470th Advisory Committee on Reactor Safeguards (ACRS) - March 1, 2000
UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
MEETING: 470TH ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
(ACRS)
U.S. Nuclear Regulatory Commission
11545 Rockville Pike
Room T-2B3
White Flint Building 2
Rockville, Maryland
Wednesday, March 1, 2000
The committee met, pursuant to notice, at 1:00
p.m.
MEMBERS PRESENT:
DANA A. POWERS, ACRS Chairman
GEORGE APOSTOLAKIS, ACRS Vice-Chairman
THOMAS S. KRESS, ACRS Member
MARIO V. BONACA, ACRS Member
JOHN J. BARTON, ACRS Member
ROBERT E. UHRIG, ACRS Member
WILLIAM J. SHACK, ACRS Member
JOHN D. SIEBER, ACRS Member
ROBERT L. SEALE, ACRS Member
GRAHAM B. WALLIS, ACRS Member
P R O C E E D I N G S
[1:00 p.m.]
CHAIRMAN POWERS: The meeting will now come to
order.
The is the first day of the 470th meeting of the
Advisory Committee on Reactor Safeguards. During today's
meeting the committee will consider the following.
Development of Risk-Informed Revisions to 10 CFR Part 50,
"Domestic Licensing of Production and Utilization
Facilities." The committee will look at proposed reports
and discuss topics for the meeting with the NRC
Commissioners on Thursday, March 2nd.
This meeting is being conducted in accordance with
the provisions of the Federal Advisory Committee Act. Dr.
John T. Larkins in the Designated Federal Official for the
initial portion of the meeting.
We have received no written statements from
members of the public regarding today's session. We have
received a request from Mr. Bob Christie of Performance
Technology for time to make oral statements regarding the
development of risk-informed revisions to 10 CFR Part 50.
A transcript of portions of the meeting is being
kept and it is requested that speakers use one of the
microphones, identify themselves, and speak with sufficient
clarify and volume so that you can be readily heard.
I am going to begin by drawing the members'
attention to the items of interest. You may want to pay
particular attention to the alert at Indian Point 2 and to
look at some of the civil penalties imposed in connection
with misidentification of plant status. Think of those in
terms of the performance indicators, which has a three
strikes and you're out clause, versus one strike you're out
clause.
Also, members may be interested in an article that
appeared in the Energy Daily on NRC Staff opinions
concerning the Reactor Oversight Program.
Are there any comments the members would like to
make before we enter into today's discussion?
[No response.]
CHAIRMAN POWERS: Well, in that regard, our first
topic for the meeting is a relatively simple subject. It is
development of risk-informed revisions to 10 CFR Part 50,
and George, you are going to give us a quick thumbnail tour
of this?
DR. APOSTOLAKIS: Yes. My problem is I don't see
the Staff here.
MR. MARKLEY: The Staff is not here.
DR. APOSTOLAKIS: Well, there is a problem with
the times, because here it says 1:20; this says 1:00.
CHAIRMAN POWERS: Okay. Well, while we are
waiting I will call the members' attention to the proposed
letters, and we have several -- I guess a total of seven,
seven letters that we are trying to do.
[Discussion off the record.]
CHAIRMAN POWERS: Are we in a position to go
ahead?
DR. APOSTOLAKIS: Mary, are we ready to start?
MS. DROUIN: Absolutely. Do I have a choice?
[Laughter.}
DR. APOSTOLAKIS: Always, ask Mark. Is Mr. King
coming as well?
MS. DROUIN: He will be late.
[Discussion off the record.]
DR. APOSTOLAKIS: Okay, this session comes back
to, as the Chairman said, an easy subject, so it should be a
breeze. Risk-informing 10 CFR Part 50, Domestic Licensing
of Production and Utilization Facilities.
Today's session will be only a briefing session.
I understand there is no request for a letter or anything.
And you can focus this a little bit. And the
discussion will also be focused, in addition to the
projector, on Option 3, I understand, correct?
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: And you held the workshop last
week with stakeholders. You plan to brief us on that one, I
hope. So without further ado, the floor is yours.
Introduce everyone at the table, first, please.
MS. DROUIN: Yes. I'm Mary Drovin with the Office
of Research. To my left is ...
MR. KURITZKY: Alan Kuritzky.
MR. CUNNINGHAM: Mark Cunningham from the Office
of Research.
CHAIRMAN POWERS: Do we know you, sir?
MR. CUNNINGHAM: We've met somewhere in the past,
vaguely, I believe, yes.
MS. DROUIN: As was mentioned, we are just here to
give a briefing of the status of where we are on Option 3 on
risk-informing the technical requirements of Part 50. We
aren't at this time requesting a letter from the ACRS on
this. It's just a briefing to let you know where we are.
DR. APOSTOLAKIS: You will tell us when you will
request a letter, what your plan is for future activities?
MS. DROUIN: Yes, we're going to go through future
activities.
DR. APOSTOLAKIS: Okay.
MR. CUNNINGHAM: The short answer is, probably
this Fall sometime.
DR. APOSTOLAKIS: Okay. So I can start writing
it.
MS. DROUIN: As you mentioned, we did have a
workshop last week. We're going to talk about what we felt
or what we thought we heard was the feedback from the
various stakeholders at the workshop.
We will also talk about the scope, the approach,
and what progress we have made to date over the last four
months, and where we plan to go, particularly over the next
three months, because we have identified a new milestone for
the June timeframe; and then where we plan to be by the end
of December.
So are our future plans, but our future plans in
terms of this calendar year.
Just briefly, as you know SECY 99-264 was issued
last Fall. That went through what our plan was for
risk-informing the technical requirements. It had a
schedule in there of what our major milestones were, and
this is what went forward to the Commission.
And we received an SRM this past February that
gave us approval to move forward with our plan, and also if
there was something we could identify in an expedited
manner, to also do that. And we were, of course, encouraged
to maintain communication with and input from stakeholders.
We're doing that through various mechanisms. One
of them is through workshops. We had a second workshop
which was last week. We had our first workshop back in
September, and we have also implemented a website which is
up and running.
If you want to access the website, you go to the
NRC website and click on nuclear reactors, and there will be
a line there that says risk-informed Part 50, Option 3. You
can click on that.
As we create things that we feel are ready to
start sharing with the public, we have been putting in on,
and a lot of what you see today has already been put on that
website and has been on there for about a month.
In looking at risk-informing Part 50, the
technical requirements, when we talk about risk-informing
it, there are three approaches or -- I'm not sure what the
correct word is here to use -- but we aren't talking about
just revising, necessarily.
We certainly are talking about revising where
that's appropriate. But it also might be considering adding
new requirements or expanding where we think is necessary,
and also deleting unnecessary requirements.
So there are three aspects to it when we talk
about revising. And the change might also entail a deletion
or addition, depending on what is the most appropriate as we
look at the risk significance of the different requirements.
We aren't covering fire protection. There are
already a lot of efforts going into that, and also out of
the scope is emergency planning.
CHAIRMAN POWERS: Could you explain that to me?
You say there's a lot of effort going on in fire protection.
It's proving to be a fairly significant potential initiator
accidents, and certainly not negligible, certainly not
outside of the cut sets of the kinds of things that you are
worried about.
There has been in an interest in the past in some
quarters on risk-informing Appendix R, and a candidate
Appendix S was actually generated by some people. I don't
know that it is consistent with the kind of risk information
that you're talking about here, but it certainly was a cut
in that direction.
Why wouldn't you address fire protection?
MR. CUNNINGHAM: I think that the basic thing was
that there were parallel activities already underway in NRR
to risk-inform the fire protection requirements, so in a
sense, they were one step ahead of us in this. They had
already made the decision to start down that road and try to
modify the fire protection requirements.
So there wasn't a need for us to do it. It's not
that it's not important; it's just that they were already
working on it.
MR. KURITZKY: I think also that the contribution
to risk from fire sequences is being included in our
evaluation. We're looking at full-scope PRAs.
We're looking at shutdown also, and --
CHAIRMAN POWERS: When you say a full-scope PRA,
what does that mean?
MR. KURITZKY: We're looking at internal and
external events. We're looking at full-power operation and
low power and shutdown states also. I mean, ideally, we
want to address the entire PRA model.
CHAIRMAN POWERS: So you have a model for all of
these things?
MR. KURITZKY: Well, what we're doing is, when we
make our risk-informed decisions, what we're going to do is
look for the basis for what we're going to make our
decision. It should hopefully not rely just on information
on, for instance, internal events PRAs for Level I.
Obviously, that's where we have the most
information, and so that's going to be a major driving
forces, but where available, we would also like to bring in
insights from other modes of operation, and also other,
external events.
CHAIRMAN POWERS: I guess I'm perplexed. That
happens a lot. It seems to me that Mr. Cunningham here was
in a group that came to us and made us a very clear
presentation at one time that said when you're making
risk-informed decisions on ranking pieces of equipment and
things like, that you ran into a problem.
If there was a problem disparity in the level of
conservatism in your PRA, that is, if you were realistic in
one quarter and then you put in a bunch of conservative
bounding things, that the kinds of predictions you got out
of it that were useful for ranking were probably not
reliable; they were questionable.
And now you're telling me I'm going to do a
full-scope PRA, but there are some things that are stronger
and some things that are weaker, which I assume must be
similar to some things are treated realistically and some
things are treated very conservatively.
And that goes into your decisionmaking process.
Don't you run into the same kind of dubious input to the
decision when -- in what Mr. Cunningham spoke of earlier?
MR. KURITZKY: Yes, I would say that you obviously
are going to come into those types of situations where we
have inconsistency in the level of information.
But what we're doing is, unlike maybe a ranking --
and I wasn't there during that discussion -- in a ranking
where you want to have everything on the same level playing
field.
Here we're taking insights into the information.
If we have more confidence in a certain type of information
that we have available to us, we'll place more emphasis on
it.
But that doesn't mean we're going to ignore other
areas of information, just because we don't have as much
confidence in them.
We may tailor the impact that has on our
decisionmaking, based our confidence in that information,
but it doesn't mean that we would want to exclude that.
CHAIRMAN POWERS: After you're done with these
decisionmaking processes, is there going to be a document
that I can read that says, okay, we had this information and
we had confidence level 10 on it, and we had this
information over here and we had confidence level .2 on
this, and therefore the weighting factors were roughly the
reciprocals of those or something like that?
MR. KURITZKY: To my knowledge, we're not
attempting to quantify that type of information.
CHAIRMAN POWERS: So it would be impossible for
anyone to replicate your decisionmaking?
MR. KURITZKY: Well, we hopefully supplied the
basis, and maybe in qualitative form. The process you're
discussing would be some type of actual quantifying, ranking
the importance of different types of input information.
What I'm speaking of is just in a qualitative
sense.
MR. CUNNINGHAM: As you may recall, we talked a
number of times about the whole issue of expert panels being
used by decisionmakers, mostly in the context of licensee
expert panels.
One of the things -- if I can go back to Reg Guide
1.174 space, I think we tried to say that there needs to be
some sort of documentation of that expert panel to the point
you can get some sense of how they made certain decisions.
Again, it's not going to be quantitative, I
suspect, but we had a goal that you could, if not replicate,
at least try to get an understanding of why certain
decisions were made.
CHAIRMAN POWERS: Here's what I'm interested in:
Suppose that I'm a member of the public, and I look around
and, for instance, you say, gee, you can not worry too much
about fire barrier penetration seals. Now, I understand
you're not going to treat fire, but let me use that example,
because it's particularly germane to the point I want to
make.
And I know from my own experience that fire
barrier penetration seals sound like pretty important
things. They keep fire from spreading.
And these guys are saying that they're of low risk
significance, and I need to understand more about this
because it's contraintuitive. I think you can't preclude
getting contraintuitive results coming out of risk
assessments because that's been the great attraction; that
they're better than our intuition.
Am I going to be able to go back and say, yes, now
I -- verily, I know my intuition about fire barrier
penetration seals was wrong, and I agree with them, that,
verily, they can go to low-risk significance? I don't know
that they are, but it's just an example.
MR. CUNNINGHAM: I guess that, again, in the
context of licensees making decisions like that, presumably
they ought to be developing that documentation.
I think that what Alan was talking about earlier
was how -- and what we started off on here was if we go in
and decide that a certain regulation does or doesn't merit
change, how do we make the decision process a little more
transparent than it might otherwise be, and how do we decide
how we consider shutdown risk and that sort of thing?
That's a fair question. I don't think we've
thought much about how we would lay out all those decisions
and document those decisions.
But I think it's an important element of making a
convincing case.
DR. SEALE: I have a question. Maybe you guys
have hidden some pretty significant commitments in this
slide. In particular, there is the recognition that you may
be adding new requirements, and you may be deleting old
requirements.
Now, I personally concur with the point that it
makes no sense to go through such an enormous effort like
this clearly is, without exerting some hindsight-driven
quality control on the relevance of some of the things that
are in Part 50.
Yet the other side of that is that you -- those
processes of making those kinds of changes are, in my
understanding, fairly formal and fairly detailed.
Essentially, you're rulemaking.
MS. DROUIN: Okay, we're going to get into some of
that later.
DR. SEALE: You're going to tell us how much of
that you've bitten off in going into this; is that right?
MS. DROUIN: We're going to have a whole
discussion here on implementation issues.
DR. SEALE: Okay, fine.
MS. DROUIN: Which will address that.
DR. APOSTOLAKIS: I have another question: We
have seen Mary and Mark many times. Alan, you're new here.
The standard question is, what qualifies you to
sit over there?
MR. KURITZKY: Because Mary told me to come here.
[Laughter.]
DR. APOSTOLAKIS: That's not a qualification;
that's why you came. So can you give us a little bit of
your background?
MR. KURITZKY: Yes. I started in the PRA field
out of college in 1981. And I have worked --
DR. APOSTOLAKIS: '81?
MR. KURITZKY: '81. I worked on a lot of PRA,
both in this country and overseas. And I have worked for a
number of contracting companies. I worked as a contractor
at Northeast Utilities, Mr. Banaca. And I have -- I worked
for two years at the NRC, many, many years ago, and I have
since come back in November. And since I've come back, I've
been involved in this risk-informing technical requirements
for Part 50 as the Project Manager.
DR. APOSTOLAKIS: Good. Thank you.
