United States Nuclear Regulatory Commission - Protecting People and the Environment
Home > NRC Library > Document Collections > ACRS > Meeting Schedule and Related Documents > 2001 > ACRS/ACNW Joint Subcommittee - November 14, 2001

ACRS/ACNW Joint Subcommittee - November 14, 2001

                     + + + + +
                     + + + + +
                 NOVEMBER 14, 2001
                     + + + + +
                ROCKVILLE, MARYLAND
                     + + + + +
                       The ACRS/ACNW Joint Subcommittee met at
           the Nuclear Regulatory Commission, Two White Flint
           North, Room T2B3, 1545, Rockville Pike, at 8:30 a.m.,
           Mr. B. John Garrick, Chairman, presiding.
           Subcommittee Members Present:
           Mr. B. John Garrick, Chairman, ACNW
           Dr. Thomas S. Kress, Co-Chair, ACRS
           Mr. Milton N. Levenson, Member, ACNW
           Mr. Dana A. Powers, Member, ACRS
           ACRS/ACNW Staff Present:
           Mr. Howard Larson
           Mr. Michael T. Markley, ACRS
           Mr. Richard Savio
           Mr. Sher Bahadur
           Also Present:
           Mr. Peter Hastings (via phone)
           Mr. Ken Ashe (via phone)
           Dr. Dennis Damon
           Mr. Yawar Faraz
           Mr. Carl Yates
           Ms. Lydia Roche
           Mr. Felix Killar
           Ms. Marissa Bailey
           Mr. Lawrence Kokaiko
           Mr. Alan Rubin
           Mr. Jack Guttman
           Mr. Christopher Ryder
           Mr. Brad Hardin
           Mr. Moni Dey
           Mr. Jason H. Schaperow
           Mr. S. Khalid Shaukat
           Mr. Ed Hacket
           Review goals and objectives for this meeting,
           concerning risk assessment methods in NMSS, John
           Garrick, ACNW. . . . . . . . . . . . . . . . . . . 5
           NRC Staff Presentation
           Standard Review Plan Chapter 3 (Draft NUREG-1520);
           reconciliation of public comments; schedule for
                 Y. Faraz, NMSS . . . . . . . . . . . . . . . 8
                 D. Damon, NMSS . . . . . . . . . . . . . . .36
           Industry Presentation
           Comments on proposed final version of SRP Chapter 3,
           Felix Killar, NEI. . . . . . . . . . . . . . . . .75
           NRC Staff Presentation
           NMSS Task Group Activities
                Marissa Bailey, NMSS. . . . . . . . . . . . .92
                 Dennis Damon, NMSS . . . . . . . . . . . . 103
           NRC Staff Presentation
           Probabilistic risk assessment for dry cask storage
                 J. Guttman, NMSS . . . . . . . . . . . . . 142
                 A. Rubin, RES. . . . . . . . . . . . . . . 147
                 Chris Ryder. . . . . . . . . . . . . . . . 156
                 Brad Hardin. . . . . . . . . . . . . . . . 171
                 Moni Dey . . . . . . . . . . . . . . . . . 186
                 Jason Schaperow. . . . . . . . . . . . . . 291
                 Khalid Shaukat . . . . . . . . . . . . . . 201
                 Ed Hackett . . . . . . . . . . . . . . . . 215
           .                           P-R-O-C-E-E-D-I-N-G-S
                                                      8:30 a.m.
                       MR. GARRICK:  Good morning.  Our meeting
           will now come to order.  This is the meeting of the
           Advisory Committee on Reactor Safeguards and the
           Advisory Committee on Nuclear Wastes Joint
                       I am John Garrick, acting as chairman of
           the Joint Subcommittee.  Tom Kress, on my right, is
           co-chairman.  The committee members that are in
           attendance are Milt Levenson of the Advisory Committee
           on Nuclear Waste, and Dana Powers of the Advisory
           Committee on Reactor Safeguards, a distinguished group
           to be sure.
                       The Joint Subcommittee will continue its
           discussion on risk informing activities of the Office
           of Nuclear Materials Safety and Safeguards with
           emphasis on the proposed final version to the Standard
           Review Plan, Chapter 3, for integrated safety
           analysis.  We will discuss the use of risk informed
           case studies and development of a probabilistic risk
           assessment for dry cask storage.
                       The subcommittee will gather information,
           will analyze relevant issues and facts, and formulate
           positions and actions as appropriate for deliberation
           by the ACNW full committee.
                       Mike Markley is the Cognizant ACRS/ACNW
           Staff Engineer for this meeting.
                       The rules for today's meeting have been
           announced as part of the notice of this meeting
           previously published in the Federal Register on
           November 2, 2001.  
                       A transcript of the meeting is being kept
           and will be made available as stated in the Federal
           Register notice.
                       It is requested that if we have speakers
           they identify themselves and speak clearly and loudly
           so that we can hear them.  
                       We haven't received any comments or
           requests for time to make oral statements for members
           of the public regarding today's meeting.  However, we
           do have a request from Mr. Peter Hastings of Duke-
           Cogema to participate via telephone.  I guess we are
           accommodating that request.
                       One of the things the committee has to
           decide and will be influenced by staff on this is
           whether or not they wish to have a letter from us.  It
           seems as though one of the key issues associated with
           at least the initial part of our meeting having to do
           with the Standard Review Plan and having to do with
           integrated safety analysis in particular is the issue
           of scope.  What actually should be in the summary.
                       As a kind of aside and a curiosity, I find
           it very interesting, and maybe the folks that present
           to us today can answer this, that an institution like
           the Army Chemical Corps who definitely has a chemical
           culture, the culture that developed the process hazard
           analysis methodology.  
                       The Chemical Corps has chosen to use
           probabalistic risk assessment, or PRA, on their
           chemical waste disposal facilities, while the NRC, the
           culture that developed probabalistic risk assessment,
           seems to be choosing process hazard analysis as the
           cornerstone of their integrated safety assessment.
           Maybe that will all be -- the reasons for all of that
           paradox will become clearer to us as we get more
           deeply involved.
                       The committee has been discussing for its
           last two or three meetings the risk informing
           activities of NMSS and other matters.  Maybe what
           we're seeing here is a little difference between
           subcultures, namely, something like the differences
           between the NRR and their philosophy about methods and
           techniques and the NMSS, but I'm not sure.
                       Okay.  Unless the members have some
           preliminary comments they would like to make, Dana,
           Milt, Tom, I think we'll turn the time over to Mr.
           Faraz for the initial presentation.
                       MR. FARAZ:  Good morning.  Can everyone
           hear me?
                       MR. GARRICK:  You want to tell us a little
           bit about yourself and your involvement in this?
                       MR. FARAZ:  Yes.  I'll do that.  My name
           is Yawar Faraz.  I'm a senior project manager in the
           fuel cycle licensing branch in the Division of Fuel
           Cycle Safety and Safeguards in NMSS.
                       Within the next 30 or 40 minutes I'll be
           providing you a very brief overview of Subpart H of 10
           CFR Part 70.  That's what the Chapter 3 of the SRP is
           really based on.
                       I'll also provide you very briefly a
           status of where the fuel cycle licensing branch stands
           in terms of ISAs for fuel cycle facilities.
                       I've kept my presentation to a minimum. 
           I have a total of 10 slides.  That's to allow a good
           discussion on this topic.  Anytime you have any
           questions, please feel free to ask.
                       Immediately following my presentation, Dr.
           Dennis Damon will provide a roughly 60 to 70 minute
           briefing on how to conduct ISAs and how we would be
           reviewing ISAs.
                       The question is why did we devise 10 CFR
           Part 70 and why did we include Subpart H in Part 70? 
           As you know, Subpart H was included in CFR Part 70. 
           The required fuel cycle licensees, as the name
           implies, to integrate all the safety disciplines.
                       Subpart H requires the use of systematic
           methods to (a) identify all potential accident
           sequences, (b) determine the likelihoods, and (c)
           estimate the consequences.
                       Another very important aspect of Subpart
           H that it requires the licensees to identify items
           relied on for safety, or IROFS.  As you know, this can
           both be hardware as well as administrative
                       Who is required to comply with Subpart H? 
           It is those whose cycle facilities are authorized to
           possess greater than a critical mass of SNM, or
           special nuclear material.  And who processed enriched
           uranium and mix oxide fuel?
                       Currently there are six operating fuel
           fabrication facilities in the U.S. that are required
           to comply with Subpart H.  Those are the six that I've
           listed.  In addition, there is also the MOX
           application that we're currently reviewing.  The MOX
           facility would also have to comply with Subpart H.
                       In addition to this, if there are any
           future enrichment facilities that need to be licensed,
           they would have to comply with Subpart H as well.
                       MR. GARRICK:  How many of these facilities
           already have something like an ISA?
                       MR. FARAZ:  I would say most of the
           facilities are already doing an ISA type -- they have
           ISAs established in their systems.  There are some
           that are fairly forward and fairly advanced in their
           application of ISAs and some that are not as advanced. 
                       The rule requires that for a site-wide ISA
           to be completed, it requires that it be done by
           October of 2004.  I would say that it appears that the
           facilities are going to comply with that requirement.
                       What does Subpart H require in terms of
           ISAs?  One of the primary requirements that I just
           mentioned is to have licensees conduct ISAs for their
                       By conducting an ISA a licensee can ensure
           for themselves and demonstrate to the NRC that the
           facility that they operate would comply with the
           performance requirements of Subpart H.  These are
           listed in 70.61.
                       Another very important aspect of ISAs is
           the identification of items relied on for safety, or
           IROFS.  To ensure that these IROFS are available and
           reliable, Subpart H requires the licensees to
           establish management measures.  Some examples of
           management measures I'll show you in just a minute.
                       On this slide and the next slide I'll just
           briefly go over what the performance requirements of
           Subpart H are.  I'm sure most of you are already aware
           of this.  First of all, the licensees are required to
           identify all credible accidents that can occur at
           their facility.
                       Once they have done that, the licensees
           need to ensure that certain accident sequences are
           highly unlikely.  These would be the ones that result
           in the following consequences.  For the worker, a dose
           greater than 100 rem or a chemically caused fatality.
                       For a member of the public located outside
           the controlled area which you don't think of as the
           site boundary, the limits are 25 rem.  A soluble
           uranium intake of greater than 30 milirems or
           irreversible chemical injury.  This is for a member of
           the public outside the site boundaries.
                       MR. POWERS:  Since this is an intention to
           integrate together a number of safety disciplines
           including environmental safety discipline, whey are
           there no environmental contamination constraints in
           this definition?
                       MR. FARAZ:  There are and I'll get to that
           in the next slide.
                       MR. LEVENSON:  I have a question.  Under
           the worker you say chemical caused fatality.  Is that
           intended to exclude OSHA type physical mechanical
                       MR. FARAZ:  Yes.  There are certain
           accident sequences that are required to be unlikely. 
           We just talked about the highly unlikely ones.  Now
           I'll talk about the ones that need to be unlikely.
                       For a worker this would be a dose between
           25 rem and 100 rem or irreversible chemical injury. 
           A member of the public would be between 5 and 25 rem
           or a chemically induced transient illness.  
                       For the environment it would be 24 hour
           average air concentration outside the restricted area
           which you can think of as the fence line which may or
           may not be within the site boundary.  The air
           concentration there if it's greater than 5,000 times,
           Table 2 of Appendix B of 10 CFR Part 20. 
                       Incidentally, if you can word that the 24-
           hour air concentration to a dose, it ends up being
           about 1 rem.  If you compare this to the member of the
           public residing outside the controlled area it's less
           and you're talking about a dose at the fence line or
           the restricted area which is within the site boundary.
                       MR. GARRICK:  Is that 1 rem due to
                       MR. FARAZ:  Yes.  It's a 24-hour dose. 
           Really this would be the controlling mechanism.
                       MR. GARRICK:  But you don't get a
           contribution from any ground shine or any other
                       MR. FARAZ:  No.
                       MR. POWERS:  Could you explain to me how
           these things come up?  Why 5,000 times and not 3,000
                       MR. FARAZ:  We went through a fairly
           lengthy process of coming up with Part 70.  It was a
           participatory rulemaking process.  This was something
           that all the stakeholders, including in our city,
           agreed upon as being a reasonable level.
                       Now, I was involved in that process but
           this is something that was already included in the
           rule.  I think there might have been something in the
           statement considerations that might shed some light on
           that.  These are levels that all the stakeholders
           including NRC thought were reasonable.  That's why
           they were established in the rule.
                       MR. POWERS:  I guess what I'm trying to
           understand is what leads one to conclude that these
           are reasonable?  I mean, there must be some thought
                       MR. FARAZ:  Right.  I'm sure that went
           into the rulemaking process which is, as you know, a
           very lengthy process.
                       DR. KRESS:  This air concentration outside
           the restricted area, is that meant to be a maximum in
           case atmospheric conditions make it jump over
                       MR. FARAZ:  It's a 24-hour average.
                       DR. KRESS:  It's a 24-hour average where? 
           Right at the --
                       MR. FARAZ:  At the fence line.
                       DR. KRESS:  At the fence line.
                       MR. FARAZ:  Right.  But you're right,
           somebody can argue that theoretically there could be
           an elevated release or buoyant release --
                       DR. KRESS:  That's what I had in mind.
                       MR. FARAZ:  -- that might go with the
           fence line and come down on the site boundary.  In
           that exceptional case, it would not be the controlling
                       DR. KRESS:  Does this performance
           requirement come with a specification on what
           analytical models are to be used?
                       MR. FARAZ:  No.
                       DR. KRESS:  Does it talk about means or
           uncertainties in the calculation?
                       MR. FARAZ:  No.  
                       DR. KRESS:  It just specifies a number?
                       MR. FARAZ:  Right.  Right.
                       MR. GARRICK:  So when you say average, are
           these average atmospheric stability conditions or are
           these for a special set of atmospheric conditions such
           as F?
                       MR. FARAZ:  Yes.  I think when the
           licensees look at their accident sequences and try and
           estimate the consequences, I'm sure they would build
           in the conservationist that is reasonably required for
           coming up with air concentrations.  
                       I think generally what the licensees do
           and what the NRC accepts, the staff accepts, is a
           conservative estimate at the fence line.  We would
           look at whether they are using annual average type
           meteorology or are they using fairly conservative
                       MR. LEVENSON:  Is there a rationale for
           why one of those is outside the controlled area and
           the other is outside the restricted area because they
           are both public.
                       MR. FARAZ:  Yes.  That's a good point.  As
           I said, I wasn't really involved in the development of
           the rulemaking process.  I would tend to think that
           with member of public maybe thinking about the nearest
                       The question may have come up is that
           members of the public can come into the controlled
           area because sometimes these facilities have roads and
           there is really nothing restricting anyone coming up
           to the fence line.  
                       In that case, they could be exposed to the
           environmental contamination while they are in that
           area.  That's why maybe the environmental requirement
           came in.  That's why I said the restricted area and
           not the control area.
                       MR. YATES:  I have a question.  My name is
           Carl Yates.  I'm with BWXT in Lynchburg.  A comment
           really.  We have been using the restricted area in our
           analyses of our accident scenarios to mean the
           radiological restricted area which is much closer than
           the site boundary or the controlled area boundary.
                       MR. FARAZ:  Right.
                       MR. YATES:  So we have been looking at air
           concentration levels on site to the restricted area
           fence line.
                       MR. FARAZ:  Right.
                       MR. YATES:  Also, I had a question.  We
           were also wondering does it say air in the regulation? 
           We were wondering if it also included liquid releases
           because Table 2 gets both air and liquid
           concentrations.  We were looking at some accident
           scenarios involving liquid releases and whether or not
           we needed to apply that 5,000-times limit to that.
                       MR. FARAZ:  I'm not absolutely sure if it
           specifies air or not.
                       MR. YATES:  Okay.
                       MR. FARAZ:  That's a good point.  That's
           something I'll need to look into.
                       DR. DAMON:  My name is Dennis Damon.  I
           was involved in the process by which the Part 70
           evolved.  My memory of why the distinction between
           controlled area and restricted areas is there were
           some facilities that we had been looking at.  
                       It turns out not to be the facilities that
           are being regulated under this but facilities that
           might come under it where they had very large
           controlled areas.  They control the whole Hanford
                       The idea was we didn't think it was
           appropriate to contaminate a very, very large area of
           the landscape to these kind of levels.  That's why it
           was made the less restrictive definition.  I mean, the
           air concentration gives you one rem and the one above
           gives you 5 rem so it's kind of backwards from what
           you've just said is the ratio.
                       DR. DAMON:  I think all I'm saying is that
           we didn't want our licensee to simply be able to use
           the fact that they controlled an area to permit them
           to contaminate it to these levels.  In other words,
           you see what I'm saying?  They move the control area
           out and inside that they don't need to -- they can
           exceed this limit.  The point was to deny -- to
           prevent that.
                       The other factor that I would point out
           about these is that these are all fairly high levels
           of consequences.  They are not low levels like you
           would normally talk about in the context of
           environmental contamination and so on.  
                       There was, I believe, a consideration to
           make that environmental requirement more comparable to
           those other requirements for workers and the public. 
           These are very substantial accidents.  These are not
           insignificant ones.  
                       I think the rationale there is it was
           desired that the requirement not be applied to very
           low levels of accidents because they are sort of like
           a cost benefit consideration there.  The licensees had
           enough to do to just consider the more severe things. 
           I think that concept comes in here.
                       DR. KRESS:  That brings to mind another
           question.  These do look like high-level -- could I
           call them safety goals?  They relate to the safety
           goals for operating reactors, or do they?  Do they
           have any relationship at all to those?
                       MR. FARAZ:  I'm not sure how they would
           relate to the reactor safety.  Dennis, are you
           familiar with --
                       DR. DAMON:  I mean, there's no discussion
           that I can remember in the evolution of the rule that
           related them to the reactor safety goals.  One other
           thing.  These are not goals.  These are requirements
           in the sense that they are required to make them a
           certain likelihood level.
                       DR. KRESS:  I understand.  I understand
                       DR. DAMON:  So they are not at a goal
                       DR. KRESS:  The rationale I was thinking
           of is if the safety goals were to be requirements,
           which they are sort of ambiguous right now whether
           they are or not and, therefore, a summation of
                       You could view fuel fabrication plants as
           an essential part of nuclear power so it seems to me
           like an essential part of nuclear power the cost
           benefit type of assessment would tell you the safety
           goals ought to be about the same because it's the same
           benefit so you ought to be able to accept the same
                       Since these are for individual sequences,
           they must be some fraction of that safety goal.  I
           don't know what fraction it is.  It depends on how
           many essential sequences you have in the unlikely
           category and in the other category.  
                       My question was to see if there was some
           rationale process it went through to show that these
           are indeed of the nature that might be equivalent to
           the safety goals.
                       MR. GARRICK:  I think it's obvious they
           did not go through an apportionment process or an
           allocation process.
                       DR. KRESS:  That would be an allocation.
                       MR. GARRICK:  I wanted to ask who decides
           the restricted area and can it be a variable?  Is that
           the licensee?
                       MR. FARAZ:  The licensee would decide
           where the restricted area is and they would present
           that to the analyses staff.  Then the analyses staff
           would determine whether it's okay or not.  They would
           establish the area and that would be part of their
           submittal to the NRC.
                       MR. GARRICK:  And that's something that
           probably wouldn't change.  I guess the licensing
           process allows for a change if they have a sufficient
           justification for it?
                       MR. FARAZ:  Yes.
                       MR. GARRICK:  There are still a lot of
           questions on that.  Go ahead, Milt.
                       MR. LEVENSON:  An incidental question is
           how do these definitions of likely and unlikely
           compare with those in the proposed Part 63?
                       MR. FARAZ:  I'm not very familiar with
           Part 63.  Go ahead, Dennis.
                       DR. DAMON:  They really have nothing to do
           with it.  We had a discussion with Tim McCartin and
           the Division of Waste Management about the issue of
           whether there needed to be consistency and we saw no
           need for there to be a consistency.
                       The term unlikely and other qualitative
           likelihood terms appear many different places in the
           regulation.  I was going to point out some of them in
           a presentation later today.  
                       They certainly are not used in any
           consistent manner except to the extent the English
           language meaning of the word.  They are used in that
           sense consistently but there's no definite numerical
           probability or anything associated with them.
                       MR. LEVENSON:  Of course, it explains part
           of the problems we have communicating with the public
           when we use different definitions for the identical
           words in different regulations.
                       MR. GARRICK:  But you do have guidelines
           that indicate what those mean.
                       DR. DAMON:  Certainly in the case of Part
           63 that's what they are going to do.  They are going
           to tell the public exactly what the staff thinks it
           means.  In the context of Part 70 here it was not
           stated in the rule but the Standard Review Plan
           indicated what the staff thought.
                       MR. GARRICK:  Yes, this was 10 to the
           minus 5 and 10 to the minus 4 for unlikely and highly
                       MR. FARAZ:  What I'll do is we'll hear
           some of the management measures that I talked about,
           some examples of management measures that are needed
           to ensure that the IROFS have really been reliable.
                       You have the configuration management
           program, training, QA, procurement, maintenance,
           functional testing, surveillance calibration
           procedures, signs, tags, shipping, storage, human
           factors.  The list goes on and on.
                       What I'll do next is I'll try and give you
           a brief overview of where --
                       MR. POWERS:  Let me ask you a question
           about it.  You've listed down a host of things with no
           indication that this is complete.  What am I supposed
           to drive from this list?
                       MR. FARAZ:  Let me just get to it.  Okay,
                       MR. POWERS:  There are 10,000 things here
           and there are probably 10,000 that are not listed on
           it.  Are these the things that NRC proposes to control
           and regulate?
                       MR. FARAZ:  These are management measures
           that the licensees are required to establish and that
           they will provide to the NRC when they complete their
           ISAs.  The NRC would look at them and review them and
           determine if they are okay or not.  What I want to do
           is give some examples of management measures that will
           be included in their ISAs.
                       MR. POWERS:  I guess I'm a little --
           suppose they have a written policy and procedure for
           tags?  I supposed NRC could review it.  How do they
           decide that is a good one or a bad one?
                       MR. FARAZ:  There's no definite criteria
           for what is okay or not.  I think the NRC would look
           at the entire management program as a whole and then
           determine if they are good management measures or not. 
           If they determine that additional management measures
           are required or needed to assure safety, then the NRC
           would ask licensees to revise or change those
           management measures.
                       MR. POWERS:  So if the NRC did not like
           the workload that the management was imposing on an
           individual, they would say don't do that?
                       MR. FARAZ:  If the licensee says that
           overtime is authorized up to $100 a week for an
           individual that is relied on for safety, then clearly
           that is something the NRC staff would question.  There
           are things like if the NRC staff sees there's some out
           of the ordinary management measurement being proposed,
           then we would look into it and question it.
                       MR. MARKLEY:  How is this being links to
           the risk-informed oversight process, or is it?
                       MR. FARAZ:  You mean the whole ISA
                       MR. MARKLEY:  Well, the oversight process
           which is your inspection and verification process and
           what they've done in looking at cornerstones of safety
           with the reactor program.  I understand they are doing
           some of that with the fuel cycle programs as well.  It
           seems to me like most of these types of verifications
           would fall within an oversight process of some sort.
                       MR. FARAZ:  Right.  They would be included
           in their license application all the ISA.  That's
           something that the licensing group would be reviewing. 
           Then once the licensing group feels that they are
           fairly good management measures in place, then the
           inspection process would confirm whether they are okay
           or not.
                       DR. DAMON:  This is Dennis Damon again. 
           The key thing to focus on in this slide is that first
           top bullet, "Measure to assure that IROFS are
           available and reliable and needed."  There is actually
           a requirement.  If you read the rule language, the
           requirement statement in the rule language, this is
           actually almost a quote from it.  
                       It says, "The licensee must establish
           these measures to assure that IROFS are available and
           reliable when needed in the context of the 70.61
           performance requirements."  
                       What the staff intended that to mean was
           you had to do these things that are on this list to
           whatever extent was sufficient to achieve highly
           unlikely for high consequence accidents and so on. 
           That's the direct requirement statement.  
                       If the accident is highly unlikely given
           the whole ensemble of all the things that they do in
           this thing with respect to that one accident, then
           that is sufficient so the staff cannot make them do a
           better maintenance program just because they like
           better maintenance programs.  It has to be tied
           directly to the highly unlikely issued.
                       Then the other thing is it says "when
           needed."  It's obvious that was to preclude the idea
           that you have to have these programs in place and
           everything has to be done all the time.  Like I say,
           this whole thing is tied -- the whole idea of the rule
           was to tie these programs to the items relied on for
           safety that come out of the ISA analysis.  It's that
           linkage that is the key thing that the staff had.  
                       The reason was because some of these
           programs that some licensees had not been part of
           their formal license commitments.  Some licenses did
           not have configuration management program descriptions
           in their licenses with commitments as to what they
           would or would not do and the same with maintenance. 
                       This is an attempt to compel that be done
           uniformly across the industry that licenses will
           contain descriptions of these various programs.  Then
           the content of those programs should be tied to the
           results of the ISA and should be done in a manner
           sufficient to achieve the highly unlikely by
           performance requirements.
                       MR. GARRICK:  So these are more in the
           context of examples of measures that could be taken?
                       MR. FARAZ:  Exactly.
                       MR. GARRICK:  Rather than necessarily
                       MR. FARAZ:  Exactly.
                       MR. GARRICK:  It would be very facility
           dependent and serve the systems that do surveillance,
           dependent, and so on.
                       MR. FARAZ:  Exactly.
                       MR. LEVENSON:  I have a question.  You
           said that basically the metric is to make sure that
           the accident is highly unlikely.  Does that mean that
           if there are accidents by their inherent nature are
           highly unlikely you don't need to identify IROFS
           related to those accidents because you're already at
           the cutoff put?
                       MR. FARAZ:  Yes, that's true.  What the
           licensees would do is they would look at all the
           accidents that can occur that are credible for their
           facility.  If an accident is not credible, then it
           won't require IROFS.
                       MR. LEVENSON:  Are you using the word
           credible and highly unlikely to be identical?
                       MR. FARAZ:  It's very hard to exactly
           quantify credible and highly unlikely.
                       MR. LEVENSON:  My whole point was if I'm
           trying to do this, how do I know where my cutoff is
           for preparing IROFS?  That should be fairly clear.
                       DR. DAMON:  It's described in Chapter 3,
           the one that we'll get to, the chapter on ISA.  The
           issue of credibility is discussed there.  The language
           in the rule is the licensee is required to identify
           all credible accidents and to make them -- if they are
           high consequence make them highly unlikely.  It's that
           kind of language.  
                       The way it was understood by the staff and
           which is explained fairly carefully in chapter 3 is
           that to be credible means not to be included in the
           ISA at all in a sense.  This certainly doesn't have to
           show up in the summary or whatever.   The staff's
           interpretation is that credibility must be obvious.  
                       It must be obviously something that
           doesn't need to be considered.  Things that do need to
           be considered because you maybe need to estimate their
           frequency or make some judgement about them, they
           ought to be -- they would be considered in the ISA and
           documented in the process of doing them.  
                       Credibility, in other words, is a
           criterion for whether it's considered and documented,
           whereas highly unlikely is a criterion for once you've
           considered it, you've made it sufficiently unlikely. 
                       In other words, what I'm saying is in
           doing an ISA you would consider accidents that would
           be far more unlikely than highly unlikely because of
           natural reasons like an extreme earthquake or
           something.  You should have thought about that in
           doing the ISA.  It's part of the process.  
                       It's just that you don't need to do
           anything about it so you don't need to write down an
           item relied on for safety on your list so there's
           nothing for the facility to do.  I think it should be
           included in the process that you went through when you
           considered all the accidents.
                       MR. LEVENSON:  So you're saying we require
           analysis and regardless of the outcome of that
           analysis, you don't do anything with the results so
           why do it?
                       DR. DAMON:  Well, it shows completeness. 
           What I'm saying is if something is obvious that it
           does need to be considered, yeah, they don't need to
           put it in there.  But if you're talking about
           communicating with like, say, future people at your
           own plant or with the NRC staff, it's important, I
           think, for a licensee to document what they did
           consider in doing their ISAs.  
                       If they thought about earthquakes and they
           said, "Okay, this earthquake is one sufficient to do
           the damage we're worried about here," but is too
           infrequent to worry about because of the specifics of
           that site, they should write that down in their
           documentation so that the next time somebody does this
           type of analysis, they don't have to replicate that
           whole process over again.  It's that kind of thing.  
                       In other words, how does the staff know
           that you've considered all accidents unless you have
           considered all accidents because that's what the rule
           requires, that you identify all so the staff needs to
           understand that the licensee did try to look for
                       Then there's a subset of that that they
           found.  I think the language is stated they don't have
           to tell us in the ISA summary about ones that they
           found that didn't meet the credibility criterion or
           whatever, or didn't even meet the highly unlikely
                       They only have to tell us about ones that
           did meet that threshold.  But in their own process
           that they went through at their plants, I don't see
           how you can do that process without documenting
           everything you've thought about.
