483rd Meeting - June 6, 2001
Official Transcript of Proceedings
NUCLEAR REGULATORY COMMISSION
Title: Advisory Committee on Reactor Safeguards
Docket Number: (not applicable)
Location: Rockville, Maryland
Date: Wednesday, June 6, 2001
Work Order No.: NRC-251 Pages 1-259
NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers
1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005
(202) 234-4433. UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
+ + + + +
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
483RD ACRS MEETING
+ + + + +
WEDNESDAY
JUNE 6, 2001
+ + + + +
ROCKVILLE, MARYLAND
The Advisory Meeting met at the Nuclear
Regulatory Commission, Two White Flint North, Room
2B3, 11545 Rockville Pike, at 8:30 a.m., Dr. George E.
Apostolakis, Chairman, presiding.
PRESENT:
DR. GEORGE E. APOSTOLAKIS, Chairman
DR. MARIO V. BONACA, Vice Chairman
DR. DANA A. POWERS, Member
DR. WILLIAM J. SHACK, Member
DR. ROBERT E. UHRIG, Member
DR. GRAHAM M. LEITCH, Member
DR. THOMAS S. KRESS, Member at Large
DR. JOHN D. SIEBER, Member
DR. F. PETER FORD, Member
DR. GRAHAM B. WALLIS, Member
ACRS STAFF:
DR. JOHN T. LARKINS, Executive Director
DR. ROBERT ELLIOTT, ACRS Staff
CAROL A. HARRIS, ACRS/ACNW
HOWARD J. LARSON, ACRS/ACNW
DR. JAMES E. LYONS, ADTS
SAM DURAISWAMY, ACRS
DR. SHER BAHADUR, ACRS
PRESENTERS:
DR. AUGUST W. CRONENBERG
DR. J.N. SORENSEN
MARK CUNNINGHAM
ALAN KURITZKY
ADRIAN HAYMER
TONY PIETRANGELO
BOB OSTERRIEDER
JOHN A. NAKOSKI
GARY M. HOLAHAN
JACK R. STROSNIDER
. I-N-D-E-X
AGENDA ITEM PAGE
I. Opening Remarks by ACRS Chairman 4
II. Proposed Risk-Informed Revisions to 10
10 CFR 50.46 and Proposed Revisions to
the Framework for Risk-Informing the
Technical Requirements of 10 CFR Part 50
III. Potential Margin Reductions Associated 101
with power Uprates
IV. Draft Final Safety Evaluation Report for 144
the South Texas Project Nuclear Operating
Company (SPNOC) Request to Exclude
Certain Components from the Scope of
Special Treatment Requirements Required by
Regulations
IV. Discussion of General Design Criteria 220
. P-R-O-C-E-E-D-I-N-G-S
(8:30 a.m.)
CHAIRMAN APOSTOLAKIS: The meeting will
now come to order. This is the first day of the
483rd meeting of the Advisory Committee on Reactor
Safeguards.
During today's meeting the Committee will
consider the following: A status report on proposed
risk-informed revisions to 10 CFR 50.46, and proposed
revisions to the framework for risk-informing the
technical requirements of 10 CFR Part 50.
The potential margin reductions associated
with power uprates; the draft final safety evaluation
report for the South Texas Project Nuclear Operating
Company request to exclude certain components from the
scope of special treatment requirements required by
regulations; and the discussion of general design
criteria and proposed ACRS reports.
This meeting is being conducted in
accordance with the provisions of the Federal Advisory
Committee Act. Dr. John T. Larkins is the designated
Federal official for the initial portion of this
meeting.
We have received no written comments or
requests for time to make oral statements from members
of the public regarding today's sessions. A
transcript of portions of the meeting is being kept,
and it is requested that the speakers use one of the
microphones, and identify themselves, and speak with
sufficient clarity and volume so that they can be
readily heard.
I will begin with some items of current
interest. The ACRS Subcommittee on Advanced Reactors
held a meeting on June 4th and 5th, 2001. We would
like to thank Commissioner Diaz for his outstanding
keynote speech.
Also, we would like to thank all the
meeting participants, especially the presenters and
the panel members. This meeting was successful
because of the outstanding support provided by the
ACRS management, and Richard Savio, Michael Markley,
and Medford L. Ztoftorie (phonetic).
Our special thanks to the administrative
support provided by the Operations Support Branch
personnel, especially Jenny Gallo, and Carol Harris,
Beverly Joe White, Tyrone Brown, Michelle Kelton, F.
M. Bernard, Tania Winfried, and Sherry Meadow.
I understand that we have a change in our
management of the ACRS staff, and Dr. Larkins will
tell us about that.
DR. LARKINS: Good morning. It is a bit
of good news and a little bit of not so good news.
When you bring employees on board for a lot of
expectations and potential, your hopes are that they
are going to develop and move on, and do some other
things.
Unfortunately, other people recognize the
expertise and potential of the staff here, and Mr.
Lyons, who has been with us since I guess -- what is
it, September, Jim?
MR. LYONS: Yes.
DR. LARKINS: He has been selected to be
the new Director of the Future Licensing Organization,
which is going to be a tremendous job and
responsibility in the agency.
We just spent two days talking about
future licensing for advanced reactor designs. So,
Jim is going to have a major challenge, and although
I hate to lose him, we still wish him good luck.
(Applause.)
MR. LYONS: Thank you. First of all, I
would like to thank the committee for all the --
actually education that I have gotten since I have
been here on this staff.
And I would like to thank John and Dana
for selecting me to come to this position, and it has
really been very useful for me to see exactly how the
committee works, and to see all the breathe of
experience that you all have, and the issues that you
address.
And I really want to thank you for holding
the workshop the last two days to bring me up to speed
on my new job. It was very nice of you to do that.
CHAIRMAN APOSTOLAKIS: It was a parting
gift.
DR. LARKINS: With that, I am pleased to
announce that Dr. Sher Bahadur has been appointed the
Associate Director for Technical Support. Sher will
be replacing Jim effective July 9th.
For those of you who are not familiar with
Dr. Bahadur, he joined the NRC in 1984, and has held
a number of progressively more responsible positions.
It is interesting to note that I was the
technical assistant for Chairman Zech in the early
'80s, and when I left to take a position in NOR, Sher
was my replacement as the technical assistant to the
chairman.
So he knows his way around the Commission
and will be very helpful. He has worked both in the
Office of MNSS and he has also worked in research, and
I think his current position there is chief,
engineering research applications branch. So he will
bring a balanced perspective and I should be able to
dump lots of work on him.
Prior to joining the NRC, Dr. Bahadur
worked in a variety of assignments in the private
sector, including NUS, Acres American, Incorporated,
and Lundy Engineering.
Dr. Bahadur has a Ph.D. in geotechnical
engineering from the South Dakota School of Mines
Technology, but even more importantly, I think he
brings a wealth of experience and background in a
number of areas that will impact both committees, the
ACRS and the ACNW.
So I am looking forward to having Sher
around for a little longer, at least a year or two,
and working with the committee. So welcome aboard.
thank you.
(Applause.)
DR. BAHADUR: Thank you, John. As you
mentioned, I have been in research for about 12 years
now, and I have looked after three different branches
during this 12 years. So I think there is a wide
breathe of experience that I have received in that
office.
And I am looking forward to working here
now and learning with the committee, and also bringing
the expertise in certain areas, which we will be
useful to you, as will for my own development. So
thank you so much again, and I am looking forward to
it.
CHAIRMAN APOSTOLAKIS: Thank you. We have
three letters to complete at this meeting, and the
response, and they are all top priority. There is the
response to Chairman Meserve's May 7th memorandum on
the differing professional opinion on steam generator
tube issues.
And the response to the April 12th EDO
letter on topics raised by the ACRS pertaining to
issues associated with industry use of thermal-
hydraulic codes, and risk-based performance
indicators.
We will also discuss our letter on the
South Texas project exemption request, but the letter
will be completed in July, and so we have three
letters. And the first session is on proposed risk
informed revisions to 10 CFR 50.46.
As you see from the agenda, we had
allocated almost two hours or three hours or more --
well, more than two hours to this subject. But we
will only take until 10 o'clock, and after the break,
we will come back and discuss Dr. Wallace's letter on
thermal hydraulic codes.
So with that, we will start on the
proposed risk-informed revisions to 10 CDR 50.46. Dr.
Shack will lead us through this.
DR. SHACK: We will be discussing the
status of the staff industry initiatives in 10 CFR 50-
46, and the industry proposal is fairly straight
forward.
They propose that -- and loss of cooling
accidents, and some other range defined upon a plant
by plant or a plant class basis through analysis and
experience.
The staff has a wider range of options
that they are considering for 50.46 and presumably we
will hear something about that range of options that
they are considering this morning, and Mark will start
us off.
MR. CUNNINGHAM: Thank you, Dr. Shack.
Good morning. My name is Mark Cunningham, and I am
the Chief of the PRA Branch in the Office of Research.
With me this morning is Alan Kuritzky, a senior
reliability and risk analyst in the branch.
As Dr. Shack indicated, we are going to
try and give you some information on the options that
we are considering on making modifications to 50.46 to
make it more risk informed.
Right off the bat, I am going to take the
slides slightly out of order, and to go to slide three
and talk about the purpose of the meeting. Basically,
we had hoped to have a commission paper to you a
couple of weeks ago for you to review.
We weren't able to do that for a variety
of reasons, and so we want to give you a status report
today on our work to consider changes to 50.46, and
use this as an opportunity to solicit feedback, and
get questions from the committee on our proposals.
We are not requesting a letter at this
point. We intend to get the commission paper -- the
commission paper is due to the EDO in about three
weeks. We intend to get it to you in time so that you
could discuss it at the July meeting, and at that
point we would ask for a letter.
Going back to slide two then, and an
outline of the presentation, basically first we want
to provide some background just to remind people where
we are in the series of steps that are undertaken in
option three.
I want to spend a little time talking
about what is in 50.46, and the different aspects of
50.46. We want to give you some options for different
ways, and discuss some possible different ways to
change the requirements, and discuss a little bit
about what future technical work might be required to
support these possible changes.
And to summarize a couple of policy
issues, and then end up with some discussion of
schedule. Just as a reminder to the committee and
others, if we go back a couple of years to a
commission paper that laid out the plan for performing
option three, and it was described in Section 99.264.
It laid out a framework, and the framework
basically had two phases in it. The first phase was
a kind of identification and evaluation phase that we
went through or had gone through everything in Part
50, and tried to identify what aspects or what
requirements within Part 50 might be amenable to being
changed to be risk informed.
We prioritized those and identified 2 or
3 issues as the most likely or the most important
changes to tackle first. The first of those was 50.44
on combustible gas control.
As the committee knows, we provided
recommendations to the commission last September on
that, and there is a rule making plan now before the
commission to make those rule changes.
The second priority that we identified
were potential changes to the ECCS requirements
contained in 50.46 and other places in the
requirements. And Part C of the first phase is --
DR. POWERS: Mark, remind me why you
thought that was 50.46 was particularly susceptible
to risk information?
MR. CUNNINGHAM: A couple of reasons
really. One was that there was a fair amount of risk
information already available that would help guide
you in possible changes to the ECCS requirements.
There is a lot known about the frequency
of breaks and the frequency of core damage associated
with different types of breaks, and that sort of
thing.
It was also recognized that there is a
fair amount or there are opportunities in 50.46 where
you could make some -- improve the realism of the
requirements.
DR. POWERS: Well, I think everybody
recognized that there were things that were bound in
the nature with 50.46, and I guess I am interested in
why you thought that particular regulation was just
right for risk information.
I think you are on the right track when
you say that a lot of information -- that we knew a
lot about breaks. I mean, we have looked at
everything from micro breaks to macro breaks, and we
know something about the reliability that the ECCS has
to have to counterman those breaks. It would seem
like pretty good reasons to go after that one.
MR. CUNNINGHAM: Another big factor I
think was that 50.46 is one of the centerpieces of
Part 50 if you will, in the sense that the --
DR. POWERS: It is a little linchpin with
it.
MR. CUNNINGHAM: It is a linchpin that you
start to change, and we saw an opportunity that if you
start with 50.46, you could have the opportunity not
only to change the ECCS requirements, but have an
opportunity downstream to make other changes to the
requirements, because there are many if you will
spinoffs from 50.46 and other parts of the
regulations.
And somebody has described it as an
octopus of having tentacles that reach out into many
other parts of Part 50. So there is an opportunity to
start working that whole set of issues.
And perhaps to put it another way, if you
don't tackle 50.46, you may have a hard time changing
other parts of Part 50 as well. So it was the
combination of things.
We thought that we could have some
successes that would be relatively low-cost and quick
to do. We had a good set of information to work from
on with the risks associated with different pipe
breaks, and again we saw that it was such a
centerpiece of Part 50, and we thought it was
worthwhile.
DR. SHACK: And I think you could also
argue that there is a substantial safety benefit.
MR. CUNNINGHAM: Yes.
DR. POWERS: I mean, I think that most
people would argue that what we are doing to the
diesels is not helpful.
MR. CUNNINGHAM: Yes, and certainly that
point has been made a number of times, and related
issues on diesel generators -- start times and that
sort of thing -- that have been argued to be counter
to safety in some respects.
And also to be clear, when we polled the
nuclear industry, and NEI provided us their ideas of
what they thought would be most important to change,
the ones that they identified right off the bat was --
the top two were 50.44 and 46.
DR. POWERS: You have a lot of information
on breaks from the studies that have been going on for
over -- gee, since '74, and we have been looking at
various kinds of breaks since then.
Do you really have a lot of information on
this hypothesized counter to safety or what we can do
to poor, innocent diesel generators?
MR. CUNNINGHAM: Do we have the same type
of level of information? No, we don't, I don't think,
but I think it is the more mechanical engineering
types and things like that will say that the
requirement to start these diesels as they are
required to do with having cold starts, and that have
to be extremely fast, it is counter to good sense if
you will in the design of these diesels.
They are very big machines, and it is not
a good way to pursue it.
DR. POWERS: Yes, but the only thing that
one would worry about is why not just go fix that?
MR. CUNNINGHAM: Because again there are
other opportunities, and looking at the complete issue
that I will come back to in a little while on ECCS
reliability, is that there are -- that the
requirements that we have that are implemented today
cause us to perhaps over design some aspects of the
ECCS that can lead to potential safety issues in other
respects.
I have been before this committee several
times to talk about pressurized thermal shock risk.
One of the issues that comes up is that if you are
putting greater demands to pump in cold water to deal
with large LOCAs, then you may be improving the risk
associated with large LOCAs.
But you may be hurting our potential to
deal with pressurized thermal shock, or increasing the
risk associated with pressurized thermal shock.
DR. POWERS: To raise an event in order to
avoid an AB?
MR. CUNNINGHAM: Yes, that's right.
DR. POWERS: And so it is probably not a
good tradeoff.
MR. CUNNINGHAM: Yes. And given that we
think there are conservatisms in the current 50.46, I
think we can do a better balancing job if you will
between those two sets of requirements.
DR. LEITCH: Has it been decided at this
point which is the next regulation beyond 50.46 to be
considered?
MR. CUNNINGHAM: We have been spending
some time looking at special treatment requirements,
but by and large now I think for the near future our
focus is going to be on getting 50.44 done and 50.46,
our hands-on 50.46 if you will.
So as I said, with 50.44 in a sense, we
are down in this context of the framework option three
and we are down in the phase two part for 50.44. We
are into rule making and that sort of thing.
And in the context of 50.46, we are back
here, in terms of the latter part of the last phase or
the last part of phase one, and we are looking at the
feasibility of possible changes.
So in that sense what you will hear about
today is us talking about what is the technical
content of 50.46, and what would lead us to some
alternatives, and what is the basis for some
alternatives to the present 50.46.
Are there policy issues that have to be
resolved, and what would be the required technical
work to proceed, and in some sense the resources that
would be required to proceed with different
alternatives.
So the bulk of my presentation is really
going to cover that sort of thing. The paper that we
owe to the commission in June is a set of
recommendations to proceed if we be believe that it is
appropriate, to proceed to rule making.
And then if the commission approves, then
we would go on into the phase two work. But in a
sense this is setting you up to make it clear that
there are a lot of things that we don't have answers
for today.
We think there are some good opportunities
for change here, but we don't have all the detailed
technical work done to provide the real basis for
this, or the complete basis for this.
Moving on now to what is in 50.46. And
50.46, in a sense, has four parts. The first part
deals with the concept of assuring system safety
function, and to assure that the requirements talk
about basically ensuring that the system can operate
given single failures.
That the system can operate given the
assumption that there is a loss of off-site power. In
effect, this first box here is a first attempt at
defining a reliability requirement for the ECCS.
So we are going to come back to this later
that there may be a better way to ensure reliability,
rather than working with single failure and
assumptional off-site power.
So a key theme of what you will hear today
is changes to the reliability aspect of the ECCS
requirements. The second part is dealing with what is
an acceptable ECCS performance, in the context of
ensuring that we don't have a core melt accident, or
a severely damaged core.
Right now there are five criteria within
50.46 and other places that are used to measure that.
The classic one or the most well known is 2,200
degrees F, in terms of peak clad temperature.
But there are others in terms of the
maximum allowed cladding oxidation, and hydrogen
generation, and a number of other things. Again, we
see in this case some opportunities for making -- and
some reasons to make this a little more general
perhaps, and improve the quality of the requirement in
general.
DR. POWERS: The requirements for maximum
clad oxidation of no more than 17 percent is not
really related to hydrogen generation is it? It is
really an embrittlement criteria?
MR. CUNNINGHAM: It is an embrittlement
criteria, exactly.
DR. POWERS: And as we are discovering
lots of things in embrittlement of the clad besides
oxidation and what not are you a part of the same
increased realism to change that to be an honest-to-
god embrittlement requirement, rather than a --
MR. CUNNINGHAM: We will come back to
that, but yes, that is a direction we are moving in.
The third aspect of 50.46 and related requirements
deals with the acceptable model that is used to
compare with the performance criteria or the
acceptance criteria.
Currently, there is an Appendix K approach
to modeling ECCS, the thermal hydraulics of it, and
then there is also another alternative for a realistic
with uncertainty analysis approach.
And we see some opportunities there worth
making some changes that could make or improve the
requirements. And finally the last part is the
definition of the range of break sizes that are
required to be mitigated by the ECCS system.
Basically now the requirement is that it
has to include up to and including the largest pipe
break in the system. Again, we will talk some more
about some possible changes to that as we move on
today.
DR. POWERS: I was intrigued by the
requirement that a volume be able to withstand the
rupture of the largest pipe in that volume. I am
familiar with a reactor not located in the United
States, and which had that requirement for it, and it
is containment modules.
And it succeeded in blowing its
containment modules up completely because it broke
several of the largest pipes. But do you bear those
things in mind in thinking about these pipe breaks?
MR. KURITZKY: You mean in breaking
multiple -- in having multiple breaks at the same
time?
DR. POWERS: Well, I mean, the requirement
is not to blow up the containment volume or things
like that. I mean, it is coming in and taking it back
and saying, well, it is no bigger than this break that
takes you one step removed from what you really want
to accomplish, which is not to break the volume.
MR. KURITZKY: Right. I mean, we have
certainly taken into consideration the containment
integrity. I mean, changes that we will recommend
involving ECCS, we will always be keeping in mind that
we don't want to violate the containment, and we take
containment in strong consideration if that is your
question.
DR. POWERS: The containment that I was
speaking of was the internal containment, and with an
environment exactly like this, and that could
withstand the break of the largest pipe in the volume.
Unfortunately, it broke 12 of them, and that was more
than it could take.
MR. CUNNINGHAM: This slide is intended to
kind of provide the basic, if you will, kind of some
boundary conditions to what we will talk about for the
rest of the morning here.
As I mentioned earlier, I think a theme
that you will see is that I think there is something
to be gained and we have considered seriously ways to
improve the description of the reliability
requirements for the ECCS system.
And getting away from this rather
prescriptive statement of single failure criteria and
loss of off-site power, and there is ways to do things
better and perhaps improve the reliability of the ECCS
system.
Another one of our boundary conditions is
that we see some opportunities and parallel and as
part of being risk informed to improve the realism of
what we have here in the ECCS requirements.
You will see in each case, I think, a
couple of different approaches to accomplishing our
goal, and in some cases we have changes that might be
still fairly prescriptive, but still improved over
what we have today.
But there is still a kind of more
prescriptive oriented changes, and we also have
approaches that are more performance based. So I
think in each case you will see alternatives that
might be somewhat less prescriptive than today, but
still prescriptive.
And then others that are more bigger steps
if you will and to be more performance based types of
approaches.
DR. WALLIS: And while we are talking
about ECCS reliability, you are not suggesting that
the ECCS be designed so that it cannot cope with a
double ended break?
You are just saying that the way in which
it copes with it doesn't have to be as reliable as we
thought it had to be? Is that what you are saying?
MR. CUNNINGHAM: What I was saying is that
in the present requirements the way of ensuring
reliability of the system for the spectrum of breaks
is a somewhat artificial way of -- well, it is done
somewhat artificially, and the assumed single failure
in the system, and the assumed loss of off-site power.
And you can accomplish the same
reliability perhaps in a more risk informed way
without necessarily -- perhaps even improving the
reliability to cope with the system.
But we are not saying that the ECCS does
not have to cope with the largest break in the system.
DR. WALLIS: Are you doing something like
a product of the probability of the break, and the
reliability or probability of the success of the ECCS
or something?
MR. CUNNINGHAM: Yes, exactly.
DR. WALLIS: And if the probability of the
break is very low, then the probability of the ECCS
working can be less than 99.99 percent or whatever?
MR. CUNNINGHAM: Yes, exactly.
DR. WALLIS: That is the argument?
MR. CUNNINGHAM: Yes.
DR. WALLIS: And we are certainly not
backing off on the capability of the thing to respond
to a large break?
MR. CUNNINGHAM: No, it is not.
DR. WALLIS: I think that should be clear
to the public that you are not backing off on that
sort of requirement?
MR. CUNNINGHAM: That's right.
CHAIRMAN APOSTOLAKIS: So is the same
thinking then applicable to the reactor for which the
core damage frequency is very, very low, so we can
relax the reliability requirements of the containment?
MR. CUNNINGHAM: Relax the reliability
requirements on what?
CHAIRMAN APOSTOLAKIS: On the containment?
In other words, we are shifting. If you think in
terms of the cornerstones, we are saying that the
initiating event or the core damage frequency is so
low that now the barriers that follow may not be
needed.
MR. KURITZKY: I think we based everything
on our framework document, which maintains or which
states that we have to maintain the defense in depth
layers, which containment of course is one.
So in our framework, we should not be
doing anything that allows to get through a layer.
CHAIRMAN APOSTOLAKIS: In this case.
MR. CUNNINGHAM: Yes, in this case.
CHAIRMAN APOSTOLAKIS: But that is the
next logical step isn't it?
MR. CUNNINGHAM: Yes, that's right. If
you could take the same framework that we are working
on here, and we are applying the framework to existing
plants. So they have a containment, and they have a
ECCS, and that sort of thing.
And the next step in a direction of
advanced reactors is to think about this framework if
you have nothing but a paper reactor if you will. And
is today's balance the right balance for a new plant.
That's a good question.
DR. WALLIS: Well, I liked your argument
earlier that if you change some of these requirements
that you might actually make the system safer, because
you are not putting greater demands on the system in
some other scenario.
If you can make that argument, I think you
have a good one. If it is just backing off alone,
that is not such a good argument.
MR. CUNNINGHAM: It is not just backing
off it.
DR. WALLIS: It is actually improving
safety if you can make that argument, and I think that
is a good one.
MR. CUNNINGHAM: Yes. Again, one of the
last ground rules for the flavor of what we are doing
here is the issue that has been raised on the
definition of whether or not you can eliminate the
large break LOCAs as a design basis accident.
I think you will hear some more later that
there are some possibilities that that could be done,
but there is also a lot of technical work that would
have to be done to justify that.
And how far we go in this particular paper
in opening the door for that is subject to some
discussion, and we will come back to that later.
DR. POWERS: But that would be the case
then where the ECCS would no longer be capable of
handling the largest break?
MR. CUNNINGHAM: Conceivably, yes. That
if you could make a convincing argument that there is
a set of pipe breaks, or pipe breaks of a greater than
certain size are extremely low frequency, then in a
sense you shift, and the pipe breaks over into the
category that we would do for a vessel rupture.
That it is an event of such a low frequency that you
do not require ECCS mitigation.
DR. WALLIS: However, if it did happen, it
would be embarrassing if you had already decided to do
away with the ability to cope with it, low frequency
or not.
MR. CUNNINGHAM: It would be embarrassing,
and a dangerous situation. And I believe as was
discussed about a month or so ago with a subcommittee,
I guess, there is a lot of technical work that the
staff believes would have to be done before you could
make that case.
And even if you did a lot of technical
work it is not clear that you could get to that end
point.
DR. KRESS: Mark, do you have a list of
potential changes that the licensee will make if you
change the definition of the pipe size for a large
break LOCA.
MR. KURITZKY: Industry has supplied us
with a couple of fairly extensive lists of things that
they would like to change if they could, and change
the definition of a large break.
DR. KRESS: Okay.
MR. CUNNINGHAM: And we didn't come
prepared to talk about that today. But I think it is
clear that if you could accomplish that that there
would be a lot that would change in the operations of
the plant, and in the design and in probably the
operations of the plant.
DR. POWERS: If all those things were
implemented, and I realize that it is kind of a
hypothetical list that maybe not all plants could
eliminate, and could do all things.
But have you taken a representative plant
and done a risk analysis on it to see if there is a
change very much?
MR. CUNNINGHAM: We have not done that at
this point. Again, we are in the -- and again to go
back to the slide on where we are in the procession of
tasks, we are at the point of do we think it is
feasible to make some changes.
And then if we were going to make those
changes, then we would proceed to do more work like
that, but we are not at the point of having to do
that.
DR. POWERS: Well, it seems to me that if
you found that the risk went up significantly that you
wouldn't want to bother trying to find out if it was
feasible to make the changes.
MR. CUNNINGHAM: Certainly, and that comes
into the feasibility part of it. And what you will
see in the presentation is that we are not coming in
and saying that our approach is to eliminate the large
break LOCA design basis accident.
We think that today there is a lot of
technical work that would have to be done to justify
that. We may want to start down that path, and I
think that our goal was to start down that path to
talk about how that might be done.
But the changes that we are talking about
in the shorter term are less radical changes to the
requirements, but things where I think we can improve
a much better balance to what is in the ECCS
requirements.
DR. POWERS: And based on evidence from
yesterday, the Chairman here, who is looking for
radical --
DR. WALLIS: Well, Mark, not only do you
have to do what you think is right, you have to
respond to what industry is asking for.
MR. CUNNINGHAM: Yes.
DR. WALLIS: And if they come in with very
good arguments that do away with a large break LOCA,
you have to be on good technical grounds to respond.
MR. CUNNINGHAM: Yes.
DR. WALLIS: And you may have to do some
of this technical work or maybe all of it.
MR. CUNNINGHAM: Well, when we come back
later on and we talk about the future --
DR. SHACK: On page 57 of your notebook,
there is a fairly detailed description of the things
that they would like.
DR. KRESS: Thank you, Bill.
DR. POWERS: And that they think they can
get out of this.
DR. KRESS: Thank you, Bill. Handwritten
on page 57?
DR. SHACK: Yes.
MR. CUNNINGHAM: Dr. Wallis, yes, the
industry or representatives of the industry have
proposed certain approaches, and we and the staff have
-- and again at the subcommittee meeting, we talked
about some of the issues that would have to be
resolved.
And I think that since then we have talked
with the industry, and are prepared to continue the
dialogue on how those issues could be resolved.
DR. WALLIS: And if you remember, they
said they would go away and prepare a really good
case. So you have to be ready for that.
MR. CUNNINGHAM: Yes, and I know that the
members of the staff are trying to set up a series of
meetings to talk about that. I don't think they have
been scheduled yet, but I think the idea is to go
forward and talk about that.
DR. WALLIS: I am just saying that talking
is fine, but someone has to do a really good technical
analysis which is convincing.
MR. CUNNINGHAM: Yes, we agree.
DR. KRESS: Mark, I have a bit of a
strange question, I guess. We have a number of design
basis accidents that the plants are required to meet,
and this is one of them. And we are talking about
changing or may possibly change the design basis
accident.
The question I have is that isn't there a
rationale that has been used by the agency to select
design basis accidents, their description and what
they are, and some sort of rationale that says we will
choose this as a design basis accident because it has
these attributes?
And it is sort of top down approach to the
question of the design basis accident; and then the
next question would be that if you had that rationale,
what pipe size goes into meeting those criteria or
whatever they are?
