472nd Advisory Committee on Reactor Safeguards - May 12, 2000

                       UNITED STATES OF AMERICA
                     NUCLEAR REGULATORY COMMISSION
                                  ***
       MEETING:  472ND ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
     
                              U.S. NRC
                              Two White Flint North, Room T2-B3
                              11545 Rockville Pike
                              Rockville, MD
                              Friday, May 12, 2000
     
               The committee met, pursuant to notice, at 8:30
     a.m.
     
     MEMBERS PRESENT:
          DANA A. POWERS, Chairman
          GEORGE APOSTOLAKIS, Vice-Chairman
          JOHN J. BARTON, Member
          MARIO V. BONACA, Member
          THOMAS S. KRESS, Member
          ROBERT L. SEALE, Member
          WILLIAM J. SHACK, Member
          JOHN D. SIEBER, Member
          ROBERT E. UHRIG, Member
          GRAHAM B. WALLIS, Member.                            C O N T E N T S
     ATTACHMENT                                              PAGE
     INTRODUCTORY STATEMENT                                   269
     HATCH UNIT 1 SCRAM WITH COMPLICATIONS (AIT)              326
     RISK-INFORMED REGULATION - IMPLEMENTATION PLAN           270
     OVERVIEW                                                 414
     SELF-ASSESSMENT PROGRAM                                  442
     .                         P R O C E E D I N G S
                                               [8:30 a.m.]
               CHAIRMAN POWERS:  The meeting will now come to
     order.  This is the second day of the 472nd meeting of the
     Advisory Committee on Reactor Safeguards.
               During today's meeting, the committee will
     consider SECY 0000-62, risk-informed regulation
     implementation plan.
               An operating event at E.I. Hatch Nuclear Power
     Plant Unit 1 is particularly interesting to us because I
     believe Hatch will be the next plant coming in for license
     renewal.  Reconciliation of ACRS comments and
     recommendations, physical security requirements for power
     reactors, future ACRS activities, report of the Planning and
     Procedures Subcommittee, and we will examine some proposed
     ACRS reports.
               A portion of the session associated with physical
     security requirements for power reactors will be closed
     today to discuss safeguards information.  There will be some
     special procedures we will have to follow for that process.
               The meeting is being conducted in accordance with
     the provisions of the Federal Advisory Committee Act.  Mr.
     Sam Duraiswamy is the Designated Federal Official for the
     initial portion of the meeting.  We have received written
     comments and requests for time to make oral statements from
     Mr. Edwin Lyman, of the Nuclear Control Institute, regarding
     physical security requirements for power reactors.  
               A transcript of portions of the meeting is being
     kept and it is requested that speakers use one of the
     microphones, identify themselves, and speak with sufficient
     clarity and volume so they can be readily heard.
               As an item of interest, it is my understanding
     that Mr. Bohnert is now doing fine, for the members that
     might be interested.  
               With that, I will ask if any of the members have
     comments that they would like to make as an opening
     statement.  Seeing no pressure to do so, I will turn to the
     first item of our business, which is the risk-informed
     regulation implementation plan.  I believe this is a name
     change for something we used to call the PRA implementation
     plan.
               Professor Apostolakis, I believe you are going to
     lead us through this.
               DR. APOSTOLAKIS:  Thank you, Mr. Chairman.  The
     staff is here, Mr. King and Mr. Cunningham, to talk about
     the comprehensive strategy, that includes the objectives,
     goals and timeframe for the transition to risk-informed
     regulation.
               With that, we are very anxious to hear your story. 
     Mr. King?
               MR. KING:  Though his name is not on the
     viewgraphs, we invited Mr. Holahan to join us, as well.
               DR. APOSTOLAKIS:  As long as he identifies
     himself.
               MR. KING:  For the record, my name is Tom King,
     from the Office of Research.  This is Mark Cunningham, the
     PRA Branch Chief from Research, and Gary Holahan, Division
     Director from NRR.
               What we want to talk about today is sort of an
     information briefing.  We're not asking for a letter from
     the committee on this.  What we're talking about is a
     program that's work in progress right now.
               As you mentioned, this used to be called the PRA
     implementation plan, and I'll get into that a little further
     as to why we've changed the name and what the objectives and
     so forth of this document are.
               Even though there's only three of us at the table,
     this does involve all the major offices, Research, NMSS,
     NRR, and will also involve the folks in Admin, the training
     people.  We will involve their help in putting together a
     communications plan and I think certainly the international
     activities of the agency, there's a lot of international
     interest in risk-informed regulation, so this plan will also
     be of interest to them. 
               So there's more than just the three of us sitting
     up here.
               CHAIRMAN POWERS:  Let me ask you, do the senior
     reactor analysts in the regions get involved in this
     planning activity?
               MR. KING:  Say that again.
               CHAIRMAN POWERS:  Do the senior reactor analysts
     in the regions get involved in this planning activity?
               MR. KING:  So far, they have not gotten involved
     in this planning activity.  I think somehow we're going to
     have to get them involved.
               CHAIRMAN POWERS:  They seem like a very central
     component in all of this, especially with the new oversight
     process. 
               MR. KING:  They've certainly been involved in the
     new oversight process and the training and communications
     that go along with that.  In terms of the option two and
     option three work, they have not been involved in the option
     three work.  I'll let Ed talk about the option two work.
               MR. BARRETT:  I don't know that we've had them
     involved at this level of planning, but we do have regular
     counterpart meetings with the SRAs to discuss issues related
     to the -- mostly to the oversight process and to the process
     for risk evaluation of events.  
               We have twice-yearly counterpart meetings with
     them and, of course, we have regular communications on a
     day-to-day basis on specifics.
               MR. KING:  I think that's a good point.  It
     probably would be worthwhile specifically getting their
     feedback and input on this.
               DR. APOSTOLAKIS:  Why don't you call these
     risk-informed, performance-based regulation implementation
     plans?  Why do you leave out performance-based?  I mean, the
     oversight process does utilize performance-based metrics.
               MR. KING:  And there is a performance component. 
     One of our five principals is performance monitoring. 
     Basically, we left it out because even though, in
     risk-informed regulation, we're going to look, if we make a
     change to a regulation or requirement, we're going to look
     and see if we can do that in a performance-based fashion.
               There is another activity taking a look at other
     things that are not risk-informed to see if they can be made
     performance-based.  So we didn't want to imply that this
     plan included the other plan that's underway, as well.
               DR. APOSTOLAKIS:  So it's a bigger issue then.
               MR. KING:  It's a bigger issue than just
     risk-informed activities.  What we've worked out with the
     folks leading the other plan, the performance plan, is that
     if we're going in and looking at a regulation to be
     risk-informed, we will also look at the performance-based
     aspects of that, so they don't have to do that.  They're
     really going to focus on the things that aren't being
     touched as part of the risk-informed activities.
               DR. SEALE:  Is there the reciprocal of that
     agreement, that if the performance-based people find a
     potential indicator that might have risk implications, that
     you will somehow coordinate with them?
               MR. KING:  I think if they find something that
     they feel we should look at in a risk-informed fashion, yes,
     they will bring that to our attention.  
               Just as far as the organizational aspects of this
     plan, Research is the keeper of the plan, but we're
     certainly not the full author of the plan.  As I said, it's
     going to involve a number of offices.
               Just by way of a little background, as you
     mentioned, the PRA implementation plan has been around since
     1995.  It basically was organized by office and it listed
     the things the office, the various offices were doing in the
     risk-informed world.  It had been updated -- 
               CHAIRMAN POWERS:  Would you call that a plan or
     would you call that a listing of activities?
               MR. KING:  I call it a catalog.  
               CHAIRMAN POWERS:  That's what I would call it.  
               MR. KING:  Part of the problem was that you could
     look it and see what was being worked on today, but you
     couldn't tell where did you want to go in the future and how
     did these things cut across the offices and how are they
     being coordinated and integrated.  
               We had an audit from GAO on the risk-informed
     regulation last year.  They issued a report that basically
     said the agency doesn't have a strategy for where it wants
     to go on risk-informed regulation.  It has a lot of
     discussion, but where do they want to go.  So they suggested
     we develop what they called a strategy.
               The Chairman, Chairman Jackson, at the time,
     agreed to do that.  We provided the Commission an outline in
     January of this year.
               Then in SECY 0062, we provided to the Commission
     some example sections of what that document might look like
     in terms of its scope and depth, and we'll talk a little bit
     more about the scope and depth and content of this thing.
               We had a Commission briefing in March.  We got an
     SRM from the Commission in April that basically said give us
     a complete draft in October of this year.  That should
     include a communications plan, it should include
     identification of those important factors that affect
     planning.  We'll talk a little bit about that, also.  And it
     also asked a question on PRA quality, which we're going to
     have to respond to in June, sort of separate from the
     implementation plan.
               What are the objectives of this document?  We
     changed the name, for one thing, to get away from -- to
     really use the terms the agency is using, risk-informed
     regulation and call it what we intend it to be, an
     implementation plan.
               The idea is that it is going to provide an
     integrated plan for the agency's risk-informed activities
     and really if you start at the top -- actually, I think what
     I will do is put on slide four and talk about how this fits
     in the overall structure of what the agency has in terms of
     documents.
               They've got the strategic plan, which is sort of
     the top level document, and if you look, it has basically
     four performance goals for each of the arenas; maintain
     safety, improve public confidence, reduce unnecessary
     burden, improve effectiveness and efficiency.
               If you look at those performance goals, they use
     the word risk or risk-informed in there, that you'll do
     things in a risk-informed fashion.  But beyond that, it
     doesn't get into any details as to what does that mean.
               At a high level, the intent of this risk-informed
     regulation implementation plan is to lay out what is the
     agency going to do to implement those high level goals and
     those high level statements in the agency's strategic plan. 
     It sort of is a link between the strategic plan and the
     detailed operating plans that each of the offices has that
     covers the major arenas that the agency works in.  
               It feeds into putting together the operating plans
     for each of the arenas, just like other things feed into it. 
     The risk-informed regulation implementation plan isn't the
     only thing that drives the work of this agency.  There are
     things called program assumptions, that includes things like
     how many plants do we expect to come in for license renewal
     and so forth.  
               So when we're planning and budgeting, there's a
     number of things that are considered, and the risk-informed
     regulation implementation plan will be one of those things
     that will provide information that's considered when the
     budgets and the detailed operating plans for each office are
     put together.
               DR. KRESS:  Tom, when this gets approved, say, by
     the Commission, would it, in effect, serve the same purpose
     as if you had a Commission policy statement on risk-informed
     regulation?
               MR. KING:  I know you have a letter to the
     Commission suggesting such a policy statement.  I don't
     know.  But the response to that letter would be -- I can
     give you my personal opinion.  I think this document could
     go a long way to doing what you recommended in your letter,
     if not totally.  That's my personal opinion.  
               Anyway, this is how we view this implementation
     plan fitting into the larger scheme of how the agency
     decides what it's going to do.  Getting back to slide three,
     really, at a high level, what this document will do is lay
     out a process and some guidelines as to how we should take a
     look at and decide what should be risk-informed, given that
     you want to go risk-inform certain whether it's regulations
     or activities that the agency does, what do you need to do
     to accomplish that, and then that will lead to what should
     be the priority in the schedule for accomplishing that.
               DR. WALLIS:  Tom, it seems there's something long
     before this, that is, why would you want to risk-inform
     anything and what criteria would you use in deciding.
               MR. KING:  Slide five, we're going to talk about
     the guidelines or criteria.
               DR. WALLIS:  There must be some sort of motivation
     that says risk-informing is being there in order to achieve
     something.  
               MR. KING:  You should risk-inform an activity,
     basically, if it's going to help you accomplish your major
     agency performance goals.  It's going to lead to helping
     maintain safety or improve effectiveness or efficiency or
     reduce unnecessary burden, then it would be a candidate to
     -- 
               DR. APOSTOLAKIS:  Actually, maintaining safety
     will not be a goal.  That's a boundary condition, really. 
     If you want to maintain the established goal, why move to
     something else.  It's just that the benefits are increasing
     effectiveness and location of resources, under the condition
     that safety will be maintained.
               That's the way I would look at it.  Not that it
     really matters much.  
               MR. KING:  I would disagree a little bit.  I think
     in the sense that risk-informed is going to make you focus
     on the things that are important, and maybe today's
     regulations don't really cover those things or some of those
     things very well, I think it does help you maintain safety.
               CHAIRMAN POWERS:  When I speak to older hands in
     the design of regulations, about risk-informed regulation,
     they say we always did risk-informed regulation.  We didn't
     create regulations for things that we didn't think were
     risky. 
               So I think there's a question here that comes up,
     and maybe it's in your second question up there, is how
     risk-informed is risk-informed.  I mean, is it intuition
     that this is a hazardous train or an important train to
     prevent hazard or is it detailed quantitative analysis that
     gives you a specific risk achievement worth or risk
     reduction worth?
               MR. KING:  It can be both.  It doesn't always to
     have a --
               CHAIRMAN POWERS:  I guess what I'm asking is does
     this plan line that out for these various activities, on how
     risk-informed you want to be in each one of these
     activities?
               MR. KING:  The intent of this plan is to lay out
     what are the goals that you're trying to achieve in
     risk-informing an activity, what are the tools, the data
     that you need to do that, guideline documents.
               DR. WALLIS:  See, now you've changed the name. 
     When it was PRA implementation plan, the question was what
     can PRA tell us about what the regulations are doing now and
     how they might be improved.  Now you've changed the name and
     it's become more nebulous what you really mean by
     risk-informed.
               DR. APOSTOLAKIS:  I think the understanding is
     that when we say risk-informing something, we mean to use
     quantitative risk information.  
               DR. WALLIS:  That wasn't the implication of Dana's
     question, though.  It seemed to be that there is another
     kind of risk-informed, which is sort of semi-intuitive.
               DR. APOSTOLAKIS:  That's not what this plan is all
     about, in my view.  I mean, yes, the regulations have always
     been risk-informed, but that's not what most people
     understand by risk-informed.  
               Risk means, in this context, quantitative
     information coming out of performance assessments or
     probabilistic risk assessments.  Otherwise, I don't see how
     this is any different from what the agency has been doing
     before.  
               Do you agree with this?
               MR. KING:  I agree with that.  I wouldn't exclude
     use of qualitative information.  
               DR. APOSTOLAKIS:  That's why it's informed.
               MR. KING:  But the heart of it is going to be
     quantitative.
               DR. APOSTOLAKIS:  That's why it's informed.
               MR. KING:  Yes.
               DR. APOSTOLAKIS:  But the new thing now is this
     quantitative information, and quantitative, let's not take
     it too literally.  I mean, having the dominant accident
     sequences in itself might not be quantitative information,
     but it comes from quantifying frequencies and ranking
     things.
               PRA and PA, that's what we mean.  
               CHAIRMAN POWERS:  My concern is that's what we
     think they mean, but do they really mean that.
               DR. APOSTOLAKIS:  He agreed, Tom agreed.
               MR. KING:  I agree.  I agree.  
               DR. WALLIS:  So without use of a PRA, it's not
     risk-informed.  It's a sine qua non.
               DR. APOSTOLAKIS:  Yes, I would say that.
               DR. WALLIS:  It is not.
               DR. APOSTOLAKIS:  Now, PRA, you include the
     performance assessment, right?  PRA is interpreted in the
     broadest sense.  I mean, if it includes statistical
     calculations and so on, you don't necessarily have to see an
     event tree, for example, to call it a PRA.
               MR. KING:  I think the main thing that such a plan
     as this will do that the PRA implementation plan didn't do
     is it's going to provide a systematic structured look at
     where does the agency want to go in risk-informing its
     activities and how does it plan to get there, what does it
     need to get there, what are the priorities of getting there.
               DR. APOSTOLAKIS:  Tom, in my mind, the most useful
     result of this activity will be this plan, will be to
     prioritize which regulations to risk-inform first and to
     identify needs for doing so, the most important needs first.
               Is that the correct perception?
               MR. KING:  Yes, I think that's true.  
               DR. APOSTOLAKIS:  I mean, goals and objectives, I
     don't know, it creates a lot of paperwork.
               MR. KING:  I think it will also be a good
     communications vehicle, too.  We talk about risk-informed
     regulation, but we don't have anything that can hold up to
     external stakeholders or internal stakeholders that really
     ties it all together and says this is what we mean by
     risk-informed and this is what we're trying to do.
               We give presentations, talk about some specifics
     that are going on, but there's no document that ties it all
     together.
               DR. APOSTOLAKIS:  So communicating the agency's
     objectives and activities, you don't necessarily mean risk
     communication. 
               MR. KING:  No, no.  I'm talking about the
     programmatic type things.  
               DR. KRESS:  Do you have anybody from NMSS working
     with you on this?
               MR. KING:  Yes.  NMSS is going to have the lead
     for two of the major arena chapters on this.  We'll talk a
     little bit about them.  
               DR. APOSTOLAKIS:  Are they here?
               MR. KING:  There's one NMSS person back there in
     the back row who is involved.
               MR. HOLAHAN:  And Joe Murphy and I have been
     invited to be on the steering committee for NMSS' actions to
     risk-inform their various areas of responsibility.
               DR. WALLIS:  In this first question, what should
     be risk-informed, it seems to me you're implying that
     risk-informing means changing the regulations in some way,
     and it seems to me that the first thing that's got to be
     risk-informed is the agency and the public and look at what
     the regulations are now, use the insights of risk to figure
     out what kind of risk reduction they are achieving in terms
     of the measures, PRA or whatever you're going to use.  
               That's risk-informing your knowledge about what
     you're doing now, before you try to change anything.
               MR. KING:  I agree.  You start with what you have
     today.
               DR. WALLIS:  Right.  And this would also let you
     and the public know what's sort of the real value of what
     you've been doing over all these years.
               DR. KRESS:  The risk achievement worth of a
     regulation, that's going to be pretty tough.  
               DR. WALLIS:  Do that first, before you try to
     change anything, to know what you're doing now.
               DR. KRESS:  I'm not sure we know how to do that.
               MR. KING:  But in effect, for reactors, that's
     what option three is doing.  We're looking at 50.44, for
     example, and saying do the things that it requires really
     mean much in a risk assessment.  Hydrogen recombiners were
     coming out saying, yeah, they really don't mean much in the
     risk world.  Maybe we ought to think about changing the
     requirements on those things.
               MR. HOLAHAN:  And to a certain extent, the IPE
     program and IPEEE program did the same thing.  They took the
     reactors licensed with the existing rules and the existing
     processes and tested what level of risk was a result of that
     process.
               DR. KRESS:  You could get an overall integral, but
     to take one regulation and say, now, what's the risk
     achievement worth of this particular regulation is going to
     be a little tougher, I think.  You might be able to do it
     for some of them.  
               DR. APOSTOLAKIS:  Let's go back to slide four. 
     One issue that bothers me sometimes is that we are very
     willing to use risk information in certain instances, but we
     approach it in a very prescriptive way and we get lost in
     the details.  I would say that yesterday's discussion here
     on MISSED surveillances is one example of that.  
               Where in this framework will you attempt to look
     at the whole thing from a broader perspective and say, well,
     gee, there are certain things that traditionally we have
     been regulating to extreme detail, but now in the risk
     context, maybe we should relax a little bit and not worry
     about you missed one surveillance or about other things,
     that don't come to my mind now.  
               But in other words, we are preserving, it seems to
     me, the detailed, prescriptive regulatory approach from the
     old days.  We are simply changing the tools, but what is
     applying to these is the same thing.
               Now, I'm not saying that all missed surveillances
     don't count or are risk insignificant, but some are there
     and we have to change our views how we -- it's more than
     just having a new mathematical tool or some analytical
     methodology for doing something.
               On the other hand, I can see the counter-argument
     coming that what do you do, you just look at things that are
     important to core damage frequency?  Obviously not.  Do you
     look at things that are more important to the cornerstones? 
     Well, I don't know.  Maybe we start talking now.
               So is there an activity that would address this if
     it is an issue?  It's the cultural thing that we mention all
     the time, in other words.
               MR. KING:  I'm not sure this plan would get -- my
     intent is not to have it down to the detailed level that
     we're going to be looking at surveillance requirements or
     allowable outage time requirements.  
               I mean, I would view this at the level of we want
     to risk-inform the technical specifications and we'll have
     some key milestones and infrastructure needs to go do that.
               Now, the actual work as to which technical
     specifications, does it include surveillance requirements
     and so forth would be a level of detail that would be too
     much for this plan.  That would be something that would show
     up down in the detailed operating plans that each office has
     for doing their day-to-day work.  I'm not sure.
               MR. HOLAHAN:  I agree with Tom that when you pick
     out individual issues at that level, you might not find
     them, but those issues are related to programs and missed
     surveillances are part of the oversight process, plays into
     technical specifications, and we're working on those issues.
               There's an activity to risk-inform the technical
     specifications and there's a list of things that we are
     doing in that area.  I think this plan will put some of
     those things into context.  
               They won't go out and deal with a thousand
     individual issues, but where those issues are pieces of
     other programs, this plan will touch those programs.
               MR. BARRETT:  There was an interesting discussion
     yesterday.  I'm Richard Barrett, with the NRR staff.  An
     interesting discussion from NEI about the evolution of
     configuration control, starting back in the early days of
     the industry with custom tech specs, and the basic point
     that NEI was trying to make was that we're moving gradually
     to a point where there is a risk-informed way of controlling
     configuration, which will be some sort of combination of
     50.36, the technical specifications, and the A-4.
               I think that's the kind of thinking that you want
     to have in this plan, where are you heading, but not just
     jumping to where you're heading, what are the interim steps,
     and one of the interim steps in getting to what NEI sees as
     a risk-informed configuration control is these specific
     risk-informed technical specification initiatives, including
     the one regarding missed surveillances.
               DR. APOSTOLAKIS:  Jack?
               MR. SIEBER:  I was wondering if your plan
     considers what I think is one of the fundamental things that
     ought to happen first, which is there are a bunch of rules,
     different rules that have a risk basis to them.  For
     example, the PTS rule has a risk basis to that.  ATWS has
     one.  Station blackout has one, backfit rule, Reg Guide
     1.174.
               They're all different than the safety goal policy
     statement and they're different from each other.
               Is there going to be some attempt someplace along
     the line to consolidate the opinion of what is risky and
     what is not and modify those rules and set the basis for
     everything else that we do or are we just going to do this
     piecemeal, one at a time, pull out a criteria that seems
     fitting at the time?
               I'm not sure if I'm clear about my question.
               MR. KING:  I understand your question.  Are we
     providing some framework to provide some consistency as to
     what risk level we're trying to achieve by the regulations
     and what changes need to be made to do that?
               MR. SIEBER:  That states my question.