                       DR. KRESS:  Are sabotage events excluded
           from this and put into some other category?
                       MR. FARAZ:  Yes, sabotage is not something
           that is typically included.
                       MR. GARRICK:  Maybe you had better
                       MR. FARAZ:  Okay.  What I'll do now is
           I'll kind of give an overview of where the fuel cycle
           licensing branch stands in terms of ISAs.
                       As of April 18, 2001, all the licensees
           had submitted ISA plans.  These are plans that will
           give the ISA approach that the licensees are going to
           follow.  The processes at their facilities will be
           analyzed and a schedule.
                       DR. KRESS:  Each process that the licensee
           decides to analyze has to meet these performance
                       MR. FARAZ:  Exactly.
                       DR. KRESS:  So a lot may depend on what
           the licensee selects as a process.
                       MR. FARAZ:  Well, they have to look at all
           their processes.  In the ISA plan there may be a
           chemical process that's away from their license
                       DR. KRESS:  Is there a firm definition of
           what the process is?
                       MR. FARAZ:  No, there's not.
                       DR. KRESS:  So the licensee just decides
           this is a separate process and this is a separate
           process and I'll do the ISA for each of these?
                       MR. FARAZ:  Right.  Right.  I would think
           of the process as, for instance, if they do
           decontamination activities, there might be a building
           and all the decontamination activities would come
           under the decontamination process.  They would look at
           all the various processes and integrate them all
           together as part of the ISAs.
                       MR. GARRICK:  So when you say approach,
           you must be looking for something different than the
           guide or the Standard Review Plan?
                       MR. FARAZ:  That's right.  As the name
           implies, it says to guide.  If they want to follow it,
           fine.  If they want to propose something different,
           that's fine, too.
                       MR. GARRICK:  Okay.  Thank you.
                       MR. FARAZ:  We've already reviewed and
           approved BWXT's ISA plan as well as NSF's.  The other
           reviews are ongoing,
                       As far as Subpart H is concerned, one of
           the submittals that are required to be made, as I
           mentioned before, by October 18, 2004, all the
           currently operating licensees are required to have
           their site-wide ISAs completed and submit to the NRC
           their ISA summaries.
                       In addition to that, by the same date the
           rule requires all the licensees to identify and
           correct any deficiencies that may have been identified
           as part of doing the ISAs.
                       However, Subpart H also allows an
           extension to that date as long as sufficient
           justification is provided to the NRC, acceptable
           sufficient justification.
                       I will just mention that we anticipate
           submittals to begin as early as spring of next year
           because, as I mentioned before, some of the licensees
           are ahead of the ballgame.  That will give a good
           opportunity for both the licensees and the staff
           because this really hasn't been done before to this
                       This will give the licensees and the staff
           a good opportunity to actually get into the thick of
           things and conduct and review an actual ISA.  None of
           the licensees appear to be behind and don't appear to
           be in danger of exceeding the enroll date.
                       Some of the challenges that we are
           currently facing and that we expect to face are listed
           in the slide.  The first one that I've listed is the
           SRP itself.  Last month we finally reached an
           agreement on the contents of the entire SRP by
           reaching agreement on what is required to be or what
           is needed to be in Chapter 3.
                       We're in the final stages.  We hope to
           finalize an issue of the SRP within the next couple of
           months.  This was a very lengthy process.  It was a
           multi-year process.  The stakeholders were very
           heavily involved; NEI, the licensees, the public. 
           Finally we have come to a point where we think that we
           can finalize the SRP.
                       Another challenge that I've listed is
           guidance on failure rates.  This is something that we
           intend to work with again the stakeholders on and it
           is information that would be helpful in determining
           what's unlikely and what's highly unlikely.  
                       These would be failure rates of hardware
           systems.  We really haven't begun this process but
           once we issue the SRP and finalize the SRP, we hope to
           get into that as well.
                       MR. POWERS:  It seems to me that it would
           be very complex guidance to give because you have over
           here a fairly lengthy list and any failure rate that
           is high can be compensated for by a lot of other
           things.  It looks like it's very challenging to set up
                       MR. FARAZ:  It will be challenging.  We
           will go through pretty much the same process that we
           followed for the SRP.  In other words, we would engage
           the stakeholders on this.  It's at its infancy and the
           picture is not very clear right now.
                       Another challenge would be for the
           licensees to conduct the ISAs and for the NRC to do
           the reviews of the ISA summaries as well as the ISAs. 
           As I had mentioned before, it could be as early as
           April 2002 that the NRC staff begins reviewing some of
           these ISA summaries and ISAs.
                       A very important challenge that I see is
           to risk inform the staff's licensing reviews and
           inspections and enforcement actions once the site-wide
           ISAs are approved.
                       MR. GARRICK:  Are you comfortable that the
           ISA process will achieve that last bullet?
                       MR. FARAZ:  I'm not sure if we will reach
           100 percent but clearly it will be a major, major
           improvement and a major step forward.  Clearly in risk
           informing our licensing reviews and inspections and
           enforcement, the ISA process is a great help and a
                       MR. GARRICK:  Okay.  Thank you.
                       MR. FARAZ:  Are there any other questions?
                       MR. GARRICK:  Questions from the
                       MR. FARAZ:  I'll ask Dr. Dennis Damon to
           provide his presentation.
                       MR. GARRICK:  Thank you.
                       Dennis, I trust, our questions
           notwithstanding, you will organize your presentation
           to meet our schedule of 10:15.  We are very pressed
           today to stay right on our schedule.  I guess we have
           a break scheduled at 10:15.
                       DR. DAMON:  Yes.  My intention was not to
           present everything that's in the big thick handout
           there.  That material is something you have already
                       It was presented back in January but I
           included the whole thing because I'm going to proceed
           to talk about one of the examples near the end and
           then proceed on to other things.  I don't think we're
           in any danger of running too long.
                       MR. GARRICK:  Thank you.
                       DR. DAMON:  Maybe I can start talking and
           when he gets the slides going, I can proceed with the
           stuff that's on the slides.  My intention was there's
           two parts to the presentation.  One of them is based
           on what's in the Standard Review Plan, Chapter 3,
           which is the ISA chapter.  
                       More specifically it's Appendix A to that
           chapter which I wrote.  Appendix A is an example of
           one method that the staff would consider an acceptable
           way of documenting and presenting an ISA and ISA
           results.  That's what Appendix A is all about. 
                       Appendix A, as you remember, basically
           describes a method where each accident sequence if it
           is identified is laid out as such just basically with
           the same exact meaning of the term accident sequence
           as you would have in a PRA which is a sequence of
           events, an initiating event followed by subsequent
           events, and ending in consequences.  
                       The licensee will identify these accident
           sequences and lay them out.  In the example in
           Appendix A they are displayed in a tabular form with
           each accident sequence and one row on the table.  Then
           it uses a scoring method that basically is a log
           rhythm of the failure rates, outage times,
                       Whatever probabalistic information appears
           in that sequence is converted into order of magnitude
           index that reflects either the frequency of the
           initiating event or the probability of failure or the
           probability of occurrence of some subsequent event.  
                       It's an index method.  The indices are
           added up and that's your metric of whether you are
           highly unlikely or unlikely in the language of the
           That's what the Appendix A method is.  Since that
           presentation in January BWXT and NSF have both
           submitted ISA plans in which they describe their
           approach to doing ISA.  
                       In my second handout, the short one, what
           I've done is put some information related to the BWXT
           method which also is an index scoring method for
           evaluating systems.  
                       What I would like to do in the
           presentation is point out some subtle differences
           between the two index methods to show you what these
           methods are like and what they do for you and what
           they don't do for you and so on.  
                       Then one other thing I intended to present
           was to discuss the last example that's in the large
           handout which is -- there are three examples in there
           and the last one is an example of something I chose
           because it's very characteristic of a large number of
           processes in these facilities.
                       It's kind of a situation where you can, in
           fact, imagine the accident but what is very difficult
           to do is to quantify it.  It's an example of an
           accident where I believe that the reason why having
           the accident is highly unlikely is because of a subtle
           interaction between having a very large safety margin
           and an absence of a reason for why you would exceed
           such a large safety margin.  
                       It's a very difficult thing to quantify. 
           I wanted to show the members of the committee why it
           is that there's reluctance to mandate across the board
           quantification for its own sake, but rather to focus
           on qualitative characteristics of processes because a
           very large fraction of the processes of the facilities
           are kind of like this one that I describe in the
           example, and that is they have qualities about them
           that will convince you that it is highly unlikely to
           have an accident but it's very difficult to put a
           number on them.  
                       That's not to say I'm against using an
           index method to categorize these things.  I think
           that's a useful thing to do is to identify qualities
           that would convince you that something is sufficiently
           unlikely and then when it has those qualities you put
           it in that category of being something you think is
           highly unlikely.  What I'm trying to communicate is
           how difficult it can be to actually come up with
           numbers for some of these things.
                       On the other side of the coin, there are
           processes that are no different from reactor
           subsystems.  They are automatic hardware safety
                       On the other side of the coin there's many
           situations in these facilities that involve human
           actions that are also no different from things that
           are very characteristically analyzed in human
           liability engineering.  
                       There are things very clearly you could do
           a good job quantifying things, and there are other
           things that are very -- that need work.  They need I
           don't know what, standardization or something.
                       MR. GARRICK:  Of course, the concept that
           allows quantification of the reactor scenarios is the
           notion of uncertainty and the characterizing of those
           uncertainties in some form such as a probability of
           density function if it's for a fixed variable or
           something like a frequency of exceedence curve if it's
           for a variable measure of risk such as fatalities or
           injuries or what have you.
                       Has there been any consideration for the
           accidents that are really important to carry it a
           little further than, say, the index method?
                       DR. DAMON:  You mean something further 
           like --
                       MR. GARRICK:  Like actually doing an
           uncertainty analysis.
                       DR. DAMON:  I think that's a good idea for
           the staff to consider when they are developing this
           guidance document.  In fact, if I remember, the early
           drafts -- Yawar is working on this thing, this
           guidance.  He characterizes it as guidance on failure
                       What I would sort of characterize it is
           more guidance to the staff in general about how to
           review the quantitative likelihood aspect of these
           ISAs.  In that context, yes, uncertainty is something
           he's considering.  
                       The issue, I think, is to communicate to
           the staff member to give him guidance how to identify
           things that he perhaps ought to take a more careful
           look at.  
                       Something that triggers his -- you know,
           if the staff reviews to serve any function at all, I
           think one of the functions it can do is an independent
           technical review of whether, in fact, these systems
           are adequately safe.  Do they meet highly unlikely or
                       Now, I don't think the staff has the
           resources nor the information to do that for every
           single process.  I would envision it considering the
           uncertainties involved.  
                       I mean, as a simple example, my own view
           is if the licensee comes in and claims that a given
           piece of hardware, whether it's passive or active
           safety hardware, has an extremely low failure rate, 10
           to the minus 3 per year or something like that, the
           challenge there is that if they are wrong, they can be
           wrong by -- let's take 10 to the minus 4 per year.  
                       If they are relying on that for safety and
           you're saying it's a once in 10,000 year type failure
           rate, you're basically placing a very heavy reliance
           on that item.  
                       Yet, there is no way to verify whether
           that assignment is correct or not based on subsequent
           events at the facility because you don't expect to see
           any events at the facility if the facility won't have
           events occurring.
                       Whereas the licensee says, "I expect this
           type of failure once every 10 years," or says
           something equivalent to that, and the uncertainty in
           that is a lot less.  
                       The staff should take that into account
           that there are certain things where they need to focus
           on where they need to review what the licensee has
           done and other places where you can rely on the fact
           that the licensee has a corrective action program and
           if they're wrong, those failures will occur more often
           and they will be picked up in the system. 
                       MR. GARRICK:  Dennis, are you satisfied
           that the ISA process is a building block towards a
                       DR. DAMON:  Well, I think it's a building
           block towards using the thought processes, the
           conceptual structure that is used in PRA.  And to
           using PRA, I think eventually -- there are licensees
           who have used quantitative risk analysis.  
                       It comes up in some context where they
           feel it's to their benefit to do so but not
           comprehensive across the plan, every single process
           basis, when they have one particular thing.  
                       I can think of two examples.  One of them
           was a license amendment and they thought because of
           the complexity of the hardware involved it would be
           more convincing to submit quantified fault tree model. 
                       The other case was a case where a
           violation was being proposed and the licensee felt
           that this was such a low risk situation that it
           shouldn't be a serious violation so they presented a
           quantitative risk analysis argument that the risk of
           what happened was very low.  They do this sort of
                       What I think is interesting about Part 70
           is in developing the language of the regulation
           itself.  What was abused the architecture of a risk
           based argument.  That's what held the whole structure
           together.  The conceptual structure is there.  
                       What I would hope would happen in the
           future is that we would all learn to talk the same
           language between the licensees and us.  As of now it's
           not fully there but over time that's what I would hope
           to see happen is that you evolve to a point where you
           are talking the same language.
                       MR. LEVENSON:  You mentioned that some
           thoughts or guidelines on when the staff might decide
           to go a little father, etc., based on things like
           probability.  Would it make sense instead of things
           like that to use as guidance when to go farther only
           those accidents that have potentially significant
                       DR. DAMON:  Yes, that's the kind of
           thought process I'm talking about.  I see a big
           difference in the thought process between someone who
           has become fluent with risk concepts like you
           mentioned.  You know, think about the severity of the
           consequences of what you're talking about and people
           who don't.            
                 There's a tendency on the part of the staff
           sometimes to get concerned about issues that don't
           relate to risk.  They've just lost sight.  They've
           lost the bubble there.  I think that's the point here. 
           I mean, later today when we talk about the Risk Task
           Group's charter and so on and SECY-99-100 that's what
           that's all about.  
                       Both the NMSS staff and the licensees in
           this process we would like to encourage people to all
           start understanding the conceptual logic of risk so
           that they can start talking about the things that are
           being required to be done in a way that directly
           addresses consequences and likelihood and
           identification of all accident scenarios, risk
           concepts like that.
                       This is just the presentation that you
           have seen before that Yawar has talked about.  There's
           one thing that is important to keep in mind.  The
           chemical acts and consequences are obviously very
           carefully restricted to the things that are -- those
           chemical accidents that relate to the license
           material, not to chemical accidents in general.
                       MR. GARRICK:  Of the chemical accidents
           that relate to licensing material, is there any tie
           between that and EPA standards on chemicals such as
           come up in the RCRA process?
                       DR. DAMON:  There are -- what do they call
           those?  AEGLs.  The language that was put into the
           regulation mimicked the qualitative language that
           described the emergency action guidelines that EPA
                       The intent was -- it was a one-time
           thought that those guidelines would be prescribed in
           the rule.  It would say in there, "This is what you
           use a threshold for defining what is a high
           consequence event, one that is life threatening," and
           use the exact language of EPA.  Then it was decided
           that had disadvantages in that these guidelines don't
           exist.  For example, you have six so that is one
                 Also it's a little too prescriptive so it was
           left at the qualitative language level, life
           threatening as high consequence and permanent or
           serious injury, I think, is the language that goes
           with the other one.  The intent was to point directly
           at the AEGLs and say, "This is really what we mean by
                       MR. LEVENSON:  The second triangle you
           have up there defines that only HF that comes from UF6
           is involved.  If I've got a plant I'm using HF.  Some
           of it is maybe recycled from UF6 and some is what I
           buy for makeup.  Do I have to differentiate and keep
           track by inventory and records as to which is what.
                       DR. DAMON:  Well, there's not a
           requirement to track it.  The point is when you do the
           ISA analysis and identify accidents that can happen,
           the material that is perhaps in a storage location is
           not intimately connected with the process that the NRC
           staff has responsibility for.  That would not be
           included in this even though it's used in the process
                       MR. LEVENSON:  No, no. But if the source
           of the -- way that reads is even if this is in a
           warehouse a mile away, if the HF came from
           decomposition of UF6, I have to consider it quite
           differently and independently of purchased HF.  Is
           that correct?
                       DR. DAMON:  That's right.  In other words,
           anything that's connected with the UF6 since the
           enriched uranium is the license material, anywhere
           that licensed material, whatever chemical form it's
           in, that's fair game.  That has to be considered in
           the ISA analysis, any accidents in UF6 storage.  Not
           just the processing of it, the storage of it.  Any UF6
           on site would be --
                       MR. LEVENSON:  I understand that but I'm
           talking about the HF separated from UF6.
                       DR. DAMON:  Once it's separated and not
           actually intimately involved in some process, then
           it's not within the -- then it doesn't need to be
           considered in the ISA.
                       MR. LEVENSON:  But that's not what this
           says.  It says "chemicals produced from licensed
           material."  If I'm decomposing UF6 then HF is a by-
           product that's produced from licensed material.
                       MS. ROCHE:  Dennis, may I?  
                       DR. DAMON:  Yes.
                       MS. ROCHE:  I'm Lydia Roche, Section Chief
           for Licensing.  In response to your question, January
           1986 there was an accident at Sequoia Fuels in which
           a UF6 cylinder ruptured and killed a worker.  What
           killed the worker primary was the HF.  If it is
           licensed material, yes, it's part of the ISA.  It's
           part of the process that we regulate.
                       MR. LEVENSON:  I understand and I am
           familiar with that accident.  This is very ambiguous
           because what you're talking about is a chemical
           produced during an accident and that is quite
           different than what is produced in a processing plant.
                       MR. FARAZ:  What I would say in response
           to that the language may be a little misleading.  You
           are correct that if it's part of the accident and --
                       MR. LEVENSON:  Part of the accident I
           understand but one of the routine processes sometimes
           used from UF6 to decompose it down to UF4 is to make
           by-product HF.  If HF is produced from licensed
           material, it seems to me that should not be covered.
                       MR. FARAZ:  It's not covered.  If a
           licensee has a process to extract HF from licensed
           material and then stores the HF a mile away from the
           site and then there's an accident there, that would
           not be included.
                       MR. LEVENSON:  This wording does not make
           that clear.
                       DR. DAMON:  Right.  I mean, certainly the
           words you can fit on a view graph are very few.  This
           is like a succinct statement.  The MOU has extensive
           guidance and there's guidance in the chemical section
           of the Standard Review Plan as to what things should
           be considered and what shouldn't.  
                       That doesn't mean that all issues have
           been resolved.  I mean, there probably are some cases
           where that issue will have to be discussed in the
           context of what's done.  I think between the staff and
           the licensees I think we have a reasonably close
           common understanding of which ones should be in and
           which ones are out.  
                       It's mostly the idea that, like you say,
           HF evolved from UF6 during the course of an accident
           or MOX or something.  We don't want you saying,
           "That's not your licensed material that's causing the
           fatality."  Then items relied on for safety, this is
           just to point out how broad this is.  Activity of
           personnel is underlined up there.  That will come up
           as I get further in here.
                       This is just to point out that if you read
           the Standard Review Plan chapter on ISA, the Appendix
           A that has this index method in it and so on and so
           forth, that is an appendix.  
                       What is stated in the body of the chapter
           as acceptance criteria is much more qualitative and
           it's really stated in terms of getting down to the
           fundamentals of whether an adequate job is done.  
                       There's many more aspects to it than just
           whether you use a scoring method and what exactly the
           scoring method is and so on.  It's really important
           that there be completeness of accident identification
           because that was really one of the major reasons for
           asking that ISAs be done.  
                       That's just to point out that's what is
           dealt with in the body of the chapter is completeness
           of accident identification, correctness of consequence
           evaluations, and then finally you do get to the
           adequacy of likelihood evaluations.
                       Again, Appendix A is just an example.  It
           was really not intended as "use this method."  It was
           intended as an example of something that had the
           structure of something that you might use.  The reason
           it was stated that way is because the NRC staff could
           not, nor could a licensee, I think, anticipate how any
           given scoring method would end up being applied as
           they went through all the diverse processes in their
                       It was envisioned that a licensee would
           establish a qualitative method defining what is
           adequately unlikely and what isn't, but that process
           would evolve as they went through their facility and
           identified different types of situations that needed
           to be dealt with.
                       This just is talking about doing an ISA. 
           NUREG-1513 has been published.  That was the ISA
           guidance document.  It focuses primarily on process
           hazard analysis and on the sort of project management
           level of what is involved in an ISA.  That has been
                       It has in it one key thing, I think.  It
           has a flow chart for selecting an appropriate method
           for identifying accidents.  I think that is probably
           the most important single thing in that guidance
           document.  If you use a "what if" method for a very
           complex process, that's just not appropriate.  I think
           you need a method that is appropriate to the
           complexity of the process.
                       There is also NUREG/CR-6410 is the
           Accident Analysis Handbook.  It's about this thick. 
           It gives a lot of guidance on doing the kind of
           consequence evaluations that come up in the context of
           the fuel cycle facility.  
                       It's actually fairly rare that one would
           actually need to do very many quantitative
           calculations of off-site consequences for a number of
           reasons.  In an uranium facility it's very difficult
           to cause a release of material.  
                       The material has such a low specific
           activity and such a non-volatile form most of the time
           that it's very difficult to give off-site radiological
           consequences that reach the thresholds we were talking
           about because we're talking about 5 rem off site to
           the public.
                       For chemical consequences likewise it
           usually is not that necessary to actually do
           quantitative evaluations.  If you did need to do one,
           it can get -- these chemical transport models can get
           quite involved because UF6 is a very heavy gas so the
           6410 has some guidance on that kind of thing.
                       MR. GARRICK:  You might be a little
           generous in saying that you have defined some of these
           thresholds quantitatively because I think in the risk
           world when we think of something -- when we think of
           a quantitative result, we don't think of a number.  
                       We think of a probability distribution
           because it tells much more of the story than is told
           by the number.  I'm just saying that because one of
           the issues we're always dealing with in the risk
           informed world is the consistency of the language.
                       DR. DAMON:  Well, this reminds me -- the
           issue of consequences reminds me of something that
           came up in Yawar's presentation.  The question was --
           he was talking about off-site consequences and whether
           those had to be calculated for average conditions or
           whatever, that issue.
                       The point is actually they have to be
           calculated for the most extreme possible condition
           that could ever occur.  In other words, all we're
           saying is if there is a spectrum of possibilities and
           if one of those in that spectrum, even if it's a far
           outlier exceeds the thresholds of the rule, then to
           that segment of the spectrum of everything that can
           happen must be addressed.  
                       The fact that it would take extreme -- it
           might take extreme weather conditions or whatever to
           cause a 5 rem dose or whatever, they would have to
           consider that.
                       MR. GARRICK:  Then, again, there's an
           inconsistency in the jargon of what we mean by risk
           because what you're suggesting here is that your
           basing your risk-informed results on the basis of
           bounding analysis and extremely conservative
                       Again, that is kind of a contradiction of
           the whole concept of risk assessment which was
           invented in order to have a mechanism by which we
           could have what is our best shot at what the risk is. 
                       We want that because that gives us a
           baseline against which to know how conservative, for
           example, we should regulate it.  It's a philosophical
           point but it's one that both the ACRS and the ACNW is
           constantly working on.
                       DR. DAMON:  What I was meaning to say
           about that, and it actually says this in the Standard
           Review Plan ISA chapter, when it talks about
           consequences I recognize in writing that that you have
           this question.  You have a release.  
                       Well, a release could be large ones, some
           small ones, the weather conditions could be different,
           the wind could blow in one direction or the other. 
           The question is what do you need to consider.  What it
           says in there is that if there is any scenario that
           would exceed the threshold of the rule, then that
           needs to be considered.  
                       The unlikeliness of that can then be
           credited in evaluating whether it is highly unlikely
           or not.  All I'm saying is there's a spectrum of
           things.  I don't think it's appropriate to say I get
           to select the average thing that could happen and if
           that average thing doesn't trip the threshold, I get
           to throw away and I don't need to consider or limit
           that or regulate that risk at all.  
                       No, you look at the tail and you have to
           go all the way out.  Could you ever exceed these
           threshold and then you can credit yourself.  We all
           know stability class F and so on doesn't occur very
           often and they can credit that in their likelihood
                       Like I say, it doesn't come up very often
           that they have to worry about these things.  This is
           getting into what I said earlier, is that the Appendix
           A method talks about -- uses this index scoring
           method.  It's a tradition, a standard, an industry
           consensus standard within the criticality community to
           try to achieve whenever possible a thing called double
                       This is the statement of double
           contingency.  You can see the community in the
           criticality safety, which is one of the predominant
           things that could cause a fatality among all the
           accidents identified, the community already is using
           what I call risk-based language.  
                       They are talking about independence and
           unlikely and redundancy and these characteristics. 
           Usually their understanding of these things is not
           exactly the same as someone who comes from a
           quantitative background.  That's what I say, I would
           like to start talking the same language.
                       This is an example of what I mean by the
           fact the index method in Appendix A really just lays
           out an accident sequence.  This is for a system of two
           active redundant controls.  The equation for the
           frequency of the accident, namely the accident being
           the two things happen, is expressed this way where the
           lambda's are the failure rates and the U's are the
                       You have two controls, control 1, control
           2.  There's two different ways you can have an
           accident.  Control 1 can fail first and then while
           it's out, while it is unavailable the control 1 can
           fail or vice versa.  You have this equation and that's
           what the method of Appendix A does.  It explains that
           is what these indices mean, that they refer to these
                       MR. POWERS:  Does it deal with common mode
                       DR. DAMON:  Common mode failures?  It
           alludes to them in the thing.  If the common mode
           failure is something explicit that they can identify,
           it should be a separate item.
                       MR. POWERS:  We usually have trouble
           identifying common mode failures.
                       DR. DAMON:  That's certainly true.
                       MR. POWERS:  I don't know that you can
           excuse them by saying we can't identify it so it's not
                       DR. DAMON:  There's a whole discussion in
           Appendix A on the question of independence which
           involves common cause.  I think it is one of the most
           important things and it is discussed in there that you
           can't treat this cost of independence lightly.  
                       It comes up even more strongly when you
           start talking about the fact that many of these
           processes are operated by human operators.  If you've
           got requirements on the operator as to the correct way
           of operating a process, when can you count on mistakes
           being independent of one another?  
                       That's a serious question.  We might get
           into that in the guidance document that Yawar is
           talking about.  There are certain standardized ways of
           looking at that issue as to what is sufficiently -- I
           mean, for example, one of the criteria would be that
           human errors are independent if they are committed by
           people on two separate watches, two separate shifts. 
                       In other words, you don't ever count human
           errors as being independent if they are committed by
           two people who are communicating with one another
           because they are standing the same shift together.  
                       It's like the incident that happened with
           the submarine off Hawaii.  They had a redundant system
           there.  The captain is supposed to look through the
           periscope and look for ships on the surface and the
           sonar watch is supposed to be looking for them, too. 
                       But the guy who was plotting the sonar
           watch heard the captain look around with his periscope
           and said there was nothing there.  He said, "Gee, I
           think there is something there,"  but I'm not going to
           say anything.  He's the captain.  That's not
           independent.  It's not an independent failure.  That
           kind of thing I think is extremely important in the
           way these --
                       DR. KRESS:  On that particular side is T2
           something that is knowable ahead of time because of
           frequency of inspection or test or something like
                       DR. DAMON:  Right.  That's what I'm trying
           to point out here.  We are expanding the
           unavailability number out here, the U2, into lambda 2
           times T2.  That's done deliberately in the method in
           Appendix A to point out to people exactly what you
           just said, which is you should often know what that
           outage time is because you will have a surveillance
           interval or you will know something about the process. 
           It will tell you it's not as indefinite as a failure
           rate is.
                       DR. KRESS:  The lambda 2 is a failure rate
           that -- does it count things like the fact that they
           did maintenance on it and the maintenance caused it
           not to be operable for some reason the next time?  Is
           that included in the failure rate?
                       DR. DAMON:  They should. 
                       DR. KRESS:  Count all failures.
                       DR. DAMON:  Yes.
                       DR. KRESS:  So it needs a database ahead
           of time for this failure rate.
                       DR. DAMON:  Well, the kind of facilities
           we're talking about people don't usually have anything
           that would amount to a database but they have to rely
           on their own memory.  They do keep track of things
           that have happened at their facility.  
                       In fact, in the PHA methods for how you do
           a PHA, one of the things that is mentioned is you
           should go back -- when you're doing the PHA on a
           particular process, you go back and retrieve whatever
           performance history you have on this thing, what have
           been the maintenance failures.  
                       Has somebody done maintenance and failed
           to restore the system or do a post maintenance test
           and that kind of thing.  That guidance is given to
           them so that is something they should consider.  
                       I can remember going to BWXT and that's
           one of the first things they showed me.  They marched
           through their methodology and that is a standardized
           part of it, you know, Chapter 1.6 or something and
           that's it.  That's what they do.
                       DR. KRESS:  In a PRA they would have used
           lambda 2 times T2 over 2.  I guess in this kind of --
                       DR. DAMON:  Yeah.
                       DR. KRESS:  It's such a small difference
           that --
                       DR. DAMON:  That's why the approximation
           sign is in there.
                       DR. KRESS:  It's probably not worth
           worrying about.
