ML021500546

G20020314/LTR-02-0372 - David Lochbaum Ltr Re Follow-up on the May 1, 2002 Commission Briefing on the Reactor Oversight Program - Davis-Besse

ML021500546
Person / Time
Site:	Davis Besse
Issue date:	05/14/2002
From:	Lochbaum D Union of Concerned Scientists
To:	Commissioners NRC/Chairman, NRC/OCM
Shared Package
ML021720002	List: ML021500546 ML021710880
References
G20020314, LTR-02-0372
Download: ML021500546 (15)

Text

EDO Principal Correspondence Control DUE: 06/06/02 David Lochbaum Union of Concerned Scientists EDO CONTROL: G20020314 DOC DT: 05/14/02 FINAL REPLY:

Chairman Meserve FOR SIGNATURE OF :

Chairman Meserve DESC:

• • PRI Follow-up on the May 1, 2002 Commission Briefing on the Reactor Oversight Program - Davis-Besse DATE: 05/28/02 ASSIGNED TO:

NRR CONTACT:

CRC NO: 02-0372 ROUTING:

Travers Paperiello Kane Norry Craig Burns/Cyr Dyer, RIII Miller, RI Collins SPECIAL INSTRUCTIONS OR REMARKS:

itpIc4& %c+-Drq FROM:

TO:

&ýIýS: 'Seýcy-of

OFFICE OF THE SECRETARY CORRESPONDENCE CONTROL TICKET Date Printed: May 28, 2002 12:21 PAPER NUMBER:

ACTION OFFICE:

LTR-02-0372 EDO LOGGING DATE: 05/28/2002 AUTHOR:

AFFILIATION:

ADDRESSEE:

SUBJECT:

ACTION:

DISTRIBUTION:

LETTER DATE:

ACKNOWLEDGED SPECIAL HANDLING:

NOTES:

FILE LOCATION:

DATE DUE:

David Lochbaum UCS CHRM Richard Meserve Concerns follow-up points on the May 1, 2002 Commission Briefing Signature of Chairman RF, Comrs.

05/14/2002 No SECY TO ACK ADAMS 06/10/2002 DATE SIGNED:

EDO -- G20020314

Union of Concerned Scientists Citizens and Scientists for Environmental Solutions May 14, 2002 Chairman Richard A. Meserve Commissioner Nils J. Diaz Commissioner Greta J. Dicus Commissioner Edward McGaffigan, Jr.

Commissioner Jeffrey S. Merrifield U.S. Nuclear Regulatory Commission Washington, DC 20555-0001

SUBJECT:

FOLLOW-UP TO MAY 1, 2002 COMMISSION BRIEFING

Dear Chairman and Commissioners:

Thank you again for the opportunity to present our views on the Reactor Oversight Program during the May 1, 2002, Commission briefing. I have been away from the office on business and vacation since that briefing and therefore was unable to follow-up on a few points until now.

First, I'm glad that Commissioner Merrifield pointed out that our comments had been prepared and submitted prior to the NRC's announcement on the creation of the Manual Chapter 0350 panel for Davis Besse. While preparing our comments, I had heard that the staff was thinking about creating such a panel, but was uncertain of the decision until it was announced. The staff responded to Commissioner Merrifield with the intent to review the procedure for possible clarification. If the procedure is revised, it should provide guidance for communicating to the public when the staff opts not to create an 0350 panel. In the Indian Point 2 case, I talked with Mr. Hubert Miller and Mr. Brian Holian in Region I to gain additional insights regarding their decision not to create a panel. The broader public would also benefit from these insights. Therefore, the NRC should communicate its reasons for not convening an 0350 panel.

Second, I'd responded to a question Chairman Meserve posed to the NRC panel regarding the reasons for Davis-Besse missing numerous warning signs. It remains my belief that non-conformance with 10 CFR 50.71(e) contributed to the problem. Enclosed is a copy of our letter dated January 29, 1997, to the Commission detailing the problem we identified at Maine Yankee. In that letter from five years ago, UCS stated:

UCS believes that the majority, if not the entirety, of power reactor licensees have also failed to update their FSARs to reflect safety analyses performed at the NRC's request. We recommend that the NRC take the necessary actions to promptly resolve this generic safety problem. All of the NRC's emphasis on conformance with the FSARs, as highlighted by Information Notice 96 17, is undermined if these documents are flawed.

