES DEPARTMENT OF ENERGY )

PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537 TENNESSEE VALLEY AUTHORITY )

)

(Clinch River Breeder Reactor Plant) )

)

TESTIMONY OF DR. THOMAS B. COCHRAN 1

Part I My name is Thomas Brackenridge Cochran. I reside at 4836 North 30th Street, Arlington, Virginia 22207. I am presently a Senior Staff Scientist at Natural Resources Defense Council, Inc. I am a member of the Department of Energy's Energy Research and Advisory Board; the Three Mile Island (TMI) Public Health Fund Advisory Board; the Nuclear Regulatory Commission's TMI Advisory Board; and the American Nuclear Scciety.

I have a B.S. degree in electrical engineering and '4.S. and Ph.D. degrees in physics, all from Vanderbilt University. I have held the positions of Ascistant Professor of Physics, U.S. Naval Postgraduate School, and Senior Research Associate, Resources for the Future.

I have been a consultant to numerous government agencies and testifiad before Congress on numerous occasions on matters related to nuclear energy generally and liquid metal fast breeder reactors (LMFBRs) in particular. I was a member of DOE's 8208180115 820816 PDR ADOCK 05000537 T PDR Q

f Nonproliferation Advisory Panel and ERDA's LMFBR Review Steering Committee. I am the author of The Liquid Metal Fast Breeder Reactor, An Environmental and Economic Critique, (Johns Hopkins Univ. Press, 1974).

With regard to matters of LMFBR safety, I was also a member of the NRC's Advisory Group on Reactor Safety Goals and NRC's Advisory Group on Operator Training. I have had extensive hands-on experience with systems modeling and computer programming, both in relation to my Ph.D. dissertation in high energy physics and while serving as a Modeling and Simulation Group Supervisor at Litton Scientific Support Laboratory at Fort Ord, California. I was one of two U.S. citizens invited to testify on safety aspects of the SNR-300, the Federal Republic of Germany's demonstration breeder, before the Enquete-Kommission "Zukunftige Kernanergie-Politik," Deutscher Bundestag, FRG (June 3, 1982).

With regard to radiation protection, my M.S. thesis was in Radiation Chemistry. I was an AEC Health Physics Fellow at Vanderbilt University between 1962 and 1964, during which period I had 3 months of on-the-job training at Oak Ridge National Laboratory. I was the campus Radiation Safety Officer while pursuing my Ph.D. degree at Vanderbilt University. While at NRDC I co-authored with Dr. Arthur Tamplin two radiation standards petitions to the NRC, " Petition to Amend 10 CFR 20.101, Exposure of Individuals to Radiation in Restricted Areas," September 1975 (PRM-20-6), and " Petition to Amend Radiation Protection Standards as They Apply to Hot Particles," February 1974 (PRM-20-5). I have been a member of the Health Physics Society for the past 18

I or so years. For further information regarding my background and qualifications, please consult the attached copy of my resume.

Introduction Intervenors' Contention 1 a) is as follows:

1. The envelope of DBAs should include the CDA.

a) Neither Applicants nor Staff have demonstrated through reliable data that the probability of anticipated transients without scram or other CDA initiators is sufficiently low to enable CDAs to be excluded from the envelope of DBAs.

Intervenors' Contention 3 b) and d) are as follows:

3. Neither Applicants nor Staf f have given sufficient attention to CRBR accidents other than the DBAs for the following reasons:

b) Neither Applicants' nor Staff's analyses of potential accident intiators, sequences, and events are sufficiently comprehensive to assure that analysis of the DBAs will envelop the entire spectrum of credible accident initiators, sequences, and events.

d) Neither Applicants nor Staff have adequately identified and analyzed the ways in which human error can initiate, exacerbate, or interfere with the mitigation of CRBR accidents.

Contentions 1 b) and 3 a), which specifically claimed that Applicants' so-called reliability program and probability risk assessments do not provide a basis for excluding the core disruptive accident (CDA) from the Clinch River Breeder Reactor

! (CRBR) design basis were deferred by order of the Board until the Construction Permit hearings. Site suitability aspects of Contention 3 c) are addressed along with Contention 2 issues in l

l

I the second part of my testimony. This first part of my testimony on Contentions 1 a) and 3 b) and d) also relates directly to Contention 2.

The proposed CRBR is a single-unit electric power plant with a sodium-cooled loop-type breeder reactor utilizing a fuel of mixed uranium-plutonium oxides. With the initial reactor core, the power level is designed to be 975 MN t , and the net output is designed to be 350 MW,.

A core disruptive accident, or CDA, has been defined by thu Applicants as an LMFBR accident "in which there are overheating and subsequent fuel melting and relocation." ("CRBRP Safety Study," An Assessment of Accident Risks in the CRBRP, CRBRP-1, March, 1977 at 3-17.) A CDA was described further by Applicant as follows:

CDA means a loss of coolable configuration of the reactor core. It covers a spectrum of highly improbable accidents ranging from those involving partial fuel melting to those in which a bubble of fuel vapor, assumed to form in the core during the accident as a result of a rapid temperature transient, expands rapidly.

Id. at E-23. With the exception of the assertion contained in the quoted material with regard to the probability of the event, the above accurately describes a CDA and is consistent with NRDC's use of the term throughout our contentions.

The term " design basis" is used in the context of nuclear licensing to denote the range of postulated accidents for which it is required to provide protectior. in the form of engineered safety features syGtems. In other words, a nuclear plant must contain highly reliable, redundant, diverse systems meeting the

I requirements of 10 CFR Part 50 and Appendices to ensure that all design basis accidents will be mitigated without significant health and safety consequences. A reactor design is acceptable only if the safety systems of the plant can mitigate the range of design basis accidents. Indeed, NRC so defines safety systems:

Basic safety systems are those that directly perform a protective function. Examples are the reactor trip system, the emergency core cooling system, the containment isolation system, and the containment spray system. The reactor trip system provides reactor protection by fast insertion of negative reactivity (control rods) when plant conditions approach design safety limits. All other systems listed are engineered safety features (ESF) systems, their function is to mitigate the consequences of postulated design basis accidents.

NUREG-75/087, Standard Review Plan, $7.1, Part III.

For the CRBR, the design basis as currently proposed by the Applicants does not include a CDA. That is, accidents which could result in core melting or substantial core damage are excluded. The proposed " allowable limit" for a so-called

" extremely unlikely fault," the Applicants' terminology for the most severe design basis accident, is stated to be " maintaining coolable geometry." (PSAR at 15.1-51) The Applicants' proposed criteria for ensuring that the core will remain coolable are described as follows:

This limit is considered to be met when the cladding temperature is held below the melting point. If there is no cladding melting then no gross cladding relocation or gross channel blockage can occur. Therefore, preventing cladding temperatures from exceeding the melting temperature will ensure maintaining a coolable core geometry.

Before the cladding melting temperature can be reached, it is necessary to first

I experience bulk sodium boiling and then dryout of the cladding. The prevention of sodium boiling is considered as a necessary and sufficient criterion for ensuring a core coolable geometry.

(Id., emphasis added).

Thus, according to the Applicants' proposed CRBR acceptance criteria, in order to ensure coolable geometry, there must be no sodium boiling and no clad or fuel melting. It is therefore reasonable to define a CDA as an accident involving the onset of sodium boiling or clad or fuel melting.

Since the design basis for nuclear plants excludes some accidents that are possible and that could have very large consequences if they occurred, it is either implicit or explicit that this exclusion is based on the judgment that such accidents are so improbable as to be incredible. This process of dividing possible accidents into classes (Class 1-8 are " credible" accidents of increasing severity: Class 9 are alleged to be

" incredible" accidents of high consequences and, it is asserted, the lowest probability) is described at page 7-2 of the 1977 FES:

In establishing the boundary between accident sequences that are to be within the design basis envelope (classes 1-8), and hence for which engineered safety features are provided, and accidents that may reasonably be assigned to the residuum for which no further protective features are normally necessary (class 9), the NRC staff in the past has used the safety objective that the risk to the public from all reactor accidents should be very small compared to most other risks of life, such as disease or natural catastrophe. The staff believes this safety i objective is met by requiring a design basis l accident envelope that extends to very unlikely postulated accidents, with the objective that there be no greater than one chance in one million per year for potential 1

I consequences greater than 10 CFR 100 guidelines for an individual plant.

(Emphasis added.) Thus, for the CRBR, the Staff has explicitly articulated the goal that the probability of accidents with sequences beyond 10 CFR 100 guidelines shall be no greater than 10-6 per year of operation.

This goal is consistent with prior NRC practice. Although the goal has not always been stated in numerical terms, there are precedents for this. For example, Section 2.2.3 of the NRC's Standard Review Plan, dealing with the evaluation of potential accidents in the vicinity of a pronosed nuclear plant, provides as follows:

II. ACCEPTANCE CRITERIA The identification of design basis events resulting from the presence of hazardous materials or activities in the vicinity of the plant is acceptable if the design basis events include each postulated type of accident for which a realistic estimate of the probability of occurrence of potential exposures in excess of the 10 CFR Part 100 guidelines exceeds the NRC staff objective of approximately 10-7 per year.

The section provides further that, in lieu of the

" realistic" calculation described above, an applicant may demonstrate compliance if a " conservative" calculation shows that the probability of occurrence of potential exposures in excess of the Part 100 guidelines is approximately 10-6 per year.

NRC has been licensing light-water nuclear power reactors

(" LWR's") for some 25 years. Until the TMI accident, the opinion of the industry and of the AEC and NRC was that substantial fuel melting was an " incredible" accident for an LWR. Thus, the

I design basis for LWR's did not include fuel melting to any significant degree.1 However, the TMI accident involved core damage far in excess of that postulated within the design basis. It is generally accepted that between 30% and 50% of the TMI-2 core was damaged. NRC's Special Inquiry Group concluded:

In a more technically accurate sense, the TMI-2 accident progression was such that a substantial fraction of the fuel was near the temperature required for formation of fuel-clad eutectic material, so that a loss of coolable fuel geometry was very possible.2 In the wake of the TMI-2 accident, NRC has changed many of its requirements for licensing LWR's. While the agency has not yet determined how to tr aat a " degraded core" accident in all respects, the regulations do now include some requirements for which substantial core damage is essentially a " design basis" event. For example, 10 CFR 50.44(c)(3)(iii) requires the installation of high point vents for the reactor coolant system, the reactor vessel head and other systems required for adequate core cooling if the accumulation of noncondensible gases would cause the loss of function of their instrumentation controls and power sources. The high point vents, like all other systems l 1 The Commission's regulations on emergency core cooling systems contemplated that no more than about 1% of the fuel cladding will reach temperatures at which it would react with coolant. See 10 CFR 50.46(b)(3); Duke Power Co. (William B. McGuire Nuclear Station, Units 1 and 2), separate views of Commissioners Gilinsky and Bradford, 14 NRC 5 (July, 1981).

2 Three Mile Island, Report to The Commissioners and to the Public, NRC Special Inquiry Group, vol. 2, Part 2, January 1980,

p. 537.

k 1

t

~

important to safety, must meet the requirements of 10 CFR Part 50, Appendices A and B which include redundancy, diversity, environmental qualification, testability, etc.

These vents would only be necessary in the event of an accident involving substantial core damage, to remove the noncombustible gas resulting from the reaction of overheated fuel cladding and coolant. Thus, substantial core damage in an LWR is a " design basis" event for at least some purposes. While I do not believe that this is sufficient protection against core damage or core melt accidents, the fact is that it is not entirely accurate to maintain that such accidents are still viewed as " incredible" for purposes of licensing LWR's.

Moreover, there are, in my view, strong reasons for treating CDA's as design basis events for the CRBR and, as I will discuss below, ample precedent in the history of fast reactors for doing so. The CRBR is different from an LWR in at least four respects which compel providing full protection against a CDA; that is, providing safety systems meeting the requirements of 10 CFR Part 50 and Appendices, or their equivalent, which would mitigate a CDA without causing releases of radioactivity in excess of the 10 CFR 100 guidelines.

First, an LMFBR can undergo a nuclear explosion. The theoretical upper limit to the explosive potential (i.e., the energetics) of LMFBR's even smaller than CRBR greatly exceeds any l

practical containment for reactors (assuming they are sited above ground).

l l

l l

k Second, a nuclear explosion in an LMFBR provides a potential mechanism for release, in vapor or particulate form, of substantially larger fractions of fuel (plutonium) and fission products to the containment atmosphere, and consequently to the environment, than would be released following a non-energetic core melt accident. This is exacerbated by the fact that LMFBRs generally contain several times the core inventory of the highly toxic isotopes of plutonium than do LWRs.

Third, release of plutonium into the environment following nuclear explosions in LMFBRs potentially represents a far more serious contamination problem than contamination by fission product release (I-131) following LWR core melt accidents, due to the long half-life and extreme toxicity of plutonium. This is evidenced by the still existing quarantine of Runit Island (Enewetak Atoll) and other islands in the Pacific following plutonium contamination for nuclear weapons tests conducted prior to the 1963 Limited Test Ban Treaty.

Fourth, as stated by the NRC Staff before the Advisory Committee on Reactor Safeguards (ACRS):

the LMFBR technology has a certain lack of solid experience of in-pile test experience, a lack of maturity of the technology which makes preclusion of CDA, or prevention to the likelihood to be next to impossible.

Transcript, Meeting of the ACRS, Nov. 1, 1974, p. 368. That is, in contrast with LWR's, over 150 of which have been licensed for construction, there is virtually no experience with reactors of the general size and type of the CRBR. Moreover, it is not possible to satisfactorily model the behavior of the CRBR core

once cladding melting begins. Even if such modeling could be done with sufficient precision, it has not been. The level of design-specific information required to verify the modeling of CDA behavior for the CRBR is outside the scope of this proceeding.

The view that LMFBRs require a higher standard for protection against CDA compared to LWRs is one shared by others in the technical community. Cave, et al., note for example:

In principle, one might argue that the same standard of safety (expressed in terms of potential harm to health and damage to property) is appropriate for fast reactors as for thermal reactors. However, in order to define an equivalent safe y target for fast reactor, it is necessary to take account of the following factors:

a) The maximum potential capacity for harm of a fast reactor has been estimated to be about an order of. magnitude greater than that for a thermal reactor of the same size ....

b) The very considerable complexity of analyzing the low probability fault sequences which could lead to core melt down (CMD) and/or pressure-driven disassembly of large fast power reactors, and the consequent uncertainties therein.

Thus, the fast reactor designer may be in the difficult position of having to demonstrate a higher degree of protection against the more severe fault sequences than is necessary in the case of thermal reactors, and he may be handicapped by greater uncertainty as to the behavior of his reactor in such conditions.

L. Cave, D. Ilberg, and D. Okrent, " Designing for Safety in Fast Reactors in the Presence of Uncertainty,", Proceedings, International Meeting on Fast Reactor Safety and Related Physics, Chicago (Oct. 5-8, 1976) p. 494.

The remainder of my testimony can be outlined as follows:

I. EXPERIENCE WITH DOMESTIC AND FOREIGN FAST REACTORS SUPPORTS INCLUDING CORE DISRUPTIVE ACCIDENTS WITHIN THE CRBR DESIGN BASIS.

A. CDAs Have Been Considered Design Basis Accidents for Domestic and Foreign Fast Reactors.

B. CDAs Have Occurred in the Past.

C. CDAs Were Considered by the NRC to be Credible Events for CRBR Until May 6, 1976.

D. CDAs Cannot Be Excluded from the CRBR Design Basis Without Detailed Design-Specific Analyses.

II. THERE IS NO EMPIRICAL EVIDENCE TO SUPPORT THE PROPOSITION THAT, FOR A REACTOR OF THE GENERAL SIZE AND TYPE AS CRBR, THE PROBABILITY OF A CDA CAN BE MADE SUFFICIENTLY LOW TO JUSTIFY EXCLUDING IT FROM THE DESIGN BASIS FOR CRBR.

A. The Definition of "Sufficiently Low" Can be Derived from the FES and the Denise Letter, Which Establish the Objective That the Probabilty of GuidelinesBeNoGreaterthan10gxceedingPart100 Per Year. Dose B. At This Stage of the Proceeding, Lacking Design-Specific Analysis of the Progression of a CDA Once Initiated, Compliance with the Objective Requires Showing tha the Probability of Initiating a CDA is Less Than 10-6 Per Year.

C. No Reactor Substantially the Same as the CRBR Has Even Been Licensed and No Demonstration Has Even Been Made for a Reactor of the General Size and Type That the Probability of a CDA Was No Greater Than 10-6 Per Year.

D. It Has Not Been Shown that the Features of the CRBR Which Are Asserted to prevent CDAs Can Be Made Sufficiently Reliable So That the Probability of'Their Failure Is Less than 10-6 Per Year. A E. No Showing Has Been Made That Design Criteria Exist for LMFBRs or for CRBR Which, If Met, Wou the Probability of a CDA is Less than10gdAssureThat Per Year.

Under these circumstances, the proposition that it is feasible to design CRBR so that the probability of a CDA is incredible is a statement of dogma, not fact.

k I. EXPERIENCE WITH DOMESTIC AND FOREIGN FAST REACTORS SUPPORTS INCLUDING CORE DISRUPTIVE ACCIDENTS WITHIN THE CRBR DESIGN BASIS.

The experience to date with liquid metal fast reactors in the U.S. is shown in Table 1.

Table 1 Power Initial Name Megawatts (Thermal) Operation Clementine 0.025 1946 EBR-I 1 1951 LAMPRE 1 1961 EBR-II 62.5 1963 FERMI-I 200 1963 SEFOR 20 1969 FFTF 400 1980 Clementine was a small, mercury-cooled experimental fast reactor located at Los Alamos that was used between 1945 and 1953 to explore the possibility of operating a plutonium fueled fast reactor (USAEC, WASH-1535, Vol. 1, Dec 1974, p. 2.2-2).

EBR-I was a small experimental breeder, located at the National Reactor Testing Station in Idaho, used to test the concept of breeding. LAMPRE was a molten plutonium reactor experiment at Los Alamos. (USAEC, WASH-1535, Vol. 1, Dec 1974, p.2.2-4). It reached its design power lever 1 year after criticality and then operated two years until the experiment was terminated in early 1964 (Ibid.).

Thus, Clementine, Experimental Breeder Reactor-I (EBR-I) and LAMPRE were early, relatively small, unlicensed reactors where design basis safety and site suitability considerations were relatively unimportant. Nevertheless, it is noted that the reactor core of EBR-I was inadvertently substantially melted in

/

F an experiment in 1955 involving operator error (USAEC, WASH-1535, Vol. 1, Dec. 1974, p. 2.2-2) The accident was caused in part because automatic safety devices were disconnected.