                       DR. DAMON:  All I'm saying this is what
           was laid out in the Appendix.  It's just a direct
           translation of how you quantify an accident sequence
                       DR. KRESS:  Why is it felt that inviting
           up these things like frequency of occurrence into
           units of a factor of 10, why is it thought that is a
           sufficiently small unit to divide it up?
                       DR. DAMON:  I would say -- I mean, in
           retrospect I would say it's probably -- I mean, I
           could be easily convinced that you would use half
           orders of magnitude would be a little better.  At the 
           time --
                       DR. KRESS:  It's sort of a finite
           difference in approximation of sorts.
                       DR. DAMON:  Yeah.  I hadn't had much
           experience in actually doing quantitative analysis of
           fuel cycle type systems at that point so I put it as
           single integers.  
                       In retrospect after having done a little
           bit of this as an exercise to see how things work, I
           am convinced it would be worth going to half orders of
           magnitude but not much beyond that because of the way
           things are being treated here these are --
                       DR. KRESS:  Maybe about as close as you
           can get them.
                       DR. DAMON:  Yeah.  Considering the range,
           the uncertainties involved in these things, there's
           not much point in going further than that.
                       DR. KRESS:  If you had a set of identified
           accident sequences and most of them fail up near the
           10 to minus 4 if your range was minus 4 to minus 5,
           would you treat that differently than a case where
           most of them fell down near the 10 to the minus 5?
                       DR. DAMON:  I'm not sure what you're
                       DR. KRESS:  Would you give it more of a
           regulatory look at it?  Would you consider it more
           problematic if you were very near -- most of them were
           very near the one edge or the other so the summation
           of all of them might look differently.
                       DR. DAMON:  There was some discussion of
           that in the Standard Review Plan as to how to deal
           with that.  It's somewhat -- how do I put it?  It
           would be somewhat problematic as to the regulatory
           status of trying to pursue that argument because of
           the way the darn rule was written.  
                       It's written as per accident sequence.  It
           was understood at the time that it was written that's
           a problem to state it that way.  Given that you're not
           going to require quantification, then you can't
           require accumulating risks from different accident
           sequences together in some other way.  It was a
           dilemma you're stuck with with this kind of
           intermediate --
                       MR. GARRICK:  So what you're end up with
           is a -- the word integration needs an asterisk because
           you're integrating horizontally but nor vertically.
                       MR. LEVENSON:  I have a question. 
           Appendix A provides guidance and examples for
           determining likelihood.  Is there somewhere else
           guidance as to how to estimate consequences?
                       DR. DAMON:  There's discussion in the main
           body of the appendix.  There's a consequence section
           that talks about evaluating consequences and some of
           the issues that will come up in the process of doing
           it.  But it doesn't get into the technical details of
           what constitutes a realistic model that the staff
           would find acceptable or not acceptable.  
                       That's discussed in this NUREG/CR 64-10,
           that accident analysis handbook gets into what the
           staff thinks about the adequacy of the current state
           of models as of about three or four years ago when
           that thing was published.
                       MR. LEVENSON:  Since that is published
           three or four years ago means it was written maybe
           five years ago.  Is there any risk-based significance
           in that guidance or is it pretty much all historical
                       DR. DAMON:  I'm not sure.  I mean, mostly
           what it talks about is methods for calculating or
           estimating the consequences of accidents whether
           chemical or radiological so it's standard atmospheric
           dispersion, wake effects.
                       MR. LEVENSON:  Yeah, yeah, yeah, but a lot
           of the stuff done five or six years ago had somewhere
           from two to four orders of magnitude of over
           estimation in the methods which is not exactly
           compatible with risk-based analysis.
                       DR. DAMON:  This method here -- I mean,
           the Part 70 structure again, like I say, is pretty
           rigidly risk-based.  It's not encouraging people to do
           anything that's what I would call bounding analysis or
                       It really is one that is focused on
           managing the risk by identifying what are the
           consequences that could happen really and really
           identifying what you think of the likelihood.  None of
           the language in here is -- there is a use for bounding
           consequence evaluations in doing an ISA which is if
           you can -- it can be used as a screening method but
           it's not embedded in the regulation as a screening
           method.               What I mean by that is you can
           think of very extreme case release of material if you
           show that even the most extreme case does not exceed
           the threshold specified in the rule for off-site
                       Then you just can wave your arms and say
           I don't need to consider off-site consequences for any
           releases of that type in the plant because I bounded
           it by this one evaluation.  You can use screening
           analyses like that.  That also is described in the
           Chapter 3 how that's to be done.  
                       It is actually I think in the consequence
           section the idea of using screening analysis, but it's
           also explained that if it comes out the other way,
           namely an extreme case does exceed the threshold of
           the rule, then you need to have considered that.
                       I would like to kind of get on to --
                       MR. GARRICK:  Yeah, you've got about five
                       DR. DAMON:  Let's see if I can get to the
           end of this thing.  I've got here -- I just wanted to
           talk a little bit about BMXT is one of the two
           licensees that have submitted an ISA plan and
           described their approach and it has been approved by
           the staff.  I thought I would briefly go over what
           they did so you can see how that relates to what this
           Appendix A thing.
                       BMXT uses various hazard identification
           methods, PHA type methods.  The hazard office uses it
           very frequently which, if you are familiar with it, is
           a very structured rigorous way of going through a
           piping system that has things about it like flow,
           temperature, pressure and marching through these
           various parameters and asking yourself what happens if
           this parameter is on the high side or the low side and
           so on.  It's a nice structured method for dealing with
           certain types of systems that frequently occur in the
           plant so they use it a lot.
                       The BWXT method does use -- has used
           integer indices for consequence very unlikely
           evaluations.  They categorize consequences in various
           bins.  Two of those bins are highly unlikely and
           unlikely, but their system is actually more -- goes
           beyond that on both sides.  They consider less severe
           events which they have reasons why they want to
           consider that in managing their plant.
                       They also consider ones that are more
           severe than the ones that are in the rule but it
           includes the two that are in the rule.  Like I way,
           they have a consequence index and they have a
           likelihood index or score.  
                       Then the combination of the two defines
           which -- that matrix of consequence indices one way
           and likelihood indices the other way defines a matrix
           full of squares and they define which of those are
           acceptable risk.  
                       Basically, for example, one of the ones
           that concerned us was high consequences in their
           system requires a score of minus 4 in likelihood. 
           That's basically the method they use.  Of course, it
           facilitates a direct translation for us into whether
           that's compliance with the rule.
                       The likelihood index that they use, the
           one that I described to you in Appendix A, the number
           of factors or number of indices that could be added
           together would depend -- it would be situation
           dependent.  It would depend on how many events in
           sequence had to happen, how many outage times, and so
                       The BWXT method is simplified down to
           really only two indices, an initiator index and a
           protection factor index.  The initiator index is --
           again there are tables of qualitative criteria.  Here
           is one of the tables for the frequency of initiating
           events.               There are qualitative criteria. 
           You can call them qualitative or quantitative or
           whatever you want to call it but there are criteria to
           get a score for the initiating event part of the
           score.  Like I said, it's used --
                       MR. GARRICK:  Dennis, I know there's quite
           a bit of effort given and some of it is certainly
           quite creative given to establishing these indices and
           what I might call utility functions or scores or what
           have you.  
                       Mathematically often what we are trying to
           do here is scalerize a vector, something that
           describes a system in terms of specific elements
           because people sometimes have trouble grasping and
           making decisions on the basis of multiple elements try
           to transfer that into some functional form or a
           utility function such that it accommodates a simple
           ranking system.  
                       I believe in our business, in the safety
           business, it's very important for us not to obscure,
           if you wish, what is really happening in terms of the
           accident sequence.  
                       Whenever I'm involved in reviewing an
           accident analysis of any kind whether it's a HAZOP
           based on or a PRA based one, I'm not comfortable until
           I really see what's going on phenomenologically and
           how you get from the initial condition or the
           initiating event to the end state or the consequence. 
                       I trust that the NRC is not getting too
           wrapped up in what I would call this tail end exercise
           of casting these results into pretty much a
           dimensionalist unitless form.  I'm basically against
           those in this business but I can understand and
           appreciate why that's being done.  It has a nice clean
           structure to it.  
                       If you read the Harvard Business School or
           the Stanford Business School reviews you'll find that
           a lot of the papers in there are on just this, on how
           to establish utility functions for decision making. 
           That's not, in my opinion, something we want to give
           too much emphasis to.  
                       We really don't want to allow ourselves to
           get into the position of not asking what's behind this
           and the kind of physical terms and physical processes
           and calculations that really give us a firm grasp on
           what's happening.  That's a long comment and speech
           but I think it does represent sort of something that
           we want to be very much on guard for in licensing
           these facilities.
                       DR. DAMON:  I certain concur with that. 
           I think the licensee's professional safety staff, the
           people that do this stuff and the ones that use it,
           they also have that concern.  
                       I think it's actually, to tell the truth,
           my belief -- which I don't know how credible this is
           but my belief is it's at the root of their concern
           about using PRA is that they are afraid it will be
           used in this sufficial way.  
                       I think they don't realize that in general
           people who have been using PRA long enough, they have
           learned that lesson that you have to -- this is not
           just a game of putting numbers on things.  It's a game
           of focusing on the reality of what's going on.  I know
           I learned that lesson.  I spent a lot of years doing
           maintenance on hardware and one of my beliefs is that
           failure rates 
           -- how do I put it?  Failure rates are made, they are
           not born.  They are made by the staff of the facility. 
           In other words, there is no inherent failure rate to
           a piece of equipment.  It's how you operate it and
           maintain it.
                       MR. GARRICK:  All right.  We've got to
           wrap this up.  Dana, since I overtook my time on
           questioning, I'll allow the committee, of course, to
           ask whatever questions they want.
                       MR. POWERS:  The most striking thing about
           this, giving an example, a redundant system not to
           include the concepts of common mode failure is
                       MR. GARRICK:  Yes.
                       MR. POWERS:  I'm not sure how illuminating
           it is to tell people to multiply two small numbers
           together to get a much smaller number.  That won't be
           very helpful in understanding how the system avails
                       The general difficulties of uncertainties
           and these numbers seem to be handled better by the
           scale than I had anticipated.  I mean, if we're only
           working in decade scales whether you've quantified the
           distributions of a particular parameter accurately or
           not may be less consequential than perhaps I'm used
                       The common mode failure, I just don't
           think you can ignore that.  It's just misleading to
           multiply 10 to the minus 2 times 10 to the minus 4 and
           get 10 to the minus 6 and then walk away happy.
                       MR. LEVENSON:  Well, I just am not at all
           sure that the very significant part of this whole
           issue which is consequences has had anywhere near as
           much attention as the probability.  
                       For instance, if I look at the example in
           Appendix A in Table A-12, I think there's probably
           orders of magnitude of conservatism.  Nobody is
           studying the probability of the consequence.  In
           essence, now likely is the proposed consequences?
                       For instance, if you drop U02 on the floor
           and there's some water, the model says it stays
           critical for an hour.  I don't think there is any
           place in the physical world where that kind of
           critical mass doesn't disassemble itself in fractions
           of minutes.  
                       I just think that the whole area of
           consequence -- maybe I'm wrong but my perception at
           this point is that the issue of consequence has not
           been addressed nearly as adequately as the matter of
                       MR. GARRICK:  Tom.
                       DR. KRESS:  Well, I agree with what I've
           heard so far.  One thought is this is an overall risk
           allocation process of accident sequences.  I've yet to
           see a real over-arching philosophy on how you go about
           doing that.  
                       Include things like uncertainty, risk
           contribution of each accident sequence and how those
           uncertainties, contribution, and defense in depth in
           general add up to an overall risk acceptance criteria. 
           That over-arching philosophy to me is not transparent
           anyway.  It may be there.
                       The indexing process, while it is clever
           and doesn't look to me like it has any technical
           problems with it other than this common cause thing
           that Dana brought up, does in my mind tend to do what
           you said.  It obsticates the real issue to some
           extent.  I worry about that, although I think you
           could deconvolute the numbers and treat it like
           individual parts.
                       MR. GARRICK:  You only read two-thirds of
           the report.
                       DR. KRESS:  Yeah, that bothers me.  A
           third thought I had is I think in terms of
           quantitative risk with uncertainties, pretty much like
           you do, and here we have a process that is some sort
           of approximation of that.  I wonder if any thought has
           been given to taking the natural ISA out of some
           facility and doing both an ISA and a quantitative risk
           analysis as a sort of validation of the process.  
                       I'm sure the ISA is intended to
           approximate the PRA in a sense that it is a
           conservative approximation.  It would be nice to know
           what the margins are and how conservative is it.  The
           only way I know to do that is to compare it to a real
                       In that sense, I think there is still a
           need for overall summation risk acceptance criteria as
           contracted to the individual sequence risk acceptance
           criteria.  I see those as not exactly being there. 
           That is the only way I know how to make a
           correspondence with the PRA type of analysis.
                       I worry about selection of accident
           sequences and selections of processes as being a way
           to manipulate the system.
                       MR. GARRICK:  It's a selection in
           partitioning of sequences.
                       DR. KRESS:  I worry about that to some
           extent, too.  Basically that's the thoughts I had.
                       MR. GARRICK:  Okay.  Dennis, thank you
           very much.  I think we'll take a 15-minute break and
           that will put us about 13 minutes behind.
                       (Whereupon, at 10:28 a.m. off the record
           until 10:40 a.m.)
                       MR. GARRICK:  Can we come to order?  Our
           next talk is going to be given by Felix Killar.  He'll
           introduce himself and tell us what he's up to, as well
           as make a presentation.
                       MR. KILLAR:  Thank you.  As John said, I'm
           Felix Killar.  I'm with Nuclear Energy Institute. 
           I've been involved in this process and, as I go back
           and talk in my presentation with the history of it,
           I'm part of the history of it I've been involved with
           it for so long.
                       What I'll do this morning is give you a
           history of the rulemaking, how we got to Chapter 3
           which is the focus of today's meeting.  What are some
           of the future actions which, from this morning's
           presentation, it's a little bit of repeat.
                       And the integration of the safety program
           which is important because there's some aspect here I
           think they haven't touched on and I want to talk about
           that.  Then specifics on Chapter 3. 
                       The history goes back to 1986, the Sequoia
           Fuels event, which you touched on this morning.
                       MR. GARRICK:  It just seems like it was in
           the 1800's.
                       MR. KILLAR:  I know.  In fact, I was
           looking at some of this the other day and I said it
           seemed like it was just the other day that this
           happened and it was that long ago.
                       Anyway, as was touched on this morning,
           that was actually a chemical event.  There was a
           subsequent event there at Sequoia Fuels about 1987,
           '88, where they had another chemical event.  
                       There was a lot of issues raised as far as
           the NRC's responsibilities and authority in relation
           to EPAs and OSHAs.  There was a lot of work done to
           try and help clarify the responsibilities and make
           sure that there isn't either an overlap or a gap.  
                       Part of this came out in 1990 with the
           update of the OSHA memorandum of understanding with
           the NRC as part as chemical events and clarification
           with EPA as far as responsibility on site and off site
           and what have you.  That was sort of the basis for
           where we started on the rulemaking and changed the
           Part 70.  
                       Then in 1991 there was an event at the
           General Electric facility.  This was viewed from two
           sides, very different perspective.  From the NRC staff
           perspective this was a near criticality and major
                       From the industry's perspective this was
           an upset condition which they understood and they knew
           what was going on and they knew how to control it, but
           the information was not clear to the two sides and
           they were never able to really connect and understand
                       As a result of that, they needed to come
           up with a better way of understanding how the licensee
           runs their facilities and is comfortable with the
           safety of their facilities.  
                       They started a process back then of taking
           a group, a task force, that went out to the
           facilities, all the major licensees including some of
           the radio pharmaceuticals and things on that line and
           said, "If we had to regulate these guys from scratch
           with a blank piece of paper, how would we do it?  How
           would we change our existing systems?  How do we go
           out to make sure that we're looking at the right
           things?"  And what have you.
                       In 1992 they came out with NUREG-1324 and
           that was a synopsis of this study that they did on how
           to regulate the facilities.  There are a number of
           findings.  The principal findings were, first of, the
           NRC staff needed better training and understanding of
           the facilities.
                       Secondly they felt there needed to be an
           integration of the various safety programs.  There
           were reports done back in the '70s and '80s on the
           risk of these facilities.  The primary risk of these
           facilities is a fire.  Nuclear criticality risk is
           further down the road.  Radio protection for the
           workers is down the road and things on that line.
                       Looking at the risk of these facilities
           and when you're focusing primarily on the nuclear
           safety, nuclear criticality, and radiation protection
           second, you weren't really focusing on maybe what was
           the major risk of the facilities.  
                       We wanted to determine a process for
           integrating the various forms of risk whether it's a
           chemical risk, a fire risk, a nuclear safety risk,
           radiation protection risk, things on that line.  
                       When we started a process of talking about
           integration and the ISA, this is what we were talking
           about is the integration of those various programs. 
           We had a number of go-arounds back and forth with the
           staff in the mid-'90s to try and explain that and why
           it needed to be done even tough the 1324 kind of
           pointed that out.  
                       Finally in 1996 we petitioned for a
           rulemaking to explain specifically what we wanted to
           have in these integrated safety assessments and why we
           needed this integration.  Our rulemaking was accepted
           with some modifications and then we began working on
           and revising the Part 70 rule to reflect this.  The
           rule was finally released in October of 2000 after a
           number of iterations.  
                       The staff proposed several different forms
           of the rule which we found were not meeting the intent
           of what we felt we needed and was not meeting the
           intent of what we felt was the initiating events back
           in '86 and '92.  We went back to the commissioners and
           various people and got the staff to kind of focus down
           on the issue that we were really trying to resolve.  
                       Finally after going through several
           iterations October of 2000 we came up with the NRC
           finalized rule initiative.  They issue it without the
           SRP which is the thing that's been kind of ongoing
           since then.
                       As alluded to this morning, April of 2001
           the licensees had to provide their plans for
           submitting the ISAs to the NRC and all the existing
           licensees have done that.
                       What are the future actions?  By March of
           2002 the NRC needs to approve the ISA plans submitted
           by licensees.  As mentioned this morning, they have
           already approved two of them, NSFs and BWXTs.  
                       There is a total -- I'm trying to remember
           the number off the top of my head.  I think there are
           like eight facilities that have submitted these plans
           so they've got about six to go.  That's changing
           because of consolidations and shutdowns at some of
           these facilities.
                       The NRC is currently working on some
           industry guidance or some guidance on facility change
           process which is 70.72 and a backup provisional which
           was also in 70.76.  We've are kind of indifferent on
                       We felt that there's value in those but,
           at the same time, for the most part the licensees have
           already gone through and implemented their change
           processes to 70.72 so additional guidance may help but
           we really don't see a whole lot of need for it.
                       Similar in the backup provision.  The back
           fit provision comes in once you have your ISA
           approved.  We don't feel that there's a big need for
           the guidance for the backup provision but it may be
           helpful having it there.
                       Come October of 2004 all existing
           licensees must have completed their ISAs and submit
           the ISA summaries to the NRC for approval of the ISA
           summaries.  We're working on that schedule.  As the
           staff mentioned this morning, some of those will be
           submitted prior to that so the NRC will be working on
                       Also in 2004 anything that is identified
           as an unacceptable performance deficiency must be
           either corrected or a plan for correcting that
           deficiency must be completed.
                       These are the various chapters of the
           Standard Review Plan.  I left out Chapter 1 and 2. 
           Chapter 1 is just a general description of the site. 
           Chapter 2 is a description of your organization.
                       These make up what I would call the meat
           of the licensing application with Chapter 3 being the
           new chapter on Integrated Safety Assessment, and
           Chapter 11 being the new chapter on Management
           Measures.  Those two came out of the two events as I
                       How do you integrate the various safety
           aspects of it and how do you manage those safety
           aspects to assure they will be performed when they
           need to?
                       The other things, radiation protection,
           nuclear criticality safety, chemical safety, fire
           safety, emergency management, protection
           decommissioning, they have not substantially changed
           in years.  We've done tweaks and modifications and
           stuff but they have not substantially changed in
           years.  These two chapters, 3 and 11, are the two
           chapters that came out of the events in this time to
           process it. 
                       What are the issues that we have with
           Chapter 3?  We have very few issues with Chapter 3. 
           Because of this process that we went through to get to
           the rulemaking and as we've gone through with the
           staff working on the Standard Review Plan, we do not
           have any problems at all with the Standard Review Plan
           and with the rulemaking at this point in time.  
                       Our issues now are what we call
           implementation issues and the implementation issues
           are what is acceptable.  We've only had two ISA plans
           submitted so far.  We have not had a full ISA summary
           submitted and approved by the staff so we are out
           there trying to make sure the package we are putting
           together is acceptable to the staff.
                       Some of the issues we have is how detailed
           does the ISA summary need to be?  That has been the
           biggest stumbling block that we've had in this whole
                       In fact, a number of times we threw up our
           hands and said, "Hey, look.  If the staff isn't happy
           with our ISA summary, come and look at the whole ISA
           or we will put the ISA, the full ISA, on a CD-ROM and
           ship it to you and you can sit there and look at it
           all you want because we cannot come to terms on what
           the level of detail needs to be in the ISA summary." 
           I think we have come to terms but now it's a matter of
           do we really understand the terms we've come to.
                       How quantitative does it need to be?  I
           think Dennis gave you some of that this morning.  The
           industry is basically a chemical industry.  Part 70
           facilities are basically chemical industry that
           handles radioactive material.  
                       As Dennis alluded to also, a lot of the
           work is done on HAZOP because HAZOP is what the
           chemical industry typically has used for years and
           what this industry has used for years for doing their
           typical safety analysis for the chemical safety of the
           facilities and they've taken that and expanded that to
           look at nuclear safety radiation protection.
                       We don't do a whole lot of quantitative
           type analysis.  Ours is more qualitative type analysis
           so we have a question about where the -- how
           quantitative it needs to be.  There are certain areas
           in the plant where a quantitative analysis will make
                       It's a unique situation, a very integral
           component or operation where you have to go through
           and look at it.  For a lot of the operations at the
           plant a very basic type analysis, even what-if type
           analysis, will be adequate for evaluating those
                       I might allude, too, I talk about
           evaluating processes.  One of the things I want to
           point out is that when we talk about a process, that
           process can be defined as just changing it from this
           table to that table or the complete process from
           beginning to end to get it from one form to another
                       It's a function of the detailness or
           sensitivity of that process in the analysis that we
           do.  When we look at processes, it can be chopped up
           in individual steps in the process it we can look at
           the whole nine yards.
                       DR. KRESS:  I'm trying to decide on the
           reasoning behind NRC thinking an ISA summary is
           sufficient.  Is that just to save time in their
           review?  You have the full ISA.  How big is it?  Is it
                       MR. KILLAR:  They are fairly huge.  BWXTs,
           I think they're probably in the order of about eight
           to 10 three-ring binders so they are similar to back
           at the FSAR stages.
                       DR. KRESS:  Back in FSAR.
                       MR. KILLAR:  Back in those days.  And they
           are rather detailed.  One of the concerns and reason
           why we went to the submittal of the ISA summary rather
           than the ISA.  What we found with our facilities is
           that they are very consistent but they change every
                       The basic process stays very much the
           same.  We make U02 to F2 routinely every day.  For
           today we may tweak this parameter or we may tweak that
           parameter and tomorrow or next week we may go a
           different direction.  
                       The process still has changed but we've
           tweaked these things in here and we need to have the
           ability to look in and say as we change or tweak this
           thing, what impact does that have on safety without
           having to go back through and do a complete ISA and
           submit a complete ISA to the staff for their review
           and consideration.
                       The other thing that we want to get out of
           all this program is that one of the biggest issues the
           NRC and the licensees have is timely license renewal. 
           Part 70 licenses run anywhere from five to 10 years. 
                       Under the Part 70 rule when we submit a
           license application for our license renewal
           application, we can continue to operate under existing
           license until that renewal application is finalized. 
           In some cases that renewal application has lingered in
           the organization in getting it completed for four to
           five years.  
                       We felt, and the NRC probably felt, that
           this was not the way to do business, so one of the
           things we want to do with this process with the new
           Part 70 and with the ISA process is keep a living
           license.  When our nine or 10 years are up, five years
           are up, whatever the time period is, they have kept
           abreast of the changes in the facility.  
                       We will keep them abreast of the changes
           with the ISA summary.  There should not be any major
           program changes so we would think that the
           programmatic programs such as radiation protection,
           nuclear criticality will not substantially change.  It
           should be a fairly simple license renewal at that time
           period.  That's one of the major benefits we see in
           going through this program.
                       And just to touch on a last point here,
           how do all safety programs together.  That's the issue
           that we have is that we want to make sure the
           understanding is how the safety programs work
                       If we want to put more emphasis in this
           area because we feel it's more important to spend more
           time and resources on fire safety than it is on
           nuclear safety or radiation protection, we should be
           able to demonstrate the balancing of those between
           themselves as far as safety to the facility and to the
                       That's my quick pitch here this morning
           because, like I say, we don't really have any major
           issues with Chapter 3 right now.
                       MR. GARRICK:  Questions?  Is this issue of
           the scope of the ISA summary resolved now in your
                       MR. KILLAR:  Yes and no.  It's resolved in
           our understanding of what the expectations are.  Until
           we actually have an IGA summary submitted and approved
           by the staff it's still an open issue.  We do not have
           an ISA summary that has been submitted and approved by
           the staff according to the new rule.
                       We have had some ISAs that were done for
           parts of facilities prior to the rule that have been
           approved so we have an idea, but now the rule has
           changed a little bit of the basis and things on that
                       One of the things that we did with the
           April notifications is identify what changes had to be
           done from what the previous ISAs we submitted in order
           to meet the new rules but we have not had an ISA
           summary that has been submitted and approved under the
           new rule yet.  Until we get through that process, we
           still have that question in our minds.
                       DR. KRESS:  My interpretation of what you
           said earlier is that the licensee is more or less
           committed to the summary as its licensing basis as
           opposed to the full ISA.  Is that an interpretation
           that is correct?
                       MR. KILLAR:  That's borderline.  The way
           the rule reads is the NRC does not approve the ISA. 
           They approve the ISA summary.  But the way they
           approve the ISA summary is that they look at the ISA
           summary, look to see if there are any questions in
           there about what they've done based on their knowledge
           of the facility or knowledge of operations and things
           on that line.         
                 If there are questions, they have the ability to
           go down and do a vertical cut of the ISA itself at the
           facility to see how part of that is reflected in the
           ISA summary.  They quasi approve the ISA by approving
           the ISA summary.  Per the rule, they are only
           approving the ISA summary.
                       MR. GARRICK:  One of the problems I've
           observed in the application of the PHA technology in
           some plants is it's not always easy to make the
           connection between the individual contributors and the
           end results or the end state results of the sequences. 
                       What some of the people that are heavily
           engaged in using this kind of technology are doing is
           beginning to look at specific contributors that pop up
           as important in more detail and, in fact,
           probabalistically building a little PRA model of those
                       In a sense, that is proven to be very
           constructive.  It provides some of the things that Tom
           was talking about earlier of baselining the difference
           in results you might get from an ISA and a PRA but at
           a level that is not quite the commitment that you
           would have if you would try to do it for the whole
                       MR. KILLAR:  Let me address a couple of
           points.  That reminded me of a point that was brought
           up earlier this morning.  One of the things that the
           industry was concerned about is that our facilities
           are not connected and interconnected similar to a
           reactor facility.  
                       Like I talked about earlier, when we
           review a process we can either chop it up in pieces or
           we can do the whole process because if this piece
           fails it has zero impact on the rest of the operation
           up there.  It has zero impact on it as far as
           radiation protection, criticality safety or anything
           along that line.  
                       We can look at these as individual pieces
           or we can look at the whole process because they are
           not interdependent as far as the safety is concerned. 
           Now, there certainly could be some interdependence.  
                       If this causes a fire, it may impact those
           operations down there.  As an independent device, as
           an independent operation, the operation safety does
           not necessarily require this operation here as well.
                       Secondly, in some of the facilities I've
           gone through and did the ISAs, they've put together
           ISA teams and they felt that -- they found a lot of
           value of putting these ISA teams together because of
           some of the issues you just brought up.  
                       Some of the things that the nuclear
           criticality guy is sitting there working on and
           thinking about, he may not have thought about in
           radiation protection.  
                       I said, "Hey, did you think about this?" 
           He said, "No, I need to put that in there because of
           what ifs or whatever and stuff."  The teams have help
           provide more depth and more understanding of their
           facilities, a better handle of the safety of their
                       To the other extent, one of the things one
           of our members found is that they got into doing a lot
           of the analytical type analysis and things on that
           line and they found that they got distracted because
           they were focusing on the numbers and not the real
                       They said, "Oh, gee. Is this 10 to the
           minus 4th or 1.3 times to the minus 4th?"  In the crux
           of things it didn't make any difference but they were
           focusing so much on that they were kind of getting the
                       MR. GARRICK:  But PRA is not to do that.
                       MR. KILLAR:  Right.