MR. CUNNINGHAM: In his early days at NRC, many
years ago, he was involved in providing -- helping develop
the technical basis for the station blackout rule. So lest
he be overly modest there --
DR. APOSTOLAKIS: Which college did you attend?
MR. KURITZKY: Maryland, University of Maryland.
DR. APOSTOLAKIS: Thank you very much. Let's go
on.
MS. DROUIN: Okay.
DR. APOSTOLAKIS: You're going very slowly, Mary.
You're still --
MS. DROUIN: Yes. I will try to make up for that.
Probably the two points I want to make on this slide before
we move on, is that we aren't just looking at the
regulations themselves, but we are looking at the
implementing documents that are associated with these
regulations.
So we would be looking at the Regulatory Guides,
the Standard Review Plans, but also looking at how the
regulations interact with each other. So we're going to be
talking more on 50.44, but whatever regulation we may be
looking at, we not only look down, but we also look across
to see how it interfaces, interrelates with other
regulations.
The last point is that we do intend to keep the
design basis concept. We might have a new set of design
bases, but to maintain a design basis concept. Now, I'm
trying to move on to the next one.
CHAIRMAN POWERS: It perplexes me. Please go
ahead, because it will come up on the next one as well, I
think. I mean, it just strikes me as surprising to hear
someone so clearly identified with probabilistic risk
assessment methodologies, speak at all with complimentary
words about design basis concepts.
And it seems to me that the two have an
orthogonality to them. Can you tell me why you're
preserving the design basis concept? I mean, it doesn't
show up. 1.174 says preserve the defense-in-depth, but it
doesn't seem to mention anything about preserve the design
basis concept. Why are you doing that?
DR. SEALE: It's a robust subset.
MS. DROUIN: I don't even know where to begin.
CHAIRMAN POWERS: Well, begin by telling me why
it's a useful concept. Because haven't -- isn't the whole
point of the risk informed approach to take a holistic view
of the vulnerabilities of a plant, rather than focusing on
one hypothesized accident or a set of hypothesized
accidents?
MS. DROUIN: But I do think that it is
fundamentally a good design concept to design something
against something. I think you want those to be where you
think your most likely accidents are going to occur.
CHAIRMAN POWERS: Why can't I design against a
risk metric? I can design against a hurricane and what I do
is I go out and figure out what is the biggest hurricane
that I can have and high velocity winds and I say, okay,
that is what makes the difference.
Why can't I equally say, gee, I want the risk to
be 10 to the minus third or less. I mean that seems like a
good design to objective.
MS. DROUIN: I think you are now moving more into
a design -- a risk-based more than a risk-informed concept
here, when you start bringing in that kind of idea.
CHAIRMAN POWERS: Okay, so you just didn't want to
be accused of being risk-based. You wanted to have some
defense that said I am only risk-informed so I will keep the
design basis concept?
MS. DROUIN: No.
[Laughter.]
CHAIRMAN POWERS: Okay. Can you un-perplex me?
MS. DROUIN: I am going to let Mark un-perplex you
because I don't think I am going to be successful.
MR. CUNNINGHAM: I guess a couple of points. One
is if we back up a little bit, you recall that our
implementation of the modifications to the technical
requirements of Part 50 is intended will likely end up in
many cases being a voluntary initiative, so one of the
reasons for not walking away from the design basis accident
type of concept is that the more you walk away from that to
go to a more, if you will, risk-based argument, the more you
will see a differentiation or separation between the plants
that choose not to be risk-informing and the plants that
are, and that may complicate this whole process even more
than it already is.
CHAIRMAN POWERS: I would have thought the
argument would go the other way. I mean a proponent of
abandoning the concept would say yes, let's make a clear
differentiation and not get a confusion by retaining this
anachronistic concept of the design basis accident in these
plants that are risk-informed.
DR. APOSTOLAKIS: What exactly does it mean to
retain the design basis concept?
MR. CUNNINGHAM: What we are talking about again
is that there are a set of design basis accidents on the
books and then there is what has become a stylized
implementation of those design basis accidents. I think at
the conceptual level those provide some sort of measure of a
way of implementing the concepts of defense-in-depth and
margins and that sort of thing.
Where people have had problems with them, one of
the reasons people have problems with them is that the
probabilities of some of the accidents are extremely low and
they are stylized to the point that they convolute the
single failure criterion into many, many different systems
and things like that and it becomes a very artificial and
improbable circumstance, so the idea of retaining the
concept is you might be able to back off on this particular
types of -- detail types of accident that you consider, but
you want to still have some sort of a concept where you are
having defenses against a broad spectrum of accidents,
different types of initiators, if you will, and retaining
margins and defense-in-depth and that sort of thing, but
again perhaps developing a new set of accidents that might
have more sense in the context of what we understand about
risk.
DR. APOSTOLAKIS: New sets in the sense that we
have new initiators or a new way of doing this stylized
analysis?
MR. CUNNINGHAM: It could be -- I was thinking of
new initiators perhaps.
DR. APOSTOLAKIS: New initiators?
MR. CUNNINGHAM: Well --
DR. APOSTOLAKIS: My first reaction to that would
be what's wrong with the current initiators? I mean you
still have to worry about the various LOCAs.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: We have to worry about
reactivity insertion, don't you?
MR. CUNNINGHAM: Maybe we are just at semantics
here.
DR. APOSTOLAKIS: You may want to add or subtract
or something a group --
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: -- but it seems to me though the
place where you can really make a difference is this
stylized emphasis.
MR. CUNNINGHAM: I guess that is what I meant --
DR. APOSTOLAKIS: Okay.
MR. CUNNINGHAM: -- when I said you can have a
large LOCA as initiator but compounded with that over years
has become that you have to have this type of failure and
this type of failure and loss of offsite power and that set
of things put together creates an accident sequence, if you
will, of extremely low probability or frequency. You may be
able to redesign -- you may be able to keep the large LOCA
but better design the requirements for the mitigating
systems and things like that to be more balanced based on
our knowledge of PRA.
CHAIRMAN POWERS: Isn't it just -- I mean you
don't end up in the same position -- you come back and say,
okay, I am going to keep this large LOCA concept and most of
the plants say, well, gee, our big pipes just don't break,
but okay, he wants to analyze big pipes, and to be realistic
he says do this and this, but my plant doesn't have that.
My plant is different from the one that they had in mind
when they did this. Now what do I do? Whereas if you gave
me a risk criterion, then I could pick any accident I wanted
to.
MS. DROUIN: Well, I don't think you necessarily
end up at the same place, because if you look at the large
break LOCA, what we are talking about is maybe when you talk
about a large break LOCA you are not talking a large
double-ended guillotine type break LOCA. It is a different
type LOCA. Now which it is I am not prepared to say at this
point, but it is not this extreme case.
CHAIRMAN POWERS: Whatever you write down about
this, this new design concept, as soon as you write it down,
some plant somewhere is going to say, ah, but my plant is
different. Now you are back into -- I mean you have got to
do something about this guy because he says my plant is not
only different, it is better than the one you had in mind
and this stuff is not applicable to me.
Well, why don't you want a regulation that applies
to anybody? The nice thing about a risk criterion is that
it applies to anybody. Even if I come in with an LMFBR and
natural enrichment fuel with heavy water as the secondary
working fluid, I don't know why you would, but if you did,
it would be just as easy for you.
MR. CUNNINGHAM: You know, perhaps the classic
example -- when we talked about having a criteria, a core
damage frequency criteria and/or a risk criterion is the
example that is always brought up is that there was a
proposal at one time to have HDGRs, modular HDGRs -- I
believe this was a DOE proposal -- that the reactor vessel,
the concrete reactor vessel would act as the containment.
They wanted to know whether that could be licensed by NRC
standards and because of defense-in-depth arguments and
things like that we basically said no, you have got to have
a containment. I don't care what the probability of
frequency of core damage is, you are going to have a
containment.
That is probably some of the underlying thought
that went into if we want to keep this design basis concept.
DR. APOSTOLAKIS: You may get a license
application, say five years down the line, of the new South
African design, the pebble bed reactor --
MR. CUNNINGHAM: Yes.
CHAIRMAN POWERS: They claim that there is no need
for a containment, so the question then for the Agency will
be do we really demand it no matter what or do we look at
what they have done and do the regulations that allow us to
do something else?
But I think the concept of design basis accidents
is really an important one, so I don't know why you decided
to say that you retained the concept, although concept of
course can be many things.
Mary's point earlier that you really need to give
something to the designers to design against, which goes
beyond I guess what you meant, it goes beyond what Dr.
Powers said, just 10 to the minus 4 core damage frequency,
for example, or some allocation to the accident sequences,
that is not something we should abandon easily.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: But how far we go I don't know.
Mario?
DR. BONACA: I still believe that somehow you have
to at some point design equipment -- pumps, valves and so on
and so forth. Now I do believe that if you look at, if you
use risk informed concepts you are going to find that what
you are going to design this equipment to is to a different
kind of targets, objectives, because you are not going to
have double-ended guillotine break as the one defining the
size of your HPSIs and LPSIs. Most likely you are going to
have a more probable range of conditions you are going to
address, but you know I would expect that I can live with
the concept of design basis. It may shift as a basis and it
may include probabilistic targets which you are talking
about, but still you would have to have some basis to design
your equipment.
CHAIRMAN POWERS: Regulators do not tell people
how to design things in detail, and so maybe a designer does
say okay, I have this risk criterion that I have to meet,
but because I want to get on with the design and things like
that I will conceive of some accidents that are possible at
my facility and I will design against them and then I will
get my PRA analysts and they will tell me if I meet the
criterion or not, but in the meantime I can do some fairly
traditional things against those.
I mean I am not taking those away from the
designer --
DR. BONACA: I understand now, because I didn't
understand before, so what you are saying is rather than
regulating the set of events that the designer is using to
demonstrate that certain targets are met you simply impose
certain targets. Oh, absolutely. That is a different
concept, yes.
DR. APOSTOLAKIS: But we have said many times that
this is not the only thing the Agency cares about. We may
not be designers but we do care about many more things than
just the core damage frequency.
CHAIRMAN POWERS: Yes, but is going to a design
basis concept the way to get to that? These other things
that we consider, that are concerned about besides core
damage frequency, is the appropriate way to get to them via
the design basis concept. I think that is a very
convoluted --
DR. KRESS: Yes, I think you are right, Dana. I
would define regulatory objectives, those other things, and
make those as part of the criteria that have to be met, but
they certainly wouldn't be specified because they are hard
to meet by design basis accidents.
DR. BONACA: But you would want to make sure that
the licensee, for example, considers a set of events that is
broad enough.
DR. KRESS: Well, that is the PRA. That is the
PRA.
DR. APOSTOLAKIS: That's the defense-in-depth
issues that come up and so on.
DR. BONACA: With PRA again, yes --
DR. APOSTOLAKIS: I guess what we are telling them
is that instead of saying we retained the design basis
concept, which really is a concept of bottom-up, we are
telling them to go top-down.
CHAIRMAN POWERS: Well, I think I would just like
to see a little more persuasive case. What I am afraid of
is exactly what we have seen, that they have chosen to
retain the design basis to meet objectives that are not
articulated, and if they have, it may well be that that is
the way to do them, but I would like to see what the
objectives are and why this is the preferred way to handle
it, because I see a lot of downside to retaining the
concepts of design basis.
The idea that you can use risk metrics as design
to targets I think is open to question. I know that
certainly the people at Oak Ridge have successfully done
that and are very enthusiastic about using risk metrics as
design targets.
My own experience has been less successful in
doing that, so it is open to debate.
DR. APOSTOLAKIS: I think you will gain some
insights into the weaknesses of this process of design basis
if you look back the last 20 years and see what PRAs have
found that have made the Agency or forced the Agency to
actually issue new rules, for example, and ask yourself why
did we have to do this, why didn't the original design basis
accident envelope protect us from this. Why did we need an
ATWS rule? Why did we need the station blackout rule?
In my mind these are failures of the design basis
accident concept because we came back afterwards doing a
different analysis and we said, gee, we better do something
about this. If our original envelope was good enough, we
wouldn't have had to do that, so maybe you will gain some
insights there as to whether the concept deserves to be
retained or modified or abandoned.
MS. DROUIN: I think there is a misunderstanding
here. Maybe when we get into the framework it will clarify
it more, because when we say we are going to retain the
design basis concept that doesn't mean in the implementation
of risk informing the requirements that we come from a
starting point or a perspective of here is the DBA and we
move forward. In fact, that is not how we are looking at
risk informing the requirements, so I think this is a little
bit misleading here.
I think if we move on and we get into the
framework I think some of your concerns will be alleviated.
DR. APOSTOLAKIS: So maybe the word "retain"
should be replaced?
MS. DROUIN: I am not sure what we should replace
it with, but perhaps it should be replaced with another
word.
DR. APOSTOLAKIS: "Revisit" the concept.
MS. DROUIN: We will take that under advisement.
DR. APOSTOLAKIS: Oh, I didn't expect you to agree
right here.
MS. DROUIN: I'll try and go through the next
couple of slides very quickly. They are just background.
When you looked at SECY 264, it talks about that
the plan has a two-phased approach. Phase 1 deals with this
year, whereas, come December, we plan to make
recommendations to the Commission for approval on proposed
changes to Part 50.
And then in Phase 2, we would be performing the
regulatory analysis on those recommendations that have been
approved by the Commission, and move forward into
rulemaking.
DR. WALLIS: How do you approve without doing this
technical basis first? Don't you have to make arguments for
decisions?
MS. DROUIN: We will be doing some analysis in
terms of the feasibility of it, but the detailed regulatory
analysis would be done after the Commission approval. So
there is some analysis done up front, just to show the
feasibility.
In looking at Phase 1, just where were are right
now, this is what we're doing to talk about today. There
have been three main things that have been done? I
apologize, but ignore that last bullet, because we haven't
made really any advancements on that fourth bullet.
But we're going to talk about the framework for
risk-informing the regulations. And this really is probably
the most important thing. We put a lot of thinking into the
process because it sets the foundation of how we plan on
moving forward on any regulation that we undertake.
And we want to really get -- to try and give you a
good understanding of what we mean by this framework.
CHAIRMAN POWERS: I'm going to apologize for my
own ignorance or poor memory, but 50.44 is the hydrogen?
MS. DROUIN: The hydrogen.
CHAIRMAN POWERS: Okay, my memory isn't as bad. I
just don't remember them by numbers.