               MR. KING:  And I think my view, to answer that, is
     yes.  Certainly, in the option three work on the reactors,
     we've laid out a framework that provides some risk
     guidelines as to what we would like to see for mitigating
     systems, for containment and so forth, that we would go
     through and use when we look at the regulations to see are
     they achieving that or not.
               And maybe they're over-achieving it or maybe
     they're under-achieving it, but the idea is to bring them to
     some more uniform level than they are today.  In the NMSS
     side of the house, I don't think they're that far along yet,
     but my own personal view is, yes, that's the kind of thing
     that should be done, I think it is being done in the reactor
     side, and I think this plan could certainly lay out, at a
     high level, some guidelines as to that approach ought to be
     taken across the board whenever we're risk-informing
     something.
               MR. SIEBER:  It seems to me that in some cases,
     the risk value of some rules is such that it creates a
     penalty, a licensee, whereas some other ones may not be
     tough enough.
               I think that part of this process should be to
     sort of make a level playing field.  
               MR. KING:  I agree.  I think this plan could
     certainly, at some level, put forth guidelines to do that.  
               MR. HOLAHAN:  But I'd have to say that I think
     we're already doing some things to move in that direction. 
     When we look at recent initiatives, like the oversight
     process and Reg Guide 1.174 and what Research has put
     together, the framework for risk-informing the regulations,
     there's a lot of consistency now, but the further back in
     time that you go, the less consistency you see.
               We had a meeting, for example, last week on the
     PTS rule and there is an activity, in fact, to look at the
     PTS rule and one of the issues is was the PTS rule picked to
     achieve the right level of safety, is it too high or too
     low.  
               I think what we're seeing is not a clean sweep and
     starting over again.  What we see is going to each rule and
     sort of normalizing it back to - 
               MR. SIEBER:  Try to converge it.
               MR. HOLAHAN:  Right, make them converge.  
               CHAIRMAN POWERS:  I think that's one of the
     questions.  I'd maybe come back to Graham's question.  It
     suggested that you get an overall assessment of what you
     achieve with the current rules by looking at the IPEs for
     normal operating events and the IPEEEs for external events,
     including fire.  I think that's true.
               Of course, I look at that panoply and I
     immediately say, now, what's left out of that.
               MR. KING:  Like shutdown, you mean?
               CHAIRMAN POWERS:  Maybe, yes.  And that raises a
     question, in my mind, when I think back to option three, and
     I'm operating a little bit from memory, and the framework
     document, I say, gee, those things look like they're going
     through and they're looking at the current rules and they're
     looking at them kind of individually and saying what do I --
     how do I change this current rule to make it a little more
     risk-informed, things like that.   
               And I say, gee, those rules were written with a
     presumption that a shut-down reactor is a safe reactor, and
     indeed that was the staff's point when they put together a
     draft of a shutdown regulation rule.  
               I'm wondering why is it that option three doesn't
     go through and also look at those assumptions that are
     behind the current regulations.
               MR. KING:  I think option three does look at the
     assumptions behind the current regulations and you will find
     some words on shutdown in our framework document.  The piece
     that's missing is the body of risk, quantitative risk
     information to go along with the shutdown condition.
               Now, there's some, but we're not ignoring the
     shutdown condition.
               DR. APOSTOLAKIS:  This raises some interesting
     questions.
               MR. HOLAHAN:  Can I go back to Dana's question? 
     Because I think the Commission spoke directly to this issue
     when it voted not to support the staff's recommended
     shutdown rule.  Clearly, the Commission intended to maintain
     safety during shutdown.  I think it wanted it done through
     the maintenance rule and other activities and it directed
     the staff to inspect and to monitor those shutdown
     activities to see whether the level of -- what level of
     safety was being achieved.
               So the new oversight process has pieces in it that
     address shutdown and a lot of those are the same issues that
     we talked about in the NEI guidance and in the proposed
     rule.  In fact, I think the Commission has left the staff
     with the -- even before there was an option three, left the
     staff with the role of, sort of on a continuous basis,
     determining whether the existing regulatory structure is
     maintaining safety during shutdown and I think that option
     three is just another opportunity to test that.
               DR. APOSTOLAKIS:  My question is related to this,
     because this raises a very interesting question.  I believe
     that one of the arguments or perhaps the main argument the
     Commission made was that the risks from shutdown and low
     power operations are managed adequately by the existing
     tools.  
               At the same time, there is, I think, widespread
     concern that these risks have not been quantified.  Even if
     we accept the premise that they are managed well, we still
     don't know the level of risk.
               Now, is that something that the risk-informed
     regulatory system can live with?  In other words, if you
     convince yourself, not necessarily for low power operations,
     that a particular activity is managed reasonably well, then
     you will say then I really don't care about quantifying the
     risk from that activity.
               Is that something that this system will allow?
               MR. HOLAHAN:  I think that's not enough, because
     if you go back to the strategic plan and its goals, the
     agency's goals are more than just maintaining whatever
     particular topic area it is, maintaining it to be safe.  
               I think there are other issues that the
     risk-informed approach can address and there is a public
     confidence issue, how do you know what level of safety; you
     might be satisfied, but how do you know that other people
     are satisfied?  How do you know that you're not maintaining
     that safety at an extraordinary cost that isn't worth it?
               So there are other opportunities to test the other
     objectives.
               DR. APOSTOLAKIS:  I find this situation very
     interesting, because why do you do a PRA?  Well, you do a
     PRA because you want to make sure that the risk is managed. 
     And now you have someone who says, well, you know, the risk
     is already managed.  So he's short-circuiting the process
     and says I don't need to do the PRA, because I know the risk
     is already managed.
               How do you know?  Well, you know, I'm convinced. 
     I'm convinced they manage their configuration, they have
     these software tools.
               So I think now it's an interesting philosophical
     question.  Do you then abandon the quantification because
     somehow you convince yourself that the risk is managed or
     you still go through the process?  I don't know myself, but
     it's an interesting question and maybe by setting the goals
     and all that stuff, you should address these questions, so
     people will be sensitized to these things.
               I don't know what the answer is myself, because -- 
               DR. KRESS:  Yes, you do.  
               MR. KING:  Well, we don't need this plan to get
     into that question.  We've got plenty on our plates with
     option three.
               DR APOSTOLAKIS:  But don't you think it's an
     important question?  
               MR. KING:  Of course it's an important question.
               DR. APOSTOLAKIS:  Let's assume that they are
     right.  I'm willing to grant that.  Then we don't do the
     PRA?  You can have pros and cons.  Some guy might say, well,
     gee, yeah, but, look, if you look at the history of PRA, we
     thought we managed certain things well and then PRA showed
     there is an interface with system LOCA or this or that, so
     there are always surprises that come out.
               On the other hand, the other side might say, look,
     it's a matter of prioritizing things.  Right now, I'm fairly
     confident I'm managing the risk reasonably well and I have
     other areas where I really don't know.  So I will use my
     resources to attack those areas first.  
               I think both arguments have merit, but it seems to
     me if we are to have a strategic plan, somehow we have to
     get into this.
               DR. WALLIS:  I was going to suggest you use PRA,
     where you can get the most leverage from it.  You don't get
     into the marginal areas where you're quibbling about whether
     or not it's going to help.  So you work on things where it's
     really going to make a difference.
               DR. APOSTOLAKIS:  Yes, but you don't know that,
     because the other side is telling you -- 
               DR. WALLIS:  You must have some idea.
               DR. APOSTOLAKIS:  Well, you have strong opinions
     on both sides.  One side says, no, I'm managing the risk and
     the other side says, well, you know, you are doing something
     very good, but I still don't know whether you're managing it
     very well.  I think both arguments have some validity.
               Anyway, I just raise the issue, because I find it
     really a very interesting question.  PRA is the way of
     managing the risk and then somebody says but I'm already
     managing it, so I don't need to go that way.  It seems to me
     a strategic plan has to some -- wherever you plan to have
     overall guidelines, objectives and so on, that question has
     to come up.
               Okay.  Why don't you go ahead?  
               MR. KING:  Moving on to slide five.  Dr. Wallis
     asked the question what are your criteria for deciding what
     you want to risk-inform or what don't you want to
     risk-inform.  There are some example criteria in the draft
     we sent, the partial draft we sent to the Commission in the
     00-62 SECY.  They basically say what we want to do is take a
     systematic look across all three arenas at the regulations,
     at the activities, like inspection program, enforcement
     program, see would risk-informing them contribute to helping
     the agency achieve any or all of its four performance goals.
               But there's also some other factors that need to
     be considered; do we have tools and data that provide
     sufficient information, where you could go risk-inform the
     activity;  is there licensee interest or capability in doing
     this; can it be done at a reasonable cost.
               DR. WALLIS:  We said in our research report that
     you kept invoking these goals, and that's fine, but a lot of
     work needs to be done if you say maintain safety.  Okay. 
     Now, first of all, we need know what kind of safety we're
     getting and all this stuff.  You need to develop that and
     see how does PRA fit in there.
               Just invoking some high level goal doesn't tell
     you very much until you begin to analyze what you would need
     to do in order to determine whether or not there is going to
     be any influence on maintaining safety by risk-informing.  A
     huge amount of structure has got to be put in there.
               So I think what we would look for is that you
     built that structure, not just invoked some high level goal,
     which is fine, but that's like saying, you know, I served in
     the U.S. and I support the Constitution or something.  
               MR. KING:  I think in the reactor area, where you
     have quantitative risk information, it gets a little easier. 
     In the NMSS area, where there's a lot of different things
     that they regulate and you don't have PRA quantitative risk
     information to look at those, it gets more difficult.
               NMSS had a two-day workshop in April where they
     brought in a number of their stakeholders and they asked
     these kinds of questions.  
               DR. WALLIS:  The biggest question on maintain
     safety is this is -- it's not clear what that means.  You
     can argue forever.  When you say if it's the existing
     regulations, well, how do they maintain safety.  It seems to
     me that risk-informing has a tremendous amount to contribute
     to determining how well the regulations maintain safety.  
               When you know that, then you can, okay, this is
     the one which is worth tweaking, because we can really gain
     something there.  
               DR. APOSTOLAKIS:  I think in connection to this
     slide and also in the context of building public confidence,
     many, many times, we hear public stakeholder groups saying
     the whole purpose for risk-informing the regulations is to
     relax regulatory burden, and people forget that for the last
     25 years, really, risk-informing the regulations meant
     increasing the burden.
               So I would suggest that whenever you talk about
     the agency performance goals, you have slides or public
     meetings or whatever in the report, you immediately show a
     few examples where you have maintained safety, like the
     station blackout rule or ATWS or whatever, as a result of
     PRA, because apparently people need to be reminded of these
     things, that you are not just changing the tech specs and
     all that. 
               We get letters from public groups that say, well,
     all they are doing is this.  And maybe give examples in
     other areas that you have improved effectiveness and so on.
               In fact, we wrote a letter, with your help, some
     time ago, how PRA has been used in the past.  It wouldn't
     take more than two or three lines to show examples like
     that; that perhaps we have done a lot on improving safety
     using PRA, and now we are also addressing issues of
     unnecessary burden.
               But let's not forget we have already done a lot of
     that, because people forget or they don't know perhaps.  In
     fact, that was a major complaint of the industry that
     happened till now, all you were doing was adding burden.
               MR. KING:  Right.  I agree with your statement and
     I think one of the things that this document could do is
     show that risk-informed is a two-edged sword.
               DR. APOSTOLAKIS:  Yes.
               MR. KING:  And you could do that with some
     specific examples.  You can also do it with talking about
     the philosophy behind risk-informed.  Just the fact that
     you're not spending resources on unimportant things does
     improve safety or at least maintains safety.
               DR. APOSTOLAKIS:  Yes.  But I think giving
     specific examples from the past will go a long way.
               MR. SEALE:  To belabor the obvious, you haven't
     made the one point here, I don't think, I didn't find it
     anyway, that the PRA provides a rational basis for ranking
     the risk and that is certainly one of the more important
     things that you are interested in if you are going to make
     your regulations efficient and attack the necessary things
     in a straightforward way.
               So sometimes you have to -- the PRA covers things
     you've already evaluated, but you didn't have that
     evaluation in the context of other risks, as well.  And now,
     with the PRA, you have a thermometer, if you will, that
     you've looked at all of these different things and now you
     have comparisons and that's important to your resource
     allocation process.
               DR. WALLIS:  In terms of public confidence, some
     of the most important public consists of your own employees. 
     If this gives a way of doing things which gives your
     employees more confidence they're doing the right thing,
     it's worthwhile, it's worth putting energy into, there's
     going to be a tremendous contribution.
               I would like to see more evidence of that, that
     people have great enthusiasm for PRA, because it makes their
     job better and so on.  
               And the other confidence is, of course, in
     industry, the whole -- that's another kind, that these
     regulations make some sense, because they have this logic of
     PRA or something behind them.
               MR. KING:  When we talk about communications in
     this plan, we're talking internal and external, and internal
     is very important.
               DR. WALLIS:  The public, and there's lots of parts
     of the public that can be really influenced by this
     initiative, it seems to me.  It's not just some public
     interest group.  Everybody with some stake in nuclear
     energy, as well.  
               DR. KRESS:  In your previous work on the
     possibility of redoing the safety goal policy statement, you
     had a number of very interesting questions or issues, things
     like should land interdiction be a goal, should you deal
     with risk spikes, are CDF and LERF the right things to use,
     should you quantify adequate protection.
               You had a number of very interesting, I thought,
     questions that seem to me to be important to the issue of
     how you risk-inform regulations.
               Will you face up to those questions and try to
     provide some sort of answers to them in this particular
     document here or will you skate around them some way?
               MR. KING:  One of the things we talked about
     having in this document were what are the risk goals that
     you're trying to achieve all of the various things you may
     want to look at in this plan in the reactor area.  I didn't
     envision this document as dealing with the land
     contamination issue or risk spike issue or some of those
     things.
               DR. KRESS:  It certainly might come up in the NMSS
     area, because that may be your risk goal there.
               MR. KING:  NMSS, they have on their plate a task
     to come up with safety goals for the things that they
     regulate.  In what form, whether that's going to be a policy
     statement or some other document, I don't know at this
     point.  I would envision whatever comes out of that effort
     will be reflected in this document, but I didn't view this
     document as the document that's going to establish those
     goals.
               I do view this document, though, as providing some
     what I call guidelines, this bullet right here.  By that,
     what I had in mind was so that there's some consistency in
     the way we implement our risk-informed activities, I think
     things like the definitions from the Commission's white
     paper on risk-informed regulation ought to be in here, like
     our principles from Reg Guide 1.174 probably ought to be in
     here, maybe we ought to come up with some consistent
     definition of defense-in-depth and safety margins, what do
     we mean by performance-based, those kinds of things.
               DR. KRESS:  How do you deal with uncertainties.
               MR. KING:  How do you deal with uncertainties,
     yes.  
               DR. KRESS:  Those are the kinds of things I would
     assume you're looking for.  
               MR. KING:  I thought that kind of stuff, to me,
     made sense to put in here, so that everybody, when you're
     talking treatment of uncertainties, we're doing it in a
     consistent fashion.  
               DR. WALLIS:  Could you also have some vision of
     where you're going?  When you reach the delectable mountains
     of risk-informed regulation, whatever they are, what do they
     look like?  Some kind of objective out there, like
     Eisenhower is going to get to Berlin or something, some kind
     of -- where are we going, where would you like to be if
     everything works out right?
               MR. KING:  I think there's two aspects to that
     question.  One is laying out our plans for those areas in
     schedules and priorities for accomplishing risk-informed
     changes in those areas and then we have a section in the
     plan called measures of success, how do you know you achieve
     what you want to achieve.
               That's sort of a nebulous thing at this time as to
     exactly what those measures of success will be.
               DR. WALLIS:  I think if anything that's been
     planned in the past, any major human activity, then one of
     the major things is a view of where you're going.  We're
     going to climb Mt. Everest and that becomes most important. 
     The plan is very important, but unless you have this purpose
     up there, some view of what constitutes success, then all
     the plans are kind of muddled.
               MR. KING:  I agree.  
               DR. BONACA:  I'd like to throw in just one more
     thing in support of what Dr. Wallis is saying.  I believe
     that we're all looking at these plans, but I think we have
     probably all different visions of what this future would be
     out there, and when we -- we haven't discussed this and I
     think we will, probably as a committee, reflect on this at
     some point, but it seems to me that there are certainly some
     people who would think that we could have, at some point, a
     50.59 process under which you could remove, for example,
     defense-in-depth commitments by 50.59.
               Other people think that that will not be
     acceptable for their own reasons.  I mean, there are reasons
     for whatever.
               The point is that I think there is a fractured or
     maybe inexistent sense of a common vision about where we're
     going with the plan and a plan typically would have some
     elements of vision of what we envision out there that will
     resolve some of the problems that existent.
               I'm just supporting what Professor Wallis is
     saying, that that would be very useful.
               MR. KING:  You could picture it, we have the four
     big agency performance goals, you could say, well, I'm going
     to go risk-inform something because it's going to help me
     achieve those performance goals and you could go back and
     then say set a success measure, whether it's how much
     efficiency improvement did I achieve, you could put some
     monetary or staff year reduction goal for that or how much
     unnecessary burden did I reduce, whatever it may be.
               You could do that and then come back and monitor
     did I actually achieve those reductions when I risk-informed
     this activity or didn't I, and that's sort of what I had in
     mind in the success measure section, although we haven't
     come up with any firm recommendations in that area at this
     point.
               DR. WALLIS:  That's incremental.  That's so that
     when I fight this battle, what's the body count, did I gain
     something.  But it doesn't give you the overall objective
     out there somewhere which makes the whole thing worthwhile.
               DR. BONACA:  I think in the oversight area, we
     have some vision now, because we have an implementation plan
     and it's being implemented now.  We're beginning to see the
     elements of it, with the cornerstones and things of that
     kind, and we can or we have commented on individual aspects,
     maybe been critical of some elements, but, in general, we
     have a good understanding and a buying-in into a process
     that is becoming risk-informed, but it can be improved, too.
               It's just that there are so many other elements of
     regulation out there and particularly we're talking about
     with existing plants, how they are operating today, what is
     effective and what is not effective, and how risk
     information can improve the effectiveness of these plants
     today.
               I think that that's an element.  We will have a
     common vision of what is going to be.
               MR. KING:  I think the common vision is certainly
     qualitative vision, focus on the things that are important,
     that we're going to be more effective and efficient.  I
     didn't envision we would set numerical goals for that.
               But certainly we'd be interested in any thoughts
     anybody has as to how we could approach that.
               DR. BONACA:  I'll give you an example.  To me,
     50.59 is an important issue, because it's the process under
     which power plants are allowed to make changes.  So I would
     say that if I look at the existing power plants, they are
     hesitant about what they are going to do in the future; are
     they going to come under this changed regulation, under
     risk-informed or not.
               As you know, there is reluctance there.  The
     reluctance is because they don't understand, they don't know
     what's going to be.  And clearly there are big issues about
     what you would be able to change in power plants under
     risk-informed 50.59, for example.
               I think we had discussions here about
     defense-in-depth and balance, but we never -- and that's an
     important element, however.  
               MR. KING:  If you just want to set some overall
     agency goal for risk-informing 50.59, other than some
     qualitative statement that I want it to be risk-informed,
     I'm not sure what else I would say.
               DR. BONACA:  I'm not expecting that you have.  I'm
     just expressing some of the issues that I believe are
     clouding a little bit where we're going with all this.
               MR. KING:  I guess you could say I want to
     risk-inform it to the point where I only get half the number
     of license amendment requests that I normally get, you could
     set some goal like that.
               DR. KRESS:  I would try to avoid quantitative
     goals in this type of exercise.  I think you just get
     yourself in trouble.  
               MR. KING:  Yes.  But you could also say a measure
     of success would be am I getting fewer license amendment
     requests because I've risk-informed 50.59, without saying it
     has to be -- 
               DR. KRESS:  That's the way I would try to do it,
     that sort of thing.
               DR. WALLIS:  This looks like solutions for
     problems.   If someone is to create that risk-informing is a
     blessed activity, therefore, you should engage in it, then
     -- 
               DR. KRESS:  I think we all believe there is a
     problem with the regulations.  
               CHAIRMAN POWERS:  They have, that has happened.
               DR. WALLIS:  But if you could say here is 50.59,
     and the reason that there's all this anxiety in industry and
     so on, and so on, and so on, and, gee whiz, risk-informing
     is the solution to those problems, that would be more
     convincing, rather than saying here we've got this tool and
     we get points for applying it, using it.
               MR. KING:  I think we should move on.
               DR. APOSTOLAKIS:  Let's move on, yes.
               MR. KING:  Slide six is just, at a high level,
     what the outline of this plan would look like and some
     executive summary.  There will be some introductory material
     that will discuss the relationship of this plan to the other
     strategic plan and other documents and processes the agency
     has.  These overall guidelines we talked about to add some
     consistency in risk-informed treatment of uncertainties and
     so forth. 
               Then there will be sections for the three major
     arenas that will get into more of the details of what's to
     be done. 
               Then on the next page, a little breakout of what
     one of those arena sections would look like.  
               Again, like I said, this is work in progress. 
     This may change as time goes on, but at this point, what I
     envisioned was for each arena, you talk about the guidelines
     that you've developed and applied to decide what are you
     going to risk-inform and what the priorities are, and then
     the results of applying those, what have you decided to
     risk-inform, what are the priorities, what have you decided
     not to risk-inform.
               And then for each thing where you've made a
     decision to go do some risk-informed work, sort of lay out
     what the major milestones are and what the -- what I call
     the infrastructure needs, the responsibilities, training
     needs, what kind of communications plan, internal and
     external.  And some of these, for each activity, a
     communications plan may be -- it may cover a number of
     activities.  It doesn't always have to be each one has to
     have its own.
               And then these measures of success, how would you
     know that what you did was an improvement.  So at a high
     level, this is sort of what I envisioned to have in there.
               DR. APOSTOLAKIS:  How would you make sure that
     certain principles that really apply to more than one arena
     are, in fact, stated clearly?  Defense-in-depth, for
     example, is one.
               MR. KING:  That was back -- where I envisioned
     that was back here in the introductory section to the entire
     plan.  That would be a lead-in to each of the three arena
     chapters and this last item, overall guidelines, that's
     where I envisioned we would talk about maybe the Reg Guide
     1.174 principles.
               DR. APOSTOLAKIS:  How do we define them?  How do
     we make sure we have all of those?  From the experience of
     trying to implement the risk-informed system or we will have
     some sort of a structured process that would identify those
     high level issues that apply to all of them?
               MR. KING:  I think at this point, we've probably
     done enough in the reactor area where we know what issues
     we've had to face, policy issues, implementation issues,
     that we could probably make a good cut at laying some of
     those things out that are applicable across the board, that
     others are going to have to face if they want to go
     risk-inform things.