I suspect that we don't have such a
rationale, but I guess part of the question is should
such a rationale be developed in an explicit manner,
rather than -- I suspect that it has grown from
intuition and other things.
MR. CUNNINGHAM: The set that is in
existence today for the operating plants is this one
as you know that has evolved over time, and one of the
challenges in thinking about changing those is to go
back in 50.46 or something else and look at the intent
of the requirements when they were established.
And in some cases that is very hard to do
because the decisions were made 25 or 30 years ago, or
more, and it is hard to discern from the record what
all the intents were at the time.
DR. KRESS: Part of my motivation for
asking the question doesn't really have to do with
this one, but has to do with advanced reactors.
MR. CUNNINGHAM: That's right.
DR. KRESS: If the tendency or the choice
is to go with we will dream up some more design basis
accidents --
DR. POWERS: Well, I think you want to be
careful with that. I don't believe that you will find
that the design base accident set is capricious or
dreamt up.
DR. KRESS: No, I didn't mean to impugn it
like that.
DR. POWERS: It is developed in a fairly
disciplined fashion to test safety systems without a
great deal of duplication, but with some bounding
nature to it.
There are a whole bunch of accidents that
one can dream up that are not labeled design basis
accident accidents because they are covered by other
existing design basis accidents. It has been a very
disciplined process I think.
DR. KRESS: Well, it is the discipline and
rationale that I wanted to see explicit, so that I can
then apply that discipline to the advanced reactors
and say, all right, for this reactor type and style,
these are good choices for design basis accidents
because they have these attributes that you mentioned.
Plus, there may be others, and I would
like to have those attributes somehow based in risk
considerations, too, rather than --
DR. POWERS: Well, I actually think there
is an NRC document that maybe two minutes ago I could
have quoted the title to you, but I can't right now,
that actually outlines some of the philosophy on how
design basis accidents are --
DR. KRESS: Selected.
DR. POWERS: -- defined and selected,
because we have gone through this exercise before. I
mean, this is not the first -- well, when the FFTF and
Clinch River were in the offing, we had to go through
these exercises once before. So people have actually
looked at these kinds of things.
DR. KRESS: Yes, but I suspect it was
before we focused so heavily on reasons.
CHAIRMAN APOSTOLAKIS: Well, if I wanted
to have a design basis accident that would draw on
risk information as Dr. Kress just said, wouldn't I
need to know which accident sequences are affected by
this regulation? Did you collect those?
MR. CUNNINGHAM: You would want that
information, yes.
CHAIRMAN APOSTOLAKIS: Do you have it?
MR. CUNNINGHAM: I think we do, yes. But
again I don't have it here today, but I think we have
a sense --
CHAIRMAN APOSTOLAKIS: Right. I think it
would be nice for us to see that, and at least it
would be interesting to me to see it.
DR. KRESS: Yes, George, and it is those
sequences that I want to see that not only affect CDF
and our alert, but I would like to see the sequences
that have to do with possibly other regulatory
objectives. Frequency of releases of fusion products
of higher frequency, lower magnitude, in CDF alert
anyway.
CHAIRMAN APOSTOLAKIS: Well, that's
perfectly fine, but what I am curious about is that if
I have a bunch of sequences and ventries, then maybe
we can say, look, this particular design basis
accidents addresses this piece here, and that piece
there, and that piece there.
And see whether we cover the whole
spectrum of sequences and how, because the accident is
not just the way -- the way I understand it, the
design basis accident is not just a large break LOCA.
It is a stylizing, and plus single
failure, and so that would be an interesting thing to
see. And maybe something is left out. That would be
a basis for defining the DBAs. By the way, it is not
just the logic behind the position.
I think one of the great advantages of
having DBAs is really that they facilitate the
interaction with the licensee.
DR. KRESS: Yes, really great.
CHAIRMAN APOSTOLAKIS: I mean, it is one
thing to say go do a PRA, and then we talk, and quite
another to say these are the things that we expect you
to do, right?
DR. KRESS: If you had a risk in some
informed way to select design basis accidents, I think
we have a problem, and it is because your purpose of
making design basis accidents is to ensure that the
design ends up with a risk status that needs
acceptance criteria.
CHAIRMAN APOSTOLAKIS: Yes.
DR. KRESS: And we don't have acceptance
criteria that includes uncertainties, and defense in
depth, and releases the lower fusion products, and
worker exposure. We don't have risk related
acceptance criteria. So I think we have a problem.
CHAIRMAN APOSTOLAKIS: Well, I think
looking at the sequences --
DR. KRESS: Well, that would be well
worthwhile. That would give you a lot of insight.
CHAIRMAN APOSTOLAKIS: Is that out of the
question to do this month?
DR. KRESS: Could we have that tomorrow?
MR. CUNNINGHAM: Well, I will tell you
what we will be giving you in this part of the paper
at the end of the month, and maybe this at least
addresses part of what you are talking about.
DR. WALLIS: Well, I like what George is
saying because once you have got that, then you could
say, well, suppose we make this change in these DBAs,
how will that perturb the sequences.
CHAIRMAN APOSTOLAKIS: Exactly. And are
there any sequences of any consequence.
VICE CHAIRMAN BONACA: I really wonder,
however, if there is that document that will have all
this information. I think that this thing has evolved
through 40 years. I mean, we have plants that were
designed originally without ECCS systems.
So somebody evidently did not think that
you could have a break of a pipe of the size of that
size. And then somehow we began to think that there
was a realistic possibility.
And at some point when all this
information was developed and put together into a
document, where a true companion to all the
information and guide was developed, and I am not sure
that it was.
DR. POWERS: This is an element of
history. The people that did the thinking that, gee,
there could be a break in this system and it won't
work, was the ACRS.
VICE CHAIRMAN BONACA: I don't know where
it came from, but what I am saying is that I am not
sure it only came only from the NRC. I mean, the
industry was very active. I mean, the NRC standards
had the specific particularization of events and
postulation of those.
And there was a lot of interaction, and I
was just wondering if there was -- because there was
a document where all of these have been brought
together.
MR. CUNNINGHAM: I don't know of such a
document.
CHAIRMAN APOSTOLAKIS: I don't think there
is such a document.
DR. WALLIS: Well, there was a long set of
public hearings. I mean, there was the ECCS hearings
that went on for a long time, and as I remember it,
the view of some parts of industry and the AEC was
that this will never happen, and we don't have to
design for it. And there was all this public
hullabaloo when out of that came the ECCS criteria.
MR. CUNNINGHAM: Yes. I was speaking
slightly more generally. I am not aware of something
where you could look at all of the design basis
accidents and have that type of information available.
Again, part of our discussion in the
attachment to the June paper is here are from risk
analyses the important sequences that are associated
with ECCS.
And we have something like that that maps,
you know, in a sense of trying to get to the issue of
what does PRA tell you about the importance of ECCS as
a function and that sort of thing.
So that piece of it will be there, and
that is just scratching the surface of what you are
trying to get at.
DR. POWERS: And an importance measure for
ECCS.
VICE CHAIRMAN BONACA: Actually, that kind
of reflection took place very much in the early PRAs,
because that was factored in with the set of accidents
from Chapter 15, and then there was a lot of
discussion of are they covering the whole spectrum,
and what else should be there.
And there were different issues,
especially initiation of events from electrical faults
that were added that were not considered in Chapter
15.
So maybe then there was a lot of -- I
don't know. Maybe in some of the early PRAs there was
a discussion of that.
MR. CUNNINGHAM: But you are right. The
PRAs started with a set of -- on the books were
already a set of design basis accidents, and then we
moved beyond that.
But something like station blackout is --
I don't believe is a design basis accident, but we
have requirements to mitigate that.
CHAIRMAN APOSTOLAKIS: That came later in
the PRAs, right?
MR. CUNNINGHAM: I'm sorry?
CHAIRMAN APOSTOLAKIS: It is not the
design basis, but the rule came because of the PRAs,
right?
MR. CUNNINGHAM: Yes, but there is not a
Chapter 15 accident that is --
CHAIRMAN APOSTOLAKIS: How about the small
breaks? They are not a design basis?
MR. CUNNINGHAM: Yes, they are.
DR. FORD: Could I ask a question more for
my clarification? When you are looking at the
overview, and the thing that you showed before, when
you come down to the last box, the ECCS cooling
performance for number and sizes, and locations of the
breaks, that isn't a very plant specific, because
presumably it would be due to environmental
degradation, and the size, and the geometry of the
initiating defects in the pipe.
Is this something that is going to be
addressed later on this program? Am I way ahead of
the problem here?
MR. CUNNINGHAM: Okay. In this context,
basically it is -- well, the requirement is imposed in
a sense without the detailed analysis of what might be
the degradation mechanisms and that sort of thing. It
is that you have to have an ECCS that deals with the
biggest pipe break.
DR. FORD: So the question you are asking
is if I had this sort of geometry and disposition of
cracks, then this is what I would do. But when it
comes down to the practicality of a utility, or a
plant, coming to you, then could they not say, well,
we are never going to have -- the probability of my
having such a system of defects is very, very low.
And that would go into your probablistic
risk assessment, and you would come out with a very,
very low number. Is that a possibility for the
future, or is that ---
MR. CUNNINGHAM: Yes.
DR. WALLIS: And is that the way that you
are going --
MR. CUNNINGHAM: That's certainly from the
Westinghouse owners group and things like that, they
in a sense made an argument along those lines, or
started an argument along those lines.
And they said for our piping and this type
of thing, we are not -- we don't see a credible way to
get the large double-ended pipe break. They don't
think it is credible.
DR. KRESS: Except for the large double-
ended pipe break, that argument would tend to be plant
specific. If you are going to hone in on a specific
size, it makes the regulation very difficult it seems
to me.
MR. CUNNINGHAM: And we get into this, and
it might be vendor specific.
DR. KRESS: It might be vendor specific.
MR. CUNNINGHAM: Or something like that.
DR. FORD: Or operational specific.
MR. CUNNINGHAM: Yes, that's right, and
that is a lot of the -- if we were to try and back
away from the, if you will, somewhat artificial
distinction that it will be the largest pipe break,
and try to back off from that, you have to get into
these issues.
DR. FORD: So right now -- and I am just
trying to calibrate myself as to what we are
discussing here, you are talking about really a worst
case scenario?
MR. CUNNINGHAM: Yes, and the question
that we are trying to get to, or one of the questions
that we are trying to deal with is how can we -- is it
credible to back away from that worst case pipe break
history if you will, and do we have a technical basis
to back away from it.
DR. FORD: But that technical basis has
been something that we will discuss not today.
MR. CUNNINGHAM: Not today.
DR. WALLIS: And if you go back to the
history, you will find that the reason for this was
really not technical. It was all this hullabaloo in
public, and that this is what seemed to the public to
be the maximum credible scenario.
There is a lot of reason for that which is
not technical probably, and if you go back to the
history.
MR. CUNNINGHAM: I wanted to take the next
four slides or so and go back and talk a little more
about each of the four boxes that were on this slide
that we just showed.
In terms of the, if you will, the
reliability aspect of the ECCS or functionality --
CHAIRMAN APOSTOLAKIS: Did you do number
seven?
MR. CUNNINGHAM: This is number seven.
I'm sorry.
CHAIRMAN APOSTOLAKIS: Oh, okay. Sorry.
So the answer was no, you didn't do it?
MR. CUNNINGHAM: No, not yet. Turning to
slide seven, in terms of the elements of the ECCS
requirements that deal with reliability of the system,
again we are considering a risk-informed alternative
to 50.46, and would basically turn it into, if you
will, a true reliability requirement.
DR. KRESS: Now, Mark, are you viewing
this as the LOCA frequency times the ECCS liability
equates to core damage frequency?
MR. CUNNINGHAM: Yes, basically. The
underlying concept for the more performance based part
of this is that the frequency of the challenge and the
reliability of the ECCS has to be balanced if you
will, so that you have reached some acceptable value.
So that the lower of the frequency of the
initiator, the lower the requirements on the
reliability of the ECCS.
DR. KRESS: Now, this balance, is it going
to be conditioned to 10 to the minus 4 per year level?
MR. CUNNINGHAM: I'm sorry, 10 to the
minus 4?
MR. KURITZKY: We have not decided on that
level.
DR. KRESS: You have not decided on what
that level is?
MR. CUNNINGHAM: No. We think or we have
it in mind, and that will be the subject of other
discussions with the committee and things like that
later on as we get into more of the details of this.
It is really -- yes, there is a value that
we have in mind, 10 to the minus 4, or whatever.
MR. KURITZKY: One point is that we feel
that it should be derived from the framework. The
framework has quantitative guidelines and we feel that
whatever value we come up with should somehow be tied
to that framework.
DR. WALLIS: Well, this is a sort of a
one-by-one. You say that the large break is very
infrequent, and therefore the reliability or response
does not have to be so big.
But then the more sophisticated way is to
look at all spectrums of all breaks, and choose the
ECCS system so that there is some sort of integral of
a reliability frequency over all breaks is the best.
MR. CUNNINGHAM: Yes.
DR. WALLIS: And it may well be that
putting all the emphasis on the big break is very bad
for the optimization of the entire response.
MR. CUNNINGHAM: Yes.
DR. WALLIS: And that would be a really
good idea.
MR. CUNNINGHAM: Well, ideally, we would
have a well-defined frequency of a pipe break size,
versus frequency.
DR. WALLIS: And then we would match the
rotation as well.
CHAIRMAN APOSTOLAKIS: Can you really do
it so neatly?
MR. CUNNINGHAM: No.
CHAIRMAN APOSTOLAKIS: I mean, as you look
at the accident sequence, it seems to me that there
isn't such a thing as ECCS.
MR. CUNNINGHAM: That's part of it. In
effect, there is an ECCS function that covers many
things.
CHAIRMAN APOSTOLAKIS: Exactly.
MR. CUNNINGHAM: There is low pressure
injection, and high pressure injection, and things
like that. So you end up splitting this continuous
distribution if you will into probably ranges, and
that's probably more where we will end up.
And that is for the range of pipe sizes
between this and this, then you would have to have
commensurate reliability of this. And then break that
into however many pieces.
DR. KRESS: The reason that I threw out
this number of 10 to the minus 4 is because I was
hoping that you weren't going to use that, because
this is one little set of sequences among all of them,
and there is some other value that is more appropriate
than that.
MR. CUNNINGHAM: Yes, and it would not be
10 to the minus 4 for just the reasons that you are
talking about.
CHAIRMAN APOSTOLAKIS: Even though we
don't like to allocate, right? It may be a good idea
though to let Mark finish what he has to say on each
view graph.
MR. CUNNINGHAM: That could be.
CHAIRMAN APOSTOLAKIS: And then jump into
this.
MR. CUNNINGHAM: You may be right.
CHAIRMAN APOSTOLAKIS: Except for the
Chairman, of course. Shall we let him say what he has
to say? Go ahead.
DR. SHACK: We can try.
CHAIRMAN APOSTOLAKIS: We can try, yes.
MR. CUNNINGHAM: So, again, we are looking
now at two possible ways of getting at this
reliability issue. One is what I was just saying, is
that it is a fairly performance based oriented type of
thing, and it was to match the reliability to the
frequency of the challenge.
And then you get into traditional if you
will reliability analyses if you will of the systems.
CHAIRMAN APOSTOLAKIS: So the word
performance there means what?
MR. CUNNINGHAM: Performance in the sense
that -- well, non-prescriptive in one sense.
CHAIRMAN APOSTOLAKIS: But it is not in
the sense that we are using it in performance based
regulation, right?
MR. CUNNINGHAM: But it could be. One
other aspect of this possibly is that we recognize
that frequency of challenges -- our state of knowledge
if you will about the frequency of pipe breaks --
changes with time.
So that the performance or the
requirements on the reliability may change with time
also. So one aspect of a performance based type of
thing might be that you say they have to meet some
value, the product has to meet some value; and as one
changes with time, then the other may be able to
change with time also.
CHAIRMAN APOSTOLAKIS: My personal opinion
is that you need a better word. Performance based is
something else. I mean, you collect evidence, and --
DR. WALLIS: I like it in contrast to the
second alternative.
CHAIRMAN APOSTOLAKIS: Right. But some
other word would be better, such as reliability based,
or reliability -- well, something like that.
MR. CUNNINGHAM: Well, it is different
than what we had talked about in other contexts.
CHAIRMAN APOSTOLAKIS: Right, and we don't
want to start using words. We have already a problem
with nomenclature.
MR. CUNNINGHAM: Well, perhaps non-
prescriptive approach or something.
CHAIRMAN APOSTOLAKIS: Non-prescriptive
or risk oriented, not based.
MR. CUNNINGHAM: All right. The second
alternative that we are considering is more
prescriptive. It is to recognize that in one aspect
of this somewhat artificial way that we look at
reliability today, is that we recognize that for the
very large pipe breaks that there is the probability
of having this simultaneous loss of off-site power
that is a requirement, and could be a very low
probability.
And so the other option that we are
considering is in a sense for a set of pipe breaks
where we think we can argue that the simultaneous loss
of off-site power isn't credible, and you remove that
requirement for that set of pipe breaks.
But the rest of it still tends to look
like what is in the requirements today, with that
exception. It is more prescriptive, and it is a small
step towards ensuring towards a risk-informed
approach. But we are considering it as an option.
CHAIRMAN APOSTOLAKIS: What is functional
reliability? Is it the probability that it will do
its job?
MR. CUNNINGHAM: It's function, yes.
CHAIRMAN APOSTOLAKIS: Now, in the South
Texas exemption request, the word functionality is
used in that sense?
MR. CUNNINGHAM: I think so, yes.
CHAIRMAN APOSTOLAKIS: And so the
probability that it will do its job? I am not sure it
is the same meaning.
DR. WALLIS: I am not sure either.
CHAIRMAN APOSTOLAKIS: It is not the same
meaning. I think it is asking to make sure that the
thing will work, and is not asking about the
probability that it will do the job for a period of
time.
MR. CUNNINGHAM: Yes, but the term
functionality -- and like in South Texas or something,
that is a little bit different. Functionality is
different than functional, and again perhaps
functionality here is not the right word.
CHAIRMAN APOSTOLAKIS: Oh. I think in the
South Texas context --
DR. SIEBER: If it will work.
CHAIRMAN APOSTOLAKIS: -- all we want to
know if it will work, and if it can do the job.
Actually, that is really what they mean. That it can
do the job. Now, how reliability it will do it is a
different story.
DR. WALLIS: It could do the job if it
were reliable.
CHAIRMAN APOSTOLAKIS: I'm sorry?
DR. WALLIS: It could do the job if it
were reliable. It is contingent upon it being
reliable.
CHAIRMAN APOSTOLAKIS: But it can be
unreliable and still capable of doing it.
MR. CUNNINGHAM: Yes, even if it is
unreliable, it could have functionality.
CHAIRMAN APOSTOLAKIS: Yes, and so I think
that when it comes to the treatment requirements, and
that is what they are worried about.
MR. CUNNINGHAM: Okay. We are not there
yet, and we are using the word -- again, this is
probably functional reliability. That is a good
point. We don't want to confuse this with the context
of functionality. Yes, you are right.
So this is where we are today in terms of
the reliability aspect of it, and I think I heard the
committee, or a couple of the members anyway weren't
overly enthusiastic about this, and the more
prescriptive oriented.
DR. WALLIS: Well, you wanted some input
don't you and comments?
MR. CUNNINGHAM: Yes.
CHAIRMAN APOSTOLAKIS: So is anybody
offering any comments?
DR. KRESS: About what?
CHAIRMAN APOSTOLAKIS: What you prefer.
DR. KRESS: Well, I have a comment, but
not necessarily about that slide.
CHAIRMAN APOSTOLAKIS: Oh, okay.
DR. KRESS: But what it appears to me is
that we are at the heart of it, and what we are
beginning to embark on is allocating acceptable risk
among a subset of sequences without real
considerations of what the uncertainties are, and what
this does to the uncertainties.
And how or what the rigor of the
quantification of defense in depth is associated with.
I have some real concerns about the process, and as
you know, I have talked about this before.
CHAIRMAN APOSTOLAKIS: When I mentioned
the sequences, I included the uncertainties.
DR. KRESS: Oh, okay.
CHAIRMAN APOSTOLAKIS: You might say that
this requirement is here because the uncertainty of
the sequence is too large.
DR. KRESS: But we don't have a good
measure of what too large is, and a subset of
sequences, and so there is a lot of -- I mean, I am
not against this process, and I think it embarks on a
method that we can learn a lot from. But I think
there is --
CHAIRMAN APOSTOLAKIS: I will give you an
example. In some of the sequences, I am sure that the
redundancy of the system is defeated by human error.
But yet that is not a single failure, part of the
single failure criteria is it?
MR. CUNNINGHAM: No, it's not.
CHAIRMAN APOSTOLAKIS: Single failure
criteria refers to hardware?
MR. CUNNINGHAM: Yes.
CHAIRMAN APOSTOLAKIS: And so there you
have it.
MR. CUNNINGHAM: Certain aspects of
hardware, too.
CHAIRMAN APOSTOLAKIS: Certain aspects of
hardware, exactly.
MR. CUNNINGHAM: That's right. Again, it
was an approximation to a reliability requirement, and
I think we could do a better job today.
CHAIRMAN APOSTOLAKIS: And that was
established 40 years ago or whatever.
MR. CUNNINGHAM: Yes.
CHAIRMAN APOSTOLAKIS: And the state of
knowledge was different than.
MR. CUNNINGHAM: Yes.
CHAIRMAN APOSTOLAKIS: So retaining the
single failure criteria doesn't sound like such a good
idea, unless you expound the definition.
MR. CUNNINGHAM: And that is a
possibility, too; is an intermediate step that is more
-- a little more current.
CHAIRMAN APOSTOLAKIS: I mean, I don't
know how much time you have because I know that 3 or
4 weeks is not a long time. If you could include some
of these thoughts regarding the sequences in your
report, that would be really very helpful.
And, you know, to speculate a little bit
on this when it was placed because at that time they
didn't have the benefit of sequences, but it is always
--
MR. CUNNINGHAM: The background document
that we will be providing was one of the attachments,
and it talks about some of the history of how the
requirements were established.
And it is looking at why are they as they
are, and then another piece is what does risk analysis
tell you about what the effect of those requirements
on the reliability.
CHAIRMAN APOSTOLAKIS: Are you going to
have any of those oldtimers reviewed that document,
people who were present when the ECCS hearings were
taking place?
DR. KRESS: Joe Murphy.
CHAIRMAN APOSTOLAKIS: Joe Murphy for
sure.
DR. POWERS: But he was so young at that
time that he --
CHAIRMAN APOSTOLAKIS: Yes, we are talking
about who were active in it, but are now retired.
DR. WALLIS: Well, Denny Ross was here
wasn't he?
MR. CUNNINGHAM: We have Dr. Wildben back
there who is very much involved in helping us look at
this issue, and he has been around a couple of years,
and has been through a number of these things. I
believe that he was involved in the ECCS requirements.
DR. POWERS: Please use the microphones.
CHAIRMAN APOSTOLAKIS: Okay. No comment.
MR. CUNNINGHAM: It is noted that Dr.
Wildben, who was involved in this, was around at all
of those times if you will.
CHAIRMAN APOSTOLAKIS: Okay. Good.
MR. KURITZKY: Mark, if I could make just
one point, is to make it clear that when we are
listing -- for instance, in this case, we have two
options under there. It is not that we are viewing it
necessarily as we are going either with one or the
other.
But that they would both go forward
possibly, and then the licensee could choose to do
either one.
MR. CUNNINGHAM: Or at this point again we
are at the point of feasibility, and we are going to
look in the further technical work that we are doing
after we have gone to the Commission, and we would be
investigating both of these options as to whether or
not they really make sense in terms of alternatives in
the rule.
CHAIRMAN APOSTOLAKIS: All right.
MR. CUNNINGHAM: Since I am running out of
time here fairly quickly, in the context of the
acceptance criterium, basically the goal if you will
is to revise the acceptance criteria such that the
ECCS performance during the course of the accident is
shown to maintain coolable core geometry.
So it is more of a fundamental thing of
getting to the issue of what is the point of 17
percent, and it really is not dealing with hydrogen,
and it is not dealing with that. It is a maintaining
a coolable core geometry.
CHAIRMAN APOSTOLAKIS: So this is a
functionality issue isn't it?
MR. CUNNINGHAM: Yes.
DR. WALLIS: We have to be careful there.
Almost any geometry is coolable eventually. I mean,
that is not a very good definition. Coolable without
the release of something, or put some constraint on
it. Eventually it is going to be cool, one way or
another.
MR. CUNNINGHAM: Yes, you're right.
DR. POWERS: This fascinates me. What do
you mean?
DR. WALLIS: Well, I mean to say that you
may well have a core geometry which is a terrible
mess, and which is still coolable. But it is not
coolable in a way that you would really like to see
happen.
DR. POWERS: I am still very confused. If
I put a bunch of core down on the bottom of the lower
plenum --
DR. WALLIS: It is coolable.
DR. POWERS: And it is coolable -- and I
don't imagine that it is coolable, but for a
hypothesis that it is coolable --
DR. WALLIS: Well, if it gets hot enough,
it will be cooled.
DR. POWERS: No, it won't. It will
penetrate the vessel.
DR. WALLIS: That's how it gets cool.
CHAIRMAN APOSTOLAKIS: We are going to run
out of time at 10 o'clock, and we have to stop this at
10 o'clock.
MR. CUNNINGHAM: So again in this case,
when we look at this issue of --
DR. WALLIS: Maybe we don't need to stop
at 10 o'clock.
MR. CUNNINGHAM: In this issue of the
acceptance criteria, we are considering a more
performance oriented one, which is that you show us by
test that the cladding integrity is maintained, and so
that gets to this issue of is a rubble bed an
acceptable end point.
So we are being a little more specific
there that it is not. Again, you could be more
prescriptive, more like the current requirements, and
say I want to have or I am going to require through
evaluation a certain temperature and cladding
oxidation be maintained.
DR. KRESS: Mark, if they wanted to show
that the cladding integrity was maintained, they will
have to show that it is below a peak cladding
temperature and that the oxidation is below a certain
level.
MR. KURITZKY: Well, actually, the first
point we are talking about is actually like a
recompression test. It actually would do an actual
physical experimental test to show that the cladding
maintained some feasibility. It would be an
analytical type of test.
DR. SHACK: Just before the LOCA.
DR. KRESS: Yes. I don't think that
anybody is going to offer to do that are they?
MR. CUNNINGHAM: Again, today I think --
well, we will be back to you to talk to you about all
of these points as we proceed into the second phase of
the work.
So, again, this will give you a flavor of
where we are going, but it is not trying to give you
the answer of whether or not either of these makes --
well, the rationale behind either of these. We will be
back with you, I'm sure, in the near future.
DR. LEITCH: The long term cooling bullet
would be retained?
MR. KURITZKY: The long term cooling
bullet? It would be subsumed in the fact that now in
the wording that revised ECCS acceptance criteria,
such as the ECCS performance for the duration of the
accident, or some such words.
DR. LEITCH: So it alludes to some time
constant?
MR. KURITZKY: Yes.
MR. CUNNINGHAM: We are also considering
possible changes to the evaluation model, the thermal
hydraulic model as well. We are looking at again a
series of options in things that we are considering.
One is to replace the current requirement
on the decayed heat with the 1994 ANS standard. It is
a more recent standard, with some description of the
uncertainty that would go with that.
And that's in lieu of something where it
is an older decayed heat curve with a 20 percent
margin on top of it. So we think 20 percent may be
excessive, and we could put something in more
realistic.
Again, the option is in -- and in the
requirements, if they are acceptable today, is to use
a realistic model with uncertainty propagation, and
they can do that today, and in typical practice,
people don't, because of the complexity of it.
Another option that we are considering is
that for certain low frequency pipe breaks, we might
be able to relax the modeling requirements to get away
from the requirement for uncertainties, and say you
can do a best estimate for very low frequency
challenges.
In terms of the possible large break LOCA
redefinition, again the requirement on the books today
is that it has to be the largest pipe break in the
system.
One thing that we are considering is
changing the wording in the rule today so that you
could -- to open the door a little bit to say that it
is either that or some alternative that is deemed
acceptable by the commission.
In rule making that would introduce the
possibility of getting at the -- at perhaps the
Westinghouse issue of can we show you that the large
break LOCA, or that certain classes of breaks are not
credible.
This in rule space would allow you to
pursue that, and without having to go to another rule
change, permit that type of an analysis.
DR. POWERS: When Westinghouse says that
something is none, let me assure you something is not
credible. I mean, I am a very credible guy, credulous
guy. I mean, I can imagine lots of things. What is
the proof that something is not credible?