MS. DROUIN: Later on, I start using words instead
of numbers to try to help out.
CHAIRMAN POWERS: Good. I want you to be
quantitative, but not in all things.
MS. DROUIN: Yes. Also, we're going to talk about
the selection of the candidate regulations and the DBAs, and
we also talked about in SECY 264 that we wanted to do a
trial implementation, and the regulation that was selected
for trial implementation was 50.44, which is the hydrogen
rule, the gas control.
DR. WALLIS: Can you say what you mean by a
framework? I looked through the documents you sent us, and
I wasn't sure I saw a framework.
MS. DROUIN: Well, that's what I'm going to get
into next.
DR. WALLIS: Is that something else?
MS. DROUIN: That's what I'm going to talk about
next. That is the framework.
We thought that how we approach these regulations,
how we implement, you know, risk insights, that we needed a
framework or a structure under which that we would be
proceeding forward.
And that's what we have tried to put together and
what we're going to try to walk you through and explain what
we mean by this framework.
So, starting off, in the development of it, there
were certain approach concepts. I'm not sure what is the
right word, that we wanted to inherently build into the
framework.
And so we wanted to identify a goal. We wanted to
identify an approach, strategies.
CHAIRMAN POWERS: Let me ask you this question,
Mary: How quibbling are people going to be over this? You
say maintain the goal of protecting public health and
safety.
If I were a quibbling sort -- and you know I'm not
-- I would say, gee, I didn't think that was the objective
at all. I thought the objective was to provide adequate
protection to the public health and safety.
Protect the public health and safety could be
interpreted by quarrelsome people as being an absolute
that's probably unattainable.
MS. DROUIN: At one version of the slide we had
adequate protection, but we're getting into a legal ground
now, and I was told that I couldn't use those words.
MR. CUNNINGHAM: Obviously there is a shorthand
here of we want to provide reasonable assurance of the
adequate protection.
CHAIRMAN POWERS: I'm just concerned on
perceptions and the fact that words actually count at this
stage of formulating a regulatory process.
And we need to be careful because --
DR. APOSTOLAKIS: Actually this is very important.
Late on, I understand you're talking about goals. And goals
are not the same as adequate protection.
So, I mean, I peaked.
MS. DROUIN: You peaked, you snuck ahead.
DR. APOSTOLAKIS: And also we had a presentation,
I believe, on the slide --
MS. DROUIN: Right, you've seen some of these
slides before.
DR. APOSTOLAKIS: And those were goals. So I
don't think the word, adequate protection, is really your
goal. You want to achieve a certain goal of public
protection that the Commission has said are the safety
goals.
But you're not dealing with adequate protection in
this analysis. Is that correct?
Because we don't have anything quantitative
defining or contributing to the definition of adequate
protection.
MR. CUNNINGHAM: That might be better to come back
to when we get to the figure.
DR. APOSTOLAKIS: I think the word, goal, belongs
there. And you have to modify the rest to say -- or maybe
meet the goals of the Commission.
CHAIRMAN POWERS: When you look at the Atomic
Energy Act, it has implicit in it, a requirement to -- or at
least various articulated incarnations that the Commission
has interpreted as having a requirement that they define
what they mean by adequate protection.
Are you going to create a risk-informed
definition?
MS. DROUIN: No. In looking at the development,
starting at the high level, as I was saying, we want to
maintain the goal of protecting the public health and
safety, and then underneath that, to develop an approach
that builds upon the defense-in-depth concept or philosophy
or principle. I'm trying to remember all the different
words that are used.
DR. APOSTOLAKIS: Philosophy and principle are
different things.
CHAIRMAN POWERS: Don't try to mix them up.
MR. CUNNINGHAM: We have a principle to maintain
the defense-in-depth philosophy.
DR. WALLIS: My impression is that you invoke
defense-in-depth but not in a meaningful way. So let's see
if you actually do something else.
MS. DROUIN: We're going to get --
DR. WALLIS: I think if you could abolish the
words, defense-in-depth entirely, it wouldn't change
anything in your framework.
MR. BARTON: Yes, it would
MS. DROUIN: I would disagree. We build upon -- I
mean, I feel very strongly that we do build upon the concept
of defense-in-depth in what we're trying to do, and are
developing strategies that would implement that.
DR. WALLIS: Show me why it helped you make a
decision between A and B. They had more defense-in-depth or
something.
MR. KURITZKY: Show him an example in 50.44 ice
condensers, for example.
MR. SIEBER: Well, it seems like you're trying to
maintain the concept of defense-in-depth while applying this
kind of a regulatory framework, the risk-informed regulatory
framework. So you aren't really building on it, it's there,
built into the regulations already.
You just don't want to lose it.
DR. APOSTOLAKIS: And there is the practical
limitation that you already have a body of regulations.
MR. SIEBER: That's right.
DR. APOSTOLAKIS: They're not static. You're not
starting with a blank piece of paper, right?
MR. CUNNINGHAM: That's correct.
DR. APOSTOLAKIS: Is that the idea you are
conveying here, that you have certain natural constraints,
and that you're not going to start writing new regulations
that perhaps differ too much from what we have now; is that
right?
MR. CUNNINGHAM: Yes, I think that's correct.
MS. DROUIN: That is true, and what we're trying
to say is that, you now, whatever options we propose, we're
going to build upon this defense-in-depth concept.
DR. APOSTOLAKIS: But building upon is the
expression, because you start -- that implies that you start
with defense-in-depth and then you apply risk information to
the best extent possible.
And as you know, there are conflicting viewpoints
regarding -- or opposing viewpoints regarding the meaning of
defense-in-depth. In the rationalist point of view,
subordinate to PRA and risk information, and the
structuralist is the supreme principle.
MS. DROUIN: Exactly, and you'll see that on the
next slide.
DR. BONACA: But it seems to me that here you're
committed to maintaining the philosophy unnecessarily the
implemented condition defense-in-depth today.
You may find through the PRA that you have better
ways of implementing it, the intent of defense-in-depth.
Still, you're not committing to maintain all the
implemented, existing implemented defense-in-depth
commitments.
MS. DROUIN: Not today, necessarily. And that's
why we get down to our last one, and we felt that we needed
for our purposes to say what we meant by defense-in-depth,
and to create a working definition.
And that we were going to try and stay consistent
with this definition.
DR. APOSTOLAKIS: Now this third bullet, you say
that you want to be consistent with a safety goals and with
the cornerstones. These are the cornerstones of the new
oversight process.
MS. DROUIN: Yes.
DR. APOSTOLAKIS: And that clearly you're talking
about all modes of operation, right, not just power
operations?
MS. DROUIN: Correct.
DR. APOSTOLAKIS: So then the cornerstones, the
idea of the cornerstones applies to low power and shutdown.
That confuses me a little bit.
On the one hand, I hear arguments that the risks
from low power and shutdown, you know, may be comparable to
power operations or an amount of control and so on.
On the other hand, we have this principle of
cornerstones, and we know that during those operations, at
least three of the cornerstones are compromised to some
extent, right?
You have initiating events, you have mitigating
system availability. Clearly, that one is compromised,
deliberately.
And then the primary system pressure boundary. Am
I allowed to use the concept of the cornerstone and say,
gee, even though the public risk is very low from these
operations, the mere fact I compromise so many of my
cornerstones, you know, would demand that I understand this
better and maybe do a more quantitative analysis.
In other words, why are we using the cornerstones
in certain areas and giving them a lot of importance, and
then we completely ignore them in other areas?
Either they are important or they are not.
MR. CUNNINGHAM: I don't think in the context of
the Oversight Program that they are ignoring shutdown
operations.
DR. APOSTOLAKIS: They are not.
MR. CUNNINGHAM: They are not, and so the
cornerstones I think as you said that would apply, full
power operations, shutdown operations or whatever, the
question then becomes okay, given that you are going to
compromise some of these barriers what do you have to do to
counter-balance that compromising to make sure that we
continue to maintain safety, adequate safety or adequate
protection.
DR. APOSTOLAKIS: Well, it is not just to manage
it, because, you know, the oversight process has clear
numerical criteria for some of these things. In other
words, for the unavailability of systems it gives me
criteria, right?
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: It says -- okay.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: Shouldn't I apply the same
criteria to low power and shutdown? Just because I do it
deliberately it doesn't count anymore?
MR. CUNNINGHAM: I have to admit I haven't thought
much about this, how you would deal with some of the
performance indicators and things like that, how you would
use them in shutdown operations -- I guess I haven't thought
much about that. I don't know.
DR. APOSTOLAKIS: Okay.
DR. KRESS: I still wanted to ask a question about
the same bullet. I thought you were through though.
I wanted to know what they mean by consistent with
the safety goals in terms of prevention and mitigation. I
am reading into that 10 to the minus 4 CDF and 10 to the
minus 5 LERF, but I don't know what "consistent with" means
in that concept. Could you maybe expand on that a little?
MS. DROUIN: Can you hold on? I think --
DR. KRESS: Oh, you are going to get into that
later?
MS. DROUIN: We are going to get into that.
DR. APOSTOLAKIS: So I guess what I questioned was
the consistency with the cornerstones and you questioned the
consistency with the safety goals.
DR. KRESS: Yes.
DR. APOSTOLAKIS: It seems to me that the
cornerstones are not used the same way in all regulations.
They are important for certain things but then we go to
other things and somehow they disappear.
MR. CUNNINGHAM: Again I am not sure that they
really disappear but how they are handled --
DR. APOSTOLAKIS: Oh, they may be there but again
I don't know that there is any serious effort to really try
to see whether we are below the goals that are given in the
new oversight process document.
MR. CUNNINGHAM: Yes. There is not somebody here
from the new oversight process to really get at that, but
clearly there should be an answer to that question of how
they deal with the cornerstones during shutdown operations.
DR. APOSTOLAKIS: Let me change the flavor of the
question a little bit to make it more relevant to your
presentation.
I full agree with you that the oversight people
will have to do that, but the question is when you develop a
framework like this, what role are you going to give to the
cornerstones? Is it a tool only for the inspection and
enforcement part of the Agency or also part of the
development of a new framework for risk informing 10 CFR
Part 50?
MS. DROUIN: It's your latter.
DR. APOSTOLAKIS: So then I will expect to see
them taken seriously, right? I mean you will have something
that will refer to the cornerstones in the framework?
MS. DROUIN: Yes. We are going to get to that.
DR. APOSTOLAKIS: Okay.
MS. DROUIN: Before I actually show the picture of
the framework --
DR. APOSTOLAKIS: Yes, in the interests of saving
time, Mary, unless you have something important to say on
this one, I think we are familiar.
MS. DROUIN: Let me skip --
DR. KRESS: I would like to correct the risk --
rationalist view a little bit. I think they have read
something into what we have said that's not quite true.
MS. DROUIN: Then please correct us.
DR. KRESS: Well, the regulations on risk
information with defense-in-depth employed to validate the
risk information and to assure the proper balance between
prevention and mitigation is not to compensate for
uncertainty or incompleteness in knowledge here.
DR. APOSTOLAKIS: I think on that point there is a
third view that is missing here. There is a structuralist
and the rationalist, which I think are described well. The
third view is the one you are describing, which we call the
pragmatic approach in the paper.
DR. KRESS: Well, I think that is the rationalist
view though.
DR. APOSTOLAKIS: I mean the pragmatic approach we
said, you know, defense-in-depth at a high level and then --
DR. KRESS: I think that is a third view, you're
right.
DR. APOSTOLAKIS: There is a third view, the
pragmatic --
DR. KRESS: I think in the rationalist view
defense-in-depth is not employed to compensate for
uncertainty or incompleteness of knowledge.
I don't think that is a correct statement for the
rationalist view.
CHAIRMAN POWERS: If they had access to the letter
that we sent to the Commission I think it is a fair
interpretation within that letter. I think things have
evolved some to bring out those concepts of balance a little
more strongly.
DR. APOSTOLAKIS: But again I think that that
issue of balance becoming more important is really what we
call a preliminary proposal, which is a pragmatic compromise
between the two and for some reason people tend to ignore
that. They focus on the structuralist and rationalist.
There is a third bullet there that is missing that
is really the pragmatic approach, if you follow the
terminology of that paper, which is sort of a mix of the
two.
CHAIRMAN POWERS: I think you're right, that
people do tend to look at the holes in that, but I also
think that that pragmatic view has grown within the clique
of authors in ways that they probably couldn't have
anticipated.
DR. KRESS: You may be right.
CHAIRMAN POWERS: I think today we would write
three.
MS. DROUIN: Point taken. I think the big thing
though is the recommendation and we tried to, when we
developed our working definition --
DR. APOSTOLAKIS: Actually what we call a
recommendation is a variation of the pragmatic view,
actually.
MS. DROUIN: Okay, good, because that's what we
have tried to take into account, and as we go through these
next sets of slides to take that into account in our
development of our working definition.
DR. WALLIS: This is where I have some problem
because it seems to me that the four things you list are
simply obvious. You have got to have an initiating event.
You could have core damage. You could have release and you
have got to have a target to the public. This is just
physics. It has nothing to do with defense-in-depth. It's
just what happens.
DR. KRESS: It is something to do with
defense-in-depth. If you --
DR. WALLIS: If you choose to intervene --
DR. KRESS: If you allocate between those four
things --
DR. WALLIS: Defense-in-depth is something above
all this which tells you how to allocate among all those
things.
DR. KRESS: That is what I was saying the
rationalist view is, but the key word in those four things
to me is the word "limit" --
DR. APOSTOLAKIS: Yes.
CHAIRMAN POWERS: But I think it is the wrong
word.
DR. KRESS: Well, I am interested in what their
view of limit is.
CHAIRMAN POWERS: I think that now we would have
encouraged them to say something like balance among the
measures taken to limit -- limit frequency, limit
probability.
DR. WALLIS: Unless your defense-in-depth tells
you how to balance, you haven't used it.
MS. DROUIN: We are still walking through this
whole thing. We are walking through it here, but can't put
it all on one slide, I'm sorry.
DR. WALLIS: Well, I am telling you,
defense-in-depth you are simply invoking it without using it
in any way. These are simply four physical events which are
going to happen, and listing them doesn't tell me anything
about what you mean by defense-in-depth.
MS. DROUIN: We are going to get to the figure
that brings it all together. We were just trying to walk
you through.