Experimental Breeder Reactor II (EBR-II) is an unmoderated, heterogeneous, sodium-cooled reactor at Idaho National Engineering Laboratory (INEL, formerly NTES) with power output of 67.5 MW (thermal). It is capable of producing 20 Mw of electricity. It has served as a fast neutron test reactor for the US LMFBR fuels and material program. (USAEC, WASH-1535, Vol 1, Dec 1974, p. 2.2-3). Although it was not licensed and the concepts of " design basis accident" had not evolved at the time EBR-II was constructed, the 1957 " Hazard Summary Report for EBR-II indicates, using " pessimistic" assumptions, that an attempt

[was] made to calculate the maximum possible nuclear explosion resulting from a core collapse under gravity" (p. 109), about 1050 lb. TNT equivalent (p. 110), and that the primary containment was designed to contain "without breaching" a

" reasonable" upper limit on the explosive energy, about 300 lb TNT.

The Enrico Fermi reactor (FERMI-I) located at Newport Michigan was a 200 mw (thermal) LMFBR operated by the Power Reactor Development Company (PRDC). This LMFBR demonstration plant was the first of the only two fast reactors that have been licensed to operate (the other being SEFOR). The PRDC applied for and obtained a license under Section 104b of the Atomic Energy Act of 1954. For purposes of the licensing of FERMI-1, the maximum " credible" accident was deemed to be the melting of 1

l fuel in one subassembly. The Applicants stated:

i l

As a result of the care given to basic safety, both in design and in the planning for operation, it is believed that no credible equipment failure can lead to melting of fuel. However, melting of some fuel in local areas of the core, specifically in one subassembly, cannot be entirely precluded.

Such melting could occur due either to plugging of a subassembly nozzle despite the care which has been taken to keep the system clean, or due to inadvertent recycling of a core subassembly . . .

Enrico Fermi Atomic Power Plant, Power Reactor Devlopment Co.,

" Technical Information and Hazards Summary Report," Part B, Section VI, Evaluation of Hazards, Revised License Application, AEC Docket No. 50-16, July 24, 1961, p. 602.1, 603.1.

Despite this, on October 5, 1966, during a slow increase in power, fuel melting occurred in the Fermi core. Seven subassemblies were removed and inspected after the accident.

Melting had occurred in two subassemblies; two additional subassemblies had been overheated. It is generally believed that the inlet nozzles of four adjacent subassemblies had been partially blocked by debris.

The next fast reactor to be built was the Southwest Experimental Fast Oxide Reactor (SEFOR), owned by the General Electric Company and located in Washington County, Arkansas. The average population within a 15 mile radius of the plant was about ten (10) people per square mile. Southwest Experimental Fast Oxide Reactor, Docket No. 50-231, Supplemental Safety Evaluation, Aug. 19, 1969, p. 2. SEFOR was designed to operate at a steady state power level of 20 MWt or to be subjected, in an experimental program, to power excursions produced by rapid ejection of a neutron absorbing slug. I ci . at 3.

t The design basis accident for SEFOR was " core collapse,"

postulated to result from an extreme overpower condition. Id. at

10. A maximum reactivity insertion rate was calculated

($50/second) and then total energy for the accident was

" conservatively calculated" to be 830 MW-sec, 230 of which would appear as energy in vaporized fuel. The AEC staff concluding that the " theoretical upper limit of the energy available as kinetic energy is 100 MW-sec," as opposed to GE's estimate that the " actual" available kinetic energy would be less than 20 MW-sec. Icl . The containment " design basis energy release" was 400 MW-sec, far less than the upper limit calculated. Thus, a CDA was a design basis accident for SEFOR and the containment was designed to withstand the maximum calculated explosion with conservative safety margins.

The Fast Flux Test Facility ("FFTF"), located at the Hanford Reservation, Washington, followed SEFOR. FFTF is a three-loop sodium-cooled 400 MWt fast neutron test reactor. FFTF was not subject to licensing since it is a DOE-owned test facility.

However, it was reviewed by the AEC regulatory Staff which prepared a Safety Evaluation. Safety Evaluation of the Fast Flux Test Facility, Project No. 448, U.S.A.E.C., Directorate of Licensing, October 31, 1972; Supplement No. 1, Dec. 13, 1974; Supplement No. 2, March 7, 1975.

It is apparent from review of the Safety Evaluation that a core disruptive accident was understood by the AEC Regulatory

, Staff to be appropriately considered as within the design basis l

l for the FFTF. The Accident Analysis section of the Safety l

l l

Evaluation judged the adequacy of the design against accidents involving gross fuel melting, sudden energy release and interference with core cooling. While noting that the postulation of such conditions requires assuming initial conditions together with a failure to scram, the assumption was termed " justifiable considering present lack of sufficient experience with which to quantify the chances of such a failure in a fast reactor system." Id. at 92.

The capabilities of the FFTF " safety related features" were evaluated against two particular postulated accidents: a loss of coolant flow without scram and a continuous reactivity insertion without scram (severe transient overpower). Id. at 93. In 1972, the Regulatory Staff estimated using conservative 3 assumptions that the maximum theoretical work energy released by such a CDA would be near 350 MW-sec. Id., Supplement No. 1, at 4. The effects of such an explosion on the containment, reactor vessel, and primary coolant system components were evaluated. While the Regulatory Staff concluded that the vessel and primary coolant system could withstand the postulated CDAs, they could not reach that conclusion with respect to the containment and, in fact, recommended that " design flexibility" be retained for future installation of a core catcher. Id. at 136. Since FFTF did not have to be licensed, the Regulatory Staff's analysis was couched in the form of opinions, conclusions, or recommendations.

3 The Staff consistently maintained the position that it was

" prudent to retain substantial conservatism in the evaluation" of both types of postulated accidents. Id. at 102, 104.

Regarding the potential for a CDA, the Regulatory Staff concluded:

While we are of the opinion that a core disruptive accident will be of low probability, currently unquantified, we are not in agreement that the state of technology and experience on LMFBR systems is sufficient to establish that there is "no realistic potential" or that such accidents are precluded. We have therefore concentrated our review on the aspects related to the adequacy of in-vessel post accident heat removal.

Id., Supplement No. 2, at 1-1.

FFTF was built without a core catcher. After it became clear to the Regulatory Staff that the core catcher option was no longer viable, the Staff recommended that an emergency plan be implemented "to alleviate the potentially high doses associated with vessel meltthrough." Id., Supplement No. 2, at 1-5, 3-3, and 3-4.

In its 1978 Safety Evaluation Report on FFTF the NRC Staff stated:

We have concluded that the risks associated with low probability reactor vessel melt-through are acceptably low assuming that a reasonable degree of containment integrity is maintained.

U.S. NRC, " Safety Evaluation Report related to operation of Fast Flux Test Facility," NUREG-0358, August 1978, p. 15-1. And as late as 1979 the Staff was still not endorsing full power operations:

The Staff will not endorse continued operation of the FFTF beyond startup and natural convection testing without adequate measures being in place to augment existing containment margins and control radiological releases from a low probability core melt-through accident.

Id., Supplement No. 1, May 1979, p. 19-2.

s 4

In summary, of the U.S. fast reactors of significant size, core disruptive accidents were design basis events or their equivalent for EBR-II, SEFOR, and FFTF, or three out of four.

Ironically, FERMI-1, the only one of the four which excluded P

accidents involving more than the melting of one subassembly on the grounds that such events were incredible, in fact experienced an accident greater than its design basis.

While our access to the details of design of foreign fast reactors is limited, the available evidence is that core disruptive accidents are design basis events in at least two plants under construction. The CDA is within the design basis for Super Phenix, a 3000 MWt pool-type fast reactor. It was licensed for construction by the French government in 1977.

Super Phenix was required to contain 800 Mj of energy. Because of that requirement, a " cupola" or dome inside containment was incorporated into the design. Its molten fuel recovery system

(" core catcher") is designed to take into account the possibility of a meltdown of 7 fuel assemblies. H. Noel and H. Frestone,

" Safety Measures at the Creys-Malville Power Station." These two devices, the dome and molten fuel recovery system, are similar to the sealed head access area and core catcher that were l

incorporated into the CRBR parallel design where the CDA was a DBA.

Core disruptive accidents are also within the design basis of SNR-300, the German fast reactor, which is being built with a core catcher. I am unable to determine whether this pattern holds true for other foreign fast peactors.

k

~

q o ,

Finally, core disruptive accidents were within the design I basis for CRBR until the letter of May 6, 1976, from Richard P.

Denise of the NRC to Lochlin W. Caf fey, Director of the CRBR Project Office, declaring that the Staff had reversed its position:

It is our current position that the probability of core melt and disruptive accidents can and must be reduced to a sufficiently low level to justify their exclusion from the design basis accident spectrum. We will therefore not consider CDAs as design basis accidents.

It is instructive to consider some of the history of the CRBR application because it establishes that core disruptive accidents cannot justifiably be excluded from the CRBR design basis without detailed, design-specific analysis of the CRER.

On July 3, 1974, and on October 21, 1974, Richbrd P. Denise, AEC's Assistant Director for Advanced Reactors, wrote # to Peter S.

Van Nort, the General Manager of the Project Management Corporation, stating that CDAs should be in the desigra basis:

Specifically, it is our current view that the plant should be designed on the basis that it will accommodate CDA's, and that CDA's specific to the CRBRP should be analyzed to form the design basis l for the CRBR Plant.

Letter Richard P. Denise to Peter S. Van Nort, Oct. 21, 1974. ,

On November 1, 1974, Robert Bernero, then Project Manager of the LMFBR Branch under the AEC's Directorate of Licensing, and who now holds the position of Director, Division of Risk Analysis, Office of Nuclear Reactor Research, testified before the ACRS on the CRBR construction permit application. He began by explaining that the Staff reviews safety by setting design i

k basis accidents for the particular plant in question. He then outlined the two possible approaches for CRBR:

Now, with respect to the CRBRP, there are two approaches with respect to this most important consideration of core disruptive accidents.

You can preclude -- you might preclude core disruption if you are confident that you can have reliable analysis of the events that tend to seed or lead up to core disruption, and the mechanics are [or]'the. actions which take place during it.

If you have confidence that you can reliably sense chose events in a timely fashion. And, of course, if you have re' liable action to prevent them, that you can make a shutdown system work in time, and a heat removal system follow-on as needed. That would be one approach.

The other approach is to design for core disruptive accidents, still striving to prevent them. This does not remove the obligation to prevent core destruction. You are still trying to prevent them D'tt you incorporate design features to cope wit .

Transcript, Meeting of the Advisory Committee on Reactor Safeguards, Nov. 1, 1974, p. 367-368.

Mr. Bernero went on to state-that core disruption could not then be precluded, precisely because the reliability of the CRBR syster.s used to prevent CDAs was not demonstrated:

Now, as we have said, from what we have seen and what we have heard and what the Regulatory Staff knows of LMFBR technology at this time, we don't think it is reasonable to assume that you can preclude or sufficiently prevent core disruption.

( And we point out that it's more than scram I

reliability. That is one phase of the three general phases I indicated.

l The first and most important is the reliable

[ reliability] analysis. And basically, if you look at an unavailability or a probability of loss of coolable geometry as the ' Applicant prefers to say, one has to assign numbers all along to the analytical reliability and those'~later considerations.

We feel that the LMFBR technology has a certain lack of sound experience of in-pile test experience, a lack of ma,turity of technology which makes perclusion of CDA or prevention to the likelihood to be likely to be ne::t t'o' impossible.

l t

= n- s e

a t

i Id. at 368.

Applicants continued to press for precluding CDAs. In order  !

to get the review of the CRBR application underway, the Staff agreed to review two separate designs at once, one which included CDAs as design basis, the other which excluded them. Letter from A. Giambusso, Deputy Director for Reactor Projects to reter S.

Van Nort, General Manager, Project Management Corporation, Nov. .

19, 1974.

On December 6, 1974, Mr. Denise again wrote to Mr. Van Nort, this time outlining the critical weakness in the Applicants' position on CDAs, to wit they continued to be unable to demonstrate that the CRBR safety systems would reliably sense and prevent all conditions leading to core disruption. Th'e Staff was.

i asking specific questions and getting only generalities in

, response.

Denise observes that the Applicants " proposed to establish >

l that safe shutdown could be assured with sufficient reliability [

tha core disruptive accidents (CDA) need not be considered in the design basis." Id. at 1. He notes that the Staff has

" frequently stated the position that we currently believe that CDAs should be included in the spectrum of design basis t accidents." Id.

Denise proceeds to describe the Applicants' case: #

[T]he tone and content of the materials furnished suggest that you are treating the CRBRP like a light water reactor, i.e., simply as a Category A plant as defined in WASH-1270 (Anticipated Transients Without Scram for Water-Cooled Power Reactors). The specific evaluations and conclusions of WASH-1270 indeed apply only to light

water reactors, and specific Regulatory positions in WASE-1270 are based on the-level of operating experience and analytical understanding prevalent for light water reactors._ In the case of the 3 '

CRBRP, it is necessary to consider methodically all anticipated transient events, as well as low  !

probability events which could involve core '

disruption, and to determine how these events are sensed in a timely way, and the specific role of shutdown action in limiting damage or preventing core disruption. From such considerations the  ;

design bases of the scram syecem and others are derived. It is not now evident tha these design '

i bases for CRBRP will be very similar to the design bases appropriate to a water reactor system, which ,

your draft materials for this meeting seem to  ;

assume. Scram reliability requirements can be appraised properly only in the context of knowing i the specific function required of the scram action. For example, if it has not been i established that transients which are to be  !'

considered will not progress irrevocably to core disruption in a few hundred milliseconds, it would  !

be fruitless to argue the reliablity of a scram a

system which takes 1-2 seconds to function. -

t Id. at 2, emphasis added.

On June 5, 1975, the Staff wrote again to the CRBR Project [

General Manager, noting that "[t]he safety review of the CRBRP is [

complicated-by the lack of resolution of a very basic issue, that ,

is, whether core disruptive accidents (CDA) should be treated as t design basis events,"4 and reasserting the Staff's position that they should be. The Staff informed PMC that because of the large l l number of computer codes cited in the PSAR and other PSAR i

( references not previously reviewed by the Staff, "special  !

7 attention and arrangements will be necessary to provide i

acceptable documentation and review" of the codes and i

l b i

l 4 A. Giambusso, Director, Division of Reactor Licensing to Peter S. Van Nort, General Manager, Project Management Corporation, i June 5, 1975, p. 1.

l

references. Id. at 3. The Staff enclosed over 100 pages of detailed questions seeking the specifics of the CRBR design and the factual bases for Applicants' assertions concerning the reliability of CRBR systems.

At least as late as April 1, 1976, the Staff was still acting on the apparent presumption that the CDA should be within the CRBR design basis. The Staff informed PMC: "[W]e are of the opinion that a sufficient basis does not exist to accept the project's best estimate assessment of some of the CDA parameters and their contributions to the accident energetics."5 ,

Complaining of "the lack of design information," the Staff notified PMC that additional detailed reviews would be required of the Applicants' CDA analysis.

One month later, on May 6, 1976, Mr. Denise announced a dramatic reversal in the Staff's position. Prior to the Denise letter, the position consistently expressed by the Staff had been (1) CDAs should be included within the design basis for the CRBR unless and until applicants could demonstrate, by analyses of the specific CRBR systems, that those systems relied upon to prevent CDAs were suf ficiently reliable to justify the assumption that CDAs would be precluded; (2) because the CRBR design is so different from LWR designs, and because of the lack of experience with fast reactors similar to CRBR, the assertion that the CRBR would meet LWR general design criteria or equivalent is not i 5 Memo, P. Speis, Chief, Liqud Metal Fast Breeder Reactors l

l Branch, to Peter S. Van Nort, G e n e r a.1 Manager, Project Management Corporation, April 1, 1976, p. 1.

l

{ .. -_ -- .. ._

b sufficient to establish that the CRBR safety systems meet the required level of reliability to preclude CDAs; (3) the Applicants showing to date, which included the so-called Reliability Program, an integral part of Applicants' systematic approach using reliability methodology to select the limiting design basis for CRBR, did not justify excluding CDAs from the design basis.

Then, on May 6, 1976, the NRC Staff informed the Applicants of their " current position that the probability of core melt and disruptive accidents can and must be reduced to a sufficiently low level to justify their exclusion from the design basis accident spectrum."6 The Staff stated that the following

" minimum features and characteristics ... are necessary" for CRBR to prevent CDAs:

1. At least two independent, diverse and functionally redundant reactor shutdown systems;

2. At least two independent, diverse and functionally redundant decay heat removal systems;

3. Means to detect and cope with subassembly faults;

4. Either a heat transport system of very high integrity or i

protective features to cope with pipe failures;

5. Protection of the containment systems against the effects of sodium releases in the equipment cells.

6 Richard P. Denise, Assistant Director for Special Projects, NRC, to Lochlin W. Caffey, Director, CRBR Project Office, reproduced at NUREG-Ol39, Final Environmental Statement Related to Construction and Operation of Clinch River Breeder Reactor Plant, Feb. 19797, p. I-2, I-4.

The letter also stated that the Staff would use as a " safety objective that there be no greater than one chance in one million per year for potential consequences greater than the 10 CFR 100 dose guidelinos ...". This was characterized as a " design objective rather than a fixed number which must be demonstrated...".

Mr. Denise's phrase -- that the probability of CDAs "can and must" be reduced to a level justifying exclusion from the design basis -- is a carious one. There is no explanation offered for the conclusion that CDAs "must" be excluded, although one could infer from other sources that the CRBR would not be licensed if CDAs were included within the design basis, hence they "must" be excluded.

1 As to the assertion, more accurately characterized as a hypothesis, that CDAs "can" be excluded, one searches the record in vain for support for this fundamental change in position. The fact is that the Applicants had been trying for at least two years to demonstrate that the CRBR systems would achieve a level of reliability sufficent to justify the assumption that CDAs were incredible; they had f ailed to make that demonstration.

Conf ronted with a design which could not then be approved on the basis of the available specific design information, the Staff retreated to the level of generalities. Against the background of the CRBR review to that date, I believe that the Staff position as of May 6, 1976, can fairly be interpreted as follows: (1) the CRBR could not be licensed unless CDAs were excluded from the design basis; (2) the available design-specific

information and analysis did not make a case for concluding that CDAs are incredible for the CRBR; (3) some other hypothetical design including at least the " minimum" features described above could justify excluding CDAs.