               Through interactions with this committee and other
     interactions on the staff, with stakeholders, we may
     identify some more.
               DR. APOSTOLAKIS:  But there will be some high
     level body monitoring all this.  
               MR. KING:  Well, later on.
               DR. APOSTOLAKIS:  Later on.
               MR. KING:  I guess I didn't put it on the
     schedule.  The agency has a PRA steering committee and we've
     run this presentation by them in terms of what our vision is
     for this document, just to make sure we have alignment
     between the office directors and ourselves, and we continue
     to come back to them as this thing evolves.
               DR. WALLIS:  This is all internal NRC people.
               MR. KING:  It's all internal NRC people.  One
     thing you'll see when we get later on, the suggestion is
     maybe we want to take this document as a draft and go out
     and get stakeholder comment and feedback on it -- external.
               DR. WALLIS:  It would seem to me you could benefit
     from having an advocate for PRA with expertise.  You know,
     if there's another George out there, who is not tied up with
     all the regulation, all the habits of the NRC, and look at
     what you're doing, could give you good advice.
               MR. HOLAHAN:  I thought we had one of those.
               DR. WALLIS:  Apart from ACRS, but someone who
     works with you daily or whatever when you need this person.
               DR. SEALE:  More than that, I think we've all been
     impressed upon occasion that the quality of PRA work that's
     been done by some of the utilities and attaching specific
     problems, and I think we would be remiss not to try to get
     their input.  They may even have a good idea or two that
     would help out.  
               MR. KING:  I think it would be worthwhile sending
     this out as a draft once we've got the sections filled in.
               DR. WALLIS:  I was thinking actually in the
     production of it, not just the formal business of you guys
     work on it and it goes out for comment, but someone actually
     in the creative process of deciding what to do.
               CHAIRMAN POWERS:  What are you looking at them to
     do?
               DR. WALLIS:  I would look for someone like a
     George who has ideas, can be critical, can say, well, how
     about this and talk about the bigger vision than you guys
     maybe have, to contest you as you develop the thing.
               It seems to me there are lots of things here which
     are of that type.  There are creative activities involved
     and there are visions of what you might be able to achieve
     that maybe you haven't thought of.
               DR. APOSTOLAKIS:  You can use consultants.  Is
     there anything that says you can't use consultants?
               MR. KING:  No.  We can use consultants.  
               DR. APOSTOLAKIS:  Then select one or two people
     and whenever you feel you need them, give them the thing and
     say what do you think.  It doesn't have to be a big deal.  
               CHAIRMAN POWERS:  I guess I'm still struggling
     with what it's supposed to provide here.
               DR. APOSTOLAKIS:  I think Graham's point is that
     there are experts out there that can, not from the
     regulatory side of the business, but perhaps they have done
     PRAs -- like Gareth Parry, before he joined your staff, was
     out there doing good work, and these people may have -- 
               CHAIRMAN POWERS:  As opposed to now?
               DR. APOSTOLAKIS:  But these people would bring a
     different perspective, I agree with you.
               CHAIRMAN POWERS:  I agree that it would bring a
     different perspective, I agree that they may have done a
     PRA.  I don't think doing a PRA is what is necessary right
     now.  It seems to me that coming in with no knowledge of the
     regulatory process is the last thing you need.  You need to
     know exactly what the regulatory process is.
               DR. KRESS:  That's what I think.  That's much more
     important than knowing the PRA.
               DR. APOSTOLAKIS:  But, guys, we're not talking
     about turning over this activity to them.  All we're saying
     is before you finalize this, give the guy the document and
     get some comments.
               CHAIRMAN POWERS:  George, I could sit here and
     say, gee, there are an awful lot of good quantum candidates
     out there that know a lot about second quantitization. 
     Maybe you ought to show it to them.  I'm just not sure they
     would help very much.
               DR. APOSTOLAKIS:  And I would agree with you.  I
     still think that if you select the people carefully, who
     have also --
               CHAIRMAN POWERS:  I think I would be much more
     interested in talking to somebody who has attempted cultural
     change in an organization.  I'd like to get their advice on
     things much more than somebody that's just done a PRA for a
     plant.
               DR. WALLIS:  That's not to say who the person is,
     but maybe we could agree that some sort of external view of
     this would give you some checks and balances and help which
     might be useful.
               DR. APOSTOLAKIS:  Yes.  We're not talking about
     the guy who does fault trees for a living.  That's not the
     issue.
               DR. KRESS:  I would be interested in a guy you
     could ask questions of, like I'm concerned if one stuck with
     just LERF and CDF, for example, that you're missing
     something, and you're missing things like 10 CFR 100, which
     talks about a dose from an unfailed containment, which is
     one of your objectives, as regulatory.
               And we have other similar things like that that
     LERF -- CDF addresses to some extent, but LERF doesn't.  The
     question I might have is if I come up with some objective
     that might, for example, be the frequency, an allowed
     frequency of exceeding a certain dose, which might be
     particularly an NMSS activity, can a PRA give you that
     number and how does PRA have to be structured to give you
     that and to give you the uncertainties in it and is it
     possible. 
               That sort of thing you might -- 
               MR. KING:  But I think what you're talking about,
     to me, is a level of detail lower than what I envisioned
     this plan to have.  Those are certainly questions you have
     to face at some point, but I didn't view this plan as
     getting down into every technical issue that has to be dealt
     with in all the things we want to risk-inform.  
               I viewed this plan as, for example, risk-informing
     Part 50, there would be a schedule for option two, there
     would be a schedule for option three, some of the major
     milestones and deliverables and so forth, but not getting
     into the individual regulations that we're looking at in
     option three.
               That's dealt with through separate papers and
     discussion.
               DR. APOSTOLAKIS:  Anyway, we seem to be getting
     into management issues here.  
               MR. HOLAHAN:  Before we leave this subject, let me
     go back and say it again, since no one agreed with me when I
     said it before.  I agree completely with Professor Wallis,
     but I think we already have a group of independent, vocal,
     knowledgeable experts sitting around this table and I don't
     see any reluctance on their part for giving us good advice.
               DR. WALLIS:  We see you once every three to six
     months or something.  This is someone you could turn to as
     part of your team, it seems to me.  That might be useful.
               DR. APOSTOLAKIS:  I think we should leave it up to
     them.
               DR. WALLIS:  Leave it up to you guys.
               DR. APOSTOLAKIS:  This is a management issue. 
     Would you move on?  I mean, we've expressed our differing
     views, which we're happy to do.
               MR. KING:  The nice thing about this committee, we
     get all these differing views, we pick the one we like.  
               DR. WALLIS:  There's no sense in our expressing
     views unless some of them are useful to you.
               DR. SEALE:  There's no quality control on our
     suggestions.
               MR. KING:  All right.  Schedule.  We need to get
     this thing done and a complete draft is due to the
     Commission the end of October.  What we had envisioned was
     NMSS has already had their workshop with stakeholders. 
     We're talking with NRR about having a similar workshop to
     take a look at what they're doing and should they be doing
     more in the risk-informed area.
               Developing some draft arena sections in August,
     coming back to this committee and the joint ACRS/ACNW
     committee in the fall to talk about those.  And then after
     the draft goes to the Commission, at least my view is we
     ought to recommend to them that that go out for public
     comment.
               CHAIRMAN POWERS:  Your schedule and your need to
     get to the Commission has a problem interfacing with our
     schedule in the sense that we don't have an August meeting
     and September then becomes kind of jammed up and things like
     that.
               Let me ask, is there a time in there where we
     should -- we want to help and I think even participate and
     give you all this wonderful advice that you can pick and
     choose from in a fairly explicit fashion.
               Should we be looking to a period of time for like
     a subcommittee meeting, where we can plunge into the details
     and things like that?  Is there an appropriate time for
     doing that?  Should we look at arena papers in detail?
               MR. KING:  I think it would be worthwhile to have
     this committee look at the arena chapters once they are
     developed and I think a subcommittee would be a good idea.
               DR. APOSTALAKIS:  Timeframe.
               MR. KING:  Maybe the August timeframe.  Are you
     permitted to have subcommittees in August?
               CHAIRMAN POWERS:  Yes, we have a bunch of them. 
     We have a bunch of them in August.
               DR. APOSTOLAKIS:  August is very hard, because my
     vacation is in Europe.  
               MR. KING:  I don't want to make it too early,
     because then you're wasting -- 
               CHAIRMAN POWERS:  It's nothing that we need to
     sort out now, but it's something that I think we want to
     sort out with you as the time comes closer to that schedule,
     just because it would be nice if we could do it on the
     October meeting.
               So that when you go to the Commission on the 27th,
     they at least have our input on it.
               MR. KING:  I think clearly the October full
     committee would be a time where, if you want to write a
     letter, that would be the meeting -- 
               CHAIRMAN POWERS:  I want things pretty well --
     have an idea of what we're going to write at that October
     meeting, rather than -- 
               MR. KING:  Which means subcommittees before that.
               DR. APOSTOLAKIS:  But not a week before.
               CHAIRMAN POWERS:  Yes.  That's what I'm trying to
     avoid.
               DR. APOSTOLAKIS:  First of all, I'm impressed that
     ACRS' view is not followed by CRGR.  
               MR. KING:  This is not CRGR material.
               DR. APOSTOLAKIS:  Second, is the ACRS/ACNW that
     joint subcommittee?
               MR. KING:  Yes.  And maybe we need to go to the
     full ACNW.  We'll have to sort that out.
               DR. BONACA:  There will probably be an ACNW
     letter, with some input or something.
               DR. APOSTOLAKIS:  Okay.  We can work out the
     details.
               MR. KING:  Okay.  The last slide I have is what I
     call issues.  There are several things, and this list will
     probably grow as time goes on.  We got an SRM from the
     Commission in April that resulted from the briefing we gave
     them on the 0062 paper.  What they said was when we give
     them this draft at the end of October, what they want is an
     identification of those internal and external factors that
     are affecting our planning process, and they listed some
     examples.
               Availability of pilot plants was one that they
     listed in their SRM.  I think there's probably some others. 
     I think licensee interest and participation in this whole
     risk-informed process is one.  
               There's questions of maybe you could go
     risk-inform some regulation, but under a voluntary system,
     if licensees aren't interested in it, why bother.  
               MR. SIEBER:  Do you have any indication at this
     point in time as to what licensee interest really is?
               MR. CUNNINGHAM:  NEI did a survey of what
     licensees were particularly interested in, I guess they --
     in the winter time.  As I recall, the top two that they were
     very interested in are changes in 50.44 on hydrogen control
     and 50.46 on ECCS requirements.
               They had a list of other things, but those are the
     two that jumped out.
               MR. KING:  But I think your question is even if we
     would make those changes, how many licensees are actually
     going to take advantage of it.
               MR. SIEBER:  Well, and beyond that, which ones are
     going to build the infrastructure that they need in order to
     participate in risk-informed regulation, because that's a --
     you're going to end up with, as I see it, two mountains. 
     One is the traditional deterministic way, the other one is a
     risk-informed way, and it's not clear to me that that
     reduces burden.  
               MR. HOLAHAN:  I think these things haven't sorted
     out yet, but I think my vision of the future is licensees
     will put the infrastructure into a risk-informed approach,
     because they need to do that because of the way the
     maintenance rule is structured and for the oversight
     process, and I think that the nature of the oversight
     process will have an enormous effect on the way licensees do
     their own work.
               And when they get to that point, at least what I'm
     imagining is, in fact, it will be those activities and not
     the examples of would you like to change 50.44 that are
     going to pull the licensees into the risk-informed world,
     and once they're there, more than they are now, some of them
     are well into this arena now, but all of them, by the very
     nature, have to participate in the oversight process.
               They need to understand the significance of their
     activities and their performance issues.  That is going to
     be the arena that gets them into this world and once they're
     there, I think that will open up to a lot more than 50.46
     and 50.44.  
               MR. SIEBER:  I sort of look at that, though, as
     like a marathon race.  There's the guys out in front and the
     guys who are walking back and there's going to be some kind
     of a distribution of degrees of participation.
               I'm not sure whether that's going to help you or
     hurt you in the process of truly risk-informing regulation.
               MR. HOLAHAN:  I think the oversight process is
     going to establish some minimum speed, which, in a practical
     way, where a licensee can continue to survive.
               DR. KRESS:  Not everybody crosses the finish line.
               MR. KING:  When I've asked this question on the
     reactor side of industry people, the answer I get back is
     there's a lot of licensees sitting on the fence.  If we get
     a few successes under our belt, that will get them off the
     fence and having a lot more step forward and want to
     participate and implement risk-informed changes.
               If we don't get some successes under our belts,
     corporate management may not be willing to support PRA
     activities at plants.  So it remains to be seen at this
     point.
               MR. SIEBER:  There's another constituency here and
     it's probably in the details that you're not wanting to
     discuss at this time, but there is a group that will be
     running with peg legs in this marathon of yours and that's
     the aspect of NMSS activities that are under the direct
     supervision or regulation by agreement states.
               I just don't see where there's very much here, at
     least at first, that's going to be attractive to those
     people at all, because there are 49 constituencies, unique,
     in a sense, that don't have the resources to build a support
     structure.
               MR. KING:  Gary and I both sat in on the NMSS
     workshop, where they had state people, they had medical
     community, they had citizens groups, of course, represented,
     and I came away with the sense that most people were
     interested in this, from the NMSS side of the house, the
     licensees and the states.
               There's always some that are against it, but I
     thought that -- there was a statement made by the
     representative of the medical community, a gentleman from
     San Francisco General Hospital, that I thought was very
     enlightening in terms of what risk-informed means for them. 
     It really means protecting public health and safety in a
     much better way than it's being done now, because if it can
     reduce the cost of medical procedures and so forth, that
     means it's available to more people and that's real risk
     reduction on real health issues.
               DR. APOSTOLAKIS:  I was looking at the General
     Accounting Office report.  There are a couple things here
     that I don't understand.  Some utilities do not have current
     and accurate design information for their nuclear plants
     which is needed for the risk-informed approach.  Is that a
     big thing?
               I mean, have you found this to be a big problem?
               MR. HOLAHAN:  Did you ask me whether I agreed with
     that statement?
               DR. APOSTOLAKIS:  Yes.
               MR. HOLAHAN:  I don't agree with that statement.
               DR. APOSTOLAKIS:  I don't either.
               MR. BARTON:  Maybe that was true a few years ago.
               DR. APOSTOLAKIS:  Well, it's '99.  
               CHAIRMAN POWERS:  I think if you go back and you
     look at the kinds of things that utilities had to do for the
     fire protection functional inspection pilots, that you might
     agree better with that statement.  
               DR. APOSTOLAKIS:  But I don't consider this an
     impediment to make it number one.
               MR. HOLAHAN:  That's right.  On the contrary, what
     I've found is that getting involved in risk-informed
     activities has been helpful in identifying issues in the
     design basis and getting them sorted out. 
               It's not as though you can't do the PRA until you
     learn the design basis issues better.  In fact, it's helpful
     in addressing those issues where there are problems.
               CHAIRMAN POWERS:  I'd certainly agree with that. 
     But that there are problems in understanding the design
     basis of things becomes very clear when you look at the fire
     protection.
               DR. APOSTOLAKIS:  Anyway, any other comments from
     the members on this issue?  Members of the public?
               [No response.]
               DR. APOSTOLAKIS:  Hearing none, back to you, Mr.
     Chairman.
               CHAIRMAN POWERS:  Thank you, gentlemen.  Look
     forward to seeing your plan.  It should be most useful.
               I will recess us until 10:15.
               [Recess.]
               CHAIRMAN POWERS:  Let's come back into session. 
     We are now going to turn to a discussion of an event that
     occurred at the Hatch Unit 1.  John, you're the one that
     brings all these terrible things to us.
               MR. BARTON:  Thank you, Mr. Chairman.  The purpose
     of this session is to hear presentations and hold
     discussions with representatives of the NRC staff regarding
     the operating event at E.I. Hatch Nuclear Power Plant Unit 1
     this past January.   We will also hear from the licensee
     following the staff's briefing.
               A description of the event, on January 26 of this
     year, Hatch Unit 1 was at 100 percent power, when the
     reactor pressure vessel water level began to decrease as a
     result of a valve in the feedwater line going closed.
               The valve closure caused a large reduction in the
     feedwater flow.  Reactor water level decreased, automatic
     reactor trip occurred, as expected.
               We've been spending a lot of time on risk-informed
     regulations, where we're going in the risk arena, and
     incidents, transients, shutdowns, et cetera, effects of CDF
     and LERF, et cetera.
               Now, from a risk aspect, this event was not
     significant in that it did not result in core damage. 
     However, it was a serious event in that several areas of
     weaknesses in overall operation and programs were
     identified, and I'm sure we'll hear about them from the
     staff.
               So at this point, I'd like to turn it over to the
     staff, Mr. Tad Marsh, to make introductory remarks prior to
     the staff's briefing.
               MR. MARSH:  Thank you, Mr. Barton.  Good morning. 
     My name is Tad Marsh and I'm Chief of the Events Assessment,
     Generic Communications and Non-Power Reactor Branch in NRR.
               I have with me today several representatives of
     the staff who will be presenting to you the Hatch event.  I
     would like to introduce Mr. Wert, from Region II, who is the
     team leader on the augmented inspection team, and Mr. Vern
     Hodge, from my staff, who will also discuss with you the
     generic implications and our follow-up actions.
               So, gentlemen, let's go ahead.
               MR. WERT:  As Mr. Marsh stated, I was the
     augmented inspection team leader, the Hatch scram that
     occurred in January, with some complications that occurred
     on January 26, in the year 2000.  Next slide.
               Just briefly, there's a list of our team members
     that participated in the team.  I'm not sure how much you
     want to hear about that.  But internally, as a region, we
     always review closely successes and ways that we can improve
     augmented inspection teams.
               One thing that we did note on this team is we felt
     we had the right combination of technical capabilities to
     review this.  All the inspectors were extensively
     experienced in boiling water reactors from a resident
     inspector perspective and additionally, we had Mr. Gary
     Hammer, a member of the NRR staff, who was very
     knowledgeable and aware of the SRV issues, safety relief
     valve issues.
               Just a brief outline.  This is a composition of my
     presentation today.  Overall event sequence, and I won't
     spend a lot of time with that.  You have the inspection
     report in which that sequence was laid out.  Equipment
     issues, because it's a very convenient way to talk about
     this event.
               Performance of licensed operators.  As we got into
     the event, I think you'll see that we became more concerned
     or just as concerned about performance of the licensed
     operators as we did about some of the equipment issues that
     initially were considered to be problems.  Health and safety
     assessment and NRC actions.
               Hatch Unit 1 is a GE BWR-4, with a MARK-1
     containment.  That's the light bulb-shaped dry well with the
     separate Taurus.  Commercial operation began September '97. 
     The licensed full power is 2763 megawatts thermal.  They did
     undergo two, in recent years, two upgrades to extend our
     power operation rating, full power rating.
               The event occurred with Unit 1 at 100 percent
     power.  It had operated for about 213 days continuously
     prior to this event.  The event also occurred at 6:51 a.m. 
     It was during a shift turnover, and we'll talk about that a
     little bit more.
               A feedwater heater inlet isolation valve closed
     when a control switch unexpectedly actuated, and we'll talk
     a little bit more about that switch in the presentation
     later.  And automatic scram on low reactor water level
     resulted as expected.
               High pressure coolant injection, HPCI, and reactor
     core isolation cooling initiated.  The reactor vessel water
     level was rapidly recovered.  I might add that in this
     event, both feedwater pumps were also running during this
     time.  So the water level was rapidly restored.
               High pressure coolant injection tripped about 67
     seconds after the reactor vessel high level trip set point
     was initially reached.  The RCIC and the feedwater pumps
     tripped at their set points, as expected.  Reactor vessel
     water level was high enough to cause water to enter the
     steam lines, and I'll talk a little bit more about what we
     thought contributed to that level in the steam lines.
               The operators closed the main steam isolation
     valves in accordance with the emergency operating
     procedures, and I might add that the procedures say -- I
     would phrase it as at 100 inches, shut the main steam
     isolation valves.
               The reactor operator did ask for concurrence to
     shut the valves after he noticed the level was slightly
     above 100 inches and they were actually shut at about a plus
     108 inches indicated level.
               The highest level during the transient was about
     plus 110.8 inches that we got off the data.
               DR. KRESS:  What is it about this particular valve
     closing that causes the water level to decrease?
               MR. WERT:  Sir, this valve that closed was one of
     the two -- one of two valves in the main feedwater flow
     paths to the reactor vessel.  There's two main lines coming
     into the reactor vessel.  They do tie back together into one
     line upstream of that, but where this was, that effectively
     reduced momentarily 50 percent of the feedwater flow.
               DR. KRESS:  Fifty percent of the feedwater flow.
               MR. WERT:  Initially.  Then you would have both
     feedwater pumps still injecting into the vessel through the
     remaining flow path.  But initially you get a large
     reduction in feedwater flow.
               DR. KRESS:  So it's an initial reduction.
               MR. WERT:  And even subsequently, but I wouldn't
     say 50 percent.  
               MR. BARTON:  You're still basically steaming at
     full power rate and reducing feed flow by half.
               DR. KRESS:  Steaming at full power and flowing in
     at half the flow.
               MR. BARTON:  Yes.  Feed level goes down pretty
     fast.
               DR. WALLIS:  What is water level, the two-phase
     mixture?  What is the water level in the two-phase mixture? 
     Is this a collapsed level or what is it?  You have boiling
     water, but the level is not a determined thing, is it?
               DR. BONACA:  It is not the collapsed level.
               DR. WALLIS:  It's not a collapsed level.  But it's
     a level of some sort where there's a transition from mostly
     water to mostly steam.
               DR. SEALE:  This is above the separators.
               DR. WALLIS:  Yes, it's way up there.  So it's a
     two-phase mixture, but I wonder what you mean when you say
     level is 110 inches.  What detects that level?
               MR. WERT:  These are water level indication
     systems.
               DR. WALLIS:  Usually that's a hydrostatic thing. 
     It's just a collapsed level measurement.  So the actual
     level where there is water is higher than that.
               MR. WERT:  I was referring to the water level
     indicated at the annulus of the vessel.
               DR. WALLIS:  I think it measures a collapsed
     level.  There's actually water higher than that.
               MR. WERT:  I think that's true in the interior of
     the vessel.
               DR. WALLIS:  There is water a lot higher than just
     110 inches probably.
               MR. WERT:  Yes, sir.
               DR. WALLIS:  Because it's bubbling and all kinds
     of stuff going on.
               MR. WERT:  Yes, sir.  We were just concentrating
     on the level that would then go into the steam lines.