MR. CUNNINGHAM: This comes in a sense to
the next slide, which is in --
DR. WALLIS: I don't think anything is
incredible. You have to define it in terms of
probability.
MR. CUNNINGHAM: Well, what I just showed
you before would allow from a rule standpoint some
flexibility in what the staff could approve and what
licensees could use.
This is a summary of what was provided at
the subcommittee meeting a month or two ago on what
would have to be the technical justification, or some
of the technical issues that would have to be
addressed in order to demonstrate credibility or
incredibility if you will.
DR. POWERS: Again, Mark, could this be
done without the reg guide that defines this, and
leave that open, or you would really envision that
this change couldn't be made until you were ready to
issue a reg guide?
MR. CUNNINGHAM: Since we have today, that
change could be made to the requirement as part of the
rule making without a reg guide. I think that is the
sense that we have.
The reg guide could at least conceptually,
if we deal with these issues, then you could deal with
that, and you don't have to go back and change the
rule.
There are a lot of practical problems that
would have to be dealt with in the course of that, but
we don't think that we would necessarily have to have
the reg guide when we made that wording change in the
rule.
DR. POWERS: I am still struggling with
what makes something incredible. You have up on your
slide in service experience. Well, we have not had a
whole lot of large pipe breaks, and so that certainly
is not a fertile field to mine there.
I mean, we have got a few cracks in them,
and maybe that is a more fertile field than I think.
And analyses, I am very confident that within obscure
computer codes and things like that, that you can
generate frequencies that are small.
But does it mean that I have to show that
never in the history of pipes in this world be a pipe
of this sized break?
MR. CUNNINGHAM: No, I don't think so. We
consider vessel rupture in regulatory space as an
incredible event, in the sense that it is not of
sufficiently low frequency that we do not have to
require ECCS to mitigate that type of failure.
That is not to suggest that there has
never been vessels of that type that have failed or
not failed in world history if you will. But it is a
combination of -- that in a sense, and perhaps
implicitly, it becomes a sense that the probability of
such a failure is low or very low, and that the
confidence or the uncertainty in that probability is
small enough that you can have confidence that it is
not going to happen.
DR. POWERS: I am going to keep asking
because I am still struggling with this. Okay. When
these guys do these calculations, they usually
hypothesize about lipsoidal cracks and certain aspect
ratio, and what not.
Of course, there are no cracks that look
at all like that are hypothesized in the computer
codes. So there is a lot of uncertainty here and what
not.
What kind of percentile of a conceivable
distribution do they have to get to, to say okay, it
is incredible here?
MR. CUNNINGHAM: I don't know that I have
a good answer for that, because I think that at some
point it becomes that quantitative information leads
to a qualitative judgment that it is close enough.
DR. POWERS: Well, presumably it has to be
on the order of what you accept for a pressure vessel?
MR. CUNNINGHAM: Oh, yes, from that sense,
we accept certain things, and --
CHAIRMAN APOSTOLAKIS: What is that, 10 to
the minus 6?
DR. POWERS: Well, we are still debating
that, but on that order.
MR. CUNNINGHAM: Yes, on that order, and
in the PTS space, you say if the risk associated with
a PTS induced vessel rupture is 5 times to the minus
6 or less, it is acceptable.
DR. KRESS: But that doesn't seem like a
good choice to me, and I will tell you why. The
consequences of a pressure vessel rupture are surely
much greater than the consequences of this pipe
breaking.
DR. POWERS: That's right, but they will
never say that. I mean, I know this PMF guys. They
come along and they will say okay, the nominal
probability for a single crack is 3 times 10 to the
minus 45th, or something like that. I mean, they come
up with very low numbers for this sort of thing.
And they will say, yeah, but there is the
possibility that cracks will interlink and things like
that, and I don't know how to deal with that. So it
could be a higher probability, and they will pick a
number like 10 to the minus 5th, and it could be up
that high.
And what Mark is saying is that there has
to be some confidence limit with that, and I am trying
to find out what the confidence limit has to be. Does
it have to be 99 percent confident that the
probability is 10 to the minus 6th or lower? Or does
it have to be 95 percent, or 80 percent, or --
DR. KRESS: Yes, I have wrestled with that
question on other issues.
DR. POWERS: I know you have.
DR. KRESS: And there is no clear
technical way to arrive at the confidence level unless
one goes to the utility function, which is not exactly
technically arrivable at.
DR. POWERS: Well, right now I am on a
very specific thing. What if Westinghouse said that
it takes to show something this is incredible? I am
very credulous. I mean, I can believe lots of things.
I even believe in 10 to the minus 45th for cracking in
BWR welds.
DR. LEITCH: Aren't we really saying then
that anything above this alternate size, if there was
some alternate size approved, that anything above that
is going to lead to core damage?
MR. CUNNINGHAM: It could be that or it
could be that anything above that size does not have
an ECCS system that has to meet the requirements of
50.46, although there may still be some mitigative
capability in the plant, but not safety related if you
will. There are several alternatives for that.
DR. KRESS: Anything above that alternate
size contributes a contribution to the CDF at a
probability or confidence level that is unacceptable,
or that is acceptable.
So you have a confidence level that the
contribution to CDF of any pipe above that is
acceptable, and none of those things have been
rigorously defined to my knowledge what the confidence
level is, or what is an unacceptable contribution to
CDF for a subset of sequences.
But that is their problem, and they have
to wrestle with something like that. I think that is
the basic concept.
MR. CUNNINGHAM: Again, there will be
other opportunities, and we will be back before the
subcommittee or the full committee to talk about all
of these issues that we are wrestling with here as
time progresses and as the rule making proceeds.
DR. LEITCH: Before although there you say
that the ECCS systems exist and no one is going to
tear out ECCS systems, yet some of the testing
criteria -- I mean, what will go along if this is
approved, and then people will start to ask for a
relaxation on testing criteria out of service time,
and diesel, and all those kinds of things.
MR. CUNNINGHAM: Yes.
DR. LEITCH: And they would no longer be
able to demonstrate to the same degree that we can
now.
MR. CUNNINGHAM: And clearly we see that
as one outcome, is that there could be relaxation in
the text specs and that sort of thing as an outcome,
and again using risk information that would suggest
that that could be justified without having a
substantial increase in risk or anything like that, at
least for the large breaks and things like that.
And to some degree there is an element
from risk analysis that would tell you that there is
some degree of over design of the ECCS for the very
largest breaks. Mr. Chairman, it is 10 minutes till.
Did you --
CHAIRMAN APOSTOLAKIS: Keep going.
MR. CUNNINGHAM: Okay. Just to give you
an idea of what things we think will be coming back to
the committee to talk about over or during this second
phase of our work, assuming that the Commission tells
us to proceed, we have hit on a number of these.
Such as developing the method and dealing
with, for example, on how you deal with uncertainties
on ensuring the reliability requirements match the
frequency of the challenge.
And the LOCA frequency versus size
information; and the resolution to what degree we can
either eliminate or modify the current large break
LOCA basis accident given the industry's interest in
that.
Again, the technical basis for some of the
changes to the evaluation methods, and what would a
new decay heat curve look like and that sort of thing.
And then this issue that we talked about
earlier of the technical basis, and saying what is an
acceptable post-quench ductility, and what does that
really mean. I think we would anticipate coming back
to the committee on all of those issues.
DR. FORD: I have a question on the first
bullet in engineering. There is going to be a time
dependence to that statement?
MR. CUNNINGHAM: Yes.
DR. FORD: What is your timing on all of
this, and who is going to do all this work? You have
got two problems with that particular bullet. One is
the information necessary, the factual information on
the time dependence of the development of the flaws.
MR. CUNNINGHAM: Yes.
DR. FORD: This is a very large
engineering topic. Another one is how you apply time
dependence to PRA, which I understand is not done
here; is that correct? There are two major problems
there; time and effort. Is there a limit to that, or
should we even be discussing this?
MR. CUNNINGHAM: Well, again, in the
concept of how you build time dependence and aging
effects and things into PRAs, we have done some first
steps, some good first steps along the way in that
regard.
In terms of the frequency versus size
information, I think we need to be able to -- in this
context is it sufficient to be able to deal with the
reliability requirements on the current ECCS systems.
So I think in this case be able to have a
fairly crude approximation of this, and still get
something that is satisfactory for being able to set
the reliability requirements.
So I think at least in my mind that it is
achievable, because we can be fairly crude in what we
are doing. The people that we have talked developing
a fairly good curve of this if you will, and that is
years worth of work.
And I think we can do less than that and
get an acceptable answer for what we are trying to
accomplish on the reliability requirements. On the
second part of it, the resolution of whether or not
the large break LOCA definition could be -- the DBA
could be eliminated, there is a lot of work.
And again at this point, we are going to
be interacting with the industry to see if we can get
some agreement on what the extent of that work would
be.
DR. POWERS: Mark, why is it that you want
to remake the reliability requirements commensurate
with the challenge frequencies, and not the product of
challenge frequencies and the consequences of failure
to meet that challenge?
MR. CUNNINGHAM: The interest in -- to me,
I would say that those would be the same thing. That
you would end up with a product that is fairly -- of
the two that is fairly consistent across the spectrum
of break sizes.
DR. POWERS: So what you are saying is
that the consequences are all the same?
MR. CUNNINGHAM: In this case, we are kind
of defining it so that the reliability of ensuring
that a certain consequence isn't achieved, or that the
reliability for ensuring that adequate coolable
geometry or that type of thing.
CHAIRMAN APOSTOLAKIS: You could look at
the spectrum of planned damage space that the PRAs
define and see which ones would be effective by these.
MR. CUNNINGHAM: Yes.
CHAIRMAN APOSTOLAKIS: And work with the
frequency of those, rather than the total --
MR. CUNNINGHAM: Yes, and we talked --
when we talked about this today, we talked about it in
terms of CDM, but containment performance is still --
we are going to deal with both.
The policy issues that we expect to see in
the paper, one is that we are attacking, if you will
the issue of the single failure criteria, and here in
the context of the ECCS requirements.
A single failure criterion applies to
other parts of the requirements as well. One is that
we are considering putting in a recommendation in the
paper that would ask the commission's approval to
proceed to identify where else in the requirements of
Part 50 that we would take on this reliability concept
if you will, or attack the single failure criterion.
DR. POWERS: The ECCS really has a two
failure requirement criterion; is that right?
MR. CUNNINGHAM: I'm sorry, but I didn't
hear the question.
DR. POWERS: The ECCS really has a two
failure requirement?
MR. CUNNINGHAM: Yes.
DR. POWERS: There is a power requirement
and the failure of any other system?
MR. CUNNINGHAM: Yes, that's right, and so
we would be revisiting the combination of those
things. Another policy issue is in the context of
selective implementation.
We have talked about this in the context
of 50.44, and the same issue applies here, of whether
or not if somebody wants to use this risk-informed
alternative, whether or not they can pick and choose
within the risk-informed alternative, like 50.44 would
be.
And in 50.44, we recommended it, and the
commission approved it, that there not be selective
implementation within a rule.
CHAIRMAN APOSTOLAKIS: Right.
MR. CUNNINGHAM: And just quickly here
again, we owe you a copy of the commission paper here
towards the end of this month, and we would like to
come back to you in July, and --
VICE CHAIRMAN BONACA: How big is that?
MR. CUNNINGHAM: The paper itself is going
to be less than 10 pages. There will be 4 or 5
attachments. One of them will be --
MR. KURITZKY: It will probably be
comparable with the 50.44 report.
CHAIRMAN APOSTOLAKIS: So how can we
review it?
DR. POWERS: Read very quickly. Actually,
we have got lots of time, George, because July 4th is
a holiday. Dr. Shack, do you think we can review that
in time to write a letter?
DR. SHACK: We have to see it when it
arrives.
CHAIRMAN APOSTOLAKIS: And assuming it
arrives on the 29th of June.
DR. WALLIS: You can take it to Waterford
with you and read it.
CHAIRMAN APOSTOLAKIS: And if we don't do
it in July, it has to go to September. Do you expect
the commission to take action from these -- I mean,
sometime soon, or --
MR. CUNNINGHAM: It is hard to tell. It
is hard to tell.
CHAIRMAN APOSTOLAKIS: It is going to be
very hard for us to write a letter I think.
MR. CUNNINGHAM: Well, we owe the paper to
the EDO like on the 23rd of something like that. So,
maybe we can get it to you in that same time frame.
Obviously, we would be interested in
getting a letter in July, and if it can't be done, it
can't be done. That is the committee's call
obviously.
CHAIRMAN APOSTOLAKIS: No, I mean, the
point is if we write it in September and the
Commission has already decided on whatever you ask
them to decide, then it doesn't make sense. Are there
any more questions or comments from the members?
DR. LEITCH: Mark, just a question as to
the total scheme of things here, and one of the things
that you said was that special treatment requirements
may be a follow along situation.
So we are looking at later on in our
agenda today, we are looking at South Texas with
respect to option two, which is really an exemption
from special treatment requirements. But further down
the road there may be a redefinition.
MR. CUNNINGHAM: Yes.
DR. LEITCH: I mean, we are putting a lot
of if's, and's, and maybe's in there, but what is in
our embryonic thinking here is that maybe rather than
seeking exemption from special treatment that special
treatment requirements could be changed.
MR. CUNNINGHAM: The option two work is
looking at the scope of special treatment
requirements, and that is obviously what you are going
to be hearing about today with Southern Texas and
others.
The longer term effort is getting at what
should be the environmental over qualification
requirements for the equipment that is subject to
special treatment requirements, and that sort of
thing.
But for the near future, our resources are
going to be principally focused on 50.44 and 50.46.
DR. LEITCH: I understand.
MR. CUNNINGHAM: So I wouldn't expect that
we are going to -- at least with the present
situation, in terms of funding and things like that,
I wouldn't expect that we would have an ability to
deal with the special treatment requirements in the
near future.
But the goal, long term, is to go back and
revisit what should the requirements be.
DR. LEITCH: Okay. Thank you.
MR. CUNNINGHAM: But it is a long term
goal.
DR. LEITCH: I understand.
DR. SHACK: We are running over schedule.
So, Adrian, and we will have the industry perspective.
MR. HAYMER: Good morning. My name is
Adrian Haymer, and I am with NEI, and I am a program
manager working for the Risk Informed Regulatory
Group.
Tony Pietrangelo is the director, is our
director of the Risk Informed Regulatory
Group, and Bob Osterrieder is the project leader at
Westinghouse, dealing with option three and redefining
large break LOCO.
And what we would like to do today is just
to give you some feedback on where we think we are on
50.46, and risk informed regulation, or the technical
requirements in general.
Because we have had some discussion with
the staff, and we have been meeting with the staff now
for -- certainly for 18 months or so, and discussing
option three.
In January of 2000, we sent a letter
saying where we need to focus our efforts in regard to
option three to the Commission, and I think we have
been consistent in our message, and we would like to
go forward and take a look at redefining the large
break LOCA activity.
And when we met I think a few months ago,
we had some discussions with you on that, and our
thought process has evolved a little bit, and perhaps
we need to make some clarifications in that regard.
But I guess our approach on 50.46 and
redefining the large break LOCA is what we might term
a graded approach, and I think some of the statements
that the staff made about their proposed language rule
is along the lines that we were thinking.
In other words, you would go forward as a
first step with taking a look at the co-incident loss
of off-site power, and defining a break size that goes
along with that.
So where they said there were two options,
we would blend those into one, and you would then get
a break size. But you would still have a commitment
or the ability to mitigate the large break.
But it wouldn't be the full design basis,
Appendix B, type requirements, but you would still
have to show the ability to mitigate the large break
or the largest break in the plant.
And the language that we think in the rule
would be very similar to what the staff mentioned a
few minutes ago. Tony.
MR. PIETRANGELO: Yes, I think that
summarizes it pretty well. We think you can treat the
double ended guillotine break more like you treat
things in severe accident management space than as a
design basis requirement that it currently is.
That double ended guillotine break
assumption drives many of the other regulatory
requirements in Part 50. That is a very, very
conservative assumption. And we see this first rule
making with 50.46 as really an enabling condition to
be able to go forward, and then take a more realistic
break size first for eliminating the coincident with
loop and single failure that is currently in the
regulations.
That would be the focus of the first rule
making. But once you have a redefined large break
LOCA, that assumption is used in many other
applications within the scheme of regulations, and we
can't possibly know all the impacts in the first
ruling making of taking a reduced large break LOCA
size.
But the point is that you can't make
changes to those other regulations based on the new
assumption without NRC approval in each of those
applications like we do via Reg Guide 1174 on risk
informed applications.
So this first one is really an enabling
rule. There will be a lot of effort to look at the
analysis and come up with a new break size will
probably be different for each NSSS reactor design.
But once that is done that really sets up
a very methodical comprehensive phased-in approach for
taking that assumption, and promulgating it through
the rest of the regulations, with tremendous benefits
in terms of the focus on safety and operational
benefits to the licensees, in terms of operating
margin and burden reduction and cost effectiveness.
And so we think that this is probably the
biggest fish in Part 50 to go after. I think we have
been consistent as an industry stating that since the
letter went in in January of last year.
We are anxious to get on with that, and
the Westinghouse owner's group, and Bob will speak to
you about that in a moment, and they have already done
an extensive amount of work looking at the analysis to
get down to that reduced break size. But we think
that this is a very important effort.
MR. HAYMER: And I think with had a
question about what comes next, and I think when you
take a look at 50.46 and some of the activities that
we think would flow from what we have discussed, and
what the staff has discussed in regards to defining a
large break LOCA coincident with loss of off-site
power and single failure, when you see what flows from
that -- and we have given a list of those areas that
we think would be amenable to further review once we
have done this first step, that is a very large amount
of work.
And I think once we have gone through
that, we might then think about going back, but I
think we are talking about a fair way down the road as
regards those activities.
So that is where we see it at the moment.
The only other point that I would make is that we have
given consideration that if this is beginning to take
some time that we should think about breaking off the
decay heat requirement into perhaps a separate rule.
And that is something that we will look at
and then decide what needs to be done with regard to
that. Bob, did you want to say something?
MR. OSTERRIEDER: Yes, just a couple of
comments. The question was brought up, you know,
what does Westinghouse or the industry feel is a good
limit on CDF or LRF, or defining what is incredible,
and we certainly don't want to define what is
incredible.
But I do want to comment that first of all
the issue of the probability of these breaks occurring
is a key issue, and there is two areas here that we
need to get on with in interacting with the NRC.
That is, the estimates of the LOCA
frequency, and how they are obtained in this curve of
frequency versus break size, and about what there has
been a bunch of discussion here. That is the first
piece.
And the second piece is related, and that
is the technical justification related to the
frequency and what is enough rigor in the
calculations.
We feel -- there has been a lot of
comments here that this is a big wide open area that
is going to take a lot of work, and what we feel is
that we need to get some of these pinned down pretty
quickly so that we can decide if this work is worth
doing.
We think that we can get together and I
think somebody already mentioned that we are working
on setting up a meeting with the staff to talk about
some of these issues, and that is the next technical
meeting that we have to schedule.
And we need to get that scheduled, but
those key issues, we need to in our opinion work on
those quickly in the near term, and decide what do we
have to consider in these curves, and what are the
issues that have to be resolved.
And that's because right now it continues
to be an open-ended high level, and there is more
rigor required here, but we need to pin down what this
rigor is on these probabilities and on the -- if we
are going to use leak before break or something to
justify the specific size which relates to that curve,
we need to get those issues down on paper as to what
they are so we can decide how to deal with them, and
whether or not they are too extensive to deal with.
And I guess that is a key point, and for
us it is a key item for moving forward. We need to
get into some of that in the near term and get that
pinned down further.
DR. WALLIS: I am intrigued by your
statement that you might need more rigor on the
probabilities. Maybe you need more rigor on the
effect of modal uncertainties.
MR. OSTERRIEDER: Well, that --
DR. WALLIS: And maybe eventually after a
decade, somebody is going to look at some aspect of
the codes that affect the probabilities.
MR. OSTERRIEDER: Well, the rigor again,
and when we presented our basis, and what high level
technical basis, we were told that we would need more
rigor in that area, and that is why I was focusing on
that area.
DR. WALLIS: Well, I am saying it is not
just probabilities, but it is the things that affect
the probabilities.
MR. OSTERRIEDER: That's correct.
DR. WALLIS: And it will always have an
effect on success and all that kind of stuff, and it
is all tied together.
MR. OSTERRIEDER: Right. But we are not
focusing on changing the acceptance criteria of the
codes, or the methods in the codes. And again when we
started the program, we were looking at the rigor that
was applied in GDC-4 and the ISI programs as being
sufficient.
It has been brought up that the staff
feels that that is not sufficient, and we need to talk
in more detail. There were some details brought
forward at the March 16th subcommittee meetings, and
we need to meet, and we hope to cover some of that in
our next technical meeting.
Also, as to more specifics about why that
is so different, and what is the basis of some of
that.
MR. HAYMER: While we are pulling on from
that topic as we go on schedule, I think the industry
is very interested in getting down and looking at some
of the detailed work that the staff plans to do and
see what we can do or have done to address those
issues.
And working together, we can move it
forward, but we have got to get a better understanding
of what we are looking at from a technical perspective
so that we can move forward on this regulation.
And that brings into mind the overall
schedule of option three, and when we started this
activity, we said 50.44 and 50.46, and the reason that
we selected 50.44 is that we thought it was going to
be fairly straightforward.
And in truth the staff moved very quickly.
There were recommendations made last September and the
Commission directed the staff to move forward with an
expedited rule making in January.
And things have seemed to have gone
silent, and now we hear that the only thing that has
been sent up is a plan, and we don't know what that
is, and we have been working on this now, for Option
3, for 18 months.
We probably are not going to have anything
to show the industry for at least another two years,
and that is beginning to concern some people.
MR. PIETRANGELO: Adrian is right and it
is frustrating from our standpoint, because 50.44, the
reason that it was selected was that it has benefited
the licensees and there are things that we do with the
plant with the recombiners and monitoring it that make
no sense from a safety standpoint.
And really that has been a belief since
about the late 1980s when this regulation was looked
at under the Marginal Safety Program. It was one of
the three final regulations that were looked at as
part of that program, and the only regulation that did
get changed was Appendix J for integrated leak rate
testing.
And then San Onofre went through an
exemption request on recombiners and on combustible
gas control, and after a 2 to 3 year review by NRR,
they finally got their exemption request in 1999.
We thought that was going to be the
principal basis for the 50.44 rule making. Yet, there
has been a lot of other things that have been brought
into play on 50.44 on certain containment types, and
I won't go into great detail here.
But we had something that already had a
technical basis, and was applicable to about 95
percent of the industry. But I think the kind of
business as usual approach to this says that we have
to make this rule perfect, and apply to everybody
equally, and make sure that is all dealt with in this
one rule making.
And as a result, I think you are seeing
the schedule dragged out on this for additional
technical basis for these other containment types, and
new gas source terms, and all the rest.
While the principal benefit of this for
the vast majority of the industry is kind of sitting
there, you have three exemption requests sitting in
NRR waiting to be reviewed, and others that probably
would be submitted if they knew that this rule making
was going to take so long.
So I think there has got to be a new
mindset when we look at these improvements via Option
3, especially when we get to something as complex as
50.46. When you see something that has benefit, and
is fairly straightforward, you need to take it.
There may be additional work done later on
to look at other aspects, but it should not preclude
or at a minimum slow down to this extent the progress
in making the regulations more risk informed.
That is our real message on this, because
on 50.46, if you wait until you know everything that
might ever happen when you go to a redefinition of
hard break LOCA, we will never finish this. We will
never finish.
DR. WALLIS: I am trying to disentangle
this. You are complaining about the way 50.44 was
handled?
MR. PIETRANGELO: Right.
DR. WALLIS: And you are extrapolating
this to 50.46, but what I think I detect is that you
realize that you have to do a lot of work on 50.46,
and that is sort of reducing the enthusiasm a little
here?
MR. PIETRANGELO: No, I think that's why
Adrian said there is a piece of decay heat --
DR. WALLIS: Decay heat may be handable,
but all these other things that we heard about this
morning are not trivial. You have to produce a really
good piece.
MR. HAYMER: Yes, and we agree that we are
willing to sit down and produce that, but --
DR. WALLIS: Well, that is what you said
last time.
MR. HAYMER: Yes, and we are willing to
work with the staff, and we are setting up meetings.
But our concern is that if you see the way that 50.44
has gone, and then if you say that is how we are going
to go in 50.46, with the amount of work that is
involved, that is going to be -- are we really going
to get there.
And picking up on Bob's point a few
moments ago, that's why we think it is important to
sit down with the staff and get a better
understanding, because we think we have the basis to
move forward with the case, and they had a plan laid
out of when certain work product would be produced,
and given to the staff so they could sit down.
Now, the staff has come back and said that
we need more rigor, and now we are trying to find out,
well, we have got a program that Westinghouse and
others are working on, and it is meant to produce
these products in this period of time.
And now we are saying there is more rigor
and now what does that mean, and it is important that
we sit down soon and discuss what those are so that we
can work on that.
MR. OSTERRIEDER: Right, and we are not
afraid of the new work, or the work that needs to be
done. What we need to do is to get it defined so that
we understand it.
If it is such a massive effort, then like
any other business decision, you have to decide if it
is worthwhile. But my main point is that we need to
sit down and define the issues that we are talking
about, and what is additional rigor, and what is an
acceptable curve of frequency versus break size to
support the PRA aspects.
We need to sit down and move on with that
so that we can decide what the work is that we have to
do, because we have been talking too long and we need
more rigor.
And we keep saying there are a lot of
issues and there are, but we haven't --
DR. WALLIS: Well, it seems to me first of
all that you need to have a case which is persuasive
to you.
MR. OSTERRIEDER: Yes.
DR. WALLIS: And then it might be
persuasive to somebody else, and waiting for the staff
to tell you what that case has to be isn't really
going to achieve very much.
MR. OSTERRIEDER: Well, we believe that we
have a case, and what we are being told is that it is
not sufficient, and what we are trying to get from the
staff is please help us understand what is not
sufficient about it other than --
DR. WALLIS: But you remind me of the
student that keeps telling his professor to tell me
what should be in my thesis, and the professor says,
well, you know, it is up to you to figure that out.
MR. HAYMER: Well, they have a series of
work products, and a plant to develop those work
products. Now we are told that we have to be even
more rigor than that, and we are saying okay, what
more do we have to do beyond this.
CHAIRMAN APOSTOLAKIS: Is the report that
you guys are preparing for the end of June going to
answer some of these questions?
MR. KURITZKY: The report at the end of
June is going to discuss the technical issues that we
believe need to be resolved in order to proceed with
the large break LOCA redefinition, and I believe as I
said earlier that the staff has agreed to meet with
the industry to talk in technical terms about the
issues that have been raised.
CHAIRMAN APOSTOLAKIS: Okay.
MR. OSTERRIEDER: The only other comment
on the amount of work is we are concerned a little bit
that we are looking at such a wide variety of options
here -- the acceptance criteria, and the different
pieces here that we have looked at, because each of
these in themselves could be a lot of work and to do
the acceptance criteria.
And our feeling was that we should focus
on these issues related to redefinition to define
them, and get on with that first, versus having little
resources to have the meetings with us and to define
this, and do some work because there are so many
initiatives going on.
And these initiatives and to do all of
this would take many, many years we believe.
MR. PIETRANGELO: And the other factor
that was not on the table maybe in some of the earlier
meetings on this was -- I think there was some
miscommunication, or we weren't on the same page with
regard to the remaining mitigation capability for the
double ended guillotine break.
I think the perception was that there
wasn't going to be mitigation capability left for
that, and so that the approach has changed. We do
want to maintain mitigation capability, even for the
double ended guillotine break.
But the point is that that can't be the
design basis assumption that drives the rest of the
other regulations where that assumption is invoked.
And there needs to be more talk about, well, what does
that mitigation capability have to be, and what is the
acceptance criteria for that.
Is it the same as the ones for 50.46, or
do you keep core damage frequency below some number?
So there is a lot of details to be worked out, but you
can only have one design basis on a system. You can't
have that this is the more likely one, and this is the
less likely design basis.
That won't work in the current regulatory
framework. So there are issues that have to be worked
out, but I think you have another factor there that
can play on rigor.
If you have remaining mitigation
capability for the double ended guillotine break, how
much more rigor do you need to demonstrate to produce
break size that is going to be the design basis.
So there is kind of a scale there that you
can use to make yourself comfortable that there is
assurance that you can handle those situations.
DR. WALLIS: I still get the impression
that there is technical work needed on both sides, and
that is what has to be done, and just arguing about it
is not going to resolve the positions.
MR. PIETRANGELO: I think part of the
reason this was selected was that you are building on
things that have already been done -- leak before
break, and risk informed ISI work. That is all work
that can be brought to bear on this subject.