It is extremely important to note that the proposition that l CDAs "can" be excluded is a hypothesis and not a fact. The Denise letter neither referenced nor contained any analyses to support the conclusion that a design containing the minimum features described therein either had been or could be shown to meet or even " adequately approach" the safety objective of ensuring that the probability of exceeding 10 CFR Part 100 guidelines was no greater than 1 x 10-6 per year of operation.

Thus, Denise's statement that the probability of CDAs "can" be made sufficently low is at best a hypothesis for which Denise provided no apparent factual support.

The CRBR Project was placed into limbo by the determination of President Carter in the Spring of 1977 that its continuation was not in the national interest. All licensing activities were halted for over four years. When they resumed, Applicants applied for a limited work authorization (LWA).

There is a disjunction between the initial CRBR licensing review in the mid-1970s and the current review for at least two reasons. First, the group of NRC Staff members assembled to work on the current review is almost without exception new to the CRBR. None of the senior Staf f responsible for the CRBR review are personally cognizant of the history of the CRBR application .

and none was able during depositions to articulate a factual

basis for the statement in the Denise letter that the probability of CDAs "can" be made sufficently low.

Moreover, neither could the Staf f justify its exclusion of CDAs to the ACRS:

MR. MARK: What we are saying is we have to understand something about the progress of such an event. We have not been quite able to decide whether it is a design-bases event or not a design-basis event. We have not been able to decide whether it is a likely event or an unlikely event. But we have decided that we must understand it.

We are going to have to face up, however, at some point to the extent to which we insist that this event be prepared for in the design. Is it or

• is it not design basis?

MR. CHECK: ... While I am not the ultimate historian, I think it has never really been classified as a design basis event. It has skirted it; it has come close. I think we are prepared to say that it is not a design-basis event without being able to prove that today, without wishing to make that case today.

Transcript, Meeting of ACRS Subcommittee on CRBR, May 5, 1982, p.

381-382, emphasis added.

There is a second disjunction not unrelated to the first.

, The initial CRBR safety review focussed on the specifics of the CRBR design. The current review, at least insofar as the LWA is ,

concerned, does not. Paul Check, who holds the title of Director, CRBR Program Office, and is currently the senior NRC Staff member for the CRBR review, stated to the Advisory Committee on Reactor Safeguards:

+

MR. CHECK: I am trying to string together a l

history and some rationalization for a logical approach to this which, quite frankly, is aimed at

( describing that minimum, tha minimum that we must do for LWA-1 purposes. ... [W]e are re-examining what was done before and seeing if we can do less

and still meet responsibilty requirements for LWA-1 findings.

Transcript, Meeting of the ACRS Subcommittee on CRBR, March 31, 1982, p. 123-124. In the terminology of the NRC rules, the focus of review has changed from analysis of the CRBR to discussion of a reactor "of the general size and type." The ACRS experienced great difficulty with this approach:

MR. CARBON: But as a point of clarification here, this is a site suitability meeting to discuss this site for a reactor of this type and size, as you said, and CRBR may or may not fit the site.

MR. CHECK: That is true. That is true.

MR. OKRENT: I must say I find the discussion of a site suitability report for a reactor of this size and type, not necessarily CRBR, to be a sort of fantasy. There is one reactor people have in mind building there. It is CRBR, within whatever modest modifications are practical at this stage and, you know, we ought to stop pretending.

The following portion of this testimony will examine each of the ways in which a decision-maker could seek confidence that the j probability of an accident beyond the CRBR design basis is so remote as to be incredible for a reactor of the general size and type of the CRBR and will conclude that there is not sufficient basis for that conclusion.

i

II. THERE IS NO EMPIRICAL EVIDENCE TO SUPPORT THE PROPOSITION THAT, FOR A REACTOR OF THE GENERAL SIZE AND TYPE AS CRBR, THE PROBABILITY OF A CDA CAN BE MADE SUFFICIFNTLY LOW TO JUSTIFY EXCLUDING IT FROM THE DESIGN BASIS FOR CRBR. i i

In order to determine whether the probability of CDAs "can" '

he made sufficiently low to justify their exclusion from the CRBR design basis, one should begin with a definition of "sufficiently low." As noted supra at 4, the 1977 FES established the goal in numerical terms. This can also be found in the Denise letter }

which contains the same " safety objective" that "there be no greater than one chance in a million per year for potential consequences greater that the 10 CFR 100 dose guidelines for an  !

individual plant, for example CRBR ...".

While this is stated to [

be a " design objective" rather than a " fixed number which must be demonstrated," the operative meaning of that distinction is unclear except perhaps to indicate flexibility in the degree or nature of the evidence required to demonstrate that the objective has been met. Nonetheless, if the " objective" is that the probability of exceeding Part 100 shall be no greater than 10-6 per year, then it is fair to use that objective as a definition of "sufficiently low" probability.

It should also be noted here that, while the objective is stated in terms of the probability of exceeding the Part 100 guidelines, for the purposes of this stage of the proceeding, compliance with that objective requires showing that the  ;

probability of initiating a CDA is less than 10-6 per year. My reasoning is as follows: The probability of exceeding Part 100 i guidelines is the product of two probabilities -- the probability t

of initiating a CDA times the conditional probability that, given

the initiation of a CDA, it will result in doses exceeding the 10 CFR 100 guidelines. The conditional probabilty that the CDA, if initiated, will exceed 10 CFR 100 dose guidelines is design-specific, partly a function of the reliability of the CRBR containment systems, which are intended to " accommodate" CDAs.

Allocation of a value substantially less than 1 to this conditional probability involves a level of design-specific review which has not been presented by the Staff and requires design-specific information which goes far beyond "the general characteristics of the CRBRP design (e.g., redundant, diverse shutdown system)" that limits the scope of this proceeding.

Order Following Conference With Parties, April 22, 1982 at 2-3.

Indeed, the Applicants' so-called " reliability program," which included the elements required to establish the reliability of the CRBR containment systems and components (e.g., data collection, testing, fault tree and event tree analysis, failure mode and effects analysis, and common mode faiure analysis), was the subject of NRDC Contention 1(b) and was ruled beyond the scope of this stage of the proceeding. Since there is no basis for determining the conditional reliability of the containment systems, a conditional probability of CDA progression cannot be established.

Moreover, analysis of the progression of CDAs involves the computer modelling of the behavior of the reactor core after the onset of core disruption. The computer codes used to do that modeling are enormously complex and contain literally thousands of assumptions. The results are strongly design specific. They

have also been ruled outside the scope of this proceeding. Tr. -

551-552, Prehearing Conference of April 20, 1982.

And finally, because both Applicants and Staff contend that they do not rely on any analysis of the progression of a CDA, once initiated, or any probabilistic risk assessment of this conditional probability for determining that the CDA is beyond the DBA envelope, there is no basis for assignment of a value to the conditional probability that is less than 1.

In sum, since the factual predicates necessary for establishing the conditional probability of CDA progression will not be considered, no credit can be taken for the conditional probability on the basis of the available information. That is, >

no credit can be taken for the improbability of conditions relating to remaining plant containment and site features. One must assume, therefore, that the overall goal of less than 10-6 5

probability per year for exceeding 10 CFR guidelines must be met for the probability of loss of core coolable geometry, i.e., the probability of initiation of a CDA. This is precisely the approach taken by the Applicants in their Reliability Program in 1976.7 Having established a goal for the probability of loss of coolable geometry, the next step is to examine alternative ways to test-whether the probability of a CDA in a reactor of the general size and type of CRBR meets the goal.

7 Applicants noted at the time that, "The conservatism inherent in establishing this requirement ensures compliance with 10 CFR 100.2 which specifies that ' novel reactors' are expected to use criteria which ' takes into account lack of experience.'" Clinch River Breeder Reactor Project, Reliability Program, January 1976,

p. 12.

I

• First, one might argue that the best evidence should j derive from a detailed analysis of the CRBR itself.

• Second, one could ask whether a reactor substantially similar to the CRBR has been licensed.

• Third, one could ask whether the features of the CRBR which are asserted to prevent CDAs are substantially the same as the features of any other reactors that have been licensed pursuant to the same criteria as those applicable to the CRBR.

• Fourth, one could ask if a set of detailed design criteria have been established and justified that, if met, would ensure that the probability of a CDA is less than 10-6 per year.

I will go through these approaches seriatum.

Case 1 The first approach can be dealt with summarily, in that the specifics of the CRBR design, beyond its " general design characteristics," are excluded from the LWA-1 inquiry.

Case 2 ,

With regard to the second approach, if, during the licensing of a reactor substantially similar to the CRBR, it was demonstrated through design-specific analyses that the l probability of CDA initiation was less than 10-6 per year, one could have confidence that a CDA can be excluded for a reactor of the general size and type of CRBR.

This second approach also can be dealt with summarily. No reactor substantially the same as the CRBR has been licensed.

The Staff and Applicants can point to no analysis that demonstrated that, for a substantially similar fast reactor, the r

probability of a CDA was sufficently low to justify its exclusion from the design basis.

While the Staff provides two paragraphs aiscussing the

" experience" with fast reactors, that experience is scant indeed, as is the information provided. NUREG-0786, Site Suitability Report in the Matter of the Clinch River Breeder Reactor Plant, Revision to March 4, 1977, Report, p. II II-4. The Staff does not even discuss the highly pertinent information of whether CDAs were inside or outside the design basis for the fast reactors mentioned, nor how that decision was made and justified. The most that can be concluded from this experience is that some fast reactors, none of which is substantially similar to a reactor of the general size and type as CRBR, have operated. Most were unlicensed. Two have experienced core melt beyond the CRBR design basis. For at least some, CDAs were within the design basis. This " experience" does not support any particular conclusion with regard to the probability of a CDA for a reactor of the general size and type of the CRBR, much less the conclusion that such probability is "sufficiently low" or no greater than 10-6 per year.

The foreign experience is, if anything, even less supportive of the conclusion. For one thing, the Staff again fails to tell us whether CDAs are inside or outside the design basis for these foreign reactors, nor what the licensing criteria were for these facilities, if they were licensed. None of the foreign reactors are substantially similar to CRBR. CDAs are within the design basis of at least Super Phenix and SNR-300. Once again, this

" experience" amounts to little more than that fast breeders have operated abroad, at times with substantial difficulties. The fact that a breeder will work does not lead one to conclude that it will not have a core disruptive accident. TMI-2 worked before it had a core disruptive accident. Moreover, the Staff does not systematically review foreign reactor experience and thus can hardly base judgments as to the adequacy of the CRBR design on such experience.

In conclusion, use of the first approach outlined above does not provide confidence that the probability of a CDA for a reactor of the general size and type of CRBR is suf ficiently low to justify its exclusion from the design basis.

Case 3 Therefore, I go on to the third approach, asking whether the features of the CRBR that are asserted to prevent CDAs are substantially the same as features of other reactors that have been licensed using criteria applicable to the CRBR. That is, have substantially similar features been incorporated into previous plants, and, if so, has their reliability been demonstrated to be so high that CDAs can be treated as incredible? This corresponds to the general approach used primarily by the Staff.

The four general design features which are asserted to prevent CDAs are discussed at pages II-6 through II-13 of NUREG-0786, the Site Suitability Report of June 1982. They are the reactor shutdown system, piping integrity, fuel failure propagation, and residual heat removal.

N l

It is instructive to examine the reactor shutdown system in I this regard, in that it is here that the design features are  ;

perhaps most similar to the comparable systems of an LWR and consequently one would anticipate that it is here that the [

Staff's (and Applicants') case could be more easily made. f 4

4 There are several questions that come immediately to mind in [

comparing the two (CRBR and LWR) shutdown systems: j

. (1) What is the reliability of LWR shutdown systems, and do i i

they meet the criterion established for such systems?  !

According to the Proposed ATWS rule for LWRs (46 FR 57521, f

Nov. 24, 1981): [

There have been roughly one thousand reactor 4

years of experience accumulated in foreign and  !

domestic commercial light-water-cooled reactors -

without an ATWS accident. This experience suggests that the frequency of ATWS accidents is less than  !

or of the order of once in a thousand reactor i years. There have been several precursor events,

. i.e., faults detected that could have given rise to i j ATWS events. This suggests that the frequency of -

I ATWS accidents, though less than once in a thousand -

reactor years, may not be very much less. Such .

frequencies are too high for accidents of the severity described above. Thus the NRC has determined that reductions must be made in the  :

frequency, severity or both the frequency and  ;

severity of ATWS accidents.  ;

i 46 FR 57522, (Nov. 24, 1981) (emphasis supplied). [

The NRC has concluded that the reliability of current reactor protective systems has not been demonstrated to be adequate and most likely is not adequate.

Id. at 57523. ,

(2) Can LWR shutdown reliability deficiencies be adequately [

corrected by modification of the reliability of the protective I  ;

system alone., i.e., the control rods and control rod drives, or I must other LWR design-specific improvements be made?  !

i

All alternatives under active consideration under the proposed ATWS rule require some LWR design-specific measures to mitigate ATWS events which are not directly transferable to LMFBRs, e.g., providing actuation circuitry that is separate from the reactor protection systemm for primary system relief values and auxiliary feedwater.

(3) Even if LWR shutdown systems could be demonstrated to be adequate for LWRs, would their level of reliabilty be adequate for the CRBR?

The answer is no. It has been long recognized that because of the differences in severity of ATWS events (see discussion at

p. 9-10 above), the reliability of LMFBR shutdown systems must be higher than that for a LWR, hence the emphasis on redundancy, diversity, and independence of the two CRBR shutdown systems.

Moreover, because of the significant differences in the other plant safety features (e.g., lack of ECCS in LMFBR and lack of intermediate sodium loop in LWR) and the difference in ATWS event sequences, consequences, and performance criteria and because these are often highly design-specific, it is impossible to establish the reliability of a CRBR shutdown system relative to that of the LWR without a comprehensive probabilistic risk assessment. (Such analyses are excluded from the scope of the LWA-1.)

In this regard, it is instructive to examine the following exchange between ACRS members and Applicants:

MR. KASTENBERG: I'll give you another example.

For some other reactors they are predicting or th are calculating core melt with frequencies of 10-gy, 10-4 per year. If someone came to you and said,

ah, is that what you are shooting at for Clinch River, you might have a problem.

MR. CLARE: Okay. I am again not exactly sure what you are suggesting there. If you ask me if I am shooting for a order of 10-3, probability no, I don't of a core think so. melt on the MR. KASTENBERG: Or even 10-4 MR. CLARE: I think we understand the message that you would be concerned that we somehow tie ourselves too closely to the LWR which might serve inappropriately.

MR. KASTENBERG: Right.

MR. MARK: And drag in irrelevant boundary conditions.

MR. CLARE: Right.

MR. KASTENBERG: Exactly.

ACRS Transcripts, May 25, 1982, pp. 275-276.

It is also worth noting here that one of the major causes of uncertainty in WASH-1400 cited by the NRC's Risk Assessment Review Group (Lewis Report)8 was the variations between reactors and the fact that WASH-1400 examined only one BWR and one PWR.

There are substantially larger differences between the major safety systems, e.g., reactor shutdown systems, in a reactor of the general size and type as CRBR and those in LWRs than between systems in reactors of the same LWR type.

(4) Given that the CRBR will have two reactor shutdown 1 systems with specific requirements regarding independence, diversity, and redundancy, can one conclude that their 8 H.W. Lewis, et al., " Risk Assessment Review Group Report to the U.S. Nuclear Regulatory Commission," NUREG/CR-0400, Sept.

1978, pp. 10-11.

reliability will be substantially improved over comparable LWR shutdown systems?

First, it should be noted that there is some " independence, diversity, and redundancy" built into LWR shutdown systems. The question arises: if we design for a greater degree of independence, diversity, and redundancy, can we determine whether the desired level is achieved -- in this case some 3-4 orders of magnitude improvement over existing LWR systems?

As stated in the proposed ATWS rule,

[T]he very high level of reliability required is difficult to demonstrate with confidence because it depends on accurately determining the rate of common cause failures. Common cause failures involve failures of multiple components resulting from a single cause or event. Reactor protection systems are carefully reviewed to identify and (

eliminate all but the most unlikely common cause  ;

failures. However, one common cause failure in the reactor trip portion of the protection system of a commercial nuclear power reactor has occurred during approximately 1000 reactor-years of operating experience. The failure was detected during normal surveillance and corrected before any event requiring a reactor scram occurred. There has also been one partial failure to scram in a commercial power reactor, which occurred at low power and resulted in no core damage or radiation

, release.

l Common cause failures have also occurred in j other systems in nuclear power plants and other I potential common cause failures in reactor protection systems have been identified. Because of the low rate of occurrence of common cause failures, operating experience is not, and cannot i be, sufficient to conclusively determine on a l statistical basis whether reactor protection systems are reliable enough to make the probability of unacceptable consequences from ATWS events  :

acceptably small. The prediction of common cause l failures is as much art as it is science. System reliability analyses that attempt to predict the nature and frequency of common cause failures auffer from problems of completeness and accuracy,particutarly when the desired failure rate is extremely small.

46 FR 57522-23 (Nov. 24, 1981).

In sum, the answer is no, one cannot conclude that the reliability will be substantially better.

(5) Can common mode failures significantly impact CRBR shutdown system reliability?

According to Woodward and Balch of Westinghouse Electric Corporation, the prime contractor for CRBR, common cause failures have the potential to significantly impact the ability of an entire safety system to function when required.

Because of the large number of potential common causative factors that are conceivable, an essential part of the CCF evaluation process is to identify and focus attention on those factors which may have the potential to produce failures having significant consequences. Two basic sources of information are used to achieve this objective:

1) Recent reactor operating and fabrication experience.

2) Detailed design evaluations which start at the component level, identify all failure modes and sorts them relative to their probability of occurrence and system consequences.

W.S. Woodward and F.J. Baloh, " Common Cause Failure Assessment Specification for the CRBRP Reactor Shutdown System," WARD-D-0195, March 1978, p. 1 1-2 (emphasis supplied).

An extensive list of common causative factor categories is provided in Table 2-1 on p. 2-7 of the Westinghouse assessment.

Id. at 2-7. The list of individual events would be far more numerous. Woodward and Baloh also observe:

Historically, significant common cause failures have occurred, as a result of unidentified dependencies which exist between components or systems.

(Id. at 2-5) and Although the human factor is only one of the many common causative factors identified ... experience has shown it to have a major influence on common cause failures (Id. at 2-6) Also, The survey of past reactor experience indicates ,

that the majority of CCF related incidents can be traced to human factors. Inferior components that escape proper inspection, installation errors, inadequate operational procedures and negligence contributed to more than 60% of the surveyed incidents.

Id. at p. 3-6.