If it is easier for me to jump right to that
figure, I will do that. I mean if you want me to skip over
these next slides.
DR. WALLIS: I will still have the same question.
MS. DROUIN: Let's go to the figure.
DR. APOSTOLAKIS: Okay.
DR. WALLIS: I think in your big framework you
could simply remove the defense-in-depth box altogether. It
wouldn't change anything.
MS. DROUIN: There's two figures that bring all of
this together. What we are trying to show here is to go
through these different concepts that we have a goal. We are
going to achieve this goal by trying to maintain
defense-in-depth and we have four strategies for maintaining
the defense-in-depth. We have two prevention strategies and
we have two mitigation strategies, and then we have tactics
that we are going to implement.
DR. WALLIS: These would be strategies if you
didn't use defense-in-depth at all.
MS. DROUIN: It is defense-in-depth in that we are
doing both. We aren't just doing mitigation. We are doing
prevention and mitigation.
DR. KRESS: I would agree that it is
defense-in-depth.
MR. CUNNINGHAM: But it is implicit in this
picture that each of the four legs of this -- there is a
balance between the four legs.
DR. WALLIS: The obvious thing to do is to prevent
and mitigate. It just makes common sense, and to say you
are doing something wonderful like defense-in-depth is
really misleading people.
DR. KRESS: It is not obvious because some people
say all you need to do is limit the public health effects,
that's it, and not have those other things.
DR. WALLIS: Well, how do you do that? You do it
by preventing and mitigating.
DR. KRESS: Or you may do it by just mitigating or
just preventing.
MR. SIEBER: It's the degree to which you do each
of these things that encompasses or embodies the concept of
defense-in-depth.
DR. BONACA: That's right.
DR. WALLIS: Then give me a rationale for
balancing. Then you are getting somewhere.
MR. SIEBER: That is what risk informed is.
MS. DROUIN: That is what we are going to get to.
I want to answer a question that Dr. Powers
brought up was the use of the word "limit" because we did
deliberately put the word "limit" there because when we get
to the next slide we are trying to identify "limits." What
we are not trying to do here is doing an ALARA type approach
where we are just going to keep pushing down and pushing
down and pushing down with no goal in mind, that we want to
identify a limit and once we're there, that's good enough.
Now maybe "limit" is the wrong word but that is
the idea we are trying to get across.
CHAIRMAN POWERS: You are telling me that you are
going to create maybe a -- what is it? -- how do I
articulate it? -- a fuzzy line akin to the fuzzy lines that
you have in 1.174 that relate to initiator frequency.
MS. DROUIN: I hate to say yes, Mark, but like you
--
MR. CUNNINGHAM: I'm sorry. I'm just not sure I
understood the question.
CHAIRMAN POWERS: Well, she says that they're not
going to push down and push down. There is clearly some
point at which you've done enough in eliminating initiator
frequency.
And recognizing the speaker's abhorrence of bright
lines, I suggested, was there going to be a fuzzy line akin
to fuzzy lines I find in Reg Guide 1.174 that speaks to the
issue not of CDF, but of initiator frequency?
MR. CUNNINGHAM: There will be shadings of gray,
yes.
DR. KRESS: I don't see how you can do that, Mark.
We're writing a set of regulations.
When you put them down on paper, they are there,
and some people are going to do something to their plant
based on those regulations. And they're going to end up
with some initiating frequency and some core damage
probability.
I don't see where the fuzziness enters into this
picture. I don't see how you have any -- I mean, the
fuzziness before was related to what further things NRC
would do, but now you're putting down a set of regulations
beforehand.
DR. APOSTOLAKIS: But if they are frequencies, you
can't really have bright lines. I mean, if they say as a
guidance --
DR. KRESS: I can't --
DR. APOSTOLAKIS: If they say the mean frequency
of medium loca should be 10 to the minus 3 or less, and
somebody comes up with 1.5, ten to the minus three, what do
you do?
You see, there is some distribution there.
DR. KRESS: I would support your earlier proposal
some time ago that a three-Region is a great way to get
without bright lines and not have them at the same time.
But --
CHAIRMAN POWERS: You still run into the problem
on the --
DR. APOSTOLAKIS: Decreasing the fuzziness.
CHAIRMAN POWERS: On the limits that you put on
either one of them. You would never write something that he
says. You wouldn't say mean probability of ten to the minus
third.
You would say that there should be a 95-percent
confidence that the mean probability --
DR. KRESS: That, to me, is a bright line. I'm
sorry.
DR. APOSTOLAKIS: Yes, it is a bright line.
CHAIRMAN POWERS: What you get out of the problem
that he's talking about, which is what do you do when it's
1.1.
DR. APOSTOLAKIS: But your 95th percentile, again,
could be one point something.
I think there has to be some allowance for this
fuzziness. It can't be bright.
DR. KRESS: What you do with the fuzziness is, you
make two bright lines. You're in a finite different type
situation.
DR. APOSTOLAKIS: I understand.
DR. KRESS: You can't have an infinite number of
lines. That's my point.
DR. APOSTOLAKIS: The three-region, I think,
addresses really different issues, which is goal versus
adequate protection.
DR. KRESS: No, because it tells you -- it does
have a way to have a fuzziness in there because within
certain region, you do something that's different than in
other regions.
DR. APOSTOLAKIS: I depends on how you define the
limits, yes, I agree. I mean, I look those words they used
in 1.174, increased management attention. That was really
nice. It was a stroke of brilliance.
CHAIRMAN POWERS: You're in a different realm now.
DR. APOSTOLAKIS: I know, I know. I still think
you will have some problem with a numerical thing, but I
wanted to offer another suggestion here.
I think there will be instances where it will not
be possible to have this nice separation between mitigation
and prevention, or at least not having the four boxes.
You may have mitigation/prevention, but not the
four boxes inside. For example, bypass sequences.
DR. KRESS: This is on the average and related to
all -- I mean, you have a different set of these for each
sequence.
DR. APOSTOLAKIS: Let me finish.
DR. KRESS: I'm sorry.
DR. APOSTOLAKIS: For external events, you can
have an earthquake. So perhaps what we need to do here is
have another super box that includes prevention and
mitigation. So now you have big box, prevention and
mitigation inside it, two boxes you have and then the two
boxes within the each within prevention and mitigation.
And somewhere in the text, or if there is a way to
show that graphically, that would be great, to indicate that
the nature of the accident sequence you are regulating --
DR. KRESS: I think this is a good slide here.
MS. DROUIN: I think this one, because it gets to
the two different implementation strategies, where here in
this one -- I mean, our preferred one is this one here where
we can address each one of the four individually.
But there are those cases, as you pointed out,
where you can't. So then we come up here to just prevention
and mitigation.
DR. APOSTOLAKIS: But what if, for example, for
some sequences, you may want to just say because of the
nature of the sequence, that the frequency of -- oh, you're
going all the way to the fatality.
MS. DROUIN: No, no. The two strategies are these
two here.
DR. APOSTOLAKIS: But look at this, you say that
prevention is core damage frequency, mitigation is
conditional -- individual fatality.
DR. KRESS: That's a number that they can use as a
pragmatic number to multiply the other two by to get to that
metric. It's not a design -- it's not one of the limits;
it's just a number they can use.
DR. APOSTOLAKIS: Wait a minute. If I multiply
ten to the minus four by ten to the minus two, I get ten to
the minus six.
DR. KRESS: Right.
DR. APOSTOLAKIS: Which is close to the -- it's
higher than the early fatality, though.
MR. CUNNINGHAM: It's less than or equal,
presumably.
DR. APOSTOLAKIS: My point is that -- and maybe
it's already there. That's what I'm trying to understand.
If I have a very strong earthquake that demolishes
the containment and the core and everything, should I use as
a criterion for that sequence --
DR. KRESS: Look at the title called infrequent
initiatives.
MS. DROUIN: You've got your anticipated, your
infrequent, and your rare.
DR. APOSTOLAKIS: Right. No, but my point is that
I cannot implement -- I mean, I can't say anything about the
conditional core damage probability. Do I care?
What I care about is the whole sequence now.
MR. CUNNINGHAM: Right, there's a set of accidents
or initiators that are going to be so extreme so that you're
not going to design the containment for the ultimate
earthquake. You can't.
DR. APOSTOLAKIS: But my point is that --
DR. KRESS: Is that what you mean by retain the
design basis concept?
MR. CUNNINGHAM: There is a set of numbers that
you just have to maintain the frequency of those challenges
somehow, so long. I was thinking of vessel rupture or
something as well.
DR. APOSTOLAKIS: I understand. Let me tell you
what I was trying to say:
I think -- and maybe it's already there; I don't
see it -- that there will be certain situations, classes of
accidents, for which the only thing I can do is worry about
the very top box, try to meet the early fatality safety goal
criteria, because I cannot break it up into other things.
Then there is another class for which the second
tier applies, prevention/mitigation. And then there are all
these internal events, really, for which the last tier
applies. Is that the idea here?
It doesn't have to be. All I am saying is that I
think you're going to have that problem.
MR. CUNNINGHAM: Yes, that's right.
MS. DROUIN: Yes.
MR. CUNNINGHAM: We'll have that problem to face,
and you'll have to --
DR. APOSTOLAKIS: Okay, because, in other words,
you cannot always demand the four boxes at the bottom. For
certain accident sequences, it's just not practical.
It doesn't make sense.
MS. DROUIN: That's exactly right.
DR. APOSTOLAKIS: Okay, fine.
DR. KRESS: Now, let me ask another question. I'm
sorry, I thought you were through, George. Go ahead.
DR. APOSTOLAKIS: For mitigate, for the second
tier, why did you put individual fatality there. I thought
you were going to put something related to releases of
radioactivity or -- I mean, you are going all the way to the
health consequences.
MS. DROUIN: Yes.
DR. APOSTOLAKIS: Why? Why not LERF or something
else?
DR. KRESS: That is almost a LERF, George.
MS. DROUIN: Because staying in consistency back
with this, our mitigation.
DR. APOSTOLAKIS: Oh, you are focusing on that.
Okay, fine, fine.
MS. DROUIN: But it is a combination, the number
is trying to take into account, you know, both of these.
DR. WALLIS: When you put these numbers in this
table, is this where you apply defense-in-depth, when you
choose to distribute numbers this particular way?
MS. DROUIN: Yes.
DR. APOSTOLAKIS: Yes.
DR. WALLIS: When you're using defense-in-depth?
MS. DROUIN: Yes.
DR. WALLIS: You're saying we won't put all of our
numbers in one box?
MS. DROUIN: That's correct.
DR. WALLIS: And who chose these numbers and on
what basis?
MR. SIEBER: Distribution.
MR. CUNNINGHAM: At this point, those numbers are
out there for debate and discussion.
DR. WALLIS: Someone could easily have a reactor
which has a completely different distribution of numbers?
DR. APOSTOLAKIS: Sure.
DR. WALLIS: You can justify it? Someone could
come in and say we have such very good numbers in Box No. 3
at the bottom here, they're so small that we don't really
need them to be so big in the other boxes?
MR. CUNNINGHAM: Then the question that you're
getting to is, does that provide sufficient
defense-in-depth.
DR. APOSTOLAKIS: No, actually the way it's going
to work at some point -- you see, defense-in-depth is an
issue for the Commission. It's a policy issue.
DR. WALLIS: But ten to the minus six is the
product of all these numbers.
DR. APOSTOLAKIS: So the Commission has already
stated the top box. The Commission in its safety goal
policy statement gave us the top box.
MS. DROUIN: Right.
DR. APOSTOLAKIS: At some point, after the debate
that Mark mentioned and so on, the scrutiny and everything,
some form of this will have to go to the Commission for
approval, because it's a policy issue.
MS. DROUIN: That's exactly right.
DR. APOSTOLAKIS: In which case then, a licensee
cannot come back here and claim that they have such a good
condition on early containment failure probability that they
can afford to have a higher core damage frequency.
DR. WALLIS: So this is where you have exercised
some kind of defense-in-depth by saying we're more sure
about one of these boxes than another; therefore, we've
given this box more importance than another?
MS. DROUIN: Exactly.
DR. KRESS: It's not necessarily more sure. It
could be one of the criteria.
DR. WALLIS: Less uncertain then?
DR. KRESS: Well, that could be one of the
criteria. The other criteria could be we value not having
that thing a lot more than the other.
DR. WALLIS: So this is where you've actually used
defense-in-depth consciously?
MS. DROUIN: Very consciously.
DR. APOSTOLAKIS: In fact, the agency, de facto,
has declared that preventing core damage is roughly 1,000
times more important than the condition of early containment
failure.
DR. WALLIS: That would seem to be putting your
eggs in one basket.
MR. SIEBER: On the other hand, these numbers are
already there because the plants are already built, and
that's the way they will come out.
MS. DROUIN: And these are also guidelines for us.
These numbers are not going to show up in any regulation.
DR. KRESS: That's the part I was going to ask.
They're not going to show up --
MS. DROUIN: Not in any regulation.
DR. KRESS: That, I think --
MS. DROUIN: As we go and risk-inform something --
DR. KRESS: Those might be in a Reg Guide, though?
DR. APOSTOLAKIS: Have to be somewhere.
DR. BONACA: Let me just say that there is a lot
of striking similarity between the bottom line and the ANSI
standards that were used to design the current plants. They
didn't talk about core damage frequency; they talked about
something very similar.
Infrequent means that you can have some fuel
damage. Very frequent, you can have defined fuel damage.
Clearly, in absence of core damage frequency, they
had to use some surrogate. But there are similarities
there, so in that case you had ANSI standards that the NRC
endorsed the regulation.
Now you don't have that, but somewhere, these had
to be, because it really replaces those standards. That's
what this is, the whole structure.
MS. DROUIN: And there are issues that we're still
grappling with in the implementation, you know, of this
framework.
I mean, for example, you know, do you this by a
whole group of initiators, or do you do it by a class?
I mean, say that you have a class of initiators
such as loss of offsite power. It fails a particular
criteria, but can you meet if the whole aggregate of your
set of initiators meet it?
There are issues embedded in here that we're still
working our way through.
CHAIRMAN POWERS: I guess one of the surprising
things about this, especially the bottom row, very important
document that this agency's produced that I personally am
very fond of, and derive a great deal of information from on
the insights from the AIPE exercise.