So we are not starting from scratch. We
have gotten things that have been accepted in the
regulatory process already, and that is a good
foundation to go after this additional work. So we
are not starting from scratch.
DR. SHACK: Any more questions?
(No audible response.)
CHAIRMAN APOSTOLAKIS: All right. Thank
you. I would like to also thank the staff for their
presentations. We will recess until 10:40.
(Whereupon, the meeting was recessed at
10:20 a.m., and resumed at 11:22 a.m.)
CHAIRMAN APOSTOLAKIS: The next item on
the agenda is the potential for margin reductions
associated with power uprates, and this is Dr. Wallis
and Dr. Bonaca.
DR. WALLIS: I would simply say that you
all know that we are interested in this issue, and you
all know Gus, and we are looking forward to what he
has to tell us.
CHAIRMAN APOSTOLAKIS: Dr. Bonaca. Okay,
Gus.
DR. CRONENBERG: This is basically a
status report on some work that I have been doing that
came out of the retreat. So I started this in March,
and I titled it, "Signature Estimates of Margin
Reductions," because I think we have bits and pieces
of information, and sort of sign posts, but it is not
the full story.
In the outline of my talk, I am going to
give you a little bit of how margins is used in the
regulatory process, and then I am going to give you
some estimates of what I was able to find for a case
study that I did for the Hatch plant.
Hatch had two prior power uprates and is
under present review for license renewal. So I will
do the power uprates, and then some estimates from
basically time limited aging analysis for the Hatch
plant, and then some preliminary findings.
DR. KRESS: Are those bullets little land
mines or what are they?
DR. CRONENBERG: They are something or
other.
DR. LEITCH: Gus, the status report that
we got, is that what you are referring to, or is that
-- I guess what I am saying is some of the chapters
here seem to be not aligned with --
DR. CRONENBERG: Yes. That is just a
draft of --
DR. LEITCH: It is just a draft?
DR. CRONENBERG: Yes, the end product is
in September, and I want to give you a final report on
this study, and that is just where I am on what I have
to date. It is a little disjointed, but I just wanted
to show you where I am going.
And so that report will be in a final form
in September when I intend to wrap this project up.
DR. LEITCH: Okay. Off-line then, I will
give you a couple of comments here after just reading
through this.
DR. CRONENBERG: That's fine.
DR. LEITCH: Editorial type of things.
DR. CRONENBERG: Yes, okay. And then you
also have in your notebook like a four page summary of
what we did and where we are at. Okay. Margins, from
Webster, are as spare amount allowed for contingencies
or another definition of bare minimum below which
something is no longer desirable.
DR. WALLIS: It's marginally, you mean?
You mean marginal performance on a test or something
like that?
DR. CRONENBERG: Yes. Well, you
understand.
DR. WALLIS: Well, you go to Webster, and
in fact the agency doesn't define what it means by
margin.
DR. CRONENBERG: Margin is used in a
rather general sense, and what I did was go to the
general design criteria and just try to give you
examples of how margin is used in the general design
criteria.
And then actually you have to go to
regulatory guidance, and you have to go to ASME
pressure and pressure vessel, or code, or American
Institute of Standards type of thing to really look at
margin.
For example, Criterion 10. It says that
the reactor core and the associated cooling control
and protection systems shall be designed with
sufficient margin to assure acceptable design limits
shall not be exceeded.
Well, Graham, you might say, well, that
doesn't tell me anything, and it might be the kind of
thing that we would expect from Graham. This exactly
how -- and it goes on and on. They are all like that.
Criterion 31, the reactor coolant pressure
boundary shall be designed with sufficient margin,
blah, blah, blah, so that it behaves in a non-brittle
manner. Again, it doesn't tell you. You have to go
a step further, and that is coming in the next few
slides.
Criterion 50, the containment. Now, not
only the primary system, but the containment,
including openings, penetration, shall be designed
without exceeding a design leakage rate, and with
sufficient margin to reflect metal, water, and
chemical reactions.
DR. WALLIS: Doesn't sufficient margin
relate to uncertainty in all of these things?
CHAIRMAN APOSTOLAKIS: Yes. Sure.
DR. WALLIS: It is tied in with
uncertainty, but that connection isn't explicitly
made.
DR. CRONENBERG: These are general design
criteria.
DR. POWERS: I think you would end up with
confusion if it made that tie, because the margins are
there for the things that are not included in the
analyses that are typically done.
CHAIRMAN APOSTOLAKIS: Not necessarily.
If you are uncertain about something, you don't know
what the value would be.
DR. POWERS: These are Chapter 15
analyses, George.
CHAIRMAN APOSTOLAKIS: Oh, oh, okay.
Thank you.
DR. POWERS: And there are things that you
may not know.
CHAIRMAN APOSTOLAKIS: That is what it
should be, yes.
DR. POWERS: And that nobody thought of,
and so those margins are things that are not taken
into account.
CHAIRMAN APOSTOLAKIS: But how can you do
that?
DR. WALLIS: Then this is just a gut
feeling then, and if you don't know what they are,
then you can't assess them. You have to make some
sort of a guess as to what they are.
DR. POWERS: You've got it.
DR. WALLIS: And so margins are just
guesses about how unsure you might be.
DR. CRONENBERG: Well, for example, it
will say that you can't exceed -- that a pipe can't
exceed a design pressure of a thousand psi. The
licensee will come and say my LOCA now shows that this
steamline for design basis accident gets to 950 psi.
I have a 50 psi margin.
The licensee will say that to me is
sufficient margin to meet --
DR. WALLIS: But your uncertainty in your
prediction is plus or minus a hundred, and therefore
I am not going to --
VICE CHAIRMAN BONACA: They would come
back and say that we have built in considerations for
uncertainties for the conservatism. Now, to negotiate
whether those conservatism would in part account for
uncertainty or not.
DR. WALLIS: Well, you can't be so wishy-
washy about it.
DR. POWERS: Graham, in no case would you
come in and say the uncertainty in your calculations
here is plus or minus anything. You would always be
that your uncertainty in this is plus X, minus
nothing, because they are conservative calculations.
DR. CRONENBERG: Okay. That's -- we are
going top down. It starts with the general design
criteria, where margin is first, and that is the rule
of law. It says that you have to have sufficient
margin, and it doesn't define in psi what that margin
is, or percent, to some limit.
You have to go to a regulatory guidance,
and even there the regulatory guidance usually refers
to, let's say, the ASME pressure and pressure vessel
code.
But it will give you acceptance criteria
for design pressures, pressure temperature limits,
stress limits, allowable materials, ductility limits.
Those are the kinds of requirements that will be
placed on certain system structures and components --
a piece of pipe or whatever.
And basically it will then say go to the
ASME pressure vessel code, and then the ASME pressure
vessel code will tell you more detail. It will tell
you how you have to test, and how you have to remedial
this material if you are going to us the thickness of
this material with that alloy and composition.
And that this is the pressure that you
cannot exceed, and that is how it is all established,
and that is how we establish design criteria. We
build upon code upon code.
DR. WALLIS: I am puzzled about what Dana
said about having no error in the other direction, and
if it is a conservative analysis, why do you need a
margin if there is no error output?
DR. POWERS: It is put in there because
you may not have thought of everything. These are
complicated systems, and at the time they were built
they didn't know what --
DR. WALLIS: So it is an illusory to say
there is no error in your conservative analysis?
DR. POWERS: Well, there are presumably
things that get discovered all the time. One of the
reasons to put margin in there for is that the coding
analyses tells you how the thing is built, and as soon
as it is built, it starts degrading.
And it degrades in ways that may not be
reflected in things like corrosion allowances and
stuff like that.
DR. CRONENBERG: And in the ASME code,
there is margin for design limits that will take into
account aging and rusting of field components and
those sort of things.
Those already have margins, and the way
that I am going to estimate margin is that I am going
to say that this is the ASME design limit for this
particular pipe, and how close are we to that design
limit.
There is margin above that, too, that is
supposedly built in, and if you test it right, and if
you subjected this material to the kinds of
environment that it was tested for. Sometimes, of
course, we have stress corrosion cracking, and those
sort of things that aren't in there, or irradiation.
We had a lot of things added to the
pressure vessel code and to the irradiation
embrittlement, and that sort of thing over time.
VICE CHAIRMAN BONACA: But even when you
talk about degradation -- for example, from corrosion
in vessels, even there, there are limits to how much
you accounted for. It's not that it is a indefinite
process of corrosion that lasts forever.
I mean, it is not a time limit as others,
but there were certain assumptions made which was
essentially limits of the acceptability to
inspections.
DR. CRONENBERG: I am going to show you
examples of this. Probably the best education is via
an example here. Let me go on. The first thing that
I wanted to look at is the impact of power uprates,
and changes in operating conditions, a change in
design basis accident conditions for increased
coolant, and that you have already associated with the
power uprate.
And you will have changes in primary
system conditions, and you will have changes in
secondary size steam generator flow rates, and feed
water flow rates, and you will have changes in coolant
and temperature, and flow rates and that sort of
thing.
Those are the kinds of things that are
changed with power uprates. Here is some current
power uprate applications. We have the Duane Arnold,
15 percent; and the Dresden plan, and the Quad
Cities, Brunswick, Clinton, and we have Arkansas 1,
and a PWR, and significant power uprates.
We are not talking now these days about 5
percent, or 3 percent uprates. We are talking major
uprates, and I guess in the conference yesterday they
were talking about 10,000 megawatts of electrical
generation, like building 10 new plants from power
uprates.
So we are talking about a major activity
here and a major responsibility of the ACRS. We are
also talking about plants that are pushing 30 years
old; mid-'70s, and vintage 25 or 30 years old.
So we are not talking about uprates, but
we are talking about uprates to an age depletive
plants.
DR. WALLIS: And some of these plants had
a power uprate before, because perhaps they were
operating conservatively initially or something. I
think some of them actually had a power uprate before
of a much smaller amount.
DR. CRONENBERG: The way I read this is
that these keep coming in. I don't know if they will
ever be an advanced light water reactor. I don't know
if they will ever be what you were talking about
yesterday.
But this train is already leaving the
station, you know, on the uprates. So your concern
about margins, I think, is a very timely, timely
subject at this point.
DR. WALLIS: The references that you made
in your earlier report about --
DR. CRONENBERG: I am not talking about --
well, on Tuesday, there is a thermal hydraulics
meeting, and I intend to go back over that if Graham
wants.
We will look at operational experience
from prior uprated plants and what I found there
besides this talk today. So I plan to give both
talks, but not today.
DR. WALLIS: You will be there on Tuesday?
DR. CRONENBERG: Yes.
CHAIRMAN APOSTOLAKIS: Just one note. I
mean, many of the PWRs are not listed here, and they
went through the five percent, but they were really
designed originally, and even the accident analysis in
the FSAR was done at the construction stage of the
higher power level, and they were really operating at
95 percent power like this or whatever.
So that is not really a power uprates. It
is something that was designed to be that way. These
are substantial power uprates.
DR. CRONENBERG: Those are what are called
power stretches, I guess, in the G.E. vernacular.
Okay. I did a case study for the Hatch case, because
that is on the plant renewal, and it had two prior
uprates. It is a G.E. BWR/4 direct cycle plant. It
is an early '70s vintage plant.
It had a power -- it is a two unit plant,
and sister units, and the same power generation from
each unit. It is originally a 2,400 megawatts and
then to 2,500, and then to 2,700. And it is now on to
license renewal.
And Monticello had or was sort of case
studies for the G.E. guidance on power uprates.
DR. LEITCH: Gus, one of the things that
concerned me about the Hatch situation, but I don't
think it appears on your slide though and on your
paper, but it talks about the stress increase in the
access hole cover plate.
And it is really quite appreciable. I
mean, most of the rest of them are kind of what you
would --
DR. CRONENBERG: I am going to get to
that, to the cover plate story.
DR. LEITCH: You are going to talk about
that?
DR. CRONENBERG: Yes.
DR. LEITCH: Okay. Great.
DR. CRONENBERG: This is just a sketch or
a schematic of the direct cycle G.E. plant, and we are
going to look at, for example, what the design
pressure for the main steam line is, and the design
pressure for the feed water system, and the design
pressures for the piping and the research evasion
pump.
We are going to march around this plant
and look at some design limits, and then some
calculated pressures and temperatures, and we are
going to look at some time aging analysis for piping
and that sort of thing.
So wherever I could glean some information
that is how I estimated margin. Okay. Here is a
summary of the uprate conditions for the Hatch, Units
1 and 2, and the years; 5 percent uprate, and then 8
percent, both of which change in operating system
conditions. So these are operating conditions.
As you can see, steam flows get higher
with uprate, and design pressure got higher on the
first, and the steam dome pressure got higher on the
first uprate, but remained the same for the second
uprate.
The dome temperature, the steam dome
temperatures got higher on the first uprate, but not
for the second. Feed water supply always is increased
and feed water temperature is a little bit for each of
these uprates.
So these are some operating conditions and
then we will look at what the design limits are for
the temperature and pressure for those kinds of
operating conditions on various piping.
Basically what I said is what -- okay. We
just saw from the general criteria that there was no
definition of what margin is. It just is that there
shall be sufficient margin.
And so I said I will make -- this is my
definition of margin, and it will be the design limit
that is in a code, the ASME pressure vessel code, and
the value over the design limits, and how close we get
to the design limit.
So here we look at the main steam line
pressure and the design limit for that piping is 1,250
psi. And the original was 1,015. So we had an 18
percent margin to the design limit.
Then we went on the first uprate and the
pressure increased to 1,050. So we dropped down to 16
percent between the value of the operating condition
and the ASME allowable pressure for that type of
piping.
And the same thing with steam line
temperatures. There is a design limit for that pipe
of 575 degrees F. We increased -- and sometimes I
could not get the information, and I want to talk
about that a little later, too.
The difficulty of getting information,
especially design basis calculational information, and
trying to retrieve historical data and historical
calculations to get the changes in margins over time.
DR. WALLIS: We are supposed to have
adequate margin, and I just can't quite grasp how we
decide what is adequate. Is 16 percent adequate, and
would 12 percent have been accurate? Would 5 percent
have been adequate? How do we know?
DR. CRONENBERG: Let me say that I am not
answering that question. That is a question before
the committee, the commission, the staff.
DR. WALLIS: Do you have any guidance
about how we can decide whether it is a reasonable
margin or not?
DR. CRONENBERG: Let me go on and then I
will come back.
DR. SIEBER: It is really not that easy,
because part of the margin is to accommodate
transient, and so you have to know what the transient
response for the plan is.
DR. CRONENBERG: The real degradation in
margin is in your calculations for your design basis
event. An 8 percent could make a 20 percent
difference in a load to a pipe, okay?
VICE CHAIRMAN BONACA: And I think that
Gus has a good example on that, that we can use to
discuss this very issue, because the question will
then come on that issue that -- and when we get to
that issue, we can talk about it.
DR. SHACK: Well, from the code point of
view, it would be 1,250 gives you adequate margin.
VICE CHAIRMAN BONACA: That is correct.
DR. WALLIS: But there is already the
margin in that.
DR. SHACK: Right. There is the code
design limit provides what they believe is adequate
margin.
DR. SHACK: That's right.
VICE CHAIRMAN BONACA: And the degree to
which you can show that, for example, that as the
plant ages, that you still have a value of 1,250.
CHAIRMAN APOSTOLAKIS: So this is
additional margin.
DR. SHACK: It is a code margin, that's
correct.
DR. WALLIS: And this is one of the
debates; who does it belong to and all of that. I
think it would be very good if we could be clear do we
need any margin beyond what is already in the design
limit margin.
CHAIRMAN APOSTOLAKIS: Well, that is not
what he is addressing now.
DR. SHACK: Assuming there is no defects,
and that is a good point.
DR. WALLIS: There are always defects.
DR. SHACK: The code is part of the reason
that it is in fact lower --
DR. CRONENBERG: The value point or the
yield --
VICE CHAIRMAN BONACA: You may remember,
for example, on the primary side that the whole debate
in 50.59 for what the value documented in the FSAR
versus a set limit.
And the industry position was that from
the set limit up it is my margin, or below is our
margin, and above is your margin. And the position of
the NRC is that we want to control also the margin
between the maximum value that you have in your FSAR
and the set limit because it is a margin. So that is
still debated.
DR. CRONENBERG: Okay. The last
presentation was not surprising with the change in
LOCA. If you want to go into significant power
uprates, that is maybe where you had better or you
could see, because as I will show you in the next
couple of slides, when you look at margins for design
basis events, they are decreased rather dramatically.
DR. WALLIS: What I am trying to grasp is
what is the criterion for deciding when you stop? Is
it when you cross the design limit or something, or
what is the criterion for limiting uprates?
DR. CRONENBERG: You will have to ask the
staff on Tuesday. We have no standard review plan.
If we had a standard review plan, we might have
specified acceptance criteria for uprates.
And I have been talking about that point
for a few years now, and I will talk about it again on
Tuesday. Here is some more feed water piping where
actually the feed water pressure went down on the
second uprate.
So the residual margin was increased, but
the real story here I think is what happened with --
that each time you come for a power uprate, you have
to recalculate your design basis accident conditions,
and that is a good part of the safety analysis report
that accompanies a license amendment request for an
uprate.
And these are design basis LOCA loads for
-- well, this is the pressure vessel, and in the
original the load was estimated at 8.9 kilopounds per
square inch, and the design limit is 15.
DR. WALLIS: Just remind me that these are
forces due to momentum effects during a LOCA?
DR. CRONENBERG: Yes. These are forces on
piping during a LOCA.
DR. WALLIS: So you have to have a good
momentum equation to predict them?
DR. CRONENBERG: Yes.
DR. SIEBER: Or a water margin.
DR. CRONENBERG: Okay. And the first
uprate, the prediction is nine. So you have a little
-- you decrease your margin a little bit. The vessel
shroud, and this is stress calculations.
One thing that was hard to do when you
chartered me to look at what this reduction in margin
is, you can only get results for little bits and
pieces of components in the system.
You don't have an ISO stress figures for
that margin of time for the LOCA. You will have a
summary table saying here is the stress on a bulk, and
here is the stress on a weld, and here is the maximum
stress during the LOCA, and that's all.
And that will be an appendix usually to
the SAR, and it is usually for a G.E. applicant, and
it will be G.G. proprietary information, and all it
will be is these five numbers of various stresses.
So it is hard to get a real good
comprehensive feel for what is going on, and it will
change with time. One operator will give you the
stress on a bolt, and the other one will give you the
stress on a weld.
The other one will be stress on a plate or
the pipe itself. So you can't get a good feel for
what is happening with time for just even one
component. You can see there is blanks in here.
You would rather see a better picture. So
if you guys are serious about requesting the staff to
estimate margin reductions for power uprates, where
are they going to get the information when they get
summary reports? And how are they going to retrieve
this information that is 10 years old?
CHAIRMAN APOSTOLAKIS: We are trying to
get a feeling right now for what the issues are. So
I think you are going in the right direction.
DR. CRONENBERG: Well, I just wanted to
bring that out to you. It was not easy to find the
information, and some of the information on the
license renewal, I had to request from the applicant
itself. It wasn't even in the agency.
And I will go on, but anyway, you see a
general trend of margin reduction for increased power
uprate, and here is this access cover plate.
DR. LEITCH: And that is exactly the point
that I wanted to address. That seems to be kind of
counterintuitive there, that large reduction in
margin.
And I wonder if we are really comparing
apples and apples, because it seems to me that in
about 1990 or so -- I don't remember the exact time
period -- that access cover plate had some problems
and was redesigned.
DR. CRONENBERG: Yes.
DR. LEITCH: And I was just wondering if
those stresses --
DR. CRONENBERG: These are the two
stresses. These are numbers that I took from the G.E.
appendix to the license amendment request for the
uprate, and it was on the same bolting. Now, that
access cover plate was replaced.
These are again to the design as to 107.7,
and this is an 8 percent power increase that you had
over a 20 percent reduction in margin for the 8
percent. The lows were significant, a significant
jump in loads from 60 to 90.
Now, that access cover plate is what they
found in Peach Bottom, a sister type of plant, was
that they had stress corrosion cracking in Peach
Bottom, and NRC required that that access cover plate
be replaced.
Hatch did -- all sister plants had to do
ultrasonic testing on theirs following shutdown, and
do ultrasonic testing. They found evidence of
cracking on their cover plate, but they could neither
confirm or deny how deep that cracking was.
NRC dictated that they put in a monitoring
program to monitor those welds, and they decided to
just preempt the problem and replace those cover
plates on Hatch because of what was confirmed at Peach
Bottom, but never really confirmed at Hatch.
They just replaced the cover plate, but
what is happening here is that Peach Bottom did have
confirmation of significant stress corrosion cracking,
and probably that design limit was not retained. And
I am always comparing it to design.
VICE CHAIRMAN BONACA: And I think this is
a good example because -- and we brought it up with
the staff already. The staff was asking what kind of
questions do you want us to ask, and the questions, if
you have aging, that may challenge in fact the design
limit of 107 KSI because of the degradation that is
resulting as a part of aging.
The question is do you still have the
margin between 90 KSI and 107, and you probably don't.
As a minimum, the uncertainty is very much in
question, because you have only 16.4 percent of
margin. So that was simply an observation that as a
minimum, in reviewing the power uprates, the reviewer
should not just simply compare a apple with an apple.
They should ask some questions regarding
the operating history, and the inspections done, and
what is happening to the plant, because the plant is
aging, and it is a fact. So that is just one point
that I wanted to make that we brought up with this
stuff.
DR. CRONENBERG: But most of the time in
the license application, they will just quote we have
this limit to our design, and this much margin to our
design limit.
I have not seen the kind of discussions
that Mario was talking about in a license application.
CHAIRMAN APOSTOLAKIS: You have not really
addressed the strength here. You are just saying that
as a design limit and calculations show that the
predicted strength is this, but you are not saying
anything about how or what is happening to the design
limit today.
DR. CRONENBERG: Well, that does come in
the aging, but these are all numbers that I got from
a licensed application. I am comparing that this is
the licensee's numbers, and this is the degradation in
margins based upon the licensee's own numbers.
And I was hoping that I could get more
information, and I found it rather confusing because
we never say you shall give me -- if we had a more
structured approach to operate, you shall give me
these stresses for these bolts, for these pumps, for
this pipe weld, for that access weld, so I can compare
in time what is happening as I uprate the power.
The story to me is confusing because we
don't have a rigorous approach to how we review power
uprates, and so --
CHAIRMAN APOSTOLAKIS: But this is really
the residual additional margin, right? Wouldn't that
be more accurate, because there is already a design
limit.
DR. CRONENBERG: I gave you my definition
of what I am using as margin.
CHAIRMAN APOSTOLAKIS: But I think if you
put the word additional there --
DR. POWERS: Residual he calls it.
CHAIRMAN APOSTOLAKIS: The concern here
was, and as we expressed before, was that when you go
with power uprate, the project engineer goes through
a checklist, but especially uprating plants that have
been running for 20 years or 30 years, there is a
history behind which involves aging, irrespective of
license renewal.
VICE CHAIRMAN BONACA: Is it adequate to
simply go back --
DR. SHACK: But again if he had any known
cracking, he would be operating under a different set
of rules. That is, that he would have to account for
the crack, the crack size, and he would have limits on
that.
VICE CHAIRMAN BONACA: I don't deny that
there are considerations like that, but I am only
saying that until now it seems to me -- and what Gus
has pointed out -- that without a specific more
thorough checklist almost of how you are going to do
it, it would be purely checking a number against a
number.
And if you have a residual margin of one,
it is enough to say yes, and the point that Graham was
raising before. And I think there has to be a more
thoughtful review given that you have an operating
history behind it.
CHAIRMAN APOSTOLAKIS: But you can't just
look at the incidents of aging, because there are also
inspection programs, corrective actions, and so all of
those have to come in, and so the assumption here is
I guess, but unless there is evidence of something
going on, the design limit is preserved.
VICE CHAIRMAN BONACA: Absolutely, and I
am not denying that, but I am only saying that we are
checking to see what kind of margins there are, and
how they are reduced, and the significance of those,
and the fact that as you get very close -- I mean,
originally they started with a blowdown pressure of
stress with a component of 64.5 KSI. That was the
original design. And the design was actually 107.7,
and a 40 percent margin, and so --
DR. CRONENBERG: That was on the first
uprate, and I don't even know what -- I couldn't find
it in the FSAR what it was on that bolt.
DR. LEITCH: But, Gus, that is the one
-- in all of this data, that is the one thing to me
that is surprising, and almost counterintuitive, that
it would change that much.
And I guess what I am saying is that there
has been some redesign work done down there on that
access cover, and I am just wondering whether these
numbers are presenting the correct story, or whether
the numbers somehow got skewed by reanalysis,
redesigning.
DR. CRONENBERG: Which number are you
talking about, the design limit or the calculated
load?
DR. LEITCH: No, the design limit. I am
saying that maybe they went back and after finding
this problem at Peach Bottom, they might have gone
back and said, oops, maybe we had better recalculate
that 64.3, and maybe they found out it was 88 or
something like that.
And what we are saying is a significant
reduction in margin due to power uprate may be due to
something totally different than that. I am just
surprised that that order of magnitude of change.
The rest of the changes almost seem
intuitive to me, and I just want to be sure that that
one piece of data isn't taken as --
DR. CRONENBERG: That was just a number.
We get summary reports, and we don't get detailed on
what boundary conditions are on codes, and what
stresses are predicted, a time line. We just get a
summary table. I am going to show you the kind of
information that we get in an application.
DR. LEITCH: Yes, but all I am saying is
that I don't understand the phenomena that would
increase the stresses on those bolts by that much by
just --
DR. KRESS: It is strictly the pressure
doing that, and the pressure didn't change that much.
I think you are right. There is something wrong
there.
DR. LEITCH: Yes. I just don't want to
focus on that question and --
DR. CRONENBERG: Well, it is coolant and
higher flow rates, and --
DR. KRESS: But that is a lot of change.
DR. CRONENBERG: Well, this is in the
application, and these are reported numbers, and none
of these are anything else but reported numbers.
CHAIRMAN APOSTOLAKIS: I think you made a
good point, and we should be cautious about that.
DR. CRONENBERG: Okay. Here is some of
the containment again, and this is an inverted light
bulb type of BWR, and we can see that the pressures
there are going up and the drywell or the margin is
going down.
And the peak drywell gas temperatures are
exceeded for a small time. However, it is only for a
short time. So that was allowed. And then the design
limit, and the suppression pool temperatures, and the
design limit is 281, and we go from 198 to 202, to
208. We keep creeping up as we might expect the
margin to design limit goes down.
DR. KRESS: Should we be concerned about
all these decreasing margins?
DR. CRONENBERG: Well, let me get to the
end, and let me talk about a more holistic or
conclusion. We also have signatures of margins for
license renewal, and most of that was gleaned from
looking at the time limited aging analysis.
And basically that comes out of appendix
material for the Hatch, and this was surprising to me
that we had discussions of the accumulative usage
factors, and estimates of those cumulative usage
factors for various components for the Taurus, for the
piping.
But that was information that I couldn't
get from the staff here. I had to go back to the
licensee and the licensee had to request from G.E.,
and G.E. has a structural associate contractor that
G.E. uses to do this cumulative -- essentially fatigue
calculations.
So you really had to go back and reference
it, and it wasn't in the agency where I got these
numbers. I had to get it from the licensee, and Mario
saw all the E-mails back and forth to retrieve this
information.
So it is not just something that -- well,
you have got to work at getting it if you want to look
at margins. Okay. This is a cumulative usage factor,
and it is basically a fatigue estimate for various
components.
And they estimated for 40 years for the
end of the first renewal, and they gave estimates for
the license renewal period of 60 years. Basically,
they keep track of the number of SCRAMs, and the
number of bolt up and bolt down operations, and
anything that can fatigue a particular component, any
minor seismic events.
And if you exceed one, then you exceeded
the allowable fatigue limit for that particular
component. So you estimate these things, but a lot of
this is based on historical data. You have got to
keep track of SCRAMing, SCRAMs, and bolt ups, and bolt
downs, and that sort of thing.
So the cumulative usage factor,
essentially you are going to one. The design limit
here is one. If you exceed the design limit, then you
have to negotiate something with NRC, whether the
surveillance has to be higher surveillance, or that
component has to be replaced, or whatever.
The suction piping, the cumulative usage
estimate for that is 57 at 40 years, and it goes up to
77 at 60 years.
CHAIRMAN APOSTOLAKIS: Again, let me
understand this. Does this include the impact of
inspections and corrective actions?
DR. CRONENBERG: No, this is just an
estimate of how close to a fatigue limit you might
have been if you had 35 SCRAMs, a combination of 35
SCRAMs, 60 head removals, a seismic event.