The Report of the Reactor Safety Review Group (September 1981) found that:

Most studies of the likely causes of serious accidents conclude through probailistic risk analysis that over 50% of the risk is associated with human failure to perform as intended.

Harold Denton, Director of NRC Office of Nuclear Reactor Regulation, copy of viewgraph enclosed in letter from Richard Shikiar to Thomas Cochran, Jan. 27, 1982.

As noted above, common mode failure analysis requires

" detailed design analysis." Potential common cause failures for the CRBR are to be identified and assessed as part of the CRBR Reliability Program.9 The adequacy of this program was the subject of Intervenors Contention 1(b), which under the Board's l

l order is outside the scope of the LWA-1.

I It is also instructive to note that the NRC Staff has made i

no assessment of the probability of accident sequences within or 9 Id. at p. 1-1.

3 beyond the design basis as can be seen from the following exchange between the ACRS and the Staff:

MR. MARK: I mean if it [ hypothetical core disruption] were a small enough frequency, then our interests might be low enough; if it is a high frequency, then our interest should be very intense. What is it?

MR. ALLEN: Okay. My response to that is, of course, the Staff is requiring that the core-disruptive accident be maintained at a low enough probability that it remains outside the design basis envelope. And on those grounds, we intend to proceed with our review ....

I do not have a probabilistic number I would feel comfortable with. All I can state is that that is the requirement: that it be kept low enough by assuring capability of the plant protection system to guarantee that.

ACRS Transcripts, May 5, 1982, p. 379. See also, ACRS Transcripts, May 24, 1982, p. 211.

In sum, there is no demonstration by the Staff that it is feasible to design CRBR shutdown systems with a failure rate significantly less than that for LWRs, which is estimated to be approximately 10-3 per year. As I have indicated above, to exclude the CDA ' rom the design basis without establishing the conditional probability that a CDA once initiated will exceed Part 100 guidelines, there must be a showing that the failure rate of the CRBR shutdown systems can be substantially (an order of magnitude) better than the goal of 10-6 per year. The present state of the art is orders of magnitude away from approaching that goal.

I have used the example of the shutdown systems to illustrate that one cannot conclude, based upon the general descriptions of the systems intended to prevent CDAs, that CDAs

3 will not occur. The primary point to keep in mind is that, despite the NRC's requirements for redundancy, diversity, and independence, all systems and all components have some rate of failure and that those failure rates are to a substantial degree design-specific. The systems designed to prevent CDAs will not work perfectly. In addition, humans will make errors in the design, testing, surveillance, and operation of the systems, adding to the failure rate.

It is therefore not sufficient to state, as the Staff does, that the shutdown systems or the other systems intended to prevent CDAs will be " state of the art" without demonstrating what the reliability of the particular state of the art system is and without demonstrating that the reliability of that system in combination with the reliability of other systems (and their interaction), is sufficient to insure that CDAs are not credible. That is the missing link. One could conclude that it is " feasible" to design CRBR so that the systems intended to prevent CDAs are state of the art. That is not the same as concluding that it is feasible to design CRBR so that CDAs are incredible. The missing link is crucial: the evidence that state of the art systems for CRBR, or a reactor of the general i

l size and type, are good enough to sense and prevent CDAs with a I

vanishingly small chance of failure.

At this point it is important to recall that Applicants are seeking to justify a decision that is unprecedented in U.S.

Licensing history: that CDAs can be considered incredible for a reactor of the general size and type of CRBR. If the evidence

does not support such a conclusion, as I firmly believe, the necessary consequence is not that an LMFBR cannot be built, but at the most that, if built, CDAs must be included within its design basis, as for Super Phenix, SNR-300, and the CRBR parallel design, for example.

To summarize, I poaed the following question above: Have substantially similar features been incorporated into previous plants, and, if so, has their reliability been demonstrated to be J

so high that CDAs can be treated as incredible? Considering the Staff's Site Sui; ability Report, the answer to the first part of the question is "no." Most of the general CRBR features have some similarities to systems which have been used in LWRs. Some are almost completely different from previously licensed plants, as in the case of the systems being developed to prevent fuel failure propagation. All have significant differences. The answer to the second part of the question is also "no" for the reasons discussed above.

I Case 4 I therefore proceed to the fourth approach outlined above, namely, whether a set of design criteria has been established and justified which, if met, would ensure that the probability of a CDA for a reactor of the general size and type as the CRBR is "suf ficiently low," or no greater than 10-6 per year, and, could these criteria be met.

The answer to the first part of this question is "no."

There are no approved design criteria for judging the acceptability of the CRBR design, nor are there general design t

3 criteria for fast reactors. The Applicants have proposed a set of broad and general criteria for CRBR (1982 SSR, Appendix A).

The Staff's review of these criteria, its acceptance, rejection and/or modification of these criteria will not be set out until the SER is published.

The general principle behind these proposed criteria is apparently that they should achieve comparability between the risks associated with light water reactors (" LWR") and the risks associated with CRBR. However, there is no way of judging whether the criteria will accomplish that, since they have not been finalized, nor has an analysis been performed by the Staff to match the existing LWR criteria against the proposed CRBR criteria. As members of the ACRS have observed, the questions of which LWR criteria should apply to CRBR, which should be adapted and how that should be accomplished, and what new criteria should be established in areas not covered by the LWR criteria, are not simple ones. See generally, Transcript, March 30-31, 1982, Meeting of the ACRS Subcommittee on CRBR.

The following exchanges from the ACRS meeting of March 30, 1982, are instructive:

MR. CARBON: ... There are several very important technical issues on which the principle design criteria are either silent or vague, and among these -- again, these are ones that I personally consider very important issues on the safety of the CRBR. One of these is the definition of design basis accident and the second is the role of CDA's and energetics. The third is the definition of the site suitability source term. Fourth is the margin of safety against seismic events. Fifth, the natural circulation decay heat removal requirement. Sixth, containment confinement considerations, including perhaps questions about vented containment. And seven, sabotage.

3 Now, obviously some of those don't belong in design criteria, but if you would do as much as you can to relate the criteria to these issues and vice versa, I think it would be helpful to our understanding.

ACRS Transcripts, March 30, 1982, p. 5. Even the NRC Staff maintains that the CRBR Design Criteria are subject to further revision:

MR. CHECK: ... He [ Bill Morris, NRC Staff) pointed out that the process for developing and improving the principle design criteria is in large measure a significant component of the construction permit review. ... as our [CP] review matures and the development of the principle design criteria progresses.

ACRS Transcripts, March 30, 1982, p. 11.

It is also important to note that the criteria by which CRBR is supposedly to be judged are being developed at the same time that the design for the plant is being finalized, and apparently on the basis of the plant's design rather than vice versa. As ACRS Subcommittee member Myron Bender stated, "I think your timing is wrong. I think you have to get [the design criteria]

out before you put it in the SER." Id. at 31. "[T]here's no basis for judging unless you put the judgment criteria out before you present your case." Id. at 33.

Both the Staff and the ACRS Subcommittee Chairman Max Carbon acknowledged that the way the criteria were being developed raised questions as to their meaningfulness when he remarked.

[W]e have to be sure that these are viewed as standards by which CRBR is judged, rather than -- I think his words were something along the lines of prepared to help justify what we are doing.

Id. at 63.

t Moreover, there is no basis for the choices of the principal design criteria which have been proposed by Applicants and are being considered by Staff. This omission has also been noted by the ACRS:

The criteria are kind of bald right now. They just say, here are the criteria. But why they are criteria leaves a lot to the imagination, and while I am very comfortable with what I understand about LWRs, I do not think I have any reason to believe that anybody here should have less discomfort than me with the question of whether I understand why LMFBRs have certain criteria.

Id. at 64 (remarks of Mr. Bender). Once again, Staff responded that it would defend its choice of criteria only when it issues its SER. Id. at 65.

In its letter of July 13, 1982, to the Commission, the ACRS provided its present position regarding the CRBR Design Criteria:

... at the [CRBR] construction permit stage substantive assurance will be needed [to assure]

that such criteria are being met. We wish to note that we do not necessarily agree with all the LMFBR Design Criteria specified in Appendix A of NUREG-0786.

Letter from P. Shewmon, Chairman, ACRS, to Nunzio J. Palladino, ,

Chairman, NRC, "ACRS Report on the Suitability of the Clinch l

River Breeder Reactor Plant Site," July 13, 1982.10 Finally, it should be noted that Applicants and Staff alike do not rely on the sufficiency or completeness of CRBRP Design Criteria, the requirements set forth in the May 6, 1976, letter from Denise to Caffey, or any known set of criteria from any 10 The ACRS went on to conclude that the CRBR site would be suitable for a plant that would present no greater risk to the health and safety of the public than an LWR; however, no opinion was offered as to whether the CRBR meets this condition.

i

V

'i variety of sources as the basis for their own conclusions that a CDA can be excluded from the DBA. In fact, no such complete set

l of criteria is known to exist. ,

In sum, none of the four approaches considered above provides the necessary evidence to insure the CDA can be excluded from the DBA.

i As noted above, Staff's case for excluding the CDA from the l DBA is essentially the Case 3 above. Applicants' case is nothing more than a combination of aspects of Cases 1, 3, and 4. I will review it below.

Applicants' Case Applicants' judgment that the likelihood of a CDA is so low

]

that it can be excluded from the design basis is based on

! Applicants' understanding of their general approach to design . (as described in PSAR 15.1.1), along with an understanding of conditions under which an HCDA can potentially be initiated, and an understanding of the plant features (as reflected in CRBRP-3, Vol. 1, Chapter 3) that are provided to " preclude" occurrence of

}

[ CDAs, i.e., render to them a probability that is sufficiently low (Clare deposition, June 16, 1982, pp. 10-11, 35-37).

Applicants have made it clear 11 that they:

(1) do not rely upon the reliability program at all; i (2) do not know the probability of failure of the reactor' l shutdown systems or any of the general design features; I

l 11 These assertions were all made in response to questions by NRDC at a deposition of Applicants' witnesses on June 16, 1982.

s  ;' -

t/

9 . 1 i

g -

(3) do not rely upon tests of their shutdown or heat removal systems as a basis for tpeir conclusion that CDAs are not DBAs; *

\

(4) have not quantified the controlling reliability thresh 61d criterion for excluding the CDA from the DBA; (5) do not factor probabilistic risk assessments into'their judgment that HCDA initiators are within or outside the design

~

basis; i

(6) have not Used'any analysis or evaluation of designs of plants other than CRBR in reaching conclusions regarding whether the CDA' is within or outside the design basis; (7) do not rely on the sufficiency or completeness of CRBRP-Design Criteria, the requirements set fprth in the May 6, 1976, l

letter from Denise to Caffey, or any known. set of criteria from a No such complete set of criterla is known to variety of sources.  !

exist; -

(8) do not rely on any analysis of the HCDA once initiated.

Returning now to the gen'e'ral design approach which ,

Applicants do rely on, Applicants claim this is set forth in Chapter 15.1.1 of the PSAR. Ch' apter 15.1.1 sets forth in the most general terms a safety approach that is nothing more than the familiar " defense-in-depth" approach characterized by "three levels of design emphasis" (PSAR, p. 15.1-1), namely attention to accident prevention, mitigation, and containment:

The first level focuses on the reliability of operation and prevention of accidents through the .

intrinsic features of the design construction, and operation of the plant, incl'1 ding quality assurance, redundancy, testability,.maintainabilty, and failsafe features of the components and systems of the entire plant.

Us l-I l

The second level focuses on the protection against " Anticipated Faults" and "Unlikely Faults" which might occur despite the care taken in design, construction, and operation of the plant set forth in level one above. This protection will ensure that the plant is placed in a safe condition following one of these faults.

l The third level focuses primarily on the determination of events to be classified as

" Extremely Unlikely Faults" and their inclusion in the design basis. These faults are of low

probability and no such events are expected to occur during the plant lifetime. Even though they represent extremely unlikely cases of failures, they will be analyzed to establish conservative design bases. In addition to these three levels of design, the CRBRP has included structural and thermal margins for accidents which are beyond the design base (see Section 15.1).

PSAR, pp. 15.1-1,-2.

Chapter 15.1.2 of the PSAR (which Applicants purport not to rely upon) sets forth the Applicants' proposed definitions of l " anticipated faults," "unlikely faults," and " extremely unlikely l

faults" and the Applicants' proposed acceptance criteria for each of these categories (PSAR, p.15.1-53)

Nowhere in the PSAR is there a demonstration that this design philosophy (PSAR 15.1.1), alone or in combination with the l

l event classification (PSAR 15.1.2) ensures that it is feasible to design a reactor of the general size and type as CRBR to make CDAs sufficiently improbable that they can therfore be excluded from the design basis envelope. Instead, what is presented here is simply a bald classification scheme with no justification for the selection of the design basis events.

One can readily see that the design philosophy itself does not logically dictate where the design basis line is drawn and does not provide the assurance that it is feasible to exclude the CDA from the DBA:

p .

l*

!O o

j 1 i

(1) The same three-level design philosophy was also applied i by DOE (ERDA and AEC) to the FFTF and to the CRBRP parallel design, both of which included the CDA within the design basis.

For FFTF, the design philosophy was as follows:

The first level of safety is the fundamentally safe reactor design to minimize the frequency of off-normal events. Accepted and conservative desigin practices assure adequate safety margins for all major systems and components, from the fuel pins to

, the reactor containment. Testing and inspection assure that all key systems are functional and  ;

i operational. Extensive monitoring systems provide ,

operator alarm for off-normal conditions. . i

! The second level of safety assumes reactor shutdown '

for any off-normal event threatening the reactor.

Two independent shutdown systems are each capable of effecting reactor scram on multiple signals covering the spectrum of possible malfunctions.

1 Each possible malfunction is protected by  ;

independent trip signals on the two shutdown i systems.  !

The third level of safety assures protection of the  !

public even for extremely unlikely conditions and f postulated failures of levels 1 and 2. Containment i i of radioactivity is provided by three successive l barriers: the fuel pin cladding, the primary  ;

reactor system, and the reactor containment [

L system. While certain off-normal conditions are  ;

expected in the lifetime of the reactor, such as  !

random failures of a few fuel pins, no identified i reactor malfunctions protected by the Plant Protection Systemm (PPS) result in breach of the- ,

l fuel pin cladding due to the imposed transient. l Only for complete failure of the shutdown systems (

do reactor incidents causing undercooling or r l overpower of the core threaten the cladding r

! integrity. Analyses of the reactor response to a +

' i hypothetical loss of cooling or transient overpower events with failure to scram show that the second i i

barrier to radioactivity release, the primary i system, is expected to remain intact even for these l extreme postulated combinations. Further analysis j assuming an accident that causes leakage out of the i primary reactor system shows that the third [

barrier, the containment building, effectively ,

i t

i.  :

, .---.-,-r--, ,. ,. . . - - . . , , , _ - . _ , . , _ . ,_.._.,_,,,m,. - _ . . _ , _ . - - - - , . , , , _ , . _ . . . . , _ , . - . --_-.,-+r _- . , . . - . , , . .

4 i'

i 4

retains the radioactivity and assures no significant health hazard to the public.12 As in the case of current CRBR safety approach, the third level r of safety for FFTF dealt with the so-called " extremely low probability events" against which the containment margins were i

assessed. Unlike the present CRBR (Reference) design, however, j

the FFTF design basis, i.e., " extremely low probability" events i

. included the HCDA.

! l

' ~

Tne design philosophy and event classification scheme i

. currently being applied to the CRBR (Reference) design was also f

applied to the CRBR Parallel design where " accidents involving  ;

i  !

I loss of in-place coolable geometry were treated as design basis [

l events" (PSAR, Amendment 5, Oct. 1975, p. F1-1). This design [

i

! included "certain parallel design options" which the Applicants l l

! at the time " judged capable of containing the consequences of a l

broad spectrum of highly improbable, conservatively specified and  ;

I i

analyzed core diaruptivs accidents used as Design Basis i

Accidents" (PSAR Amendment 5, Oct. 1975, p. F1-3). Likewise, the I

same proposed Clinch River Breeder Reactor Plant Design Criteria t were applied to both the Parallel and the Reference designs. I In sum, the application of the safety design philosophy (PSAR, Chapter 15.1.1) and the proposed CRBRP Design Criteria do .

not insure the feasibility of excluding the CDA from the DBA. i The fact that one can establish a general classification scheme f

I t

12 FFTF Final Safety Analysis Report, HEDL-TI-75001, vol. 7, p. f A.1-1 and A.1-2. See similar statements in Hanford Engineering l Development Laboratory, " Fast Flux Test Facilty Design Safety i Assessment," HEDL-TME 72-92, July 1972, pp. 1-1, 1-2, 3.1-1.

{

t t

does not insure nor provide confidence that one can properly assign accidents to the respective categories. As history demonstrates, Applicants have used the very same categories and different accidents were assigned. Precisely the same safety philosophy applies whether the CDA is within or outside the DBA envelope. In each case, a judgment has been made; but in neither case does the classification scheme provide assurance that the judgment is correct.

What is necessary is a showing based on empirical or at least analytical evidence -- some defensible test of the hypothesis that the probability of a CDA can be made suf ficiently low to justify its exclusion from the DBA.

This brings me to the heart of Applicants' case, namely the claim that it has systematically identified all CDA initiators and taken steps to protect against them.

Two questions must be addressed:

• First, can one have confidence that all important classes of initiators have been identified; and

• Second, is identification and protection of initiators a sufficient condition to insure the probability of a CDA is sufficiently low?

Both these questions must be answered af firmatively in order to exclude the CDA from the DBA.

With regard to the first question, it cannot be answered wtihout (a) a detailed analysis of the specific design, which is beyond the reach of the LWA-1 stage (Case 1, above), and (b) a PRA or reliability program analysis of event trees, fault trees,

P failure mode and effects analyses, and common mode failure analyses, all beyond the scope of the LWA-1 proceeding. With regard to (a) the Staff admits that it does not have a basis for l .

judging the completeness of the initiators, as evidenced by the following exchange from the ACRS meeting of June 24, 1982:  ;

MR. KERR: Does there now exist a description of  !

those postulated design basis accidents?

MR. STARK: They appear in the PSAR in Chapter 15, which we are reviewing to make sure they are I complete. Part of our review is looking at

( accident initiators and we are not saying right now  !

that that is a complete list. That is part of our  !

review to assure it is a complete list.

MR. KERR: How will you judge completeness finally?