In there they show on some nice plots that, gosh,
the containment, conditional containment failure
probabilities for BWRs exceed all but perhaps the
bottom-most limit you have written down there, whereas many
PWRs would not exceed any of the limits that you put down
there. Then it goes on -- but not to worry because the
conditional core damage probabilities of these BWRs is so
much lower, so there is approximately equivalent safety.
I rather suspect you are familiar with that
document.
MS. DROUIN: No, I am not at all.
[Laughter.]
CHAIRMAN POWERS: I mean it looks like it. Why
are those two things, in the face of all this evidence we
got from the IPEs it says we ought not separate conditional
core damage probability into one set of cases and
conditional early containment probability into another set
because our existing plants don't separate nicely that way,
did you go ahead and create two columns there?
MS. DROUIN: I guess I didn't view it that way,
that these were contradicting each other.
CHAIRMAN POWERS: What I am saying is it is
contradictory to your experience with the existing set of
reactors and I think as Jack Sieber pointed out we have got
plants that are built now and one would think that at the
very minimum you would want to write this risk informed set
of regulations so that they were applicable to the plants
now.
As I read this, it would be suitable only for the
PWRs. I mean it is a PWR-biased categorization here.
DR. KRESS: I agree with you, Dana, and the
question I was going to ask is if we had a quantification of
what we call adequate protection, that is what you are
talking about. That is a quantification of it in the IPEs
and it seems to me like if our goal with risk informing the
regulations is to maintain the same level of adequate
protection the numbers we would have under "prevent" and
"mitigate" would be different than those numbers that we
have up there.
Those are the goals. They are not adequate
protection, and that is what concerns me a little about the
whole thing. I think we need things in there that are
different numbers than those just because of the reason you
said.
CHAIRMAN POWERS: I mean the alternative, it seems
to me, based on experience, based on this wonderful document
produced by an incredibly insightful senior author --
[Laughter.]
CHAIRMAN POWERS: -- that comes back and says now
do not create two columns here because that is not the
way -- the risk insight we got from the IPEs says that you
really shouldn't do that.
DR. KRESS: I think you could create two columns
but they would be different numbers than what they have up
there.
DR. APOSTOLAKIS: Have you read that report, Ms.
Druin?
CHAIRMAN POWERS: Let the record show Ms. Druin is
in fact the senior author of this very, very good document.
DR. KRESS: My point is that two columns are fine.
That is a manifestation of defense-in-depth. It's just that
the numbers are not compatible with adequate protection.
CHAIRMAN POWERS: Tom, I still think that the
compatibility with defense-in-depth is achieved with three
columns. The violation of what I think the lessons learned
from IPE is -- it should be one column. I mean it could be
one column. That is one way to get around it.
The other way to get around it is to change the
numbers.
MR. CUNNINGHAM: Another way to get around it is
differentiate, have different numbers for PWRs and BWRs or
different design containment classes.
DR. KRESS: Yes, but that doesn't make any sense
at all -- I think that would be a real mistake.
CHAIRMAN POWERS: I think you take the ground
rules and I think the implicit ground rules and it may in
fact be even explicit, it says let's risk inform these
regulations pursuing what reactors are going to have to deal
with, and that is a fairly finite set. I mean it's
certainly ones we have got now, very much it's the ones we
have got now. It might even be the evolutionary reactors
and the advanced reactors that we have certified I still
think you're compatible.
Do you get to a reactor like the pebble bed?
Maybe the designers come in and say that they are persuaded
that it doesn't need a containment. I think they have
got -- the burden of proof is on their shoulders.
DR. APOSTOLAKIS: But shouldn't this regulation be
written in a way that provides sufficient flexibility to
accommodate all these various cases?
CHAIRMAN POWERS: I think it would be very
desirable to do that. I think that is asking an awful lot.
DR. BONACA: I think there is only one
accommodation. What I mean is that for a BWR really what we
are doing for a BWR really what we are doing right now, we
are cashing in some extra prevention capability we have for
less mitigation that we have because of containment.
I don't think the opposite would be allowed by the
goals we have because 10 to the minus 4 is a goal that we
have in place for plants and I don't think you would say,
all right, 10 to the minus 3 core damage frequency is
acceptable because I have a containment that has a 10 to the
minus 3 mitigation capability.
DR. KRESS: Well, there is a rationale, Mario, to
say that sort of stuff, and I wish -- I want to get it on
the table eventually, and it is a rationale for having
perhaps different numbers for BWRs and PWRs and that is what
you want to do is have an acceptable uncertainty in the
final answer.
Now if you make that, if you can get that --
that's an undefined number, that acceptable uncertainty, but
if we had a number for it, if you could meet that acceptable
uncertainty better by doing it one way versus the other,
then that ought to be the way to do it, as long as the
uncertainty is acceptable. That is the key that is missing
here.
DR. APOSTOLAKIS: You know what? This is
beautiful. This conception -- those guys have to implement
it. I don't know how beautiful it is for them.
You are going down the list here, having as
guidance the uncertainty in the numbers that the assessment
gives you -- that is another way of saying what Dr. Kress
just said. If you can demonstrate with reasonable assurance
that you meet the early fatality safety goal and the latent
cancer fatality safety goal you don't have to do anything
else. Now in practice of course it is doubtful you are
going to do that, so you go to the next level.
Are you demonstrating with good -- I don't want to
use reasonable assurance, but, you know, with sufficient
confidence that you have met the core damage frequency goal
and the conditional containment. If you have, then stop
there. You don't have to go below.
DR. KRESS: If you haven't, you do something else.
You go more.
DR. APOSTOLAKIS: But if you don't then you better
give us additional assurance. Go to the four columns you
have there.
This brings me to another question. Where are the
cornerstones?
DR. KRESS: Actually those four columns could be
viewed as cornerstones.
DR. APOSTOLAKIS: But they are not "the"
cornerstones. No, I think we should take that list very
seriously. We can't just say this is only for enforcement
and inspection. Either we worry about these things or we
don't.
DR. KRESS: Those pretty well parallel the
cornerstones.
DR. APOSTOLAKIS: But they are not the same.
DR. KRESS: They have left out things like
security --
CHAIRMAN POWERS: Let me interject and ask the
subcommittee chairman where we stand on getting through
this. I do have some time constraints today.
DR. APOSTOLAKIS: I understand that.
CHAIRMAN POWERS: Should we perhaps let the
speaker get through the next 10 viewgraphs, just to find out
what she has to say?
DR. APOSTOLAKIS: I would propose something
else --
MS. DROUIN: Money.
DR. WALLIS: I would like you to do something for
me. My colleagues are far too complicated. They get into
all these details. In principle, what you are saying I
think is that if you have some sort of template like this
you could take all the existing regulations, LOCA and stuff,
and you could see how it fits into this framework of stuff,
and you could see whether or not they are overly
conservative or overly liberal of whatever they are, and
then you could then decide whether to change them.
MS. DROUIN: Right.
DR. WALLIS: In principle it should be possible to
apply this to the whole body of regulations as they now
stand.
MS. DROUIN: Correct.
MR. SIEBER: Actually, you are going a step
further than that in trying to regulate to a set of numbers
that is something like this in these different boxes, is
that not true?
MS. DROUIN: Well, if I go back to our other
figure, in getting to Dr. Wallis's point, when we look at --
this is just an example here --
DR. WALLIS: Go to PTS and say what does it buy
you in terms of these 10 to the minus whatevers.
MS. DROUIN: And see where do the regulations map
into here and how well do they map and have they done it the
best way, the best risk informed way.
MR. SIEBER: But it is a mistake to think that all
the body of regulations that you have cover all the elements
of risk and uncertainty in the plant.
MS. DROUIN: That's correct.
MR. CUNNINGHAM: Right.
MR. SIEBER: It's probably one small fraction of
that.
MS. DROUIN: Right. What we don't have a
viewgraph on here is that this is looking at the regulations
in a sense from a bottom-up -- or, you know, people call it
different things -- but one of the things that we are doing
is taking the insights from that wonderful document and
seeing where there are risk significant concerns and then
mapping those to how have they been covered in the
regulations or if they have been covered in the regulations,
and if not, should they be covered in the regulations, so
that is another process that as we look at this framework --
to see if there's potential holes.
DR. WALLIS: This is where I was looking for a
different sort of framework. I would sort of I guess be
willing to start off with this figure at the beginning of
your discussion without any discussion whatsoever and then
give me a framework for how you are actually going to apply
it. That is what I didn't see.
MS. DROUIN: That's correct. You haven't seen
that.
DR. WALLIS: Because I could have taken this, I
think, with about five minutes of discussion. I don't know
why we spent all this time.
DR. APOSTOLAKIS: Well, we are trying to give some
help to the guys. I mean we are not just criticizing -- I'm
sorry, had you finished, Graham?
DR. WALLIS: Yes, I think so.
DR. APOSTOLAKIS: I have to intervene. You can't
through all your viewgraphs -- you use your judgment and hit
the important points and wrap it up by 2:55 --
MS. DROUIN: I think so.
DR. APOSTOLAKIS: 2:55 you are out, right?
MS. DROUIN: Okay.
DR. APOSTOLAKIS: In the middle of a sentence.
MS. DROUIN: All right.
DR. APOSTOLAKIS: Because we have to give some
time to Mr. Christie.
MR. BARTON: You are taking away her time, George.
DR. APOSTOLAKIS: She can actually leave now.
[Laughter.]
MR. CUNNINGHAM: Just to be clear, you want Mary
to keep talking until 2:55 and then you will talk or --
DR. APOSTOLAKIS: No.
MR. CUNNINGHAM: -- or we will have the complete,
the Staff's presentation will end at 2:55?
DR. APOSTOLAKIS: Yes, because Mr. Christie has
requested time.
MS. DROUIN: I understood that is what you meant.
MR. MARKLEY: And NEI.
DR. APOSTOLAKIS: And NEI?
MS. DROUIN: I am not going to spend a lot of time
on this --
DR. APOSTOLAKIS: Wait, that changes it. The
total is 15 minutes? Okay, 2:55.
MS. DROUIN: 2:55? Now if I finish earlier, do I
get a bonus?
DR. APOSTOLAKIS: Yes. Buy you a cup of coffee.
Why don't you go to what you consider are the key issues
that you would like to bring to the attention of the
committee and maybe get some feedback.
MS. DROUIN: One of them is where Dr. Wallis left
off, where we are just now starting. You know, we have
gotten this framework but now how do we implement it? That
is, you know, the $80,000 question and this is not meant to
list all the issues.
Here are just some of the issues that we are
coming across.
I'm sure that as we get into it, there are going
to be more issues that we are going to unravel.
But here, we're just --
DR. APOSTOLAKIS: And as you talk to this
Committee.
MS. DROUIN: Excuse me?
DR. APOSTOLAKIS: And as you come to this
Committee.
MS. DROUIN: And as we come to this Committee,
absolutely.
But the application of the single-failure
criterion, whether you should do it, how you implement it,
is an issue.
How we --
CHAIRMAN POWERS: Why does it even exist in a
risk-informed regulation?
MS. DROUIN: That's one of the issues.
MR. CUNNINGHAM: That's a fair question.
MS. DROUIN: A very fair question; does it make
sense in a risk-informed environment to have the single
failure criterion?
CHAIRMAN POWERS: Is there any convolution of the
logic that would lead to it?
MR. CUNNINGHAM: Yes, there is. Again, the
question of single-failure criterion as a concept or as it
has been applied, the application has evolved considerably
with time to be perhaps more constraining than the original
intent.
The original intent may still make sense, but --
DR. APOSTOLAKIS: Well, you know, as a general
principle, I mean, there is such a thing as the principle of
conservation of requirements, perhaps, or knowledge. I
mean, you are creating new requirements at a higher level.
Something has to give at the lower level. I mean,
we can't preserve everything we've been doing for 40 years
and on top of it say, now we want this frequency for core
damage. I mean, that would argue against the single-failure
criterion, in my view.
So, bear that in mind, that we are not here just
to add to the regulations. I mean, the fact that you put
those big requirements up there has to have some impact on
what you put --
DR. KRESS: You may be able to meet them only with
the single-failure criterion.
DR. APOSTOLAKIS: But that's a separate issue.
MR. CUNNINGHAM: In this environment, the question
is, is it a practical concept to use, to continue to use,
given this framework and application?
DR. APOSTOLAKIS: It's the whole issue of
practicality, and conceptually also.
MR. CUNNINGHAM: Conceptually, also, yes. Is it
--
DR. WALLIS: Now, these numbers in your boxes are
plant-specific. So how do you do this mapping without
looking at the particular plant?
DR. KRESS: They weren't intended to --
DR. WALLIS: How do you map generic regulations
into PRA.
DR. KRESS: They weren't intended to be
plant-specific.
DR. WALLIS: But they are. These probabilities,
when you calculate them, are plant-specific, aren't they?
DR. KRESS: Well, the idea is to --
DR. WALLIS: So isn't that one of the biggest
problems with mapping general regulations into PRA.
MS. DROUIN: But you can see where the group of
plants have fallen in a particular area, and one of the
things I'm going to get to after this slide is walk you
through 50.44, because that's our trial implementation.
And where you might have it on a plant-specific
basis, you still have here's what the industry as a whole
has told you, so it's not really applied on a plant-specific
basis in that regard.
We've had a lot f discussion on that second main
bullet, on how we're going to use these quantitative goals.
And all of that, we're still thrashing out, and as we move
forward, hopefully -- I'm sorry?
DR. APOSTOLAKIS: The cornerstones.
DR. KRESS: No, George, don't keep bringing up
these cornerstones.
DR. WALLIS: I just want to say, what happens if
you try and do it?
DR. APOSTOLAKIS: These are issues, these are
implementation issues.
MS. DROUIN: Real quick, to your cornerstone
thing, George, it might not be the exact words, but here are
four of the cornerstones right here, and the other ones are
up here in this box. So we are not ignoring the other
cornerstones.
DR. APOSTOLAKIS: What I'm saying is that there is
an explicit cornerstone regarding the unavailability of
mitigating systems. And you have put it inside the core
damage probability, which is combined now with other things.
And my question is, why doesn't it stand alone?
Why do I care about it when I inspect and enforce, and I
don't care about it when I write new frameworks?
MR. CUNNINGHAM: As you said, this is an issue we
have to deal with.
DR. APOSTOLAKIS: I understand that.
MR. CUNNINGHAM: And that's fair.