               DR. WALLIS:  But we at least have a picture of
     what's going on.  There's actually a lot of water above
     that, as well, tossing around.
               MR. SUMNER:  My name is Lewis Sumner, I'm the Vice
     President for Plant Hatch.  At this point in the sequence,
     when this level was this high, the reactor has already
     scrammed.  The void collapse has already occurred and you
     are reading true level.
               DR. WALLIS:  So it is true level.
               MR. SUMNER:  Yes, true collapsed level.
               DR. WALLIS:  Thank you.  
               MR. WERT:  At this point, the operator initially
     attempted to control pressure with the safety relief valves. 
     That's in accordance with his operating procedures, to open
     a relief valve.
               You would do that because you have the reactor
     essentially isolated here and the pressure is slowly
     increasing due to decay heat.
               The expected control panel indications were not
     received.  What I'm referring to there is there's three
     lights under each control switch for these safety relief
     valves.  There is a green light that tells you there is
     power being provided to the solenoid valve that supplies
     pneumatic air to operate the valve electrically.
               There is also a yellow light that tells you that
     the pressure in the discharge pipe going to the Taurus from
     this valve has reached greater than 85 pounds, the set
     point.  It varies from plant to plant.  But it detects
     pressure in the tailpipe.  
               And the final indication is a red light that tells
     you only that the solenoid has been energized, either by
     switch operation or through operation of the low load set or
     the ADS system.
               The operator was looking for the amber or yellow
     light that told him I have a high discharge pressure in my
     discharge line, and he did not get that light at this point.
               So he then, in turn, manipulated the control
     switches for several other SRVs and then he obtained an open
     indication and the SRVs were subsequently used to control
     reactor pressure.
               Reactor pressure peaked slightly above normal
     operating pressure in this event, approximately 1,085
     pounds.  After the event, the licensee determined that the
     SRVs had actually opened when they were actuated.  The SRV
     tailpipe, and that's the discharge line to the Taurus,
     again, there's a temperature recorder on the back panel in
     the control room that showed clearly that the valves had
     opened.
               There are some other indications, as well.  You
     can look at the Taurus temperatures in the area around the
     SRV discharge line spargers inside the Taurus, and we did
     that as a team.  One thing we were concerned about was
     possibly that the valve, the pilot assembly lifted and maybe
     not the main portion of the valve, and we looked at that and
     that gave us a good indication that, in fact, the main seat
     had actually opened on the valve when we expected to.
               DR. WALLIS:  So you could see this by looking at
     the record afterwards, but the operator, in order to see
     this at the time, would have to go and look at some back
     panel.
               MR. WERT:  Yes, sir.
               DR. WALLIS:  So this isn't really information
     that's available to the operator at the time, unless he
     makes a big effort to go and get it.
               MR. WERT:  Unless he makes -- 
               MR. BARTON:  Not really, and especially, during
     this event, it happened at shift turnover, they had an
     abundance of people in the control room.  They also have a
     shift technical advisor who is supposed to help the
     operators through transients to understand what's going on
     in the plant. 
               So there are some questions here as to why that
     wasn't looked at, I think, and I don't think it's that.
               DR. WALLIS:  It's a question of time.  When he's
     looking for the yellow light, that's right in front of him. 
     But looking for these other indications would take more
     effort to go and look for them.
               MR. WERT:  Right.  And the other indication he's
     looking for is a reduction in pressure at the same time when
     he expects the valve to open, obviously, and he didn't see
     that either.
               MR. SIEBER:  Who is the manufacturer of the safety
     relief valve and what type of -- 
               MR. WERT:  I was going to get to that.  These are
     Target-Rock two-stage pilot initiated valves.  
               MR. SIEBER:  Thank you.
               MR. WERT:  The operators subsequently used a high
     pressure coolant injection and reactor core isolation
     coolant for inventory control.  There were several early
     attempts to restart reactor core isolation cooling, and this
     was after the initial transient, that did not succeed. 
     Approximately four times, the reactor core isolation coolant
     system was attempted to be restarted and it was unsuccessful
     and that was attributed to the procedure or the process that
     was used to restart the turbine, and we'll get into that a
     little bit later.
               DR. WALLIS:  The heat sink then is just whatever
     is coming out the relief valves.  The heat sink is the
     steam.
               MR. WERT:  At this point, that's correct.  They
     have other systems that they could use.  But RCIC was
     successfully used later in the event.  They had auxiliary
     operators down in the spaces actually draining the water out
     of the steam supply lines to the reactor core isolation
     coolant system and one of our team members interviewed those
     operators and there was a significant amount of water
     obtained out of that line.
               High pressure coolant injection was manually
     operated several times and tripped properly at its high
     level set point on two occasions.  
               DR. WALLIS:  What two occasions?  Those were the
     only two occasions?  
               MR. WERT:  Yes, sir.  In this event, subsequent to
     this event.
               DR. WALLIS:  So it tripped properly every time its
     high level set point was reached.
               MR. WERT:  With the exception of the initial -- 
               DR. WALLIS:  The first one, it didn't.
               MR. WERT:  Yes, sir.
               CHAIRMAN POWERS:  Can you give me an idea of what
     the flow rate is from the high pressure injection?
               MR. WERT:  The high pressure coolant injection
     system is thousands of gallons per minute, as compared to
     the reactor core isolation cooling, which is several
     hundred.
               Safety relief valves, while the safety relief
     valves were passing water or a steam-water mixture, the
     pressure in the discharge line did not get high enough to
     actuate the pressure switch. 
               Our conversations with the GE and also the
     Target-Rock personnel that were there at the time, they also
     indicated that there some reliance on I'll call it impulse
     loading of this pressure switch.  So they contributed that
     also to part of the effect of why the pressure switch did
     not actuate.
               Alternative open SRV indication, and that is
     referring to the discharge line temperature recorder, was
     available, was not used.  We do know that in training, when
     we looked at the training plan, that it is described in the
     training plan, the use of this temperature recorder, as one
     indication of SRV operation.
               We'll talk about this during our discussion of
     operator issues, but the gentleman that discussed the STA's
     involvement in this event, I think that's where it properly
     involves.
               DR. WALLIS:  Temperature would seem to be a more
     direct indication, because pressure depends upon the flow
     rate and how much is water and how much is steam and other
     things like that.
               MR. WERT:  Yes, sir.  I would point out that the
     indications that are available on SRV indications vary from
     plant to plant considerably.  Some of the plants have
     acoustic monitors.  Some of these indications were
     originally designed to detect SRV leakage passed.  Back in
     the early days, there was a lot of problems or a number of
     problems with SRV leakage.  So these indication systems are
     set up differently from plant to plant.  They vary
     considerably.
               Our understanding of a discussion about the
     acoustic monitor, not to depart too much from the
     discussion, was, with the vendor representatives, indicated
     that they would have to, in fact, also be precisely adjusted
     and set.  In other words, the water might have affected even
     those indications in this event, an acoustic indication.
               Five of the pilot actuated Target-Rock SRV
     assemblies were later satisfactorily set point tested.  This
     is the routine testing that's done at Wyle Laboratory.
               In this case, of course, it was not a routine
     test, but it's the same test that's done routinely.
               One pilot valve assembly was inspected.  It was
     totally dismantled and inspected.  The Wyle facility is
     familiar with this.  There is a corrosion bonding issue
     that's still an issue with these Target-Rock SRVs.  So
     they're pretty familiar with what these cartridges, pilot
     valve cartridges should look like when they disassemble
     them.
               We also had an NRC inspector there to watch
     disassembly who has some familiarity also with these SRVs. 
     He is assigned to the Browns Ferry facility, which is
     located within 20 minutes of this facility, so it was easy
     for us to do.
               There were no unexpected conditions found.  There
     were some indications that water level had, in fact, reached
     the SRV elevation.  You could tell this by the types of
     contamination that were found in the valve. 
               Subsequent General Electric and Target-Rock
     analysis supported operability of the safety relief valves,
     the discharge lines and the components in those discharge
     lines, and I'm referring there to the vacuum breakers that
     are located in these discharge lines and also the pressure
     switches that we had talked about before.
               Those pressure switches serve as an indication to
     the operator of pressure in the tailpipe for the valve
     lifting, but they also are used to arm a system called
     low-low set that exists at Hatch, and that system is
     designed to minimize the forces on the Taurus if you have
     repeated lifting of these SRVs.  So that pressure switch is
     important.
               MR. MARSH:  If I could add something at this
     point.  The agency was concerned that the initial parts of
     this event and up until perhaps this point about the ability
     of the SRVs to operate in this type of an environment and
     what he over-pressure analysis and the transient analysis
     remained intact, whether it would, in fact, represent what
     the plant would respond.
               In this analysis that we're discussing here showed
     the staff that the transient analysis and the over-pressure
     analysis was still valid, that the SRVs may have had a
     different type of performance, but, in fact, over-pressure
     was protected.  So this is an important key point in how the
     team was progressing through the inspection.
               MR. WERT:  I didn't go into the details there, but
     the licensee and General Electric and Target-Rock supplied a
     very conservative analysis with very conservative
     assumptions on how much water could be in these steam lines
     and how long it would delay the opening, actual operation of
     the pilot valve, and then, in turn, the main seat, and then
     relieve the function from the valve.
               They used very conservative assumptions, like I
     said before.  They assumed that only one SRV would function
     and the difference -- the ability to mitigate the pressure
     increase was very significant.  They could do it in a matter
     of just over a minute as compared to requiring several
     minutes before the pressure would become a problem.
               The next equipment issue was reactor core
     isolation cooling.  As I said before, several of the
     attempts to restart reactor core isolation cooling were not
     successful, and this was not early in the event, but
     subsequent developments during the event.
               They let the head -- the procedure left the
     reactor core isolation cooling steam emission valve fully
     open and under some plant conditions, such as water in the
     steam supply line, the turbine can over-speed if this
     restart procedure is used.
               It's not understood precisely why this occurs. 
     There's two different explanations.  One involves steam
     carry-over or water carry-over into the steam actually
     through the turbine control system and another one is that
     the water that's actually contained in the line flashes to
     steam as it goes -- as it approaches the final part of the
     turbine supply system.
               In either case, it affects the operation of the
     turbine control system and you are susceptible to over-speed
     trips.
               Additionally, the licensee's event review team
     identified that the simulator training did not accurately
     reflect the reactor core isolation cooling performance, and
     what I mean by that is that this attempt could be -- this
     procedure could be used successfully in the simulator.  
               It might not have been necessarily a simulator
     modeling problem as much as just a training issue, where the
     operators could, in fact, successfully use this repeatedly
     in the simulator, but it wouldn't work in the plant.
               MR. BARTON:  Is it a training issue or is it a
     simulator fidelity issue?
               MR. WERT:  It really depends, sir, on how the
     facility decides to handle it.  I think that the facility
     has, in fact, changed the modeling of the simulator and
     Lewis could probably tell us that or not.  I know that
     they've done some corrective actions, but I don't mean to
     hedge my answer, but you could, in fact, just satisfy this
     by having your simulator training personnel, in fact, insert
     failures into the system.  You don't necessarily have to
     create the modeling to exactly perform this way.
               I believe the senior resident inspector told me
     that they have changed the modeling of the function of the
     valve.  
               MR. SUMNER:  The model has been changed and the
     procedures have been changed and the training has been
     changed.
               MR. BARTON:  Thank you.
               MR. SUMNER:  But there are still probably other
     deeper issues than that as we look at the RCIC performance.
               MR. BARTON:  Thank you.
               MR. WERT:  And our final bullet up there, licensee
     promptly revised these reactor core isolation cooling
     procedures, and they did that prior to restart of the unit.
               There is some operating experience data available
     on this phenomenon, I call it on stream-driven turbines, but
     they largely are constrained to auxiliary feedwater systems
     in PWRs and they involve long runs of piping.  A little bit
     different than the arrangement at Hatch.
               High pressure coolant injection, the high reactor
     water level most likely resulted from the high pressure
     coolant injection system not tripping immediately when the
     high level set point was reached.  Additional factors
     contributed to the high water level and what I'm referring
     to there is that just essentially the swell of the reactor,
     of this inventory of water that is inserted at 90 to 100
     degrees, then heating up inside the vessel due to decay heat
     is significant.
               Then, also, in this event, both feedwater pumps
     were operating and early in the transient, one of the
     operators placed the master feedwater level control switch
     into manual and due to some complexities in the way the
     controller works, this resulted in the feedwater system
     operating at a very high capacity.
               MR. BARTON:  Was this by procedure?  Are operators
     allowed to take automatic functions out and go to manual? 
     Was that allowed by procedure or is that something that was
     done in violation of a procedure?
               MR. WERT:  It is permitted by procedure and we'll
     talk about that a little bit later.  The licensee has
     initiated some actions to review that.
               But I just wanted to point out that that's one of
     the factors in the high level, that it makes it difficult to
     ascertain exactly why the level got that high.
               DR. WALLIS:  You spoke about time, you said not
     immediately.  What sort of times are we talking about here
     from when it should have tripped and how long it stayed not
     tripped and how long the level was rising after it should
     have not -- what sort of times are we talking about?
               MR. WERT:  Our review of the data indicated at
     just over a minute, 67 seconds, that the system operated, it
     continued to inject after it reached high level -- 
               DR. WALLIS:  After it should have tripped.
               MR. WERT:  Yes, sir.
               MR. MARSH:  The feed pumps had tripped by that
     point, you had RCIC by that point.
               MR. WERT:  The feedwater pumps and the reactor
     core isolation coolant system had both tripped as expected
     at their trip set points.
               The operator should have manually tripped high
     pressure coolant injection when it was indicated that the
     system did not automatically trip.  The licensee did not
     conclusively determine why high pressure coolant injection
     system did not immediately trip during the initial
     operation.
               Subsequent extensive testing supported the
     operability of the trip function.  I don't want to go into
     the whole logic path here.  There's essentially several
     contacts in series.  There's two sets of Agastat relays in
     series that initiate the trip.  Both of those were sealed
     functions; in other words, the Agastat relay was inside a
     sealed case.  It's not commonly a type that you see have
     problems due to intrusion from material.
               MR. BARTON:  I take it the licensee has never been
     able to repeat this failed switch since the event.
               MR. WERT:  We could not.  The licensee or our
     efforts could not conclusively identify exactly why it did
     not trip initially, and that's why I was making the point
     that it tripped twice subsequently successfully.  We think
     that affects the ability to troubleshoot the problem.
               Then after the two contacts, it goes to an HGA
     relay, in turn.  Now, one thing that also contributes to
     this is not all these contacts and relays are monitored in
     the licensee's data gathering system.  So it was difficult
     to just point out a certain relay and detect exactly how far
     the signal got through the process.  That varies from plant
     to plant.
               The feedwater valve control switch is our next
     area of discussion.  Southern Nuclear determined that a
     GE-type CR-2940 control switch failure caused the feedwater
     heater valve to close unexpectedly and the way they
     discovered this was after the scram had occurred, operations
     noted that the feedwater heater temperatures were diversion. 
     They had noted indications on their feedwater temperatures
     that they were not expecting.
               They investigated that.  They found on the local
     control switch in the turbine building the fifth stage
     feedwater heater inlet valve on the Bravo side had closed,
     and that was subsequently traced to the switch.
               The licensee did quarantine the panel.  They did
     extensively try to determine what could have happened with
     the switch.  For example, they did a lot of work in the area
     of security access records to that area and tried to
     determine if someone had, in fact, entered that area or had
     been carrying material, for example, through that area or
     had bumped the switch or bumped the panel, and they did not
     conclusively come up with an explanation of that.
               MR. BARTON:  Where is this switch located?
               MR. WERT:  The switch is actually located on a
     local control panel in the turbine building.  It's on the
     middle floor of the turbine building.  It's not in a
     particularly narrow passageway and it does not protrude into
     the passageway past other components on the same panel.
               There was a General Electric service information
     letter, commonly called a SIL, 217, which was issued in
     1977, that states that the switch contacts for these
     switches may close prematurely from slight movement of the
     selector switch and the service information letter
     recommended that the switches be replaced with a less
     sensitive model.
               This failure that we're referring to in the switch
     does not involve the contacts in the interior of the switch. 
     It involves the cam mechanism on the hand switch operator
     itself.  It's a plastic molded component.
               There is an improved model that was subsequently
     developed that has a small notch in this plastic rotating
     assembly that engages the protruding operation of the
     contactor, the portion of the switch that actually works the
     contacts.
               So when we say a switch failure, that's what we're
     referring to, simply the very slight movement, a very slight
     agitation, maybe even a vibration in the area would cause --
     could cause the switch to operate.
               Two of the switches had failed at Hatch in 1996. 
     They were both in non-safety-related applications, and after
     this event, this particular event, the licensee developed a
     list of all the affected switches, including the
     safety-related applications, and they made a prioritization
     list and replaced some of them.  We were satisfied that they
     had addressed the important located switches prior to plant
     startup.
               MR. BARTON:  This recent startup.
               MR. WERT:  Yes, sir.
               DR. WALLIS:  How did they prioritize it?  Did they
     use some sort of risk information and select the ones that
     they ought to fix?
               MR. WERT:  They looked a lot at safety-related
     applications, and Mr. Sumner could probably address exactly
     how they prioritized it, but they also did use risk because
     they looked at what could cause a transient, which failure
     could result in a transient.
               So I'm not sure that they used risk explicitly,
     but at least that was part of their factor.
               MR. BARTON:  This switch could cause a transient.
               MR. WERT:  Yes, sir.  Main steam line
     instrumentation, another consequence of this event is that
     there were some problems with a few pressure transmitters
     connected to the main steam line.  The licensee assessed the
     potential effects of the transient, such as localized
     flashing or water hammer on the instrumentation connected to
     the main steam line.
               Obviously, there's, I think, over 40 pressure
     transmitters connected to these steam lines and the
     licensee's testing identified that four pressure
     transmitters were affected by the transient.  Two were
     significantly damaged.  Their on two assembly portion of the
     pressure transmitter was, in fact, physically deformed.
               Two other pressure transmitters were involved in a
     failure of reactor core isolation cooling to automatically
     isolate during the subsequent plant cool-down, and that was
     the subject of a separate 50.72 notification.
               DR. WALLIS:  Were these water hammer events that
     damaged the transmitters?
               MR. WERT:  We believe it could be characterized as
     a water hammer event, localized flashing of the water.
               DR. WALLIS:  Flashing is not as dramatically -- it
     doesn't produce high pressures like water hammer.  Flashing
     may lead to water hammer later on, but it's usually the
     hammer that produces the high pressure that damages
     something.
               MR. WERT:  Right.  I think we were stating that
     there was no large water hammer event occurring over the
     whole entire steam line.
               DR. UHRIG:  At what point did this occur
     time-wise, this damage?
               MR. WERT:  I don't think it's well known exactly
     when this damage to these pressure transmitters occurred. 
     I'm not sure.
               The affected transmitters were replaced prior to
     startup and the licensee did some extensive actions, as
     reviewing the application of the pressure transmitters,
     whether they were suited for the purpose that they should
     accomplish and there was no necessary corrective actions
     found in that area.  In other words, they replaced the
     switches, the pressure transmitters with a like component.
               CHAIRMAN POWERS:  Significantly damaged is often
     in the eye of the beholder.  Can you give us a good feeling
     for what you mean by significantly damaged in this case?
               DR. WALLIS:  They didn't work?
               MR. WERT:  I was referring to the two that were
     significantly damaged, I was referring to their Bordun
     assembly had been physically deformed, but, in fact, I would
     say that we said that four pressure transmitters were
     affected and by that, I mean that they were -- when tested,
     they failed calibration and they could not be placed back
     into calibration.
               MR. MARSH:  The team was convinced, I guess, and
     I'm asking the licensee, as well, through you, that these
     transmitters were damaged in this event.  There wasn't any
     question about them being inoperable prior to this event?
               MR. WERT:  I'm not aware of any question at all
     prior to the event.
               MR. SUMNER:  Let me comment on that.  It's our
     belief that of the transmitters that we're talking about,
     that the transmitters on RCIC, one clarification is that
     these transmitters isolate RCIC on low pressure, less than
     50 pounds.  So we're talking about a low pressure isolation
     of the steam supply to RCIC. 
               Now, what you also need to understand is only one
     RCIC line valve failed to isolate.  The other one isolated
     properly, like it's supposed to, just like the plant design
     would call for.  You have an in-board and an out-board
     valve.  Only one valve failed to close because of the damage
     that Len referred to on the transmitters.
               And I think Len has characterized it correctly. 
     When you pulled these transmitters out, they would not
     calibrate.  They would not reach the procedural tolerances
     for putting them back in. 
               Where they physically failed, we could see the
     Bordun-2s were physically deformed to the point where the
     transmitter would not respond properly.  Was there any
     mechanical damage outside of that?  No, there wasn't.
               We do believe that on the attempts to run RCIC,
     that the water in the RCIC supply line, and, as Len referred
     to earlier, as you tried to start it up, there probably was
     some localized flashing as the pressure was rapidly relieved
     as the turbine stop valve came open.
               And it could have happened then or when the stop
     valve went shut, when it over-speed tripped.  So in any of
     those operations there, if there is a water hammer or
     flashing, that's when we postulate when the damage to the
     transmitters occurred.
               MR. WERT:  Thanks, Lewis.  The next area of
     discussion involved the performance of the licensed
     operators, and we touched upon that several times.
               The event occurred during a shift change or a
     shift turnover.  The shift supervisors had already turned
     over, but the reactor operators were in the process of
     changing over, and the senior reactor operator was outside
     the, quote, at the controls area when the event initiated.
               And at Hatch, the turnover process involves
     largely -- it's done somewhat sequentially.  The senior
     reactor operators turnover, I'll say, independent of the
     reactor operators, and they usually turn over well ahead of
     the reactor operators.
               The oncoming watch, if you would, assumes their
     duties and then they, in turn, brief the reactor operators
     as a combined crew and then they go in and the reactor
     operators officially take over the duties from the actual
     on-watch reactor operators.
               When this event occurred, the oncoming senior
     reactor operator or unit supervisor would then, in turn, go
     into the -- went into the control room with the on-watch
     reactor operators, just after the event had initiated.
               And when I say he was not at the control areas, we
     mean he was in a room just adjacent to the controls area,
     just a few steps, but that is somewhat important in an event
     like this.
               MR. BARTON:  But the operators that were on the
     control board were the operators that were on-shift.  They
     had not been relieved.
               MR. WERT:  That's correct, sir.
               MR. BARTON:  Okay.