MR. STARK: Whenever we feel confident, we will describe it in the SER and defend it before you. ,

Transcript, June 24, 1982, Meeting of the ACRS Subcommittee on

~

i i CRBR.

l l

I With respect to (b) above, Staff's position regarding some of the potential CDA initiators identified by Applicants, e.g.,

l double-ended pipe break, is not final (1982 SSR, p. II-9). Even i

l Applicants concede:

It is impossible ... to confidently list all the '

important initiators before the event tree and fault tree analyses have been performed.

i CRBRP Project, PRA Program Plan, June 18, 1982, p. 3 (emphasis r l '

added). A " preliminary list" of initiating events will be j developed as part of the Applicants' PRA. A previous list was j P

^

, assembled in CRBRP-1. [

Both CRBRP-1 and any fault tree / event tree analyses were the l subject of Intervenors' Contention 1(b) and 3(a), which have been ruled beyond the scope of the LWA-1 proceeding. j

3' With regard to the second question, it should be apparent from the preceding portions of this testimony that the mere identification of initiators and systems intended to protect against them does not preclude CDAs. Even if initiators were exhaustively identified, I have demonstrated above that all-protective systems have some failure rate and determination of that failure rate is crucial to the question of whether a CDA is incredible.

In addition, one must consider the ef fect of human and design errors and other common mode and multiple failures. An af firmative answer to the second questions (whether identification of and protection against initiators is a sufficient condition to insure sufficiently low CDA probability) requires a showing that multiple and common mode failures cannot significantly affect the probability of a CDA. This, in turn, cannot be done without a detailed design-specific analysis.

Multiple failures, whether common mode or otherwise, should be expected as real possibilities -- one of the lessons learned l from TMI-2. Consequently, it is essential, for any safety evaluation designed to determine whether a CDA can be excluded from the DBA, to treat event sequences (fault trees) as well.as L initiating events.

l Again, these areas of analysis are part of the Applicants' l

Reliability Program and are outside the scope of the LWA-1 proceeding. It is instructive in this regard to review the Applicants' own description of their Reliability Program. The relationship of the Reliability Program to the overall safe y and

~

o D

licensing approach was described as follows:

As stated in the PSAR, the basis for the CRBRP application is to provide a plant which meets all applicable Federal Regulations including those specified in 10 CFR 100. The application follows the conventional course for licensing of a nuclear power plant. Due to the lack of precedents for LMFBR plants, the CRBRP design approach utilizos reliability techniques extensively to provide a systematic determination of events to be included in the plant design basis.

The overall design of the CRBRP is based on the natural three levels of design which Regulatory uses to evaluate the adequacy of proposed nuclear power plants.

A systematic approach using reliability methodology is then employed to select the limiting design basis. The remaining accidents with potential to exceed 10 CFR 100 guidelines are either in the design basis envelope of the plant or excluded from it depending on the probability of the event which initiates the accident.

The reliability program is an integral part of the overall Safety & Licensing approach and is used to assure and confirm the low probability of specific initiators not covered by precedent or Regulations and thereby allow exclusion of these initiators from the design base.

I ci . , p. 6 (emphasis added).

These descriptions of the Reliability Program not only provide support for my testimony that CRBR design-specific testing and reliability analysis are

, necessary to establish the design basis for the CRBR (i.e., to l

exclude CDAs from the design basis) but indicate that Applicants l

clearly conceded as much. Now Applicants contend that they established the CRBR design basis without use of the reliability program and the adequacy of that program. This is plainly inconsistent with Applicants' earlier assertions. This issue is the subject of NRDC Contention 1(b), which has been ruled outside the scope of the LWA hearing.

Nuclear engineers all too often have tried to hide the absence of empirical evidence or confirmatory analysis by clothing their arguments in vague or meaningless generalities such as " reliance on engineering judgment." This should not be allowed. The task at hand demands more and was perhaps best i

, stated by the Safety Analysis Group at Los Alamos National Laboratory in addressing a technical concern associated with licensing the CRBR:

Because there is [ sic] relatively large uncertainties of various origins (initial condition, data interpretation, data limitation, theoretical inadequacies) in the assessment of severe accidents and because of basic nonlinear physical tendencies, the manifestations of these imperfections in our knoweldge and capabilities

, become critically important. Also, the treatment of multiple uncertainties is important. Any cavalier approach justified by the hypoth Te Ical (often equated with impossible) status of these accidents can degenerate quickly to judgements

(perhaps hunches or guesses) instead of facts or j quantified uncertainties. The result can be a strong erosion of credibility and accident assessments that are little more than exploratory rather than definitive. A clean quantitative approach must be utilized to characterize accident tendencies given the real ranges of uncertainties. If these tendencies are divergent

! (large, variable ranges of energetics extending above SMBDB)[ Structural Margins Beyond Design Base], difficult decisions will be required (more relianceonlowjnitiationprobabilities, design changes, etc.).

f I submit that no such case has been presented that justifies i exclusion of the CDA from the envelope of the DBA for the CRBR.

f 13 Reactor and Structural Systems Analysis for CRBR Licensing, Final Report for Task 1, " Review of the Status of CRBR Licensing Technical Issues," and Task 2, " Develop a Plan for the Resolution

. of Applicable CRBR Licensing Issues," submitted to NRC Staff by l Los Alamos National Laboratory, Jan. 1982, p. IV-2.

Conclusion As a matter of science, or even simple logic, demonstration of the Applicants' case requires establishment of criteria and testing of these criteria with empirical or analytical evidence. Such an analytical test was proposed by the Applicants in 1976. The selection of the design basis events and test of Applicants' assertion that the CDA was incredible were in fact the purpose of the Applicants' Reliability Program.14 No alternative analytical test of the Applicants' hypothesis that the CDA can be excluded from the DBA has been provided.

Nor does retreating from the level of specifics to the level of generalities enhance Applicants' and Staff's case. That is, focussing on "a reactor of the general size and type" instead of CRBR itself and asking whether it is " feasible" to make CDAs incredible rather than whether it has been done do not in this case offer Applicants and Staff a safe haven. If a finding of

" feasibility" is to be based on anything more than faith and hope, it too must be anchored in past experience supplemented by analytically rigorous prediction.

David Okrent, a prominent member of the technical community and an ACRS member for many years, pinpointed precisely the gaping hole in this case:

MR. CHECK: If we proceed down this path of minimum finding, we are going to be leaning toward the finding of feasibility.

14 Clinch River Breeder Reactor Project, Reliabilty Program, January 1976.

MR. OKRENT: I think that is an inappropriate path if that is really the one you are planning to take for a variety of reasons, many of which have been said before, even at the Supreme Court.

You have to have in mind, it seem to me, a l

reactor that resembles the one that the Applicant has in mind or it is just not ... meaningful."

l Transcript, Meeting of the ACRS Subcommittee on CRBR, March 31, 1982, p. 123-124, emphasis added.

Lacking the precedent of even one substantially similar fast reactor during the licensing of which it was demonstrated that the probability of a CDA is "sufficiently low," the Applicants and Staff make a circular argument: we will require CDAs te be of low probability, hence they will be. But the physical world does not respond to such fiat. Although NRC " required" the TMI-2 core not to be severely damaged, it was severely damaged nonetheless. And although the AEC, in the same sense, " required" that no more than one subassembly melt in the FERMI-I core, at least two subassemblies defied that requirement. The list could be continued, but the point should be apparent. CDAs cannot be considered incredible for the CRBR, or for a reactor of the general size and type.

.h ~

,/

6 BEFORE THE UNITED STATES NUCLEAR REGULATORY COMMISSION ATOMIC SAFETY AND LICENSING BOARD

)

In the Matter of )

)

UNITED STATES DEPARTMENT OF ENERGY )

PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537 TENNESSEE VALLEY AUTHORITY )

)

(Clinch River Breeder Reactor Plant) )

)

AFFIDAVIT OF DR. THOMAS B. COCHRAN City of Washington )

) ss:

District of Columbia )

I, Dr. Thomas-B. Cochran, being duly sworn, depose and say that the foregoing testimony is true and correct to the best of my knowledge and belief.

Dr. Thomas B. Cochran Subscribed and sworn to before me this 16th day of August 1982.

/

/ Notary P6blic

,5 e

Octobsr 1, 1981 RESUME Thomas B. Cochran, Ph.D.

Business Address:

Natural Resources Defense Council, Inc.

1725 I Street, NW, Suite 600 Washington, D.C. 20006 (202)223-8210 Home Address:

4836 North 30th Street Arlington, VA 22207 (703)532-1044 EMPLOYMENT HISTORY April 1973-present: Natural Resources Defense Council, Inc.

Senior Staff Scientist, focusing on national energy R&D policy, principally nuclear energy issues, the breeder reactor, plutonium recycle, nuclear weapons proliferation, safeguards, and radiation exposure standards. Consultant to the U.S.

Department of Energy (DOE) on nuclear nonproliferation and nuclear R&D strategy; consultant to the Comptroller General on (a) U.S. and international controls over the peaceful uses of nuclear energy, (b) Advanced Nuclear Technologies, and (c) U.S.

Liquid Metal Fast Breeder Reactor Program; consultant to the Office of Technology Assessment (OTA); Member of DOE's Energy Research Advisory Board, DOE's Nonproliferation Advisory Panel, OTA's Advisory Panel on Nuclear Proliferation and Safeguards, the Nuclear Task Group of OTA's Analyses of the ERDA Plan and Prcgram, and OTA's Gas Curtailment Study Review Panel. Consultant te Governor of Lower Saxony, West Germany, to serve as an Inter-national Expert in the Review of the Gorleben Nuclear Fuel Cycle Center. Served as a member of ERDA's LMFBR Review Steering  ;

Committee, the National Academy of Sciences' Panel on Strategy for Developing Nuclear Merchant Ships, the Task Force on Energy Conversion Research and Development of the Federal Power Survey, the United Nations' Environment Programme's International Panel of Experts on Energy and the Environment, the National Council of Churches' Energy Study Panel and the World Council of Churches Consultation on Ecumenical Concerns in Relation to Nuclear Energy. Also served at a consultant to Resources for the Future and numerous environmental organizations. Testified before Congress and federal agency hearings on numerous occasions, including testimony before the Joint Committee on Atomic Energy, the House Committee on Interior and Insular Affairs, the Joint Economic Committee, the House Committee on Small Business, and the Nuclear Regulatory Commission's Advisory Committee on Reactor Safeguards.

t i

i

5 , -

l

+ Thomns B. Cochran Page Two June 1971-April 1973: Resources for the Future, Inc.

Washington, D.C.

Senior Research Associate, Quality of the Environment Program.

Studying environmental effects of the U.S. civilian nuclear power industry, residuals management in the nuclear fuel cycle, liquid metal fast breeder reactor program, national energy policy, and radiation standards. Wrote a book, The Licuid Metal Fast Breeder Reactor: An Environmental and Economic Critique.

1969-1981: Litton Mellonics Division, Scientific Support Laboratory Fort Ord. California Modeling and Simulation Group Supervisor. Supervised the activities of 10 operation research analysts engaged in military research pertinent to the evaluation of proposed U.S. Army concepts and material by U.S. Army CDCEC.

1967-1969: U.S. Naval Postgraduate School Monterey, California Lt-USNR, Active Duty; Assistant Professor of Physics; Radiation Safety Committee; part-time research involving computer studies of synchrotron radiation production in beam transport systems at Stanfard Linear Accelerator, Stanford, California.

EDUCATION Summer 1969: University of Colorado, Boulder. Postdoctorate.

Summer Institute of Theoretical Physics.

1965-1967: Vanderbilt University, Nashville, TN. Doctorate.

Major: Physics. Minor: Mathematics. Research in high energy (bubble chamber) physics. NASA Fellowship. Guest Research Associate in Physics Department at Brookhaven National Laboratory, Upton, NY, studying synchrotron radiation shielding problems.

1962-1965: Vanderbilt University. MS degree in Physics.

Research in radiation chemistry; AEC Health Physics Fellow; applied health physics training, Oak Ridge National Laboratory; Vanderbilt University Campus Radiation Safety Officer.

1958-1962: Vanderbilt University. BE degree in Electrical Engineering, cum laude. NROTC.

PROFESSIONAL AFFILIATIONS American Physical Society Health Physics Society Maerican Nuclear Society Sigma Xi PERSONAL Age: 40. Birth date: 18 November 1940. Birth place: Wash. DC.

Wife: Carol J. Cochran. Two children.

-l ' "

00cKETE0 d -

OstiRC in ga 16 P5 57 BEFORE THE UNITED STATES NUCLEAR REGULATORY COMMISSION - - .

ATOMIC SAFETY AND LICENSING BOARD -

)

In the Matter of )

)

U.S. DEPARTMENT OF ENERGY ) Docket No. 50-537 PROJECT MANAGEMENT CORPORATION )

TENNESSEE VALLEY AUTHORITY )

)

(Clinch River Breeder Reactor )

)

TESTIMONY OF THOMAS B. COCHRAN Part II Introduction I will now discuss Intervenors' Contentions 2 and 3(c),

which both relate to the site suitability analysis under 10 CFR 100. Contention 2 is as follows:

The analyses of CDAs and their consequences by Applicants and Staf f are inadequate for purposes of licensing the CRBR, performing the NEPA cost / benefit analysis, or demonstrating that the radiological source term for CRBRP would result in potential hazards not exceeded by those from any accident considered credible, as required by 10 CFR 5100.ll(a) , fn. 1.

(a) The radiological source term analysis used in CRBRP site suitability should be derived through a mechanistic analysis. Neither Applicants nor Staff have based the radiological source term on such an analysis.

e 6, !

(b) The radiological source term analysis should be based on the assumption that CDAs (failure to scram with substantial core disruption) are credible accidents within the DBA envelope, should placa an upper bound on the explosive potential of a CDA, and should then derive a conservative estimate of the fission product release from such an accident. Neither Applicants nor Staff have performed such an analysis.

(c) The radiological source term analysis has not adequately considered either the release of fission products and core materials, e.g.

halogens, iodine and plutonium, or the environmental conditions in the reactor containment building created by the release of substantial quantities of sodium.

Neither Applicants nor Staff have established the maximum credible sodium release following a CDA or included the environmental conditions caused by such a sodium release as part of the radiological source term pathway analysis.

(d) Neither Applicants nor Staf f have demonstrated that the design of the containment is adequate to reduce calculated offsite doses to an acceptable level.

(e) As set forth in Contention ll(d), neither Applicants nor Staff have adequately calculated the guideline values for radiation doses from postulated CRBRP releases.

[ Contention ll(d) states:

[ Guideline values for permissible organ doses used by Applicants and Staff have not been shown to have a valid basis.

[(1) The approach utilized by Applicants and Staff in establishing 10 CFR S 100.11 organ dose equivalent limits corresponding to a whole body dose of 25 rems is inappropriate because it fails to consider important organs, e.g. the liver, and because it fails to consider new knowledge, e.g.,

recommendations of the ICRP in Reports 26 and 30.

4

^

s*t

[(2) Neither Applicants nor Staff have given adequate consideration to the plutonium

" hot particle" hypothesis advanced by Arthur R. Tamplin and Thomas B.

Cochran, or to the Karl Z. Morgan hypothesis described in " Suggested Reduction of Permissible Exposure to Plutonium and Other Transuranium Elements," Journal of American Industrial Hygiene ( August 1975) .]

(f) Applicants have not-established that the computer models (including computer codes) referenced in Applicants' CDA safety analysis reports, including the PSAR, and referenced in the Staff CDA safety analyses are valid. The models and computer codes used in the PSAR and the Staff safety analyses of CDAs and their consequences have not been acequately documented, verified or validated by comparison with applicable experimental data. Applicants' and Staff's safety analyses do not establish that the models accurately represent the physical phenomena and principles which control the response of CRBR to CDAs.

(g) Neither Applicants nor Staff have established that the input data and assumptions for the computer models and codes are adequately documented or verified.

(h) Since neither Applicants nor Staff have established that the models, computer codes, input data and assumptions are adequately documented, verified and validated, they have also been unable to establish the energetics of a CDA and thus have also not established the adequacy of the containment of the source term for post accident radiologica] analysis.

Contention 3 (c) , which relates to Contention 2 (c) , is as follows:

c) Accidents associated with core meltthrough ,

following loss of core geometry and sodium-concrete interactions have not been adequately analyzed.

r

.S4 These contentions assert the fai. lure of the Applicants and the Staff to comply with the requirements of 10 CFR Part 100, the Commission's Reactor Site Criteria, particularly Section 1

100.11 . We will defer to the second phase of these hearings 1 Section 100.11 states:

As an aid in evaluating a proposed site, an applicant should assume a fission produce releasel/ from the core, the expected demonstrable leak rate from the containment and the meteorological conditions pertinent to his site to derive an exclusion area, a low population zone arid population center distance. For the purpose of this analysis, which shall set forth the basis for the numerical values used, the applicant should determine the following:

(1) An exclusion area of such size that an individual located at any point on its boundary for two hours immediately following onset of the postulated fission product release would not receive a total radiation dose to the whole body in excess of 25 rem 2/

or a total radiation dose in excess of 300 rem 2/ to the thyroid from iodine exposure.

(2) A low population zone of such size that an individual located at any point on its outer boundary who is exposed to the radioactive cloud resulting from the postulated fission product release (during the entire period of its passage) would not receive a total radiation dose to the whole body in excess of 25 rem or a total radiation dose in excess of 300 rem to the ,

thyroid from iodine exposure.

(3) A population center distance of at least one and one-third times the distance from the reactor to the outer boundary of the low population zone. In applying this guide, the boundary of the population center shall be determined upon consideration of population distribution. Political boundaries are not controlling in the application of this guide. Where very large (continued on next page)

e

• b these hearings the question of whether the analysis of CDAs and their consequences are adequate for performing the NEPA cost / benefit analysis, although much of my testimony is relevant to the findings the Board must make under both Part 100 and Part 51.

(footnote 1 continued) i cities are involved, a greater distance may be necessary because of total integrated population dose consideration.

1/ The fission product release assumed for these calculations should be based upon a major accident, hypothesized for purposes of site analysis or postulated from considerations of possible accidental events, that would result in potential hazards not exceeded by those from any accident considered credible. Such accidents have generally been assumed to result in substantial meltdown of the core with subsequent release of appreciable quantities of fission products.

2/ The whole body dose of 25 rem referred to above corresponds numerically to the once in a lifetime accidental or emergency dose for radiation workers which, according to NCRP recommendations may be disregarded in the determination of their radiation exposure status (see NBS Handbook 69 dated June 5, 1959). However, neither its use nor that of the 300 rem value for thyroid exposure as set forth in these site criteria guides are intended to imply that these numbers constitute acceptable limits for emergency doses to the public under accident conditions. Rather, this 25 rem whole body value and the 300 rem thyroid value have been set forth in these guides as reference values, which can be used in the evaluation of reactor sites with respect to potential reactor accidents of exceedingly low

' probability of occurrence, and low risk of public exposure to radiation.