FirstEnergy's final root cause report for the reactor head damage stated that the B&W Owners Group prepared an evaluation of the boric acid coirosion problem and that NRC reviewed and accepted it. Had the Davis-Besse Updated Final Safety Analysis Report (UFSAR) been revised to reflect this evaluation, Washington Office: 1707 H Street NW Suite 600

• Washington DC 20006-3919 9 202-223-6133

• FAX: 202-223-6162 Cambridge Headquarters: Two Brattle Square

• Cambridge MA 02238-9105

• 617-547-5552

• FAX: 617-864-9405 California Office: 2397 Shattuck Avenue Suite 203

• Berkeley CA 94704-1567

• 510-843-1872

• FAX: 510-843-3785

May 14, 2002 Page 2 of 2 there is greater likelihood that a plant worker or NRC inspector would have questioned one or more of the numerous warning signs more rigorously. Without this information present in the UFSAR, it was easier to cancel the proposed modification to the service platform that would have facilitated inspections, to videotape the reactor vessel head during refueling outages but not analyze the tapes, to notice an increase in unidentified leakage within the containment without worrying about the consequences, and to clean boric acid crystals off the reactor vessel head with a crow bar.

UCS believes today, as we did in 1997, that the majority, if not the entirety, of power reactor licensees have failed to update their FSARs to reflect safety analyses performed at the NRC's request. We reiterate our recommendation for the NRC to resolve this generic safety problem.

Sincerely, avId LoUIIaUmII Nuclear Safety Engineer Washington Office

Enclosure:

January 29, 1997 letter from David Lochbaum to NRC Chairman and Commissioners 6-ggL,

UNION OF CONCERNED SCIENTISTS January 29, 1997 Chairman Shirley A. Jackson Commissioner Kenneth C. Rogers Commissioner Greta J. Dicus Commissioner Nils J. Diaz Commissioner Edward McGaffigan, Jr.

United States Nuclear Regulatory Commission Washington, DC 20555-0001

Dear Chairman and Commissioners:

The Commission placed considerable emphasis this past year on plants operating within their design and licensing bases. Numerous staff activities, including Information Notice 96-17 last March and the 50.54(f) letters last October, implemented the Commission's directions on this important subject.

We share the NRC's concern about conformance with licensing basis requirements. We respectfully call to your immediate attention an apparent violation that we have documented for the Maine Yankee Atomic Power Station. This apparent violation, as detailed in the attached report, involves the failure of the Maine Yankee licensee to update the Final Safety Analysis Report (FSAR) to reflect safety analyses performed at the NRC's request. This failure constitutes an apparent violation of 10 CFR Section 50.71(e). We conclude that nuclear safety decisions at Maine Yankee may have been made using its inaccurate and incomplete FSAR. We recommend that Maine Yankee's FSAR be properly updated and that all prior nuclear safety decisions based on its inaccurate FSAR be reviewed to verify their adequacy.

UCS believes that the majority, if not the entirety, of power reactor licensees have also failed to update their FSARs to reflect safety analyses performed at the NRC's request. We recommend that the NRC take the necessary actions to promptly resolve this generic safety problem. All of the NRC's emphasis on conformance with the FSARs, as highlighted by Information Notice 96-17, is undermined if these documents are flawed.

Thank you in advance for your consideration of this significant safety concern.

Sincerely, David A. Lochbaum Nuclear Safety Engineer cc:

Leonard J. Callan, Executive Director for Operations Samuel J. Collins, Director of the Office of Nuclear Reactor Regulation Hubert J. Miller, Regional Administrator, Region I Washington Office: 1616 P Street NW Suite 310

• Washington, DC 20036

• 202-332-0900

• FAX: 202-332-0905 Cambridge Headquarters: Two Brattle Square Cambridge, MA 02238

• 617-547-5552 - FAX: 617-864-9405 California Office: 2397 Shattuck Avenue Suite 203. Berkeley, CA 94704, 510-843-1872

• FAX: 510-843-3785 PRINTED ON RECYCLEO PAPER

Maine Yankee's FSAR Problem EXECUTIVE

SUMMARY

Problem Statement The Final Safety Analysis Report (FSAR) for the Maine Yankee Atomic Power Station does not contain information from safety analyses performed at the Nuclear Regulatory Commission's request.

Root Causes The Maine Yankee Atomic Power Company violated federal regulations requiring FSARs to be updated with safety analysis information.