DR. SHACK: And we don't even know if
these are calculated based on actual cycles or some
projected design cycle?
DR. CRONENBERG: It is a combination.
When you look at them, they do have tables of historic
data for the SCRAMs, and then they estimated what it
is going to be in the future, and that is how they get
it to 40, and that's how they get to 60.
It is a combination of historical data and
estimates. I think it is a pretty nice analysis. I
thought this was -- I thought this was somebody trying
to estimate margins, you know.
And it is for various things that you have
said, because you have a standard review plan for
license renewal, and you say you will do these kinds
of estimates on these kinds of components. And then
you can begin to see, well, at least there is an
estimate of margin here.
DR. FORD: On a procedural aspect, for
instance, the piping. This is based on a code
analysis, which takes into account normal fatigue and
corrosion, but it does not take into account, however,
corrupting, and corrosion would be an additional
effect. How is that taken into account?
DR. CRONENBERG: That is a good point. As
far as I can tell from looking at these contractor
reports, it is assumed that same power for the next 20
year cycle, and I did not see something in here that
related to if you had added on top of it a power
uprate.
Just that you had so many bolting
operations, and so many SCRAMs at power. So I can't
be sure, but I would have to go back into this.
DR. FORD: Well, maybe I am asking a
question where there is no way of knowing the answer,
but how would the staff address the degradation mode
on this --
DR. CRONENBERG: This kind of thing never
comes up in an uprate. You don't have -- usage factor
estimates in the power uprate. Those are time limited
aging analysis, and that is what the whole -- Mario
and some of your concerns are.
We don't look at licensing of a plant in
a holistic sense. We look at one licensing action and
make a judgment. We will get another licensing action
and make a judgment, and we will look at fuel
replacement and we make a judgment.
But we don't make or you don't have to
have legacy tables in here, where I did this to my
system, and I did that, and this was an uprate, and
this was a license renewal, and this was a fuel
change, and these are the changes in design basis
loads for all these changes.
Maybe somebody has, but I can't glean that
kind of information from any of these reports on the
legacy of this plant and all the changes that have
been made, and how it impacts margin. We review
separate licensing actions.
DR. SHACK: Peter's direct question, and
I think they would argue do the code analysis, with a
very small thinning requirement allowance in the code,
which is done independently --
DR. FORD: So the worst --
DR. SHACK: That is the only way the flow
assisted corrosion affects the CUF, and there is no
other thing, but then you would address the flow
assisted corrosion separately.
DR. FORD: Separate and take the worst
one?
DR. SHACK: Yes. You would have to
demonstrate that you weren't violating any of your
code limits on thinning.
DR. SIEBER: Well, there is actually
margin built into the manufactured product, because
the code says here is the minimum wall, and when you
go and buy a new one, it is thicker.
DR. WALLIS: George, we are due back here
at 1:15 after lunch, and that is a fixed time isn't
it? So we have to move along.
CHAIRMAN APOSTOLAKIS: Yes, and there is
also a separate meeting in 10 minutes.
DR. CRONENBERG: Okay. Do you want me to
wrap this up? okay.
CHAIRMAN APOSTOLAKIS: Okay. Why don't
you go to the conclusions, and summary and
observations.
DR. CRONENBERG: Okay. Margin estimates.
Again, I talked about not getting or having to go
through lots of steps to get numbers. This
information is not readily available as far as I can
see.
And I tried to tell you that we get
summary reports in the license applications. We don't
-- if you want margin estimates for a plant, you are
going to have more than just I got it for this bolt
and this piece of pipe, and that's all I am going to
give you. There is not a lot of information.
And summary and observations. Safety
margins is used in a broad sense in the regulatory
process, and we have already talked about this. There
is a lot of difficulty in getting self-consistent data
for an assessment of margin impact.
Not only do you get it for different
components, but calculational codes change, and
calculational procedures change for LOCA. You are
already talking about major calculational changes for
LOCA.
So it is hard to get an apples and apples
comparison. Nevertheless, I think that we had some
success for this case study for Hatch. We were able
to estimate from the licensee's own number some
signatures of margin reductions, and it looks like
there is always some margin reductions for various
pipe.
DR. WALLIS: And it is not particularly as
severe, except for these bolts and that may be --
DR. CRONENBERG: Yes, but we have not
looked at it integrated. I have given you bits and
pieces of information, too. I never put it all
together.
To me, the SARs and the SERs do not appear
to have information of sufficient detail or
consistency for any in-depth quantitative assessment
of margin info for multiple licensing actions.
I don't think we have the kind of
information from the SARs and SERs, and the type of
information requirements that we have to date.
Uprate review. Again, I want to endorse
the prior recommendations for a standard review plan.
I have been talking about this, and you have other
studies in this agency. The Maine Yankee lessons
learned says why don't you have a standard review plan
for uprates, and it would probably be better if there
was a scientific study of power uprates from the early
'70s.
And it came to the same conclusion. It is
an ad hoc sort of process that is not in place, and I
think the agency would be better served if we had a
standard review plan, especially when we are talking
about the power uprates that we are talking about; 20
percent for an aged fleet of plants.
And it also came from my own review of
operational events for operated plants. I had some
suggestions on what could be included in a standard
review plan, and it goes on from there. I think I can
wrap it up.
CHAIRMAN APOSTOLAKIS: Okay. Thank you.
DR. LEITCH: Just one question. I thought
that one of the effects that we were going to look at
is increased fuel burn up, and I don't see anything
about that here.
In other words, in addition to power
uprates and license renewal, I thought that one of the
other major things was increased fuel burn up. And I
just wondered if you planned to take a look at that
yet.
In other words, is that coming along in
the future? Are you saying what we have here is just
a preliminary draft?
DR. CRONENBERG: I don't think I am going
to be able to get to it. I think I have about 6 weeks
left in my time, and I want to wrap up what I have
done in a coherent paper report. So this project ends
in September, and I work half-time.
So I don't plan to do anything on fuels or
another plant, or anything else. I just wanted to
give you a report and I wanted to give you a 10 page
summary paper if somebody wants to publish it.
And I also want to do the same on a prior
study that I did for operational events. I want to
write a 10 page summary and leave it with some of you
guys to publish it.
DR. LARKINS: Gus, is there any -- do you
have reason to believe that there may be information
out there that if someone were to follow on to this
activity, this project, to do something in this area
additionally, like high burn up fuels?
DR. CRONENBERG: Yes, I think you could.
You have got to delve into it, and yes, there is
corrosion limits, and irradiation, and brittlement on
control rods that march on with time.
DR. LARKINS: One of the things that I am
getting at, and one of the things that you might want
to do in finalizing your report is to make some
recommendations for any follow-on activities.
DR. CRONENBERG: Sure. Sure.
VICE CHAIRMAN BONACA: Are you going to
look at some of the PRA aspects that we discussed
before?
DR. CRONENBERG: I am going to try to, but
basically you know what is in PRA. You don't reach
your design limits, and you march on. You don't fail
components.
DR. WALLIS: I am trying to grasp what the
ACRS should do on this, and we have a meeting on
Tuesday about uprates, and are we expected to write a
letter for July on power uprates or are we just sort
of learning as we go along, and eventually we will
have to do that.
VICE CHAIRMAN BONACA: I think we are
learning.
CHAIRMAN APOSTOLAKIS: At this point, we
are learning.
MR. ELLIOTT: I think that would be up to
you guys, depending on what you hear at the
subcommittee meeting. One thing to note is that back
in December when you discussed this issue last time,
the research people came in and said that they were
proposing to look at the issue of synergism that Gus
has raised here.
But they said that they had no funding,
and what you are going to hear Tuesday is now that
they do have funding, starting in FY '02. So you may
want to think about commenting on that, depending on
what he has to tell you on Tuesday.
DR. POWERS: It seems to me that it would
be surprising if we didn't come back and say how come
you guys haven't developed the standard review plan
for power uprates.
DR. ELLIOTT: Well, you may recall back
again in December that they told you that they didn't
plan to do it, and the committee took no action at
that time. They basically accepted that, and they
claim that they have a template that they used based
on the last two reviews, the Hatch and the Monticello,
and that is what they are following.
VICE CHAIRMAN BONACA: I am still left
with some curiosity in my mind regarding how would
LRF be affected with a power uprate and containment
that is not any more capable of being assumed
strength, and assuming the PRAs. I would just like to
understand that.
And maybe the sensitivity on the PRA would
give us some answer on what the sensitivities are. I
really don't know.
DR. KRESS: I think the answer is that the
containments fail at the discontinuity that Dana tells
us about, and those probably don't change much by this
process.
DR. POWERS: We can probably get rid of
the containments, and it is not doing any good for us,
and --
DR. KRESS: Yes, we might as well get rid
of them, as they don't help.
CHAIRMAN APOSTOLAKIS: Okay. We are
recessed until 1:15.
(Whereupon, at 12:15 p.m., the meeting was
recessed.)
. A-F-T-E-R-N-O-O-N S-E-S-S-I-O-N
(1:18 p.m.)
DR. POWERS: I will bring this session
into order, and we can just go right ahead with the
presentation on the South Texas project.
DR. SIEBER: Okay. The lead speaker today
will be John Nakoski, as the senior project manager
for this project; and since I have read most of the
things that you have written, you must have a sore arm
by now.
I would also mention that we are getting
down towards the end one way or another of this
project, and I have received lots of mail from anyone.
DR. POWERS: There are sore arms and a lot
of us with sore fingers, right?
DR. SIEBER: I would expect today to have
us have concerns to ask questions to see if they can
be resolved, and I intend to do the same. And from
those questions, you probably will get some of the
gist of how we are thinking.
But right now, and until we are through
hashing this over, we don't have a consensus yet, and
hopefully we will arrive at one. So with that kind of
introduction, John, I would like you to begin.
MR. NAKOSKI: Okay. Thank you. To my
right is Jack Strosnider, and he is the Director of
the Division of Engineering; and to my left is Gary
Holahan, and he is the Director of the Division of
Systems Safety and Analysis.
I would like to go quickly just to refresh
everyone's memory where we are and where we have been.
This is an effort that started in July of 1999. We
have met with South Texas a number of times, and those
meetings are on here, but we talked about them before.
In January of 2000, we issued a request
for additional information. South Texas came in with
a revised submittal in August of last year, and as you
can see, we briefed ACRS on this issue a number of
times.
In December of last year on the draft
safety evaluation that we issued on November 15th, and
in February of this year, we discussed categorization
with the NCRS subcommittee. In April of this year, we
had a meeting with the full committee on treatment.
Recent activity is that the staff, the
risk informed licensing panel, met with South Texas on
the content of the FSAR. In the middle of last month,
we finally brought to closure all the open items
identified in the draft safety evaluation.
And yesterday, the SE was forwarded to the
EDO for his review in support of a July 20th
commission meeting. And we are here today meeting
with the ACRS to cover our findings that are described
in a preliminary safety evaluation that we made
publicly available yesterday in a letter to South
Texas.
Going forward, we expect to brief the
Commission on July 20th, and following that, we expect
to issue the notices of exemption and the final safety
evaluation in August.
DR. SIEBER: You will get a letter from us
and it will probably come out in July, but we won't
have enough time from this meeting to resolve
everything and get it printed, and I don't think we
will anyway.
MR. NAKOSKI: And on our expectation, we
would expect that after the July meeting, after you
have had sufficient time to review the final safety
evaluation, to provide us with your comments.
The conclusions that the staff reached in
categorization is that we found or that we concluded
that it is acceptable to categorize the risk
significance of both the functions and the
structure systems and components for use in reducing
the scope of structure systems and components subject
to special treatment.
It is also acceptable to define those
structure systems and components for which exemptions
from the special treatment requirements can be
granted.
DR. SIEBER: Let me ask a fundamental
question, and the answer is not in the FSAR, but when
you use PRA, you calculate CDF and LRF, but if you
look at the regulations, there are restrictions on
plants, and there are components that are basic
components according to 1.3 that are that way not
because they impact CDF or LRF so much, but that there
are other kinds of accidents or things that can
release radiation either inside the plant or outside
to the public, like a spent fuel pool, and accidents,
and so forth.
How do you assure yourself that you
effectively blanket everything that is necessary by
using just CDF and LRF as the metrics for
categorization, or the deterministic process to the
extent that it addresses that?
MR. HOLAHAN: This is Gary Holahan. In
part, I think the answer is buried in your question,
and that is that CDF and LRF don't measure --
DR. SIEBER: Everything.
MR. HOLAHAN: -- everything, and that is
part of the reason that the categorization process,
and the testing of what belongs in each of those
categories can't be done just by the risk importance
measures.
In effect, there are many components that
are not modeled in the PRAs.
DR. SIEBER: That's right.
MR. HOLAHAN: And that's because either
the subject matter doesn't relate to core damage
frequency, or even if it does, because they are
screened out, or because their judgment is that they
are not such important contributors, or they are
subsumed in other super components if you will.
For all these reasons, we have pressed in
this activity, as well as all our decision makings,
back to regulatory guide 1.174, and that you need to
have an integrated decision process that covers issues
like defense in depth, and respects barriers, and
safety margins, and good engineering processes.
So we don't have numerical metrics for all
of those other things. South Texas has a process that
they use, and other people have used other processes.
But we recognize that the issues are more than core
damage and large LOCA release.
And the measures are more than CDF and
LRF. So you have to look at the whole process, and we
think that we have done that in this case. So we hope
to learn more about that.
DR. SIEBER: So you are relying on the
expert panel?
MR. HOLAHAN: We are relying on the expert
panel and that whole process involving the expert
panel to capture the rest of the features.
DR. KRESS: And that is what we mean by
the categorization process and the whole thing.
MR. HOLAHAN: By the categorization
process, we mean the whole process and not just the
importance measures.
VICE CHAIRMAN BONACA: You know, on this
issue, I was looking at the five questions that they
have used as some question that would lead you to, for
example, FSAR Part 100, and I thought that they
related more to CDF and LRF conclusions, but you are
telling me that they don't.
Or they may lead you, insofar as answering
to those questions, to Part 100 releases, or for
example, a limited amount of fuel damage?
MR. HOLAHAN: I think that the questions
are intended to do more than that.
VICE CHAIRMAN BONACA: Okay.
MR. HOLAHAN: I mean, we could ask South
Texas for some practical examples, but for example, if
I look at one of their questions, does the loss of
function in and of itself directly cause an initiating
event.
Now, that could cover events, whether they
are dominant sequences in the PRA that might cover
other initiating events as well, and that there is a
value of protecting against.
VICE CHAIRMAN BONACA: And if we could ask
that question to South Texas?
MR. GRANTUM: There are several questions
that are used in the determination process, and this
is Rick Grantum, South Texas. The one that Mr.
Holahan mentioned is one covering initiating events to
cover a spectrum of initiating events.
We also have other questions that are
associated with is the component mentioned or taken
for in our emergency operating procedures. So that
carries another set of components, and a lot of those
components are used, and the basis for those
components being in the EOPs is Part 100 requirements
and others of those aspects.
So we have a catchall in the EOPs that we
take credit for, and we also ask questions relative to
could it fail another risk significant component, and
is it used to mitigate accidents or transients.
Those are the deterministic types of
questions that the working groups and the expert
panels deliberate on to encompass the concerns that
have been mentioned.
DR. KRESS: When you talk about the
categorization process here, does that also include
the sensitivities analysis?
MR. HOLAHAN: Yes.
DR. KRESS: You are considering that part
of the process?
MR. HOLAHAN: Yes. In fact, if the
sensitivity studies, which in fact I think are more as
a Delta CDF, Delta LRF test, and if they showed that
the cumulative effect of these proposed changes was
too large, then in fact I think you would have to cut
back on how extensive a list of low safety
significance items you would put in that category.
DR. SIEBER: That is the 1.174 test.
MR. HOLAHAN: Yes, that's right actually.
DR. SIEBER: I guess in my opinion that
you can categorize any reasonable engineering
happening, provided that you have the sensitivity
studies and apply the result to a comparison of 1.174.
MR. HOLAHAN: Well, we talked about this
subject before, and I think in terms of the things
that can be measured by a PRA, the delta CDT test is
more important than the importance measures.
DR. SIEBER: That's what I think.
MR. HOLAHAN: And the fundamental nature
of it shows, because it is in reg guide 1.174, and
importance measures are not.
Importance measures are discussed in some
of the other issues, specific regulatory guides, but
in all of those cases there really are subordinate to
the overall goal of -- that the net effect of the
change should be -- on risk should be small.
DR. SIEBER: Right.
MR. HOLAHAN: But neither of those
processes captures the engineering safety margins or
defense in depth issues.
DR. SIEBER: That's right.
MR. HOLAHAN: So you couldn't go directly
to the Delta CDF and say that is the only issue.
DR. SIEBER: If I performed the so-called
thud test, and how much does it weigh, and how much
space do you put in the FSAR for these various
aspects, I see on page 16 that there is a paragraph
that looks at the Delta CDF and Delta LRF as compared
to the standard in Reg Guide 1.174.
MR. HOLAHAN: Yes.
DR. SIEBER: But as you described the
screening process in the PRA, that is multi-pages, and
indeed that is plant specific, because I think that
the screening values, they don't seek to make a whole
lot of difference on exactly what they are.
But you could choose another set of
importance measures and as long as you could perform
this test that is on the bottom of your page 16, you
are okay.
So if you go and read it, it looks like
this comparison was an after-thought, and all the
categorization was done, and then they said, oh, gee,
we have some metrics here that we can apply to the reg
guide to show that we are okay, and that is sort of
the impression that I get.
MR. HOLAHAN: That is an impression or a
perception that we would not like to have widely seen.
The real fundamental measure is that the change that
you are doing has a small effect on risk.
DR. SIEBER: That's right.
MR. HOLAHAN: And I think the reason
importance measures took a large place is that
certainly in other applications we didn't know how to
calculate Delta-CDF, and as a substitute, we said --
for example, on graded QA and other issues, we said
that one way of showing that the change in risk was
small was by only allowing changes to components that
we knew were very unimportant.
And having done that, we had a qualitative
feeling that the Delta-CDF's risk effect was small.
In cases where we think we can calculate Delta-CDF,
even though it is only through a sensitivity study, or
give a range, I think that is important.
We have given some thought to the subject,
and I would say one other thing. I think you could
meet the small effect on risk goal by almost
arbitrarily picking the components and then doing this
test.
But I don't think you could meet one of
our other goals, and one of the goals of this whole
process is that we should be focusing the staff and
the licensee on those components that are most
important to safety.
So I think it is advantageous to give the
best shot we can at identifying important and less
important components. For example, you could approach
this issue from a purely economic point of view, and
go to the most expensive components and apply it, and
keep subtracting until you get Delta-CDF is equal to
whatever it is, and say that is where I am going to
go.
I think that is not the overall safety
approach that has been laid out. What we have said is
that that would not be focusing your attention on
safety. It is focusing your attention on the costs.
And though we recognize that we would like
to reduce unnecessary burden, we would like to do it
in a way that produces a better safety focus. So the
categorization process in my mind is not arbitrary.
You ought to take your best shot at it, and then you
ought to also test it with respect to its effect on
the overall result.
DR. KRESS: That leads me to believe sort
of in an indirect fashion you are giving a blessing to
the use of RAL and FSER vesely as a way to provide
this focus on risk significant items. Is that a
correct interpretation of what you said?
MR. HOLAHAN: In this case, yes. I think
what we have said in our general documents is that we
have given these as examples, and not to say that this
is the only way to do it.
But that you always ought to have more
than one -- I think what reg guide 1.174 says is that
you ought to have at least two risk matrix, and there
ought to be two complimentary ones. And it suggests
that these are two of the four that are mentioned.
DR. KRESS: The problem that I may have
with that is that I am not sure that developing the
RAL and FSER vesely for each individual component of
an entirely group, of which there may be many of,
correctly addresses the group importance, and in
giving a blessing to the process under those
circumstances.
And that's all right for one component,
and that's fine, or one or two components even. but
for a relatively large group of components, I am not
sure it is wise to give that blessing at this moment
to the use of RAL and FSER vesely of each individual
component as a threshold to decide safety significance
of the items. Could you respond maybe to that?
MR. HOLAHAN: I think there are a couple
of unresolved issues with the importance measures. So
at the moment, in this application, we are satisfied
with what was done. In part, because we watched them
do it, okay, and we saw how it was coming out.
And we know quite a lot about the PRA, and
we know what the dominant risk sequences are, and what
the total CDF and LRFs are for this plant.
I don't think you can pick risk matrix -- FSER vesely,
RAL, or any of these things -- and use them
abstractly.
I think it makes a difference whether the
baseline risk is 10 to the minus 4 or 10 to the minus
6. I think that affects how you pick the components.
I think we all recognize that if you slice
the pieces down to the sub, sub, sub, subcomponent,
you could eventually show that everything isn't very
important, every little piece isn't very important.
So what we found is that as it was done
here is okay. I think you have to be a little bit
careful about extrapolating that to say any plant can
pick up these risk matrix and these thresholds and use
them in the future.
DR. KRESS: Will that be made clear in the
FSAR?
MR. HOLAHAN: Well, I think it is not so
important in the FSAR.
DR. SIEBER: It is in the FSAR.
MR. NAKOSKI: This is John Nakoski. I
believe we do mention or state in the FSAR that these
screening criteria, or FSER vesely and RAL, are pretty
much SDP specific.
DR. SIEBER: You say that, and you go a
little bit further to say that it is not necessarily
a template, and that is where I think we ought to be
with this.
DR. KRESS: And how is it that you know
that the screening criteria is appropriate even for
SDP? Is it because of the sensitivity analysis
verifies it?
MR. HOLAHAN: The sensitivity analysis
shows that the total of change can't be all that
large.
DR. KRESS: And if I do not have the
sensitivity analysis?
MR. HOLAHAN: It would be very hard to
judge that.
DR. KRESS: It would be hard to make a
judgment on that?
MR. HOLAHAN: Yes. And I think also when
you do a sensitivity analysis that you would find out
that 99.99 percent of that change can change just a
couple of components.
I think you would think that maybe you
didn't do it right either. In this case, I would have
been surprised to find that.
DR. SIEBER: Could you describe or give us
a list of the sensitivity studies that were done?
MR. HOLAHAN: I couldn't, but I think a
member of our staff could. Sam, Sam Lee.
MR. LEE: Hi. This is Sam Lee. I am not
sure if I understood the question. The question was
to give you a list of the sensitivity studies that was
done for this particular --
DR. SIEBER: What the perimeters were.
There was more than one study, right?
MR. LEE: Yes. First of all --
DR. SIEBER: There was 21 studies or
something like that.
MR. LEE: The particular study that we
focused our review on was the study where it took all
the components and took the mean failure rate and
multiplied by a factor of 10, and that gave us some
sense that there were to be a change in reliability in
these components.
And if we were to assume that it might
have changed by a factor of 10, what impact would that
have on the overall plant frequency. That was the
sensitivity study which we focused our view on, but I
believe that maybe South Texas can help me with this.
Is that there were many more sensitivity
studies done that were done to support that finding.
The other one that we also focused on was as you
pointed out, that CDF and LRF were not the only matrix
that we looked at.
We did ask the question in our REI as to
how they accounted for the importance of those
equipment that are there to protect the containment,
and so one of the studies that the licensee performed
for us was the failure containment probability. That
is another one that we looked at.
MR. GRANTUM: This is Rick Grantum, and I
can give you some other examples if you want to hear
some more.
DR. SIEBER: No, I would prefer in the
interest of time, and we aren't even through the first
sentence yet.
MR. HOLAHAN: But there are only two
topics.
DR. SIEBER: On the other hand, it is
important for me to understand what the staff relied
on to come to the conclusions in this FSAR, as opposed
to how many thousands --
VICE CHAIRMAN BONACA: I would like to ask
just one more question before we move on, because I
asked the question before with regard to the other
measures of performance, and the answer was
satisfactory to me.
But you also spoke about that you don't
want to communicate, and when I read the FSAR, I
really did not appreciate from it that that integrated
process that really is the heart of 1.174 is truly
addressed here through those measures.
I mean, maybe I didn't read it right, but
it didn't come through, and so I am glad to hear that
it was used. But I think it could have been more
explicitly addressed in the terms.
Because one is left with the impression
that other subsumed goals, such as Part 100, are not
being addressed, and that is really what I concluded.
DR. KRESS: Before Sam Lee sits down, for
the sensitivity studies, could you maybe tell me why
it is that you feel comfortable with the factor of 10?
Do you have some database that says that?
MR. LEE: When we first were reviewing
their initial submittal, and we wanted to see --
again, we are postulating that there could be changes
in the reliability. We are not sure of the
reliability, but --
DR. KRESS: You may not change it at all.
MR. LEE: But what may be a good number,
and the factor of 10 was actually submitted by the
licensee. But what gave us a sense of comfort for
that was that if you look at most of the failure
rates, and the distributions for the components in
South Texas, you have a range of the 50th percentile
to the 95th percentile.
And typically for those components, the
error factor of three sort of lined up with the 95th
percentile. So in our view, if you had a factor of
10, that well exceeded the 95th percentile.
DR. KRESS: Somehow that doesn't give me
much comfort, because that is a distribution of
failure rates for things that have been given special
treatment.
MR. LEE: That's correct.
DR. KRESS: And what I am really
interested in is how would that change if the special
treatment were not given to them, which means that you
may shift the whole distribution one way or the other
and by some amount.
And so I am more interested in whether
there has been a comparison of things that have been
given the special treatment with things that have not
been given, and if you had any feeling as to that.
MR. LEE: Well, that is really a good
point, because a factor of three would be within the
boundary of the 95th percentile. That's why if you
assume a factor of 10, it wouldn't actually exceed the
distribution, and that gave us some sense that even if
you were to shift the distribution to the right a
little bit, that that might be bound by that.
But you are right. It is hard for us to
tell how much of that shift will be, and a factor of
10 at this point gave us some sense that it would be
okay.
And again I would emphasize again that
when you do the sensitivity analysis and you look at
the results of the Delta changes, they are fairly
small.
DR. KRESS: They are really small with a
factor of 10, yes.
MR. LEE: Yes. So maybe perhaps we can
assume that if we were to extend the factor out even
further, and we haven't -- and I don't think that
South Texas has done that.
But even if we were to do that, my guess
would be that it might still be within the window.
But I am not suggesting that we ought to do that.
DR. SIEBER: One of the disappointing
things to me is that not only does it seem a little
arbitrary and we don't know the answer now, but we
never will know it with the exemption on 50.65.
MR. STROSNIDER: This is Jack Strosnider,
and I would like to make a few comments on this
because it starts getting directly to the treatment
issue, and I guess just a few thoughts.
One is with regard to trying to quantify
how this distribution shifts. And I think we have to
recognize that we can't quantify right now what the
special treatment rules actually add in terms of CDF,
or LRF, or any of these.
We don't have that quantified to begin
with. There was a lot of judgment and the intent was
to maintain a high confidence and a high reliability
functionality.
DR. KRESS: Is there a database out there
for failure rates of things like these that have been
given the commercial treatment?
MR. STROSNIDER: There is some, and South
Texas did some work, and it is referred to in our SER.
MR. GRANTUM: On page 53.
MR. STROSNIDER: On page 53. They looked
at NPRDS, the nuclear plant reliability data system,
for information, and it indicates here between the
years of 1977 and 1996, and to try and answer the
question of reliability of commercial versus safety
related components.
And in fact I think the staff has tried
this a few times in the past, and I think the
conclusion was that there was no appreciable
difference in the reliability. In fact, it is not
like you can actually tell if you were given a
component and you tested it a while, it is kind of
hard to tell if it is safety related or commercial.
MR. STROSNIDER: I would just add that I
think that is true based on the sort of data that was
looked at, where you are looking at unavailability
times and that sort of thing.
But I want to come back again to that I
don't think you should really expect that there is a
quantitative correlation here, or that it is easily
quantified in terms of the change in treatment, and
what the quantitative effect is.
And to recognize a comparison with
commercial equipment and that the data does not
include would this equipment function under seismic or
harsh environments, or some of those things.
So you can get some insights certainly,
but also some of the specific things that we are
trying to look at are not directly addressed by that
database.
But that tells you that you shouldn't
expect necessarily a quantitative relationship, which
is a valid question, and in the ideal world you would
like to have that. But then if you go another --
DR. KRESS: Well, I just want a good
feeling that in fact --
MR. STROSNIDER: And to go another step,
too, talking about the sensitivity analysis, and what
does a factor of 10 tell you. We discussed this at
the last meeting on treatment, in terms of potential
for common cause failures, and you could argue that
changes in treatment could potentially influence that,
and that was one of the subjects that we did discuss.
And I would just point out in the safety
evaluation, which as John Nakoski indicated, is sent
to the licensee, we stated our understanding of that
sensitivity study and how it addresses the potential
for common cause failures.