                       MR. GARRICK:  You are supposed to focus on
           what can go wrong and keep the attention on the
           scenarios if you wish.  People that tend to get hung
           up on the numbers, they themselves are not practicing
           the art the way it was intended.
                       MR. KILLAR:  And that is exactly the point
           I was trying to make.  There was a concern when some
           of the members said they saw the ISA team getting
           involved in the numbers and not really looking at the
           understanding of what they were doing and stuff and
           they corrected that.
                       There was another point I was going to
           mention but I can't recall off the top of my head what
           it was.
                       MR. GARRICK:  Any other questions?  Okay. 
           Thank you.  Thank you very much.
                       I guess we are now going to hear from the
           NRC staff.  We'll ask each member to introduce
           themselves and tell us a little bit about their job
           and proceed with their presentation.
                       MS. BAILEY:  Good morning.
                       MR. GARRICK:  Good morning.
                       MS. BAILEY:  I'm Marissa Bailey.  I'm a
           Senior Project Manager in the Risk Task Group.  I'm
           here this morning to basically -- turn on the mic --
           give you an overview of our activities, our risk
           informing activities in the Risk Task Group.
                       I and Dennis Damon will be doing this
           presentation because our section chief Lawrence
           Kokaiko doesn't have a voice today.
                       MR. GARRICK:  Sounds like an excuse to me.
                       MS. BAILEY:  Basically our activities in
           the Risk Task Group fall into three categories;
           supporting the risk initiatives and risk related
           activities in the different NMSS divisions, developing
           and implementing risk related training, and then
           developing and implementing a framework for risk
           informed regulation in the materials and waste arenas.
                       What I want to do is just go very briefly
           over the first two bullets.  I and Dennis Damon will
           then spend most of the time going over the status of
           the third bullet as far as where we are in
           implementing risk informed regulations and conducting
           the case studies, and also developing safety goals.
                       As far as assistance to the divisions in
           NMSS goes, this is a list of some of the activities
           that we have been involved in or that we expect to be
           involved in during the next year.
                       I think most of you have heard this
           before, but basically our goal here in our assistance
           and peer review activities is to ensure that risk
           methodologies are applied consistently, to basically
           make sure that the staff's regulatory positions are
           consistent with their risk significance, and also to
           just provide general guidance and assistance on the
           use of risk information and risk assessment methods.
                       In regard to training, we have implemented
           several training courses or we are developing or they
           are in the development phase.  At this point there are
           three introductory courses in risk assessment that's
           being offered.  There's one for the technical staff,
           one for the technical manager, and then one for the
           administrative staff.
                       We are offering a course on quantitative
           frequency analysis for fuel cycle.  We are in the
           process of developing a training course on the use of
           the by-product material risk study, and also
           developing a handbook for that.  And we are assessing
           other risk-related training with the technical
           training center.
                       DR. KRESS:  Are those courses held here in
           White Flint?
                       MS. BAILEY:  Yes.  Or in the region.
                       DR. KRESS:  Or in the region.
                       MS. BAILEY:  Now I want to basically get
           into what's been I would characterize the major
           activity in the Risk Task Group over this last year. 
           Basically that is implementing and developing a
           framework for risk-informed regulation in the
           materials and waste arena.
                       SECY-99-100 and the SRM for that has
           really provided the basis and guidance for what we've
           been doing in the Risk Task Group for the last year. 
           The first phase of that has involved conducting case
           studies.  Just very briefly, let me go over Secy-99-
                       This was issued by the staff back in March
           of 1999.  In this commission paper we proposed a
           framework for risk informed regulation in the
           materials and waste arenas.  That framework also
           involved a five-step process for moving forward with
           risk-informed regulation.
                       In that five-step process the first step
           was to identify candidate applications that would be
           amenable to risk-informed regulation.  Although in
           NMSS we are probably -- there are areas that are
           further along in this five-step process, in general we
           are in step one of this five-step process.  In other
           words, we are still pretty early in the process of
           trying to identify candidate regulatory applications.
                       IN the SRM SECY-99-100 which was issued
           back in June 1999 the commission approved the proposed
           framework.  They also directed the staff to develop
           materials and waste safety goals that would be
           analogous to the reactor safety goal.
                       DR. KRESS:  Did they give you any guidance
           on what the word analogous meant?
                       MS. BAILEY:  No.
                       DR. KRESS:  You have to do that yourself?
                       MS. BAILEY:  I think we're feeling our way
           through it.  Dennis will be talking about where we are
           in this process as far as development safety goes as
           soon as I'm finished here.
                       So basically what we've done is we have
           developed draft screening criteria to help us identify
           those candidate regulatory applications that are
           amenable to risk informed regulation which, again, was
           step one of that five-step process.
                       We also adopted a case study approach to
           help us test the draft screening criteria and also
           help us begin to process and develop safety goals. 
           The case studies would be retrospective looks at a
           spectrum of activities in the materials and waste
                       Individual and cumulatively they should
           tell us or illustrate for us what has been done in the
           materials and waste arenas with respect to using risk
           information.  To what extent have our activities been
           risk informed or not risk informed.
                       The objectives of the case studies were to
           test the draft screening criteria and produce a final
           version, to examine the feasibility of safety goals. 
           If they are feasible, develop a first draft.  
                       Then the subsidiary objectives of the case
           studies were to gain insights on how we could risk
           inform our regulatory processes and also gain insights
           on what tools, data, methods, guidance we would need
           to implement the risk-informed approach.
                       MR. GARRICK:  Now, the Risk Task Group
           came into being after the ISA process was pretty well
           developed.  Is that not correct?
                       MS. BAILEY:  Lawrence, can you answer
                       MR. KOKAIKO:  I have a little voice.  Just
           not a sustained one.  The ISA process had already
           started before the Risk Task Group had come together. 
           With Dennis Damon we followed the activities of it. 
           We revisited BWXT and Global Nuclear Fuel and were
           aware of what's going on.  We have not been in charge
           of development of the SRP Chapter 3.
                       MR. GARRICK:  Okay.  I'm just trying to
           get focused on what the Risk Task Group really is
           doing to risk inform the office given that the ISA is
           kind of the driver of the analysis effort and that it
           has already been pretty well established.
                       MR. KOKAIKO:  The ISA is the driver in
           fuel cycle for fuel fabrication facilities.
                       MR. GARRICK:  I see.
                       MR. KOKAIKO:  But in other areas of NMSS
           other things will have to be utilized.  NMSS is a
           broad regulatory spectrum from moisture density
           gauges, gamma knives, all the way to the repository.
                       MR. GARRICK:  Thank you.
                       MS. BAILEY:  These are the AK study areas,
           the areas that we conducted the case studies on, gas
           chromatographs, static eliminators, fixed gauges,
           uranium recovery, the decommissioning of the Trojan
           Nuclear Plant, transportation to the Trojan reactor
           vessel, the seismic exemption for the dry cast storage
           facility for the TMI defuel debris and INEL, and the
           seismic upgrades for the Paducah gaseous diffusion
                       Now, these areas or activities were chosen
           as case studies because we felt that they had elements
           of risk informed decision making in them, or because
           it was felt that these were activities that could
           benefit from risk-informed decision making.
                       I guess I would like to point out that at
           this point in time we have completed our case studies. 
           In fact, last month we held the last of the series of
           stakeholder meetings on the case studies.  
                       During that meeting we presented the
           insights that we gained from the case studies and also
           tried to get some feedback on how we could integrate
           the individual results of the case studies and move
           forward with risk informing our regulatory processes.
                       Now, at this point I would just like to
           summarize for you some of the general insights that
           we've learned or that we've gained from the case
                       With respect to the screening criteria, we
           basically found that they did encompass the relevant
           considerations for what we ought to be thinking about
           or what we ought to be considering as we try to decide
           whether an activity can be risk informed.
                       We did find that there should be
           considerations rather than criteria.  That's really
           just to reflect the fact that the screening
           considerations is a decision-making tool.  It's not to
           be a check list that gives you a black and white
           answer and that forces you to go down a certain path
           if the answer happens to be yes or no.
                       MR. GARRICK:  It's kind of in the spirit
           of being more risk informed and less prescriptive, I
           would say.
                       MS. BAILEY:  Okay.  Yeah.  Basically the
           outcome of the screening considerations is just
           another factor you ought to be taking into account
           when you try to make your decision.
                       Let me just go back to that slide.  The
           other thing I did want to point out was that we did
           find that the screening considerations is a useful
           decision-making tool and we're pretty much ready to
           finalize it.  
                       However, we did find that the application
           of it can be very subjective and guidance on how it
           should be applied needed to be developed.  We are also
           in the process now of trying to develop guidance for
           how to use the screening considerations.
                       Screening considerations themselves are a
           series of seven questions that we would ask.  The
           first four questions basically addresses the agency's
           strategic goals of maintaining or improving safety,
           improving efficiency or effectiveness, reducing
           unnecessary burden, helping or enhancing public
                       The fifth criterion addresses the
           availability of sufficient information to risk inform.
           The sixth criterion basically asks whether a risk-
           informed approach could be implemented for a
           reasonable cost.  
                       Then the seventh addresses other
           precluding factors.  Given that an activity meets the
           first six, is there anything else that would or should
           stop us from risk informing a process.
                       This next slide just gives you the exact
           wording of the screening considerations.
                       As far as safety goals go, which is the
           second objective in the case studies, the case studies
           showed us that it is feasible to develop safety goals
           and that a multi-tiered structure, similar to the
           reactor safety goals, is more possible approach, and
           if we did take that approach, we would have to develop
           subsidiary objectives for each program area.
                       We also found some implicit and explicit
           safety goals in the case studies.  We also found some
           examples where decision making could have been
           facilitated if a clear set of safety goals existed. 
           Dennis will go into the safety goals in more detail as
           soon as I'm finished.
                       As far as the value of using risk
           information, the case studies showed us that the use
           of risk information, at least in those eight
           activities, did help the staff to make decisions that
           were in retrospect consistent with the agency's
           current strategic goals.  They also found that the
           risk information can be useful in helping us identify
           shortcomings in our regulations or regulatory
                       However, for us to fully realize the
           benefits of a risk-informed approach. there are
           probably several things that we need to do in the
           future.  One, we need to continue with staff training. 
                       We probably need to introduce or develop
           risk-informed guidance on rulemaking and licensing and
           inspection and enforcement.  We have to develop safety
           goals.  We probably need to recognize that zero or
           zero risk is not possible, that it's impossible in the
           real world.  And we need to address human reliability.
                       With regard to tools and information and
           methods and guidance, the case study showed us that it
           exist in varying degrees.  In some cases there are
           tools and methods that would support a risk-informed
           decision making.  But, in some areas, some would have
           to be developed or some would have to be further
           developed.  Whatever tools and methods are out there,
           they all shared a common weakness of the human factor.
                       As far as where we go from here, we've
           completed our eight case studies so now we're on that
           yellow block.  We're in the process of trying to
           integrate the results of the case studies.
                       By December we hope to put out an
           integration report that would have the final screening
           considerations, have a first draft of safety goals,
           and could address some of the process improvements
           that we could make in the materials and waste arenas.
                       Also by December we hope to have developed
           guidance for how screening considerations should be
           applied.  Early next year what we want to do is start
           applying those screening considerations systematically
           to the program areas within NMSS and start trying to
           identify what areas could be risk informed.  In
           parallel with that, we also want to further develop
           and refine the safety goals with the help of the
           Office of Research.
                       I think that pretty much concludes my
                       MR. GARRICK:  Questions?  Thank you. 
                       DR. DAMON:  Good morning.  I guess I
           didn't introduce myself before.  My name is Dennis
           Damon and up until two years ago I had been working in
           the Division of Fuel Cycle Safety and Safeguards.  One
           of the things I worked on was the Part 70 rulemaking
           and the ISA chapter, the Standard Review Plan. 
                       Then about two years ago I became part of
           the Risk Task Group which at that time was under John
           Black.  Currently now it's under Lawrence Kokaiko. 
           I've been now involved in this broader spectrum of all
           the different risk-informed activities in NMSS since
           that time.
                       What I wanted to do here was to try to get
           fairly quickly to some of the interesting issues that
           come up when you talk about safety goals on the
           nuclear material side.  
                       I don't want to de-emphasize the
           importance of having done these eight case studies
           because if you go off and you try to develop safety
           goals in the abstract without looking at very specific
           cases, there's a danger that what you develop just
           doesn't apply to the real world of what these people
           are dealing with.  
                       That was the purpose of the eight case
           studies was to look at risk information in the context
           of eight very specific cases and see does this all
           make sense.  The idea would safety goals be useful to
           anybody in this NMSS area.
                       One of the conclusions from looking at
           case studies was, yes, it is sometimes.  It's not
           always a useful thing to have but quantitative
           measures of what is safe enough which would be a
           safety goal, a quantitative measure that would be a
           useful thing in certain specific situations that come
                       Then I just want to make it clear that I'm
           sure you gentlemen haven't been probably involved in
           the reactor safety goal side understand what is meant
           by a safety goal but I wanted to communicate that what
           the Risk Task Group's understanding of it is and this
           addresses that.  
                       It is a level that is safe enough but, as
           you notice in the third bullet, it's a level of risk
           that is low enough without explicit consideration of
           whether it's possible to achieve that value.  This is
           our understanding of it.  It's a level of safety that
           is inherently safe enough, not one that's conditional
           on whether you can achieve it or what it would cost to
           do that.  
                       The purpose of these safety goals is to
           facilitate risk management.  It is important to
           remember, and this is often forgotten once you start
           to get right into this risk management.  
                       When you start using risk information to
           manage safety, it very quickly assumes this flavor
           that these goals you're setting for yourself are
           requirements.  Like I say, by the definition of what
           I think they are supposed to mean, they are not
                       MR. POWERS:  Can we go back over this? 
           Define how safe is safe enough without any economic
           considerations?  Why did you conclude that?
                       DR. DAMON:  Oh.  
                       MR. POWERS:  I'm not sure what you're
           driving at here.
                       DR. DAMON:  What I'm driving at is that
           there are different concepts for what is safe enough. 
           One concept is in one aspect of being safe enough,
           it's the thing I should be.  I should be this safe.  
                       When you say you should be that safe, that
           implies it's possible to achieve it, it's reasonable
           to achieve it.  It's that kind of thing.  There are
           requirements in the regulations like ALARA that that
           is the concept.  It's a level of safety that is a
           reasonable level to require that you achieve.
                       A safety goal is not -- my understanding
           of a safety goal is not based on reasonableness.  It
           is based upon an inherent look at the risk itself and
           a consideration that level of risk is in some sense --
           in some higher sense it's safe enough.  It's not
           conditional on whether you can achieve it or not.
                       MR. POWERS:  Let me explore a little bit
           because I'm not really sure what you're driving at. 
           When we think about adequate protection, we do not
           take into account economic consideration.  
                       When we think of a ALARA, we do because
           there's a point at which we say, well, it's not
           reasonable to achieve because it cost too much money. 
           Then we put a specific number on that, a dollar
                       When we think about safety goals, we've
           said once you achieve this level of safety, the public
           interest has no -- the public has no interest and you
           would be safer to go to expenses to which you have a
           greater level of safety.  They don't say you can't but
           you can.  I'm not absolutely sure what you're driving
           at here.
                       DR. DAMON:  I think you're saying the same
           thing as what I'm getting at.
                       MR. POWERS:  Okay.
                       MR. GARRICK:  So you are saying that the
           ALARA principle applies here?  At least the principle. 
           If you can make something safer with very little cost,
           and even though you have met the safety goal, why not
           do it?
                       DR. DAMON:  That's one of the interesting
           questions.  That's the kind of stuff I think is useful
           to talk about because --
                       MR. POWERS:  Because I thought he was
           capping the ALARA.
                       DR. DAMON:  That's what I'm saying.  Some
           people will say this consummate of safety goes a four
           to ALARA and other people say no, it's not.  That's
           what I'm saying.  It's a very interesting point to
           bring up.
                       MR. POWERS:  Let me encourage you very
           much to cap ALARA because otherwise it just hamstrings
           you because I can always consider a way to do things
           with less radiation dose.  No matter what you come up
           with, I can always think of another way to do that. 
           What you want to say is there's a point regardless of
           whether it be done at zero cost that you quit thinking
           about those things.
                       DR. DAMON:  Well, that's what I say. 
           We're early on in the stages of analyzing and talking
           about safety goals, but some of the people involved,
           like myself and Bob Bari and Viuod Mubayi at
           Brookhaven, have been doing this a long time so they
           know there are these issues out there.  
                       What we're trying to do is elevate this
           stuff, put it out in public and start reexposing
           people to it and clarifying these things.  Some of the
           things seen in reactor safety goals, a reactor is just
           one particular kind of device and situation.  Because
           of that, it's possible to simply the consideration of
           safety goals.  
                       When you get to NMSS with the broad
           spectrum of things they deal with, one of my views is
           you have to be sure that the set of safety goals
           you're coming up with are covering everything that you
           want to and that you need to deal with.  
                       Like the second bullet up here, "To
           identify proper safety roles, to identify risk metrics
           to manage," is kind of getting to this.  We've got to
           make sure that we were addressing the things that they
           really have to worry about in NMSS.  That means it has
           to be -- what I would like it to be is a complete set.
                       What this slide is intended to call out,
           and maybe it doesn't do it quite well enough, is that
           safety goals, as I've said before, they are
           aspirations, not limits.  But there are risk-based
           requirements in the regulations right now and they
           come in in two different ways is the way I look at.
                       One way they come in is really as an
           explicit risk-based requirement.  The performance
           requirements of 7061 that we were just talking about,
           the highly unlikely for high consequence, that's what
           I mean by that.  It's an explicit risk-based
           requirement.  It's a requirements that something about
           the licensee has to meet.
                       10 CFR 32.23 and 24 also have such a risk-
           based requirement so that's one type, a risk-based
           requirement statement.  It's a requirement stated in
           terms of risk, likelihood and consequences.
                       The other type of what I would call a
           risk-related requirement statement is something like
           ALARA.  The way I think of this is as a conditional
           risk-related requirement.  It's a requirement that you
           continue to lower risk conditional on what it cost and
           whether it's feasible and other considerations.
                       Safety goal is, like I say, something
           different from that.  That's why I'm trying to draw
           this distinction that we understand.  This is just to
           emphasize the fact that the statement I made before
           about the fact that the case study showed that
           quantitative risk information be useful.
                       The first one up there, transportation,
           has to do with the Trojan reactor vessel shipment.  In
           that study a quantitative risk analysis was done. 
           What they calculated -- one of the things they
           calculated -- they calculated two interesting things. 
                       One of them was the probability of an
           accident that would exceed the design conditions of
           the transport vessel and shipment package.  In other
           words, a collision that you could not be sure that the
           reactor vessel would not be breached.  
                       They calculated probability of these very
           severe accidents and they got a number about 10 to the
           minus 6.  Well, the only trouble with that is they
           calculated it but nobody was telling them 10 to the
           minus 6 was acceptably low.  They made that decision
           on their own.  
                       It would have been useful if they had
           quantitative guides telling them, "Yes, this is an
           acceptable value."  The only problem is they didn't
           calculate consequences.  They just calculated
           probability of whether the accident would be severe
           enough that it would possibly lead to consequences. 
           That's one thing they did.
                       Another thing they did in the context of
           that study is they calculated -- that's a probability. 
           Basically since a shipment is a one-time only thing,
           this is a one-time only probability of a one-time only
                       The other interesting thing they
           calculated was they calculated the cumulative person
           rem to both the workers who were preparing this
           shipment package and also to the public incident to
           making the transport.  The transport package was a
           reactor vessel in its internals in a shipment package
           so there is some shielding.  There is some dose
           involved in preparing that package for shipment.
                       The interesting thing that came out of the
           study was is that this cumulative total person rem
           figure was actually lower for shipping it by the barge
           method which is what they proposed.  
                       To me what was an interesting example of
           is why I said before it's useful to have all the risk
           metrics identified that you're trying to manage so
           that when you tell somebody to do a risk analysis that
           they analyze -- they calculate the risk with respect
           to all those metrics because otherwise you get this
           biased picture if you only calculate one risk metric
           and you don't look at the other ones.  
                       That's one of the things I think we learn
           from this is look at all the different risks involved. 
           This is pointing out that the gas chromatographs,
           which is one of the other case studies, the regulation
           that applies to them is 10 CFR 32.23 through 27.  
                       I'm going to show you what that looks
           like.  This is what it looks like.  This is what I
           call a risk-based requirement.  This is what they are
           required to do.  If you look down at not the last row
           but the row that says "whole body" there.  This row
           here, "whole body."  
                       This applies to gas chromatographs which
           are a device which is a typical thing that NMSS
           regulates.  Devices or pieces of equipment that are
           used by certain persons in the public.  This is normal
           use and disposal.  This is normal storage.  
                       This is really intended to address the
           manufacturing facility and the warehousing and the
           distribution of the things where they might be present
           in large numbers.  This is the case where a user has
           got one of these things out in a lab somewhere using
                       There's 1 millirem.  It must be unlikely
           in one year for that person.  For this person who
           works at the facility where they are manufacturing or
           storing these in a warehouse, 10 millirem must be
           unlikely in one year.  These are requirements, not
           safety goals.  
                       Out here one unit in one location.  As we
           march what we're doing is marching out in consequences
           along this whole body dose thing.  Half a rem, 15 rem. 
           Half a rem probability is low.  15 rem probability is
                       What I see here is a risk-based
           requirement statement.  It raises all kind of
           interesting questions when you're trying to formulate
           safety goals.  Why should this be different from this. 
           This guy gets -- it's the same unlikeliness and this
           guy gets 10 times more.  
                       I think the reason is because they are
           treating this guy as a worker, a radiation worker.  He
           works for a manufacturer of radioactive material and
           this person is being regarded as a member of the
           general public.  That would be the way I would
           interpret that.  That's why they did the difference.
                       All I'm saying is there's a lot of risk-
           related requirements and reasoning that is already
           embedded in the regulations and that's why we're
           having to go through these case studies, to tease this
           stuff out and then try to figure out how that relates
           to safety goals.
                       On the previous slide it said right down
           here, "15 rem probability must be negligible."  They
           have interpreted this right in the regulation.  This
           is a direct quote, "Negligible is defined to be not
           more than one such failure per million units
                       There's a flaw in this reasoning.  They
           say negligible probability.  Well, what if you got a
           million units in your warehouse.  There is sort of
           inherent logic flaw in the way they stated this. 
           That's why I say there's a virtue to going through
           this safe goal stuff to try to explain to people how
           to formulate these safety requirements.
                       It was also identified that safety goals
           might have helped in some of the other case study
           areas that they worked on.  Safety goals might be
           useful in these areas.  There's dry cask storage which
           you'll hear about later.
                       This is really a much more interesting
           slide.  One of the things we did was we -- one of the
           issues to consider in formulating safety goals is why
           should there be more than one.  What is it that makes
           you have more than one safety goal.  
                       In the reactor site they identified
           individual societal.  What we did was we went around
           and looked and tried to figure out what are all the
           other factors that would cause you to have more than
           one safety goal.  
                       Certainly individual versus societal is
           one of them and I'll talk about what I think it means. 
           Maybe you can tell me what you think it means. 
           Anyway, that is one parameter that causes you to have
           two different kind of safety goals.  
                       Then there are all the different factors
           that influence the population at risk.  In other
           words, you might need to have a different safety goal
           for different populations.  One rationale for that
           being voluntary versus involuntary.  
                       One example of voluntary versus
           involuntary is worker versus public.  With the outside
           public person the facility is plunked down next to
           them and they derive only a general benefit from it. 
           Nothing specific, yet they are inflicted with all the
           risks.                Whereas the worker, in a certain
           sense, it's voluntary that he assumes the risk of
           working in a facility that handles radioactive
           material.  Since there's a difference in -- and that's
           embedded in our 10 CFR 20.  
                       That concept that there should be a
           difference is embedded in 10 CFR 20 which is a
           requirement statement, 5 rem for a worker, 100
           millirem for a member of the public.  As a unit would
           that be reflected in a safety goal, that difference.
                       MR. POWERS:  I have frequently questioned
           whether the workers are voluntarily assuming risks
           when they go to work at a radiation facility.  The
           reason I question that is if we compare the education,
           we provide the workers on the radiation risk to the
           kinds of statements that doctors ask you to assign
           when you have an operation or some medical process
           operated on you, there's no comparison.  
                       The education on risk can consist of
           telling you there's no problem, whereas the doctors
           tells you, "You're going to die on this operation that
           I'm going to perform on you and it's horrible beyond
           belief and nobody in his right mind would ever do
           that.  Do you want to do this?"  So it's always been
           an open question to me whether one ought to make this
           distinction or not.
                       DR. DAMON:  Well, that's the kind of
           questions and comments we're looking for.  We're just
           in the early stages.  We haven't even really -- we
           haven't fully aired this in public.  We did present
           this slide in a public meeting but that's the kind of
           issue that -- I mean, I wrote a little paper talking
           about this.  
                       Voluntary is, like you say, yeah, it's
           voluntary but if he doesn't go to work there, he
           doesn't get paid either.  It's not like 100 percent
                       Then there's another reason why it might
           be appropriate to allow him to be exposed to higher
           risk and that is he gets a benefit out of it.  He does
           get that salary.  In fact, that's not on this slide
           but what I was going to say is individuals/societal
           and voluntary/involuntary are just two parameters.  We
           consider 13 parameters -- no, 15.  
                       There's 15 different parameters that could
           influence whether you give somebody higher or lower. 
           One of them is benefit.  In the case, like you said,
           the guy who is getting an operation, the reason he is
           willing to take that risk is he's going to get a
           benefit from it.  It's a risk benefit trade off.  
                       It points out what the real difference
           here is between worker and public where one of the
           other differences is a different difference, and that
           is the worker gets a benefit; namely, he gets the pay. 
           The public guy's benefit is at a very remote level
           from that thing.  
                       When you do a risk benefit trade off kind
           of thinking about these things, the worker might say,
           "Oh, yeah.  I get more morasses.  That's too bad but
           I get paid."  The interesting thing is all this risk
           benefit trade off thing comes up at two other ends of
           the spectrum.  
                       It comes up at the end of the medical
           spectrum, of course, where there's a risk that if you
           undergo a procedure that involves radioactive
           materials, you might get -- you are subject to the
           risk of misadministration, not of the dose that you
           are supposed to get but that they would screw up and
           actually kill you with the radiation.  
                       There's a risk there but there's a big
           benefit to trade off.  A huge benefit and a
           substantial risk.  At the other end of the spectrum,
           there's risk benefit trade off in that there are
           safety devices that have radioactive material in them
           like smoke alarms.  
                       An infinitesimal radiological risk traded
           off against the benefit of having smoke alarms that
           work according to that principle.  All these 13
           factors come into as issues to consider in formulating
           safety goals.  We have gone through and thought some
           of this through but, like I say, we're still in the
           early stages.  
                       This is an interesting one.  There are
           chemical risks, nonradiological risks.  Also it's
           interesting to think bout long-term risk which comes
           up, of course, in waste disposal sites.  It induces
           difficulties in how do you deal with this.  
                       MR. GARRICK:  I know there's an
           environmental impact statement, but have you
           considered at all bringing environmental impact into
           the safety goal domain?
                       DR. DAMON:  We have considered doing
           environmental and property damage.  These are some of
           the risk things we are considering here.  We are
           considering a tiered structure like they used in
           reactor safety goals where the top level is
           qualitative and then is quantitative down here.  
                       Environmental and property damage are two
           things.  In addition to risk to individuals and
           societal risks, there is environmental and property
           damage being considered.  Like I say, we're very early
           stages in trying to think about what the heck can you
           do with this thing.
                       MR. GARRICK:  Yeah, I was curious
           particularly about the quantitative part, what you
           might be thinking about there.
                       DR. DAMON:  The individual versus societal
           one, I would like to make a statement in case somebody
           wants to object to what I say.  In my mind there's a
           very dramatic difference between individual and
           societal risk the way I think of them.
                       Individual is a question of justice that
           derives from the idea that -- it really, I think,
           derives from the other end of the spectrum; namely, a
           case where a facility would say -- local a facility
           which would subject someone to a risk of 50 percent of
           being killed due to them locating there.  
                       Just a gross risk imposed on some innocent
           bystander would be intolerable.  Since that is
           obviously unjust, they are driving the benefit, that
           person is driving the risk and there's an injustice. 
           It's a goal to lower that down to some level.  
                       When you reach a lower level that's low
           enough, that's okay.  If you lower it to zero you lose
           all flexibility in society.  You can't do anything
           because everything you do imposes a risk on somebody. 
           Somewhere in between is a concept that that level of
           injustice is something we have to live with in order
           to allow society to function.
                       The other one, societal risk, in my mind
           is a total grand integral of all risk associated with
           something and it comes into the process of thinking
           whether that process is being conducted in a way where
           there's a net -- how do I put it?  It's a net benefit
           kind of a reasoning.  
                       In other words, risk is one of the
           disbenefits you get when you do something and you
           would like to keep it down.  Since you are getting
           this benefit from doing the thing, you are probably
           going to continue to do it and the question is how low
           a value is this total risk impact going to be. 