The Nuclear Regulatory Commission (NRC) failed to enforce these federal regulations.

Safety Implications The FSAR is used to determine if plant or procedure changes can be made without reducing safety margins. The FSAR is used to develop training materials and risk assessments. The FSAR is used by the NRC to determine if a nuclear plant's operating license can be changed without imposing a significant safety hazard.

The NRC periodically requires nuclear plant owners to perform analyses of safety issues.

Their results typically indicate adequate safety margins are available as long as equipment is operated within certain limitations.

When the FSAR is not updated to reflect these safety analyses (particularly the limitations involving safety equipment), determinations using inaccurate information may indicate a proposed activity is safe when it actually represents an undue risk to public health and safety.

Required Actions Maine Yankee's FSAR must be updated to incorporate information from safety analyses performed at the NRC's request.

Plant changes, procedure revisions, and training materials developed since the safety analyses were completed must be reviewed to ensure that safety margins were not inadvertently removed.

If these tasks are not completed during its current outage, Maine Yankee's operation with uncertain safety margins must be specifically reviewed and approved by the NRC.

The NRC must determine if the other nuclear power plants are operating with uncertain safety margins caused by inaccurate FSARs.

Union of Concerned Scientists January 29, 1997 Page I

Maine Yankee's FSAR Problem

Background

On October 9, 1996, James M. Taylor, Executive Director for Operations at the Nuclear Regulatory Commission (NRC), notified senior management for every nuclear power plant of the NRC's expectations regarding conformance with design and licensing bases requirements. Mr. Taylor stressed the importance of the Final Safety Analysis Report (FSAR):

"The FSAR is required to be included in, and is one portion of, an application for an operating license (OL) for a production or utilization facility. 10 CFR 50.34(b) describes the information which must be included in an FSAR. The FSAR is the principal document upon which the Commission bases a decision to issue an OL and is, as such, part of the licensing basis of a facility. It is also a basic document used by NRC inspectors to determine whether the facility has been constructed and is operating within the license conditions." [emphasis added]

NRC Chairman Shirley Ann Jackson explained the FSAR's vital role during a speech at the 17th Annual Institute of Nuclear Power Operations Conference for utility chief executive officers on November 7, 1996:

"The NRC uses the FSAR when evaluating license amendment requests and other issues at particular facilities and will use the FSAR in reviewing applications for license renewals. The accuracy of the FSAR, and the design basis generally, has a direct impact on the accuracy of recurring reviews and safety analyses performed by the NRC staff. NRC inspectors continue to use the FSAR as a baseline when conducting inspections." [emphasis added]

Thus, the NRC relies on an accurate FSAR when determining that nuclear power plants comply with federal safety regulations. Leonard Bickwit, Jr., NRC General Counsel, stated in a letter dated August 14, 1980, to the NRC Commissioners, "...compliance with the Commission's regulations is essential to a detennination of adequate protection of the public health and safety under the Atomic Energy Act

[of 1954]" [emphasis added]. It logically follows that an accurate FSAR is essential for adequate protection of public health and safety.

Title 10 of the Code of Federal Regulations (CFR) Section 50.34(b) specifies the NRC's regulations covering information contained in the FSAR:

"A description and analysis of the structures, systems, and components of the facility, with emphasis upon performance requirements, the bases, with technical justification therefor, upon which such requirements have been established, and the evaluations required to show that safety functions will be accomplished. The description shall be sufficient to permit understanding of the system designs and their relationship to safety evaluations."

As reported in the Federal Register on May 8, 1980, the NRC issued a final rule effective July 22, 1980, requiring periodic updating of FSARs at all nuclear power plants:

"The Nuclear Regulatory Commission is amending its regulations [10 CFR 50.71(e)] to require each person licensed to operate a nuclear power reactor to submit periodically to the Commission revised pages for its Final Safety Analysis Report (FSAR). These revised pages will indicate changes which have been made to reflect information and analyses submitted to Union of Concerned Scientists January 29, 1997 Page 2

Maine Yankee's FSAR Problem the Commission or prepared as a result of Commission requirement. The amendment is being made to provide an updated reference document to be used in recurring safety analyses performed by the licensee, the Commission, and other interested parties." [emphasis added]

The current requirements specified in 10 CFR Section 50.71(e):