In fact, the licensees indicated that for
certain groups of components, like MOVs, that it was
not explicitly addressed in their sensitivity studies.
But we put down our understanding of it so
that we could get confirmation from them when they
look at this to see if it is accurate. So those are
all issues that come up in terms of the sensitivity
studies, et cetera.
But the thing that I want to point out is
that the finding that we were trying to look at, and
I am getting a little bit ahead here, but what the PRA
staff told the engineering staff is that you want to
maintain functionality of this equipment.
And it might be with lower confidence, but
you need to maintain functionality because I don't
think that anybody concluded that these sensitivity
studies indicated that if you had common cause
failures of some significance that it might not impact
the CDF and LRF values.
So when we start to talk about treatment,
I would just point out and recognize that the intent
is to maintain functionality throughout the life of
the component under the design basis conditions.
DR. SIEBER: Well, the point that I was
trying to make though is that the maintenance rule is
a way to gather information, and with the NEI Maint
9.301, there is a lot of flexibility in how you group
components.
You can group them by TRAM, by system, or
by individual component, and it seemed to me that just
keeping what goes on in the maintenance rule, since
they already do it now, is not such a great burden.
And that you maybe get a better sense
after a process like this was in process for a couple
of years as to what those failure rates really were
and how they would change, provided there was enough
data to do it. You know, you don't have 50 failures
a day and so it takes a lot time to accumulate data.
MR. STROSNIDER: But I do think that if
you are going to try to address some of these issues
through the maintenance rules, you would have to make
sure that that program is really looking at some of
these issues that are addressed by special treatment.
Again, harsh environment and seismic
conditions, and those are tough things to get at, and
that's why I said that in the end that you end up
having to apply considerable judgment, in terms of
what is the appropriate level of treatment.
DR. SIEBER: Yes, but the problem is
without the maintenance rule, you have no
documentation, and so there is no chance of doing an
analysis, even though you may not know what the answer
is. Well, that is my feeling on that subject.
DR. KRESS: Could you give me a better
idea of what you exactly mean by maintain
functionality?
MR. STROSNIDER: Well, let me go back and
say let's start by thinking about what it is that we
are looking at exempting. If you look at the special
treatment rules, at least to some extent, or I think
to a large extent, the purpose of those was to make
sure that that structure systems and components, when
called upon to mitigate an accident, would perform
their safety related functions.
And so this is mitigating an accident, and
so you are into a situation where perhaps there is
steam, radiation, humidity, whatever the environment
is, and the component has to be able to function, and
that is to deliver its safety related function under
that environment.
Similarly, if you postulate the seismic
event, that it will perform its safety related
function under that seismic event. So those are two
easy examples of what the special treatment rules were
intended to address.
Now, the question is if you go look at
what is required by those rules and everything, can
you for low safety significant components, can you
relax some of the treatment, and the amount of rigor
that is in those special treatment rules and to come
up with a program that would still maintain
functionality, but might not require as much in terms
of whether it be documentation or testing, or whatever
it is.
DR. POWERS: I guess I am still struggling
with the difference in your mind between functionality
and availability is.
MR. STROSNIDER: Well, there is in my
mind, because if you look at availability, if a
component fails to function under normal operating
conditions, then you have probably got a pretty good
indication that it is not going to perform under these
more challenging conditions that I referred to.
But if a component does function under
normal operating conditions, or if it is not called
upon to function under normal operating conditions,
but is called upon during the accident and the more
severe conditions, you have to ask yourself are you
getting information that says, yes, will it operate
under those conditions.
Those are very difficult things to get and
they always have been, and that should not be a
surprise. When you talk about collecting information
on-line, how often do you really do a test under those
sort of environments or seismic conditions? You
don't.
That's why the special treatment rules try
to address that in terms of the other elements that we
will get to in the treatment program. You know,
procurement, and maintenance, and those sorts of
activities.
CHAIRMAN APOSTOLAKIS: So functionality
here means the ability to function as expected? It
has nothing to do with the probability that it will do
it?
MR. HOLAHAN: It has to do with
capability.
CHAIRMAN APOSTOLAKIS: Capability.
DR. SIEBER: I think a better comparison
is to equate availability with operability, and
operability according to the rules is a pretty high
standard.
You have to meet a number of rigid
parameters for a component, and you can fail to do
that, and it won't be operable or available, but it
will still function, because maybe the service demand
is not as severe as the envelope in which the
component is supposed to be maintained to be operable.
I don't know if that makes sense or not.
MR. HOLAHAN: I know of some utilities who
use the terminology of big "O" operability and little
"o" operability, because there is some legal
implications.
CHAIRMAN APOSTOLAKIS: There is no Greek
"O" there. Remember Greek "O"? Well, let's go back
to the categorization, because we are mixing too many
things.
And the thing that concerns me is that
-- well, first of all, I agree with what Gary said
earlier and what is in the FSAR, that the overall
approach makes a convincing case, at least in my mind,
that the risk 3 and risk 4 components belong there,
and we can discuss their treatment and so on. But
what worries me is that if we approve this and list
everything they have done, and put it in the FSAR and
so on -- and I will use a word that was used a lot in
our meetings with the Commission, that we will ossify
the methodology, okay?
And that is not only -- I mean, that
concern doesn't only have to do with the importance
measures, but it is also the questions that the expert
panel used with some issues here regarding the degree
to which they overlap and so on, and evidently nobody
really thought about them.
It was a purely -- and that reminds me a
little bit of the old days when we were dealing with
expert judgment. If an academic was doing the
exercise, they would tend to invite academics, and so
they would talk about pumps in the abstract.
If engineers were to do it, they would
invite pump experts, and they would have no idea as to
the normal part of dealing with expert opinion. It
dawned on us with 1.150 and later studies, that
actually you need both kinds of expertise.
And you need the normative expert and the
substantive expert, and here I think the expertise
that was missing was the normative kind. You know,
the structuring, and maybe it was missing in the
actual work that you did.
But if I look at the paper that I have in
front of me, and questioning the overlapping, and at
the same time if I read the whole thing, I say, my
goodness, the overall conclusion makes sense. It does
make sense.
I may pick one page and say why did you do
it this way, and you could do it better, but does that
really change the conclusion? But what worries me is
that what if you have 20 licensees tomorrow who come
and repeat everything that South Texas did and a
factor of 10?
Why not a factor of five? It seems to me
that to shift the mean value by a factor of five is a
heroic effort. You are shifting the mean.
DR. KRESS: That would be a hard thing to
do.
CHAIRMAN APOSTOLAKIS: And you are taking
the whole distribution and putting it up there, you
know. And judging from the weak evidence we have,
Gary, you said that they couldn't tell the difference
between the failure rates.
So all this stuff, it would be nice to
have some incentive to think about it without
necessarily -- you know how it is. If these guys
approve something, that's it.
MR. HOLAHAN: If they can get away with a
factor of five that would be an incentive.
DR. SIEBER: One wonders whether that
would make any difference.
CHAIRMAN APOSTOLAKIS: But you know how it
is. The moment it is approved though, everybody else
says we are going to get it, too, and that's it.
MR. HOLAHAN: I am not so concerned about
the ossification problem. It is not as though this is
the lead plant in an exercise where we expect other
plants to follow this model.
Remember that the overall context of this
is we are working risk informed regulation, Option 2,
rule making. And this is sort of a proof of principle
that shows that we are capable of defining a program
and a licensee is capable of implementing such a
program.
I think the issue of how to do this more
generically so that it applies to everyone still faces
us, and it is an integral part of Option 2 and the
rule making activity.
So I don't see this as the model that will
last and be used by many people. I see that as being
framed by how we deal with these issues in Option 2
and in a rule making context.
CHAIRMAN APOSTOLAKIS: And when is that
going to take place by the way?
MR. HOLAHAN: Well, we have already
started.
DR. SIEBER: Is there any more questions
on this first sentence?
DR. LEITCH: I am in the first paragraph,
and I guess that's all one sentence. So, yes. I am
concerned about the reliability of the instruments,
particularly control room instruments that the
operator uses to make significant decisions.
And there is a subset of those instruments
described in what I think is Reg Guide 1.97 if my
memory serves me correctly.
CHAIRMAN APOSTOLAKIS: That's it.
DR. LEITCH: And the operators are trained
in accident situations to specifically rely on those
instruments. And I guess my question is whether is it
fair to assume -- and I think it is, but I just would
like to hear confirmation, but is it fair to assume
that none of those instruments would have been
categorized as Risk 3?
MR. HOLAHAN: Well, let me answer the
question a little differently. The staff is approving
a process, and so we can't give you a list of how
these components fall out in the process.
As a matter of fact, probably most of that
categorization hasn't been done. We approve a process
and over a period of time a licensee will implement
this system by system. So many of those components
may not have been categorized yet.
DR. LEITCH: But what you understand of
the process, would you expect that the process --
MR. HOLAHAN: From what I understand of
the process, I would think that particularly the part
of the process that addresses the expert panel and the
look at the emergency operating procedures would go
directly to those instruments that are referred to in
the emergency operating procedures.
And that would push them into the high category.
DR. SIEBER: Well, this is question two in
the deterministic section on page 18, which tells me
that if it is in the EOP or an ERG, it is category one
or two.
CHAIRMAN APOSTOLAKIS: Now, one other
thing about ossification. The extensive use of
conservative assumptions in a risk-informed framework,
I think we ought to be very careful before we start
doing that.
And a factor of 10 is one, and I think it
is conservative from everything that I know about it.
MR. STROSNIDER: I guess I would just
suggest that we probably need to think about that. If
I could give some examples. There was a discussion on
just one of the open items that we had, which was how
you treat metering test equipment and whether you
found that that metering test equipment was out of
calibration if you needed to go back to some of these
slow safety significant equipment and recalibrate it.
The original proposal was not to do that,
and the only reason that I bring that up is because
there is the potential if you look at something like
that for treatment.
If you had something that was really way
out of calibration, and to go off and mis-calibrate a
set of equipment, such that it wouldn't function
-- and the shift there is much greater than -- could
be much greater than a factor of 10. We dealt with
that open item, and --
CHAIRMAN APOSTOLAKIS: A shift of what?
MR. STROSNIDER: In the probability of
functioning. If you take equipment -- and let's say
it starts at 10 to the minus 3rd probability of
functioning, and you go out and you mis-calibrate it,
it may go to a point where it is not going to
function.
And if you do that across a number of
different components, you could have an issue. Now,
like I said, that is an open item that we dealt with,
but when you start talking about treatment, there is
the potential to have impact on functionality.
And if you are starting at 10 to the minus
3rd, and you say I am going to go from one in a
thousand chance that it doesn't work to one in a
hundred --
CHAIRMAN APOSTOLAKIS: Yes, but mis-
calibration is not part of the failure rate as far as
I know. Mis-calibration is a human error that is
found separately, and they didn't increase that by a
factor of 10.
If a failure rate is due to random causes,
and it is very hard to say that going up by a factor
of 10, the mean value.
MR. STROSNIDER: I would suggest that
there is random causes, but one of the other issues
that you really want to think about when you are
talking about changing treatment is the potential for
common cause failures; common cause maintenance,
common cause calibration and the sort of things that
I was mentioning, which could affect more than a
factor of 10.
CHAIRMAN APOSTOLAKIS: Were these
analyzed?
MR. STROSNIDER: Well, again, I would like
to put that into the context of that is one of the
reasons when we get to the treatment discussion, where
we will say that the objective of the treatment
program is to make sure that these structure system
components will function, and that functionality is
being maintained.
And that is one of the reasons it is
important to put that as a goal of the treatment
program because of those kinds of considerations.
MR. HOLAHAN: I would like to go back and
say something about conservatism, because there is
some forms of conservatism that I think are
detrimental to a risk informed process and others that
are not necessarily.
If you make some conservative assumptions
in the PRA in some areas, you will distort the
perception of what is important and what is not, and
those are I think destructive. That sort of
conservatism will in fact change the importance
measures, and it will change what goes into the
categories.
The kind of conservatism associated with
picking a factor of 10, as opposed to something else,
I don't think distorts the results. It may put a
little more margin in some way in your decision.
It may restrict you in how many components
go in this category versus that one, but I don't think
it is as serious a concern as sort of distorting your
views so that you are not really focusing on the most
important things.
You are simply focusing on the things that
you assumed were problems, and drove those to be the
answers.
CHAIRMAN APOSTOLAKIS: On the other hand,
if a factor of 10 is used 2, 3, or 4 times, then it
becomes part of the tradition, and then the first guy
who cannot show that a CDF has been small with a
factor of 10 is stuck.
Now what do you do? If he dares go down
to a factor of five, all hell is going to break loose
again. So that is the danger of that, and also the
treatment of common mode failures, and taking the
whole importance of the therm, and putting it under
one component, that is also a conservative thing to
do.
And again we don't want to bless those and
have them there forever. For a particular regulatory
decision, I think conservatism is fine, but again this
works now and it doesn't work tomorrow.
And the whole idea of risk informing the
regulations is to be as realistic as possible.
DR. SIEBER: But it seems to me that that
kind of literary discussion would go on with the
writing of the rule and its companion reg guide, which
would be the suggested implementation; as opposed to
trying to somehow or other weave it into this
particular set of requests for exemption, provided
that those documents appear within my lifetime.
CHAIRMAN APOSTOLAKIS: So let me
understand you. You are asking STP to put all this
stuff in the FSAR, right?
MR. HOLAHAN: All this stuff?
CHAIRMAN APOSTOLAKIS: The thresholds that
they use for all --
MR. HOLAHAN: Yes. Yes, we are.
CHAIRMAN APOSTOLAKIS: So I guess you have
categorized all the components, right? Are there any
more?
MR. CHINSEL: Yes. We have done about
45,000 systems.
CHAIRMAN APOSTOLAKIS: How many all
together?
MR. CHINSEL: There is a few over a
hundred-thousand per plant.
CHAIRMAN APOSTOLAKIS: But these remaining
55,000 are not in the PRA and so the importance
measures are irrelevant, right? It would be part
basically of the expert --
MR. CHINSEL: Some of the components are
still in the PRA that we have not yet categorized.
MR. HOLAHAN: I think we are going system
by system.
MR. CHINSEL: That's correct, going system
by system.
CHAIRMAN APOSTOLAKIS: So you are blessing
this particular process with the 50,000?
MR. CHINSEL: Yes.
DR. SIEBER: And that's probably why you
are putting the metrics in there specifically as
numerical value.
MR. HOLAHAN: I think we are also putting
it in there --
DR. SIEBER: It describes the process that
they are using.
MR. HOLAHAN: Yes. I think we are also
somewhat constrained by the fact that this is an
exemption, and that we have not been through a rule
making process, and in fact we are making a finding
that this is an appropriate substitute for the normal
regulations in these areas.
I think we were probably somewhat more
constrained in being less flexible in how a licensee
can change this process than we may be at the time
when the rule making is done.
If you think of it analogously, we have
50.59, and which allows licensees in other areas in
effect to make changes and through a certain set of
tests, they are basically saying that they judge that
they are still in conformance with the regulations
under this change situation.
In this case, if we were to allow
additional flexibility, in effect what we are saying
is that the licensee doesn't meet the regulations, but
we have defined some other process.
And to allow them to change that process,
and for them to decide that they still don't meet the
regulation, but they have some other standard which
they decided as good enough to grant them an
exemption, it is not something that we would normally
do.
I mean, we really don't have a process for
doing that. So there are some constraints associated
with the fact that this is an exemption, as opposed to
a license amendment, or even a rule change.
DR. SIEBER: Okay. John, maybe we can
move on.
MR. NAKOSKI: Okay. This is John Nakoski
again. If we can get to bullet two on slide three.
This deals with the conclusions that we drew on
treatment, and what we concluded was that the
alternative treatment program proposed by South Texas
includes the necessary elements, and that if South
Texas effectively implements them, can result in the
safety-related low risk components remaining capable
of performing their safety functions under design
basis conditions.
CHAIRMAN APOSTOLAKIS: Why do you need to
say if effectively implemented? I mean, was there any
intended proposed alternative treatment program and
was that effectively implemented?
MR. NAKOSKI: It is not -- it doesn't
indicate that, but we believe that it would be
ineffectively implemented. It is just that it is an
indication that the burden for effective
implementation remains with South Texas.
MR. NAKOSKI: This is Jack Strosnider, and
just to point out that is where that burden always is.
The licensee has that responsibility, and it
emphasizes that, but it also was intended to point out
the fact that the staff did not do a detailed review
of how this treatment would actually be implemented.
Normally our more traditional approach is
that we get down into looking at procedures, and we
get down into a lot of very specific issues. We tried
to avoid that in this review.
The reason for that is that recognizing
that this is, given the robust categorization process,
that this is low safety significant components, so
that we didn't need to go into that level of detail.
But we wanted to make sure that the people
understood that we didn't, all right? And what we
looked at was the high level programmatic elements,
the expected outcomes, and I will acknowledge that in
some cases that we expanded on what was meant by some
of that, in terms of what we thought needed to be in
the FSAR.
But we tried to focus, and you have heard
some of the prior discussions on the what's; that is,
what is expected, versus how it is actually going to
happen.
And it would have been a different review
if we really had gone down into how are you
specifically going to treat this piece of equipment or
that piece of equipment.
DR. SIEBER: I think one of the
interesting things is that the way that this is laid
out is pretty good, because it actually quotes what is
going to go into the FSAR, and when I examined the
proposed treatment requirements, I noticed in a number
of places where decisions are being made, or where
things are happening, and engineering decisions, like
equivalency, and that kind of stuff.
And in the training program, my program is
just as good as the vendor's recommended program. The
last sentence in every one of those is that no
documentation is required. I don't see how you can
manage your engineering department or your training
department without documentation, which is the basis
upon which you make decisions.
So I am wondering if you are putting the
time in to make the decision, or to do the analysis,
why can't you spend a little extra time and write it
down.
MR. NAKOSKI: This is John Nakoski. It
is not that we would not expect South Texas to have
some sort of documentation. It is just that we would
not require that to be documented.
For their business practices, you are
right. They would need to have some sort of records.
DR. SIEBER: I don't understand how you
could do a good job of organizing engineering without
writing down the basis of the decisions that you make.
And I guess the other thing that strikes
me then is what if issues come up where enforcement is
necessary by the NRC, you wouldn't have a basis upon
which an enforcement action could occur, because they
wouldn't be required to keep the record.
MR. STROSNIDER: And there was actually a
lot of discussion internally with regard to
documentation. Of course, again trying to look at
this from a risk-informed perspective, and looking at
various areas where you can reduce unnecessary
regulatory burden, the discussions were what sort of
documentation is really essential and needs to be
maintained in accordance with existing special
treatment, and what can we let go of in a sense.
We talked about equipment qualification as
an example, and that is one area where if you look at
the special treatment rules, there are some
significant requirements for documentation, and
quality assurance, et cetera.
DR. SIEBER: Yes, I didn't discuss those.
MR. STROSNIDER: And if you accept the low
safety significance of some of these components, then
you might not need that same amount of rigor. Yes,
the expectation as I said, and if you look at each one
of the elements in this program, there is an
expectation stated at the beginning of it in terms of
maintaining functionality.
Whatever the licensee needs to do in order
to keep track of that, they would have to do, but that
is their determination at this point. EQ might be an
example where you say if you want to understand the
qualified life, and at what point do you need to deal
with that.
And the expectation is that they would
maintain the functionality of this equipment, and if
there is something that needs to be checked at some
period, then they would have to do that.
But we are not prescribing, like what is
prescribed in the special treatment rules, what is
necessary, so that they could get by with just what is
necessary for them to meet these outcomes.
So it is a different approach and you have
to look at it and recognizing its low safety
significance components.
MR. HOLAHAN: I think you also have to
look at this issue in the context of the new reactor
oversight process, and which the expectation would be
that because these are low safety significant
components, it is very unlikely that they will ever be
above the licensee response zone.
And so you would expect the licensee to
find and fix these issues, but you wouldn't expect
them to require any elevated attention by the NRC. I
am not saying it is impossible, but normally you
wouldn't expect that.
DR. WALLIS: You took the trouble to put
in this phrase of "if effectively implemented by the
licensee." That kind of implies that someone is going
to check up on it. So what is the mechanism for
checking up on this effectiveness of implementation?
MR. STROSNIDER: I think you are looking
at the reactor oversight process. I don't think it
would be the intent to focus our inspections on low
safety significant components unless something drives
you into that from the perspective of the oversight
process, in which case then it would be dealt with.
DR. WALLIS: If you are going to take the
trouble to mention it though implies that you are
saying that someone has to check up on it in some way
from time to time, and I am just wondering where it
falls in the inspection process.
MR. HOLAHAN: In the reactor oversight
process, because it is a low safety significance, they
are not likely to be focused on. So the normal place
to see them is in the inspection of the corrective
active program, which is one of the central elements
of the inspection program.
DR. SIEBER: And no exemption was
requested from any element of that.
MR. NAKOSKI: That's correct. Corrective
action requirements of Criterion 15 and 16 of 10 CFR
50, Appendix B, continue to apply.
DR. SIEBER: That's right.
MR. HOLAHAN: And the reason that the
reactor oversight process includes corrective action
is because obviously we have put a lot of these lower
issues into the licensee response area, and so we need
to have some mechanism -- and not just for these
specific components, but for the whole program -- to
see that they are responding effectively to all of the
issues that are below the green light threshold
DR. SIEBER: So the documentation
obviously for Risk 4, and also now for Risk 3, is of
no regulatory concern?
MR. HOLAHAN: That's correct. Quality
records would not be required.
DR. SIEBER: On the other hand the
licensee has to understand that even in a coal plant
that you keep records when you maintain things, and
when you calibrate them, and what engineering
decisions that you make, and operating difficulties,
and that type of thing. That is standard business
practice.
MR. HOLAHAN: I think we have talked about
documentation, but this exemption does not remove
documentation completely. There are certain areas --
DR. SIEBER: I know that, right.
MR. HOLAHAN: -- of design and corrective
action and documentation will still be there.
MR. NAKOSKI: Okay. We can move off the
third slide, and go to findings that the staff made.
These are really findings that we have to make in
order to grant the exemptions.
The first one is that we found that
relaxing the special treatment requirements on these
low risk components poses no undue risk to public
health and safety.
We also found that the categorization
process is a material circumstance that wasn't
considered when the special treatment requirements
were adopted.
And we may have considered risk insights
when some of these regulations were adopted, but we
have never I believe considered an integrated decision
making process like proposed by South Texas.
We have also concluded that it is in the
public interest to grant the exemption. That is
primarily that we have improved efficiencies and
effectiveness in the application of our oversight. We
target our attention better on those risk significant
components and functions at South Texas, and South
Texas can do the same.
Now, we also found that the proposed SFAR
section is a sufficient basis for granting the
exemptions.
South Texas requested -- I believe it was
18 -- exemptions from 18 regulations, and to one
extent or another, exemptions for low safety
significant, non-risk significant components that fall
within the scope of these regulations.
And the ones that are listed here on the
slide are being granted. If I can talk just a little
bit about some of the rules and where there are some
limitations.
On 10 CFR 50.49(b), which would exempt
essentially all of these LSS and NRS components from
the scope of the environmental qualification rule,
there are some design aspects that continue to apply,
and it is covered in the safety evaluation.
The exemption to 10 CFR 50.59, really it
only applies to changes to treatment that result from
the granting of these exemptions. For any other
change to the FSAR or any other licensing basis
document, the requirements of 50.59 continue to apply.
The Appendix B --
DR. SIEBER: The change to treatment was
to cease maintaining the item and turn it into a
breakdown of maintenance, where would that fall under
50.59?
MR. NAKOSKI: If it was covered by the
scope of an exemption that we granted, they would not
have to seek prior staff approval for that. If it
wasn't covered by an exemption that we granted, they
would have to come in if when they were doing their
50.59 evaluation that it required prior staff review
and approval. Did that answer your question?
DR. SIEBER: Even if it was Risk 3?
MR. NAKOSKI: If it was outside the scope
of an exemption we granted, yes, they would have to
come in for -- if it was for the threshold of 50.59.
In other words, if they have a commitment
in their licensing basis that isn't part of this --
DR. SIEBER: Well, you have a commitment
to the PM program, but you exempt portions of that,
basically saying that just a PM program to match
commercial standards, whatever they are.
Then there is a phrase that is in there a
couple of times that the licensee is not obligated to
list all the commercial standards, and what the State
of Texas says they ought to do, which could be the
State of Pennsylvania, or Maryland, or whatever. They
all do the same stuff.
And so I could picture taking that to its
extreme limit, and somebody deciding that I am going
to save money and I am not going to change the oil
except every 10 years.
MR. HOLAHAN: I don't think that you could
make that decision and be consistent with a
description of the program in the FSAR.
MR. NAKOSKI: That's correct.
MR. HOLAHAN: And what this is basically
saying is that you can't change -- you can change the
programs so long as it still conforms to what is in
the FSAR, and there is probably a lot of flexibility
for doing that.
MR. NAKOSKI: I think there is actually
confusion, and this is John Nakoski again. The 50.59
process is basically -- the exemption that we are
granting them for 50.59 basically applies to changes
that they will need to make to their FSAR as a result
of the exemptions that we grant.
There is going to be an addition. They
are going to add a section to the FSAR that lays out
their categorization and alternative treatment
processes.
In there also will be a change control
process for how they control changes to that Section
13.7 of their FSAR. It kind of lays over any
requirement that 50.59 would impose on that section.
So if the wanted to change the treatment that is
described in Section 13.7 of their FSAR --
DR. SIEBER: They have to ask you first.
MR. NAKOSKI: -- and if it reduces the
effectiveness, it has to come back in, because it will
undermine or has the potential to undermine the basis
for our exemption.
DR. SIEBER: And 50.65.
MR. NAKOSKI: And 50.65, the maintenance
rule, there is recently 50.65(a)(4), which came into
effect, and that continues to apply to all components
within the scope of the maintenance rule.
DR. SIEBER: Maybe to help us, you could
tell us what (a)(4) does.
MR. HOLAHAN: And I am drawing a blank.
Well, (a)(4) requires licensees to assess and manage
the risk associated with taking components out of
service.
DR. SIEBER: Okay. And since these are
low risk things, it is not hard to manage.
MR. HOLAHAN: Right.
DR. SIEBER: On the other hand, you lose
again some of the tracking and records, like taking
20,000 components out of the maintenance rule, and
that gets back to my --
MR. NAKOSKI: I will say that part of the
South Texas monitoring program is if a low risk
component impacted an HSS or MSS function, they would
capture that failure. So that data would be captured.
But if its failure impacted or affected a
low risk or non-risk function, it wouldn't be
captured. So again it is targeting the attention on
the high risk, medium risk functions that we want to
focus on.
DR. SIEBER: And if I go through the
deterministic screening questions, it would seem to me
that there would not be a low risk component that
would affect or disable a high risk frame, right,
because it wouldn't get screened out. It would not
get screened into a risk series.
MR. NAKOSKI: That is our expectation;
that if it does occur that it would be infrequent.
DR. SIEBER: And it would almost seem like
it was impossible. On the other hand, you are
expecting functionality of even RSC-3 components, but
you won't have a record.
MR. NAKOSKI: I'm sorry, but I didn't
catch that.
DR. SIEBER: There won't be a record as to
whether it was functional or not.
MR. HOLAHAN: But from a safety point of
view, it isn't that important.
MR. NAKOSKI: I would modify that to say
that there wouldn't necessarily be a quality record
under an Appendix B program.
DR. SIEBER: You aren't requiring any
record?
MR. NAKOSKI: That's correct.
MR. HOLAHAN: Except corrective action
program and design basis.
MR. NAKOSKI: And design control. Under
10 CFR 50, Appendix B, quality assurance criteria, as
we discussed previously, Criterion 3, design control,
and Criterion 15, with non-conforming materials,
components, and parts; and 16, correction actions,
continue to be in effect.
The exemption to Appendix J is for type
leak rate testing only; and the exemption to Part 100,
the design requirements continue to apply as described
in Part 100.
And the exemption is to the specific
engineering analysis and testing requirements in Part
100.
There were some exemptions that we
determined that we would not grant, and primarily the
general design criteria -- really because what the
licensee proposed met the regulations for GDC-1, and
this relates to the other two at the bottom of the
slide, 50.35(b)(6))ii), and 50.54(a)(3).
Early in the review process, we recognized
and South Texas recognized that really we needed to
have a quality assurance program updated to reflect
the changes in treatment, and if for nothing else, as
a record keeping tool.
And as a result, they submitted and we
found acceptable as discussed in the safety evaluation
their proposed revision to the operating quality
assurance plan, and so that met the requirements of
GDC-1.