DR. APOSTOLAKIS: That's all I'm saying; that it's
much more explicit. I agree with Mary that everything that
is the limit core damage frequency box, but in the other
document, it's spelled out, the four of them. If you
multiply them, you get the core damage probability.
So why do I have four there and two here?
DR. BONACA: There is some issue, too, about --
MS. DROUIN: You have the same four.
DR. BONACA: -- here, the separation and
mitigation is typically by core damage. And the others were
not. I mean, clearly the mitigation was intended in the old
fashioned way of the old analysis whereby mitigating
equipment wasn't just to mitigate core damage; it was to
mitigate events.
So there is some other issue that has to be dealt
with to reconcile.
DR. APOSTOLAKIS: I think your major -- one of the
biggest issues you will have here is what of the -- which
ones of the existing regulations you want to eliminate.
MS. DROUIN: I'm sorry, I couldn't hear you?
DR. APOSTOLAKIS: Eliminate. The fact that you
are putting these multilevel requirements now, how far can
you go in eliminating existing requirements. The
single-failure criterion, for example, is one we discussed,
and I'm sure there are others.
This is a key implementation issue, in my view.
MR. CUNNINGHAM: Again, the single-failure
criterion is not a requirement; it's an implementation
mechanism or something like that, embedded in requirements.
DR. APOSTOLAKIS: It's essentially a requirement.
The licensee has got to meet it. No?
MR. CUNNINGHAM: Anyway, we're just -- that's
semantics, I think.
DR. APOSTOLAKIS: In the engineer's office, many,
many years ago, doing some drawings because we were coming
before the NRC, well, the single-failure criterion was very
prominent there.
MS. DROUIN: Okay, for time purposes, I'm going to
skip the whole next section and jump all the way over to
Slide No. 25. As I said, 50.44, the combustible gas control
regulation, is the one that we have done for trial
implementation.
And, in fact, we went into the workshop with
another recommendation on 50.44, and the stakeholder
feedback supported that recommendation. We're going to try
to move in 50.44 on a much more expedited basis, looking at
the timeframe of June of this year to go to the Commission
with preliminary recommendations, and not wait till
December.
We're going to try and really expedite 50.44. So
I want to quickly walk through what we're doing on 50.44 and
give you an idea of where we're at.
Just quickly, in terms of our framework,
remembering that the framework is looking at both prevention
and mitigation, what you see with 50.44 is that it addresses
the third strategy, of limiting our radionuclide releases.
As we look at 50.44 there's three things here that
I want to focus in on that as we risk inform the regulation
and start examining the requirements we are going to
determine if we can eliminate any non-risk significant
elements. Can we simplify it to make it more effectively
meet the objective? -- but also when we look at it to see if
there are any missing risk elements that might warrant that
unforgivable word of "adding" to it.
When you look at 50.44 there's six basic parts to
the regulation, six requirements there. The top three
here -- I don't think that my pen will work -- there's a
demarcation here, because there was two parts to 50.44,
pre-TMI and post-TMI, and this was the original rule and
then the rule was amended after TMI, which added on these
three other requirements, so prior to TMI what you are
seeing there is that the regulation was impacting all
containment types and then when you got into the amendments
post-TMI you were not necessarily impacting all the
different containments.
The other thing I want to point out, when we talk
about large Drys, that also includes the sub-atmospherics,
and that is an important point.
What I am going to do is take those six
requirements and walk through them and talk about the
requirements and get into how the licensee has implemented
the requirement, look at that implementation and the
requirement itself and evaluate the safety significance and
then some very early preliminary thoughts that we have right
now for options for consideration in terms of potential
recommendations.
DR. WALLIS: Evaluate safety significance means
some kind of a contribution to LERF?
MS. DROUIN: Yes.
MR. KURITZKY: CDF and LERF.
DR. WALLIS: CDFs already have --
MS. DROUIN: Yes. No, that would be LERF.
If I take our first requirement, which is
measuring the hydrogen in containment, that is what the
requirement states. The implementation of it has been to
put in safety grade instrumentation for hydrogen or oxygen
measurement. The fact that it is safety grade
instrumentation, that is not the actual requirement. The
requirement is what you always see here in bold and
underlined.
When you look at it, the hydrogen measurement
certainly has the capability of safety value for tracking
and managing the accidents and here is one that also gets
tied into Option 2, because some relaxation of the special
treatment requirement is imposed on the equipment also.
In looking at this particular requirement, what
our first thoughts are is to perhaps allow some grab
sampling instead of having a constant monitoring. You can
just go out and do some random sampling, and also what we
are starting to look at is trying to determine where has the
safety grade instrumentation been imposed. It certainly
hasn't been imposed by the regulation.
DR. WALLIS: How about not measuring it at all?
MS. DROUIN: Or not measuring it at all.
DR. WALLIS: How would you assess whether that is
valid? I mean you can look at the effect on LERF and it is
going to be very small.
How small does it have to be before you say you
don't need any measurement at all?
MS. DROUIN: What I see to recall in going back
and looking at the results from the IPEs and looking at
NUREG-1150 is that the hydrogen -- I am trying to remember
those numbers --
DR. WALLIS: Just measuring it though -- well, are
you going to apply some criterion?
MS. DROUIN: In looking at what was the
contribution to your early containment failure from a
hydrogen combustion, and then therefore what is the need to
measure it.
MR. KURITZKY: And it varies from plant type to
plant type and containment type to containment type.
DR. WALLIS: You don't necessarily need to measure
it. You just need to prevent it burning. I think it gets
very complicated when you look into the details of what you
actually buy from each one of these requirements.
MS. DROUIN: But when you get into some, you know,
hydrogen combustion in some particular accidents is a
relative contributor so there is some value in knowing what
your hydrogen concentration is for being able to measure it,
but whether or not you need your safety grade --
DR. WALLIS: There's a .1 probability of
containment failure in the box that you showed us. That is
much too crude to evaluate whether or not you need to
measure hydrogen in containment, so you need some other --
MR. CUNNINGHAM: Yes, that's right.
MS. DROUIN: Right.
MR. CUNNINGHAM: You need something more --
DR. WALLIS: Much more.
MR. CUNNINGHAM: Yes.
DR. WALLIS: That is what I was looking for was
more a framework for how you are going to actually make
these decisions, but may not have got that far yet.
MR. CUNNINGHAM: The framework that we talked
about before might give you an idea that this is an issue to
tackle. What it doesn't do is give you an idea of how you
really design what the requirements would look like.
DR. WALLIS: I was looking for your framework for
deciding whether or not a regulation was necessary or needed
to be modified. Maybe you haven't got that far yet.
MS. DROUIN: Would you state that again?
DR. WALLIS: When you make these comparisons, how
do you make a decision about whether or not we need to keep
measuring H2 in containment? That is the sort of framework
I was looking at, for your intellectual framework for how
you are going to start making decisions on the basis of risk
informing. Maybe you haven't gotten that far yet.
MR. CUNNINGHAM: We haven't gotten that far yet.
MS. DROUIN: That's correct. Going on to the next
requirement in terms of mixing, in looking at it from a risk
perspective, keeping a well mixed containment atmosphere
without hydrogen stratification we felt is important to
safety, so often when you look at this particular
requirement the systems that are used for mixing are also
generally used for other functions, so on this particular
requirement our preliminary thinking was we weren't
proposing any changes on this particular requirement.
CHAIRMAN POWERS: When we took a look at 50.59,
using the language that we have available to us now with
modern capabilities at risk we ran into all kinds of
problems with the quantitative adjectives that appeared in
there.
There was language to the effect of don't have any
increase in risk. At that time that language was put in
there they meant no increase in risk to the limits that you
could detect whether there was any increasing risk and the
detection capability was very crude at the time. Now it is
much better, and the lawyers have said that poses a
problem -- when it said none it meant none. Now you can
detect better and you can say that just about everything
does have some changes in the accidents that are possible,
so when you come in here and you have a requirement, "a
well-mixed atmosphere" there is nothing quantitative about
it. It just says a well-mixed atmosphere. Aren't you going
to run into the same problems that I can run a CFD code --
I'm sure Professor Wallis could lend me one that would be
superb --
DR. WALLIS: Sell you one.
[Laughter.]
CHAIRMAN POWERS: I should have known that.
[Laughter.]
CHAIRMAN POWERS: And I could come in and say,
aha! -- look right here, in this corner it is not well-mixed
in that corner and therefore it is an unacceptable
containment.
Aren't you inviting that kind of difficulty when
you don't address those adjectives?
MS. DROUIN: I don't disagree with that.
CHAIRMAN POWERS: Not going to change the
regulation anyway, right?
MS. DROUIN: I didn't say that.
DR. WALLIS: This is where you really come up
against the nitty-gritty.
MS. DROUIN: Yes.
DR. KRESS: That's right.
DR. WALLIS: Find out if it is possible to do the
job you are trying to do.
MR. CUNNINGHAM: That's right.
DR. APOSTOLAKIS: Remember, this is a work in
progress.
MS. DROUIN: Very much in progress.
DR. WALLIS: But the interesting part to me is
whether you can make it work on any one of these things.
MS. DROUIN: Absolutely.
MR. CUNNINGHAM: And 50.44 --
DR. WALLIS: Even a part of 50.44.
MR. CUNNINGHAM: Even a part of 50.44 is
relatively simple compared to some of the other regulations.
It is a good test but it is a fairly simple test at this
point.
MS. DROUIN: And the other part of 50.44 --
because what you see here in terms of the work in progress
is looking at 50.44 the way it is written today and how it
is implemented today.
The other thing that you don't see here, which we
are just right now starting -- we don't have anything to
present to you yet -- is saying let's not even look at what
is written. Let's look at the objective of what the rule
was and starting with a blank piece of paper, one, do we
even need a regulation that gets to controlling -- whatever
the title of our regulations are -- combustible gas.
You know, do we need such a regulation and if we
were to write that regulation with a blank piece of paper,
how would it be written from a risk informed manner, and so
we are also attacking it from that perspective and coming
from looking it this way, which we started by looking at the
separate requirements, now starting on a blank piece of
paper it will be interesting to see if the two converge
whether we end up at the same place. At this point I can't
tell you where we are going to end up.
DR. WALLIS: Can you imagine a regulation which is
a one-liner which says "Thou shalt design an H2 control
system or combustible gas control system so that some
probability is less than 10 to the minus X" and that's just
the regulation, one line.
MR. SIEBER: I can't imagine that.
DR. WALLIS: Then it is up to the designer to do
it or the licensee to show that it meets that criteria -- a
one-line regulation.
MS. DROUIN: I don't know.
DR. WALLIS: Is that sort of thing feasible, do
you think?
MR. CUNNINGHAM: Again, you can go into some of
the regulations that we have got on the books today, the
regulations themselves are very simple and they are not
quite that simple but they are very simple, but then they
will add on either an appendix to Part 50 or something that
complicates things or a Reg Guide or something, but in many
cases -- we have said this before in a different context --
sometimes the regulations themselves are not the issue here.
It is the implementing documents that complicate things
greatly.
DR. BONACA: I just would like to make a comment.
I made it before, but I don't think it was picked up. We
spoke before about correlating cornerstones with this
approach, and you are still working on it. I'd point out
again that there is an inconsistency in the definitions of
prevention and mitigations that you use here versus the
cornerstone.
In the cornerstone you use the traditional
approach whereby a diesel generator unavailability falls
into the mitigating systems. Here you are referring to core
damage.
MR. CUNNINGHAM: Yes.
DR. BONACA: And you are looking at a mitigation
as a condition of failure -- it's almost impossible to
relate --
DR. APOSTOLAKIS: Oh, but --
DR. BONACA: -- and I am pointing it out because
the new Oversight Program is supposed to be risk informed,
but you have to make sure at some point the two things
correlate.
DR. APOSTOLAKIS: Consistency. There has to be
consistency.
DR. BONACA: It's very important that you look at
it and I think it is a work in progress so therefore you
have the opportunity to either adjust one or the other.
DR. APOSTOLAKIS: Yes, that's point of view. The
other point, which is related to what Graham just said and
we said earlier, is how do you decide in the diagram you
showed us earlier to go one step down? How do you decide to
go one step down, and the guidance has to be the confidence
you have in your results.
In other words, you could in some ideal world have
a one-line regulation, design a reactor so that the core
damage frequency is less than 10 to the minus 4 per year,
nothing else. If you could do that with high confidence,
you wouldn't need anything else, so I think that is
something that I believe you should pay some attention to
and see how it would guide us to do everything else because,
yes, why do I have to worry as a regulator about measuring
hydrogen? There must be a reason, and the reason has to be
the uncertainty in the final result.
DR. WALLIS: If you're sure it won't burn -- sure
you don't have enough to burn, you don't need to measure it.
DR. APOSTOLAKIS: I mean this contributes to some
accident sequences.
MR. BARTON: Yes.
DR. WALLIS: With a humongous containment, fine.
DR. APOSTOLAKIS: So it is really the final number
that should count, so it is not just the point values we are
using and then incidentally we are saying these are mean
values and we think we're okay. I think that uncertainty in
the distribution itself is a key element here because it
dictates how far down you will go.
This is your last slide?
MS. DROUIN: Yes.
DR. APOSTOLAKIS: You are happy to tell us.
MS. DROUIN: Yes.
DR. APOSTOLAKIS: And you have to do it in
seconds.
Okay, I'll give you a minute.
MS. DROUIN: Thank you. As we said, we are in the
midst of preparing a status report that will go to the
Commission, that will address a lot of the policy issues
that we're going to need to go back on.
As I said, we had planned to move it on an
expedited basis on 50.44. We're planning on holding some
kind of public meeting in the April-May timeframe, as we get
more of these ideas more solidified to go back and get some
feedback from stakeholders, and go with the recommendation
to the Commission. I say that is approximately the June
timeframe; that is our target date.
We're looking at, in terms of other regulations,
DBAs, and preliminary recommendations on those to have some
ideas in the August 2000 timeframe. This would go beyond
the 50.44, and to hold a public workshop in September, and
hopefully come back and meet with you all in October.
DR. APOSTOLAKIS: So that would be the next time
we see you?
MS. DROUIN: Unless you wanted to meet beforehand,
but that was the next time we were intending on coming back.
DR. APOSTOLAKIS: This is really important for us.
MR. CUNNINGHAM: You asked at the beginning of the
meeting, when we were looking for a letter. I volunteered
that we were looking for a letter late this year.