I' In the testimony that follows, I intend to show that: ,

I. The assumed fission product release in the site  !

suitability source term chosen by the Staff is not sufficiently conservative; II. The Staff's proposed source term does not include the pressure and thermal effects associated with core meltthrough, and is therefore nonconservative; III. The Staff has not correctly performed or adequately documented the dose calculations in the source term analysis and has failed to select conservative 10 CFR ,

J i

Part 100 guidelines for internal organs; IV. Neither Applicants nor Staff have established that the models, computer codes, input data and assumptions used to determine the suitatility of the CRBR site are valid.

I. The Assumed Fission Product Release in the Site Suitability Source Term Chosen By the Staff is Not Sufficiently Conservative.

Intervenors' first argument under Contention 2 is that the assumed fission product release in the site suitability source term chosen by the Staff as an aid in evaluating the proposed site is not sufficiently conservative to meet the Commission's r intent and requirements under the 10 CFR Part 100 Reactor Siting Criteria. To understand why this is so, it is helpful [

t to begir: with a discussion of the policy underlying Part 100 r and the meaning of its requirements.  !

A. History of 10 CFR Part 100 The 10 CFR Part 100 Reactor Site Criteria were promulgated in 1962 after extensive public comment by the NRC's predecessor, the Atomic Energy Commission (the "AEC"). 27 Fed.

Reg. 3509 (1962). It can readily be seen that these site suitability requirements were intended to provide a substantial additional layer of conservatism above and beyond that provided by safety features designed to mitigate against design basis accidents. In other words, the AEC decided that, even if the plant were designed to prevent and mitigate against all credible accidents, the possibility for a much more serious, though highly improbable, accident could never be completely discounted, and therefore its consequences must be considered I

when siting the plant. Atomic Energy Commission Reactor Site +

Criteria, Report to the Director of Regulation by the Director, .

I i Licensing and Regulation, AEC-R 2/39, Appendix D at p. 9. As 1

stated in the Notice of Proposed Guides:

l The basic objectives which it is believed can be achieved under the criteria set forth in the proposed guides, are:

! a) Serious injury to individuals offsite should be avoided if an unlikely, but still credible, accident should occur, b; Even if a mofe serious accident (not normally considered credible) should occur, the number of people killed should not be catastrophic.

i

26 Fed. Reg. 1224 (Feb. 11, 1961).2 The regulations state that the major accident from which the source term should be calculated has " generally been assumed to result in substantial meltdown of the core with subsequent release of appreciable quantities of fission products." 10 CFR S100.11(a), n. 1.

The site suitability source term for light water reactors, which was developed after many years of licensing and operating experience, was based upon a step-by-step analysis of a major postulated accident, one with conccquences far exceeding those of any LWR design basis accident. The source term was derived using highly conservative assumptions, and is based upon a series of highly unlikely events occurring in sequence. First, the analysis postulated that the coolant piping ruptures completely from high internal pressures due to uncontrolled internal heat generation, which in turn could only occur if:

(1) Reactivity control mechanisms fail to function, (2) High pressure relief systems fail to perform, and (3) Pressures exceed rupture limits of the piping material.

Furthermore, in order to postulate that this complete shear of ,

a coolant pipe, itself an extremely unlikely event, would r

result in fuel melting, the analysis also assumes that:

1 2 These objectives were eliminated from the final rulemaking notice, "since it is believed that they have already served their purpose and need no reiteration in any subsequent ,

publication in the Register." AEC-R 2/39, supra p. 7, at Appendix B, p. 7.

(1) Decay heat is sufficient to increase fuel temperature to the melting point; and (2) Safeguards systems provided to flood or spray the core with water are either inoperative or insufficient to keep fuel temperatures from rising.

Atomic Energy Commission Reactor Site Criteria, Report to the General Manager by the Director, Division of Licensing and Regulation, AEC-R 2/19, Appendix B at 21-22. This accident is not just incrementally larger than the limiting design basis accident for light water reactors; it is orders of magnitude larger. This difference reflects the substantial conservatism utilized in the site suitability analysis to provide a second level of defense.3 when combined with the 3 Additional conservatisms were built in to determine the extent of the fission product release from this accident, and the amount released to the environment:

l (1) It is assumed that the reactor is a pressurized water type for which the maximum credible accident will release into the reactor building 100 percent of the noble gases, 50 percent of the halogens and 1

percent of the solids in the fission product l inventory. Such a release represents l

approximately 15 percent of the gross fission product activity.

(2) Fifty percent of the iodines in the containment vessel is assumed to remain available for release to the atmosphere.

The remaining fifty percent of the iodines is assumed to absorb onto internal surfaces of the reactor building or adhere to internal components. Rather than the assumed reduction factor of two, it is estimated that removal of airborne iodines by various physical phenomena such as adsorption, adherence and settling could (continued on next page)

F 4

conservatisms applied to calculations of the extent of the fission product release to the environment and off-site doses, the Commission concluded that "the net effect of the ,

assumptions and approximations is believed to give more conservative results (greater distances) than would be the case if more accurate calculations could be made." AEC-R 2/39, supra p. 7, Appendix D at 13.

While the Commission believed this approach to be i

appropriate for LWRs as " represent [ing] the same very conservative approach to site selection that has characterized (footnote 3 continued) give an effect of 3-10 reduction in the final result. Credit has not been taken for the effects of washdown or filtering from protective safeguards such as cooling sprays '

and internal air recirculating systems.

Washdown features and filtering networks could provide additional reduction factors of 10-1000.

(3) The release of available (airborne) r radioactivity from the resctor building to the environment is assumed to occur at a constant leakage rate of 0.1 per cent per day. The leakage and pressure conditions are assumed to persist throughout the effective course of the accident, which for practical purposes, would be until the iodine activity becomes insignificant. The '

maximum pressure within the reactor building and the leakage rate would actually decrease '

with time as the steam condenses from '

contact with cooling surfaces. By assuming no change in leak rate as a function of pressure drop, it is estimated that the final off-site doses calculated may be too high by factors of 5-10.

i AEC-R 2/39, supra p. 7, Appendix D at 14-15 . ,

i i

such evaluations in the past," id., it'explictly recognized

'that even more conservatism is required in siting reactor types with no previous licensing experience:

The site criteria contained in this part apply primarily to reactors of a general type and design on which experience has been developed, but can also be applied to other reactor types. In particular, for reactors that are novel in design and unproven as prototypes or pilot plants, it is expected that these basic criteria will be applied in a manner that takes into account the lack of experience. In the application of these  ;

criteria which"are del ~iberat ly flexible, the safeguards provided--either site isolation or engineered features--should reflect the lack of certainty that only experience can provide.

10 CFR S100.2(b) (emphasis added) .

In any site suitability analysis, the Commission envisioned that an applicant could trade off the use of engineered safeguards for site isolation only when the-safeguards were

! " extensive and well proven," Atomic Energy Commission, Reactor Site Criteria - Draft Regulations Submitted to ACRS, AEC-R l

l 2/22, Dec. 10, 1960, at 2, based on operating experience from plants already licensed. AEC-R 2/39, supra p. 7, Appendix B at  ;

7. The agency believed such licensing experience was essential "to provide a more definitive basis for weighing the effectiveness of engineered safeguards versus plant isolation ,

as a public safeguard." Id. The Advisory Committee on Reactor Safeguards (the "ACRS") firmly believed that novel or unproven i

reactor types, which necessarily lacked previous licensing 6 i

7 i

experience, " belong at isolated sites -- the degree of isolation required depending on the amount of experience which exists." AEC-R 2/39, supra p. 7, Appendix C-2 at 2.

B. The Assumed CRBR Site Suitability Fission Product Release Is Insufficiently Conservative Whether or Not Core Dicruptive Accidents are Considered Credible Accidents Within the Design Basis ,

The assumed fission product release, or source term, chosen by the Staff for the CRBR site suitability analysis is set forth in the 1982 SSR at III-ll. The Staff claims that the source term is non-mechanistic,.and is directly analogous to the LWR source term, modified only to include the release of 1%

of the plutonium fuel from the core, (a value that is identical to and derived from the percentage of nonvolatile fission products in the LWR source term) . 198 2 SSR at II II-9.

The Staff also claims that the source term is based on a CDA in which ten percent of the core is vaporized, and ten percent of that vapor escapes from the vessel head into the containment, resulting in a total plutonium release of one percent.

Transcript of Advisory Committee on Reactor Safeguards CRBR Subcommittee Meeting, June 24, 1982 at pp. 165, 169-70.

The Staff's proposed source term is insufficiently conservative, regardless of its derivation, and whether or not core disruptive accidents are considered to be credible l

t

accidents within the design basis of the CRBR. If, as I firmly believe, CDAs are credible accidents, then the Staff's source term clearly does not bound the consequences of a major CDA.

This is evident from the fact that when the Staff derived a site suitability source term for Applicants' Parallel Design, in which a CDA is considered a credible accident within the design basis, the assumed fission product release included ten percent of the plutonium fuel:

Proposed Staff Source Term for Parallel Design Noble Gas (%) 100 Halogens (%) 100 Volatiles (%) 100.

Solid F. P. (%) 10 Fuel (Inc.Pu) (%) 10 Sodium (1b) 1000 (Spray) l Letter dated Feb. 2, 1976, from Van Nort to Boyd, " Clinch River Breeder Reactor Plant Project - Project Office Summary of January 22, 1976 Meeting on Site Suitability Source Term," at 5.

Even larger site suitability source terms have been used in the past to bound core disruptive accidents in other reactors.

For example, in EBR-II, the source term assumed that 50% of the fission product activity contained in the. reactor (and 50% of the Pu-239) is released to the atmosphere from the hypothesized reactor disaster. Argonne National Laboratory, Hazard Summary Report, Experimental Breeder Reactor II ( EB R-II) , May , 19 57, a t Appendix F, p. 343. And in SEFOR it was assumed that, as a result of a core disruptive design basis accident, the entire core is volatized with 100% of the available fission products and 100% of the plutonium released into the inner containment space. Safety Evaluation By the Division of Reactor Licensing, U.S. Atomic Energy Commission, In the Matter of Southwest Experimental Fast Oxide Reactor, Nov. 18, 1968, at 27.4 The Staff has not done the necessary analysis to determine whether the currently proposed source term would sufficiently bound all credible CDAs, let alone perform the necessary mecharastic analysis with built-in conservatisms at every l

step. The Staff admits that its assumption that ten percent of the plutonium from the core is vaporized is based upon no l

l 4 The site suitability source term for the FFTF, which was constructed by the Applicant, Department of Energy, contained the same fuel fraction release as that proposed for the CRBR; l

i.e., one percent plutonium. Yet since this facility was never l

licensed by the NRC, there was no mechanism by which Intervenors or others could challenge the validity of this l

source term, and consequently one should not attach undue

! weight to its estimates.

l

estimation of how many fuel assemblies would fail,5 and does not consider the specific component designs proposed by the applicants.6 The Staff has supplied no analyses of the potential consequences of various core disruptive accidents, and in fact considers such analyses to be beyond the scope of this proceeding. Letter from Daniel T. Swanson to Administrative Judges dated April 16, 1982 at 2. In fact, the Staf f admits that it would have to redo its analysis of the source term if CDAs were considered credible, since the Staff has no idea whatsoever if its assumptions would remain conservative:

Mr. Cochran: Then the conservatism with regard to the source term is dependent on a conclusion that CDAs are not credible events?

Mr. Morris: Yes. However, it is not beyond the possibility that if CDAs were considered credible, that the source term could still be found to be conservative.

Mr. Cochran: You don't know about it because you have not done the analysis?

Mr. Morris: That is right.

5 Transcript of Deposition by Intervenors of William Morris, Richard Stark, Wayne Houston, and Paul Leech, May 6, 1982

[ hereinafter Deposition of NRC Staff], at p. 178 (statement of Mr. Hulman) .

6 Id., at pp. 42-43 (statement of William Morris) .

Mr. Cochran: Setting aside how it was derived, is the source term conservative when compared to the maximum theoretical work energy that might be produced in a CDA at the CRBR?

l Mr. Houston: I don't know whether anyone has ever made that comparison.

Mr. Cochran: Would it be conservative with respect to the probable energy release of a CDA in the CRBR?

Mr. Houston: I don't know.

Deposition of NRC Staf f at pp. 152, 178.

Nor have the Applicants performed the necessary analysis of whether the Staff's source term is sufficiently bounding if CDAs were considered credible:

Mr. Cochran: Has the project considered what the consequences would be to the design and siting of the Clinch River Breeder Reactor if the CDA were within the design basis accident spectrum?

Witness Clare: I am not aware of any analysis that is, that comprehensively sonsiders a hypothetical core disruptive accident as the design basis in terms of its overall impact on the design and the siting.

i Mr. Cochran: You are the project's expert in this area, are you not?

Witness Clare: I am an expert in this area.

Mr. Cochran: Are any of you aware whether the project has considered what the consequences would be to the design and siting of the Clinch River Breeder Reactor if the CDA were within the design basis accident spectrum?

Witness Brown: I think that in the context, in a limited context the parallel design represented a project consideration, but I don't -- it was not the total implication. It wasn' t a separate study that focused just on that total aspect of it, but it was a consideration of some of the implications of what taking an HCDA as a design basis accident --

. . . . I Mr. Cochran: And is it also correct that there is a spectrum of CDAs for which that design and those design parameters or site suitability source term analysis parameters would not be correct?

Witness Clare: One can hypothesize HCDAs in the CRBRP where these leak rates would not apply.

Mr. Cochran: In general, wouldn't those type of CDAs be associated with large sodium releases, for example, to the reactor cavity?

Witness Clare: Some of those scenarios would include that, yes.

Mr. Cochran: If the CDA were a design basis accident, is it possible that that source term would have to be revised?

Witness Clare: You are postulating a different situation than that, which leads us to our current design in the hypothetical sense that you are raising. Where the design basis accidents change, one would have to reconsider the design of the plant and the site suitability source term.

Transcript of Deposition by Intervenors of George H. Clare, Neil W. Brown, and L. Walter Deitrich, June 16, 1982, at pp.

143-144, 150, 152-153.

According to the statements of the Staff and the Applicants, therefore, if it is proven than CDAs are credible

accidents that should be within the CRBR design basis, then both the Staff and the Applicants will have to redo their source term analysis, something neither has yet done, to determine whether and how the source term should be revised.

Evidence from the treatment of other reactors, and from the Staff's own preliminary analysis of the Parallel design, indicates that the assumed plutonium release from the core would have to be increased by at least a f actor of 10.7 Even if this Board finds that core disruptive accidents are incredible and outside the design basis accident envelope, I believe that the Staff's proposed source term is still inadequately conservative for several reasons. First, as stated above, the Staf f may not treat this first-of-a-kind reactor as it would a tested, proven light water reactor design. 10 CFR S100. 2 (b) . Instead, it must apply additional conservatisms to take into account the utter lack of breeder reactor licensing experience. The Staff must factor in these conservatisms either by selecting a more isolated site than it would for a tested design or by requiring extensive and well-proven engineered safeguards. It is not enough for the 7 Even the Applicants admit that treating the CDA as a credible design basis would increase the plutonium release fraction by a factor of 10. See the Applicants' assumed source term for the Reference and Parallel designs in PSAR, 15. A -10 ;

PSAR Amend. 3 Aug. 1975, 15.A-4.

Staf f to extrapolate directly from the LWR source term without substantial additional margins of safety to account for the uncertainties inherent in this novel design. Nor is it enough for the Staff or the Applicants to point to engineered safeguards which have not been proven or previously licensed and, indeed, which will not even be fully scrutinized until a later licensing stage. Unless the Staff increases the source term by some additional margin to take account of the novel, untested nature of the CRBR, it violates both the requirements and the intent of 10 CFR Part 100.

Second, because breeder reactors such as the CRBR have an accident potential far greater than that of any conventional reactor, and because the parties lack all but the most preliminary information on CRBR Safety at this early licensing stage, the source term chosen now must be large enough to bound any accidents which the Staff may later determine to be credible after a full safety review. As the NRC Staff cautioned the Applicants in 1976:

If the intent of the project is to proceed through the licensing process in an expeditious manner, then it is our opinion that the design approach must be of an enveloping nature and sufficiently conservative to account for further design modifications and uncertainties.

Letter, dated April 23, 1976, from Themis P. Speis, Chief of the NRC Liquid Metal Fast Breeder Reactor Branch, to Peter S.

Van Nort, Project Management Corporation General Manager (emphasis added).

The Atomic Energy Commission recognized the need for additional conservatisms in situations like these when

[t]he necessity for site appraisal arises early in the life of a project when many of the detailed features of design which might

• affect the accident potential of a reactor are not settled [;]

and recognized "the inherent difficulty of postulating an accident representing a reasonable upper limit of potential hazard." AEC-R 2/39, supra p. 7, Appendix D a t p. 7. In this case, the greater-than-usual accident potential of the plant and the earlier-than-usual site review mandates that the Staff ensure that its source term is sufficiently conservative to envelope the substantial uncertainties that exist. The Staff took this approach elsewhere in the siting analysis by lowering the organ dose guideline values by a factor of 10 (now 2) during the construction permit and LWA review stages from those values applied during the operating license stage. In applying tnis principle here, the Staff should increase its plutonium release fraction by a factor of at least 10 to account for the substantial possibility that CDAs will be found credible after a full safety review.

The Applicants may argue that, since the extensive work that would be performed under a limited work authorization is l

! at their own risk, neither the Staff nor the Board need be 1

concerned that LWA-1 site evaluatior.s retain their validity at a later licensing stage. Such an approach would render this hearing superfluous and make a mockery of the siting process.

It also ignores the substantial interest of the people living near the proposed site and the public at large, who are financing this project, in ensuring that' money-is not wasted and the land needlessly leveled because of a peremptory decision at this stage that later proves mistaken.Moreover, the claim that Applicants proceed at their "own" risk is substantially undercut by NRC precedent indicating that the f

money and time spent at this site will be accounted against alternative sites.

Finally, I believe that, when compared with the LWR source term, the proposed CRBR source term provides nowhere near the amount of conservatism necessary, even if CDAs are not considered credible or design basis accidents. The proper inquiry is not only whether the source term bounds all design basis accidents, but also the extent to which the accident is bounding. If the Commission intended to require only that the l source term bound all design basis accidents, then the LWR source term would not have been orders of magnitude greater than the largest LWR design basis accident. An approach similar to that used in light water reactors is necessary to i

achieve Part 100's objective of providing against excessive l exposure doses from conceivable though highly improbable r

accidents. 27 Fed. Reg. 3509 (Apr. 1962). As I have indicated in my testimony on Contention 1, the maximum capacity for harm from an LMFBR accident has been estimated to be an order of magnitude greater than that from an LWR. This difference is not reflected in the Staff's choice of the source term, namely the LWR souce term plus 1% of the plutonium.