"Each person licensed to operate a nuclear power reactor pursuant to the provisions of Section 50.21 or Section 50.22 of this part shall update periodically, as provided in paragraphs (e)(3) and (4) of this section, the final safety analysis report (FSAR) originally submitted as part of the application for the operating license, to assure that the information included in the FSAR contains the latest material developed. This submittal shall contain all the changes necessary to reflect information and analyses submitted to the Commission by the licensee or prepared by the licensee pursuant to Commission requirement since the submission of the original FSAR or, as appropriate, the last update FSAR. The updated FSAR shall be revised to include the effects of: all changes made in the facility or procedures as described in the FSAR; all safety evaluations performed by the licensee either in support of requested license amendments or in support of conclusions that changes did not involve an unreviewed safety question; and all analyses of new safety issues performed by or on behalf of the licensee at Commission request. The updated information shall be appropriately located within the FSAR." [emphasis added]

According to the NRC's Infonnation Digest (1995 Edition), the NRC issued Operating License DPR 36 (Docket No. 50-309) for Maine Yankee on June 29, 1973. Therefore, this regulation applies to Maine Yankee.

The regulation's purpose seems obvious. The Final Safety Analysis Report describes design features, procedures, and safety analyses that ensure plant operation conforms with federal nuclear safety standards. The regulation requires that any changes to design features (i.e., plant modifications),

revisions to procedures, and any new or revised safety analyses be reflected in the FSAR by periodic updates. Periodic updating is essential because the FSAR is a "living" document used in the day-to day operation and maintenance of the nuclear power plant. Complete and accurate FSAR information ensures that safety decisions are risk-informed.

UCS reviewed bulletins issued by the NRC between 1981 and 1994 to all holders of operating licenses for nuclear power reactors and to all holders of operating licenses for pressurized water reactors. UCS reviewed NRC bulletins because these documents require actions that must be taken by all recipients.

These required actions frequently identify equipment that must be inspected for potential problems, but can also specify analyses that must be performed. NRC Bulletins 88-04 and 88-11 clearly specified that licensees were to perform analyses of safety issues. UCS believes that federal regulations require FSARs to be periodically updated to incorporate information from analyses of safety issues such as those requested by the NRC in Bulletins 88-04 and 88-11. Therefore, UCS conducted an audit, documented on the following pages, on Maine Yankee's handling of these two bulletins to determine if its FSAR had been updated as required by federal regulations. UCS did not evaluate the technical adequacy of Maine Yankee's response to the bulletins, but simply whether information from the safety analyses performed by Maine Yankee had been incorporated into the FSAR.

Union of Concerned Scientists January 29, 1997 Page 3

Maine Yankee's FSAR Problem NRC Bulletin 88-04 On May 5, 1988, the NRC issued Bulletin 88-04, "Potential Safety-Related Pump Loss" to all holders of operating licenses for nuclear power plants. According to the NRC's Inform aion Digest (1995 Edition), the NRC issued Maine Yankee an operating license on June 29, 1973. Thus,Bulletin 88-04 applied to Maine Yankee.

The required actions specified in Bulletin 88-04 included:

"Evaluate the adequacy of the minimum flow bypass lines for safety-related centrifugal pumps with respect to damage resulting from operation and testing in the minimum flow mode."

[emphasis added]

By letter dated January 17, 1991, Jacque P. Duff, Chief - Engineering Branch, Nuclear Regulatory Commission, transmitted Inspection Report No. 50-309/90-23 to Mr. Charles D. Frizzle, President of the Maine Yankee Atomic Power Company:

"This letter refers to the Safety Issues Inspection conducted on November 5-9, 1990 by Messrs. J. T. Yerokun and D. Casada at the Maine Yankee Atomic Power Station, Wiscassett, Maine." [emphasis added]

The only subject examined during this NRC inspection at Maine Yankee was the response to Bulletin 88-04. Therefore, the NRC classified this subject as a safety issue.

The inspection report stated that the "inspection was conducted in accordance with NRC Inspection Manual (IM) chapter 2515, Temporary Instruction (TI) 2515/105." NRC Inspection Manual Temporary Instruction 2515/105, "Inspection of Licensee Activities in Reference to NRC Bulletin 88 04, 'Potential Safety-Related Pump Loss,' dated May 5, 1988," May 14, 1990, specified':

"The requirements of Bulletin 88-04 are to ensure that General Design Criteria 1, Quality standards and records, is met for all safety-related pumps. Pump to pump interaction and lack of sufficient miniflow capacity can lead to failure of the equipment to perform its safety related functions. In addition, General Design Criteria 35, Emergency Core Cooling, and 10 CFR 50.46 are applicable to ECCS pumps to ensure that abundant emergency core cooling is provided. Pump damage from miniflow operation could result in insufficient core cooling for certain small break LOCA [loss of coolant accident] or loss of feedwater events." [emphasis added]

Therefore, the safety issue described in Bulletin 88-04 has significant nuclear safety implications because it involved emergency core cooling system (ECCS) performance and core cooling capability.