                       It's not an issue of justice because
           you're already -- if you've complied with an
           individual safety goal, then this thing is already --
           it's not a question of justice to the individual. 
           It's simply a societal question of whether we are
           willing to incur this level of risk associated with
           this type of activity.
                       MR. POWERS:  You might want to think also
           in terms of general uncertainty.  When we tried to
           formulate a worker protection goal for some of the DOE
           facilities, we quickly ran into the problem we don't
           where the guy is.  
                       In most of your individual risk things you
           can say he's at the site boundary or somewhere beyond
           there so you can kind of locate him.  You really can't
           locate him when you are trying to do a worker sort of
                       You could in that scenario gravitate
           toward a societal goal for the society of workers
           because of the uncertainties of where they are
           located.  You can integrate over the population but
           you just can't do one individual.  
                       There is some of that built into larger
           societal goals in that you don't know which members of
           society might be particularly receptacle to radio or
           chemistry or something like that.  You create societal
           goals to compensate for that uncertainty.  
                       You quickly find that societal goals
           suffer from extrapolation to the limit because you
           start getting things like one gram of plutonium
           dispersed in the atmosphere will kill three people
           when you integrate over a million population and
           things like that.
                       You might think of it in terms also of
           just uncertainty of what's going on in this population
           of individuals.
                       DR. DAMON:  I think I can generalize what
           -- that's a very interesting observation because you
           can generalize that in saying that some of the things
           I have seen about -- how do I put it?  
                       When you look at a safety requirement or
           a regulation, and it may be stated in terms as either
           an individual risk limit of some kind, or it might be
           stated as an integral measurement, it's not always
           true that is actually what they are trying to manage. 
                       It may be that it's done that way for
           practical reasons.  Like you say, you can't measure it
           so we're going to average or some reason like that. 
           It's very important, I think to tease out what they
           really are trying to do.  What is really the purpose
           of this regulation.  
                       Yucca Mountain is kind of an example of
           that.  They are regulating to an individual risk
           limit.  But why did they locate it in a remote
           location where there's few people?  Because the risk
           limit to an individual doesn't have anything to do
           with how many people there are.  You have to be
           careful that you understand why people are using it. 
                       What I would say is that's one of the
           reasons for subsidiary objectives down here is there
           are practical working level quantitative tools,
           whereas I would hope to try to keep these things --
           the higher up you go, the more you should be based on
           something that's stated in terms of strict principles
           and general principles and things that would always be
                       This is especially true in NMSS because
           there are so many diverse things going on that you
           want to keep this stuff as general as you can.
                       MR. KOKAIKO:  Dennis, excuse me.  Dr.
           Powers, I appreciate your comment on that.  I agree
           with you.  in NMSS we have real life applications
           where this happens and the most obvious is a
           construction site.  You have one radiation worker but
           everyone there is involved in the enterprise of
           construction.  Yet, they are all assuming a part of
           that risk.  I appreciate that comment.  
                       MR. POWERS:  It's the same.  I mean, your
           construction sites are the same as new facilities. 
           You have a few guys doing the actual manipulation but
           then you've got all the secretaries and the janitorial
           force and construction workers getting their share of
           the risk, but you don't know who is getting what so
           you just integrate over the whole population.  
                       It actually works very well for those
           kinds of finite populations because you can do things
           to reduce the societal -- that small societal risk. 
           It makes sense and you can think about how to do them,
           whereas you can never figure out how to protect an
           individual from doing something stupid.  I mean,
           there's a limit to where you can go on something
           really stupid.
                       The other thing to bear in mind on the
           subsidiary goals is you call them practical.  One of
           the problems you have with very high-level goals is
           you can calculate them.  You can calculate them but
           you can't calculate them without controversy.  
                       Sometimes those controversies become
           irresolvable or the cost to resolve them is so high
           you just don't want to go there.  I mean, that is
           certainly what happened with CDF, core damage
                       We have evolved.  The technology that we
           generally all agree is you can get a core damage
           frequency.  Nobody can agree how to calculate the
           actual risk.  We use a working goal that everybody
           thinks is about right.  
                       They come to why they think it's about
           right by circuitous invariable routes but they all
           agree the number is about right and avoid calculating
           the actual risk because nobody can ever agree on
           whether they've got that calculation right. 
           Technologies are not routinely available to calculate
           that.  That's another way to look at your subsidiary.
                       DR. DAMON:  So here is something Bob Bari
           laid out showing over here is reactors and this is
           materials and waste and we are trying to use the same
           tiered structure is what he's trying to say.  Down
           here at this level we're trying to think of what types
           of safety goals would apply.
                       Another interesting thing about safety
           goals and NMSS is, you see, it might be one of the
           reasons for safety goals.  There are two reasons why
           I think safety goals are a valid concept.  It's not
           that there's just a level of risk that's
                 Yeah, you can say that.  That's like relative to
           other things.  There are two other reasons besides
           that.  One of them is the cost benefit thing.  That is
           eventually you go down so low that you are probably
           tripping ALARA cost benefit criterion anyway.  But the
           other one is what they call secondary effects.  
                       What I mean by secondary effects was
           something alluded to my Lawrence, and that is in the
           NMSS side when you impose a requirement on somebody to
           do something to manage the radiation risk, you're
           actually perturbing the process that they do in their
           everyday work.  
                       If they work at a construction site where
           the construction risk is like -- the risk of getting
           killed in a construction accident is about 2.5 times
           10 to the minus 4 or something like that.  It's a
           substantial risk.  
                       If you perturb that and you double that
           while you are minimizing some radiation risk, what
           have you accomplished?  The point is is NMSS
           applications run into this real world where if you try
           to make things too safe, you are actually making
           people unsafe.
                       MR. GARRICK:  What do you mean on this
           chart under tier 3 under materials and waste by
           chronic?  I know what chronic means but I want to know
           what you mean here.
                       DR. DAMON:  That is operational health
           physics.  That's 10 CFR 20.
                       MR. GARRICK:  Why would you put that in
           this category?  I mean, reactors have operational
           health physics, too.  That's something you can
           calculate in advance and determine in advance.  If
           it's too high, you won't build the facility.  It's not
           a disturbance.  It's not an upset.
                       DR. DAMON:  Right.  Well, is the question
           the same as before?  In Part 20 there's an ALARA
           requirement.  The question is is there a flaw on
           ALARA.  That's what he means by that.
                       Here's what Bob Bari came up with.  That
           we got individual and societal goals and the only
           difference here -- there are a couple differences but
           I'll point out one.  The worker was put in here in
           this individual one.  That's different than reactor. 
           The reactor one doesn't have that.  
                       That breaks down to five QHOs in this list
           and then there's another one on the next page.  What
           I'm pointing out here is there's an individual public
           acute, individual public latent, and individual worker
           acute, and individual worker latent.  
                       You don't have to necessarily do things
           this way.  The United Kingdom combines these two
           together.  The United Kingdom has safety assessment
           principles in which they put out quantitative limits
           and quantitative goals for different types of risk.  
           They add these together.  That's like saying there's
           no difference between whether you are acute or latent
           fatality.  They add them together and they --
                       Now this one here, like I say, this is
           just an early first draft proposal.  Up here in the
           public risk area, the QHOs for that we use the same
           thing that was used in the reactor, one-tenth of one
           percent of the corresponding risk from other things. 
                       For acute it's other accidental
           fatalities.  This is the 3.5 times 10 to minus 4 which
           is one-tenth of one percent of that.  Then this QHO
           here is one-tenth of one percent of the sum of cancer
           fatality risks which are 2 time 10 to the minus 3 per
                       Down here for workers there are different
           ways you can do this one.  The U.K. uses basically 10
           to the minus 6, I believe, as their one.  It's not
           tied to a relative scale.  What we're saying is here
           is one way of tying it to a relative scale.  
                       This one-tenth of occupational fatality
           risk.  Or you could do it the same way and say why
           should this be different than the nonworker.  Let's
           use the same one up here, a tenth of a percent of
           prompt fatality risk from all other accidents.  
                       The difference here is occupational
           fatality risk is very low.  Dying on the job is not
           the way people get killed accidentally.  You get
           killed in your car, you know, or you fall down and
           break your neck.  Occupational fatality risk is only
           5 times 10 to the minus 5 per year.  One percent of
           that is five times 10 to the minus 6.
                       MR. LEVENSON:  Is it intended that that
           apply to accidents that are nuclear type?  Because, as
           worded, again are you saying that they should be only
           one percent of industrial average?  
                       If they're working in that plant and there
           were no radioactive material in it, you are requiring
           that plant to be 100 times as safe as any other plant. 
           I think it's intended to mean that the radiological
           aspects should not add more than one percent rather
           than that being the total risk.
                       DR. DAMON:  Yes, that's what intended.  In
           other words, yes, this is the increment added by the
           part the NRC regulates.
                       MR. LEVENSON:  Right.  Not because of the
           operation of the facility.
                       DR. DAMON:  Right.  We're not saying that
           you need to do this.  This is not a requirement.  It's
           just saying if it was one percent of occupational
           fatality risk, which is already a very low number, why
           would anybody object.  
                       You would say we're only adding one
           percent to your risk of getting killed.  You still
           have all this other 100 percent risk.  When you work
           in a nuclear facility you don't forgo the other risks. 
           They are just added.  
                       In fact, people get killed in these
           facilities from these other risks.  Like I say, this
           is just an early first draft of the thought process of
           imitating what happened for public.  We're imitating
           that for here and asking people what do you think.  
                       What I really think this last one is a
           much more problematic thing, societal risk.  What I
           managed to convince Bob Bari, I think, is societal
           risk goal has two components.  
                       One is that risks from nuclear
           applications be low relative to other risks in
           society.  Well, I can tell you right now that risks
           from all nuclear applications all added up together
           are infinitesimal compared to the risks of all the
           other risks.  90,000 people a year die by accident in
           this country.  90,000.
                       MR. GARRICK:  Half of them from
                       DR. DAMON:  Yes, half from automobiles. 
           That's an enormous number.  There's no way nuclear
           applications are going to start approaching that.  So,
           you know, fine.  
                       What's the other one?  The other one was
           the risk from a nuclear power plant should be
           comparable to competing methods of generating like --
           you know, viable competing methods of generating
                 Well, we tried to apply that analogy in NMSS and
           I don't think it works very well.  Some of the
           applications don't have viable competing technologies
           or they are different in some way.  
                       The other one is it goes of scale at both
           ends of the spectrum.  At one end of the spectrum is
           the smoke alarm.  Suppose you've got a smoke alarm and
           the nuclear risk from that is trivial.  Why should you
           make it any lower just because it happens that there's
           a non-nuclear smoke alarm.  Okay?  
                       I don't see the rationale for that.  At
           the other end of the spectrum I don't think it works
           either.  Suppose you have a nuclear application where
           the risk is phenomenal.  It's extremely risky, but the
           competing technology is even worse.  "Are you okay? 
           I met my safety goal.  I'm lower risk than all of
           competing technologies."  I don't think so.  I think
           societal risks we need something here.
                       DR. KRESS:  I think you're right.  The
           problem I have with it is now you have to have common
           units for the denominator end of the numerator.  The
           only one I see in common is dollars.  
                       You have to reconstruct your risk in terms
           of dollars and you have to reconstruct your benefit in
           terms of dollars.  It looks like a difficult task to
           me but it makes a lot of sense.
                       DR. DAMON:  Yes.  In effect, that's the
           issue.  You see, what bothers me is it is clear to me
           that we are regulating to societal risk because it's
           the reason for remote siting of facilities and it's
           the reason why we don't dissolve our nuclear waste in
           the public drinking water supply and dilute it down. 
           We are using this as a consideration in regulating. 
           The question is what is a level that is low enough. 
           I say it's a difficult question.
                       MR. KOKAIKO:  Dennis, may I compound the
           problem even further?  We may have another health
           objective between worker latent and worker acute. 
           Also in NMSS you have applications that can cause
           severe burns radiologically.  In fact, a radiographer
           just recently received a very high exposure to his
           hands.  We've gotten some feedback to say that perhaps
           we should also be looking at that risk as well and try
           to quantify that which is somewhere between your
           worker latent and worker whole body dose that would
           kill you.
                       DR. KRESS:  It's comparable to just what
           you would call injuries.
                       MR. KOKAIKO:  Yes.
                       MR. GARRICK:  Well, you're right that they
           can get very complicated if you try to calibrate this
           in too fine a detail.  Some people don't even like to
           go as far as using dose.  The cutoff ought to be
                       There's all kinds of ways to make this
           unmanageable and I think you have to be very astute as
           to what you end up with as your metrics.  To the
           extent that it's applicable you also ought to be
           guided as much as possible by precedence.
                       DR. DAMON:  I certainly concur with that. 
           Anytime we can find something like this one that's
           been well worked over, we're just going to buy off on
           it.  It's only when we come to something that it just
           doesn't seem to work for what's going on in NMSS that
           we need to worry about anything else.
                       DR. KRESS:  That's one reason I like that
           bottom one on there is because you can actually
           include things like injuries.  If they are all put on
           a dollar basis you could include it all in that
                       DR. DAMON:  This is another one that is
           tough.  I don't even know if this meets -- I mean, it
           was expressed in the first public meeting that
           environmental -- how do I put it?  Protecting the
           environment was not done for human benefit or
           something to that effect.  Different people have quite
           a different view about what environmental objectives
           might be.
                       MR. POWERS:  Have you chatted at all with
           the Swedes on this?  They come out and they just say,
           "Okay.  Thou shalt not contaminate the land with more
           than X amount of cesium."  That's their safety goal. 
           Don't worry about people.  Just don't contaminate the
                       I don't know what rationale by which they
           came to that conclusion but it might be interesting to
           chat with them just to find out because maybe that
           gives you some insight on how to handle this sort of
                       DR. DAMON:  This one we haven't even begun
           to hardly think about.  It's just a very --
                       MR. POWERS:  Of course, the other way is
           to call up Dr. Kress and ask him for the dollar value
           of human life, take his number, and then you can come
           up with a dollar equivalent for environmental
                       DR. KRESS:  It's worth thinking about.
                       MR. POWERS:  Well, you spend a lot of time
           and, in fact, Bob Bari's group did it, on surveying
           what regulations ascribe to the value of a human life
           in order to set our ALARA limits so he's acutely
           familiar with it.  That may be the way to handle it. 
           Just make them equivalent dollar values.
                       DR. KRESS:  That's the only metric I see.
                       MR. POWERS:  Those were all quickly
                       DR. KRESS:  -- what value they assign to
           human life. 
                       MR. POWERS:  That's an argument I've made
           for a long time.  I think you're right.
                       DR. KRESS:  It's the one we got dribbled
           on the floor and booted out.
                       MR. POWERS:  Yeah, kicked right out.
                       DR. KRESS:  Kicked out of the office on
           that one.
                       MR. LEVENSON:  I'm afraid that doesn't
           solve the problem because even if we all agreed on the
           dollar value of the human life, what we're talking
           about here are very low doses and no agreement as to
           whether any human lives are involved or not.
                       MR. GARRICK:  It might even extend life.
                       DR. KRESS:  The contamination of land --
                       MR. POWERS:  It's going to cost so much.
                       DR. KRESS:  -- will cost so much it will
           control everything.
                       MR. GARRICK:  Okay.  Let's move along.
                       DR. DAMON:  I think we're done.  You
           mentioned chronic risk.  I mean, we don't -- we
           haven't really had a conversation on this one.  I
           think 2 millirem is used as a chronic risk goal
           objective by the United Kingdom.  That's where the 2
           comes from.  I've seen people use 1.  I've seen them
           use this.  Maybe it shouldn't be an absolute number. 
           Maybe it should be relative to something.
                       MR. GARRICK:  Well, maybe one thought
           would be to not necessarily try to start with
           everything included but start with something that you
           have high confidence in that allows you to add to it
           as you figure out what these other things ought to be. 
           In other words, phase in your safety goals is a
                       DR. DAMON:  And the second one here, Bob
           Bari has been working on -- he's been working on two
           things.  He's been tabulating these things.  These are
           different NMSS applications.  These were different
           frequency or probability values that might be used to
           manage these sort of analogous to CDF.  These are CDF
           analogs for different things.
                       The other thing he's doing is he's
           quantifying -- he's going to the NUREG/CR-6642 and
           other risk assessments that have been done in NMSS and
           he's putting down the -- we are trying to estimate
           with the risk assessments that exist what are the
           risks in these different areas.  
                       We are doing a bunch of stuff but I can't
           show it to you all because it's sort of in the middle
           of being developed.  That's the kind of thing we're
           doing.  We're looking at safety goals, what should be
           considered in principle, what are the options to pick
           from, what are the considerations, and then also
           trying to quantify what the risks really are so we can
           get some feel about where we're at.
                       MR. KOKAIKO:  Dennis, if I might just
           point out, this is really just sort of a strawman. 
           This is subject to radical revision.
                       MR. GARRICK:  Well, it also looks like
           it's more than just an analog with core damage.  It
           looks like it's analog with core damage plus
           containment release or containment failure.
                       MR. KOKAIKO:  Yes, sir.
                       DR. DAMON:  Yes, that's true.  It is more
           analogous to large or early release.
                       MR. GARRICK:  Any more comments?  This
           helps us a great deal to get an insight on where you
           are and what you're doing.  Does the Risk Task Group
           operate on a meeting basis?  Do you get together
           periodically or how does it operate?  Can you answer
           in a very short time how it functions?
                       DR. DAMON:  I mean, the Risk Task Group is
           a regularly functioning unit.  It's constant.
                       MR. GARRICK:  So it's a group.
                       DR. DAMON:  It's a real organization.
                       MR. GARRICK:  It's not an ad hoc?
                       DR. DAMON:  No, it's not ad hoc thing that
           gets together irregular or vague intervals.  No, we
           work daily together.
                       MR. KOKAIKO:  It's our day job.
                       MR. GARRICK:  Very good.  Thank you very
                       If there's no further questions, we will
           adjourn for lunch and be back at 1:00.
                       (Whereupon, at 12:10 p.m. the meeting was
           adjourned for lunch until 1:00 p.m.)
                     A-F-T-E-R-N-O-O-N  S-E-S-S-I-O-N
                                                      1:02 p.m.
                       MR. GARRICK:  The meeting come to order. 
           Our next topic is going to be the Risk Assessment for
           Dry Cask Storage, and we will have Messrs Guttman and
           Rubin to start off, and I understand there's going to
           be a team.  Why don't you introduce yourselves and
           tell us where you work, etcetera.
                       MR. GUTTMAN:  I'm Jack Guttman.  I'm the
           Chief of the Technical Review Section B in the
           Springfield Project Office in NMSS.
                       MR. RUBIN:  I'm Alan Rubin.  I'm a Section
           Chief in the PRA Branch in the Office of Research
           which is conducting this dry cask PRA in response to
           a user need from NMSS.
                       MR. GARRICK:  Okay.  Proceed.
                       MR. GUTTMAN:  I'm very pleased to
           introduce some excellent in-house activities to
           develop a spent fuel dry storage PRA.  I hope this
           meeting will convey the outstanding technical
           contributions and analytic capabilities that various
           entities within the Office of Research and the Spent
           Fuel Projects Office have developed and continue to
                       In the future, we plan to solicit your
           comments, expertise and support of the findings from
           this important program.  This is an important
           initiative for several reasons which I will highlight
           in my introduction.  
                       MR. POWERS:  In our research report,
           didn't we characterize this research as some of the
           most important that was being done?
                       DR. KRESS:  We did.
                       MR. POWERS:  Preaching to the choir, at
           least two members of the choir.
                       MR. GUTTMAN:  As a brief background, the
           Spent Fuel Project Office issued a user's need letter
           to research to develop a dry storage PRA.  In support
           of this effort, the Office of Research and the Spent
           Fuel Projects Office and NMSS established a task force
           comprising of a group of experts in various fields. 
           The ground rule was to develop a generic PRA using a
           certified cask for which the staff has readily
           available information, thereby optimizing our limited
           resources.  The PRA would then be used by the Spent
           Fuel Projects Office as appropriate.  The PRA is being
           developed in-house with limited contractor assistance
           such as human factors considerations.
                       The Spent Fuel Projects Office planned use
           of the PRA includes to risk inform 10 CFR Part 72, to
           support NMSS risk task group activities such as safety
           goal evaluations and development, to risk inform our
           inspection programs, to maintain safety, to enhance
           public confidence and to reduce unnecessary burden. 
           Enhancing public confidence has taken a significant
           role as the staff is being requested to meet with
           local concerned citizens on the safety of dry cask
           storage.  This program will assist our interactions
           with the public.  Performing the analysis in-house
           enhances our technical and regulatory credibility.
                       MR. POWERS:  That really is true.  If
           you're going to have to explain this to the public,
           you've got to have the expertise to answer the
           questions in real time.  You can't say well, I'll get
           back to you on that.  You really do need to do this
           when you're in-house, don't you?
                       MR. GARRICK:  One of the things I think
           the committee would be very interested in as we go
           along here would be what that influence has meant in
           terms of the way in which you're doing the PRA.  Has
           it led to any fundamental change in how you do it? 
           I'm talking about the business of involving the public
           and trying to enhance public confidence.  What are you
           doing specifically to do that besides interact with
           the public?
                       MR. GUTTMAN:  Typically, the Spent Fuel
           Projects Office is requested and is becoming more
           frequent by state representatives and the utilities
           and local communities to come to local public meetings
           and explain the regulations and the reasons why a
           utility should be permitted to remove their spent fuel
           from the pools and store it in dry casks.  This is
           becoming a more important activity as more reactors
           are decommissioning and unloading their fuels from the
                       MR. GARRICK:  Or the pools are just simply
           filling up.
                       MR. GUTTMAN:  The pools are just simply
           filling up.  That's correct.
                       MR. GARRICK:  Yes.  Okay.
                       MR. GUTTMAN:  As I highlighted, the PRA is
           performed in-house.  A task force of Research and
           Spent Fuel Projects Office technical experts was
           established for that purpose.  The task force consists
           of the following technical expertise.  Project
           management, PRA, structural dynamics, material
           sciences, seismic, criticality, thermal, consequence
           analysis, statistics and human factors.
                       DR. KRESS:  Is each one of those a
           different person or is one person all of those?
                       MR. GUTTMAN:  Each one is a different
                       MR. POWERS:  There are no Tom Kresses.
                       MR. GUTTMAN:  Actually, there are several
           people for each category.
                       MR. GARRICK:  Is the PRA category or
           structure dynamics category or where are you with
           count for external phenomena?
                       MR. GUTTMAN:  The PRA practitioners would
           basically come up with the eventries and faultries. 
           Let's say for example, if they're moving a cask and
           there's a potential for drop, then the structural
           people will perform dynamic analysis.  We're using,
           for example, ANSYS/LS-DYNA.  Identify the stresses and
           loads on the casks.  Then the structural people look
           at the results and determine if there's a potential
           for a failure and try to quantify that.
                       MR. LEVENSON:  For something like a cask,
           are there ever conditions where the seismic loads
           exceed the drop loads?
                       MR. GUTTMAN:  No.  Drop loads are in the
           order of 45 to 60 Gs.
                       MR. LEVENSON:  I know.  That's why I
           wonder why we have a seismic category and do a bunch
           of analyses when it's clearly subsumed within --
                       MR. GARRICK:  Because the public would
           ask, why didn't you consider seismic?
                       MR. LEVENSON:  You say it's not nearly as
           severe as dropping it.
                       MR. GUTTMAN:  With that introduction, I
           would like to turn to Alan Rubin for the technical
                       MR. RUBIN:  Thank you, Jack.  I just
           wanted to just go back and remind you that back in May
           of last year, 2001, I presented a proposed plan and
           approach to this joint subcommittee on what we were
           going to do on the dry cask PRA project.  At that
           time, work had not begun.  We were getting the team
           together.  So what you're going to hear today is a
           work in progress.  We're probably at the mid-point,
           maybe somewhat past the mid-point of this project.  So
           you'll hear some conclusions in some different areas
           of the work and you'll hear some status and approach
           in other areas.  And then in the future when we're
           finished with our integrated results and analyses, we
           will present that information to the subcommittee at
           the time.
                       MR. GARRICK:  When do you expect to
           finish?  You're going to tell us that, I guess.
                       MR. RUBIN:  I'll tell you that.  You're
           jumping to my last slide at the end of the day, but
           basically --
                       MR. GARRICK:  It's a bad habit of mine.
                       MR. RUBIN:  Our schedule now is to have a
           draft report to NMSS in the late spring or early
           summer of this year. 
                       This is an overview of what you're going
           to hear today following my introduction.  These are
           the different steps and the people who are involved in
           those tasks are going to be giving these detailed
                       First is an overall modeling approach of
           the code that we're using, the Saphire code, which
           we're using to do the PRA to model the dry cask. 
           You'll hear about then the external events that are
           considered in the dry cask analysis and how we've
           calculated the initiating event frequencies for those
                       You'll hear in particular one of the
           events which is a fire scenario and how the thermal
           loads were developed based on modeling of fire, the
           dry cask fire resulting from an aircraft crash. 
           You'll hear about those analyses, both of thermal load
           from the fire, are calculated in determining what the
           temperature conditions are on the cask.  You'll hear
           results and discussion on the mechanical loads.  What
           loads are imposed on the cask for mechanical events,
           be they drops, impacts from tornado-generated
           missiles, or drops or tip-overs.
                       DR. KRESS:  Does this include what happens
           internally to the fuel itself?
                       MR. RUBIN:  There is some fuel failure
           modeling that is going on.  It's not completed yet. 
           But the fuel itself is contained in a canister, a
           multi-purpose canister, and that is encased into an
           overpack, a large concrete structure, in the storage
           pad.  You'll hear more about that with the structural
           analysis.  The real focus is for things to cause
           problems, the multi-purpose canister has to fail, and
           that's what the focus is of both the thermal and
           mechanical failures.
                       And then once we have those loads, both
           the thermal loads, the temperatures and time
           conditions, as well as the stresses from the different
           mechanical impacts, we'll have a presentation on how
           those go into the calculation of the probability and
           likelihood of cask failure.  Each of them tie into
           different sequences.
                       Then there is some consequence analysis in
           terms of how we're going to look at the source terms
           and evaluate the overall risk to the public,
           integrating the consequences and the frequencies in
           our PRA.  At the conclusion of these detailed
           presentations, we'll tell you what the next steps are,
           where we are in the analysis, and I've already given
           you one bottom line of our schedule for the draft
                       These are the objectives taken from the
           user need from NMSS.  First, the dry cask PRA has not
           been done before, so there is really a first of a kind
           project.  The intent was we wanted to develop a
           methodology for performing such a PRA on dry casks. 
           You hear a lot about that today.
                       DR. KRESS:  Since you got decay going on,
           do you pick out a specific decay time for these or do
           you do a time variable PRA?
                       MR. RUBIN:  We're doing a nominal analysis
           where the fuel, first of all, is aged five years
           before it's put into the cask.
                       DR. KRESS:  So you picked out five years.
                       MR. RUBIN:  You pick out a time and then
           look at the decay heat following that.  But we're also
           looking at scenarios if there's misloading of fuel
           from human error.  We'll get into some of that.  What
           impact that could have.
                       DR. KRESS:  What I was wondering is there
           may be motivation to start getting that stuff out of
           the spent fuel pool faster and would your PRA be
           amenable to backing up, say, one year?
                       MR. RUBIN:  Yes, it would.  We would put
           in different decay heats and the consequence analysis
           we put in different source terms.  Yes.
                       MR. GARRICK:  But you might end up with
           mixed stages for the fuel.  Different fuel of
           different ages, as long as it met the five year
           requirement, but it could be 10 year, eight year, six
                       MR. RUBIN:  It's realistic to take five
           years but certainly the fuel could be 10 years old and
           then you're going to have lower decay heat so the
           impacts are going to be less.
                       MR. GARRICK:  But I mean you could have
           fuel elements that are of different age.
                       MR. RUBIN:  Absolutely.  Yes, and you
                       MR. GARRICK:  In the same cask.
                       DR. KRESS:  Which brings me to another
           question I had.  Say you've got 10 of these casks.  Is
           the source term coming from all 10 or what would come
           from any one of them?
                       MR. RUBIN:  We're doing an analysis of one
           cask and assuming that that cask has got five year old
           fuel, and you'll hear some more about that.  And then
           typically the kinds of events, initiating events.  If
           they are not common mode cause failure, they're going
           to impact one cask.
                       DR. KRESS:  One cask at a time.
                       MR. RUBIN:  A seismic event could impact
           a number of casks on a pad.  So that's where you look
           into different levels of consequences, depending on
           whether you have a common cause failure or not for
           multiple casks.  So as Jack Guttman said, we're doing
           a pilot PRA and the specific cask that we're looking
           at is called a Holtec HI-STORM cask and the reason
           that was picked is because of its availability of
           information as well as the likelihood that that cask
           will be used at a number of different reactor sites in
           the country.  We're looking at a BWR site for our
                       Our final objective is to look at the
           potential risk to the public from dry cask storage and
           to identify what those dominant sequences are.  This
           will hopefully provide a lot of information, useful
           information for risk informing NMSS activities. 