               MR. WERT:  The reactors did not properly monitor
     reactor vessel water level and injection system operations,
     and we've talked about that previously.  The tripping of the
     high pressure coolant injection system.  And as a team, one
     of our team members was actually a senior reactor operator
     at a boiling water reactor for several years and we reviewed
     this aspect critically from the perspective of is it a
     realistic expectation at the time with the events that were
     occurring in the control room that they should have detected
     the fact that the high pressure coolant injection system had
     not tripped off and also the main steam isolation valve
     isolation was somewhat delayed.
               In both of those decisions, our subjective
     conclusion was that they should have recognized it.  We did
     not see that there was a large number of events going on. 
     Obviously, our resident inspector was in the control room
     shortly after this event, but we didn't actually observe the
     actual sequence at this point.
               MR. BARTON:  Let me ask you a question.  At the
     time of the transient, you said that the control room
     operators had not been relieved, but yet in the AIT, so
     there was shift turnover still going on outside in an office
     or something outside at the controls area.
               The AIT report talked about an excessive number of
     people at the control area and the control room.  Now, how
     did that happen?
               MR. WERT:  What we're referring to there, sir, was
     that essentially you have almost two crews there.  You had
     the oncoming crew and the off-going crew in the control
     area.
               Now, all these people were not in the at the
     controls area.  They were immediately adjacent to the at the
     controls area at a back panel held out at a desk, I would
     say, 20 to 30 feet away, but they were not right in the at
     the controls area.
               However, there was a larger number of people in
     the at the controls area itself proper than there normally
     would be on an event like this. 
               Does that answer your question?
               MR. BARTON:  Partially.  Where did these extra
     people come from?
               MR. WERT:  Some of them were the oncoming crew.
               MR. BARTON:  So there was a mix of oncoming crew
     and the crew that was still on watch.
               MR. WERT:  Yes, sir.  Also, in addition, there are
     several operations supervisory personnel that participate in
     turnovers that were also present at the time and I think
     maybe not at this point in the event, but shortly
     thereafter, also some management personnel were also in the
     control room; again, not in the at the controls area, but
     immediately adjacent to it.
               And one of those individuals, of course, would
     also be our resident inspector.  
               The next bullet, the shift technical assistant did
     not provide timely assistance to the operators, when
     unexpected SRV indications were observed and as commented by
     one of the gentlemen earlier, we considered that to be a
     problem.
               Training sessions had described the availability
     of the tailpipe temperature as an indication of SRV
     performance and we're not expecting that the operator
     necessarily would turn the switch and then run around to the
     back panel, but with all the people that were available and
     certainly the shift technical assistant.
               MR. BARTON:  Does the STA at Hatch have collateral
     duties or is he full-time STA?
               MR. WERT:  He is a full-time STA, at least --
     well, Mr. Lewis will correct me if I'm wrong.  I'm speaking
     from my knowledge of about five years ago when I was the
     senior resident there.  He was a full-time STA.  He does
     have other duties that he performs on watch.
               MR. BARTON:  But during a transient, what is his
     role?
               MR. WERT:  During a transient, his role is the
     classical shift technical assistant role, assist the
     operators and particularly analysis of indications, but
     largely constrained to reactivity and inventory issues.
               Is that how you would characterize it, Lewis?
               CHAIRMAN POWERS:  I have to admit I'm a little
     confused about who was where when.  Do we happen to have a
     diagram that could show us who was where?
               MR. WERT:  I don't have one.
               CHAIRMAN POWERS:  Maybe at some time we can.
               MR. WERT:  Yes, sir.  I can draw one shortly after
     this discussion.
               CHAIRMAN POWERS:  Sometime later.
               MR. BARTON:  Lew, do you want to address the STA
     issue?
               MR. SUMNER:  Yes.  The collateral duties that Len
     was referring to is that during normal power operations, the
     STA does the classical shift technical advisor
     responsibilities, as well as he has primary responsibility
     for reactivity monitoring of the reactor core, core
     management.
               In an event, in a transient, he is the classical
     shift technical advisor, where he has no other collateral
     duties than to assist the crew and analyzing the indications
     that they are seeing when the event is transpiring.
               MR. BARTON:  So in this event, he failed to
     fulfill his STA role or, in your opinion, failed to give
     advice to the operating crew?  In other words, could the STA
     have helped the operators in helping to identify whether the
     SRVs were operating or not and why didn't he do it?
               MR. SUMNER:  I would say that I would like to
     clarify that during an event like this, the STA is looking
     at a lot of parameters, not just the operation of the safety
     relief valves.
               MR. BARTON:  I understand that.  That would be one
     of the things -- if the operators are trying to operate SRVs
     and they're not sure whether they're operating or not in
     some -- either the SRO or the STA or somebody should be able
     to see that the operators are having difficulty and provide
     some advice, guidance, assistance, how about looking at
     backup indications, et cetera, et cetera.
               MR. SUMNER:  It is reasonable to expect an STA,
     when he sees that the operator is not getting the expected
     indication, that he could go around to the back panel
     recorder and try to, from an engineering point of view,
     determine that the indications that he is seeing do indicate
     that the SRVs are operating and he could come back and
     provide that advice to the operators to continue what you're
     doing, the valves are operating, but you're not seeing the
     right indications.
               Yes, that is a reasonable expectation.  I'm not
     going to say he failed in his duties, because he had a lot
     of duties to do, but he could have assisted the crew more
     than he did in this particular activity.
               MR. BARTON:  Do you also have a management
     expectation at shift turnover, if the plant goes into a
     transient, how the transient is handled with respect to who
     takes control, who backs up and doesn't get involved?  Is
     that a management expectation written down at the station?
               MR. SUMNER:  Well, the management -- what you have
     to -- the picture you have to understand is that during the
     turnover that Len is referring to, the entire crew that is
     oncoming, as well as some members of the off-going crew, are
     turning over in an adjacent room to the control room, to
     minimize the distractions that occur as you're doing a shift
     turnover, because there is a lot of discussion about what
     occurred over the last shift, what is to be done in this
     shift, are there any conditions that need to have special
     attention paid to them.
               At that point in time, in the at the controls
     area, the operators are monitoring the operation of the
     plant.  Should an event occur, as in this case here, then
     the supervision comes out to take control of the shift and
     the expectation would be that the operators who are at the
     controls at that time would assume responsibility for
     management of the transient.
               In this event here, out of, I think, concern to
     help out other operators, we had some of the oncoming
     operators also assist in performing activities that you
     normally do to manage a transient.
               That's not the way we train, and certainly we have
     changed our management policy to require that operators now
     have to ask permission to become involved in the management
     of the event.  It has to get direct supervisor permission to
     assist in the event.
               MR. BARTON:  And this is a change you've made
     since this event.
               MR. SUMNER:  Yes, sir.
               MR. BARTON:  Yes, sir.
               MR. WERT:  Next page.  As referred to earlier, the
     operator took manual control of the feedwater flow
     controller and this affected the controller's response to
     the feedwater transient.  I think it's pretty much
     understood that the industry has made some advances over the
     recent years in controllers on these systems.
               This is, in recent years, an upgrade.  This is a
     complex digital control system, very I'll call it smart
     logic, looks for failures, looks for differences in their
     inputs and automatically drops out default inputs, that type
     of thing, and the operator took manual control of this.
               It's not against his procedures to do that, but
     the licensee is reviewing that policy and looking at that
     closely.  Certainly, an operator would be expected to take
     manual control of an automatic system if he understood what
     was happening that was incorrect with that system.
               In this case, it's not clear that what exactly had
     happened was understood at the time when he took manual
     control. 
               MR. BARTON:  Is this because maybe the operator
     didn't have a lot of confidence or familiarity with this
     system?
               How long was this system installed in the plant,
     digital feedwater control?
               MR. WERT:  It had been installed for several
     years.
               Lewis, I guess, could again help with that.
               I think -- I would characterize it for at least
     four years.
               MR. BARTON:  Okay.
               MR. WERT:  So, I don't think it was a confidence
     in a new system issue.
               MR. BARTON:  Okay.
               MR. WERT:  Reactor core isolation coolant restart
     guidance and simulator training were not adequate for the
     conditions of the event, and we talked about that earlier,
     and the licensee has initiated comprehensive corrective
     actions in that area.
               I mean, as my next bullet implies, the licensee
     promptly completed several corrective actions, including a
     revision to the turnover process, and Lewis describe some of
     that.
               For example, they have revised their procedures so
     a senior reactor operator is in the control room.
               The licensee has also initiated broader corrective
     actions to address operations performance issues, and for
     example, one of those is the operation of manual and
     automatic controllers.  I think they're looking at that
     across the board.
               We noted that, during this event, there were a few
     other issues that came up with these automatic controllers. 
     The HPCI flow controller was actually taken automatic at one
     portion during the event, or placed into manual, instead of
     left in automatic and dialing back the flow set-point, for
     example.
               So, it's an area that the licensee is reviewing.
               Health and safety assessment -- we discussed that
     there was no adverse effect on public health and safety as a
     result of this event, was no radiological release, and no
     approach to operational safety limits.
               The safety-related systems remained operable,
     although there were some problems with the important plant
     equipment, were experienced, and that's like we described
     with the reactor core isolation coolant system.
               NRC actions -- Region II dispatched inspectors to
     the site and initiated -- initially we initiated a special
     team inspection on January 26th.  An augmented inspection
     team was dispatched to the site January 30th to February
     4th, and the exit was attended by several members of the
     public that we had on February 4th.
               The NRC staff contacted the BWR owners group,
     discussed the event with INPO during its weekly call, and
     also, there was a response by telephone to an informal Union
     of Concerned Scientists inquiry on this event.
               Region II continues to monitor the licensee's
     implementation of corrective actions through out baseline
     inspection activities, essentially the resident inspectors.
               On May 17th of this year, the licensee is going to
     come in and discuss corrective actions with Region II
     management in a meeting, and we suspect that there will be a
     lot of discussion of broader corrective actions in some of
     these areas that we talked about earlier.
               Next slide.
               The augmented inspection team was tasked in the
     charter to identify candidate generic issues, and we did
     identify what we considered to be some potential generic
     issues, and we initiated an information notice, and this
     information notice was issued on February 11th highlighting
     three issues.
               We talked about the fact that SRV operation is
     slowed, and the indication, depending on tailpipe pressure,
     is affected when the valve was passing water instead of
     steam.  We talked about that earlier.
               It's just information to all the licensees.  All
     the licensees' different indicating systems would depend on
     what they necessarily would do with this data.
               Procedural guidance for MSIV closure and
     set-points for the high-level trips of injection systems may
     not prevent complications due to water collecting in the
     main steam lines, and we're referring to there that we had
     noted that there was several -- there have been several
     reactor vessel over-fill events in previous years at BWRs.
               In one event, the operators, in fact, did not
     close the MSIVs, and our review has indicated that the
     guidance on closure of the main steam isolation valves is
     somewhat inconsistent between the facilities.
               At Plant Hatch, it's a note in the emergency
     operating procedures.
               We know that, at another Region II facility, it's
     in a procedure, not in the emergency operating procedures,
     and at another facility in Region II, we know that -- our
     review indicates that the operators are trained to shut the
     MSIVs, but there is no explicit procedure set up to do that.
               CHAIRMAN POWERS:  I think this is the really
     generic conclusion here; this is the really important one,
     to my mind.
               MR. WERT:  And the last issue we -- again, in the
     information notice, we wanted to highlight the reactor core
     isolation coolant performance issue.
               Next slide.
               And my last slide is that we have initiated a
     memorandum on April 14th from my Division Director to the
     Events Assessment Branch Chief here in NRR requesting review
     of two issues, and we anticipate that this will probably
     involve interaction with the BWR owners groups and maybe
     General Electric, as appropriate.
               The two principle questions:  To what degree
     should water be allowed to enter the main steam lines at
     boiling water reactors, and should -- I'm referring to it
     loosely -- universal guidance be developed for BWRs, with
     specific criteria directing when the MSIV should be closed?
               You know, for example, in this event, if you get
     all your major injection systems -- high-pressure coolant
     injection and reactor core isolation cooling systems and
     feedwater systems tripped off and you know that you're not
     injecting and the water level is just slightly increasing,
     do you want to shut the MSIVs, for example?  That's one of
     the questions.
               DR. WALLIS:  Where is the water going?  There's a
     turbine somewhere downstream, isn't there?
               MR. WERT:  Yes, sir, there is a turbine, and
     there's some other, I think, considerations also on analysis
     of the steam lines, as far as whether they can handle the
     weight and forces of the water, and we have noted that
     that's dependent on the plant, it varies from plant to
     plant.
               And the other question was the significance and
     the specific impact of the water and the main steam lines
     relative to considerations in the design and licensing
     basis, and one of the major factors that we're looking at
     there is the instrumentation, the potential instrumentation
     effects.
               If you get water in the steam lines, then you
     affect the instrumentation attached to those steam lines. 
     That could complicate events.
               We also know that there is variations, for
     example, in set points and the level trip systems of the
     injection systems between the different BWRs.
               We know the high-pressure coolant injection system
     at one facility is actually a one-out-of-two logic used
     twice type of thing on the high-level trip, which kind of
     sounds surprising on an injection system, but that's the way
     it is.
               So, there are some differences out there that need
     to be looked at.
               Our team could not conclusively determine if the
     design basis for the set point on the injection systems --
     whether it was based on simultaneous operation of different
     injection systems or whether it just assumed that one
     injection system was running at a time, for example.  We
     didn't get that far.
               That's all I have for my presentation.
               MR. MARSH:  The next part of the presentation is
     Vern Hodge is going to discuss the NRR safety assessment.
               MR. HODGE:  Thank you, Tad.
               I am from the Events Assessment Branch in NRR.  We
     were assisted in evaluating the risk of this event by the
     Probabilistic Safety Assessment Branch, and Mr. Dan O'Neal
     is in the room to assist in the discussion.
               The dominant sequences -- first of all, we used
     the risk model for the Hatch plant and applied it to this
     event by making some assumptions, found that the dominant
     sequences included losing the condenser as a heat sink,
     failing to provide adequate high-pressure coolant makeup,
     and failing to de-pressurize the reactor to allow
     low-pressure makeup.
               We're not saying these things happened in the
     event but that the risk is evaluated considering the
     probabilities of these events.
               The probability for losing the heat sink, the
     condenser as a heat sink, is modeled by taking little credit
     for recovering the power conversion system in relatively
     short recovery times.
               DR. WALLIS:  If you close the steam line, how does
     the condenser act as a heat sink?
               MR. HODGE:  It doesn't.
               DR. WALLIS:  So, you have lost it.
               MR. BARTON:  You take away your heat sink, there's
     no question of probability; you've actually lost it.
               MR. HODGE:  Yes.  We're talking about the
     probability of recovery.
               MR. FARRUK:  Anees Farruk from Southern Nuclear.
               You are right, you could recover the secondary
     side by opening MSIVs.
               MR. HODGE:  Concerning the HPCI and RCIC systems,
     we did not change the failure probabilities for those, but
     consider that conditional probability for HPCI failure, the
     recovery is assumed to be in the plant, not in the control
     room.
               This was in an effort to model the event that HPCI
     did not trip at the high-level set-point but tripped later,
     and the idea here was to assume that the probability would
     be increased by considering the field recovery rather than
     the control room recovery, assumed to be easier, and if the
     HPCI and RCIC system were to fail simultaneously, we did not
     consider the water coming into the reactor from the control
     rod drive pumps.
               To account for the AIT finding that the control
     room was crowded, we increased the probability for operator
     failure slightly.
               DR. WALLIS:  How do you decide how to do that?  I
     mean "slightly" doesn't sound very much.  Someone makes a
     judgement?  Does this have any effect anyway?  Does this
     probability make much difference to the conclusion?
               MR. HODGE:  I'd like to ask Dan to consider that
     question.
               MR. O'NEAL:  This is Dan O'Neal.
               There is a HRA work-sheet, a human reliability
     work-sheet that's used for these -- modeling these types of
     events, and due to the general confusion and the operator
     not being aware of their areas of responsibility, we modeled
     that as a work process -- a poor work process, where if
     operator is needed to emergency de-pressurize the reactor,
     there could be possible delays, and so, we increased the
     probability of failing to de-pressurize a reactor slightly
     due to the general confusion and lack of awareness of areas
     of responsibility.
               DR. WALLIS:  Well, "slightly" sounds as if it's a
     very small thing.  How do you decide the probability of
     failure?
               MR. O'NEAL:  We use the HRA work-sheet, which
     considers --
               DR. WALLIS:  Gives you sort of a formula that you
     apply?
               MR. O'NEAL:  Yes.  There's basically a process you
     follow, and we determined that we could increase the
     probability of failing to de-pressurize by a factor of two. 
     The probability is normally low, and increasing by a factor
     of two, it still remains low.
               MR. FARRUK:  This Anees Farruk again from Southern
     Nuclear.
               The way we considered that was basically, when we
     do the HRA, we take a look at all the -- you know, the
     factors which could influence an operator's action, like --
     you're talking about stress training, you know, the
     pre-conditions, post-conditions.
               So, all these things are originally looked into
     the PRA, you know, as part of the HRA.
               So, it's nothing new that you go through this. 
     That's the way we look at it, you know.
               The only time we will change anything that is in
     the PRA in terms of operator actions is if there is
     additional events which caused some of the systems to be
     degraded.  Then you would use a different operator action.
               MR. HODGE:  So, factoring in these assumptions,
     the calculated conditional core damage probability is 1.6
     times 10 to the minus 5.
               We are considering this event as a significant
     event because of several complicating factors:  water
     filling the main steam lines to the main steam isolation
     valves, also the condenser heat sink on manual closure of
     the main steam isolation valves, inadequate indication of
     safety operation, faulty operation of two steam-driven
     injection systems, unclear lines of responsibility in the
     control room, and excessive sensitivity to mechanical motion
     of the feedwater control switch.
               CHAIRMAN POWERS:  Let me ask a question about this
     "unclear lines of responsibility in the control room."  What
     precisely leads you to that concern?
               MR. HODGE:  We're depending on the AIT report.
               CHAIRMAN POWERS:  Right.  I understand.  I'm just
     asking you to remind, out of the AIT report, what leads you
     to say the words "unclear lines of responsibility."
               MR. HODGE:  We're just thinking about the large
     number of people at the controls area and the time of the
     turnover as general considerations.
               DR. WALLIS:  How about testimony from the people
     there?
               I mean if someone had actually said one reason I
     was confused was that my supervisor was not here because he
     hadn't yet taken over or something and therefore I was
     confused -- did you get testimony from individuals that
     there was reason to believe there were unclear lines of
     responsibility?
               MR. WERT:  I can address some of that.
               First, I don't think there was any operator at the
     time that was confused.  I don't think we'd use that term.
               DR. WALLIS:  Was unclear about lines of
     responsibility.
               MR. WERT:  Right.  It connotates a different
     understanding.
               I think what we're referring to there -- and I'll
     give you an example of some interviews that we had with some
     of the operators that will help bolster this, but what we're
     referring to there is normally, as Lewis said earlier, the
     on-shift crew, the dedicated crew, if the event had
     occurred, there's specific responsibilities on who's
     observing and who's watching and monitoring operator of
     injection systems, and in this case, there was some
     indications that some of the oncoming crew got involved with
     those operations, and it was an assumption on some -- the
     different members crew -- of the crew that another member
     was doing something when, in fact, they may not have been,
     and where that would have been -- I guess one of the
     indications of that -- when we initially interviewed the
     senior reactor operator, initially, before the licensee had
     time to have a detailed session in the simulator where they
     went over what they thought had happened during the event
     with the operating crew and discussed the failure of HPCI to
     trip and some of these other events that had occurred, the
     operator had indicated to myself and another team member
     that he thought they did a fairly good job of handling the
     event, and after his review in the simulator session, he
     indicated to us that he had not realized some of the things
     that had occurred during the event.
               Now, I still think they adequately controlled the
     event, but he didn't understand some of the things that had
     occurred.
               Now, we would expect a little bit of that to occur
     just because of how many activities are occurring at the
     time, but that would -- does that help give an indication of
     what we're talking about?
               DR. WALLIS:  That was a different subject from
     unclear lines of responsibility.
               MR. WERT:  Right.
               DR. WALLIS:  The fact that he thought things were
     fine and they weren't quite so fine -- that really has
     nothing to do with lines of responsibility.
               MR. WERT:  I was just trying to couple it to an
     actual --
               DR. WALLIS:  Line of responsibility -- it's almost
     conjecture that this might have been why someone didn't
     quite realize what was happening as much as he might have
     done, or it really is traceable to a line of responsibility?
               MR. WERT:  In answer to your question, sir, I
     don't remember an exact circumstance in which an operator
     said I assumed that someone else did that.  I think you're
     correct.
               CHAIRMAN POWERS:  It seems to me that the line is
     just misstated.  I think you've got a human operational
     environment issue here, but I'm not sure that it's unclear
     lines of responsibility.  I think it has to do with
     distraction and things like that.
               You may have -- and it sounds to me like the
     corrective action that the licensee has taken to work on his
     shift change-over rule is appropriate responsibility.  He's
     not changing his lines of responsibility.
               MR. BARTON:  Do you want to address that?
               MR. LEWIS:  Well, let me give you an example, I
     think, os what Len is probably trying to refer to.
               When you train with the minimum crew members and
     you assign crew members -- one crew member has
     responsibility for reactor water level control and all the
     systems that control that.
               When you have more than the minimum number of
     people, then you have enough people to run HPCI by itself,
     to run RCIC by itself, and to run the reactor feed pumps by
     themselves.
               So, there can exist in a situation when you have
     more people than your normal minimum crew -- when he's
     talking about we have unclear lines of responsibility, what
     you're really saying is that probably no one operator in and
     of himself has assumed responsibility for reactor water
     level control.
               There are enough operators that one is controlling
     RCIC, one is controlling HPCI, and one is controlling the
     reactor feed pumps.
               As far as was there any question about who was in
     charge and who was directing who, there was no confusion on
     that point.
               MR. BARTON:  Now I understand better.  Thank you.
               MR. HODGE:  That's all our presentation.
               MR. MARSH:  I have a couple comments, if I can,
     please.
               Speaking from the generic standpoint, we clearly
     have some work to do to look at this event and the
     ramifications of it, the recommendations of the AIT.
               I want to point to a couple of things that have
     taken place in terms of the agency's communication to the
     industry about this event.
               We issued an information notice early which
     contained the AIT's preliminary findings and the concerns
     that were expressed at the exit.
               We have had discussions with INPO in terms of
     their actions, and we are aware that they're working on an
     SOER, which is one of their highest levels of
     communications.
               We also have been in a discussion with the BWR
     owners group, and we are not yet far enough along to know
     exactly what's happening there.
               There were some preliminary plans on their part to
     communicate with the industry early.  We need to follow that
     up to find out where we are in terms of those
     communications.