Various analyses of CDAs have postulated the releases of up to 10 percent of the plutonium from the core. See CRBRP-3, Vol. 2, at p. 4-17 (assumes 5% plutonium release) ; CRBRP-1 at

p. 7-13 (assumes 10% plutonium release from the core to the environment from a highly energetic accident that is postulated to fail the primary coolant boundary and penetrate the outer- 1 containment) . I believe a fuel release fraction of 10%

plutonium, or a factor of two higher to provide an additional safety margin in recognition of the fact that the upper bound of the CRBR explosive potential has not been defined, would be an appropriate source term even if core disruptive accidents are not within the design basis envelope.

II. The Staff's Proposed Source Term Does Not Include the 1 Pressure and Thermal Effects Associated With Core Meltthrough, and is Therefore Nonconservative Intervenors' second challenge to the Staff's proposed CRBR source term is that it does not include the pressure and I

thermal effects associated with core meltthrough, and is therefore nonconservative.8 The reasons why such effects must be considered are as follow:

The Staff's proposed source term is apparently premised on I

the occurrence of a core disruptive accident. See-Transcript of ACRS CRBR Subcommittee Meeting, July 24, 1982, at p. 178.

l In a site suitability analysis one should conservatively assume, as Applicants have done, that all accident sequences leading to a CDA would lead to whole core involvement. See CRBRP-1 a t p. 3-17. One should also conservatively assume that 8 The Staff admitted that it did not consider these effects in its source term analysis:

The source term is postulated to enter containment and then to have no associated effects on the possibility of sodium being the source of sodium fire in containment.

Sodium-concrete interactions causing an overpressurization of containment and all that would have to go along with any mechanistic scenario of a core disruptive accident.

' That is where -- that is where this attempt should take place -- non-mechanistic source term -- and try to relate it to a mechanistic accident really fails. The treatment of the site suitability source term does not assume, for instance, an l overpressurization of containment beyond i design pressure.

Transcript of ACRS CRBR Subcommittee Meeting, July 24, 1982, at

p. 171 (statement of William Morris) . (continued on next page)

4 the molten fuel will penetrate through the bottom of the reactor vessel and guard vessel. Id. at 4-7. Such a core melt event was the basis for the NRC Staf f 's radiological site suitability source term analysis for the FFTF. U.S. Nuclear Regulatory Commission, Safety Evaluation Report related to operation of Fast Flux Test Facility, Department of Energy, Aug. 1978, at pp. 15 15-65.

Once meltthrough of the core vessel and guard vessel occurs, approximately 1000 seconds into the accident (see C.3RP-3, Vol. 2 at p. 3-18), all of the available sodium in the reaccor vessel and primary loops, i.e., approximately 1.1 million pounds, would very likely be dumped into the reactor cavity. See CRBRP-1 at p. 7-7; CRBRP-3, Vol. 2 at p. 3-19. In addition, for an energetic CDA, a small fraction of the sodium in the reactor vessel would be expected to follow the path of the fuel release through the head seals into the secondary containment. The sodium released from the reactor vessel would t be expected to result in sodium fires and interactions with the concrete in the reactor cavity, resulting in overpressurization and high thermal loadings of the secondary containment.

Applicants' predicted progression of a core melt scenario includes these events, and is generally described in CRBRP-3, Vol. 2, at pp. 3 3-26.9 9 Intervenors do not necessarily endorse all the quantitative values set forth in this core melt scenario.

6 Since the Staff's CRBR site suitability source term analysis is based upon a CDA, it cannot simply ignore the pressure and thermal loading implications of such an event. To do so would be to negate whatever conservatisms otherwise exist in the analysis. Indeed, the FFTF site suitability analysis did consider these pressure and thermal loading effects, and included the possible effects of venting. FFTF Safety Evaluation Report, supra at 15 15-65.

The Staff's site suitability source term analysis with regard to the containment evaluation not only ignores the effects of overpressurization and thermal loading in the containment, but also incorrectly models the actual containment that is being proposed. The Staff's source term analysis, unlike that of the FFTF, assumes that radiological releases to the environment, even from the most severe accident, will only occur via annulus filtration and bypass leakage of 0.001% per l

l day. 1982 SSR at p. III-ll. Yet the Applicants have proposed a system whereby, in the case of a CDA, all radioactivity in I

the containment would be released directly to the environment through filtered vents. CRBRP-3, Vol. 2, p. 2-7. And the Staff has elsewhere required that, following an accident, containment integrity need be maintained for only 24 hours2.777778e-4 days <br />0.00667 hours <br />3.968254e-5 weeks <br />9.132e-6 months <br /> before such venting is permitted. Letter dated May 6, 1976 from Richard P. Denise to Lochlin W. Caffey.10 Under this 10 The Applicants' current provisions for venting are still under review by the Staff. 1982 SSR at pp. 11 II-19.

schizophrenic approach the Staff now assesses the suitability of the CRBR site based upon a containment design with no vents, but includes venting to accommodate a core disruptive accident, the very same accident from which the site suitability source term is derived. This approach means that the site suitability analysis is in fact less conservative than the accident analysis for the plant itself. Rather than provide a second level of defense, this site suitability analysis has become little more than a justification for the proposed site.

In summary, I believe my testimony indicates that the Staff's CRBR site suitabiity source term is inadequate because of its insufficiently conservative assumed fuel release fraction and its failure to consider the pressure and thermal effects associated with core meltthrough. Given either one of these inadequacies, and correcting for no other errors, it is obvious that the site is unsuitable for a reactor of the general size and type as the CRBR. But even assuming, for purposes of argument, that the proposed source term is

. appropriate, the site is still demonstrably unsuitable when l

certain other errors in the Staff's analysis are corrected.

l l

l l

l l

l

III. Staff Has Not Correctly Performed or Adequately Documented the Dose Calculations in the Source Term Analysis and Has Failed to Select Conservative 10 CFR Part 100 Guidelines for Internal Organs It is apparent from the 1982 SSR that the Staff has not-correctly performed or adequately documented the dose calculations in the source term analysis and has failed to select conservative 10 CFR Part 100 guidelines for internal organs. Dr. Karl Z. Morgan, in his testimony earlier, outlined a number of errors in Staff's site suitability dose calculations, including:

a) failure to consider the dose "from the entire passage of the cloud;" -

b) failure to use conservative values for the plutonium isotopic concentrations; c) failure to consider all isotopes of interest; d) f ailure to use current dosimetric and metabolic models; j e) failure to consider all pathways; i

f) failure to properly calculate the bone (and bone surface) dose; g) failure to document adequately the dose calculations i assumptions and methodology.

Dr. Morgan also challenges the Staff's proposed 10 CFR Part 100 dose guidelines for lung and bone. Testimony of Dr. Karl Z. Morgan at pp. 8-24.

With regard to inadequacies in Staff's dosimetric and

4 metabolic modeling, and with regard to calculations of the internal organ doses, I fully subscribe to the views of Dr.

Morgan as set forth in his testimony and incorporate his

[

l testimony by reference (pp. 8-20). With regard to 10 CFR 100 guideline values for internal organs, I subscribe to and  ;

i incorporate by reference the views of Dr. Morgan (pp. 21-29) 4 and the conclusions of Dr. John C. Cobb as set forth in their i respective testimony. I also wish to elaborate further my own f 2

views on these matters.

A. The Proposed Dose Guideline Values for Lung and Bone ,

Are Too High l {

~

The Staff has assumed dose guideline values of 75 rem to the lung and 300 rem to the bone surface. 1982 SSR at III-9.

These values are reduced by a factor of 2, for purposes of i review at the construction permit and LWA-1 stages, to values of 35 rem to the lung and 150 rem to tne bone surface. Id. l These values were derived from the stochastic weighting factors  !

in ICRP 26. Id.; see also ICRP 26, para. (105). The first [

problem with these values is that the Staff has misapplied the f i

ICRP 26 methodology by ignoring the additional limits on organ doses of 50 rem /per year to the lung and bone surface, I recommended by ICRP 26 in order to prevent non-stochastic effects. ICRP 26, para. (103) . The U.S. Environmental ,

Protection Agency, in adopting the methodology of ICRP 26, ,

recently proposed a dose commitment limit of 30 rem /per year i

l t _ _ - _ _ _

to these same organs to prevent non-stochastic effects. USEPA, Proposed Federal Radiation Guidance for Occupational Exposure, Background Report, EPA 520/4-81-003, Jan. 1981, at p. 10.

While I will argue below in favor of even lower dose guideline values, at this point I simply wish to note that the 50 rem and 30 rem limits recommended by ICRP and EPA respectively are consistent with the original intent of the 10 CFR 100 Reactor Site Criteria, which was to ensure that "[s]erious injury to individuals offsite should be avoided if an unlikely, but still credible, accident should occur", 26 Fed. Reg. 1224 (Feb. 11, 1961), and the admonition of the ICRP that its recommended limits are necessary to prevent harmful non-stochastic effects. ICRP 26, para. (103) .

It is worth noting that, when the ACRS first proposed site suitability guideline values, it selected 25 rems to the whole body, 300 rems to the thyroid, and 25 rems to the bone and lung. Atomic Energy Commission, ACRS Comments on Site Criteria for Nuclear Reactors, AEC-R 2/23, Dec. 10, 19 60, a t p. 3.11 These proposed bone and lung limits are more compatible with the ICRP and EPA non-stochastic limits than the much higher guideline values proposed by the Staff.

I might also note that, under EPA's environmental radiation protection standards for normal operations of the uranium fuel i

cycle, the following annual dose equivalence limits to members l

11 These bone and lung values were presumably dropped because they were not considered controlling for light water reactor accidents.

of the public are set forth: 25 mrem to the whole body, 75 mrem to the thyroid, and 25 mrem to any other organ, e.g., lung and bone surface. 4 0 CFR S190.10 (a) . Based on these regulations, the lung and bone surface doses equivalent to 25 rem to the whole body would be 25 rem to the lung and bone i surface. Again, these limits are substantially lower than the limits proposed by the Staff, yet more consistent with the lung and bone surface limits recommended by EPA and ICRP 26, and the original proposed ACRS guidelines.

I believe that even smaller dose guideline values f or lung and bone surfaces than those of ICRP and EPA to limit non-stochastic effects are necessary for the following reasons. First, I wholly subscribe to the views of Dr. Morgan that the lung and bone surface guidelines should not exceed the EPA proposed guidance on dose limits for persons exposed to transuranium elements in the general environment; namely, 1 mrad per year to the lung and 3 mrad per year to the bone.

Karl Z. Morgan Testimony at p. 21. Second, I agree with Dr.

Morgan's conclusion that the Staff's proposed dose levels of i

i 150 rem to the bone and 35 rem to the lung "would result in severely serious consequences and are far beyond acceptable i

j ievels." Karl Z. Morgan Testimony at p. 24. Third, as noted previously, I endorse fully the statements of Dr. Morgan and i

Dr. Cobb that the factor of 2 reduction in bone surface and lung dose guidelines at the construction permit and LWA-1 stage to account for uncertainties is far too small. I will discuss

{ this point in the next portion of my testimony.

B. The Factor of 2 Reduction Used to Lower the Lung and Bone Dose Guidelines at the CP and LWA Stages Does Not Sufficiently Account for Uncertainties in Dose Models And Radiological Risks In t'.e 1977 SSR , the Staff used a factor of 10 to reduce the dose guidelines for the lung and bone dose at the CP and LWA stages. This factor of 10 was the product of two factors:

1) a factor of about 2 to take into account uncertainties in final design detail and meteorology and new data and calculational techniques that might influence the final design of engineered safety features or the dose reduction factors allowed for those features; and

2) a conservative factor of 5 to take into account uncertainties in dose and health effect models.

In the 1982 SSR (p. III-9), the Staf f reduced this uncertainty factor from 10 to 2, claiming that the factor of 5 to take into account uncertainties in dose and health effects models is no longer needed .12 This claim is totally unsupportable.

The adequacy of the current Federal radiation protection standards for plutonium and other transuranic elements has been a matter of considerable debate for a number of years. One, but by no means the only, issue has been the adequacy of these standards to account for the fact that when alpha-emitting i

i radionuclides are deposited in human tissue as particulates, or l

12 NRC Staff's Supplement Answers to Natural Resources l Defense Council, Inc. and the Sierra Club Twenty-Sixth Set of Interrogatories to Staff, at pp. 19-20.

I L

otherwise accumulate in high concentrations, e.g. in the alveoli and bronchial bifurcations of the lung and on bone surfaces, relatively high (in some instances exceedingly high) doses are presented to very localized tissue. The current standards are based on the assumption that the risk to the organ from such localized exposures is not greater than the risk assuming that the energy deposited by the alpha radiation is uniformly distributed throughout the organ.

There are three important examples where various experts have argued that the current treatment of non-uniform exposure is to alpha emitters is nonconservative by two or three orders of magnitude. One of these is based on the arguments set forth by Dr. Karl Z. Morgan (who was primarily responsible for deriving l the current standards related to maximum permissible internal organ exposure) in his article in the Journal of American i Hygiene ( Aug . 19 75) , and described briefly in his testimony.

1 On the basis of the evidence described in his article, Morgan l argues that the current plutonium' standard is too high by a factor of approximately 200. Accepting Morgan's thesis, in order to provide adequate protection to the public (and radiation workers) , one should increase the quality factor used in calculating the bone dose (in rems) by a factor of 200, or use the currently assumed quality factor and reduce the standards by the same factor.

A second example of possible nonconservatism is the hypothesis that the principal causal factor in tobacco-related L

carcinoma is a result of inhalation of Po-210 (an alpha emitter) in cigarette smoke.13 This hypothesis, often referred to as the " warm particle hypothesis," has been argued most recently in a series of Letters to the Editor appearing in l the New England Journal of Medicine Vol. 307, 29 July 1982, at l

pp. 309-313. Here it is noted that the localized distribution of Po-210 in the bronchial region of the lung "now appears to be 1000 times more carcinogenic than gamma radiation -- as compared to the factor of 10-20 currently assumed." Id. Dr.

John C. Cobb also cites the Po-210 work as part of the basis for his view that "present and proposed standards or guidelines fut plutonium and other alpha-emitting radionuclides like

, americium and uranium may be seriously inadequate to protect the public." Testimony of Dr. John C. Cobb at pp. 1-2.

A third example of possible nonconservatism is the " hot particle hypothesis," a variation of the " warm particle hypothesis" based on the Po-210 evidence. The hot particle hypothesis was supported by Arthur R. Tamplin and myself in a series of NRDC reports.14 1

13 See, e.g., Martell, E.A., Nature, 249, 214-218 (May 17, 1974) ; Martell, E.A., New Scientist, 63, 404-412 (July-Aug.

1975).

14 See, e.g., Radiation Standards for Hot Particles, NRDC, l

February 14, 1974 ; NRDC Comments on WASH-1535, DRAFT EIS LMFBR Re Volume II, Part 2, Section 4.6.5, Particle Lung Dose Effects, reprinted in ERDA-1535, pp. V.55-1 to V.55-328; "NRDC Supplemental Submission to the EPA Public Hearings on Plutonium and the Transuranic Elements," February 24, 1975; and NRDC testimony in the GESMO Proceeding (Dkt. No. RM-50-5) , Re:

Chapter IV, Section J, Appendix D, March 4, 1977, Prepared by Arthur R. Tamplin and Thomas B. Cochran.

l

Although this hypothesis has been criticized by a number of people and organizations, including the Nuclear Regulatory Commission, none of these groups or individuals have responded to the rebuttals to their arguments prepared by Dr. Tamplin and myself. See The Hot Particle Issue: A Critique of WASH-1320 as it relates to the Hot Particle Hypothesis, November 1974; "A Critique of the Biophysical Society DRAFT Comments on

' Radiation Standards for Hot Particles'," December 1974;

" Comments by NRDC on the NRC's Denial of Petition for Rulemaking [ Docket No. PRM-20-50]," June 2, 1976; and " Natural Resources Defense Council Critique of the NAS-NAC Report,

' Health Effects of Alpha-Emitting Particles in the Respiratory Tract," March 1977. I remain convinced that this hypothesis has not been disproven.

None of thest hypotheses are proof that the risks of " hot spots" of alpha emitters is as high as the respective hypotheses would indicate. But the hypothesis currently accepted by Staff and Applicants -- that the risk associated with these hot-spots can be conservatively treated by assuming the alpha irradiation is smeared uniformly throughout the organ

-- is also unproven . One cannot use one hypothesis to set aside another. This is nothing more than a case where the data 4

allow for a wide range of interpretation and different experts have widely divergent views on the matter. In this regard it I

is instructive to examine the BEIR-III review of the " hot spot" l

i r

issue in its discussion of~ lung cancer:15 The possible influence of " hot spots" of insoluble radioactive particles deposited in pulmonary tissues on cancer risk has been evaluated in a previous report.32/ The evidence is still insufficient to determine whether aggregates of radioactivity that remain localized in specific regions of the lungs give a greater or smaller risk of lung cancer per average lung dose than uniformly deposited radiation. Preliminary experimental data indicate that a small fraction of inhaled insoluble particles may remain in the bronchial epithelial layer for long periods, but the significance of this local exposure on lung-cancer risk is still uncertain.

32/ National Research Council, Advisory Committee on the Biological Effects of Alpha-Emitting Particles in the Respiratory .

Tract. Washington, D.C.: National Academy of Sciences, 1976 Based on these uncertainties in dose and health effects models, a factor reduction of the dose guidelines for lung and

bone at the CP and LWA stages is not only appropriate, but absolutely necessary. I believe these dose reduction factors l

l should be approximately 100 for bone surface and 100-1000 for lung, assuming the quality factors assumed by the Staff are used in calculating doses. These factors would lower the lung guideline value to .75 rems and the bone surface guideline value to .03 .3 rems for purposes of CP & LWA review.

l 1

BEIR III, p. 326 (emphasis added).

l l

l

IV. Neither Applicants Nor Staff Have Established That the Models, Computer Codes, Input Data and Assumptions Used to Analyze CDAs and Their Consequences Are Valid Intervenors' Contention 2(f) challenges the validity of the models and computer codes used by the Staff and the Applicants in their safety analyses of CDAs and their consequences.