GDC-2, 4, and 18, they deal with design
requirements, and the design isn't being changed under
this exemption or under Option 2. So really they
don't fall within the scope, and there is no special
treatments for which exemptions should be granted.
Now, as I said, the last two, we
determined that an update to the QA program should be
done and South Texas agreed. So we aren't granting
those exemptions either.
And with that, that is the prepared
material that I had for the meeting today, and we
would be happy to answer any additional questions.
DR. SIEBER: I suspect there are no
shortage of questions. If anyone would like to ask
questions that are disturbing them at this time, this
would be a great chance as we are ahead of schedule.
DR. POWERS: I guess my question is have
we resolved the question.
DR. SIEBER: Well, it all depends on what
you would call resolution, and that it may not
necessarily be pertinent. On the other hand, I think
that the question that I have asked will cover the
areas of concern, and we are trying to decide now how
important my feelings really are to the success of
this project, and that will take a little bit more
thinking on my part.
But I am sure that others have asked a lot
of questions of me that seem to be pretty burning.
DR. POWERS: Let's come back to the
question on the cut-offs for FSER vesely -- well, the
issue is that they picked some values and used them in
this application. But it seems to me that those
weren't particular outlandish values that they picked.
In fact, they seem kind of common, but
there seems to be some interest in claiming that those
aren't not be a template for others to use, and so my
question is why not?
DR. SIEBER: Well, that was my comment of
10 days ago, and it was really responding to Dr.
Apostolakis' remark about ossifying some methodology
industry wide, and that was really the purpose why I
said it shouldn't be bound to use those screening
criteria for bound to use questions that they asked in
the rating system that went alongside that.
And the general methodology was okay, and
I basically say that because my personal opinion
really is it doesn't make a lot of difference how you
do the categorization provided that you have no heavy
hitters in there, and that you meet the criteria of
Reg Guide 1.174. And so it was an attempt to satisfy,
and it could go either way.
DR. KRESS: My problem with that, Dana, is
two-fold. One of them is that those importance
measures have the absolute value of the CDF and the
LRF, if you are using LRF also, in the denominator.
Therefore, almost automatically it makes
them plant specific. Now, that may look like a simple
fix. You just take the numbers and multiply them by
the -- or ratio them by the CDF, and you have got
another set of numbers.
MR. HOLAHAN: Or perhaps we should put the
safety code quantitative objectives in the
denominator.
DR. KRESS: That would be another way to
fix it.
DR. SIEBER: But that may change
categorization.
DR. KRESS: So that was one of my
problems. The other problem that I had though -- and
I think it is a deeper problem -- is that I am not
quite sure that I agree with Jack that the
categorization process doesn't matter.
You have got the expert opinion, and you
could use a ouija board, and you could throw darts,
and as long as you validate it with your sensitivity
analysis, but I am not quite comfortable with that
because I have a feeling that there is a way to decide
what thresholds to use for RAL and FSER vesely that
would give you a given change or a given percentage
change in CDF and LRF.
I am not certain of that because I have a
real problem -- what we found with each of these RALs
is the individual RAL for each component, and I don't
know how to combine those for a bunch of components.
You just don't multiply by a number of
components, or you don't add them up, but what I am
afraid of that we will quit here. When I think there
may be somewhere in these definitions of RAL and FSER
vesely a way to actually technically defend their use
in bounding the group RAL, and the group LRF, and I
just did not want them to quit here and say now it
doesn't matter.
But if there is a way technically to come
up with that group RAL, that would be a value for a
lot of the risk-informed things that we are going to
do later on, and we may want to use those things.
And it is extension of the technology of
using RALs and FSER vesely, and other important
measures, to the other risk informed processes that
worries me.
And I just did not want them to quit
because while we have got this sensitivity study or an
uncertainty analysis, whichever you want to use, to
validate it, because it doesn't matter how you got
there.
I think it does matter because I think it
is going to be used in other processes and it could be
misused, and I think it is an opportunity to further
develop the concept so that it is technically
defensible. That was my worry.
DR. SIEBER: And I guess if I were South
Texas, I would wonder why I am getting stuck with
doing the extra part.
DR. KRESS: And that is the other part.
I didn't to penalize South Texas, because I do agree
that they have jumped through enough hoops and that I
do believe that the sensitivity study does confirm
that their process fits into the 1.174.
I just didn't want to -- I think this is
an additional research project that needs to be done,
and I didn't want to bless the process as it is for a
group RAL or a group FSER vesely, and I wanted to be
sure in the whole letter or whatever we do that we
don't bless that, because I don't want to stop with
that.
CHAIRMAN APOSTOLAKIS: Isn't that a little
related, Tom, to the issue identified with respect to
the risk-based performance indicators?
DR. KRESS: It is related definitely, and
I am afraid that there may be other places in the
risk-informed process where it is related. I didn't
want to leave the impression that just because it is
okay to give South Texas their exemption because they
did this that we have a process that is technically
defendable, in terms of actually determining -- well,
the process is here because it was confirmed by the
sensitivity analysis. That is the technical defense
of it. You may not have a sensitivity analysis for
all these other things.
DR. SHACK: You are always going to have
to compute, or bound, or estimate Delta-CDF for it to
work.
DR. KRESS: Well, this is what I am
saying.
DR. SHACK: The sensitivity study in this
case is a substitute for computing Delta-CDF.
DR. KRESS: What I am saying though is
there may be a way to use RAL, and FSER vesely to
determine that bound without going to the sensitivity
analysis if you did it right.
That is what I am saying ought to be
developed. You wouldn't have to do the sensitivity
because we were able to do the sensitivity here
because we got a good warm feeling that Factor 10
really does bound the effects.
We may not have a warm feeling about some
other thing, and we may not be able to do this
calculation. It would be useful to have a RAL and a
FSER vesely that you actually knew did bound a group
effect, and that is what I am saying.
CHAIRMAN APOSTOLAKIS: We can put it in a
different way. I think it is defensible the way it
is, but we wouldn't want it to stay that way. I mean,
we want it to stay defensible. We would not want the
methodology to be frozen for all these reasons.
DR. SHACK: Well, I would agree with that.
I would look at it in a different way. I mean, we --
CHAIRMAN APOSTOLAKIS: There is always a
third way.
DR. SHACK: When you select these
components, you are satisfying other things other than
the Delta-CDF and the Delta-LRF, and you get other
things.
You know, as we argued, the FSER vesely
looks at the risk significant components, and the RAL
looks at the stuff with the low failure rates if it is
really safety significant here.
You are gathering things together, and so
those populations that you do gather and test, and see
if the Delta-CDF have different characteristics, and
I think that should be researched.
DR. KRESS: Well, I also felt that this
was a one-way test, and that you took those components
that were downgraded and did all of them with a factor
of 10. But you had 40,000 other components that you
didn't do that to.
And if you did the FSER vesely and RAL
correctly for group components, you may find out that
some of those actually would have been risk
significant; whereas, they weren't even -- you didn't
--
DR. SHACK: The reason that you had a FSER
vesely for a RAL was in the PRA.
CHAIRMAN APOSTOLAKIS: Well, let me give
you another example and a possible improvement. Did
you consider at all the idea -- and this question is
addressed to South Texas -- of surrogate components
like they use in risk-informed inspections?
DR. KRESS: And that's what I had in mind.
You could surrogate some of those other 40,000.
MR. GRANTUM: There are some components
that are surrogate components when you look at the
components like diesel generators that encompass large
skid mounted equipment.
CHAIRMAN APOSTOLAKIS: And how about the
thousands of components that are not in the PRA? Just
like pipes are not in the PRA, but in the risk-
informed inspection program, they consider -- well, at
least the Westinghouse approach, considers the
surrogate component.
So you look at the impact of the failure
of that pipe on that component and that super
component isn't in the PRA. I mean, that is a lot of
work, and you don't necessarily have to do it in your
case. But did you consider it at all?
MR. GRANTUM: Yes, that has been
considered whenever we have talked about the
applications of risk-informed in-service inspection
and that was in fact some of the discussion on how
robust the categorization process was, because there
was an issue about -- well, we contended that we did
look at surrogate components.
And taking out a section of a pipe or
several piping segments could be the same as assuming
that the pump has failed, but have the same impact on
the CDF.
CHAIRMAN APOSTOLAKIS: And that is an
inspection problem?
MR. GRANTUM: Right. But it is also in
the PRA, because we had the FSER vesely of that
component failing, which one could make an argument
that the piping segments would be the same.
I would say that the staff had concerns
about that because they indicated that they didn't
think that accounted for dynamic effects; pipe failing
and special interactions types of effects.
CHAIRMAN APOSTOLAKIS: But the exemption
request, this one, and not the risk-informed
inspection program; did you do any of these surrogate
component business?
MR. GRANTUM: Not --
CHAIRMAN APOSTOLAKIS: Or is it strictly
based on the expert panel --
MR. GRANTUM: It is based on the series of
sensitivity studies that PRA comes up with a statement
of the importance based on the 21 sensitivity studies,
the working group combines the deterministic
questions, and the expert panel approves that.
So the surrogate components that you are
referring to weren't directly done as part of the
categorization for this.
CHAIRMAN APOSTOLAKIS: If I take a
component that is not in the PRA, and the expert panel
categorizes it based on the five questions, and there
was no further analysis to see whether that component
could belong to a bigger component that is already in
the PRA so I could have some sense of what would
happen if we do it the same way for the --
MR. GRANTUM: Well, yes, we answered the
five questions, and we are asking the question could
it fail a function.
CHAIRMAN APOSTOLAKIS: And then one could
conceivably find the RAL for that system and somehow
come up with an intelligent method that Tom is asking
for.
MR. GRANTUM: Right.
CHAIRMAN APOSTOLAKIS: Again, this not
something that you might have done, but that could be
an improvement in the matter.
MR. GRANTUM: Well, with a series of
sensitivity questions, I would say the answer is yes.
I mean, for looking at all the questions that we
asked, it is subsumed in those answers.
DR. SIEBER: When I think what Dr. Kress
said, that he could eliminate the sensitivity studies
and have the proper definition of the thresholds for
the importance measures, I guess then that I would
object to that.
DR. KRESS: I don't know if it is possible
or not.
DR. SIEBER: I think the regulatory basis
-- what you are doing here is Reg Guide 1.174, and
without the sensitivity studies, it can't apply.
DR. KRESS: Oh, yeah, because you are
bounding the delta, if they actually bond the delta,
but I don't know if it is possible or not.
DR. SIEBER: I guess you could, but I
would still like to see it directly applied the way
the regulation states, as opposed to --
DR. KRESS: But you may not be able to do
that all the time.
MR. HOLAHAN: Those two could come
together, if for example, you could calculate the
Delta-CDF contribution at the component level, and
then you simply add them up, and that is equivalent to
doing the sensitivity study.
So you pick a bunch of small ones, but you
make sure that the cumulative effect is still small.
DR. SIEBER: Well, I guess I still don't
believe that South Texas ought to get that rock in
their knapsack.
DR. KRESS: Well, I actually wasn't
proposing that either.
DR. SIEBER: Well, nobody is proposing
that.
MR. GRANUM: Dr. Apostolakis, I have been
asked to clarify something. There are comments over
here that, no, we didn't explicitly go and take a
component, and extrapolate out in the form of a super
component to look at the impact of that.
On the other side of the coin, when we
looked at a component deterministically, if it was
going to fail a function or it would have failed a
risk-significant function somehow, it would have
gotten the same ranking as the highest significant
function that it was associated with.
CHAIRMAN APOSTOLAKIS: It was the panel
that did this?
MR. GRANUM: Right. I wanted to clarify
that, and I will allow my colleague here to further
clarify that if you would like.
MR. SCHNIZEL: Glen Schnizel, South Texas.
Now, again, if a component's model is in the PRA, we
looked at it from the function standpoint, and if
there are other components that are necessary to
satisfy that same function, if those components would
fail, they received essentially the same
categorization as would the PRA reflected. So, from
that perspective, that is how we captured that.
MR. HOLAHAN: Let me say something on this
subject, and that is that I share some of the
committee's concern, but not another part of it.
I am not a particular fan of FSER veselies
and RALs. I think there are a lot of limitations and
difficulties with them, and I think there is room for
improvement, and we ought to be encouraging that.
And I am supportive of that, and I think
the fundamental goal is to identify components issues
to be focused on, and also to be judging whether the
small change standard in 1.174 is met. I don't share
the committee's concern over ossification.
DR. SHACK: Well, Appendix T is the place
where ossification is concerned.
MR. HOLAHAN: Amen. That's right. I
think before we get to that point that there is plenty
of time to lay those issues out. Plus, the way that
we have been thinking of Appendix T, it would say that
you can do it this way, or you can propose something
else.
And the purpose of an Appendix T is to say
we are sure that this is okay, and so you can do it
without review and approval. I don't see that the
staff is in a mood or is not receptive to new and
good ideas. The whole reason we are here is -- this
whole thing is a new and different idea.
CHAIRMAN APOSTOLAKIS: Well, what happens,
Gary, until we have a new -- which could be some time,
and let's say you have three other licensees, and they
hear that South Texas was granted the exemptions, and
they go line-by-line, and they try to reproduce what
South Texas did.
Now, they might have problems because of
the extreme redundance that those guys would get, but
the --
MR. HOLAHAN: That could happen. As a
matter of fact, we are granting this for Unit 1 and
Unit 2. I mean, so you already have two. So what is
wrong with that?
DR. POWERS: Well, I'm ready to ossify
them.
CHAIRMAN APOSTOLAKIS: What?
(Laughter.)
DR. KRESS: Too late.
DR. POWERS: For the life of me, I have
not seen anything here that is going to change or that
causes any heartburn to people. The only thing that
looks at all suspectively is this business of okay,
suppose I take a low safety significant component, and
let's say it is dead and died.
And now I do the raw for the other
components and one or two of them might come up, and
we don't find that out. We don't know that. I don't
know why we don't do that. It seems like an easy job
to do.
MR. HOLAHAN: Except the number of
combinations is astronomical.
DR. POWERS: It is a modest common
editorial problem.
CHAIRMAN APOSTOLAKIS: It is modest when
you want to calculate a number, but actually doing it
is different.
DR. POWERS: I am sure that these things
could be imaginatively done.
MR. HOLAHAN: This is getting simpler all
the time.
DR. POWERS: I mean, that seems to be the
only thing that would represent a significant
improvement in the technology. Otherwise, I am ready
to ossify. Why not have somebody do it line by line.
CHAIRMAN APOSTOLAKIS: Wait. Wait. Has
anyone come to you yet or hinted that they might come
with Option 2 exemptions request using the top event
prevention methodology? That is really different.
MR. HOLAHAN: No.
CHAIRMAN APOSTOLAKIS: Nobody has done
that?
MR. HOLAHAN: I have not heard that. We
have had discussions of the top event methodology in
other contexts, and not as an exemption.
CHAIRMAN APOSTOLAKIS: Well, that would be
very different.
MR. HOLAHAN: I have not heard it. Tim
Reid, have you heard anything?
MR. REID: Top event prevention has been
discussed at some of our meetings, and those
individuals have attended our meetings, but I haven't
heard any exemption or any idea like that being
proposed so far.
CHAIRMAN APOSTOLAKIS: Okay. Because that
would be a very different approach. Okay. Thank you.
DR. SIEBER: Any further questions?
CHAIRMAN APOSTOLAKIS: Or comments.
DR. SIEBER: If not, Mr. Chairman, I think
we have concluded. Thank you very much, and I thought
it was very productive.
CHAIRMAN APOSTOLAKIS: Thank you,
gentleman. Well, we are due for a break. So we can
go with a break. We will recess until 3:35.
(Whereupon, at 2:53 p.m., the meeting was
recessed, and was resumed at 3:35 p.m.)
CHAIRMAN APOSTOLAKIS: We are back in
session, gentlemen. The last presentation of the day
is by Mr. Sorensen, ACRS Senior Fellow, and he will
talk to us about the general design criteria, and some
work that he did the last few months for us. Jack.
DR. SORENSEN: Thank you. This assignment
actually had its genesis during the ACRS planning
session, and the scope was basically to take a look at
the Federal design criteria and Appendix B from the
standpoint of their place in the grand scheme of
things if one is going to risk-informed regulation.
There was sort of an underlying thought
that Appendix A and Appendix B would be key to risk-
informed revisions to the regulations, and that
probably is not quite true.
The questions that I tried to address and
will touch on in this presentation -- and in the paper
which follows it -- are the GDC risk-informed as
written, and the answer to that question is yes,
insofar as that concept was understood at the time the
criteria were written.
The second question is are they an
impediment to risk-informing Part 50, and the answer
to that is that some are, and many are not, and we can
go through some examples of it later.
How can they be made risk-informed, and I
have addressed that in a very general way, and in a
somewhat naive way perhaps, but I hope in a way that
will be useful.
And the final question today apply to new
reactor types or non-light water reactors, and the
answer to that is that some do and some don't, and I
will try to touch on these.
The general design criteria as they exist
right now, and have existed since about 1971, are 55
individual criteria in six groups. The overall
requirements protection by multiple fission product
barriers and protection and reactor control systems,
and fluid systems, and reactor containment, and fuel
and radioactivity control, and the scope and content
of the individual criteria, vary very greatly from one
to the next.
DR. KRESS: What happened to 6 through 9?
DR. SORENSEN: Funny you should ask that.
I think I actually touch on that in a later slide, but
the earliest -- the GDC, as they exist now in Appendix
A to part 50, were published in February of 1971, or
incorporated into Part 50 in 1971.
The earliest version that I could find
was written in 1965, I believe. I found a memo from
Harold Price, who was then the Director of Regulation
to the Commissioners, forwarding general design
criteria for consideration. There were 27. And the
evolution of the criteria as far as I can tell was
primarily in negotiation between the staff and the
ACRS over a period of several years.
Following that 1965 version, I know that
around 1969 that there was a version published for
comment that contained 70 criteria, and they were
numbered consecutively from 1 through 70.
When they were finally incorporated in
Appendix B, some had been combined with others, and
some had been dropped, and for reasons which are a bit
mysterious, they tried to maintain something of the
original numbering scheme.
So there are gaps in the numbering scheme.
They reflect the state-of-the-art in reactor design at
the time that they were published, and when we get
into looking at individual criteria that becomes very
evident.
Another observation is that they reflect
the phenomenology important for light water reactor
safety. The early version that I mentioned, the 1965
version, clearly made an attempt to cover other
technologies that are references to unclad fuel,
vented fuel, and other features that are not typical
of light water reactors.
What evolved into the 70 criteria and
later into the 55 is clearly focused on light water
reactor technology, and indeed the introduction to
Appendix A says that.
And the criteria contained 4 or 5
different kinds of information, and in hopes that it
might at some point be useful, I tried to characterize
them in that sense.
Typically, each criteria either
establishes a need for conservatism, a list of things
that need to be accounted for, which I have decided to
call completeness. They call for a capability to be
provided.
They call for reliability of some of the
systems or functions that are required, or they simply
require a defense in depth feature of one kind or
another.
In the package of material that I gave
you, at the end of that, there is a spread sheet that
summarizes all 55 criteria, and some of the different
ways that I have tried to characterize them, though I
don't plan to use that directly in the presentation.
But it might be a useful reference at some point.
I have also included in what I gave you
verbatim copies of the text of Appendix A, the general
design criteria, and Appendix B, the QA criteria, in
case you want to refer to those.
In the introduction to Appendix A are the
following major -- or what I would call the major
points. The application for construction permit must
include the principal design criteria for the system.
That is a requirement in Appendix A.
And by implication one option would be to
simply play back the general design criteria that are
listed there. The criteria to establish requirements
for structure, systems, and components important to
safety, and again this is from Appendix A directly.
Important to safety is defined as those
systems, structures, and components that provide
reasonable assurance of no undue risk; and what that
means is that what we are dealing with in Appendix A
is an adequate protection standard, because there is
a legal equivalence established between the phrase,
"No undue risk," and "adequate protection."
So the standard is not risk. It is
adequate protection. And the criteria as written
establish minimum requirements for water cooled
nuclear plants. That is specifically stated.
It is also stated that there are
considered to be generally applicable to other types
and can provide guidance in establishing criteria for
other reactor types.
Appendix A also goes on to say, or the
introduction goes on to say, that the development of
the general design criteria is not yet complete, and
that there are four issues enumerated that need
further consideration, which are:
Single failures of passive components;
redundancy in diversity requirements for fluid
systems; type size and orientation of primary system
breaks; systematic non-random concurrent failures or
redundant elements. As far as I know, those words
have been since 1971 unchanged.
Also, within the introduction there are
two exceptions listed, the first two points on this
slide. The introduction specifically says that the
general design criteria may not be sufficient for some
plants, in which case the applicant is expected to
propose additional criteria.
And it also says that some general design
criteria may not be necessary for some plants, and
again the applicant is in principle to propose his own
set.
One observation that is kind of
interesting is that we really don't know without
examining individual license conditions to what degree
the operating plants comply with the general design
criteria.
Over half of the currently operating
plants received their construction permits before the
GDC were made part of Part 50. There are some
important definitions in Appendix A, and specifically
definitions for loss of coolant accidents, which that
has been discussed in a number of presentations today,
earlier, and in the previous couple of days.
And they define loss of coolant accident
as including all pipe breaks up to and including the
double-end break of the largest pipe in the system.
There is a definition for single failure and there is
a definition for anticipated operational occurrences.
So those phrases are self-supported within
the appendix. Before we get into this possible
specific changes to Appendix A, I think there is some
observations that are worth making.
One is that past regulatory reform
efforts, and I am thinking specifically of the
marginal safety program that was conducted during the
1980s, and the regulatory review group in the early
'90s, judged the GDC to be important to safety and to
not be a significant burden, insofar as the regulatory
structure was concerned.
In support of that thought, one can
observe that there are 160 division one regulatory
guides, and of those, 129 support some aspect of one
or more of the general design criteria.
I think an additional 10 of those are QA
related, which in a sense also supports the GDC,
because the first criteria is a QA criteria. Part 50
incorporates a lot of material by reference. So
specifically the ASME code, Sections 3 and 11, and I
think Section 8 now as a matter of fact.
Several IEEE standards, and so the GDC are
a relatively small part of the total volume of
regulation that one has to deal with, and in reality
risk-informing the GDC only makes sense in conjunction
with other changes in the regulations.
The reason for making particular note of
that is that from this point on, and in order to keep
the scope of what I was doing reasonable, I had looked
basically at the GDC in isolation. I didn't try to
look at all the tentacles from each of the criteria.
There are basically three options for
risk-informing the general design criteria. The first
and simplest is to modify the scope, and I will give
an example of that in a second.
The second is to modify the individual
requirements. The third is basically to replace the
GDC as a body with safety goals, and/or risk
acceptance criteria, and move something like the GDC
into the realm of guidance documents.
What I mean by modifying the scope is
something akin to what the approach that the staff is
taking on Option 2 for risk-informing special
treatment requirements.
As we will see in a minute, a number of
the criteria incorporate the term, important to
safety. Equipment important to safety must be treated
in a particular way. The simplest change you can
envision is replacing that phrase or redefining it
with perhaps the phrase, "important to risk."
And then you have to agree on what that
means. One possibility, of course, is to use the
risk-informed classification safety class scheme that
the staff has come up with as part of Option 2, where
one might put risk one and risk two components into
the important to risk class, and then subject them to
the criteria, and whatever special treatments that is
implied there.
And we will look at some examples of where
that might be the case. The second element or second
option, modifying the individual requirements, is
similar again to what the staff is doing in Option 3
to risk-inform the technical requirements in Part 50.
And where you look at each regulation,
each provision, each design criterion, and try to
determine how it might be changed to improve its risk
focus.
There is actually a number of things that
you can do there. The simplest thing is to look at
the criterion and tender to find the minimum change
that you have to make to shift the focus from
important to safety, or safety related, to important
to elements important to risk, but not change the
basic intent of any of the requirements.
CHAIRMAN APOSTOLAKIS: I thought in Option
2, Jack, when the staff speaks of the importance to
safety, they really mean work risk.
DR. SORENSEN: Yes.
CHAIRMAN APOSTOLAKIS: Tool safety
significance components is really low risk
significance?
DR. SORENSEN: That's correct. They have
come up with this four box scheme.
CHAIRMAN APOSTOLAKIS: That's right.
DR. SORENSEN: But I think the path
involves actually changing the words, because they
didn't want to -- they do not want to have important
to safety to mean one thing for people who have not
adopted risk-informed options, and another thing for
applicants who have.
CHAIRMAN APOSTOLAKIS: It is a mystery to
me why they went that way, although you might say that
core damage is not really risk. It is core damage
frequency.
And to say something is an important risk
because it is core damage, most likely it is, but
strictly speaking, it is not risk. It is
categorization. But what is confusing, of course, is
that they talk about safety related, and the
importance to safety. They are two different things.
DR. SORENSEN: And as far as the path they
are on in Option 2 as I understand it, they are kind
of taking those two definitions -- important to safety
and safety related, and then replacing them with the
words, "important to risk" in certain of the
requirements.
And using this four box scheme to classify
components, the systems and components that are
important to risk. Okay. So that is a second way of
doing this and modifying individual requirements is
actually going in and rewriting every requirement in
risk terms, which one could do.
And the third possibility would be to go
a step further and not only rewrite them, but make
them technology independent.
One of the projects that NEI has embarked
on is to have by the end of the year a proposed draft
of general design criteria that are technology
independent. I am going to be interested to see what
they come up with.
CHAIRMAN APOSTOLAKIS: Did they give us an
example yesterday?
DR. SORENSEN: Well, in Adrian Haymer's
presentation yesterday or the day before, he had one
example which was kind of an easy one. I mean, he
picked one of the easy ones, and as Dana observed I
think in one of the sessions on Monday, at some point
you have got to talk about the phenomenology, and it
is a question of whether you talk about that in
something called the design criteria, or someplace
else, but it is obviously very hard.
CHAIRMAN APOSTOLAKIS: Are these criteria
sort of principles of good practice when you design
them?
DR. SORENSEN: Some of them are, yes.
CHAIRMAN APOSTOLAKIS: So you can't really
replace them --
DR. SORENSEN: Well, it is a question of
where you put them, I think. If I were starting over,
a lot of them I would adopt pretty much the way they
are.
Whether I left them as part of the
regulations, and whether I put them in the guidance
documents is another question.
CHAIRMAN APOSTOLAKIS: Well, the ones that
refer to, for example, to water, and design, and so
on, I don't see how one could put those in a safety
program.
DR. SHACK: Well, commensurate with the
importance.
DR. SORENSEN: Yes, most designers do not
start with a blank sheet of paper. They start with
something that has worked in the past, and good design
practice evolves in any technology.
CHAIRMAN APOSTOLAKIS: How about in a
purely risked-based, or risk-based, it seems to me
that there would still be a place for something like
the general design criteria.
DR. SORENSEN: Absolutely. Somebody will
have to go from your regulatory requirements to a set
of design criteria that a designer can work to. You
can't just hand the safety goals to the designer of
every system in the plant and say, okay, come up with
a design.
At some point, you have got to allocate
your safety budget amongst systems, and whether you
like risk allocation or not, that happens at some
point in the design process, and it is just a question
of how.
So you have got to have a place to start,
and I think there is a fairly good argument for these
general design criteria or something very much like
them being or staying as part of the regulatory
structure.
This may become a little bit easier to
talk about when we look at a couple of specifics. I
don't have any particular or any specific proposal to
offer with respect to replacing the GDC with safety
goals.
Conquest, a couple of months ago, I guess,
when I was trying to get some advice from him on how
to proceed with this project, came up with an E-mail
proposal that I think he sent to everybody involving
risk-accepted or safety goals, and risk-acceptance
criteria.
I think that would certainly work, but
somewhere in this hierarchy of design documents, you
have to have something equivalent to the general
design criteria.
Just a couple of other thoughts, and then
we will look at some individual criteria. Going back
primarily to Option 1 and changing the scope.
Of the 55 criteria, 13 of them have a
scope that is now defined as important to safety, and
with a change of a couple of words could be redefined
in terms important to risk, and change virtually
nothing else, and have I think a good impact.
The single failure criterion which was
mentioned in this morning's presentation appears
specifically in nine of the criteria, and if you
decide what to do about it in the context of one of
those criterion, you could probably make a similar
change in others.
But that is basically a reliability
consideration, and there are probably better ways to
state that now than the single failure requirement.
And overall 13 could be changed from important to
safety to important to risk.
And 30 probably would require no change,
although I think all of these judgments are arguable
at this point; and 19 could be recast in risk terms by
looking at the individual requirements. And I think
now I would like to go to looking at a couple of --
DR. WALLIS: I was wondering about that.
There are many things that are important to safety
which aren't included in risk, if you think of risk as
being simply a typical PRA.