               Internally, we need to take the recommendations
     from the team and assess them against licensing bases
     issues, need to answer the questions about the design bases
     for the trip set-points, whether in fact it includes
     simultaneous operations of the feed pumps, the RCIC pumps,
     and the HPCI pumps, as well as answering the team's concerns
     about the design for the logic itself, the timing that's
     there, and to answer the question about the MSIVs and the
     variation around the industry for how those pieces of
     equipment are operated, and we look to help from the owners
     groups for some of those questions that may be best served
     to ask those types of questions in the industry.
               To put this event in another kind of a context,
     this was an AIT, and we don't have many AITs, okay?  In the
     last 18 months, we have had three AITs, and so, that gives
     you some sense of the significance of the event.
               MR. BARTON:  I think between that and INPO's
     anticipating an SOR kind of gives us a feel for the
     significance of the event.
               MR. MARSH:  Right.  I think so, too.
               We also looked at this in the context of the new
     oversight process.  What does this event tell us in terms of
     the veracity of the oversight process?  Would we have seen
     this, reacted the same way?
               We used -- in responding to this event, we used
     the Management Directive 8.3, the new Management Directive
     8.3, which is a risk-informed process, in order to come to
     the decision to man an AIT.
               We also asked ourselves whether the work processes
     that are involved for determining risk that the resident
     uses and in terms of inspection followup are consistent with
     the new oversight process, and they largely were.
               In other words, the new oversight process mates
     with how we reacted in this event, and that was reassuring.
               I guess the message that we want to leave with you
     is there is certainly work to do, follow-on work coming from
     this event.
               We think the team did an outstanding job in
     looking into this event and the underlying causes, and we
     look forward to more interactions with the licensee in terms
     of follow-on actions.
               MR. BARTON:  Thank you, Thad.
               At this point -- 
               DR. WALLIS:  I think the thing that struck me most
     when you were going through the whole technical description
     was your points about water in the main steam lines.  I mean
     you have this question about to what extent should water be
     allowed to enter the main steam line and what's the
     significance of having water in there.
               I would think this is something that must have
     been surely considered long ago.  I mean it's an obvious
     possibility that the water level could rise and water could
     get into the steam line and what are the consequences.  That
     must have been surely addressed by the designers of these
     systems.
               I'm surprised that the question is still being
     raised now as if no one knows what the consequences might be
     of having water in the main steam line.
               MR. MARSH:  That's certainly a part of our
     follow-up action to find out to what extent this scenario
     was postulated, when and how.
               My recollection is that it was -- some of these
     trip functions were added later, that this was not part of
     the original design, some of these high-level trip
     functions, because of this possibility.
               A dead weight load has been considered in these
     lines, and that's the reason that you would block them so
     that you don't exceed any dead weight loads, but dynamic
     loads -- my impression is that you want to avoid dynamic
     loads and that's why you have these trip functions.
               Now the question is what's the bases for those
     trip set points to avoid this from occurring and should the
     MSIVs be closed, is that a good action or not a good action
     in order to ameliorate a high-level situation.
               DR. WALLIS:  Well, in defense-in-depth, one might
     decide to design the thing so even if you did get this water
     in there, no one is going to raise a question about is it
     going to be too heavy or is it going to impose loads that
     are too big, we've just designed it so it's okay.
               MR. BARTON:  That's good for the new-generation
     reactors, Graham, yeah.
               DR. SEALE:  You've got what you've got.
               MR. BARTON:  You've got what you've got.
               MR. SIEBER:  You cannot back-fit.
               MR. BARTON:  Are there any other questions of the
     staff before we hear from Licensing?
               [No response.]
               MR. BARTON:  Hearing none, Lew, would you like to
     make some comments?
               MR. LEWIS:  I've just got some brief comments.
               One would be that, on the risk assessment, we came
     to a different conclusion on the number for the risk
     assessment, and we'd like to have the opportunity, with our
     models and our assumptions, to review that with the staff to
     see why our conclusions are different.
               We came up with -- for a similar calculation -- in
     the E to the minus 7th range, not E to the minus 5th range,
     and it all depends on what assumptions you make.
               MR. BARTON:  Sure.
               MR. LEWIS:  And you come to a different conclusion
     depending on the assumptions you make.
               So, we certainly want to have the opportunity to
     sit down and review and discuss our assumptions on our risk
     assessment.
               The second thing is that -- concerning the
     adequacy of the high-level trips, we did have what's called
     a TRACG analysis run by GE where we made assumptions of the
     exact conditions that were present.
               One feedwater line is isolated, both pumps are
     trying at 100-percent demand, HPCI has not tripped at the
     right set-point but RCIC did, and to verify -- we were
     looking for such things as was there an asymmetric level
     condition in the vessel at the time which would explain why
     HPCI did not trip?
               Well, that analysis didn't prove that out.
               We also went to prove that -- were the trip
     set-points adequate as part of the initial design basis, and
     the TRACG analysis that we did proved that they were
     adequate.
               So, we believe we've got enough -- this is a
     detailed study we've had GE working on for the last six
     weeks to make sure that there are no other issues out there
     that we know of related to the adequacy of the high-level
     trip set-points.
               We talked about the fact that we weren't able to
     determine why HPCI didn't trip.  Well, there's an
     explanation for that.
               When it did trip, automatically, the first time,
     all the evidence was basically destroyed at that point of
     how to determine what component may not have worked
     correctly, but I will let you know we have put some
     compensatory actions in there that exercise that logic chain
     so that in the event that it is demanded again to operate,
     that we've tried to improve the level of assurance that that
     trip function is going to work, and we have reviewed and
     still continue to review whether or not we should change the
     logic design for the high-level trip.
               But the thing we should remember is that actual
     design basis for HPCI is to inject water into the vessel and
     make sure the core is covered under a small DBA and that it
     should trip at a high level, there's no belief that it
     shouldn't trip at a high level, but its actual safety design
     basis is to put water back in the vessel, which it did
     successfully.
               There are a tremendous amount of lessons learned
     that we've gotten out of this event, and Len has discussed
     some of the immediate ones that we've done as far as
     correcting some equipment problems, some procedural problems
     with RCIC, the simulator model that he referred to, but we
     continue to look at deeper issues out there.
               We look at our management processes to see, if we
     have a RCIC model that does not exactly match the plant, how
     did it come to be that way, and does that give us insight
     into looking for other models or other issues out there that
     we need to look at?
               So, we continue to look at that.
               We do have a follow-up meeting, as Len referred
     to, on May the 17th, where we're going to discuss our
     corrective actions, and we'll discuss not only the ones
     we've talked about today for the immediate stuff but some of
     the deeper issues out there that we continue to explore.
               So, we've tried to use it as a learning
     experience.  I know there are some generic issues out there.
               I don't believe determining what is the proper
     guidance for closing the MSIVs on high-level will be an easy
     thing to do, because as Len referred to, there are different
     plant designs and there are different considerations,
     depending on which plant you're at, but I believe there is
     the importance of making sure that you don't get water in
     the main steam line that was certainly brought out by some
     of the things in this event.
               MR. BARTON:  One further question I've got is how
     detailed had you looked at your corrective action system and
     the effectiveness of it, especially since the history with
     the GE SILs and information notices on these switches?
               MR. LEWIS:  The GE SIL came out in, I believe,
     1977, and we did a review in 1977 based on the guidance in
     the SIL as to what we should look for.
               We thoroughly evaluated that, and we have written
     documentation as to how we evaluate it.
               We've had one failure of one switch in 15 years,
     and that's this failure that Len referred to that happened
     in 1996, and subsequent to that, of course, we did a broader
     review with this particular even there.
               So, one of the issues we do have is when we have
     SILs that had been evaluated 20 years ago, is there a need
     to go back and re-evaluate them in today's world?  We
     haven't come to a conclusion on that.
               MR. BARTON:  I guess the question I would have
     there -- and I understand that.  I lived through the same
     thing with the GE SILs and how far do you go and how much
     equipment plant do you change out.
               But you had a subsequent failure.  Well, you had a
     failure after the SIL in '96.  Apparently, according to the
     AIT, this was classified as a significant event or a
     significant issue in your corrective action system, and yet,
     four years later, it didn't look like you did anymore
     maintenance or change-out of this style switch, and the
     reason I'm hammering you on this is, if you look at the new
     oversight process and where we're going to risk-informed
     regulations, etcetera, etcetera, you know, how robust your
     corrective action system is depends a lot on, you know, how
     the plant is going to perform and how the NRC is going to
     look at your performance down the road.
               So, again, you know, I still have a question as,
     you know, how robust is your review or your self-assessments
     of your corrective action systems?
               MR. LEWIS:  Well I think the question you ask --
     SILs is a narrow area.  When you get into other issues out
     there -- we do have categories we call significant
     occurrences.
               We have others that are higher category we call
     event reviews, and we do try to -- like you've done with
     this event here -- this event met the criteria to have a lot
     of study done on, and event reviews meet the criteria in our
     own procedures for having a lot of study done, significant
     occurrences have less study done but more than just routine,
     you know, common occurrences that happen in the plant.
               That is an issue that we're reviewing right now. 
     Does this particular event reveal a weakness or a need for
     improvement in the way our corrective action is done, and
     for example, would you postulate that you need to create a
     self-assessment process for material you've reviewed several
     years ago to see if the conditions have changed?  We have
     not come to that conclusion yet, but it is something we're
     studying.
               MR. BARTON:  I understand that.  Thank you.
               DR. SEALE:  What's the status of the plant now?
               MR. LEWIS:  The status of the plant -- both units
     are at 100-percent power.
               DR. SEALE:  How long did it take to go back to
     full power?
               MR. LEWIS:  After this event here?
               DR. SEALE:  Yes.
               MR. LEWIS:  Approximately -- we were down, I would
     say, approximately a week to do all the reviews, make the
     procedure changes, re-do the training, do a broadness review
     of -- or locate all the locations for the different switches
     of this type, categorize them to whether or not -- the worst
     postulated action from that switch and what the end result
     could be of that to decide which ones we would replace
     before we started back up.
               DR. UHRIG:  Have you replaced any of the switches
     in the other unit?
               MR. LEWIS:  Yes, sir, we have done it.  We did
     some immediately on the other unit, and then, during the
     subsequent refueling outage, then we went and changed out
     the other ones.
               MR. BARTON:  Any further questions?
               [No response.]
               MR. BARTON:  If not, I'll turn it back to you, Mr.
     Chairman.
               CHAIRMAN POWERS:  Thank you, gentlemen.
               At this point, I want to dispense with the
     transcription.
               [Whereupon, at 11:35 a.m., the meeting continued
     in executive session, to reconvene in public session this
     same day, Friday, March 12, 2000, at 12:45 p.m.].                   A F T E R N O O N  S E S S I O N
                                                     [12:45 p.m.]
               CHAIRMAN POWERS:  Let's come back into order, and
     we'll move to the topic of physical security requirements
     for power reactors.
               Dr. Kress is our cognizant official on this.
               DR. KRESS:  I don't know why, but I am.
               CHAIRMAN POWERS:  Well, because you're very
     physical, I suppose.
               DR. KRESS:  I don't have a lot of introductory
     remarks to make except it's awfully hard to make a risk
     assessment of security.
               I have seen such things in the past, and what I
     recall of them are this particular area is a significant
     risk.  In fact, it may be risk dominant.
               So, it's good to pay attention to it, and it's
     generally treated in the classical way with regulations, in
     the classical sense that there are design basis threats and
     defense-in-depth philosophy, and then you use inspection and
     a test to see if your system works.
               Well, I think one of the problems is that these
     tests, challenges to the system have been done in the past
     on the sort of -- I presume a voluntary basis.
               There's no regulatory authority to require them in
     the regulations, but I think one of the things they want to
     fix when they're developing -- what they're looking at is
     developing a new rule for this area, and that's one of the
     things they want to fix.
               So, with that as sort of a minor introduction,
     I'll turn it over to the staff.
               CHAIRMAN POWERS:  Before we go to them, I'd just
     comment that, within the DOE community, we're concerned
     about terrorist-type activities not in the sense of using
     nuclear materials to threaten the public population but,
     rather, to threaten facilities themselves using -- of
     particular interest is gas and biological threat, has become
     an area of some currency within the DOE community looking at
     -- upon nuclear reactors as a public institution, along with
     airports, other government buildings and whatnot, especially
     following the Oklahoma City incident, and so, this is
     gaining more currency than maybe we had when the Cold War
     was at its peak.
               DR. KRESS:  Yeah.  Well, I think one of the things
     they're wrestling with is -- in making a rule -- is what are
     the design basis threats.  I'm not sure how much of that
     we'll hear today, but I hope we hear some.
               Let's turn it over to you guys.
               MR. ROSANO:  Good afternoon.
               I think that, at this point, most of you know
     Glenn Tracy, my boss, the Branch Chief.
               My name is Dick Rosano.  I'm the Chief of the
     Reactor Safeguards Section, and I'm going to try to address
     a couple of the concerns that you just raised in the context
     of the briefing, realizing, of course, that what I'm going
     to be talking about are the regulatory changes that we're
     proposing, that we're working on in terms of risk-informing
     the regs and that there will be a separate section
     afterwards having to do with design basis threat, and I
     think, as I go, you will see some of -- you'll pick up some
     of my comments about the risk issue and how easy it is to do
     and the fact that there are two different kinds of risk that
     we're going to talk about.
               First an overview of where we've been and what is
     driving all of this.
               I'd begin by referring to risk-informing 73.55,
     and it actually pre-dates that somewhat, because the effort
     underway right now began when we started contemplating an
     exercise rule that was designed to be the successor to the
     Operational Safeguards Response Evaluation program, the OSRE
     program.
               OSREs, for years, had conducted assessments at the
     plants -- force-on-force drills run on scenarios meant to
     test the defensive strategies or the protective strategies
     of the plants.
               We wanted to be able to replace that program with
     a requirement to do drills and exercises, and after spending
     some time looking at that, we expanded the consideration to
     include an entire look at 73.55 and other related power
     reactor regulations.
               By that, I mean there are certain others like
     50.54(p) and 50.90 that control changes to security plans
     and commitments made.  So, in the context of risk-informing
     73.55, we would want to be able to look at the other
     associated regulations.
               When we did then consider risk-informing 73.55,
     the issue of risk in essentially two forms comes up, and we
     wanted to differentiate the two types of risk.
               One is the probability of event, which I believe
     you mentioned, and that really is a very difficult thing to
     estimate.
               In fact, you will find that most of the sabotage
     events that have occurred through history did not come with
     a high probability or expectation that they were about to
     occur, and the community understands that the Commission,
     over the years, has understood that and made various
     proclamations relating to it.
               Our efforts are not to risk-inform that process. 
     We are not trying to -- in the context of rewriting these
     regs, we are not trying to assign a risk or probability to
     an event occurring.
               In the later presentation by Roberta Warren from
     NMSS, when she does talk about design basis threat, there's
     an element of that, and the intelligence community provides
     great assistance in understanding what probabilities there
     are, but that's not what we're trying to do when we're
     risk-informing 73.55.
               However, there is another element of
     risk-informing the regs that we can deal with, and that has
     to do with the consequences, the safety consequences of the
     event.
               Stripped down to its basics, a safeguards event or
     a sabotage event is the initiating event in a safety
     sequence, and we can do some risk-informing to better
     understand what might unfold from that event.
               There are a lot of factors.  Obviously, we have to
     be able to stabilize the systems at the plant, knowing that
     there will not be additional sabotage events within that
     context before we can then sit down and assign a
     probability, but the regulations are intended to assign some
     risk sense or probability or better safety understanding of
     what might happen.
               Perhaps one of the greatest products --
               DR. KRESS:  Could I interpret that to mean that
     you might be focusing on the conditional core damage
     frequency given the event?
               MR. ROSANO:  Yes, we are.
               What we're doing now is trying to base the
     regulation on performance criteria and safety criteria using
     the design criteria of the operational systems, using that
     as the proposed goal of a sabotage event, and then looking
     at the probability of the attack resulting in the failure of
     one of those design criteria.
               We recently wrote in a Commission paper, 00-63,
     the six design criteria that we intended to use for that.
               I know I'm getting ahead of myself a little bit. 
     I'll try to be more controlled, but we'll go back to that,
     because that's an important point that we want to discuss.
               As we began to peel back the layers in
     risk-informing the regs, we did find more and more
     fundamental issues that needed to be resolved and that we
     needed to come to better understanding of.
               One was the definition of radiological sabotage,
     which goes to your point.
               The regulations do define rad sab as an event
     which would cause a risk to the public.  I've left out a lot
     of words, but that's what it boils down to.
               Well, the level of risk was not delineated, the
     type of event, and so on.
               So, we considered -- and in fact, in a Commission
     paper, did recommend to the Commissioners that we look at
     what is defined as rad sabotage and improve upon the
     definition.
               The more we worked on that, the more we decided
     that, even with a better definition of rad sabotage, we
     would still need to come up with performance criteria.
               Subsequent to that, we did advise the
     Commissioners that we had decided that the proper approach
     for beginning this rulemaking was to define the performance
     criteria that we expected the plant to maintain in the event
     of a sabotage attack and that their systems should be
     designed with a goal of maintaining those performance
     criteria.
               Now, when I said that the licensee or the plant
     would need to maintain, another important difference that we
     promoted and proposed was that it be a whole-plant response.
               Rather than thinking of this as a gun battle in
     the protected area, the security force against the
     attackers, we wanted to step back from it and accept that
     there are a number of other actions that can be taken by
     other members of the licensee force -- for example, the
     operational staff -- actions that could be taken to mitigate
     the consequences of the attack or, perhaps by isolating
     systems or components, perhaps defeat the attack, simply
     without even the actions of the security force, which is not
     to say that we would propose they do away with it, but we
     wanted to respect what the entire plant organization could
     do, and we took those things into account, and so, the new
     rule will consider actions by operators and operational
     staff.
               MR. BARTON:  Would that entail operators leaving
     the control room?
               MR. ROSANO:  It would entail what the licensees
     believe are the best means of handling that.  In some cases,
     I understand some licensees would consider it important to
     dispatch operators to the remote shutdown panel and so on. 
     There are issues like that.  Each licensee will have their
     own answers.
               DR. BONACA:  Just a question I have.  I remember
     approximately 20 years ago there was a review of all the
     power plants to identify that you cannot disable the plant
     -- let me use the word "disable" now, and we didn't talk
     about CDF at that time, or core damage -- that you cannot
     disable the plant by one individual in one location, that
     there was sufficient separation and diversity of systems in
     different locations that you would have -- so, there are
     some elements already in place that are still -- because I
     remember that, and I remember that there was no further
     activity after that, it was the only thing that was done.
               MR. ROSANO:  That has been better applied in a
     safety arena than in safeguards, although it also applies in
     safeguards, because the principle that no single act can
     defeat the safe operation of the plant is a design feature,
     design concept that would also prevent a single act of a
     saboteur from accomplishing that purpose.  Notice I said a
     single act of a saboteur, not a single saboteur.  One
     individual could do more than one thing.
               But it would apply, and I think that that's an
     important part of looking at the whole plant response to a
     sabotage attack.
               DR. KRESS:  Does that mean that each plant might
     have to have something analogous to the emergency operating
     procedures, call it a sabotage operating procedure?
               MR. ROSANO:  Well, in fact, they already do.
               DR. KRESS:  They do?
               MR. ROSANO:  The plants have incorporated what
     they call protective strategies or tactical response
     strategies.
               One of the things that this rule would do would be
     to add a little bit of detail to that and encourage
     licensees to more formalize their processes for this, but
     licensees already do have procedures, and they have -- under
     Appendix C of Part 73, they're required to have a
     contingency plan, and it's for safeguards emergencies, and
     usually that results in things called tactical response
     strategies where the security force has pre-programmed
     responses to certain types of events, responses that they
     practice through drills, and it sends them to certain
     positions to respond, depending on what kind of event it is
     and what's the likely outcome.
               Going on, then, I mentioned the problem with
     definition of rad sabotage and the performance criteria, so
     now we're trying to deal again with the whole plant and
     trying to use and take credit for any of the response
     actions that might be incorporated together.
               The next item that we found in peeling away the
     layers of this issue was the design basis threat and the
     adversary characteristics.
               The rule -- there are three levels of detail.  The
     rule says that the design basis threat will include several
     persons, and it describes them in general terms.
               There is a classified -- in the case of category
     one facilities -- a classified description of the numbers of
     people, and for power reactor facilities, there is a
     description that is safeguards information that describes
     the number of people who would attempt sabotage.
               The category one facilities need to protect
     against sabotage and theft.  We consider sabotage for
     radiological purposes the only real issue at the power
     reactor facility, and the type of threat, the type of DBT
     and the size of the DBT would be different for each.
               The next layer of detail is what we found
     ourselves in while dealing with this problem today, and that
     is that these adversaries could carry a number of different
     arms or tools or items of equipment and that we needed to
     have a clear understanding from which we would work and from
     which the licensees would work in order to balance their
     protective systems and understand what they needed to deal
     with.
               This is also considered classified information for
     the fuel facilities and safeguards information for the power
     reactors.
               These characteristics are very important for the
     licensees to understand in order for them to comply and live
     up to the expected level and very important to guide our
     exercises to make sure that we're testing at the proper
     level.
               The difference between different poundage or
     amounts of explosives, different types of armaments needs to
     be settled.
               Now, NMSS has done extensive work on this, with
     the intelligence community and in defining these details.
               You'll hear more about that later, but this is
     another issue that we concluded needed to be solved in order
     for us to get to a more clear understanding of what the regs
     should be.
               DR. KRESS:  Does that description of adversaries
     deal with the potential for an insider at all?
               MR. ROSANO:  An insider is assumed to be part of
     the design basis threat for both sabotage and theft, yeah.
               Then the last item in terms of overview is the
     industry's interim program.
               I mentioned the OSRE program, Operational
     Safeguards Response Evaluation program.  That has been in
     place since about 1991.
               As of this month, we have completed the first full
     round of OSREs in which a headquarters-led team with
     regional assistance and contractors has gone to each of the
     power reactor facilities, conducted week-long tests,
     complete with table-top exercises and scenarios drawn up by
     both licensees and the NRC and force-on-force drills,
     several of them, not a single one, to determine the adequacy
     of protection.
               The OSRE program has completed its first full
     cycle.  Our goal was to replace the OSRE program with this
     rule-based system, which we will.
               That will take some time to do, and what we wanted
     to do was have an opportunity to pilot the new concepts,
     pilot the ideas that we would like to incorporate into the
     rule as we write the rule, and the industry offered to write
     a program that would be forward-looking rather than
     backward-looking to a new program that would include some of
     the ideas that we've been debating over the months for the
     new rule rather than simply incorporating those already used
     for the last nine years in the OSRE program.