Contention 2 (g) challenges the validity of the input data and assumptions used by the Staff and the Applicants in those computer codes and models. Contention 2(h) challenges the proposed source term since it is not based upon an adequate analysis of CDA energetics.

With regard to the Staff's site suitability source term analysis, the Staff has stated that it does not analyze or rely upon the energetics of a CDA or the magnitude of its release to the secondary containment. Rather, the Staff's site suitability analysis begins with the postulated release of the assumed source term to the secondary containment. The Staff analyzes the dose consequences of this postulated release using three computer codes:

1) HAA-3;

2) PAVAN; and

3) TACT; The HAA-3 code is used to model the behavior of aerosols in the containment. I have not analyzed the HAA-3 code due in part to the fact that the Staf f claimed at the Conference With Parties on August 2, that it was using HAARM rather than HAA-3 I

(Transcript of Conference with Parties, Aug. 2, 1982, at p.

850.) The Staff corrected this error on August 6, 1982, only 10 days ago. Letter from Daniel T. Swanson to Administrative Judges dated August 6, 1982. The Staff claims that the HAA-3 code is also used by the Applicants. Id. Applicants, however, use HAA-3B, a later version of HAA-3. PSAR, P. A-140.

On August 6, the Staff informed Intervenors for the first time that it also uses the PAVAN code to calculate the X/Q values subsequently used in TACT. That same day, the Staff 6

supplied Intervenors with a draft users guide for PAVAN.

There is no evidence that a formal code review process has been conducted. The fact that only a draft users guide is available suggests that no such review has been conducted. Consequently, the reliability of the code is questionable.

The TACT code is used by the Staff to calculate the whole

( body and organ doses for a given SSST release. THe X/Q values and the dose conversion factors (DCFs) (e .g . , rem / cure inhaled) are code inputs. The Staff provided Intervenors on August 6, i

1982 with a copy of a TACT programmers manual,17 wnich 16 Bander, T.J., DRAFT " User's Guide for PAVAN: Evaluating Non-Routine Releases of Radioactive Materials from Nuclear Power Stations," Batelle NUREG/2858 PNL - , June 1982.

17 R. George, F.G. Prohammer, F.E. Dunn, " TACT Programmers Manual, ANL, undated.

O includes a printout of the code, along with sample TACT calculations (i .e. output) . The Staff informed me, however, that unspecified modifications to the code have been made i subsequent to the time the programmers manual was written, which, incidently, is undated.

As indicated in Dr. Morgan's testimony, incorporated herein i by reference, no documentation exists -- at least none was provided -- for the DCFs assumed by the Staff as input for the i

TACT code calculations. Given the inadequacies of the documentation of the TACT and PAVAN codes, the Staff's calculations cannot be accepted as reliable.

Applicants claim to use the SAS3D, PLUTO, VENUS, REXCO-HEP, COMRADEX III, CACECO, and HAA-3B codes in their site suitability analysis. (Transcript of Conference with Parties, Aug. 2, 1982 at 844-846); PSAR Appendix A).

The SAS3D, PLUTO, VENUS and REXCO-HEP codes are used to i 5 analyze CDAs and their co[isequences within the reactor vessel Applicants claim that they do not rely on analyses of CDA energetics or these codes as a basis for their view that the CDA should not be considefed within the DBA envelope (Contention 1) and claim that any discussion of these codes is limited to the scope of the 1982 SSR, pp. II II-19. ,

Transcript of Conference With Parties, supra, at p. 851.

Applicants have also stated in deposition that they will not l challenge the validity of the Staff's assumed SSST, filter I efficiencies, or assumed leakrates in the LWA-1 proceeding.

i  !

I

(Transcript of Deposition by Intervenors George H. Clare, Neil W. Br an, and L. Walter Dietrich, June 16, 1982 at 139-141) .

For these reasons, and because I believe that the Board may not rely upon Applicants' codes before they have been reviewed by the Staff, Intervenors will not present a detailed review of Applicants' codes at this time. The importance of an independent Staf f review of any of Applicant's codes that are presented as a basis for LWA-1 decisions is evident from the fo.11owing observations:

(1) Memorandum from G.F. Flanagan, Oak Ridge National Laboratoary to Distribution dated August 13, 1976:

Because the magnitude of the work estimated [CDA energy release] using these

" crude" models was excessive when extrapolated to large commercial plants, a large effort was initiated primarily at ANL and later at HEDL and LASL, to mechanistically model the disassembly so as to reduce the energy release.

This resulted in several series of codes l

being developed such as SAS, VENUS, REXCO, MELT, etc... Their prime purpose was to further the understanding of the behavior of fuel, coolant and cladding before and during a core disruptive accident. They were never intended to supply an absolute number for the work or energy release for purposes of reactor design. . . .

On the surface these codes appear i mechanistic and probably this is the reason i the results are represented as design numbers. However, on close examination tl models in the codes are based on small out-of-pile experiments, simplified in pile experiments, tradition and hypothesis. Many parameters are left to the user to determine which actually regulate the sequence, timing, and ultimate energy release of the accident being investigated. To quote a developer of one of the codes, "we l

parameterized our ignorance". This is not 1

l

to say that the codes are not useful because they are when used for the purpose intended, to study the effects of various input data changes on a particular accident, model comparison, etc., but not for the purpose of supplying the design basis data.

Thus the problem boils down to a question of, "do we have the capability to predict I the mechanistic disassembly of a reactor l during an accident to the accuracy required if such an accident is declared a design basis accident (DBA)?" The answer is "no" and further the task is so enormous that it is unlikely we will be able to obtain the accuracy and reduce the uncertainties without a considerable investment in money and time both experimentally and analytically. (Emphasis supplied.)

In a handwritten note on this memo is the note "This could be sensitive raaterial please treat it as such."

One of the important points Flanagan makes is that the codes "parameterize our ignorance," and consequently the energy release and therefore the source term is regulated by the users' input assumptions. These assumptions are often design specific. But more importantly, these parameters have not been j reviewed by the Staff.

(2) Another indication of the need for an independent analysis of Applicants' codes relates to the Applicant's analysis of CDAs in the new heterogenous core, which is documented in CRBRP-GEFR-00523. SAS-3D was developed directly from SAS-3A using the same physical models and SAS-3A is cited by Applicants as a basis for the validity of SAS-3D. The major differences between SAS-3A and SAS-3D are in the treatment of data management and reprogramming to obtain better efficiency.

SAS-3A has been supplemented, however, by an even later version, called SAS-4A. Some of the differences between SAS-4A and SAS-3A were summarized as follows in a paper by Cahalan, et

_a_l . : 18 However, experience gained through application of SAS3A pointed out areas where improved models and numerical techniques would significantly strengthen and expand the understanding of core disruptive accidents.

In order to obtain an improved physical model, a more accurate numerical solution, and a reduction in computer time, the SAS4A

- transfer routines have been completely rewritten and are significantly changed from those in previous versions of SAS.

The SAS4A coolant boiling model [9] is an extended and totally reprogrammed version of the SAS3A coolant boiling model [4). The one-dimensional, multiple bubble framework has been retained, but a number of numerical and phenomenological improvements have been made to improve the ability, efficiency, and applicability of the model.

Because SAS-3D incorporates the same physical models as SAS-3A, these improved models incorporated in SAS-4A are also l

improvements over the physicasl models in SAS-3D. In I discussing the CRBR transient overpower accident, Mr. Hummel, a l

l 18 Cahalan, et al., "The Status and Experimental Basis of the l SAS-4A Accident Analysis Code System," paper presented at the i

Fast Reactor Safety Technology Conference in Seattle, August i 1979.

l L

Nuclear Regulatory Commission consultant from Argonne National Laboratory, recently testified:

And for some reason, the heat transfer calculations in SAS-3D and SAS-4A are +

sufficiently dif ferent that you get by all right with 10 cents a second for SAS-4A and you do not with SAS-3D. We have not sorted this oint yet, but I wanted to mention it as an important variable.19 It should be little comfort to those using SAS-3D that it gives the more conservative result in this particular instance if the model is predicting erroneous results.

(3) In the May 1 - Aug. 31, 1981 Foreign Attaches Quarterly Report prepared at Sandia National Laboratory, the authors state:

Several errors and seeming inconsistencies were detected in the SAS3D input manual and code. To date, investigators have not been able to obtain a consistent accident sequence involving an overpower excursion leading to the fuel-pin rupture and subsequent fuel-coolant interaction. Part j of the problem has been due to the lack of i complete documentation on the SAS3D code and

! possibly an inadequate check-out of the l

SAS3A to SAS3D modifications for UTOP accident sequences.

l W. Breitung, F. Briscoe, G. Fieg and P. Herter, " Limited f

l Distribution Foreign Attaches Quarterly Progress Report,"

Sandia National Laboratory, May 1 - Aug 1, 1981 (emphasis added). These observations were made before most, if not all, of the Applicants' site suitability CDA analyses were performed.

(4)Intervenors, through discovery, obtained a memorandum from the chief engineering officer of the Clinch River l

l l

19 to the Chief of the division responsible for project planning, development, coordinating and executing policies and plans in the areas of public safety, environmental affairs, 20 nuclear safeguards, licensing, and reliability concerns a report numbered ANL/ RAS 77-15 prepared by Argonne National Laborataries. The Argonne report in question is one of the fundamental underpinnings of the CRBR accident analysis. It constitutes the principal technical documentation for the validity of the computer code (SAS-3D) used to calculate the occurrence potential, accident progressions, and nuclear explosive potential of the CRBR core. The Riley memorandum calls unambiguously for the systematic deletion from the Argonne report of " negative" information that would presumably interfere with the licensing of the facility. For example:

19 The Engineering Division, headed during the pertinent time by the author of this memo, is responsible for management of the design, engineering, and fabrication of systems, processes, equipment, and facilities, including quality, cost estimates, schedule, and research and development activities. CRBR PSAR, 1.4-5 (Am. 6 6, Ma rch 19 8 2) .

20

_I_d.

21 See CRBRP-3, Hypothetical Core Disruptive Accident Consideration in CRBHP, Vol. 1, Energetics and Structural Margin Beyond the Design Base, 2 Jan. 1979, Rev. 3, Aug. 1981 and 4 March 1982; see in particular pp. 1-4 and C-3.

General Comments

1. The subject report is not acceptable because the information is presented in a very negative manner, particularly Chapter

2. The overall conclusion derived from Chapter 2 is that significant uncertainty exists in the Project's knowledge of all the major phenomenon which contribute to the initiation phase of a loss-of-flow (LOF) accident for an end-of-equilibrium cycle (EOC) core. The report should not only present to NRC our current understanding of the LOF/EOC accident and the basis for this knowledge, but also the results and descriptions of the SAS-3D analysis. This report should be written in a straightforward, positive manner.

2. Any reference in this report to the need for additional work either experitental or analytical should be deleted. This type of information is not appropriate for transmittal to NRC.

Specific Comments Chapter 9 - This chapter which presents the conclusions should be completely rewritten.

Not only does this chapter support Chapter 2, i.e., the Project does not understand the LCF-EOC event, but it also presents to NRC a list of additional experiments which should be performed, see comments G1 and G2.

Recommendation The critical chapters 1, 2, 7, 8 and 9 should be rewritten to a) present a positive, real assessment of the LOF HCDA, b) delete any reference to additional analytically [ sic} or experimental work andc) incorporate the preceding comments.

Until this is accomplished, Engineering does not recommend transmittal of this report to NRC.

l Memorandum, pp. 1-2, 4 (emphasis added).

l l

t

Although the memorandum was written in 1977, the Argonne Report is still the primary documentation of the validity of the SAS-3D code.22 Although Applicants claim that the recommended changes were not included in the final ANL/ RAS 77-5 report, the fact that an Applicant (or its highest technical management personnel) would direct that NRC be kept purposely ignorant of the limitations of its safety analyses should make it clear that Applicants' codes should not be relied upon without independent Staff review.

V. Conclusion In summary, I believe that the Staff's site suitability analysis contains many omissions, inconsistencies, and nonconservatisms which, when corrected, demonstrate that the proposed site is not adequate to protect the public health from accidents at a reactor of the general size and type as CRBR.

In particular, the Staff's failure to base its assumed fission

product release upon a major core disruptive accident (since such accidents are credible, and, at l

l l

l 22 It is relied upon in the latest pertinent licensing documents (a) General Electric Co., "AN ASSESSMENT OF HCDA ENERGETICS IN THE CRBRP HETEROGENEOUS REACTOR CORE,"

CRBRP-GEFR-00523, Dec. 1981, p. 1-3, Chapter 3 and Appendix A; (b) US DOE, CRBRP-3, supra n. 7; US DOE, " Final Environmental Impact Statement, Liquid Metal Fast Breeder Reactor Program j (Supplement to ERDA 1535, Dec. 1975)", DOE /EIS-0085-FS, May 1982, pp. 132, 145.

L

the very least, cannot be proven incredible without a full s:afety review) , and its failure to evaluate conservatively the consequences of such an accident, including containment overpressurization and high thermal loadings that would result from sodium fires and sodium-concrete interactions, renders the entire source term analysis inadequate. Even if the Board accepts the Staff's nonconservative source term, the postulated radiological doses to the nearby population are in reality much greater than those derived by the Staff. Correcting the Staff's errors in these offsite radiological doses would prove that they are too large to meet either the Staff's proposed guidelines, which we contend are inadequate, or the appropriate guideline values suggested by Dr. Morgan and myself.

Conversely, the Staff's postulated offsite doses are not low l

l enough to meet the appropriate dose guideline values for lung and bone surface based on recommendations by the ICRP, the EPA, or the testimony you've heard today. As a result, the site for a reactor of the general size and type as CRBR does not provide adequate protection to the public health.

i

BEFORE THE UNITED STATES NUCLEAR REGULATORY COMMISSION ATOMIC SAFETY AND LICENSING BOARD

)

In the Matter of )

)

UNITED STATES DEPARTMENT OF ENERGY )

PROJECT MANAGEMENT CORPORATION ) Docket No. 50-537 TENNESSEE VALLEY AUTHORITY )

)

(Clinch River Breeder Reactor Plant) )

)

AFFIDAVIT OF DR. THOMAS B. COCHRAN City of Washington )

) ss:

District of Columbia )

I, Dr. Thomas B. Cochran, being duly sworn, depose and say that the foregoing testimony is true and correct to the best of my knowledge and belief.

Dr. Thomas B. Cochran Subscribed and sworn to before me this 16th day of August 1982.

/

Notary P6blic R

October 1, 1981 RESUME Thomas B. Cochran, Ph.D.

Business Address:

Natural Resources Defense Council, Inc.

1725 I Street, NW, Suite 600 l

Washington, D.C. 20006 (202)223-8210 Home Address:

4836 North 30th Street Arlington, VA 22207 (703)S32-1044 EMPLOYMENT HISTORY April 1973-present: Natural Resources Defense Council, Inc.

Senior Staff Scientist, focusing on national energy R&D policy, principally nuclear energy issues, the breeder reactor, plutonium recycle, nuclear weapons proliferation, safeguards, and radiation exposure standards. Consultant to the U.S.

Department of Energy (DOE) on nuclear nonproliferation and nuclear R&D strategy; consultant to the Comptroller General on (a) U.S. and international controls over the peaceful uses of nuclear energy, (b) Advanced Nuclear Technologies, and (c) U.S.

Liquid Metal Fast Breeder Reactor Program; consultant to the Office of Technology Assessment (OTA); Member of DOE's Energy Research Advisory Board, DOE's Nonproliferation Advisory Panel, OTA's Advisory Panel on Nuclear Proliferation and Safeguards, the Nuclear Task Group of OTA's Analyses of the ERDA Plan and Program, and OTA's Gas Curtailment Study Review Panel. Consultant to Governor of Lower Saxony, West Germany, to serve as an Inter-national Expert in the Review of the Gorleben Nuclear Fuel Cycle Center. Served as a member of ERDA's LMFBR Review Steering Committee, the National Academy of Sciences' Panel on Strategy l

l for Developing Nuclear Merchant Ships, the Task Force on Energy l Conversion Research and Development of the Federal Power Survey, the United Nations' Environment Programme's International Panel of Experts on Energy and the Environment, the National Council of Churches' Energy Study Panel and the World Council of Churches Consultation on Ecumenical Concerns 'n Relation to Nuclear Energy. Also served as a consultant to Resources for the Future and numerous environmental organizations. Testified before Congress and federal agency hearings on numerous occasions, including testimony before the Joint Committee on Atomic Energy, the House Committee on Interior and Insular Affairs, the Joint Economia Committee, the House Committee on Small Business, and the Nucj. ear Regulatory Commission's Advisory Committee on Reactor g Safeguards.

l l

l l __

.

• Thomas B. Cochran d Page Two June 1971-April 1973: Resources for the Future, Inc.

Washington, D.C.

Senior Research Associate, Quality of the Environment Program.

Studying environmental effects of the U.S. civilian nuclear power industry, residuals management in the nuclear fuel cycle, liquid metal fast breeder reactor program, national energy policy, and radiation standards. Wrote a book, The Liquid Metal Fast Breeder Reactor: An Environmental and Economic Critique.

1969-1981: Litton Mellonics Division, Scientific Support Laboratory Fort Ord. California Modeling and Simulation Group Supervisor. Supervised the activities of 10 operation research analysts engaged in military research pertinent to the evaluation of proposed U.S. Army concepts and material by U.S. Army CDCEC.

1967-1969: U.S. Naval Postgraduate School Monterey, California Lt-USNR, Active Duty; Assistant Professor of Physics; Radiation Safety Committee; part-time research involving computer studies of synchrotron radiation production in beam transport systems at Stanfard Linear Accelerator, Stanford, California.

EDUCATION Summer 1969: University of Colorado, Boulder. Postdoctorate.

Summer Institute of Theoretical Physics.

1965-1967: Vanderbilt University, Nashville, TN. Doctorate.

Major: Physics. Minor: Mathematics. Research in high energy (bubble chamber) physics. NASA Fellowship. Guest Research Associate in Physics Department at Brookhaven National Laboratory, Upton, NY, studying synchrotron radiation shielding problems.

I 1962-1965: Vanderbilt University. MS degree in Physics.

l Research in radiation chemistry; AEC Health Physics Fellow; applied health physics training, Oak Ridge National Laboratory; Vanderbilt University Campus Radiation Safety Officer.

1958-1962: Vanderbilt University. BE degree in Electrical Engineering, cum laude. NROTC.

PROFESSIONAL AFFILIATIONS American Physical Society Health Physics Society Maerican Nuclear Society Sigma Xi r

PERSONAL Age: 40. Birth date: 18 November 1940. Birth place: Wash. DC.

Wife: Carol J. Cochran. Two children.