           Again, we can apply the same methodology to different
                       Jack mentioned the broad scope of the
           participants involved in this project.  I won't read
           off all their names but they're listed here, and
           you're going to hear from a lot of them this
           afternoon.  These team members include members from
           the PRA Branch, section chief and the overall
           management of the project is our responsibility in the
           PRA Branch as well as the PRA modeling.  The analysis
           of initiating events and the fire analysis.  
                       This project involves all three divisions
           in the Office of Research, so it's a cooperative joint
           program, joint effort.  In the Division of Engineering
           Technology, the Engineering Research Applications
           Branch is responsible for the analysis of mechanical
           loads and the same division, Engineering Technology,
           the Materials Engineering Branch is involved with the
           failure analysis for both thermal and impact loads and
           mechanical loads on the casks.  This is a mouth full. 
           The Safety Margins and Systems Analysis Branch of the
           Division of Systems Analysis and Regulatory
           Effectiveness are doing the calculations of the
           thermal loads on the cask, the consequence analysis
           and criticality.
                       As my final slide, I just want to give
           some perspective on the overall scope of the study so
           you'll see what's included and what's not included. 
           There are three phases of the cask that are being
           looked at.  The first one is the handling phase which
           takes place in the reactor building where fuel is
           loaded from the spent fuel pool into what's called the
           multi-purpose canister, and you'll see a picture of
           that diagram in the next presentation.
                       That canister is then dried, inerted and
           sealed before it's inserted into an overpack, which is
           the large concrete structure that holds the spent fuel
           in the storage pad.  This cask is then transferred on
           site from the reactor building to the storage pad. 
           It's called the transfer phase, and we're looking at
           accidents that can occur during that phase.  And
           finally, looking at events that can occur during 20
           year storage.  Twenty years is the nominal license for
           these dry casks.
                       What is not included in the scope is
           probably equally as important as what is included. 
           First of all, the fabrication of the cask.  We're
           assuming the cask is built as it's designed, so
           fabrication errors are not covered.  Off-site
           transportation is a different PRA than the
           transportation studies and modal studies being handled
           looking at risk from transportation, and acts of
           sabotage are also not included in this PRA.
                       MR. POWERS:  How about aging?
                       MR. RUBIN:  Aging of a cask over 20 years? 
           I don't think there's any particular effects looking
           at aging.  We're looking at errors at drying and
           inerting the cask which could cause some different
           problems on the materials.  That is part of it.  But
           if the cask is sealed and dried and inerted as the
           procedures say it should be, then I don't think
           there's any aging problems that we're looking at.
                       DR. KRESS:  In developing a frequency for
           handling, you assume every five years you load up the
                       MR. RUBIN:  Cask could be loaded more
           frequently than that.
                       DR. KRESS:  More frequently than that.
                       MR. RUBIN:  Depends on the site, depends
           how much fuel is being moved into the storage pad.  It
           could be a number of pads over the license period for
           the reactor.
                       DR. KRESS:  But you have a number for
                       MR. RUBIN:  Well, we will have a number
           for that.  You're not going to hear that today.  The
           handling phase is being covered in analysis of the
           liabilities analysis being done by a contractor.  We
           don't have the final results yet to present today.  We
           will in the final report.  But that's looking at
           errors that could cause a cask to both drop because of
           human error as well as potential mechanical failures
           of the crane.
                       DR. KRESS:  You don't include the effects
           of the drop if it drops into the pool itself?
                       MR. RUBIN:  No, that's different.  That's
           a heavy loads analysis.
                       DR. KRESS:  That goes with the operating
                       MR. RUBIN:  Correct.  We're looking at the
           effects of the drop on the cask but not the effects of
           the cask dropping on other equipment in the reactor
           building or over the taurus, for example, the BWR.
                       So if there are any further questions,  I
           will be happy to answer them.  I will continue on with
           the presentation.  Will the next two members come in. 
           The next presentation is going to be done by Chris
           Ryder.  Why don't the next two people come up.  Brad.
                       MR. RYDER:  Good afternoon.  My name is
           Chris Ryder, and I'm going to be talking to you today
           about the methods that we're using to determine the
           risk of dry cask storage.
                       I'll give you a little bit more details
           about the system that we're studying.  The cask
           consists of three components, a multi-purpose canister
           that contains the fuel, the transfer cask which
           provides shielding inside the reactor building, and
           the overpack which provides protection and shielding
           during storage.
                       DR. KRESS:  When you say multi-purpose,
           that means it's good for dry cask storing and
           transportation and sticking in Yucca Mountain?  
                       MR. RYDER:  Yes.  The canister can be
           pulled out of the overpack which in this case is just
           good for on site storage and put into another
           container and then shipped off site.  That's why it's
           called multi-purpose.
                       Here are some dimensions that you can look
           at at your own leisure.
                       MR. LEVENSON:  What's that word mean? 
                       MR. RYDER:  This is the system.  Here's
           the multi-purpose canister.  This is where the fuel is
           placed.  This is placed into the transfer cask which
           is used for handling.  Both are put in the spent fuel
           pool where the fuel assemblies are loaded.  The top is
           put on the shielding.  It's brought out to another
           area for preparation and there it's dried and sealed,
           inerted and sealed up and then this transfer cask is
           placed on top of the overpack.  With the stays, the
           MPC is lifted off of the bottom lid and the MPC is
           inserted into the overpack.  The overpack has four
           vents on the bottom, four on the top.  Air enters the
           bottom vents, pulls the MPC and exits the top vent.
                       MR. POWERS:  What's the electrical
           chemical potential between the lead and the steel?
                       MR. RYDER:  Say it again, please.
                       MR. POWERS:  The electrical chemical
           potential between the lead and the steel?
                       MR. RYDER:  I don't know.
                       MR. POWERS:  Doesn't corrode though?
                       MR. RYDER:  I couldn't answer that at this
           time.  In the transfer cask, it's steel/lead/steel
           water jacket, and that's used just temporarily for the
           handling operation.  There's no long term storage for
                       MR. POWERS:  Concrete.  Just concrete?
                       MR. RYDER:  Say it again, please.
                       MR. POWERS:  Concrete.  Just concrete?
                       MR. RYDER:  Just ordinary concrete.  It
           has no structural support at all.  The structural
           members on the overpack is the steel.
                       MR. POWERS:  Steel.
                       MR. RYDER:  And the concrete is just for
                       MR. POWERS:  And there's nothing specified
           about the aggregate, other than size?
                       MR. RYDER:  It's just ordinary concrete. 
           I don't know the specifications of it.
                       MR. POWERS:  What about the PSI concrete? 
           Just ordinary sizing on the stones and things like
                       MR. RYDER:  But the structural members
           themselves is the steel.
                       MR. LEVENSON:  What's the little wedge
           shown blown up on the drawing?
                       MR. RYDER:  This?
                       MR. LEVENSON:  Yes.
                       MR. RYDER:  That's just a section showing
           that this is the steel.  This is the concrete.
                       MR. LEVENSON:  It's not a wedge going into
           a hole?
                       MR. RYDER:  Any other questions about
                       DR. KRESS:  I see this thing is cooled by
           natural circulation.
                       MR. RYDER:  Yes, it is.
                       DR. KRESS:  Is loss of cooling accident
           one of the PRA --
                       MR. RYDER:  That's one of the initiators
           which I'll get to.
                       You heard about the three phases of the
           operation handling transfer and storage.  Here are
           some of the steps.  Loading of fuel, lifting it from
           the spent fuel, the issue you heard before.  We find
           it convenient to talk about these because this is how
           we actually structure our PRA around those three
                       DR. KRESS:  Going back to this natural
           convection cooling.  Is there just one inlet vent or
           is there a ring of them?
                       MR. RYDER:  There's four of them.  Four in
           the bottom, four in the top.
                       DR. KRESS:  And then they're baffled so
           that they --
                       MR. RYDER:  And then there are channels on
           the inside which help to support or align to keep the
           multi-purpose canister from tipping and the air passes
           between the channels and along the MPC.  Also, if the
           cask were to tip over, the channels collapse and so
           they provide some cushioning.
                       DR. KRESS:  Okay.  And is there just one
           outlet vent or is there?
                       MR. RYDER:  There's four inlet vents on
           the bottom, four outlets on the top.  There's a screen
           over them to keep out debris and inside the vents are
           baffles to keep radiation from streaming out.
                       DR. KRESS:  Okay.  Thank you.
                       MR. RYDER:  There are two possible
           approaches that we could have done in conducting our
           PRA.  We could have looked at all initiating events,
           no matter how low their frequencies or we could do a
           screening analysis, and to use our resources
           effectively, we chose to do the screening analysis.
                       What we did was we began by compiling a
           list of initiating events and we began with the
           external events in the PRA procedures guide.  Then we
           looked at plant procedures.  We observed some of the
           operations, talked to NMSS staff and looked at the
           design and we added our own initiating events.  
                       With that complete list, we can then apply
           that to other plants if we need to.  But in applying
           this to a particular site, we started looking at
           eliminating events by various criteria.  To begin, we
           looked at which events were not applicable to the
           site.  For example, if it's not in a seismic reaction
           region or a volcanic region or subject to Tsunamis, we
           can eliminate those events to begin with.
                       Then we also did engineering analysis to
           look at what events would have no effect on the cask,
           and we eliminated those.  And then we are in the
           process of looking at events which have low risk.  By
           that, we mean low frequency or low probability of
                       MR. GARRICK:  What was your frequency cut-
           off?  Did you have a cut-off?
                       MR. RYDER:  Nominally, we're taking 10-8,
           but this is a screening study and we're going to look
           at our results and, if need be, revisit that.
                       In the handling phase, we have mechanical
           events.  You can drop the cask when it's open.  You
           can drop it when it's sealed.  In the transfer phase
           we have mechanical events and thermal events.  The
           cask can be dropped.  It can be tipped over.  The
           thermal events can occur if, for example, the transfer
           vehicle, if the fuel were to catch fire in that and
           eat the cask.
                       MR. POWERS:  Would that happen if
           lightning strikes?
                       MR. RYDER:  That's coming up.
                       MR. POWERS:  During transfer, I mean.
                       MR. RYDER:  Say it again, please.
                       MR. POWERS:  During handling part of it.
                       MR. RYDER:  Say it again.
                       MR. POWERS:  Do you have lightning strikes
           during the handling part of it?
                       MR. RYDER:  During handling, that's inside
           the reactor building.
                       MR. POWERS:  That wouldn't count the
           outside --
                       MR. RYDER:  Transfer is outside.  We don't
           consider that there.  The procedures call for the
           transfer being done only when there's good weather
           conditions.  So if there's like rain in the forecast
           for the afternoon, either they'll put the operations
           off until the next day or they'll try to move them up,
           so they'll start earlier in the day to be sure that
           they're finished before hand.  So if there's inclement
           weather, the cask is not moved.
                       MR. POWERS:  It must be something they're
           worried about.  What is the concern?
                       MR. RYDER:  I think they just don't want
           to --
                       MR. POWERS:  Zap a worker or something
           like that.
                       MR. RYDER:  Say it again, please.
                       MR. POWERS:  Zap a worker.
                       MR. RYDER:  Yes, basically.  They also
           just want to have the workers working under ideal
                       In the storage phase, you can have
           mechanical events due to tip-overs, strikes by heavy
           objects, explosions from gas main, a passing truck or
           a barge.
                       DR. KRESS:  Excuse me, Chris.  Are these
           initiating events you've identified or are these the
           ones that have survived the screen?
                       MR. RYDER:  No.  These are ones that we've
           identified.  We are eliminating many of them.  I'm
           just here giving you some examples of the ones that
           occur.  We have a list of about 50 in detail.
                       Thermal events.  You could have vent
           blockage.  Like I say, from flood waters or from
           debris.  Mechanical thermal events would be the
           effects of an accidental strike by an aircraft and
           then there's lightning.  
                       MR. GARRICK:  The lightning is just a
           people problem, isn't it?c
                       MR. RYDER:  We believe so at this time. 
           There is some speculation that there might be some
           effects on the concrete and the overpack, and we're
           also continuing to look into what could happen to the
           MPC, but we believe right now that the current will
           just pass through it.
                       MR. GARRICK:  You don't know how good a
           Faraday cage it is.
                       MR. RYDER:  That's the primary concern is
           for worker exposure for the workers, but no, I don't
           know that at this time.
                       MR. LEVENSON:  Is the vent blockage
           including concern for rodents and insects and birds
           which are probably much more likely than floods?
                       MR. RYDER:  Yes.  Actually, one of the
           initiating events which we are going to be looking at
           is long-term accumulation of insects or debris
           accumulating inside the vents.
                       MR. POWERS:  Squirrel nests.  
                       MR. RYDER:  I mean it's a warm environment
           and so it would tend to attract creatures.
                       Method of analysis is, of course, the
           event trees.  We're using fault trees to look at the
           human errors and some equipment failures.  Then we
           have other analyses going on.  I have a stylized event
           tree in the package here.  The event trees are much
           simpler than you would see in reactors.  I'm not going
           to go through this.  You can look at it on your own. 
           But they're nowhere near the detail that you see the
           power plant PRAs.
                       Inputs to the event tree are the
           initiating event frequencies.  Some of those you'll
           hear about later on.  We have the probability of MPC
           failure.  To do that, we have analyses that determine
           mechanical and thermal loads on the cask and then
           those results go into a fracture mechanics analysis to
           give us the probability.  We also are looking into the
           ability of the reactor building to isolate, the
           ventilation system to isolate, and then we have our
           consequence analyses, too, and you'll be hearing more
           about those.
                       DR. KRESS:  Does the fracture mechanics
           part of this start out with some postulating cracks
           and crag distributions in the cask?
                       MR. RYDER:  Yes, and you'll be hearing
           about that.  There are flaws and welds that normally
           occur and which are acceptable.
                       MR. GARRICK:  Chris, before you do the
           risk assessment.  Did you do any threshold analysis? 
           That is to say, did you try to get a handle on what
           kind of forces and impacts and temperature conditions
           you'd have to get to even get a problem?  
                       MR. RYDER:  We did some of that.  We
           looked at the submittal, of course, and then we had
           Jason doing some calculations as well.  But it was
           limited in that respect.  We basically postulated
           various events that could occur and then we asked
           other analysts if they could tell us if these could
           indeed happen.
                       MR. GARRICK:  Well, there's two ways to do
           this.  You establish a scenario and see what the end
           state of that scenario is in terms of the effect.  But
           the other way, in order to kind of get a sense of the
           magnitude and also very helpful in the screening is to
           analyze it in terms of what the threshold values are
           for getting any kind of a release condition.
                       MR. RUBIN:  We're doing that along the way
           as we go.  You'll hear some of the results on the
           interim analyses looking at, for example, what
           temperatures can cause the MPC to fail.
                       MR. GARRICK:  Right.
                       MR. RUBIN:  And if no temperature scenario
           or sequence will reach that temperature, then it's not
           going to go into the PRA model.
                       MR. GARRICK:  It's a very useful exercise
           to keep the problem under reasonable management.
                       MR. RUBIN:  That's exactly what we're
           doing, and it's an iterative process.
                       MR. RYDER:  And I would ask some of the
           people if the cask experience, this initiating event,
           what would happen to it, and they would give me some
           kinds of judgments in which case we would pursue it in
           more detail.
                       With that, that ends my portion.
                       DR. KRESS:  Is somebody going to talk
           about the consequences later?
                       MR. RYDER:  Yes.  That concludes my
                       MR. POWERS:  I may be leaping ahead in the
           presentation and, if so, I'm willing to wait for the
           answer, but do we have information that would tell us
           what kind of fracturing and fragmentation of fuel rods
           would happen given a mechanical insult at various
                       MR. RYDER:  I'm going to leave that to
           that discussion.
                       MR. GARRICK:  That's kind of what I was
           trying to get at, Dana, too.  Threshold for a source
                       MR. POWERS:  I know that the
           transportation folks have wrestled with that problem
           and it strikes me that if we do have information, it
           may not be applicable to the higher burn up flags that
           we would encounter in the future.
                       MR. GARRICK:  Yes.  Out in your laboratory
           20 years ago or so, they did train impact and truck
           impact tests on fuel casks.
                       MR. POWERS:  They didn't stick a bunch of
           fuel rods inside it.
                       MR. GARRICK:  They were very impressive in
           terms of establishing some sort of --
                       MR. POWERS:  A lot of people over-
           interpret those just a tad.
                       MR. GARRICK:  They were expensive tests,
                       MR. POWERS:  They were expensive tests and
           they were done for particular purposes, not
           necessarily what people want to use them for today.
                       MR. RYDER:  Are there any other questions?
                       MR. GARRICK:  Questions?  Okay.  Thanks,
                       MR. POWERS:  I guess one of the questions
           that comes up.  You've been following the PRA
           procedures guide probably because that was what was
           available when you started this work.  Can you derive
           anything useful that's appeared since the procedures
           guide came in?
                       MR. RYDER:  I'm not prepared to answer
           that right now.  I could get back to you on that.
                       MR. POWERS:  I mean I happen to be a big
           fan of the procedures guide.
                       MR. RYDER:  We used the procedures guide
           to get a list of initiating events and then, through
           our own study, we added other events to it and
           discussions with the NMSS staff.
                       MR. POWERS:  So it's not likely to be
                       MR. RUBIN:  We also looked at all the
           initiating external events, for example, analyzing the
           IPEEEs.  We included them in this study as well in our
           list.  It's fairly comprehensive.
                       MR. POWERS:  I mean since we've been going
           to this effort to produce standards for PRAs, I just
           wondered if there was anything out there.  
                       MR. RUBIN:  We went through a lot of
           effort and discussions with the user office, the spent
           fuel project office and ourselves, to make sure we had
           an all inclusive list.  It seemed to the point of
           almost getting a little bit ridiculous in some points. 
           We went overboard in being inclusive rather than
           excluding events.
                       MR. POWERS:  Did you add volcanism? 
           That's the question.
                       MR. RUBIN:  We did, but some sites don't
           have a volcano.
                       MR. POWERS:  But they might.
                       MR. RUBIN:  But if it did, it would be a
           block vent scenario with debris build-up, and we have
           that analyzed.  So I'd say we could cover that if we
           knew the initiating event frequencies of the volcano. 
                       MR. POWERS:  Talk to the guys at Yucca
           Mountain.  They seem to find volcanos where other
           people can't find them.
                       MR. RYDER:  Brad Hardin will now continue
           the discussion.
                       MR. HARDIN:  Good afternoon.  I'm going to
           talk to you about our analysis of the external events
           of the initiating frequencies.  This is a list of the
           events that we looked at.
                       MR. GARRICK:  Are these essentially based
           on the reactor's PRA?
                       MR. HARDIN:  No.  I wouldn't say just
           that.  I think we considered this particular
           application and we actually looked at some things that
           maybe for reactors we don't look at too much any more. 
           I guess for the IPEEE we had gone through a number of
           these types of things just fairly recently here and in
           the case of the dry cask storage, I think maybe Chris
           and Alan both said we tried to be very inclusive at
           first and then we tended to look at things that were
           very unlikely.  We screened those out.  But we started
           with a pretty long list of things.  Accidental
           aircraft crashes and then tornados.  We were
           interested in determining what the likelihood would be
           of the cask sliding during a tornado from the high
           winds and perhaps striking other casks and then
           tipping over onto concrete pads.  What kind of damage
           might we get from that?  What's the likelihood of it? 
                       I'm not going to talk to you about any of
           the damage areas because other people coming up after
           me will talk to you about the analysis of the
           potential for failing the multiple container and then
           flooding and lightning.
                       DR. KRESS:  All these things are site
                       MR. HARDIN:  Yes.
                       DR. KRESS:  One would do a site specific
                       MR. HARDIN:  That's right.  For this
           particular site.
                       MR. GARRICK:  Yes.  That's why I was
           asking the question because the reactor is site
           specific, too.
                       MR. HARDIN:  I'll talk to you a little bit
           about the data.  This one has a lot of interest. 
           Looking at it from the viewpoint of accidental
           aircraft crashes in this case.  We put in an equation
           up here, partly to show you an example of the type of
           analysis that was done on most of these external
           events.  The form of the equation is fairly similar
           where the analysis result that we would like to get
           is, in this case, the number of crashes per year into
           the site where we might get damage.
                       The summation takes place over the four
           local airports that are in the area of this particular
           site.  We did an analysis of the likelihood of a crash
           during take-off and landings in some detail because we
           had good data for that.  We attempted to also analyze
           fly-overs, but it's been very difficult to get data
           for the number of flights flying over the area.  It's
           somewhat complicated and even today we learned of a
           new reference where we might be able to get some
           information on that.  But at any rate, right now I'm
           just going to talk to you about the take off and
           landing analysis.
                       There are four airfields that are in the
           vicinity of this particular site.
                       MR. POWERS:  Is Ca a generic term?
                       MR. HARDIN:  It's a generic term that's
           been derived from analyzing crashes all over the
           United States, and it depends on the distance from the
           site to the particular airfield. In this case, each of
           the airfields was fairly distant from the site.  They
           ranged in distance from 16 miles to 29 miles, and the
           data that we had, when you try to look at something as
           far as 16 miles, it's a very, very small number.  It
           would be a better analysis if we had airfields that
           were closer to the site.  It turns out that the C is
           the same for each of the airfields because they're all
           fairly distant ranging in distance from 16 to 29
           miles.  These airfields were identified --
                       DR. KRESS:  Is that a circular area?
                       MR. HARDIN:  That's the way it's analyzed,
           as if a plane --
                       DR. KRESS:  With the center at the
           airfield and the end of the radius at the plant?
                       MR. HARDIN:  Yes.
                       DR. KRESS:  What you said earlier is you
           really don't have good information on direction of the
           flight so that you could narrow that.
                       MR. HARDIN:  For this particular analysis,
           when we did the first run at it, we tried to do a
           little bit fine tuning to take into account direction
           and we did get a little bit of information that
           indicated that the one airfield that we were most
           interested in because it had larger planes landing and
           taking off, that the flights tended to come in all
           directions except from the east.  The eastern quadrant
           didn't have that many flights coming into it.  So
           we've done a little bit of analysis along that line,
           but it didn't change the number very much.  It just
           ended up making it a little bit smaller by reducing
           that quadrant.
                       The term that summed the multiplication of
           Ca X Na which is the number of operations in and out
           of the airfields might be considered to be like a
           crash density and then if you multiply it times some
           equivalent area, then you get the total number of
           crashes that you might expect.
                       MR. POWERS:  Is it the target area that
           you want to do there or the area that an aircraft
           crash occupied?
                       MR. HARDIN:  I'm sorry, Dana?
                       MR. POWERS:  I mean I slam an airplane
           into the ground.  It creates a damage circle so big
           which I think is bigger than the cask.
                       MR. HARDIN:  That's right.
                       MR. POWERS:  So it's that area that you
           want to use, not the cask area, isn't it?
                       MR. HARDIN:  That's right.  There's a
           skidding area that's typically added, depending on the
           terrain, and we used I think a distance of about 100
           feet for that and then the projected area of the pad
           with the casks on it was used and then we added 100
           feet to that to come up with an area.  The final
           result in this case was something on the order of 10-9
           crashes per year.  It was a pretty small number.
                       While we're talking about aircraft
           crashes, we needed to pick a particular type of
           airplane to analyze in terms of the results of the
           potential for damage to the cask and we were given
           pretty good information from the Federal Aviation
           Administration in the area of the site.  They were
           able to tell us how many operations were at each
           fields, which fields were used more commonly, and what
           type of aircraft used them.  
                       It turns out that the aircraft are limited
           by whether the runway is long enough.  Of course, some
           of the larger planes just can't land at certain
           airfields because the runway is not long enough.  Out
           of the four airfields, there was only one airfield
           that had a large enough runway that all of the planes
           that used those areas could land at that one
           particular place.  So we sort of focused our analysis
           on that.
                       MR. POWERS:  You're going to be worried
           about 20 years from some time.
                       MR. HARDIN:  Yes.
                       MR. POWERS:  There's a substantial
           evolution that occurs in aircraft over a 20 year
           period.  That usually is not in the direction of
           smaller.  Did you try to correct for that?
                       MR. HARDIN:  We asked the people at FAA
           that were familiar with these airfields if they
           thought that would change very much in I don't
           remember how many years, but it's possible that this
           would have to be returned to and re-analyzed at some
           point if there are some major changes there.  But
           right now they thought the data they gave us was
           pretty good, at least out to I think maybe 10 years or
           so.  The Lear Jet 45 was one of the planes that was a
           larger one that had a fairly large amount of fuel of
           all the ones that landed at these four airfields.  It
           was not the largest plane, but we chose it to analyze
           because the two planes that were larger than it were
           restricted in which fields they could land at because
           of this runway distance and so we thought that the
           Lear Jet 45 would be a good one to start with to see
           what we would get from that.  So you're going to hear
           some results of that analysis.
                       DR. KRESS:  And even though it's 10-9, you
           decided to go ahead with the rest of the analysis even
           though it likely would have been screened out based on
           the screening criteria because you needed the
           methodology or the consequences anyway.  Probably some
           sites that may not screen it out.
                       MR. HARDIN:  Yes, and because we had a
           team of people working on this and we started all of
           these analyses some time ago --
                       DR. KRESS:  In parallel.
                       MR. HARDIN:  -- we weren't sure sometimes
           what kind of probabilities we were going to get at the
           time and so some of the consequence areas were looked
           at also.
                       For tornados, looking first at likelihood
           of sliding and tipover.  Khalid Shaukat, who's going
           to talk to you a little later, did an analysis and
           determined that in order for the cask to slide, we
           need to have 400 mile per hour wind during a tornado
           or greater and for a cask to tip over, it would
           require a 600 mile per hour wind or greater.
                       DR. KRESS:  These analysis are rather
           simple drag versus frictional resistance to sliding
           and knowing the weight of the thing.  Is that right?
                       MR. HARDIN:  I think that Khalid should
           answer that.  He's the one that did the details on it. 
           He'll be up here in a few minutes.
                       DR. KRESS:  We'll wait for that.
                       MR. GARRICK:  Approximately what's the
           center of gravity of a full --
                       MR. SHAUKAT:  That is correct.  It is
           based on drag force and friction.
                       MR. GARRICK:  What's the center of gravity
           height?  The height of the center of gravity
           approximately on a fully loaded cask and approximately
           how wide are these casks?
                       MR. SHAUKAT:  I can answer that question. 
           It's slightly higher than the mid height of the cask. 
           It's 878 inches from the bottom.
                       MR. GARRICK:  How wide are these casks?
                       MR. SHAUKAT:  The cask is about 11 feet in
           diameter.  The overpack I'm talking about, not the
           MPC.  It's about 11 feet in diameter.
                       MR. HARDIN:  Well, the highest recorded
           tornado in the United States to date has been about
           300 miles an hour.  We were given a good bit of help
           and information from the Wind Science and Engineering
           Research Center in Lubbock, Texas.  It's operated by
           Texas Tech University.  And so we tried to get some
           feeling from them about what's the likelihood of
           getting wind speeds and tornados reaching 400.
                       MR. POWERS:  After they stopped laughing,
           what did they say?
                       MR. HARDIN:  Well, they indicated that
           this data hasn't been taken for I think it's maybe 15
           years or 10 years, and so they can only speak for that
           time when they've had fairly reasonable data.  But
           they don't think there's any physical phenomena that
           would limit it to go slightly above 300 but there are
           some people, experts, that think that it would be
           unlikely to get wind speeds that go much higher than
                       DR. KRESS:  I don't think you can get the
           temperature difference between the layers of air that
           would generate that much energy.  I think it would be
           that sort of consideration.
                       MR. HARDIN:  Well, to analyze the
           probability of getting up to 400 miles an hour, we
           used the data that we had that went up to a little
           less than 300 and we did a regression analysis on it
           to get a curve so that we could extrapolate it out to
           400, and we did that recognizing that we really don't
           know what accuracy we have in doing that.  But we came
           up with a value of something like 10-9 again for the
           likelihood of having a tornado that would result just
           in sliding and so for tip over, since it takes a
           considerably higher wind speed, we presume that that's
           also a very small number.
                       DR. KRESS:  Did you look at tornado
           generated missiles?
                       MR. HARDIN:  Yes.  That's the next slide.
                       DR. KRESS:  I'm sorry.  I didn't look
                       MR. POWERS:  You pretty quickly get the
           conclusion here, Tom, that no matter what we think of,
           you've got an answer for it.  This is frustrating.
                       DR. KRESS:  That's frustrating.
                       MR. POWERS:  You've got to leave some
           blanks for us to jump into to feel like we've
           accomplished something.  
                       MR. HARDIN:  As far as tornado generated
           missiles, the design basis tornado of 360 miles an
           hour in the standard review plan has a number of
           different items that you would typically look at. 
           Utility pole, 12" schedule 40 pipes, steel rods, and
           automobiles.  And in looking at these, it was
           predicted that there would be no penetration of the
           concrete shell and no MPC failure.  Again, I'm not
           intending to talk too much about these kinds of
           results.  If you have questions about that, someone
           else can answer.