               That program has gone through a few revisions. 
     It's called the Safeguards Performance Assessment Program --
     the title has changed a couple of times -- and that program
     has been reviewed and been subject to comment by the NRC.
               We've worked extensively with the industry through
     public meetings and members of NEI, and that is coming
     along.  That actually kind of leads us into the next couple
     of slides, I'll be able to tell you more about the status,
     but in general, the goal is to have an interim program to
     ensure that we continue evaluations of security response
     strategies, not just security, because we have an inspection
     program that evaluates security, and it does a good job of
     that, but we would also like to have evaluations of the
     response strategies.
               So, what we want to do is have a continuation of
     these exercises, allowing OSRE to sunset in favor of a
     program that looks to the future, and let that program run
     until the rule can reach its final state.
               CHAIRMAN POWERS:  I guess I don't quite
     understand.
               You have this OSRE program, and now you've got a
     proposed new program that's characterized as looking to the
     future.
               I'm struggling with what's different.
               MR. ROSANO:  Well, there are several differences.
               One is that we would like to have -- the rule, for
     example, would require the licensees to develop a robust
     program of drills and exercises.
               Currently, although many of them do conduct
     drills, there's no requirement in the rule that they do so. 
     So, the voluntary program that they're offering as an
     interim program would do that.  That's one of the changes.
               CHAIRMAN POWERS:  But I mean you've done this --
     through the OSRE, you have these exercises.
               MR. ROSANO:  Yes, sir.
               CHAIRMAN POWERS:  Would they be the same or
     different?
               MR. ROSANO:  The exercises under the interim
     program and under the rule would be very similar to OSREs. 
     They would be force-on-force drills incorporating the design
     basis threat standards in those drills, but currently,
     because there's no requirement for drills or exercises, a
     lot of licensees -- there are some licensees who drill at
     different frequencies.  Some drill very often, some drill
     not so often.  It has left us with the inability to take a
     snapshot in time at any given time as to what the abilities
     are.
               The interim program, the SPA, would incorporate
     quarterly drills, which is what we're thinking about for the
     new rule.
               It would have a triennial requirement for
     extensive exercises, so that the exercises under the OSRE
     program that -- considering that the first full cycle took
     eight years, then obviously the full exercises under the
     interim program of the rule would be three times as often.
               There are some other things.
               The design criteria will be looked at.
               The OSRE program uses significant core damage as
     the goal of the attack, which if you take that and then work
     backward, then you'd assume that the licensee protective
     strategies only have to be designed to prevent significant
     core damage, and that's a very useful approach, but what
     we're trying to do is improve upon that, and so, the design
     criteria that we proposed in the recent Commission paper
     would be tested out in the new program, so there would be a
     better understanding of how this would function in the rule.
               Certain other things, including means of training
     and feedback mechanisms, so that findings in the exercises
     would be fed back through the corrective action program, all
     parts that we consider essentially to the new rule would be
     piloted in the interim program.
               DR. WALLIS:  It seems to me it's not quite so
     simple.
               Adversaries, if they were able to get into a
     position where they could get control of something and cause
     some damage, probably would want to say okay, now we want
     something, and you don't know what they control, what they
     can do, how far they've gone.  
               We'd be in a very difficult position negotiating
     with people who you don't know what they're able to do, how
     far they've been able to do things, and you don't have
     information coming out that tells you what they've done.
               MR. ROSANO:  That's a very specific
     safety-oriented question.
               The goal of the response strategy should be for
     the licensee to maintain control of the operation of the
     plant, and so, for individuals to reach a point in the plant
     where they could take over control would be considered a
     loss of a system.
               DR. WALLIS:  Do you go beyond that?  I mean if
     they do reach that point, then you've still got to do
     something.
               MR. ROSANO:  You still have to do something, but
     actually -- let me try to differentiate between denial and
     defeat strategies.
               The licensees, more and more, are going to denial
     strategies, which is to keep the potential saboteurs away
     from the equipment that might allow them to take control of
     the plant, so that they -- in effect, they win, they win the
     game if the attackers are isolated or kept out of the
     critical areas of the plant.
               A defeat strategy would mean, again back to the
     notion of a gun battle, would mean killing more of them than
     they kill of the licensees.  That's not the approach.
               So, the point is for the licensee to maintain
     control through denial of the areas of the plant necessary
     to maintain safe operations.
               DR. WALLIS:  Assuming once you've lost control,
     that's the end of anything you think about?
               MR. ROSANO:  Oh, no.  Certainly we wouldn't just
     give up, but now, at this point, what we're talking about is
     the safeguards, protective strategies, and the
     responsibilities within the program to be able to defend
     against losing that control.  If the attacker gains control
     of the critical systems, there's still actions that need to
     be taken.
               DR. WALLIS:  I think you might be in a position
     where you don't know if he's gained control or not but you
     know that you happen to have lost your control, but you
     don't really know what they've been able to do.
               MR. ROSANO:  So, anyway, that is the point of the
     interim program, is, again, to be forward-looking.  What we
     want to do is take the best of the OSRE program, of which
     there is quite a lot, but to incorporate some new ideas and
     to test out where we're going.
               We also think of the interim program as an
     evolutionary thing.  It won't be static.  As we learn and
     things become obvious to the industry and the NRC, we'd like
     to be able to incorporate those.
               The second part of the presentation is on
     chronology, and in my way of going around the facts, I
     probably already covered a lot of this, but I just want to
     bring us back to where we were.
               In May of 1999, we briefed the Commission, and
     actually, what I failed to mention there was that that was a
     result of a Commission paper.
               The SPA task force, the Safeguards Performance
     Assessment Task Force, submitted in January '99 -- it was
     SECY paper 99-24, and we submitted our recommendations, and
     that had to do with creating an exercise requirement in the
     rules.
               On May 5th, we briefed the Commission, the
     Commissioners, followed with an SRM dated June 29th in which
     they instructed the staff to go forward and develop these
     recommendations.
               That was in June.
               It was during the course of the summer of 1999,
     through extensive meetings with the -- public meetings,
     including the industry, in which more was discussed about
     the possibility of opening up the door to consider all of
     the safeguards regulations.
               I wasn't with the NRC back in the '70s when we
     wrote 73.55, and I also know that, in spite of some of the
     fixes we've made to 73.55 over the years, we've never
     stepped back from it and taken a complete look.
               We believe it's time -- the staff has thought that
     it's time, and this is a good opportunity for us to
     modernize the regulations.
               In October, SECY 99-241 was proposed, and that
     included all of these concepts, risk-informing 73.55,
     including the exercise rule, so a broader look, and that was
     approved by SRM in November of '99.
               March 9th of this year, we submitted the SECY
     00-63.
               This was in response to the part of the November
     SRM that asked us for a definition of rad sabotage, and as I
     described earlier, we tried and could not conclude that
     simply an improved definition would solve all the problems.
               We concluded that we needed to have design
     criteria that would form the basis for the protective
     strategies and for the regulation.
               We submitted those design criteria in SECY 00-63,
     and the Commissioners adopted the recommendations in April
     of this year, telling the staff -- directing the staff to go
     forward and to work the rule.
               So, it's been taken step by step.
               In the beginning, we recommended an exercise rule. 
     After that, we recommended a broader look at 7355 to
     risk-inform it, and then, following that, we submitted a
     Commission paper in order to show how we intended to base
     the rule, on what we intended to base the rule, and that was
     the performance criteria.
               MR. TRACY:  I would also add the Commission
     directed us to incorporate the performance criteria in the
     interim program that the industry would ultimately take on.
               MR. ROSANO:  As for future, we are looking at
     summer of 2000 -- this program proposed by the industry, the
     Safeguards Performance Assessment Program -- the staff has
     spent considerable time reviewing it in several different
     versions, submitted comments to the industry, received some
     feedback from them, and it's been an iterative process.
               We hope to be able to reach final agreement and
     endorse the industry's Safeguards Performance Assessment
     Program.  That's what was referred to as the interim program
     on an earlier slide.
               That would be the program that would allow us over
     the next two to three years to test out the concepts in the
     rule.
               Now, an important point before I go beyond there
     is that we intend to continue doing exercises of protective
     strategies from here through that time.  Those will probably
     be in the form of OSREs, because it's a program that's
     worked very well and it's well understood.
               We will do OSREs on a periodic basis in order to
     continue the flow of information about licensees' response
     strategies until the time -- and here it says in late 2000
     -- that we expect SPA exercises to begin.
               The endorsement needs to precede the actual
     initiation of the program by some several months to ensure
     that the licensees who come up first for the exercises are
     working -- are operating under the right rules of
     engagement.
               CHAIRMAN POWERS:  I guess I have -- a couple of
     questions spring to mind.
               MR. ROSANO:  Sure.
               CHAIRMAN POWERS:  The first one that springs to
     mind is I think that the licensees are excellent at running
     electrical generation facilities.  I am not sure what their
     qualifications are for designing terrorist activities.
               So, I come in and say, gee, I wonder how one looks
     -- goes about formulating and reviewing a proposed SPA
     program, what criterion one uses to say whether it's an
     adequate one or not.
               I mean I know there are other organizations -- I
     happen to work for one -- that makes a business out of doing
     these things for the military.
               Can you tell me more about how it gets designed
     and how it gets reviewed?
               MR. ROSANO:  The document that has been generated
     by the industry, that we've been reviewing -- we have
     reviewed, in the context of what we know so far today about
     OSREs, what OSREs have taught us -- now, the OSRE program
     has been -- has enjoyed the benefit of contractors that we
     use who are very experienced in this area and who have
     helped us through the years.
               The document that the industry has proposed
     incorporates a lot of those ideas, plus I happen to know
     that the licensees typically have contractors themselves who
     have backgrounds in this field.
               Now, you've reached deep into the subject and
     asked a very important question.
               It's not just a matter of evaluating the exercise
     results, it's a matter of evaluating the program itself, and
     so, in fact, that's what I think is one of the strengths of
     the new program.
               This program, SPA, as well as the rule to come out
     -- it's kind of like the difference between, you know,
     giving a man a fish and teaching a man to fish.
               If we get the opportunity to look at the
     licensee's program, the industry's program, and it's a
     robust, strong, legitimate program, we can walk away with
     greater assurance that things will be conducted properly
     even when we're gone rather than just while we're on-site,
     and that's the goal of the new initiative.
               CHAIRMAN POWERS:  The next question that comes to
     mind is that I know -- you've certainly emphasized
     force-on-force exercises, as well as table-top exercises and
     things like that.
               I also know that there's a booming cottage
     industry in developing computer codes to simulate armed
     intervention against incursions and whatnot.
               Is that -- do those figure into this program at
     all?
               MR. ROSANO:  Yes.  I'm very pleased you asked that
     question, because it turns out that, in the last two days,
     we've just finished a two-day symposium in which --
               CHAIRMAN POWERS:  I'm a great straight man.
               MR. ROSANO:  You can ask questions all day, sir.
               A gentleman on my staff in the back of the room,
     Al Tartif, put together a workshop that brought to
     headquarters here members of Department of Energy, DOD,
     Sandia, Lawrence Livermore Labs, and the subject was how do
     we risk-inform security regulations, and nearly -- probably
     half of those addressed themselves to modeling and
     computer-based systems to test it.
               There is a lot to be gained from that.  It allows
     multiple tests of the same strategy either before or after
     you run a real exercise.
               There's a lot there, and I expect that the
     industry will make use of that.  It would make a lot of
     financial sense for them to do so.
               DR. WALLIS:  You're always talking about arms and
     weapons.
               It seems to me that's the most unlikely thing; the
     most likely thing is intelligence sabotage, as things get
     more and more computerized in the control room, someone
     knowing something about the system, slips in some lines of
     code which screw up the control system of the reactor, so
     that when someone does something, something happens and they
     lose control because they're getting false information.
               MR. ROSANO:  Perfect issue.
               In fact, cyber-security is an essential element of
     the new rule-based program, and as an aside, I'll say that I
     fought to avoid having our group referred to as the physical
     protection group, because I think that safeguards has to
     include more than physical protection.  It could be that, in
     the next 10 years, cyber-security may be more important than
     physical security.
               Okay.
               I think we're near the end, in any case, with the
     exception of time for some questions.
               In May of 2001, according to SRM that's been
     generated -- and this now, I think, is a couple SRMs ago --
     I can't keep track of which one told us to do which, but by
     May of 2001 --
               DR. SEALE:  There's a snowstorm over there.
               MR. ROSANO:  Probably is.
               May of 2001, the draft or the proposed rule is
     expected to be ready for publication, and by November 2002,
     we intend to have the final rule in place.
               Now, one thing I will say that refers back and
     that is that the licensee -- this interim program includes a
     triennial cycle of exercises, and the expectation was based
     on it taking about three years for us to write the rule from
     beginning to end, and so, the licensees will actually be
     running drills on a fairly continuous flow during this
     period that we're writing the rule so that, by November
     2002, we would expect to have had a significant percentage
     of licensees who have already run through their drills.
               And that completes my presentation.
               Any questions?
               CHAIRMAN POWERS:  I think we can thank the
     gentleman for that presentation.
               DR. KRESS:  I think we have comments from Mr.
     Lyman.  This might be a good time for him.
               CHAIRMAN POWERS:  Yes.
               DR. KRESS:  Thank you, guys.  That was very, very
     interesting.
               CHAIRMAN POWERS:  Mr. Lyman, I have enjoyed your
     presentations in the past on MOX fuel, and I hope you're as
     informative in this area as you were in that area.
               MR. LYMAN:  I'll try to be.
               I do appreciate the opportunity to make a few
     comments here.
               My presentation, which you should have gotten a
     copy of, is based on one which I gave at the RIC a few weeks
     ago, and I am grateful to Mr. Rosano for inviting me to
     speak at that conference, since I think we're probably
     regarded as a pain in the neck.
               DR. APOSTOLAKIS:  Could you tell us who you are
     please?  Not all of us know you.
               MR. LYMAN:  My name is Edwin Lyman.  I'm a
     physicist with the Nuclear Control Institute, which is a
     nonprofit research organization which focuses on nuclear
     non-proliferation issues and also issues of nuclear
     terrorism, which carry us over into nuclear sabotage, as
     well, and radiological sabotage.
               We are a public interest group, one of the few who
     have been trying to track NRC's developments in this area,
     and I think our perspective on the history of this program
     and how we've gotten here today is somewhat different from
     Mr. Rosano's, so I'd like to at least present some of the
     background as we see it, where the issues and the
     differences with the industry's position and ours are, and
     just comment on the future.
               I'll refer most of the details to the document I
     distributed.
               First of all, as a public interest organization,
     we are concerned with the public confidence aspects of NRC's
     programs.
               In fact, we see ourselves wanting to have
     confidence in NRC's programs, and therefore, what we see
     forms the basis for our ability to have confidence.
               In the issue of physical security and physical
     protection, I think it's especially crucial that the
     appearance of a robust system is maintained, because the
     public has less access.
               Even compared to safety issues, a lot of what goes
     on in the physical security arena is within a black box.
               So, we have to accept the assurances of NRC that
     they know what they're doing, that they can assess the
     threat accurately, and that the regulations they impose are
     appropriate for ensuring that the appropriate response to
     that threat is guaranteed, and we have to take their words
     for it in a lot of aspects, and appearance is, in the
     physical security, physical protection arena, reality to
     some extent, since the appearance of making nuclear plants
     look like hard targets is a big part of actually deterring a
     terrorist threat.
               Now, the background to the -- where we are in the
     OSRE program is that, back in the summer of 1998, it was
     terminated by staff without consulting the Commission.
               This was following a rather undistinguished
     performance by the utilities, by the licensees in the OSRE
     program, in which case almost half of them failed the OSRE
     in that they were unable to prevent an entire target set
     from being taken out, and according to OSRE, the OSRE logic,
     that would lead to significant core damage.  So, in almost
     half the plants, the mock terrorists were able to achieve
     significant core damage.
               Needless to say, this was not regarded as -- this
     is regarded as embarrassing by some of the licensees, and
     they were not happy about having to continue to comply with
     this program.
               In fact, the measures that they took greatly
     exceeded what they committed to in the security plans in
     some aspects, and in particular, an average of 80 percent of
     -- they employed more than 80 percent, on average, of
     security guards for the OSRE program, in excess of what they
     committed to in the security plans, and yet they still had
     this rather poor response.
               So, in our view, OSRE did what it set out to do,
     and it was, in fact, the very model of a performance-based
     program that NRC wants -- is looking to adopt more broadly
     in that there were a set of prescriptive regulations which
     were 10 CFR 73.55(b) through (h) giving very detailed
     instructions on what the licensees had to do, and the fact
     is that, even if they were in compliance with those, they
     still were not able to respond to the performance assessment
     appropriately, so it revealed there were weaknesses in the
     prescriptions that needed to be corrected.
               So, after the cancellation of OSRE, there was
     leaks to the press, there were different professional
     opinions on this, and it led to a rather embarrassing
     situation where the White House itself had to call Chairman
     Jackson at the time and ask her to reinstate the program,
     because major policy speeches had just been given
     recognizing the increased risk of terrorism and increased
     response by the Government.  So, NRC seemed to be out of
     step at that point.
               DR. KRESS:  Do you have any idea of why it was
     canceled, the program, in the first place?
               MR. LYMAN:  Well, there's no hard evidence there. 
     Chairman Jackson responded to Representative Markey by
     saying that there had been complaints on an informal basis
     by the industry about this program, it was too expensive. 
     They really objected to the expense of having to assemble
     the additional guards necessary, and it really was a burden
     to them.
               At the same time, I think NRC staff will say they
     were looking at revising the program from the beginning and
     this cancellation was simply a way to transition toward a
     new program, but it certainly was so abrupt that there
     didn't seem to be any kind of transition, and so, the cycle
     was not complete at the time that it was canceled.
               So, I can only speculate, but it appears,
     certainly, that after the performance record of the
     licensees at that point, they were anxious not to continue
     what seemed to be an embarrassment.
               So, going from that point on, the OSRE program was
     reinstated, but at the same time, there was an effort to
     rewrite the whole rule, as Mr. Rosano has discussed.
               The original intent -- well, there was another
     point about canceling the program, was that it was unclear
     whether there was legal authority for this.  Were the
     licensees required to endure these exercises to demonstrate
     they could deter the design basis threat against
     radiological sabotage, and our legal counsel believes there
     was authority, but it was decided that that really should be
     formalized by a new regulation.
               So, originally, I think the intent was simply to
     augment the authority in the rule to include an OSRE-like
     exercise as a requirement of the licensees, yet I believe
     the Nuclear Energy Institute wrote a letter saying it's time
     to open up the whole rule, we want to look at everything,
     and that was consented to, and we have concerns about that,
     that at least what comes out of this process should be at
     least as robust as what has happened in the past, because we
     don't think -- in contrast to maybe other performance
     measures of the licensees over the years in safety, which
     has led to the new oversight program, where there's
     confidence that, well, they're doing better in these areas,
     so we can give them more responsibility for their own
     oversight in some areas, this is not one arena where the
     performance has been that good, and I would not -- and they
     haven't earned the right to self-assessment, in our view.
               I'd just like to, as a way of background, describe
     some of the core issues that emerged at first.
               NEI proposed and the staff was willing to accept,
     it seems, changing the definition of radiological sabotage
     at the beginning, so that instead of significant core damage
     as the standard for OSRE, it would be a weaker condition
     that a Part 100 release would not have to be -- you would
     have to keep below a Part 100 release.
               So, the effect of this would be where if a
     successful -- or a failure of the OSRE program would occur
     if the entire target set was taken out and significant core
     damage would result.
               If you went to a Part 100 release, that would mean
     you would accept significant core damage.  I'd remind you
     Part 100 is the type of release consistent with, I believe,
     the substantial meltdown of the fuel.
               So, what the NEI proposal was really saying is we
     would accept enough damage to the plant that we could go to
     substantial meltdown of the fuel, but given that our
     containment, our emergency planning, and our engineered
     safeguards are designed to keep below Part 100 releases,
     then we can't afford to have greater damage and still
     satisfy protection of the public from a radiological
     release.
               Now, we found that approach somewhat extreme and
     wholly unreasonable, and from a public confidence
     standpoint, it just showed to us how out of touch we thought
     NEI was with the public, because we don't think the public
     would accept if a terrorist attack occurred at a nuclear
     plant, that terrorists were actually able to bring
     explosives into the plant, blow up safety equipment, blow up
     the -- or violate the reactor coolant system boundary, and
     yet, because the operators were able to stop this from
     becoming a holocaust, a Chernobyl, that that would be an
     acceptable and, in fact, not even -- that would be an
     acceptable outcome of their physical protection strategy.
               Just looking at what happened with the Indian
     Point 2 accident where there was no measurable radiological
     release, you looked at the public response to that, you just
     see that that is really extreme.
               I think the public believes and should believe
     that the physical protection at nuclear plants can prevent
     damage, any kind of damage, from being done to the plant,
     whether or not it's a critical safety system.
               So, we think going to a Part 100 was a mistake,
     and to NRC's credit, they arranged their SECY paper and
     their own recommendation to be based on performance
     criteria.
               This is closer to the way the original OSRE was
     structured.
               In other words, you want to make sure that you
     have enough equipment in place so that you can bring the
     plant to safe shutdown and you maintain core cooling, though
     they were willing to go beyond that point and say that that
     was acceptable.
               However, at the same time, there are some aspects
     of the plan going forward that we are concerned about.
               This session started with the question about
     risk-informing this process.
               We don't think that it's necessarily a wise thing
     to risk-inform security, to try to link security so closely
     with safety issues when, in our view, they are really
     different animals, and that's because, when you're dealing
     with intelligent adversary, what they are capable of doing
     is completely different from a dumb equipment failure.
               You know, if you have one spontaneous equipment
     failure, you can figure out what the probability of that is
     going to be.  If you have two spontaneous failures, that's
     generally more unlikely, unless it's a common mode failure. 
     But if you have an intelligent adversary who might be an
     insider, who might have access to everything you know, to
     your severe accident management guidelines, to your
     emergency planning, they know what you're going to do, and
     it will be a chess game.
               There is no way to estimate the probability of the
     capability of that insider to bring this plant to a
     meltdown.  So, we don't think that it's really necessarily a
     wise idea to risk-inform this process in the same way.
               We're all in favor of using better knowledge of
     what the critical safety systems are, what the weak points
     of nuclear plants are in designing a protective strategy,
     but in our view, that is not going to lead to a -- that
     wouldn't lead to a relaxation of what you can protect, and I
     think it's pretty well known what you have to protect.
               Now, the other aspect of this which is related and
     came up is the increased reliance on operator actions in
     assessing the consequences of an attack.
               We do not think that it's wise to go to increased
     reliance on operator actions in this way, especially if an
     entire target set is taken out.