That was not in the particular context of, for
example, 50.44. So I tend to agree. I'm not sure we should
be waiting until this Fall to be talking to you again.
DR. APOSTOLAKIS: We should have a supplementary
meeting first. So I will leave it up to you to judge when
it would be convenient and appropriate to have a
Subcommittee meeting, so you will have something more to
say, but it will not be near the end, so that additional
advice will really irritate you.
DR. WALLIS: I'm really puzzled because I don't
think you're anywhere near a recommendation yet.
DR. SEALE: That's right.
DR. WALLIS: You haven't even started to make any
decisions about anything. You have to decide how you're
going to make decisions. So what are you going to recommend
by June?
MS. DROUIN: In June we're just dealing with
50.44.
DR. WALLIS: But you haven't come near resolving
any of the issues on 50.44 yet.
DR. SEALE: You're right.
DR. APOSTOLAKIS: Well, it's March 1st.
DR. WALLIS: I don't think there's any hope at the
present speed.
MR. BARTON: It's a work in progress.
MS. DROUIN: Can I have 15 more seconds?
DR. APOSTOLAKIS: Okay.
MS. DROUIN: This will make you feel better,
George.
MR. BARTON: I doubt it.
MS. DROUIN: Jus real quick, we did have a
workshop --
DR. APOSTOLAKIS: We didn't talk about that, did
we?
MS. DROUIN: I just wanted to give you some
highlights from it. There was general agreement with our
approaching guidelines at a high level, but the thing was
that consistency with the plant oversights, with the
cornerstones, impact on workers, for us to keep and maintain
a good communication with the different owners groups and
the industry programs, because there's a lot happening in
these areas.
One of the things that came out is that if you
remember, at the very beginning, we said that out-of-scope
was emergency planning. We've got some feedback that we
shouldn't necessarily make that kind of statement.
There was a lot of agreement that we should try to
move ahead on an expedited basis on 50.44.
DR. WALLIS: But you don't have a plan yet.
MS. DROUIN: That doesn't necessarily mean that
it's on all of 50.44. Maybe there is a particular aspect of
50.44 that we can move quickly on, and that's what we will
be determining over the next three months.
And that's all I have.
DR. APOSTOLAKIS: Any other comments from the
members?
[No response.]
DR. APOSTOLAKIS: Thank you very much.
DR. WALLIS: I think you might be in trouble if
you didn't come back to us several times. You might come
back and we might say you haven't got there yet. It's still
a long way. I'm concerned about progress.
DR. APOSTOLAKIS: Late May, perhaps? Would that
be all right with you? We'll leave it up to the staff.
DR. WALLIS: You're too high level with all this
discussion. You don't really get down to how you're going
to do the job.
MR. CUNNINGHAM: I would think maybe the best way
to proceed would be using 50.44 as an example to get at just
what Dr. Wallis is saying, how do you take this from the
conceptual level to what is this requirement going to look
like level, and May is probably too late for that.
DR. APOSTOLAKIS: For reliability on PRA, but Dr.
Wallis will have to be there. You're not a member of that.
DR. KRESS: That's all right, we'll make him be
there.
DR. APOSTOLAKIS: Okay, thank you very much. I
appreciate it. NEI and Mr. Christie? You can both come and
sit there.
If you're going to stand, we'll give you the other
microphone. Okay, it's up to you. If you want to stand, we
give you the other microphone.
MR. CHRISTIE: Adrian has only got one slide. I
see new members. Do I have to introduce myself?
DR. APOSTOLAKIS: Yes, tell us who you are.
MR. CHRISTIE: My name is Bob Christie. I am the
owner of a firm in Knoxville, Tennessee that does consulting
work for nuclear power plants and railroads and anything
that has to do with risk and reliability evaluations.
My background is, I started with the Tennessee
Valley Authority in 1974. I did four years in hell doing
regular safety analysis, and then got the light, and I've
now done about 20 some odd years of PRA.
So, I was one of the utility representatives on
the PRA procedures guide. I have been involved in the
efforts over the years.
Presently, we've got in the industry, a lot of
things to risk-inform, to move towards some more effective
regulatory scheme by using risk-informed, performance-based
regulations.
Good enough, George?
DR. APOSTOLAKIS: Yes.
MR. CHRISTIE: Today we would like to talk a
little bit about the meeting that happened, the workshop
that happened last Friday. And you have a detailed comment,
so I'll try and make this short.
There were two documents handed out. One is
called the Framework for Risk-Informed Regulation. Another
is called Risk-Informing 10 CFR 44. Okay, they're both
pretty thick documents.
They were handed out at the beginning of the
meeting. I believe that I was probably the only person
crazy enough to read the documents at night and come back on
Friday having read the documents. Most of the other utility
people were smarter than I was and had not read them, and so
what can we say?
Okay, let's take the general approach. In the
first place -- and we said this in the meeting -- there's no
general agreement on the general approach.
I, particularly, am unclear on what it is. I
really don't understand it. It appears to me to be some
combination of risk-informed space regulation, which is
great for my part. But clearly they have statements in
there that, you know, we're picking things and going to be
consistent with the quantitative health objectives.
Then the first thing they do is use minus four
core damage frequency, which is inconsistent with the
quantitative health objectives, more conservative, et
cetera, et cetera.
You cannot use quantitative health objectives to
set regulations, because we all know that with quantitative
health objectives, safe is safe enough, but they're not
adequate protection.
The regulations are adequate protection, the
safety goals are how safe enough, and therefore you can't
set regulations on the quantitative health objectives or the
safety goals.
So, you know, there's no -- there is definitely no
general agreement on the approach.
DR. KRESS: Bob, do you think it would be possible
to have numbers like the ten to minus four and point one
containment, although not those particular numbers, but
numbers like that that would represent adequate protection?
MR. CHRISTIE: Again, Tom, you've got to recall
that years ago when I proposed what has become to be called
the whole plant program, I said we ought to know the whole
-- the numbers from top to bottom. We ought to start at the
top with the quantitative health objectives.
Well, I wanted to start at the top with defining
adequate protection. And you know I tried a delphi process
to define adequate protection. I have a definition of
adequate protection.
DR. KRESS: Well, would you like to share it with
us?
MR. CHRISTIE: Well, it's approximately three
percent of background, three to five percent of background.
That's what came out of the delphi process.
DR. APOSTOLAKIS: What background?
MR. CHRISTIE: Background, for immediate
fatalities and latent cancers.
DR. WALLIS: You mean the average background, not
the background in Denver or New England?
DR. APOSTOLAKIS: No, he's talking about risk,
background risk.
MR. CHRISTIE: The quantitative health objectives
are based upon .1 percent of the background for individual
fatalities and .1 percent of background for latent cancers.
And so when I asked people to go out and do a
delphi as to -- well, if -- and it was convoluted, but all
of you got a copy of what I sent out. I asked them, if we
define adequate protection as what is the level of risk
reached by the present regulations, what did you think the
present regulations were?
And I said -- and I provided a chart of my own and
thought I might influence people, but I put my chart in an
envelope, closed, so that they didn't too much to them and
so on and so forth.
Again, I have a definition in my own mind of what
adequate protection is on the risk curve. I now have a
definition of what the safety goals are on the risk curve,
and I want to know where every plant in the United States
stands with respect to what I consider adequate protection,
with respect to what I consider quantitative health
objectives, with what I consider to be emergency planning,
what I consider to be what we call, you know, release
categories; the plant damage states; the conditional
probability of systems working, and the initiating events.
I just want plants to have a PRA and to know where
they stand from top to bottom. And each plant is going to
be absolutely unique.
DR. KRESS: Let me ask you another question: How
much faith do you have in a delphi-arrived at definition of
adequate protection, and don't you think that could have
been done by just going to the IPEs, for example?
MR. CHRISTIE: No. I wanted to define adequate
protection. IPE has got nothing to do with adequate
protection. IPEs were risk evaluations.
DR. KRESS: Well, the plants that IPEs refer to
are the result of --
MR. CHRISTIE: Not of regulations.
DR. KRESS: -- of having met adequate protection.
MR. CHRISTIE: No, they're not the result of
regulations. All the plants that are a result of
regulations plus all the other things we do to make the
plant run well -- and adequate protection is, if you had a
plant and it was done just to the regulations, what would
the level of it be?
Okay, the plants are probably an order of
magnitude --
DR. KRESS: It's the worst plant you could build
and meet the regulations; that's what you're saying.
MR. CHRISTIE: Not the worst plant; just a plant
built to the regulations. If you had to just sit down and
go to through the regulations and you took out all the other
things we do that aren't in the regulations, and make the
plant run better, et cetera, et cetera --
DR. KRESS: That's what your delphi says.
DR. WALLIS: What would the level of protection
be?
MR. CHRISTIE: Right, what would the level of
protection be?
DR. WALLIS: Adequate is superfluous.
MR. CHRISTIE: If we define adequate protection --
DR. WALLIS: Real protection, is what you're
saying.
MR. CHRISTIE: It's not the real. The real
protection consists of the piece that comes from regulation
and the piece that come from without the regulations.
And the piece without the regulations is what has
driven us down to probably an order or two magnitude below
the safety goals, not the regulations.
DR. APOSTOLAKIS: So what you're saying is that
what you found was that the adequate protection level was a
factor of 20 to 30 higher than the goal?
MR. CHRISTIE: Give or take.
DR. APOSTOLAKIS: Twenty to 30.
MR. CHRISTIE: Somewhere in there.
DR. APOSTOLAKIS: Do you have a document where you
describe this?
MR. CHRISTIE: No.
DR. APOSTOLAKIS: Do you plan to have one?
MR. CHRISTIE: I'm not sure why I would.
DR. WALLIS: Because it makes your conclusion more
believable.
MR. CHRISTIE: Again, we'll talk to you later.
DR. APOSTOLAKIS: We'll talk later.
MR. CHRISTIE: Okay, so the first place is -- and
over the weekend, the comments that you see have been
reviewed. The comments that you see are my comments, but
they have been reviewed by the other people in the meeting
that were vocal enough to get up and speak.
They've changed my comments, not substantially,
but in many cases, they are people better with words than I
am, and so it represents a composite of a lot of people that
were there.
Okay, let me emphasize, beyond a shadow of a doubt
-- and we told everybody in the meeting that the absolute
emphasis we saw in the meeting on adding requirements was
unacceptable to us, because that's what we saw in the
meeting. The framework, and especially the 50.44, just
added requirements to us. And if you want to get me mad
again, you can make me bring up the examples of why I
thought that.
But I don't think you want to do this. We did it
in one public meeting, and that was bad enough. Two would
be a little bit more.
But the staff is well aware of what we were
thinking. Now, Nick Grantom brought up absolutely that this
thing is critical to everything, not just to Option 3.
If you look at what's happening to the South Texas
Project, what you're seeing there, especially if you look at
the request for additional information, that the South Texas
people are now responding to, you will see clearly in there
that the intent of many of those questions is to preserve
the design basis, control to the design basis, and if you
identify anything in the PRA that is safety significant in
our terminology, then what you will do is, you will control
it just like if it were in the design basis space.
And that is completely unacceptable to us. If
there are no elimination requirements, then why are we doing
all this?
DR. WALLIS: You see this as an additional
requirement then?
MR. CHRISTIE: If you will read the request for
additional information in South Texas, you will find that
there are add-ons, lots of them. And the way that they want
to treat the add-ons is that they want to treat them just
like the things.
Now, we've been assured by the staff, some of the
staff, that that is not the intent of those questions, and
that we are getting a little bit bent out of shape because
we're reading them incorrectly.
But when I read the words, just like I read the
words in 50.44 last Thursday night, coming from the staff, I
read words and I work off of those words. And I know that
the staff, especially in Option 2, is really seriously
trying to help and not create extra burden for us.
But that's not what's coming across. And it
didn't come across last Thursday or Friday, either. So,
eliminating requirements is very crucial to us. Rick gave a
couple of options to the staff, probably in the wrong
meeting, as to what we're expecting on the Option 2 part.
There's a PRA uncertainty issue, and, ladies and
gentlemen, you can read my comments. My comments are the
same comments that you heard from Dr. John Garrick when you
had the joint ACNW/ACRS meeting.
To treat uncertainty, what you do is, you know the
factors that lead to the uncertainty, you know the magnitude
of the uncertainty, and you know how much impact it has on
the decision process.
If you know all that, then you can treat and
handle uncertainty.
CHAIRMAN POWERS: We have colleagues here that
have a variety of definitions of uncertainty. And they
distinguish between aleatory uncertainty and epistemic
uncertainty.
When we interrogate them on the epistemic
uncertainty, they say, oh, yes, but that also includes the
things that you have not modeled.
And so how do I know that uncertainty?
MR. CHRISTIE: Again, I have been doing risk
assessments now for 20 years. Almost every risk assessment
I have ever done includes uncertainty. How well we have
included that uncertainty and that risk assessment, again,
is in the eyes of the beholder.
We've spent enough money, we thought, to make the
decisions that were necessary to improve the plants and make
sure that the plants were working well.
I can't answer that. We'd spend days trying to
work on that question.
DR. SEALE: But it doesn't do us any good to spend
our time arguing that it's therefore an inappropriate
question to ask.
MR. CHRISTIE: Oh, I think the question of what is
the uncertainty in your probabilistic risk assessment is one
of the key questions that you have to answer, and you do the
best job you can to go through the facts, identify the
factors, try and quantify the magnitude of the uncertainty,
and then see how it hits the -- influences the decision
process.
But the key is the decision process, not spending
millions and millions of dollars reducing uncertainty.
Once you get those factors down, if you can, and
-- again, it will be in the eyes of the beholder, how well
you get it down -- but it's the guys who've got the money
that basically have to make the decision.
DR. KRESS: But there has to be some guidance then
to the decisionmakers on how to use uncertainty in their
decisionmaking process.
MR. CHRISTIE: Again, I was a participant in the
PRA Procedures Guide. We put guidance in there on how to
treat uncertainty. If we did a bad job, I haven't heard
about it.
You know, what we would add to it today, I don't
know. Probably we would add some things to it, because
we're theoretically 20 years smarter.
But if you want to go back and say in the PRA
Procedures Guide, let's change the guidance on uncertainty,
then, fine, you know, put together another ASME, ANS, and RC
program and we can go do it.