                       MR. POWERS:  Is there enough impulse
           provided by any of these projectiles to cause the
           thing to tip over?
                       MR. HARDIN:  No.  Not without a very, very
           low probability.  It would take a very high wind
           speed, again, to create a missile with enough speed to
           do that.
                       MR. GARRICK:  In the maintenance of these
           casks, is there anything that people could do
           accidentally or intentionally or whatever that would
           make them more vulnerable?
                       MR. RUBIN:  If that would occur, it would
           be during the handling phase because there's really
           not much going on other than surveillance when it's in
           storage.  So, for example, if there's a misloading of
           fuel over the long-term, what effect could that be if
           it was improper drying or inerting, sealing the cask?
                       MR. GARRICK:  I was just thinking of
           things like the cap being loose or something and 300
           or 400 mile an hour wind creates quite a Bernoulie
                       MR. RUBIN:  Are you talking about the top
           being lifted off?
                       MR. GARRICK:  Yes.
                       MR. RYDER:  The overpack top is bolted on
           and the MPC is sealed for the 20 years.  It's got
           redundant sealing, redundant welds.  It's supposed to
           be just a passive system that is placed on the storage
           pad and, except for surveillance to check the vents,
           there's nothing really --
                       MR. GARRICK:  They don't do any
           maintenance that would require them to remove the cap?
                       MR. RYDER:  No.  It's meant to be placed
           on the storage pad for 20 years and left there.
                       DR. KRESS:  How do they inspect these
                       MR. RYDER:  So far, we've learned that
           it's just visual observation of looking to be sure
           that there's no debris on the vents.
                       DR. KRESS:  You just look at the outside
           of the vent.
                       MR. RYDER:  Look on the outside.
                       MR. HARDIN:  We conclude that because of
           the low likelihood of getting high enough winds that
           the frequency of occurrence of a missile failing the
           cask is very small.
                       Flooding has been screened out also
           because the topography in the area of the site is such
           that rain water, even during the maximum precipitation
           that we look at during the IPEEE review, would not
           have any way for water collecting.  It would drain
           away from the particular site.  The elevation of it
           also precludes having river-related flooding including
           dam breaks.  We weren't able to actually calculate
           anything on that.  We didn't have the kind of data
           that we might have needed.  There have been some
           calculations done by the licensee and those numbers
           that they calculated were very small.  I think 10-8 or
           something like that.
                       This is the last one.  It's lightning. 
           Lightning is monitored in the United States by the
           National Lightning Detection Network which includes
           about 100 sites spread out around the country and this
           network is operated by a company called Global
           Atmospherics.  They sell data for particular areas. 
           You can get data down to one-tenth of a mile.  And so
           we bought data from them for 10 years from a tenth of
           a mile out to three miles, and we were able to
           calculate a density of occurrence of lightning flashes
           in the area that we could then, using a target area
           for strike of the casks, we estimated about a 10-2
           strike per year frequency of lightning strikes.
                       DR. KRESS:  That's one every 100 years?
                       MR. HARDIN:  I'm sorry, Tom?
                       DR. KRESS:  That's one strike every 100
                       MR. HARDIN:  Yes.
                       DR. KRESS:  It's not like my place.  I get
           one every year.
                       MR. POWERS:  That explains a lot about
                       MR. GARRICK:  I think you started out by
           saying that these have a 20 year life.
                       MR. RUBIN:  Twenty licensed.  The life
           time could be longer but the license is for 20 years.
                       MR. GARRICK:  That's my question.  What
           kind of life do these casks have?  Do they last 100
                       MR. RUBIN:  I'll leave that to Jack
           Guttman to answer.
                       MR. GUTTMAN:  We license it for 20 years
           and we have ongoing a license renewal program.  We
           just issued a standard review plan and the first
           application for license renewal is expected next year. 
           The vendors are saying it will last approximately 100
           years or so, but we haven't performed any calculations
           to identify the length of number of years that a cask
           would be acceptable.
                       MR. GARRICK:  Have you done enough
           analysis to know what part of it ages the fastest?
                       MR. GUTTMAN:  At this point with the data
           that we've received through research from the INEO,
           casks that were monitored and instrumented, we did not
           see any active degradation occurring at this point and
           those casks are approximately 17 or 18 years old.
                       MR. HARDIN:  If you don't have any
           questions on this, Moni Dey from the PRA Branch is
           going to talk to you now about the fire analysis that
           was done.
                       MR. DEY:  Thank you, Brad.  I'm going to
           cover the fire analysis and Jason Schaperow following
           me will present the thermal analysis that utilizes the
           results that will be developed.
                       I'll start off with the statement of the
           problem.  As Brad mentioned, we're going to be
           analyzing the fuel spillage from Lear Jet 45 aircraft. 
           The assumptions are to ensure that we're conservative,
           that the dry cask remains upright and is totally
           engulfed in a fire.  We're analyzing the effects of
           the fire on one dry cask.  Normally there are 12 casks
           on a pad but to be conservative, we're analyzing the
           effects of the fire on just one.
                       As was mentioned, the dry cask, the
           outside diameter is 11 feet and 19.3 feet high, so
           it's a fairly massive object.  The amount of fuel in
           the Lear Jet 45 is 6,080 pounds.  So that's the amount
           of fuel that could be spilled in fire.
                       The objective of the fire analysis is 1)
           to determine the duration of the fire, assuming all
           the fuel leaks out and secondly, to determine the
           temperature distribution of a hot gas from the fire
           surrounding the dry cask.  Specifically, the
           temperature of the hot gas near the inlet and outlet
           vents which Chris described earlier.
                       A brief presentation of the analysis for
           the duration of a fire.  In order to estimate the
           duration, one needs to postulate the way the fuel
           spills.  The duration of the fire will obviously be a
           lot less if there's a very big leak as a result of a
           crash and the fuel spills all at once.  So in order to
           be conservative, a minimum spill rate was chosen so
           that the 1) the dry cask will be totally engulfed in
           the fire.  So in that sense, this is a worse case fire
           effects analysis, worse case in the assumption of the
           leak size.
                       Therefore, in order to determine the
           duration of the fire, one can estimate the equilibrium
           diameter of the fuel pool that would be related to the
           spill rate and the burning rate, and the burning rate
           for fuel is available. Various measurements have been
           made and this data is available in fire protection
           handbooks.  The burning rate for this particular type
           of fuel is about 4 mm/minute.  I've attached some data
           at the end of the slides if you're interested in
           looking at some of the curves from the handbooks.  
                       As I mentioned, assuming the fuel pool
           size that's needed to engulf the fire is approximately
           twice the diameter of the cask so about 22 feet
           diameter fuel pool that would burn.  Based on this,
           one estimates that the duration of the fire would be
           about 24 minutes for the fuel spillage.
                       The next question is what is the
           temperature of the hot gas that Jason will use in his
           analysis.  I had two sources of information that I
           used for this.  One is over the last decade, several
           plume models have been developed and secondly,
           recently there were some tests done at Sandia on
           horizontal transportation casks where temperature was
           measured and the temperatures measured near the cask
           and this was near the ground level.  It was
           approximately 1,800 F.
                       Secondly, the plume models, as mentioned,
           several plume correlations developed over the last two
           decades and the temperature and velocity in the plumes
           have been measured.  Typically, the plume is divided
           into three regions.  First region right above the
           burning area is a consistent flame region followed by
           an intermittent flame region and then just a plume of
           hot gases with no flame in it.  And these different
           regions produce different temperatures and velocities. 
           I've attached some figures that document these
           measurements that have been made in empirical plume
                       Based on these correlations and the height
           of this particular dry cask, the entire dry cask would
           be in the consistent flame region.  The temperature of
           the hot gas around the dry cask is estimated to be
           about 1500 F.  What I recommended was using a
           temperature of 1832 F for the hazard analysis which
           Jason will cover.
                       Finally, the conclusions of the fire
           analysis for this type of jet.  The duration of the
           fire is estimated to be about 24 minutes and the inlet
           and outlet vents, both of them will be exposed to hot
           gases at approximately 1830 F.
                       MR. GARRICK:  Did you look at any extreme
           of values like if you had 10 times as much jet fuel? 
           Six thousand pounds is about one hour driving time for
           a 747 jet engine.  Did you try to examine supposing
           you had 10 times as much fuel what that do to the
                       MR. DEY:  Well, basically 10 times more
           fuel that you mention that would be in a 747 would
           increase the duration of the fire by a factor of 10.
                       MR. GARRICK:  And what about the
           temperatures?  Would they be pretty much the same?
                       MR. DEY:  The temperatures would be pretty
           much the same.
                       MR. GARRICK:  So it would increase the
           duration probably to hours.  Right?
                       MR. DEY:  Yes, about four hours.
                       MR. GARRICK:  Yes.  Okay.
                       MR. GUTTMAN:  I'm not sure that if you had
           a larger amount of fuel that you actually can
           extrapolate that to hours.  You'd have to have a small
                       MR. GARRICK:  Yes.
                       MR. GUTTMAN:  If the plane crashes in,
           probably the entire fuel will be spilled all over the
           place and using this conservative bounding analysis
           that it sticks within a diameter or so of circling the
           cask is a very conservative assumption.
                       MR. GARRICK:  So you think the 1800
           degrees -- well, the 1800 degrees is not in dispute. 
           It's just the duration.  
                       MR. GUTTMAN:  Yes.  Much bigger.
                       MR. GUTTMAN:  Thank you.
                       MR. SCHAPEROW:  I'm Jason Schaperow from
           the Safety Margins and Systems Analysis Branch.  The
           objective of my analysis was to assess cask heat up to
           allow the structural people to evaluate the cask
           failure probability.  The approach we took was to look
           at three scenarios for the HI-STORM cask.  We looked
           at a blocked vent scenario, buried cask and external
                       Our conclusions are for the blocked vents
           and the buried cask scenarios, the heat up is slow due
           to the low decay power of this fuel and for the
           external fire scenario, we saw that the temperature
           rise was limited by the fire duration.
                       This next slide shows the HI-STORM cask. 
           This is taken from the safety analysis report for the
           cask.  This cask consists of a sealed metallic
           canister, as we mentioned a couple of times already. 
           This shows it partially inserted into the overpack. 
           This MPC is the confinement boundary and the overpack
           which is steel and concrete provides the mechanical
           protection and radiological shielding and, as has
           already been mentioned, this concrete and steel
           overpack has air ducts in it.  There's actually an
           annular region between the MPC and the overpack, and
           there are some so-called channels in there to kind of
           keep the MPC centered in the overpack, but there's
           basically an annular region in there.
                       The approach we took was to assess three
           scenarios.  This is to develop a range of conditions
           that can be used to evaluate the cask failure
           probability.  For the blocked vent scenario, we
           estimated the heat up resulting from blocking all four
           of the intake vents and with the one-dimensional model
           that we used, that shut off flow through the vent. 
           For the buried cask scenario, we again shut off the
           vents but we also put the cask in a condition where
           there's no heat transfer from the outside surface, no
           conduction of radiation off the outside surface of the
           cask which is a very extreme condition. 
                       Finally, for the exterior fire scenario,
           we calculated the heat up from the external fire which
           Moni provided the boundary conditions for.  We applied
           the MELCOR code to assess cask heat up.  MELCOR is an
           integrated accident analysis code for severe reactor
           accidents.  It can be used for thermal hydraulics, as
           we've used it for here.  It's also got modeling for
           core melt progression and fission product source term
           which we are planning to use in the consequence.
                       DR. KRESS:  Is this thermal hydraulics or
           is this strictly conduction and radiation heat
           transfer?  Is there a natural convection inside the
           cask itself?
                       MR. SCHAPEROW:  In the nodalization I've
           chosen here, you'll see there's nothing inside the
           MPC.  For the fire scenario, I'm allowing natural
           circulation of the hot fire gases through the annulus. 
           For the first two scenarios, no, no flow.  This is
           just conduction and radiation but for the third
           scenario, we're allowing flow of hot gases through the
                       The major inputs to this code.  The
           thermal hydraulic input for the control volumes, the
           flow paths and the heat structures and finally, the DK
           power which is the heat input.  I've noted on this
           slide the DK power we use in our analysis.  This is
           important because this is a very small number, and
           this is what drives the calculation for the block vent
           in the buried cask scenario.
                       DR. KRESS:  When you say each assembly. 
           That's each fuel assembly.
                       MR. SCHAPEROW:  That's correct so for the
           whole cask it's about 21 kilowatts.  This is a BWR-
           type canister and holds 68 BWR assemblies.  About one-
           eighth of a core.  
                       This slide shows the nodalization we used
           with the MELCOR code.  I would like to mention this is
           simple.  It has only five elements.  Three control
           volumes and two heat structures.  As Tom pointed out,
           we're not considering convection within the multi-
           purpose canister.  It's one volume.  No flow.  
                       This next slide gives the MPC shell
           temperatures we calculated for the scenarios which
           only had DK heat.  That is the block vents in the
           buried cask scenarios.  We just ran it out in time out
           to about a million seconds.  It takes a long time to
           heat up with the low DK power here.
                       DR. KRESS:  This is the temperature on the
                       MR. SCHAPEROW:  That's right.  This is the
           boundary of the multi-purpose canister shell.  This is
           the boundary for fission products.  
                       DR. KRESS:  Does this have a maximum fuel
           temperature inside that's calculated also?
                       MR. SCHAPEROW:  I did not calculate a fuel
           temperature inside.  I didn't even put fuel in here. 
           I just have helium.
                       DR. KRESS:  Oh, you just had the heat
           going --
                       MR. SCHAPEROW:  Helium with a constant
           density heat source.  Just uniform heating of the
           helium.  We are developing a MELCOR input file.  We're
           going to be doing some calculations.  We're actually
           putting fuel assemblies in there.
                       DR. KRESS:  Your focus here was on what
           would happen to the cask.
                       MR. SCHAPEROW:  That's correct.  Whether
           it would rupture or not.  This is going to be used by
           the structural people to estimate failure probability.
                       DR. KRESS:  When you get time involved in
           it, you will go back and say I've got so much time to
           do corrective actions to get the failure probability
           or something like that.  You'll have a temperature at
           which you don't want to exceed and then you'll have so
           much time to get there.
                       MR. SCHAPEROW:  I don't know how they're
           going to handle that.
                       MR. RUBIN:  This might be where some of
           the risk informed insights might come into play in the
           results of this in terms of procedures and other
           things, looking at the time before you run into
           problems and what could be done.
                       MR. SCHAPEROW:  This was an issue on the
           spent fuel pool risk study from last year.  This is
           heat up just based on slowly draining pool.  People
           have days to take care of it.
                       DR. KRESS:  Do you have a temperature that
           you don't want to exceed yet  based on structural
                       MR. SCHAPEROW:  I'd have to turn to the
           structural people for that.  Ed.
                       DR. KRESS:  The question is do you have a
           limiting temperature that you want to say that you
           don't want to exceed yet?
                       MR. HACKETT:  This is Ed Hackett,
           Materials Engineering Branch and Research.  I think
           Doctor Kress asked a question about limiting
           temperature.  We were looking at, I believe -- I
           didn't do these analyses.  I'll be subbing here later
           today for Tanny Santos.  I think we were looking at
           about 1,000 F. as sort of the ball park answer.  There
           was not a whole lot of damage that was contributed in
           a creep mechanism before 1,000 F.
                       MR. GARRICK:  And the damage is where that
           you were most worried about?
                       MR. HACKETT:  The damage would be largely
           to the areas like the welds, for instance.
                       DR. KRESS:  Does the helium get internally
           pressurized at these kind of temperatures?  That would
           be significant pressure.
                       MR. SCHAPEROW:  That's correct.  The
           structural analysis used both the temperature and
           pressure results from these calculations.
                       DR. KRESS:  Okay.  
                       MR. GARRICK:  Let's pull out all the water
           from the concrete?
                       MR. SCHAPEROW:  We didn't consider water
           in the concrete as the -- this is for the multi-
           purpose canisters.  It's only the helium and the fuel
           inside that pushes outward.
                       We also ran a test using a temperature of
           1830 F. for the environment.  This was my attempt to
           simulate a fully engulfing external fire, and it's
           described --
                       DR. KRESS:  That's the maximum temperature
           you would get in combusting jet fuel in a
           stoichiometric mixture with air or what?
                       MR. GARRICK:  It's about 1500 degrees I
           think was your maximum, wasn't it?
                       MR. DEY:  Yes.  The temperatures that have
           been measured typically for various fields, it doesn't
           vary very much.  It's around 1500 degrees.  Just to
           get some margin, I recommended using 1830 because
           there have been some measurements.  
                       DR. KRESS:  That's when you take a
           stoichiometric mixture of combustion and put all the
           heat back into the mixture.  You get 1500 or something
           like that.
                       MR. GARRICK:  See, really what you're
           ending up with here is not so much a risk assessment
           as a bounding analysis because we don't really know
           what the answer is to the question.  From this
           analysis, we don't know the answer to the question
           what is the risk?  We know some other answer.
                       DR. KRESS:  We know that the risk is less
           than some value.
                       MR. GARRICK:  Yes.  
                       MR. POWERS:  In the engulfing fire, you're
           heating from the outside through the concrete and
           through the flow through the ducts.  Right?
                       MR. SCHAPEROW:  That's correct.  All I've
           done in this calculation is very straightforward. I've
           just changed the boundary condition as the environment
           is now very hot.
                       MR. POWERS:  In this concrete field
           region, is it vented?
                       MR. SCHAPEROW:  No, it is not and I think
           that issue was discussed as far as the concrete giving
           off steam.  I'm not sure how that was resolved.  I'd
           like to refer back to the PRA Branch.
                       MR. RYDER:  We're not looking at the
           effects of the overpack.  Our concern is the
           confinement boundary which is the MPC.
                       MR. POWERS:  I think we'll get to that. 
           Suppose that I indeed pressurize that outer package. 
           How does the steel deform?  Does it deform into the
           overpack or does it just all push outwards?
                       MR. RYDER:  We have not looked at that in
           our analysis.  Our focus has been on the MPC and the
                       MR. POWERS:  I suspect you'll find out
           that it'll all deform outward, but it's worth looking
           at because at these kinds of surface temperatures, if
           someone were to use limestone concrete, you'll get
           some fairly impressive pressures within the concrete
           fill regime.  It's a little tricky to figure out
           exactly what it is because in fact the CO2 pressure
           will get so high it'll keep the limestone from
           decomposing.  But it'll be impressively high
                       MR. LEVENSON:  And I think the reason you
           can be almost sure the bulge will be out is the inside
           steel is nowhere near these temperatures.  It may be
           700 - 800 degrees or 1,000 degrees lower.  I mean if
           the MPC inner canister only goes to 260, then the
           inside part of the overpack only goes to 260.
                       MR. SCHAPEROW:  That's temperature rise.
                       MR. LEVENSON:  Right.  So if the inside is
           260 and the outside is 1800, it's going to bulge out.
                       MR. SCHAPEROW:  That's 260 plus the
           initial temperature.
                       MR. LEVENSON:  It doesn't matter.  
                       MR. SCHAPEROW:  It isn't going to make any
                       MR. LEVENSON:  It's 300 versus 1800.
                       MR. POWERS:  I'm not so good at these
           complicated structures deciding which things move
           where.  It's worth looking at because you may get some
           impressive pressures.
                       MR. SCHAPEROW:  That concludes my
                       DR. KRESS:  I wasn't quite clear earlier
           on how you estimated the fire duration.  Is that
           saying the jet fuel is in a pool of a certain
           dimension and the rate of burning off of the pool or
           something like that?
                       MR. DEY:  That's correct.
                       DR. KRESS:  You get four-tenths of an hour
           out of that, and then you did the four hour as a
           sensitivity study.
                       MR. SCHAPEROW:  That's correct.  Just say
           well, what if it's 10 times as great.  How would that
           affect it.  Basically it goes up proportionately, the
           temperature.  It's a linear rise at this point.
                       MR. GARRICK:  Okay.  Thank you.  We are
           supposed to be having a break now, but I'd like to get
           through this next presentation.
                       MR. SHAUKAT:  I am Khalid Shaukat from
           Research Applications Branch and I'm going to talk
           about mechanical loads on the dry casks and the
           stresses on the MPC.  There were two objectives for my
           work, the first one being testing the mechanical loads
           on the cask system for all the scenarios during
           handling, transfer and storage phase of this
                       The second objective is to determine the
           stresses in the multi-purpose canister and those
           stresses would eventually be used for estimating the
           probability of failure of MPC or the consequences to
           the public.  
                       For the handling events, we looked at the
           drop of the MPC and on the refueling floor when the
           cask is moved horizontally like so, hung from the
           crane, it is usually 12 inches above the floor.  We
           tried to calculate that if it falls down due to any
           fault of the crane, would it tip over or not?  We
           found out no, it will not tip over.  So then we
           calculated what height would it require to fall from
           that it could tip over.
                       DR. KRESS:  Doesn't that require you
           knowing some sort of angle at which --
                       MR. SHAUKAT:  Some sort of an angle, so
           the bounding case is an angle of 20 degrees tilt from
           the vertical.
                       DR. KRESS:  Where did that come from, that
                       MR. SHAUKAT:  That angle came from the CG
           and the geometry of the cask.
                       DR. KRESS:  It would tip over if it fell
           at that angle.
                       MR. SHAUKAT:  Yes.  The CG of the cask
           falling outside the tipping edge of the cask would
           cause it to tip over.  That angle we have calculated
           to be about 20 degrees from the vertical and that
           angle can not be reached unless the fall is more than
           28 inches from the ground.
                       DR. KRESS:  That's what I don't
           understand.  Doesn't that depend on the way the thing
           fails or something?
                       MR. SHAUKAT:  No, no.  If it fails, then
           it will drop down.  But we calculated that as long as
           the cask is 28 inches above the floor and it falls at
           a tilt, its one edge would touch first and the CG of
           the cask would still be inside that edge so it would
           just rest like this.  It will not tip over.
                       MR. HACKETT:  If it's higher than 28
                       MR. SHAUKAT:  If it's higher than 28
                       DR. KRESS:  Its momentum wouldn't carry it
           on over the other way?
                       MR. SHAUKAT:  If it's higher than 28
           inches, it could tip over.  Now, the load is such that
           it will not sway in the other direction.  It's very
           heavy, 360,000 pounds weight.
                       DR. KRESS:  My question is is there ways
           for this carrier device to fail so that it lands at a
           bigger angle than that?  Is it held up with two straps
           or one strap?
                       MR. SHAUKAT:  It is hung with a -- which
           has two sides holding on it.
                       DR. KRESS:  And if one of them fails?
                       MR. SHAUKAT:  If one of them fails, we
           have not looked into that situation yet.  Then we
           tried to calculate the stresses on the MPC for various
           drop heights.
                       DR. KRESS:  No.  The question is if it
           tipped over, is that a problem?
                       MR. SHAUKAT:  If it tips over?
                       DR. KRESS:  Is that a particular problem?
                       MR. SHAUKAT:  A non-mechanistic tip over,
           for example, just falling and then because of the tilt
           it falls over, the non-mechanistic tip over we have
           calculated is not a problem.
                       DR. KRESS:  Not a problem.  Okay.
                       MR. GARRICK:  And that's a handling
                       MR. SHAUKAT:  That's a handling accident. 
           Then we tried to calculate what would be the stresses
           on the MPC for various drop heights and we found out
           that the height could be during that transfer phase of
           the MPC from HI-TRAK into the overpack could be a
           great height like about 80 feet or so and then we
           tried to --
                       DR. KRESS:  There you don't have to worry
           about an angle.
                       MR. SHAUKAT:  There you don't have to
           worry about the angle, but we said we wanted to
           calculate what would be the stresses on the MPC for
           various heights and we found out that a threshold
           value of 62 foot drop could cause the stresses in the
           MPC very close to the buckling strength of the
           material which is 64,000 psi so that is a 62 foot
           threshold value.  And in that case, the
           circumferential stresses on the MPC shell are very
                       DR. KRESS:  My recollection is is they
           took these casks and dropped them off the top of
           cranes that were higher than 62 feet.
                       MR. SHAUKAT:  And nothing happened.
                       DR. KRESS:  Nothing happened.  That's what
           I thought I remembered.
                       MR. SHAUKAT:  We calculated the buckling
           strength reaching up to the ultimate strength of the
           material.  We're not saying it would fail at that 62
           feet height.
                       During the transfer of the MPC from HI-
           TRAK into the overpack, it's a direct vertical drop of
           20 feet which is the height of the overpack.  So it
           goes inside the overpack and we calculated what will
           be the stresses on the MPC for that fall, and that is
           11,000 psi.  
                       Now we go to the transfer events when the
           overpack is being carried by a crawler from the refuel
           building to the concrete pad outside, and we
           calculated if the crawler vehicle is traveling at its
           maximum speed and if it drops the overpack, would it
           tip over?  During this procedure, the crawler is
           carrying the cask only 11 inches high from the ground
           so we calculated that if it falls either on the
           asphalt or gravel or even the concrete pad, it would
           not tip over.
                       We also calculated that if the cask fell
           on the ground and the crawler operator fails to stop
           the vehicle, what would happen?  The finding was that
           the cask weighs about 360,000 pounds and the crawler
           weighs 158,000 pounds.  It can not push it.  Its track
           would start slipping.
                       DR. KRESS:  That requires you to have a
           coefficient of friction between the track and the road
                       MR. SHAUKAT:  We checked those different
           coefficient frictions.
                       DR. KRESS:  Are these tracks like a
           tractor?  Do they have treads?
                       MR. SHAUKAT:  Yes, they're like tractor
           and they would slip.  They could not push it forward. 
           We also calculated if the overpack digs into the
           asphalt or the gravel surface and the crawler pushes
           it, would it tip over?  And it doesn't.
                       Last area in this case we looked was the
           crawler carrying the cask near the concrete pad and
           hits another cask on the pad, what could happen to the
           stresses in the MPC?  We found out that if it hits
           another cask, the struck cask will not slide or tip
           over and the stresses in the MPC would be very, very
                       Then we go to storage events and we looked
           into the seismic and we found out that almost no
           sliding would be for the design earth quake of .015 G. 
           Then we performed some sensitivity analyses to show
           that it would take 10 times design earth quake to move
           the cask up to half the separation distance, assuming
           that during the earth quake the two casks adjacent to
           each other move in the opposite direction, although
           this is a very unusual phenomena, but this is the
           worse case it could ever happen, it would move in the
           opposite direction.  So we said okay, if the two casks
           move up to the half of the separation distance, we can
           conclude that it would not collide and we found out
           that up to 10 times of design earth quake, it will
           still not collide and no tip over could occur at any
           earth quake level up to 10 times of design earth
                       MR. HACKETT:  Can I just interject.  This
           goes back to Doctor Garrick's point at the beginning
           of the presentation.
                       MR. SHAUKAT:  The threshold events.
                       MR. HACKETT:  These are obviously very
           much bounded by the drop events for the most part,
           mechanical impact.
                       MR. GARRICK:  It makes me wonder where
           we're going with the PRA approach here, and I'm not
           one to ever say we shouldn't do a PRA, but if there
           was ever a case that we may be able to standardize
           something and design it such that it was site
           insensitive and perform one comprehensive safety
           analysis, it sounds like this might be it.
                       MR. HACKETT:  I think Alan mentioned at
           the beginning --
                       MR. RUBIN:  You'll find a lot of things,
           phenomena, sequences, will be screened out based on
           frequency, initiating events or lack of impact on the
           cask, and you're seeing those today.  There are,
           however, some instances of sequences which are not
           screened out yet.  We particularly don't have the
           human error factored into this yet, and you'll hear
           some more about that later.  But the PRA portion will
           be probably very simplified.
                       MR. GARRICK:  Yes.  Okay.
                       MR. RUBIN:  But we had to do this analysis
           to come to that conclusion.
                       MR. GARRICK:  Right.
                       MR. SHAUKAT:  We looked into the aircraft
           impact.  We chose the largest aircraft that could go
           in one of the four airfields nearby in that area
           within 30 miles radius and Lear Jet happens to be the
           largest aircraft and we calculated that at its landing
           or take off speed of 140 miles an hour, it would not
           slide or tip over the cask.  Then we calculated at
           bounding value what speed impact would cause sliding
           or tip over of the cask, and we found out about 235
           miles an hour speed could cause a tip over or slide.
                       MR. LEVENSON:  Was that done with an
           assumption that the 20,000 pound weight of the jet was
           a solid piece of metal with no energy absorption
                       MR. SHAUKAT:  Right.  Based on the
           assumption it's just a solid piece of --
                       MR. LEVENSON:  So you've got two orders of
           magnitude in that.    
                       MR. HACKETT:  Probably a lot.
                       MR. LEVENSON:  At least that.  Yes.
                       MR. SHAUKAT:  Tornados.  As Brad Hardin
           mentioned earlier, tornado velocity of 400 miles per
           hour could slide the cask and the probability of that
           is 10-9.  This was calculated based on the drag force
           and the coefficient of friction between the cask and
           the pad.  A tornado velocity of 600 miles per hour
           could tip over the cask and it was estimated that it
           would be orders of magnitude less than 10-9 to have
           that kind of tornado.