There are other things that have some
effect on safety. That is always the problem. I
think risk is only interpreted in terms of PRAs.
DR. SORENSEN: Yes, and in my thinking on
these, those are the terms that I was thinking in.
Some of these you might examine closely and decide
that you don't want to change important to safety to
important to risk. I'm not sure.
But in a first reading or a second reading
even, it looked to me that that would be a
straightforward change. And there is one other point
that I wanted to bring up.
In terms of applicability to non-light
water reactors, there is 36 of them that are probably
applicable to virtually all reactor types, and there
are 19 that probably are not applicable to some
reactor types.
And again I think that judgment is in the
case of some criteria could go either way. Some of
them are clearly general, and some of them the intent
applies, but you might end up with an inappropriate
word in the criterion, a reference to cladding, for
example, where you might in fact not be dealing with
clad fuel. And I will try to touch on these in the
examples.
Okay. A good example of criterion -- this
is not in your slides, but in the text of Appendix A
immediately behind the slides, you will find each of
the criteria.
And the significant words here from a risk
standpoint, and I think this is one where you could
change important to safety to important to risk, and
perhaps improve the focus.
DR. SORENSEN: What is this thing tsunami?
What is it?
DR. SORENSEN: Tidal wave. The source may
be different.
DR. POWERS: It is on a lake isn't it?
DR. SORENSEN: You're right. One is an
ocean and one is a closed body of water. This one, I
think simply changing the scope would be pretty
straightforward. I am not sure that the changes that
were in Haymer's examples provide much benefit
frankly.
DR. POWERS: Well, he left that nice
prepositional phrase, "With sufficient margin."
CHAIRMAN APOSTOLAKIS: So what was the
difference with yesterday?
DR. SORENSEN: I should have brought that
with me and I did not. I'm sorry. Basically, the
three numbered points have been combined and
generalized in some way, which I have now forgotten.
I apologize for not bringing that along.
CHAIRMAN APOSTOLAKIS: So what would you
do to this one?
DR. SORENSEN: I would simply take the
phrase, "important to safety," and replace it with
"important to risk." And use whatever definition of
risk that I had decided to use in my regulations in
general. I think the staff proposal --
DR. POWERS: It seems to me that this is
where the absolute has to be confronted. I think you
have to come in and address the absoluteness here.
DR. SORENSEN: Well, my thought on that,
Dana, was that in fact is done in the numbered points,
where it says, appropriate consideration. I saw those
words as softening the requirements in the first
paragraph.
DR. POWERS: I see that as non-helpful,
because you come down and say, well, how do I define
appropriate. Well, I define that based on risk. I am
still stuck with the problem that I can at any site,
if I am willing to go back far enough in the
geological history, I can find an earthquake that the
planet simply cannot withstand, that no structure
could ever withstand, because far enough back there
were some pretty horrendous earthquakes. So it seems
to me that the absolute term here shall be designed to
withstand has to have something in it that puts it
within the context of some sort of probability here.
DR. SORENSEN: I guess it was not clear to
me that that had to be done here, as opposed to
someplace else in your regulatory structure.
CHAIRMAN APOSTOLAKIS: What I would
suggest is that this would be eliminated in a risk-
informed, because you would naturally consider the
contribution from --
DR. POWERS: Well, it is the naturally
part that I have a little trouble with.
CHAIRMAN APOSTOLAKIS: Why?
DR. POWERS: It is not so obviously to me
that that would be natural.
CHAIRMAN APOSTOLAKIS: In a PRA?
DR. POWERS: In a PRA, and I use that --
I substantiate that by pointing out that in all of the
applications of 1.174 that have been presented to the
committee, when they go to set the horizontal access
value, the CDF value, they don't use the seismic
contribution of risk. They have not at any time that
we have come up here. And when asked to do that, they
said, oh, it moves it up a little bit.
CHAIRMAN APOSTOLAKIS: If you read Option
2, they do refer to it. They do. And they say the
reason why they did the --
DR. POWERS: George, I am saying that it
is not natural. I am not disagreeing with you that
there places where it says take into account seismic
risk.
CHAIRMAN APOSTOLAKIS: But we are
confusing now two issues. What I am saying is that in
a risk-informed licensing regulatory system --
DR. POWERS: You would want to have a
design criteria that said that shall make it natural
to include seismic contributions to risk.
CHAIRMAN APOSTOLAKIS: No, no. This says
design, and what I am saying is that if it is risk-
informed, you are going to have -- if you submit a PRA
that does not have external events, and you are
regulating on the basis of core damage frequency or
something else, then that PRA would be unacceptable.
In fact, all three refer to the load from
the earthquake and not the strength. So you still
have the problem with what does withstand mean.
DR. SHACK: Let's put it this way.
Lawyers have not interpreted this to mean that you
have to withstand the effects of tectonic plate
shifting.
DR. POWERS: The problem is that it is
like an EPA criterion. The better I get at my
geology, the more that historical record in fact is
appropriate and it seems to me that appropriate
consideration gets me out of it.
DR. SORENSEN: Possibly.
DR. POWERS: But, George, that is not
useful unless you tell them what a good PRA is. That
is what the good general criteria would be for a PRA.
CHAIRMAN APOSTOLAKIS: Well, it would
state all modes of operation and contributors and all
causes of failure.
DR. POWERS: If you say those things, then
no PRA is adequate, because no PRA currently takes
into account sabotage, and that is clearly
contributable.
CHAIRMAN APOSTOLAKIS: And I would exclude
sabotage.
DR. SORENSEN: This is fairly typical of
the discussions that one would get into in virtually
every one of these. I would with your permission
move on to a couple of examples.
CHAIRMAN APOSTOLAKIS: Sure. So we can
repeat the arguments.
(Laughter.)
CHAIRMAN APOSTOLAKIS: The PRA doesn't
tell you that you should design things to the quality
standards that industry has, and the PRA will just
assess the risk, and since we were told that there is
no difference between --
DR. SORENSEN: Well, I think the function
of something like the general design criteria in a
risk-informed system is the same as it is in the old
deterministic system. It is to give the designer a
road map, a path that he can go down and be reasonably
assured that he will end up with a design that is
acceptable.
CHAIRMAN APOSTOLAKIS: Is it general
principles or a road map? There is a difference,
Jack.
DR. SORENSEN: Well, a road map is perhaps
the wrong word.
CHAIRMAN APOSTOLAKIS: Is it the
constitution or is it the law?
DR. SORENSEN: But I think you can
establish a hierarchy of design documents that
includes the regulations at the top here, and then
going down perhaps to the next step, something like
the general design criteria, and then to industry
codes and standards.
And functional requirements and so forth,
and I think that something like this belongs somewhere
in that hierarchy, and whether you put them into the
regulations or you put them someplace else is probably
not of great import.
Part of what is embedded here is a list of
all the things that the designer has got to take into
account if he is going to end up with an acceptable
design.
CHAIRMAN APOSTOLAKIS: Right. And that's
doing a good PRA.
DR. SORENSEN: In a sense it is a
checklist.
DR. POWERS: But is this guidance for the
designer or for the PRA guy?
CHAIRMAN APOSTOLAKIS: No, the designer
must know that eventually his design would be
subjected to a PRA, and go back and forth. So he has
to know.
VICE CHAIRMAN BONACA: Well, many of these
criteria actually are defense in depth.
DR. SORENSEN: There is five that I see
that where the primary purpose is defense in depth,
and there is another half-a-dozen where there is an
embedded defense in depth requirement; and then there
is quite a few where defense-in-depth is perhaps the
underlying thought.
The second one that I wanted to take a
quick look at was environmental and dynamic effects
design bases. Again, this is a list of things that
the designer has to take into account.
But the thing that I especially wanted to
take note of here is that this is one of the few
criterion that has been modified since 1971, and
specifically the however, "however, dynamic effects
associated with postulated pipe ruptures," and so
forth.
And this obviously is the leak before
break consideration. The only other one where the
criterion itself has changed is control room
criterion, which we will get to later, but that was
changed to accommodate the new source term. But this
has the same kind of arguments that I think --
CHAIRMAN APOSTOLAKIS: Is there a
criterion that says or refers to human error?
DR. SORENSEN: No. These are design
criterion.
CHAIRMAN APOSTOLAKIS: Well, the control
room design affects human error.
DR. SORENSEN: Possibly. But the straight
answer to your question is no.
CHAIRMAN APOSTOLAKIS: Well, the point
that I am making is that if you start writing down
GDCs and trying to figure out dynamic effects, and
this and that, you are going to be incomplete, because
you can't predict everything. So that's where you
make a blanket statement and whatever is important.
DR. SORENSEN: But again between that
statement and the designer executing the design has
got to be something like this that lists everything
that you know about it. You don't want them leaving
out things.
CHAIRMAN APOSTOLAKIS: If I do a PRA
wouldn't I naturally consider dynamic effects?
DR. POWERS: None of them do.
CHAIRMAN APOSTOLAKIS: Gus, you are so
unfair. The good ones do. This is called spacial
common cause failure analysis. We did it for Indian
Point, for heavens sake, 20 years ago.
DR. POWERS: How many other PRAS have it
in it?
CHAIRMAN APOSTOLAKIS: Well, I can't, but
in fact people have experimented at that time using
the sense code that were developed, and you ended up
with something that was three feet high. It is the
spacial analysis that you do for fires, for floods,
for dynamic effects. Sure, otherwise it is not a good
PRA. I am talking about 20 year old technology now.
DR. SORENSEN: Okay. Criterion 5. This
one is interesting for primarily because it is the
only one that I saw by inspection that is probably
counterproductive as far risk information is
concerned.
The decision of what functions to share or
not share seems to me to be exactly the kind of
question that modern PRAs could help answer, and this
criterion as written biases the designer against
sharing.
It is kind of interesting to note that in
the Manshan station blackout event of a month or two
ago, one of the options that was not available to the
operators was to cross-connect the unit one diesel
with unit two. And the reason was that that
plant was built to the general design criteria.
That particular plant was built to satisfy
Part 50. Those were the criteria that they adopted.
And it was noted in the one of the incident analysis
reports that I read that they did not have the option
of cross-connecting the units.
DR. WALLIS: Well, why not, because it
would actually help the orderly shutdown and cool down
of the remaining units.
DR. SORENSEN: Well, this criterion biases
you against establishing that connection.
DR. WALLIS: Unless it can't be shown.
DR. SORENSEN: So the designer, to satisfy
this easily, says don't do it.
DR. WALLIS: And doesn't read the rest of
the sentence.
DR. POWERS: Well, if you are a designer,
you are sitting there saying I can do one job or I can
do two. Gosh, let me think. Which should I do.
DR. SORENSEN: Obviously, we have 55
criterion, and we are not going to get through all of
them. I will try and finish up in the next few
minutes, but let me touch on one that I think is the
next one, which I think is probably all right the way
it is written. I am not sure that I would change that
from a risk-informed standpoint.
Basically what it says is that you
shouldn't have a design that is going to incur fuel
damage during normal or anticipated operational
occurrences.
DR. POWERS: And that is where you get
into a risk problem again. Is something that has some
probability of occurring an anticipated operational
occurrence. At the time that these were written that
meant something that would happen in the lifetime of
the plant.
DR. SORENSEN: Right.
DR. POWERS: Do you want to extend that
definition as you move into a risk-informed
environment, and if you do, then you run into an
absolutism problem.
DR. SORENSEN: I think you have to reach
for it.
DR. POWERS: A little bit.
DR. SORENSEN: But if I understand your
comment, the underlying concern is really dealt with
in other criterion here. I mean, it becomes evident.
DR. POWERS: It could be, but what I am
saying is a lot of this have this anticipated
operational occurrence phrase in now, and we knew from
the definitions someplace that that means within the
lifetime of the plant.
DR. SORENSEN: Right.
DR. POWERS: It is a 10 to the minus 2
probability. Do you in a risk-informed world want to
extend that, and say that okay, rather than having an
absolute thing for anything that is 10 to the minus 2,
have something that has some sort of a rated
characterization for incredible, which I am reliably
informed now is 5 times 10 to the minus 7.
DR. SORENSEN: I think you are reading
more into this criterion than I would read into it,
but as I noted earlier, we can generate these kinds of
discussions on virtually every one.
CHAIRMAN APOSTOLAKIS: The last line there
doesn't belong, anticipated occurrences.
DR. POWERS: What it is saying is that you
are precluding something or certain kinds of high
probabilities.
CHAIRMAN APOSTOLAKIS: Right.
DR. POWERS: Well, there is nothing wrong
with that.
DR. KRESS: This is one of those things
where I keep talking about high frequency, lower
fission product release.
DR. POWERS: Well, you can imagine doing
something that says, okay, with a high confidence
level, which we could define as 95 percent or any
other number, you precluded.
Or we could also take it and say now you
preclude it, but the confidence level and reliability
of doing it varies as the probability goes down from
this 10 to the minus 2 level.
DR. KRESS: Well, if you had the FC curves
as the regulatory thing, it would automatically do
that.
DR. POWERS: They could do that for you,
yes.
CHAIRMAN APOSTOLAKIS: It seems an option
that it does not ask for margins. But ultimately it
seems to mean in a risk-based system that it would be
a combination of margins and defense in depth that
would give you the wrong numbers. They are not
separate things. I don't see why you should limit
yourself to the anticipated occurrences.
VICE CHAIRMAN BONACA: Well, this was
purely a word that was tied to it that meant it would
happen 40 years ago in an operation.
DR. SORENSEN: Okay. Well, let's take a
look at another one that is interesting, and this one
I think is a clear illustration of how these criterion
reflect the state of knowledge at the time.
I have never understood why this one
exists. It seems to me that it is completely covered
by Criterion 10, which we just looked at, and I think
the answer is that the phenomena had become of
possible power oscillations and spacial power
oscillations in large cores had become recognized in
the preceding few years.
Interestingly enough the 1965 criteria,
the earliest version that I found, that this was not
addressed specifically in power oscillations. It was
addressed to process variable oscillations, which
would include flow, for example.
DR. WALLIS: Isn't this just another
anticipated operational occurrence?
DR. SORENSEN: Yes, I would consider that
this is completely covered by Criterion 10, which
preceded it. But I thought it was an interesting
example of reflecting the state of the art. I guess
we have time for one or maybe two more.
DR. KRESS: What does it say about
containment?
DR. SORENSEN: Okay. That is the next one
that I thought that I would look at. Actually, there
is probably 12 separate criteria that deal with
containment, and the basic requirement is here;
"Reactor containment and associated systems shall be
provided to establish an essentially leak tight
barrier."
And this is one of those where clearly
there is some advocates of some reactor types that say
this should not apply. I would suggest that if we
were starting over for light water reactors, we
probably would not want to specify essentially leak
tight containment the way this one does.
You may want to allow other concepts since
the early containment failures seems to dominate risk
as far as we already know.
DR. POWERS: What this does is preclude
confinement.
DR. SORENSEN: Yes.
DR. POWERS: And when you preclude
confinement, then you are condemning yourself to
eventually having an uncontrolled release in the event
of an unmitigated accident.
DR. SORENSEN: This would as worded would,
yes. Of course, the containment bypass, you have to
deal with containment bypass sequences anyway.
But this is one that I think I would give
some thought to, and I would hasten to add that I
don't have the expertise in either PRA or severe
accident phenomenology to know how to rewrite it.
I just suspect that if you were to redo the GDC that
you might decide to rewrite this one.
This criterion, of course, is supported by
another 12 or 15 criteria that deal with containment
related phenomena and containment heat removal,
atmospheric cleanup, and penetrations, and isolations,
and system isolation, and so forth.
But this is pretty unequivocal as to what
is needed.
DR. KRESS: Mine would have been very
equivocal. I would have said thou shall provide a
reactor system such that the frequency is at least to
a 95 percent confidence level.
CHAIRMAN APOSTOLAKIS: Well, yes, some
language like that, because that allows you to take
credit for the release that you want. The probability
of it.
DR. SORENSEN: Just as a last offering
here, I would suggest looking at Criterion 17 on
electric power systems. This is the first one where
the single failure criterion is specifically invoked,
and the first one that you come to if you go through
them in numerical order.
It is also, I think, the longest of the
criteria.
CHAIRMAN APOSTOLAKIS: Does a single
failure have a definition somewhere?
DR. SORENSEN: Yes, it is defined up in
the introduction in terms of inability to perform the
specified safety function.
CHAIRMAN APOSTOLAKIS: If what happens?
If it fails? Assuming a single failure.
DR. WALLIS: If you have a hundred
batteries, that means that one battery will disable
the safety function that you are trying to deal with?
DR. SORENSEN: Yes. But the other thing
to note here is that this gets to be a very specific
criterion, electric power supplied by two physically
independent circuits.
You can have a common switch yard, and
that is acceptable. There are underlying assumptions
as to where the unreliability is, or where the risk
might be.
And again this seems like a perfect
candidate for recasting, in terms of a reliability
goal that could be supported by modern risk analysis
techniques. I would not attempt such a wording.
VICE CHAIRMAN BONACA: Jack, if we could
go to Criterion 55.
DR. SORENSEN: Sure. You are talking
about monitoring releases.
VICE CHAIRMAN BONACA: No, it is one that
tells you that you would have penetrations of pipes
that would be -- well, it --
DR. SORENSEN: Well, that is clearly one
that I think you might end up rewriting in terms of
risk considerations. It is very specific. In fact,
criteria 50 through 55 I think you would rethink in a
risk-informed environment.
CHAIRMAN APOSTOLAKIS: No, the question
here is what do we do with all of this? I mean, we if
have Commissioner Diaz come down here and talk to us,
are we going to write a letter, or how does the
committee feel about this? And if we write a letter
to whom do we address it and why?
DR. SORENSEN: I have a couple of thoughts
that might go in to the committee's thinking on this.
CHAIRMAN APOSTOLAKIS: Go ahead.
DR. SORENSEN: One is that it seems to me
that Appendix A, and Appendix B for that matter, are
not keys in any significant way to risk-informing the
body of regulations. They are a part of it, but they
are no more important than a lot of other things.
So I think sort of the underlying
implication in Commissioner Diaz's comments that they
were key to proceeding I think is simply not right.
CHAIRMAN APOSTOLAKIS: But you also I
think claim that you could not risk-inform the
regulations unless you go back to the GDCs and change
them.
DR. SORENSEN: That is probably true.
DR. POWERS: And I agree with him on this.
If I look at Part 50, and I imagine anything in there
that is changed to be somewhat risk informed, and I
say now what do I do different, it ends up that I do
nothing different, because I get controlled by the
GDCs.
And if you hit this one first just to get
it out of the way, then you can go and look at the
regulations and know that you are not going to run
contrary -- you are not going to get into this mouse
trap, and where the guy does nothing different.
CHAIRMAN APOSTOLAKIS: So what would be a
wise course of action for this committee; to raise the
issue with the Commission or support Diaz?
DR. POWERS: Well, it depends a little bit
on how aggressive you want to be. It seems to me that
your options vary.
CHAIRMAN APOSTOLAKIS: Well, should this
be part of Option 3?
DR. POWERS: Well, it is part of Option 3.
DR. SHACK: It should be, but it is just
that they have prioritized it in a different way.
They have chosen to do it a different way.
CHAIRMAN APOSTOLAKIS: So does the
committee feel otherwise?
DR. POWERS: Well, right now they have got
them -- I mean, we don't know what they are going to
come back with, but they seem to have themselves in a
conundrum on 46. They are going to try to get out of
it, but I don't see how to get out of it with the
approach they are taking, but maybe they will.
But if they are going to continue to be
boxed on 46, it seems to me that you go the other
route.
CHAIRMAN APOSTOLAKIS: What does that mean
for us now?
DR. POWERS: Well, that is one way to
approach it, is to ask the staff what they are going
to do about that, and then engage in these debates
that Jack wants to cut off.
The other approach it seems to me is that
you go through and say pick the juicy, easy ones. And
there are a couple of them. I think 17 and a couple
of others in there that seem particularly ripe to make
risk-informed, and send the Commission a letter and
say, gee, we can do these, and do one for them.
CHAIRMAN APOSTOLAKIS: Well, we really
shouldn't write a letter without hearing more. We
have to give them an opportunity.
DR. SORENSEN: Both Option 2 and Option 3
will, if pursued to their logical conclusion, will end
up touching the GDC. In Option 2, in the first sense,
I talked about changing the scope in some way, and in
Option 3, in changing individual requirements, and
which you have no way of knowing right now is how many
actual changes they will end up recommending.
Now, my own thought is that the option
three process in particular is biased against making
changes to the GDC. The process starts with what they
call the defense in depth concept or philosophy, and
it doesn't lead easily to specific changes.
And that's because defense in depth rules
that framework, and I think there is a little more
hope for option two.
CHAIRMAN APOSTOLAKIS: Well, they
interpret defense in depth differently. It is their
justification for failing for different values, which
as releases and core damage, and so on. I don't think
this is the kind of defense in depth they refer to.
DR. SORENSEN: You may well be right. My
reading of the framework document is that the process
ends up being biased against change.
CHAIRMAN APOSTOLAKIS: Okay. So that
brings us again to the question; what do we do now?
DR. SORENSEN: But clearly the staff would
argue that they are on a path where both option two
and option three deal with some aspect of this, and
will presumably come to some recommendations to the
commission.
VICE CHAIRMAN BONACA: It seems to me that
some individual applications, unless you deal with
some of the principles, you have no idea if you are
still going to have the confusion like here. And it
seems to me that if you want to have a radical
rewriting on a risk-informed basis, you should start
from the top, and first attempt to see how they could
be converted to risk-informed criteria.
CHAIRMAN APOSTOLAKIS: Well, is it worth
doing this now, or do other things that are more
practical?
DR. SHACK: Well, what do you gain if your
goal is ultimately to have a whole new risk-informed
regulatory system. If you are looking at the moment
to try to identify the things that have the largest
impact on safety and reduce regulatory burden,
unnecessary regulatory burden, I am not sure that
starting with the GDCs would rank terribly high on
that list. They never show up on the NEI --
DR. KRESS: I think risk-informing the
GDCs, I agree with Bill first that what he just said,
that risk-informing the GDCs probably is important for
the advanced reactors, if they ever have one.
That's where there is a collision, and a
discontinuity in things, and what I would -- my choice
of things would be to don't do these one at a time,
except in the context that Bill said, where you are
trying to -- you have picked the ripe ones, and you
see where you have to change the GDCs so they are not
in conflict.
And you do that like they are progressing,
and to have a parallel effort, and have somebody say
I want to rewrite these GDCs completely, starting from
a blank page. This was my recommendation to Jack
actually when I wrote it.
And I would start out with writing down
all my regulatory objectives that I want to achieve,
and figure out to do them in a risk-based way that
includes the prior definition of defense in depth, and
the proper use of uncertainties, and to cover the
whole range of fission product releases that I am
interested in.
And I would work my way down on how do I
achieve this type of design that would meet this
criteria by specifying it in a risk-based way, but
risk-informed because I am going to have a proper
definition of defense in depth.
And end up with a whole new set of design
criteria that are not very prescriptive like this, but
may end up saying things like redundancy and
diversity, and may even have things like you shall be
sure to be able to shut down the reactor, and you may
be sure to have emergency cooling. You may be sure to
have long term cooling.
You may have things like that in it which
are --
CHAIRMAN APOSTOLAKIS: So what you are
saying is that the Gen-4 guy --
DR. KRESS: Yes, put this off to the Gen-4
system.
CHAIRMAN APOSTOLAKIS: But NEI told us
that they are working on these things, and they would
have something by December.
DR. KRESS: Yes, but I suspect they are
going to pick out --
CHAIRMAN APOSTOLAKIS: But that might be
the first good opportunity for us.
DR. KRESS: To have a letter, yes. But I
am in favor of sort of approaching it like Bill said.
VICE CHAIRMAN BONACA: But looking at the
other side, you know, if you leave this stuff behind,
I agree they are more important to certainty if they
have priority in many ways, and it seems to me that
ultimately we are going to have patch work to patch
work.
DR. KRESS: That is exactly what we are
doing. That's why I wanted to have a parallel effort
to get away from that.
DR. POWERS: There is a perception,
George, that these things are past history. They are
not. I mean, GDC-3 is actively invoked regularly.
CHAIRMAN APOSTOLAKIS: But I think in Bill
Shack's world that that would be singled out where
they try to reach some benefits by risk-informing fire
protection requirements. So the question is should we
do it as the need arises or shall we have an all out
attack of the GDCs?
DR. POWERS: Well, it seems to me that
coming in that you have got two approaches. The staff
chose an approach and now you are boxed. They are
getting boxed right now.
DR. KRESS: It may not work is what you
are saying.
DR. POWERS: Well, if their approach is
not going to make substantive program progress, it
seems to me that the alternate approach, which I
happen to think is what should have been the approach
all along, is to go after ANB.
VICE CHAIRMAN BONACA: Well, the thing
that troubles me about the whole thing is that all
they can us is Reg Guide 1.174, and I wonder how many
of the changes that will happen at South Texas will
conflict with some of this GDCs. I could bet you that
there will be some conflicts.
And we have not gone back to what is the
foundation of the original of the existing systems
are, and so we are changing things here, and I think
they can go only so far.
DR. POWERS: Well, you have maintained
function, and you have maintained all your Chapter
15s.
CHAIRMAN APOSTOLAKIS: Did you guys raise
the issue of containment earlier with South Texas?
DR. KRESS: Yes, it came up. Somebody
mentioned it.
CHAIRMAN APOSTOLAKIS: So it is not an
issue anymore?
DR. KRESS: Well, I think Sam Lee did.
CHAIRMAN APOSTOLAKIS: So again what do we
do here with this thing? Should we let it rest until
December and see what NEI comes up with?
DR. KRESS: Yes, I don't think we are
ready yet.
CHAIRMAN APOSTOLAKIS: I really don't
think we should be writing letters without hearing
from the staff, and to ask them to come and talk about
the GDCs, they will love us for it.
DR. SHACK: Do you have another
presentation on Option 2 scheduled?
CHAIRMAN APOSTOLAKIS: Option 2? Not in
the near future. Option 3 doesn't come to mind,
except in 50.46.
DR. POWERS: But Option 2 follows along
somewhere.
DR. SHACK: Right. It is a few months
behind.
CHAIRMAN APOSTOLAKIS: But South Texas is
done.
DR. POWERS: But it is the generalization
of the rule.
CHAIRMAN APOSTOLAKIS: Oh, that is going
to take --
DR. SORENSEN: That originally was the
quick fix.
CHAIRMAN APOSTOLAKIS: Okay. If we don't
write the letter now, how do we make sure that Jack's
work is documented and reviewable?
DR. SORENSEN: There is a paper that I can
put out as soon as --
CHAIRMAN APOSTOLAKIS: A paper or report?
DR. SORENSEN: It is 20 or 25 pages of
this kind of discussion, one criterion at a time.
CHAIRMAN APOSTOLAKIS: So why don't we get
a report from you and maybe wait until NEI does
something. And if we find there another opportunity
where there is a reason to bring it up, then we bring
it up.
DR. SHACK: And Jack's conclusions aren't
so different from what the NEI people said.
DR. POWERS: And GDCs were not such a
problem.
CHAIRMAN APOSTOLAKIS: Okay. So let's
recess -- oh, I'm sorry.
DR. KRESS: I have another view of what
the GDCs are before we leave them and while we are on
it.
CHAIRMAN APOSTOLAKIS: Okay.
DR. KRESS: If I think about it, and if I
had a system of this risk-based concept that I
mentioned, and if I viewed defense in depth as being
an allocation of the risk contribution through both
the sequences and things like initiating events and
mitigation, if I were reviewing defense in depth as an
allocation among those things, then I would view the
general design criterion as almost wholly defense in
depth, because what it does is do that in a
prescriptive constructionist way of doing it.
So I think if you had the proper
definition of defense in depth, in terms of this
allocation and in terms of related uncertainty that
you would end up with something like -- if you carried
it on down to lower and lower tiers, you would end up
with something like the GDCs, and that's why I say
that if they could start over from a top level
concept, they might end up with a different type.
CHAIRMAN APOSTOLAKIS: I think the Option
3 guys have already done some of that.
DR. KRESS: They may have.
CHAIRMAN APOSTOLAKIS: But they didn't
call them GDCs, but by the mere fact that they started
by assigning values, upper bounds to intermediate
events, that is a structural manifestation of defense
in depth at that top level. Okay.
Thank you very much, Jack. It was very
informative and we look forward to your report.
And send it in draft form to all the members at some
point.
DR. SORENSEN: I had planned to do that,
yes.
CHAIRMAN APOSTOLAKIS: And seek comments.
Okay. And we will recess until 10 minutes past 5:00.
(Whereupon, the meeting was recessed at
4:58 p.m.)
Page Last Reviewed/Updated Monday, August 15, 2016