               If you look at the latest draft of the industry's
     self-assessment program, which has turned from SAP, which it
     was a few weeks ago, now to SPA -- it doesn't seem to be a
     self-assessment program anymore, but their own plan -- they
     were still, as a few weeks ago, saying that even if an
     entire target set is taken out, we still want to have the
     opportunity to be given credit for preventing significant
     core damage if we can show their operators would be able to
     intervene that way, and our response to that is, if you're
     willing to give operators credit for those types of actions,
     that has to be demonstrated, that capability has to be
     demonstrated either on a simulator or through a human
     reliability assessment.
               There has to be some way.  You can't just take
     their word for it.
               DR. KRESS:  Let me ask you about that.
               It seems to me like that's analogous to what we
     call severe accident management, where the operator has
     severe accident management guidelines to do whatever he can
     with the existing systems, given what he knows about how the
     accident is progressing, to try to stop it, and I think
     that's a good idea.
               Even in the case of a sabotage effect, it would be
     nice for somebody to have pre-thought out what the operator
     might be able to do, with whatever parts of the system that
     he still has control of and is functional, to be able to
     stop it.  So, to me, it's thinking out the process and
     putting down ahead of time what he might be able to do,
     which seems like a good idea, whether you take credit for
     that or not.
               MR. LYMAN:  No, I absolutely agree with that, and
     I have no complaint about thinking these things through more
     carefully, but in my view, when you are evaluating an
     exercise, that that should go into the margin and shouldn't
     be given credit --
               DR. KRESS:  Shouldn't be part of the performance
     evaluation.
               MR. LYMAN:  Right, unless they can demonstrate it,
     because I mean if you have -- God knows what kind of
     complicated event you have and you don't know if the
     adversary, like I said before, an active insider has -- as
     someone mentioned before -- has interfered with the
     electronics, with the instrumentation systems -- maybe
     they've thought out everything that you would do.
               I mean they have these plans, and they say, you
     know, if you want to -- if you're going to scram the plant
     or you're going to de-pressurize the coolant system or
     whatever, that I'll be one step ahead of you, and so, unless
     you can really assess that appropriately, then you shouldn't
     be given credit for it unless the operators can be
     demonstrated, if they're given all these -- you know, the
     variety of scenarios, and I just think this would greatly
     complicate the evaluation, because if you tried to think
     through all the possible scenarios that an insider could
     create to confuse, I think that would increase the licensee
     burden.
               I don't know why they would want to do that kind
     of exercise.
               I think it's just easier for them to show they can
     keep saboteurs from bringing explosives to a vital area.
               So, you know, if they want to go through that
     exercise, I just say they have to demonstrate it credibly or
     they shouldn't get credit.
               In the existing OSREs, for instance, if a security
     guard has some sort of fantastic shot, if their success
     depends on what might be viewed -- you know, a shot that
     requires considerable skill, they're taken out to the firing
     range and asked to demonstrate -- I understand a recent one,
     that they tried to take credit for a shot that couldn't be
     demonstrated.
               I'm just saying that has to be -- that should be
     done the same way.  You want credit for it, you demonstrate
     it, and that's why I would urge you to try to recommend that
     some sort of robust means for demonstrating that is
     implemented.
               I think that point's been driven home.
               The last aspect now, the design basis threat -- we
     have a few concerns with what's been going on in that area.
               One is that the adversary characteristics
     document, which is just released -- in our view, at least --
     the public can't see that, because we're not cleared for
     safeguards information, but it's our belief that this is
     based on the best intelligence judgement, information
     judgement to date, and I was under the impression that that
     document would not be sent to industry for comment.
               In fact, a few months ago, Mr. Rosano made the
     statement that it was a finished document.
               When NEI wanted to see it and comment on it, they
     were told at that time that it's not for comment, which
     seems reasonable to me, because I don't think they have the
     capability for any type of independent intelligence
     assessment of what's a reasonable threat, but I understand
     that the document was sent out, was offered to cleared NEI
     personnel for review, especially for its impact on
     operational and financial aspects of the plant's operation,
     and that troubles me, because I don't know what that
     feedback is actually going to do to the document itself.
               The other aspect of this I'm concerned about is
     the lack of a mechanism for testing at one point against the
     entire design basis threat.
               The design basis threat is a set of different
     capabilities in the industry's latest plan for their
     program.  They do not say at any point that they are going
     to run an exercise with the entire capability of the design
     basis threat at once.
               What they say is we might run different pieces,
     test different aspects of the threat, then put it all
     together, but that, to me, is not credible.
               If you have a design basis threat, then there
     should be at least one evaluated exercise where the entire
     capability is active at once, and that includes the
     possibility of an active insider, which I believe you asked
     before if insiders were evaluated in the past or were
     present in the past, and only passive insiders who could
     give information but do not actually take part in the attack
     and didn't engage in any of these other activities of trying
     to interfere with systems, and so, clearly, an active
     insider is a component which really should be brought to
     bear, and especially the impact of an active insider on the
     operators if they attempt to intervene, clearly that could
     be neutralized.
               So, another aspect of the -- of trying to bring in
     operator actions is you have to consider malevolent operator
     actions, as well, or the ability to neutralize operators,
     and that would increase the range of possible targets, I
     think.
               CHAIRMAN POWERS:  Let me ask a little question
     about that.
               Suppose I did have an operator that was in cahoots
     with an outside force, attempting to do something. 
     Wouldn't, in fact, any activity that he undertook be
     promptly detected by the rest of the operational staff?
               MR. LYMAN:  That's certainly a possibility, but
     you know --
               CHAIRMAN POWERS:  Under active supervision.
               MR. LYMAN:  Yes.  Certainly, there are mechanisms
     that -- of course, that are designed to prevent -- for it to
     be able to detect that, but I couldn't say that, in every
     instance, that would be detected, or if an operator that was
     fully aware or placed highly enough, you know, in the
     security organization of the plant couldn't bypass these.  I
     mean it depends on your assumptions, and that's something
     which is still not known to the public.
               I don't know what's assumed about the capability
     of operators, but the possibility has been raised about
     someone who prepares for this incident by walking through
     the plant, making small changes that might remain undetected
     but cumulatively would have a big effect when the actual
     attack occurred.
               So, I'm sure you could dream up scenarios.  The
     question is how do you judge which are credible and which
     aren't?  I don't think there's a way to put a numerical
     value on them.
               Finally, on the -- what was called the
     self-assessment program and is now something else, the --
     there have been concerns that, like I said before, the
     industry hasn't really earned the right to have greater
     oversight in this area, yet that's what they're asking, and
     that's why the initial phrasing was self-assessment program.
               This is one big difference between OSRE and what
     they're contemplating, is that there would be potentially
     less oversight in certain arenas, and this is what we are
     not happy about seeing.
               We think whatever comes in the future has to have
     something as stringent as OSRE.
               If they are more frequent, that's all to the good,
     but they have to have the ground rules that are at least as
     stringent, because there's no evidence that they should be
     relaxed at this point, until the industry can demonstrate
     repeatedly they've corrected the vulnerabilities that have
     been shown in the past.
               So, with that, I'd conclude.
               Thank you.
               DR. KRESS:  Well, you've certainly give us some
     good food for thought, and we appreciate you coming by.
               I might ask if anyone has any questions of Mr.
     Lyman.
               DR. BONACA:  You had some comments in your paper
     on the process.  You did not elaborate on that.
               MR. LYMAN:  Well, this is difficult for someone
     from the public to actually say, but having sat in on the
     series of meetings since the beginning of this year, which
     are -- is part of what you might call interactive
     rulemaking.
               I would have to say that, because of the lack of
     resources of public organizations like ourselves, we can't
     participate on the same level as the industry can, and what
     I've seen in these meetings is almost like a contract
     negotiation, where the industry is writing its own
     documents, NRC has commented line by line, and the industry
     has quarreled with almost every change.
               Some of them they take, some of them they take
     back for consultation, they bring the document back the next
     time and it hasn't been changed, and it hasn't -- it doesn't
     seem to be the best or the most efficient way, first of all,
     since there was a debate for several months about
     radiological sabotage and the same arguments kept coming
     back to the fore.
               Because of this inequity, I would almost say that,
     unless the public can marshal the same resource to
     participate as equal players in this, that it might be worth
     putting more distance, again, between those writing the rule
     and those commenting on the rule, and of course, I would
     prefer more public access, more public resources, but in the
     absence of that, which doesn't seem very realistic, I don't
     know, I think it's a problem which has to be looked at.
               Other aspects like 10 CFR 70, which is also this
     interactive rulemaking -- we haven't been able to
     participate at all in that, and yet, I understand there's
     significant industry participate in the rule writing.
               DR. KRESS:  That's a very interesting comment.
               I understand that NEI would like to make a
     comment.
               Than you, Mr. Lyman.  We appreciate you coming by
     and giving us your views.
               MR. DAVIS:  Good afternoon.  I'm Jim Davis from
     Nuclear Energy Institute.  I've been working security there
     for about six years.
               I noticed the NRC staff provided you three slides. 
     I handed you 13.  Don't worry, I'm not going to go through
     every one of the slides, but I thought I'd provide some of
     the information as background material, and let me refer
     just to a few of those.
               What's OSRE?  I mean it seems like that's sort of
     a magical word.
               Perhaps a way to look at it is similar to some of
     the other baseline inspection programs we've seen in the
     past, and as you approach the end of that baseline program,
     you say what have you learned and what should we do in the
     future, and I think both the NRC and the industry are at
     that point right now.
               Last week, we completed the last inspection -- the
     last of the first series of inspections.  Every facility has
     now had an OSRE.
               So, you sort of finish the baseline and you say
     what do we do next, and I think you actually will find that,
     in the last couple of years, NRC staff has done a
     significant amount of work to try to figure out where they
     want to go in the future and what's the optimum way to
     capitalize on the lessons learned in the OSRE.
               Let me emphasize that an OSRE is basically a
     facility-run exercise observed by the Nuclear Regulatory
     Commission staff.
               The adversary is provided by the facility.  The
     training of the adversary is provided by the facility.
               So, a preponderance of this is a facility-run
     exercise that's observed and critiqued and evaluated by the
     staff.
               We had a whole list of SECYs earlier, but one of
     those SECYs, 99-024, very early in the process -- and this
     was the Safeguards Performance Assessment Task Force that
     did really a holistic look at the process -- is saying we
     think that there's more opportunity to integrate the
     licensee into this process and get the industry more
     involved and more responsible for the set-up, run, and doing
     these things.
               Remember, an OSRE is an eight-year cycle.  Once
     every eight years you were getting an OSRE.
               Out of that process and in discussion with the
     staff, the staff came up with what was referred to earlier
     as the exercise rule, and look at these elements.  Licensee
     develop target sets, licensee develops areas, licensee
     conducts drills and exercises, licensee evaluate, licensee
     correct the deficiencies.  It looks like a lot of licensee
     words.  Keep that in mind.
               We looked at that and said we've learned something
     from the OSRE process, too, and what we've learned, what the
     industry has learned, is if you take a deterministic rule
     and try to do performance-based evaluations against that
     rule, you're in big trouble.
               That has been our most significant issue, and in
     the discussions over the last year, we have said it is
     absolutely essential, if you are going to hold the industry
     responsible for performance instead of compliance with (b)
     through (h) in the rule, you want us to perform at a certain
     level, we must understand what the underlying criteria are
     for that performance.
               We've got to design to those criteria, we've got
     evaluate to those criteria, and we'd appreciate it if
     somebody would provide oversight to those same criteria.
               We felt it was absolutely essential that, to
     achieve this performance base, that the holistic look needed
     to be taken at the rule, and Mr. Lyman is absolutely right,
     on August 31st we sent a letter to the Chairman of the
     Commission saying the industry feels we need to completely
     rewrite the rule, and that's going to take three years, and
     we agree that we need to go on, and that's when we made the
     proposal that we would take the concepts and precepts that
     had already been developed and discussed with the NRC
     Commission and we would try to put them into an interim
     program as we move forward.
               But the biggest thing is assessment against what,
     and I think when you kick us out of here, you're going to
     discuss one of those activities, is what is the adversary
     that we are working against, because we need to understand
     that in detail just as much as anybody else, because it's a
     fundamental of the design of our program.
               But let me tell you what this core program
     contains.  It's procedures for developing target sets.  Go
     back to the first slide.  What did it say?  You wanted us to
     develop target sets, procedures for developing scenarios, a
     three-year cycle of drills and exercises, not an eight-year
     cycle, a three-year cycle, something that the licensee is
     responsible for.
               The drills are evaluated.
               Deficiencies are handled within the training and
     corrective action program, and at least once every three
     years, an evaluated exercise, a holistic look at the program
     that demonstrates the six key elements of the program, and
     those are the same key elements that the staff has been
     talking about for many years as they go through the
     discussion of what they consider important in the OSRE
     process and they try to train the -- and help people get a
     performance-based view of what they're going and the
     expectation that the NRC staff would be observing those --
     and critiquing those particular exercises.
               So, I guess what I wanted to just bring to the
     table today was that, one, the industry feels that it's time
     to rewrite the security regulation to take advantage of the
     performance insights that we have all gained from the OSRE
     process.
               We agree that a compliance-based rule is not the
     most effective way to maintain security in the current
     environment that we have today and that the program we are
     proposing, in fact, is exactly what the staff wants to put
     forward in the rule, and we think that there is an excellent
     opportunity to test these concepts over the next several
     years as the rulemaking process moves forward, so that at
     the end we put in the rule some words that in fact will work
     within the program, and I think you all are aware of several
     rulemaking efforts where we've had to come back and change a
     rule because, in fact, when you started writing the
     implementation guidance after the rule was done, you found
     out it didn't work quite the way you wanted it.
               So, we're enthusiastic about this process, and we
     think it's going to be a good effort.
               DR. KRESS:  What is the problem with you guys, the
     licensee, knowing what the design basis threat is?  Is that
     a security issue or what?
               MR. DAVIS:  No, sir.  The design basis threat or
     the characteristic -- the detailed characteristics --
               DR. KRESS:  Detailed characteristics.
               MR. DAVIS:  -- are classified safeguards, and the
     security manager at every facility is cleared for safeguards
     information.
               Clearly, the security manager has to know what
     he's working against.
               DR. KRESS:  Is there a reluctance to let you guys
     know what you're having to guard against?  Is there some
     reluctance?
               MR. DAVIS:  I don't fully understand the history
     and what's gone on in many years.
               The problem I think we've faced is we started out
     with a deterministic rule.
               When you tell me I have to build an eight-foot
     fence and have to have .2 foot candles of light, I don't
     need to know much more than that.
               So, nobody went through the exercise of clearly
     defining what radiological sabotage meant, how Part 100 was
     applied, which is a siting criteria, how it applied and how
     we cross-connected it across the entire plant, but when we
     get into the performance base, those issues become important
     to us, and as we get to the end of the process and we look
     back and say, gee, part of the problem we've had is we have
     not understood in the field the performance criteria that
     we'd expected at the same level that some on the staff or in
     other areas had.
               Therefore, we need to -- you know, let's look
     forward.
               I don't know history, but looking forward, we need
     to clearly understand what the adversary is and what the
     performance expectations are.
               With those, then we can ensure that our program is
     adequately designed, and this is not -- don't come once
     every eight years and say here is the criteria I am using to
     evaluate your performance, give them to us up front, we'll
     design our system, and you can look over our shoulders
     periodically and make sure we're performing to that
     criteria, and although -- and I don't have -- I guess I've
     got do a better job of selling that, because to me, that
     seems like, you know, an order of magnitude improvement on
     what we've been doing in the past.
               This is not the industry trying to do away with
     security regulations.
               We're not asking to do away with the guard forces
     and that kind of -- we're asking for -- to actually move,
     really move into the performance-based approach to
     evaluating the effectiveness of security that's at the
     plants.
               MR. SIEBER:  Are you trying to save money?
               MR. DAVIS:  I didn't say that.
               MR. SIEBER:  All right.  I withdraw my question.
               MR. DAVIS:  Well, let me answer your question.
               The problem that we face is we have some
     performance -- some deterministic requirements that are
     levied on the plants today that, in fact, contribute
     absolutely nothing to the overall public health and safety.
               At the time they were put in place, they probably
     looked like good requirements, but they are sitting there as
     requirements.
               So, we, in fact, sometimes have people doing
     things that we look at now do not contribute to the overall
     capability to counter a terrorist attack or prevent a
     terrorist attack.
               By making some of those deterministic things go
     away, focusing on the performance aspect within the same
     resources, we, in fact, provide a higher level of assurance
     that our security organization is going to perform its task.
               So, it's a shift in the focus of resources, is
     what you're really looking for.
               MR. SIEBER:  I don't know if I'm allowed to ask
     this question, but could you give me some examples of things
     that you think are deterministic that don't contribute to
     the overall mission?
               MR. DAVIS:  Well, one good example is the original
     rule you have a requirement to have .2 foot candles of light
     in the perimeter zone.
               At the time that that was put in effect and the
     electronic surveillance systems that were available, that
     was probably not a bad requirement for lighting.
               As we look forward with the improvements in
     electronics, you probably don't need that high an intensity
     in lighting in all areas to provide adequate surveillance.
               What's the performance criteria?  The performance
     criteria is it is able to monitor, observe, and determine
     what is moving in that particular area, not that you have a
     certain fundamental lighting requirement.
               So, there's one example.
               MR. SIEBER:  It actually goes -- it's not only
     what is moving, but it could be something that isn't moving
     but doesn't belong there.
               MR. DAVIS:  Yes, sir.  I mean a variety of things.
               MR. SIEBER:  And so, you would give your response
     officers and your watchmen these surveillance devices in
     lieu of keeping light-bulbs lit?
               MR. DAVIS:  I think what you will find is the
     lighting requirement would be commensurate with the
     surveillance equipment that you're using in that particular
     case.
               MR. SIEBER:  So, it would be one or the other.
               MR. DAVIS:  Defining lighting in this area and
     defining the electronic equipment standards you use in
     another area.
               The issue is can you observe and categorize what's
     going on in that particular -- I mean that's one example.
               MR. SIEBER:  Do you have any others, or is that
     the most prominent?
               MR. DAVIS:  That's just one example.  There are
     lots of others.  They all run in the same arena.  I hate to
     get into details, because you end up spending five or six
     minutes trying to explain the entire background so that the
     thing is -- the relevance of the issue is a little bit -- it
     takes some technical detail to understand why something is
     or isn't important.
               I guess which brings me to one more thought, if I
     can inject this.
               I would like to make sure you understand that we
     have professionals in the industry that are managing
     security. These are security professionals.  I am not a
     security professional.
               They know what they're doing, and they came from
     the same background as all the contractors and everybody
     else that we've been talking about.
               The industry does have the knowledge and does have
     the capability to set up realistic and challenging
     exercises, and whenever the question came up, we do have our
     own contractors that we use in this business to help us get
     an independent look.
               DR. WALLIS:  Mr. Lyman spoke of a situation where
     you might find yourself in a sort of chess game with some
     intelligent intruder.  I just wonder how you figure out that
     you're going to win that chess game.  I'm not sure that
     regulations help you very much in that sort of adversarial
     confrontation.
               MR. DAVIS:  Developing defensive strategies
     requires a lot of work.
               Table-top exercise, as mentioned earlier, is one
     of the techniques you use, and you pick a variety of
     scenarios and you start playing the what-if game -- if, what
     if; if, I will -- and you run through those various
     scenarios and you develop your defensive strategies for the
     broad case lot of what you're doing.
               You work in adversary characteristics against your
     target sets, and you run in your various scenarios, where
     your responders go in those various cases, what advantage
     you might or might not have in a particular situation, where
     your vulnerabilities are, and then changing your procedures
     to fix those cases.
               So, basically running those kind of what-if cases
     is a significant part of the development of the security
     plan and the contingency response plan for a particular
     facility.  The drills and exercises is one of the tools you
     use to validate the plan in that you run --
               DR. WALLIS:  I was more concerned with the
     intelligent adversary game, that usually security personnel
     are not chosen for superior intelligence.  You don't want
     them to have to make lots of decisions based on
     chess-game-type things.  You want them to react exactly as
     trained, and I wonder how you anticipate, then, the
     chess-game-type adversary.
               MR. DAVIS:  Management is making these decisions. 
     I guess I can't accept the statement that our security
     personnel are not very highly trained or skilled at what
     they do.
               DR. WALLIS:  No, they are.  They are very well
     trained and skilled, but it's not in the chess-game type of
     adversarial setup.
               MR. SIEBER:  Maybe I could address that a little
     bit.
               I think in any job classification, you have a
     range of people from watchmen all the way up to your
     response people plus your management, but security in a
     power plant, having worked in one for many years, is a team
     between management, security, and operations, and so, you
     can't look at it just as the uniformed security force, you
     have to look at it as a broader team.
               MR. DAVIS:  I agree, it's a total team concept.
               DR. KRESS:  One more question, then we're going to
     have to move on.
               DR. BONACA:  I thought I understand -- I mean Mr.
     Lyman said that there was a significant failure rate of the
     OSRE exercises.
               If I understand what you said, it's that you trace
     back that one to the fact that there are deterministic
     criteria at the plants and the criteria used by the NRC to
     evaluate performance by the staff are not clear to the
     staff.
               MR. DAVIS:  The performance criteria, in some
     cases, has not been adequately defined.
               I think Mr. Lyman likes to make a statement that
     half the people fail, but unfortunately, I think, if you go
     back and look at the situation, you'll find that there are
     very few cases where a finding, an actual violation of
     regulations was issued as a result of an OSRE inspection,
     and you have the difficulty of taking an opportunity to find
     a weakness in your program where you can take some other
     actions to improve the strength of it and you turn that into
     a -- into, gee, it must be a failure instead of here is a
     way of doing business that will improve you, and that's
     where I'd like to sort of compare this to some of the other
     inspections.
               Very frequently you find you're in compliance with
     regulations, but in fact, there are other ways and other
     things you can do that still comply with regulations but
     improve the performance and reduce the risk of the system.
               DR. BONACA:  You said going to performance-based
     exercises, then that would result in some other issues with
     OSRE.  That's why I was trying to understand where you saw
     these performance-based, you know, exercises being a
     resolution of the issues.
               MR. DAVIS:  I think the underlying issue is OSRE,
     in trying to look at performance, has shown that using a
     deterministic rule approach does not give you a program that
     clearly identifies and overcomes all the potential
     vulnerabilities.
               I thank you very much for your time.
               DR. KRESS:  Thank you.
               I guess that now is the time that we're going to
     -- we can go off the transcripts, because we're going to go
     into the closed portion of the meeting.
               [Whereupon, at 2:08 p.m., the meeting continued in
     executive session.]