By letter dated May 15, 1991, S. E. Nichols, Manager - Nuclear Engineering & Licensing, Maine Yankee Atomic Power Company, submitted Maine Yankee's response to Inspection Report No. 50 309/90-23 to the NRC. This response indicated:

TI 2515/105 did not direct NRC inspectors to verify that FSARs had been updated. The NRC's guidance to its inspectors was deficient.

Union of Concerned Scientists January 29, 1997 Page 4

Maine Yankee's FSAR Problem "Calculation MYC-1374 was performed to determine how four pump [two low pressure safety injection and two containment spray] operation would affect minimum flow rates for the LPSI and CS pumps. Each of the four LPSI pumps will provide at least 350 gpm during four pump operation. The CS pumps require a minimum flow rate of 200 gpm and the existing system will provide over 250 gpm during four pump operation. This calculation demonstrates the ability of the six inch line to provide adequate flow during simultaneous pump operation and we believe that this previously unresolved item has been adequately addressed." [emphasis added]

and "Specifications developed in 1968 indicate that the [containment spray] miniflow system should provide 425 gpm. However, these early records also indicate that a minimum flow valve and/or a reduction in line size would be used to control recirculation. Sometime prior to installation our existing orifice was sized and installed in lieu of a minimum flow valve/line reduction. This 1-1/16 inch diameter orifice is documented by a Byron Jackson drawing in our technical file but the design flow is not included. Flow calculations and measurements both indicate that this orifice provides approximately 300 gpm which is greater than the manufacturer's recommended minimum flow of at least 200 gpm. A technical evaluation has been completed that provides the basis for existing miniflow rates and initiates document corrections." [emphasis added]

Therefore, at least one calculation and one technical evaluation were performed by Maine Yankee in response to the NRC's request on the safety issue described in Bulletin 88-04. In UCS's opinion, the calculation and technical evaluation indicate that Maine Yankee performed analyses for Bulletin 88-04.

Maine Yankee's FSAR has been revised 12 times since the federal regulation requiring periodic updates was enacted in 1980.

By letter dated April 12, 1996, Mr. Charles D. Frizzle, President of the Maine Yankee Atomic Power Company, submitted Revision 12 to Maine Yankee's FSAR to the NRC.

Information added to the FSAR can only be eliminated by a subsequent revision if it is superseded or otherwise no longer applicable. The most recently updated FSAR should represent a cumulative compilation of information applicable to the current plant configuration making it unnecessary to refer to previous revisions. UCS reviewed Maine Yankee's FSAR Rev. 12 with particular focus on the following sections considered most likely to be affected by the subject analyses:

6 Engineered Safeguards 6.2.2.1 High Pressure Safety Injection [HPSI] System 6.2.2.2 Low Pressure Safety Injection [LPSI] System 6.2.2.3 System Actuation 6.2.3.1 High Pressure Safety Injection Pumps 6.2.3.2 Low Pressure Safety Injection Pumps 6.2.4 Design Evaluation 6.2.5 System Reliability Table 6.2.1 LPSI Pumps Table 6.3.1 Containment Spray Pumps 7.3.2 Safety Injection System 9.1.3.4 Safety Injection 9.1.4.7 Safety Injection 9.9 Residual Heat Removal [RHR] System Union of Concerned Scientists January 29, 1997 Page 5

Maine Yankee's FSAR Problem Section 6.2.4, "Design Evaluation," contains a lengthy listing of design features for the HPSI and LPSI systems, but minimum flow provisions for the pumps is not described. Section 6.2.5, "System Reliability," indicates that the H1PSI and LPSI pumps are provided with a recirculation line for periodic testing, but does not describe the minimum flow function and associated flow requirements.

Table 6.2.1 reports a minimum flow of 350 gpm for the LPSI pumps. Table 6.3.1 lists design parameters for the containment spray pumps, but does not address minimum flow requirements.