DR. KRESS: I'm interested in guidance to the NRC
staff on how they should use the uncertainty, assuming they
had relatively good numbers for it.
MR. CHRISTIE: Oh, okay.
DR. KRESS: This is a different subject.
MR. CHRISTIE: Could be. I'm not sure we --
George, I think we did.
DR. APOSTOLAKIS: You answered the question.
DR. KRESS: You answered it pretty good.
DR. APOSTOLAKIS: And we are running out of time.
MR. CHRISTIE: Single-failure, hey, we don't need
single-failure in this framework document. You know, I
mean, we've got PRAs. They do single-failure,
double-failure, triple-failure, they do common cause, they
do dependent failures, they do anything you want them to do,
and they do it better than anything I've ever seen before,
and I have done them both.
So, to try and add single-failure into some
framework for writing regulations today is, to me -- we're
wasting our time, in my opinion.
The same thing would go for design basis. There
are some pieces of the design basis stuff that works, and
we'll keep, but let's go to risk-informing 50.44.
As you probably know, there is a petition for
rulemaking that went into the Federal Register January 12th
on 50.44. It completely stripped all the design basis stuff
out of the proposed rule.
It was not relevant to public health risk, and we
just stripped it out.
DR. WALLIS: It just seems to me, the biggest
difficulty to risk-informing 50.44 or any other regulation
is that the objective of the regulation is not cast in risk
language. So you don't know what goal you have in terms of
the language you're trying to use.
MR. CHRISTIE: Dr. Wallis, I recommend that you
read the petition for rulemaking, and see if we did the job
of phrasing it in risk. This is our attempt.
DR. WALLIS: You did it?
MR. CHRISTIE: Yes, well, myself and a bunch of
other people. It come from us, comes from people that have
done risk assessment.
DR. WALLIS: You don't find in 10 CFR, blah, blah,
blah.
MR. CHRISTIE: You do find in 10 CFR, some, 50.63
station blackout, risk, right; 64 is risk. Oh, yes, it's
got elements of risk in 50.63.
DR. WALLIS: But it's not quantified.
MR. CHRISTIE: No, not quantified numbers, but it
has elements of risk to it. So, you know, we've done that,
put in the 10 CFR, elements of risk. Have we done it
successfully and well? Again, it's in the eyes of the
beholder.
Big issue in the meeting last Friday -- and you
can talk to some other people about it, because I don't like
talking about it anymore -- we did simplify the procedures
at Arkansas and San Onofre. It was a risk-positive move.
It was approved by the Nuclear Regulatory
Commission in the safety evaluation report, and if you read
the document, you will see that that may not have been true
to the people that wrote this document on 50.44, which
caused quite a bit of tempest.
I would have t say, and I haven't been to all NRC
meetings, but the meetings on Thursday and Friday and the
workshop were the most contentious meetings I have been in a
long time. We had people way past the bounds, myself
included, okay? It's one point in time I sat down and shut
up because all I was doing was adding to the gasoline, and I
will say it to the NRC people that are here today -- I got a
letter -- Tom King -- I meant no disrespect to you people or
to you national lab people by my silence.
DR. APOSTOLAKIS: So where can we find all this
information?
MR. CHRISTIE: It is in the framework document and
in the 10 CFR document, the things that they handed. It
came in a package.
DR. APOSTOLAKIS: But you are summarizing this
contentious meeting?
MR. CHRISTIE: Right, I am summarizing some of the
issues in the contentious meeting and my words that
accompany these slides.
DR. APOSTOLAKIS: And you are trying to be fair,
presenting both sides?
MR. CHRISTIE: I am never fair.
DR. APOSTOLAKIS: Okay. But you are very honest.
MR. CHRISTIE: I hope so. Okay. It became clear
to us that some part of the NRC was to put all plug igniters
for the large dry containments. That's already been through
the process, the 1509. It shouldn't even enter in at all to
any criteria or anything with respect to rewriting 50.44.
The hydrogen monitoring issue, again we find no
safety reason for hydrogen monitoring in any of the plants,
period. Okay? There's a lot of operational concerns for
hydrogen monitoring but they are operational concerns and
they have nothing to do with what we call adequate
protection of public health and safety. They have to do
with operational concerns. They are not the primary
parameter for any action that we know of taken in the
plants.
DR. KRESS: You are defining adequate protection
in terms of the QHOs in this case?
MR. CHRISTIE: No. I am defining adequate
protection in terms of is this a primary parameter that I
would have to have to guarantee that things work the way
they should work, and hydrogen monitoring is not one of
them, to the best of our knowledge.
We do lots of things in the emergency operating
instructions or some people call them emergency operating
procedures. We have lots of accident management guidelines,
et cetera, et cetera, but it is not a key ingredient that
would cause us to do anything different.
If Dr. Wallis is correct, if we removed all
hydrogen monitoring from the plant, the plants would do the
things that they are doing and probably without it -- the
same actions would be taken. Okay?
The last one is long-term hydrogen. Again, some
of the people in this room were involved in San Onofre. It
was a concern that was brought up. The Safety Evaluation
Report was written for San Onofre on the basis that the
hydrogen monitoring and the long-term hydrogen recombiner
issues were put to bed except when the SER was issued the
recombiners were declared non-safety and hydrogen monitors
were not.
We still have hydrogen monitors safety-related at
San Onofre. In the petition for rulemaking we would no
longer have that if that petition for rulemaking were to go
through.
DR. WALLIS: Well, if you are right that having
hydrogen measurements has no effect, then you don't need to
be risk-informed to decide you don't need it.
MR. CHRISTIE: No, the basis that we got to to
decide on what the primary measures were was a risk informed
affair. You could not do that decision -- we would not have
made the decisions we made, for instance to basically depend
on reactor vessel level, thermocouples in the core,
radiation monitors around the core, radiation monitors in
the containment, pressure and temperature in the
containment, et cetera, et cetera, if we hadn't done all the
risk assessments and ran that kind of thinking process
through well, what is it that we really want to do.
For instance, on hydrogen monitoring, we can have
sequences where we will completely wipe out the core or put
it on the floor and the amount of hydrogen won't be much at
all. Your design basis LOCA without any safety injection,
for instance, is probably the classic example. We melt the
core with no water on it. We won't have any zirc water
reaction and we won't have any hydrogen but that core will
be on the floor.
DR. WALLIS: You'll be making hydrogen from the
concrete -- but we are getting into too many details.
MR. CHRISTIE: Yes, but when we, by the time we
get to hydrogen -- the corium on the floor -- is there
anything that the operators haven't done already to retain
the containment capability such as the sprays, et cetera, et
cetera? Would they do anything different? They have
buttoned it up. They have turned on all the active heat
removal systems, et cetera, and Adrian -- where is Adrian?
DR. APOSTOLAKIS: Yes, Adrian --
MR. CHRISTIE: I'm sorry, Adrian, I, as always in
these ACRS meetings, I went over.
DR. APOSTOLAKIS: Are you finished?
MR. CHRISTIE: Yes, I am finished.
DR. APOSTOLAKIS: Thank you very much, Bob.
MR. HEYMER: My name is Adrian Heymer. I am from
NEI. I am a Project Manager. I have been working on and
off on risk informed activities at NEI since about 1993 and
I guess I first used PRA in the field in about 1977 in a
different country at a different time and a different place.
I just want to say a few words to clarify some
issues. It may have been a boisterous workshop last week,
but I think it was very beneficial and this meeting today
has been -- the more you discussed this, the more I learned.
I think when you look at the framework and you look at the
slide that the NRC put up with the framework, the one that
had the defense-in-depth box, I think that is a very good
start.
I think it may not be perfect but it is a good
start from which we can build. I think it is true the
industry were confused by some of the statements -- like the
defense-in-depth box. We struggled with that a bit.
We are sending a document out to get some formal
industry feedback and we will be passing that on to the NRC.
I think the term "single failure" that is also put
in there we also found a little confusing.
As to is there a general agreement on the
approach, the guidelines and the framework, I am not quite
sure what that entails. It seems to be a big box of things
to say there is a general agreement on. I think we have got
a good starting point. I think the NRC Staff have done a
very creditable job in getting to where they have got to
today. They have set themselves a very aggressive schedule
on 50.44 and they have gone through this process and they
have come to the conclusion, very much the same conclusion
as the industry reached when it sent a letter to -- and we
sent a letter to Chairman Meserve January the 19th, and I
can make a copy of that available if you don't have one,
which summarized the results of the survey the industry did
at the back end of last year on where should we focus our
efforts, from the benefits side, on risk informed
regulation, the technical aspects.
We came up with a conclusion that it is 50.44
because we have already done a fair bit of work on that.
That is work that went as an example to see how far we can
get, set a timeline, reach a decision, and move forward, and
the next one, which is a lot more complex, is 50.46, which
really -- it's been said here before -- the regulations are
like a carpet. They interweave and they are all dependent
upon each other, but if you don't look at what you can do
with 50.46 first when you look at the other regulations, you
tend to get locked back into 50.46.
MR. BARTON: What is 50.46, Adrian?
MR. HEYMER: The ECCS performance.
MR. BARTON: Okay.
CHAIRMAN POWERS: Let me ask you a question.
Because the plants have been built, so many of them have
been built, and they have been built to comply with 50.46,
suppose I changed that regulation radically. Would I really
have any impact on the industry at all?
MR. HEYMER: Yes, I think you do as regards some
of the day-to-day activities, as regards to the ability to
reassess where you stand as regards -- as it cascades down,
perhaps not just from 50.46 but as it cascades down to some
of the other regulations.
CHAIRMAN POWERS: I think I might concede to you
the point on cascading down.
MR. HEYMER: Yes.
CHAIRMAN POWERS: But the regulation itself I
don't think gets you very much.
MR. HEYMER: But the issue I am trying to drive at
and we are trying to drive at from an industry perspective
is that unless you find out what you can do with 50.46, when
you go to these other areas and try and determine what you
can do with that, you get locked back up into 50.46 -- it's,
if you like, a central regulation.
CHAIRMAN POWERS: I think that's true. I can
imagine it's true. I haven't shown that for myself, but it
seems to me that if I were going to do something like that
that I would start with the GDCs.
MR. HEYMER: Well, you can start there. It's just
the fact that the GDCs are -- there's not too much in the
GDCs that you have to change. It's in the implementing
documents that you would have to change, but they are linked
back to 50.46 in itself.
CHAIRMAN POWERS: I think the GDCs link back to a
good deal more than 50.46.
MR. HEYMER: They do, but a lot of what you might
want to change or end up changing can be linked into 50.46
and it provides what the industry believes is a significant
stepping stone to moving on, not only in the other
regulations but to reassess the plant and make improvements
in the plant.
I think once you have sorted 50.46 out, then you
have got a clear path to where you need to put your
priorities for the other regulations.
CHAIRMAN POWERS: Okay. I'll think about that a
lot, but I have always kind of looked at 50.46 not so much
as having an impact but rather being a demonstration of
commitment rather than having any impact simply because
plants are already built and already has an ECCS system that
obviously meets the requirements of 50.46 and they probably
are not going to change that very much. The problem is it's
already fixed.
Now you may be right -- they back off on a lot of
things they maintain about it and there are other things
they do that are hooked to it, but it wasn't first on my
list.
MR. HEYMER: Okay. I think the point has been
made fairly forcibly a few moments ago and also in the
workshop there are some items that are in the guideline
documents and the material that was handed out that we will
comment on as an industry and I think that is expected and
we will provide those comments.
I think it is important not to revisit issues past
unless there is really good reason to.
I would like to say a word about an additional
activity that is being progressed, which I think some people
in this room are aware of associated with Generation 4
plants, and that is really starting off with a clean sheet
of paper and saying where do we go with the regulations.
There was a debate at senior levels within the
industry on should we try that approach, and the feeling was
no, because we want to have, if you like, two sides. We
want one side that can benefit existing plants and it was
just felt that starting off with a clean sheet of paper,
one, it might take us some time to get there, and two, it
might be difficult to translate those into the current
fleet, but that is going on and I see that as being another
activity which helps to improve the regulations and focus on
the right stuff.
I do think we have made a reasonable start. I
think we are impressed with the schedule that the Staff has
put down and placed and we hope they keep to that schedule
and it is good they have broken down 50.44 and 50.46 into
chunks to look at, and that is probably a good thing to do,
but we are looking for some good management to drive itself
to a conclusion so that we don't continue to evaluate and
evaluate and evaluate. There comes a time when you have to
draw a line.
Finally, we do need a success in risk informed
regulation and we would go for a small success rather than a
big success. At the workshop I said we would take a field
goal over a touchdown, taking the liberty to put it in
American football terms, but there --
DR. WALLIS: What's a field goal?
[Laughter.]
MR. HEYMER: There are a lot of skeptics out there
on risk informed regulation and I think we need to get a
success on the board, and I think the NRC Staff is trying to
work towards that.
DR. APOSTOLAKIS: So are you implying that there
have been no successes yet?
MR. HEYMER: I think from where the industry
stands at the moment they look at risk informed regulation
and they say, well, what is risk informed regulation? Some
people think, well, I might consider ISI and IST as a
partial success but I think I could go a lot further than
what we have done in the past.
If you mention the maintenance rules, executives
tend to rise out of their chair very much like other people
do on some issues associated with 50.44, and so that is not
considered a success from the industry perspective, and
there was a flavor -- I don't think it was meant or intended
at the workshop -- that was mentioned before about adding
on, and it was suggested there is also elimination, and I
think that point was taken by the NRC as improving is
eliminating as well as improving -- adding on -- if there is
need to add on at all.
I guess the other point that was made at the
workshop and hasn't been brought up here, if you are going
to add on, you must be careful not just to add on but you
mustn't pile on, and there is a temptation to sometimes do
that on voluntary efforts. I think that has been kept in
check in the past and it will be in the future.
DR. APOSTOLAKIS: You think this is voluntary, eh?
[Laughter.]
DR. APOSTOLAKIS: This is a personal view. It
does not reflect anybody else's view.
Mr. Heymer, do you have anything else to say that
you think is extremely important?
MR. HEYMER: That's it.
DR. APOSTOLAKIS: Okay. Thank you very much for
coming here. Back to you, Mr. Chairman.
CHAIRMAN POWERS: I will recess the committee
for -- till ten minutes of the hour and that will conclude
the transcription service.
[Whereupon, at 3:35 p.m., the transcribed portion
of the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016