Section 9.9 describes design parameters for the RHR pumps, but does not mention minimum flow requirements.

Based upon a diligent review of Maine Yankee's most recent updated FSAR, UCS concludes that analyses performed by Maine Yankee in response to NRC Bulletin 88-04 and NRC's Inspection Report 50-309/90-23 have not been incorporated into appropriate FSAR sections as required by 10 CFR Section 50.71(e).

NRC Inspection Report No. 50-309/90-23 and Maine Yankee's responses to Bulletin 88-04 described minimum flow requirements for safety pumps based on manufacturers' recommendations. The minimum flow configurations as described in these documents rely upon flow control valves and/or restricting orifices and also upon limiting run-times at low pump flow. Adequate minimum flow protects pumps from damage so they can supply cooling water to the reactor. Excessive minimum flow diverts water from reactor vessel makeup and core cooling functions. Thus, proper minimum flow is essential in order for the emergency core cooling systems to fulfill their vital safety functions.

Maine Yankee's updated FSAR does not contain required information on the safety pumps' minimum flow design bases.

NRC Bulletin 88-11 On December 20, 1988, the NRC issued Bulletin 88-11, "Pressurizer Surge Line Thermal Stratification" to all holders of operating licenses for pressurized water reactors. According to the NRC's Information Digest (1995 Edition), the NRC issued Maine Yankee, a pressurized water reactor, a full power operating license on June 29, 1973. Therefore,Bulletin 88-04 applied to Maine Yankee.

The required actions specified in Bulletin 88-11 included:

"Within four months of receipt of this Bulletin, licensees of plants in operation over 10 years (i.e., low power license prior to January 1, 1979) are requested to demonstrate that the pressurizer surge line meets the applicable design codes and other FSAR and regulatory commitments for the licensed life of the plant, considering the phenomenon of thermal stratification and thermal striping in the fatigue and stress evaluations. This may be accomplished by performing a plant specific or generic bounding analysis. If the latter option is selected, licensees should demonstrate applicability of the referenced generic bounding analysis." [emphasis added]

By letter dated December 13, 1991, S. E. Nichols, Manager - Licensing & Engineering Support Department, Maine Yankee Atomic Power Company, submitted Maine Yankee's response to Bulletin 88-11 to the Nuclear Regulatory Commission. This response indicated:

"Action lb of Bulletin No. 88-11 requested that an analysis be performed to demonstrate that the pressurizer surge line meets the applicable design codes and other regulatory requirements Union of Concerned Scientists January 29, 1997 Page 6

Maine Yankee's FSAR Problem for the licensed life of the plant when considering the phenomenon of thermal stratification and thermal striping. References (f) and (g) contain NRC audit comments to Maine Yankee's initial structural analyses incorporating the stratified surge line flow effects. These comments have been incorporated into and/or addressed by recently completed revised analyses. The revised Maine Yankee analyses for generic surge line qualification criteria were conducted by and included in the Combustion Engineering Owners Group (CEOG) work documented in Reference (j). Qualification concerns unique to Maine Yankee (support adequacy, clearances, etc.) were evaluated and documented in accordance with Maine Yankee's Procedure 17-226,

'Technical Evaluations." The results of the revised analyses verify that the Maine Yankee surge~line, when including the effects of thermal stratification and striping, satisfies appropriate ASME code criteria for a forty (40) year design life." [emphasis added]

Therefore, analyses were performed by or on behalf of Maine Yankee in response to the NRC's request on the safety issues described in Bulletin 88-11.

Maine Yankee's FSAR has been revised 12 times since the federal regulation requiring periodic updates was enacted in 1980. By letter dated April 12, 1996, Mr. Charles D. Frizzle, President of the Maine Yankee Atomic Power Company, submitted Revision 12 to Maine Yankee's FSAR to the NRC.

Information added to the FSAR can only be eliminated by a subsequent revision if it is superseded or otherwise no longer applicable. The most recently updated FSAR should represent a cumulative compilation of information applicable to the current plant configuration making it unnecessary to refer to previous revisions. UCS reviewed Maine Yankee's FSAR Rev. 12 with particular focus on the following sections considered most likely to be affected by the subject analyses:

4.2 Design Bases [Reactor Coolant System]

4.7.2 Design Cyclic Loads 4.2.5.3 Design Loads 4.3.7 Pressurizer Table 4.3.7 Pressurizer Parameters 4.4.2 Prevention of Brittle Fracture 4.5.4 Additional Tests Section 4.7.2, "Design Cyclic Loads," describes the heatup and cooldown cycles for the reactor coolant system along with a number of other design bases thermal cycles. The pressurizer surge line thermal stratification analyses, including their fundamental assumptions and results, performed in response to Bulletin 88-11 are not described. Section 4.2.5.3, "Design Loads," provides extension coverage of the low pressure overpressurization analyses, but does not mention the pressurizer surge line thermal stratification analyses. On page 4-25, it is reported that "A small continuous flow is maintained through the spray lines at all times to keep the spray lines and surge line warm, reducing thermal shock during plant transients," but no mention is made of the analyses performed in response to Bulletin 88-11. Finally, the only references listed on page 4-50 dated after 1981 are documents associated with the capsule surveillance program.

Based upon a diligent review of Maine Yankee's most recent updated FSAR, UCS concludes that analyses performed for Maine Yankee in response to NRC Bulletin 88-11 have not been incorporated into appropriate FSAR sections as required by 10 CFR Section 50.71(e).

Union of Concerned Scientists January 29, 1997 Page 7

Maine Yankee's FSAR Problem According to the NRC in Bulletin 88-11, pressurizer surge line stratification is a safety concern because:

"Unexpected piping movements are highly undesirable because of potential high piping stress that may exceed design limits for fatigue and stresses. The problem can be more acute when the piping expansion is restricted, such as through contact with pipe whip restraints. Plastic deformation can result, which can lead to high local stresses, low cycle fatigue and functional impairment of the line. Analysis performed by the Trojan licensee indicated that thermal stratification occurs in the pressurizer surge line during heatup, cooldown, and steady-state operations of the plant." [emphasis added]

The analyses performed for Maine Yankee in response to this bulletin indicated that the existing piping configuration did not produce unacceptable fatigue or stresses. However, these conclusions apply to the plant configuration at that time and remain valid only if there are no changes to the plant configuration and the underlying assumptions in the analyses. By failing to update the FSAR to incorporate these analyses, Maine Yankee is violating federal regulations and setting the stage for a future activity (e.g., modification to a pipe whip restraint, revising procedures controlling heatup, cooldown and steady-state operations, or plant license extension) creating an unsafe condition.

Conclusions and Recommendations NRC Bulletins 88-04 and 88-11 required Maine Yankee to perform analyses of safety issues. Maine Yankee's responses to these bulletins indicate that the analyses were completed. A review of Maine Yankee's Final Safety Analysis Report (FSAR) revealed that this document has not been updated to reflect the analyses of these safety issues as required by federal regulations.

The concern is not that Maine Yankee failed to adequately evaluate the safety issues described in the NRC Bulletins. The concern is that these safety analyses have not been incorporated into Maine Yankee's FSAR and that safety decisions am being made using this incomplete and inaccurate document.

The FSAR is an important source and reference document that is used daily at nuclear power plants.

It is a source document for benchmarking control room simulators, writing emergency procedures, developing lesson plans, conducting probabilistic risk assessments, and performing numerous other activities. It is a reference document for determinations if proposed changes to the plant and its procedures can be made without adversely affecting safety margins and for safety inspections conducted by the NRC.

An incomplete and inaccurate FSAR corrupts all of these efforts. It might be claimed that updating the FSAR to include safety analyses required by the NRC is not necessary because the relevant information has been shared with the NRC and is available. However, as pointed out by James M.

Taylor, NRC Executive Director for Operations, in memo SECY-95-300 dated December 20, 1995:

"Those commitments not contained in the FSAR are not controlled by a defined regulatory process such as 10 CFR 50.59. Therefore, licensees have the ability to change docketed commitments not contained in the FSAR without informing the Commission." [emphasis added]

Union of Concerned Scientists January 29, 1997 Page 8

Maine Yankee's FSAR Problem It is theoretically possible that everyone using the FSAR as a source or reference document also reviews correspondence to and from the NRC to extract applicable information from safety analyses performed at the NRC's request. It is extremely improbable that this considerable effort is made every time. Therefore, UCS concludes that nuclear safety decisions at Maine Yankee have probably been made using inaccurate information contained in its FSAR.

The failure to incorporate the results of safety analyses into Maine Yankee's FSAR is not just a paper problem. It may have concrete and serious safety repercussions. For example, Maine Yankee's response to NRC Bulletin 88-04 indicated that the plant's configurationfwas adequate to prevent safety pumps from suffering damage at low flow conditions. The justification for this conclusion was based on analyses showing that the pumps can operate for limited periods at low flows. However, since the information from these analyses has not been incorporated into the FSAR, it is presumably possible that the safety pumps could be damaged if they were operated at low flow conditions for a longer time, such as during testing. The individuals writing, approving, and performing such testing may be misled into believing the testing conditions are safe because Maine Yankee's updated Final Safety Analysis Report neither describes any operating limitations nor references the safety analyses containing those limitations.

Another example of the safety implications from using inaccurate FSAR information when making nuclear safety decisions occurred at TVA's Browns Ferry Nuclear Plant in the early 1980's. Several of the plant's safety relief valves were leaking badly, allowing steam to escape from the reactor vessel into the suppression pool water. An analysis was performed to calculate the worst-case heatup rate and applied to expected conditions after an accident to determine when the suppression pool water's maximum temperature limit would be reached. In light of this analysis, emergency procedures were revised to instruct the operator to use a backup safety pump and heat exchanger to cool the suppression pool water, thus preventing its temperature limit from being exceeded. The FSAR was not updated to reflect this necessary operator action. Subsequently, it was discovered that the "backup safety pump" had been relied upon to resolve two or three other plant problems. Each use was fully justified, but the single "backup safety pump" was being asked to perform three or four essential functions at the same time. Because the FSAR had not been updated to reflect any single analysis, everyone sincerely believed the backup pump was available to correct his particular problem.

Everyone was wrong, and different corrective actions were required.

UCS concludes that incomplete and inaccurate information in Maine Yankee's FSAR could contribute to the inadvertent reduction and elimination of necessary safety margins.

Union of Concerned Scientists January 29, 1997 Page 9

Maine Yankee's FSAR Problem The following actions are necessary to correct Maine Yankee's FSAR problem:

1) All analyses of safety issues required by the NRC at Maine Yankee from July 22, 1980, to date must be identified. These analyses may have been requested by the NRC in bulletins, but also by NRC requests for additional information, inspection report findings, orders, confirmatory action letters, promulgation of 10 CFR 50.63 on station blackout, generic letters, demands for information, and other vehicles.

2) The Maine Yankee FSAR must be updated to incorporate applicable information from these safety analyses.

3) Changes to the plant, the Maine Yankee operating license, and procedures implemented since July 22, 1980, must be reviewed against the material being incorporated into the FSAR via task 2 above to confirm that the revised information does not invalidate safety evaluations performed to support the changes.

4) Maine Yankee's Individual Plant Examination (IPE) should be reviewed to confirm that its risk assessments are based on the actual plant configuration and operating procedures.

The first two tasks yield an updated FSAR to comply with 10 CFR Section 50.71(e). The last two tasks ensure that activities at Maine Yankee that used its inaccurate FSAR did not inadvertently reduce safety margins. Maine Yankee's response to Mr. Taylor's request under 10 CFR 50.54(f) dated October 9, 1996, cannot satisfy these tasks because the source document used to prepare that response, the FSAR, is deficient. Maine Yankee's FSAR lacks the required information on safety analyses performed at the request of the NRC. It is extremely difficult to review a document and identify missing information without first establishing what it must contain (i.e., task 1 above).

In granting Maine Yankee Atomic Power Company an operating license for Maine Yankee, the Atomic Energy Commission (the predecessor to the NRC) reported that it had found "reasonable assurance (i) that the activities authorized by this operating license can be conducted without endangering the health and safety of the public, and (ii) that such activities will be conducted in compliance with the rules and regulations of the Commission" [emphasis added]. By failing to fulfill its legal obligation to update the FSAR for safety analyses performed since 1980, UCS concludes that Maine Yankee Atomic Power Company may have unnecessarily endangered public health.

Based upon observation and experience, UCS believes that Maine Yankee's FSAR problem affects the majority, if not the entirety, of nuclear power plants. It is imperative that the NRC seriously evaluate the safety implications of 108 other nuclear power plants operating with procedures, training, risk assessment and modifications developed and evaluated using potentially inaccurate FSARs.

Additionally, the NRC must revise its internal procedures to provide appropriate guidance to its inspectors to ensure that nuclear utilities updated their FSARs to incorporate safety analyses as required by law.

Union of Concerned Scientists January 29, 1997 Page 10