                       Tornado-generated missiles.  We have
           calculated all missiles that are in the vicinity.  We
           found that none of them could penetrate the cask.  The
           worst one for the automobile would be the worst one to
           check for the sliding or tipping over, and we checked
           that automobile as a tornado missile will not slide or
           tip over the cask.
                       DR. KRESS:  I'm intrigued by these
           calculations, if you don't mind.
                       MR. SHAUKAT:  And this is based on certain
           coefficient frictions we have taken.  We have taken a
           range of coefficient friction.  WE have found that the
           smallest coefficient of friction would be governing
           for the sliding case and the highest coefficient of
           friction would be governing for the overturning case
           and we found that it would not tip over or slide for
           different ranges.
                       DR. KRESS:  Going back to the airplane
           crash and tip over analysis.  My first thought on that
           would have been I would get the momentum of the plane
           and then I would look at how much potential energy it
           takes in getting the center gravity of the cask to tip
           over.  Is that what you did?
                       MR. SHAUKAT:  Yes.  Exactly.
                       DR. KRESS:  So it seems all the momentum
           goes into tipping it over.
                       MR. SHAUKAT:  As if one ball for the total
           weight of the aircraft hits it.
                       DR. KRESS:  Okay.  That's a pretty
           conservative analysis.
                       MR. LEVENSON:  That's what I was saying.
                       DR. KRESS:  That's what you were saying
           about absorbing some of that energy in the jet.
                       MR. LEVENSON:  An airplane does not do the
           same damage as a wrecking ball.
                       DR. KRESS:  Mostly it's the engine that
           does the --
                       MR. RUBIN:  You'll find this is typical,
           that the approach we tried was to do either simplified
           calculations.  If we need to do more detailed
           calculations later on because we could not eliminate
           events, then we would do that.
                       DR. KRESS:  I don't fault that.  I think
           it's the way to go.
                       MR. RUBIN:  So that's generally the kind
           of approach we've taken.
                       DR. KRESS:  Yes.  I think that's what you
           ought to do.
                       MR. RUBIN:  I just wanted to clarify that.
                       MR. SHAUKAT:  Shock waves.  We located
           that the nearest natural gas pipeline is about four
           and a half miles from the site and an explosion from
           such a distance would not affect the structural
           integrity of the cask.
                       DR. KRESS:  That's not much of a surprise.
                       MR. LEVENSON:  But what restrictions are
           there that would prevent over the next 20 years
           somebody putting a natural gas pipeline?  Did you do
           the other case?  How far away does it have to be
           before it doesn't do any damage?
                       MR. SHAUKAT:  No, we have not done that
                       DR. KRESS:  It would have to be on the
           site, I think.
                       MR. POWERS:  It would have to be under the
                       MR. SHAUKAT:  For flood we did the
           bounding calculations.  What kind of flood would it
           take to slide or tip over the cask?  And we found that
           a flood velocity of 25 feet per second or 17 miles per
           hour will not slide or tip over the cask.  And this is
           very small probability to have such kind of flood.
                       MR. POWERS:  On your airplane impact in
           this cask analysis, you've looked at the airplane
           hitting the cask.  What if it hits the ground
           underneath of it?
                       MR. SHAUKAT:  The bounding case would be
           the airplane hitting near the top of the cask.  We
           have taken that case.
                       MR. POWERS:  Why wouldn't it be gouging a
           hole right in under the corner of the cask?
                       MR. SHAUKAT:  That would not put such a
           heavy impact on the cask as --
                       MR. POWERS:  -- going down from under and
           it tips over.
                       MR. SHAUKAT:  If it does not hit directly,
           then it is a non-mechanistic tip over.  A non-
           mechanistic tip over, we have found that it's no
           problem.  A mechanistic tip over when it hits and tips
           over, that could be a problem.  But a non-mechanistic
           tip over that it falls down because something is
           digging here would not impose high stresses in the MPC
           to cause it to fail.
                       MR. POWERS:  What does it do to the fuel
                       MR. SHAUKAT:  We have not looked into the
           fuel inside.
                       That finishes my presentation.
                       MR. GARRICK:  Okay.  I think we'd better
           take our break now.  We've got how many more?
                       DR. KRESS:  Two or three.
                       MR. RUBIN:  Two more and then a brief
                       MR. GARRICK:  I unfortunately will not be
           here when we reconvene, but the able co-chairman here
           will take over the meeting.  But we'll take a 15
           minute recess.
                       (Off the record at 2:44 p.m. for an 18
           minute recess.)
                       DR. KRESS:  Can we get started again,
           please.  I'll turn it back to you.  Where are we?
                       MR. HACKETT:  I think what we're onto is
           moving on from what Khalid talked about and structural
           evaluation.  This is sort of the response of the cask
           as a materials and structural system to the loadings
           that he talked about.  I'm Ed Hackett and I'm
           Assistant Chief of Materials Engineering Branch.  I
           guess all I get is some of the managerial credit for
           this work.  The other two folks on here did all the
                       DR. KRESS:  Take all the credit you want.
                       MR. HACKETT:  Okay.  Thank you.  This is
           a nice piece of work.  Again, as Jack and Alan led off
           with, all this work was done in-house in MED and they
           did a very nice job.  Tanny Santos and Doug
                       Just in terms of I think Jason had the
           larger overview of this thing as a system, but what
           you're looking at with the cask is really a stainless
           structure which is a good thing from a fracture
           material response perspective because it tends to be
           a very forgiving material as regards potential for
           brittle fracture, other things we've talked with the
           ACRS about on many occasions and some other systems. 
                       So we considered three failure mechanisms: 
           fracture, limit load and then creep rupture.  Creep
           rupture obviously in response to the high temperature
           scenarios.  Limit load is really a gross section
           failure of the cask, the cask wall in that kind of
           case.  What Tanny did was to create failure models for
           those three mechanisms with an Excel spreadsheet and
           what they call this at risk add on module which
           basically performs Monte Carlo simulations on the
           material properties.  So that's the way things were
                       In terms of some more general information
           that's provided in your packages, there's really two
           scenarios that were addressed.  One is the situation
           with the mechanical accidents that's been discussed
           extensively already today.  In that case, you have
           basically the drop accidents from handling and tip
           over.  In that case, you really only have the two
           failure mechanisms which are really fracture or limit
           load failure of the cask.
                       DR. KRESS:  When you're looking for, say,
           the loads and stresses on a drop cask, I envision an
           initial contact with something.  Your forces, you've
           got momentum being offset by impulse, integral forces
           times time.  Somehow you have to get those forces out
           of this, and that depends on how things deflect and
           deform including what it lands on.
                       MR. HACKETT:  Right.
                       DR. KRESS:  Did you just neglect what it
           lands on and say it didn't deform at all?
                       MR. HACKETT:  I'll turn to Khalid for the
           detail.  I believe that's the case.  I believe it was
           assumed as a --
                       MR. SHAUKAT:  Yes.  We considered that the
           actual case is such that there is a shear wall below
           the concrete floor going diagonally in the area where
           this could fall and we considered that because of the
           presence of the shear wall, it is more rigid.  But any
           impact would have to be absorbed by the flexibility of
           the floor and the shear wall.  But we considered it as
                       MR. HACKETT:  This builds on also, Doctor
           Levenson mentioned the aircraft impact, and the crush
           of the aircraft structure was not modeled.  Probably
           the most sophisticated analyses of that sort that are
           done are the ones that are done with automobile
           crashes.  So you could do that, and there would be a
           different distribution of forces resulting from that,
           but that wasn't done, at least not yet.
                       The other side of this chart really talks
           about the thermal situation where you'd have the
           blocked vents, the cask being buried or an external
           fire that have been discussed.  There are stresses
           there.  Some discussion earlier from the internal
           pressurization from the inert atmosphere.  In that
           case, you add a failure mechanism in the form of creep
           rupture if you get the temperatures high enough to
           cause deformation of that sort.  
                       So just to run through these real quick. 
           First one is fracture mechanics which is basically
           assuming that you've got a structure with a flaw.  In
           most cases, that's a pretty good assumption.  Most
           engineering structures.  The flaw parameters.  There
           was some discussion of that earlier, and I know we
           talked to the committee extensively, at least the
           ACRS, about the flow distribution for reactor vessels. 
           For instance, in pressurized thermal shock.  We used
           the program from that also on here.  This program
           called Prodigal, which is an expert code that
           basically from weld fabrication parameters will yield
           the distribution of flaws that may be expected in that
           type of structure.  So the flaw parameters did come
           from Prodigal.  Again, that was done in-house. 
                       There were some assumptions here that were
           conservative, the assumption being that those flaws
           from the Prodigal analysis were assumed to be surface
           breaking which would be again a conservative
           assumption.  Toughness and strength properties in that
           case were also taken from the literature and were
           sampled per a Monte Carlo type routine. 
                       For the next failure mechanism limit load
           which is very often stainless structures will fail in
           a limit load fashion, and I know we've also been
           before the committee talking about a lot of examples
           of that.  Most recently, probably the control rod
           drive mechanism housings, for instance, would  likely
           fail in a limit load scenario.  They're an ostonimic
                       So really what you're saying is by the
           time you get to a limit load scenario, the structure
           is behaving like it doesn't care whether there are
           flaws there or not.  You're into gross plastic
           yielding of the structure.  In this case, we just did
           something as simple as -- or Tanny did -- looking at
           applied stress exceeding the flow stress where the
           flow stress was calculated as you see it there, taking
           into account bending and  membrane stresses so
           basically you ended up with a scenario that's
           considering sigma flow at about three-quarters of the
           combined yield and ultimate material properties.
                       Creep rupture is more complicated because
           you're now considering another dimension to the
           problem.  In addition to stress and temperature,
           you're considering the time variability of the
           properties with the temperature.
                       DR. KRESS:  You use constant temperature
           in there.   
                       MR. HACKETT:  Yes.  I know that came up. 
           I think that's the bottom bullet.  What Tanny did is
           he assumed that the initial steady state temperature
           was applied.  This say for 40 years.  It might have
           been 20.  I'm not sure.  But at any rate, that's what
           he did.  He didn't project ahead for the heat decaying
           with the decay in the fuel.  The creep rupture
           strengths were obtained from the literature.  
                       The evaluation procedure in this case is
           very much like what you do for fatigue damage.  You're
           basically using a dimensionalist parameter like
           Larson-Miller and your summing damage fractions to get
           to a creep damage.  When the sum adds up to greater
           than one, you're assuming you have a failure from
           creep rupture.
                       So that's sort of background on how it was
           done and then in terms of some results.
                       DR. KRESS:  When you use the Larson-
           Miller, doesn't that imply you're using the transient
                       MR. HACKETT:  Larson-Miller actually as
           far as the input goes, the input temperature would
           have been considered steady but it is then a transient
           case -- you're right -- in terms of the Larson-Miller
                       MR. POWERS:  Wasn't Larson-Miller's work
           done for isothermal conditions?
                       MR. HACKETT:  I don't know.  
                       MR. POWERS:  I think we have extrapolated
           it substantially in going to the transient cases.
                       MR. HACKETT:  I know Doctor Powers is
           getting into an area that was disputed when we did
           some work previously on -- Alan probably remembers
           this -- on Three Mile Island vessel where we looked at
           stress control versus strain control and there was
           some debate there also in terms of the transient case.
                       MR. POWERS:  Significant debate.
                       MR. HACKETT:  I remember some discussions
           with Doctor Rashid, for instance.
                       MR. POWERS:  I mean Rashid's contention is
           that we just don't have the really empirical data-
           based work at those kinds of temperatures and kinds of
           bi-axial stresses and things like that.
                       MR. HACKETT:  And I think you have to
           admit that's very true in terms of the data.  There's
           no question.
                       In terms of results that they achieved--
                       MR. POWERS:  Probably ought to quit
           investigating irradiated heavy section steel and start
           looking at bi-axial strain and heavy section steel.
                       MR. HACKETT:  Another level of complexity. 
                       We did look at the failure probability,
           just to share with you a few of the results here, and
           there's still some work in progress.  These slides
           show the failure probability as a function of time and
           temperature for at least two of the thermal scenarios. 
           I think Moni Dey mentioned earlier the fire duration
           was considered to be 25 minutes.  In this case, the
           conclusion was that was not long enough to cause
           failure of the MPC, so you're looking at the case of
           the fire is actually over here in the red.  You can
           get, as you can see, some very high temperatures from
           the fire and pretty much above -- I think this is
           shown above about 1,200, probably really anywhere from
           1,000 above you're transitioning from sort of a
           fracture-dominated mode to a creep-dominated mode or
           maybe even creep crack growth in between.  I think by
           the time you're up in this range, you're probably
           looking at a pure creep type behavior, at least a
           stage one or stage two creep.  Below 1000 F. you're
           probably looking at a fracture-dominated scenario.
                       For the blocked vents or the buried cask
           over on the other side in blue, you're looking at a
           situation again that's dominated by fracture or
           fracture controlled up to 1000 - 1100 F. and then
           creep control beyond there if those temperatures get
           that high.  And then you can move over to the axis to
           look at the kind of failure probability you're talking
                       DR. KRESS:  Just to give you a test,
           what's this little hump in the curve?
                       MR. HACKETT:  The one at 1120?
                       DR. KRESS:  Yes.
                       MR. HACKETT:  I would assume what's going
           on there is probably a disconnect.  At some point,
           there's not a smooth transition between those two
           types of failure mechanisms.
                       DR. KRESS:  Oh, you're right.
                       MR. HACKETT:  I don't know if it's exactly
           a step function.
                       DR. KRESS:  It's the transition between
           failure mechanism.    
                       MR. HACKETT:  Exactly.
                       MR. LEVENSON:  Is that little X that says
           1000 F. way over on the right hand side of the first
           chart, is that a point?
                       MR. HACKETT:  I'm just looking at that for
           the first time here.  I should have paid more
           attention to that.  Yes, that's right.  So that is
           just one data point and it is actually that low.  As
           I recall a conversation with Tanny, it is actually
           that low in the failure probability.
                       DR. KRESS:  Sure.
                       MR. HACKETT:  The next slide shows the
           vertical drop for the transfer cask.  In this case,
           dropped from looking at from zero to 100 feet.  I
           think it's also fair to say that this graph beyond
           about 60 feet is probably more than a bit but it's not
           exactly the most certain part of the analysis at this
           point.  I think up to 60 feet you're looking at again
           probably largely a fracture-dominated scenario with
           some aspect of limit load.  Beyond that, I'm sure
           you're probably talking probably complete crush or
           limit load gross plastic deformation of the walls.  So
           the upper part of that curve, if it is indeed correct,
           is going to be limit load-dominated, and then you can
           see the failure probabilities will go up significantly
           when you increase that drop height in terms of gross
           plastic failure of the wall.
                       And the last one we have that Khalid
           mentioned earlier was the 20 foot drop in this case
           into the overpack when it's being transferred which
           again would drop straight down into the overpack.  The
           maximum applied stress was calculated at about 11 ksi. 
           All the failures in that case would be predicted to be
           a fracture-dominated scenario if they happened at all,
           and those failure probabilities are down around the
           10-4 range.  So not a very severe situation for the
                       That's what we have to date.  There is
           some more work under way like the previous slide. 
           We're finding some of that upper area from the higher
           level drops, but that was basically the task of the
           Materials Engineering Branch was to take the loads
           that Khalid generated and apply them to the structure
           through use of finite element modeling and some
           assumptions made on the variation in the material
           properties and see what would result.  So far, I don't
           think there's any real surprises there from what we've
                       That pretty much concludes what I had to
           say.  If there aren't any questions, Jason is going to
           continue on with the consequences.
                       MR. POWERS:  You have not looked at all
           the behavior of this outer shell when it's heated in
           the engulfing fire.   
                       MR. HACKETT:  In terms of the material
           properties or --
                       MR. POWERS:  Yes.  What I'm thinking of is
           okay, you're going to heat this outer shell to 1800 F. 
           It is going to be pressurized inside.  Milt assures me
           that this is going to expand outwards.  I presume it
           will rupture.  The concrete all falls out.  Does that
           change the temperatures on the inside?
                       DR. KRESS:  Lowers them probably.
                       MR. POWERS:  Why is it going to lower
                       DR. KRESS:  Because you already got that
           temperature going up through the annulus and now
           you've changed it from a flow up to an annulus to just
           being surrounded by the temperature.  I'm guessing
           based on what I thought the analysis was.  Probably
           lowers it.
                       MR. POWERS:  Let me make sure I
           understated.  We're getting this gas from someone from
           a state where pi has the value of three.  Right?
                       DR. KRESS:  That's right.
                       MR. POWERS:  So I want to put this in
           perspective where this gas is coming from.
                       DR. KRESS:  Where road kill is legal.
                       MR. HACKETT:  I don't know how much of
           that Jason -- Jason addressed some of it earlier.  I
           don't recall the gap between the MPC and the overpack. 
           I think it's on the order of half an inch.
                       MR. SCHAPEROW:  Two and a half inches.
                       MR. HACKETT:  Two and a half inches.  
                       MR. SCHAPEROW:  It's all the way around.
                       MR. HACKETT:  I think then again these are
           things we haven't analyzed but just to respond to that
           sort of line of questioning, by the time the shell
           expanded to fill that gap two and a half inches, they
           would have to be --
                       MR. POWERS:  It's on the outside.  Bill
           tells me it's going to expand on the outside.
                       MR. HACKETT:  Right, so this is the MPC
           expanding into the overpack.
                       MR. POWERS:  No, no.  What I was thinking
           of is this overpack expands.
                       DR. KRESS:  It disappears.
                       MR. POWERS:  And presumably it breaks. 
           The concrete inside is powder at this temperature.  It
           falls out.  Engulfing fire is still going on.  Does
           that cause -- I mean it's got to happen pretty quick. 
           You haven't got a lot of time, but does it have any
                       MR. HACKETT:  As of right now, I guess
           that's an unanalyzed condition.
                       DR. KRESS:  I would just look at the heat
           transfer coefficient you get for natural convection up
           that annulus and then look at the heat transfer
           coefficient you get from natural convection around the
           thing if it were unconstrained and see how much
           different those are.  They're probably about the same.
                       MR. LEVENSON:  There's only 24 minutes of
           fire.  You probably deteriorate all that concrete.
                       MR. POWERS:  It may be since we're free to
           adjust the fire burning rate, maybe we change from the
           24 minute to the slower leak with a 44 minute fire. 
                       MR. LEVENSON:  More importantly, without
           getting into the details, I think your point, which I
           agree with, is somebody needs to look at the overpack
           which hasn't been looked at.
                       MR. HACKETT:  Yes.  Where that would have
           gotten considered would have been Jason's analysis,
           and that has not been addressed.
                       MR. SCHAPEROW:  No.  The previous project
           manager, who I understand is on sick leave right now,
           had thought of this issue.  He identified this issue,
           and I am kind of thinking that he had done something
           to resolve it, but I'm not sure.  We'll have to go
           take another look at that.
                       I'm back up here for one more shot before
           I quit.
                       DR. KRESS:  Here's where we're going to
           get a source term.  Right?
                       MR. SCHAPEROW:  Well, first I need to know
           what scenario fails the cask.
                       DR. KRESS:  Oh, okay.
                       MR. POWERS:  -- independent of that.
                       MR. SCHAPEROW:  So this is going to be a
           very, very short talk.  I just wanted to say a few
           words about the consequence assessment.  The objective
           of this work is to assess the consequences for dry
           cask storage accidents, and we intend to and we have
           been applying the MACCS reactor accident consequence
                       MR. POWERS:  Let me ask you a question
           about that.  For this particular analysis, you've got
           a cask setting out in the middle of this flat plane
           where there's there's nothing around.  I mean this is
           a completely isolated cask.  But the guy that actually
           has casks for a living, they never have that.  He has
           casks surrounded by lots of other casks.  Is there
           going to be any difference between a MACCS calculation
           and what happens when you're in a field of casks?
                       MR. SCHAPEROW:  If one cask fails and it's
           sitting in an array or a field of casks, as you
           suggest, you might expect a little more dispersion
           than if it's a single cask because you've now got the
           wind blowing past an array and so you've got a bigger
           wake than if you just had one cask.  Based on the
           limited work we've done so far, I suspect that our
           source from uncertainty is going to be much bigger. 
           I think that's where we're going to have some troubles
           with the source term.  You already suggested that
           earlier today.
                       DR. KRESS:  Let me ask you a more
           philosophical question.  I have 10 casks on the site. 
           I have a probability of failing one due to some of
           these accident sequences or cumulative frequency of
           failure and I have a source term for that cask and I
           calculate a consequence, so I've got a frequency and
           a consequence which I can convert to a risk.  Now, if
           I've got 10 casks, is my risk 10 times what I just
                       MR. SCHAPEROW:  I would expect that most
           accidents, the ones we're considering, would only
           affect one cask.  It would have to be something that
           hit all the casks at the same time.  So it would be
           very conservative to multiply it by 10.  Probably
           unwarranted to do such a thing unless what it was
           affected all of them at the same time.
                       DR. KRESS:  That's because these are mass
           stoichiastic events.
                       MR. SCHAPEROW:  There's a separation. 
           These casks are separated on the pad.  In the spent
           fuel poor or reactor, all the fuel is right there
           together, but in this situation they're separated. 
           They're in separate containers spaced with whatever
           spacing they have between them.  So it would have to
           be big enough to hit all the casks at the same time.
                       DR. KRESS:  And you can't drop all the
           casks at the same time because you're only moving one
           at a time.
                       MR. SCHAPEROW:  That's correct.  Typically
           inside the building is where they're handling it with
           a crane.
                       DR. KRESS:  I think you're right.  
                       MR. LEVENSON:  I think there's a
           philosophical question as to whether all of the
           accidents inside the building which are precursors to
           loading the cask ought to be called cask storage
           accidents because they really aren't.  I mean storage
           implies what happens when it's being used as a storage
           container and dropping the multi-purpose container
           before it's even in the cask shouldn't really be
           called a cask --
                       MR. RUBIN:  It's just part of the
           operations to get the fuel into the cask, and it's
           included in the scope of work.  I understand what
           you're saying.
                       MR. LEVENSON:  The context of the question
           is when people start adding up is cask storage safe or
           not and you've included a bunch of accidents that are
           irrelevant to the use of a cask, is dropping something
           into the pool going occur whether you do or don't use
           dry cask storage?
                       MR. RUBIN:  You have to go back to what
           the objective is from the user office as to where some
           of the priorities for looking and inspections or where
           the risks are for the dry cask storage system.
                       MR. LEVENSON:  I think all of these things
           are worth looking at, but we've got to be careful what
           we call them.         
                       MR. HACKETT:  I think that's a good point
           when you call it storage.  I think that shows how
           effective NRR was in handing this problem off to NMSS. 
           That really does fall under the category of the
           operating plant and where you make that transition.
           Interesting point.
                       MR. RYDER:  When I do my analysis, I'll be
           able to distinguish between the operations at handling
           and transfer and storage and break those out, and it
           would be up to me to communicate those various risks
           clearly and not just lump them all together as you're
                       MR. LEVENSON:  That would be fairly
                       MR. RYDER:  Yes, very much so.
                       MR. SCHAPEROW:  The approach we took was
           to use the MACCS code which we use for reactor
           accident consequences and adapt it by revising the
           input to be representative of cask accidents.  As part
           of this work, we are examining the effect of what we
           are considering to be the important parameters and
                       DR. KRESS:  Did you include some sort of
           emergency response in that MACCS code or did you just
           say there's no emergency response needed and we'll
           just look at the consequences without it?
                       MR. SCHAPEROW:  The initial calculations
           that I've done have basically left that stuff alone.
                       DR. KRESS:  Good.
                       MR. SCHAPEROW:  As a starting point for my
           calculations, I'm using a fairly well known surrey
           large early release calculations that actually come
           with the code, and I've basically left that alone.
                       DR. KRESS:  Oh, you did, so that does
           happen.  It has evacuation and some emergency response
           in it.
                       MR. SCHAPEROW:  I'm assuming emergency
           response.  We're doing this at a facility which is an
           operating reactor, so they have all that stuff in
           place.  This is a cask storage of spent fuel in dry
           casks at an operating reactor facility.  They may not
           need that.
                       DR. KRESS:  Yes, but it would never
           trigger the emergency  response protective action
           guidelines probably.
                       MR. SCHAPEROW:  That's right.  If the
           release is small enough, you would not exceed the
                       MR. LEVENSON:  How valid are the release
           fraction assumptions in that code?
                       MR. SCHAPEROW:  That's an input.  That's
           something that we've been thinking about what to put
           in for release fractions.  A lot of work was done on
           release fractions last year for transportation
           accidents by Jerry Sprung at Sandia and some others,
           and they did quite a bit of analysis to look at the
           releases of fuel finds, releases of what's considered
           volatiles, ruthenium and cesium at fuel burst
           temperature.  So they looked at a lot of that.  We'd
           like to adapt some of that where appropriate but right
           now we don't have a scenario where we're having a
           release.  So so far the stuff I'm getting from the
           level one analysts is that this is screened out and
           that's screened out.  So we've done some calculations,
           but I'm kind of in a holding pattern right now.
                       DR. KRESS:  Sort of like a pebble bed
           modular reactor.
                       MR. SCHAPEROW:  You probably have a little
           higher decay heat in one of those.
                       DR. KRESS:  I said that just for Dana's
                       MR. POWERS:  When we go through the ATWOS
           and those, we'll not only have decay heat.  We'll
           actually have power spiking events.  That'll give you
           a unique source term.
                       MR. SCHAPEROW:  Anyway, the MACCS code
           treats atmospheric transport, accumulation of dose to
           individuals off-site, and we do allow for mitigation
           or relocation and evacuation.  Based on all this, it
           performs estimates of the health effects.  Cancer
           fatalities and -- fatalities.
                       DR. KRESS:  Do you guys do that here?
                       MR. SCHAPEROW:  Pardon?
                       DR. KRESS:  Did you guys exercise MACCS
                       MR. SCHAPEROW:  Yes.  It executes in about
           a minute or so.  It's a fairly straightforward code to
           use.  In our analysis, we are trying to look at what
           may be the important parameters.  We're doing analysis
           on inventory of the fuel, release fractions, release
           start time and duration, initial plume dimensions and
           the plume heat content.  With respect to the site,
           we're also examining population densities and site
           specific weather.
                       I'd now like to briefly discuss what I
           believe are the two most important parameters in this
           analysis:  inventory and release fractions.  First I'd
           like to note that a cask does have a lower inventory
           than a reactor for two reasons, one of which is there
           are fewer assemblies in a cask than in a reactor,
           about a factor of seven less for a PWR as shown here
           and about a factor of eight less for BWR.  
                       Also, the fuel is not put in the cask
           until it is at least five years old, so we have
           opportunity for a bit of decay and, as I note here in
           the last bullet, of the 60 isotopes we normally use
           for reactor accident consequences, only 16 of those
           are still there for cask accidents.
                       MR. POWERS:  Curious nomenclature because
           they're always there.
                       MR. SCHAPEROW:  Well, at levels that would
           influence the --
                       MR. POWERS:  There's a level problem.
                       DR. KRESS:  But the half life, they're
           always there.  
                       MR. POWERS:  Every isotope.
                       MR. SCHAPEROW:  Finally, I'd like to
           mention a little bit about source term.  There are
           three important parameters that affect the source
           term.  Again, these were strongly considered and
           discussed in the work on the transportation risk
           study.  That's the fraction of the rods failing, the
           release fractions for an individual failed rod, and
           the deposition in the cask.  This concludes my
                       DR. KRESS:  Okay.
                       MR. POWERS:  When your guys come back and
           tell you, oh my god, you've analyzed this engulfing
           fire and come up with a scenario that's going to bust
           this thing wide open like an egg.  How do you handle
           the plume?  I mean it's a really funny looking plume. 
           You've got a fire plume.  Then you've got the plume of
           radionuclides coming out.
                       DR. KRESS:  Fire plume probably dominates.
                       MR. POWERS:  And you  just treat this one
           as kind of a leak into the --
                       DR. KRESS:  That's what I would do.
                       MR. LEVENSON:  Because there's no other
           source of energy.
                       MR. POWERS:  The fire plume goes out at 24
           minutes, I'm told.
                       DR. KRESS:  Then just forget it because
           I've got an on-site release.
                       MR. LEVENSON:  You've got no transport
                       DR. KRESS:  I don't think you have enough
           energy to drive it.
                       MR. POWERS:  I cracked this think open
           like an egg.
                       DR. KRESS:  And you got radioactive decay
           energy driving it?  You've got no krypton or xenon
                       MR. POWERS:  What I have is heat wave
           coming in.  
                       DR. KRESS:  Restored energy.  There would
           be a certain level of that.
                       MR. LEVENSON:  Not much.  The transport
           time through concrete is pretty damn slow.
                       DR. KRESS:  My guess is you don't have to
           worry about that end of it, but it needs looking at.
                       MR. POWERS:  Because the transport time is
           going to be dominated by the plume of liquid water,
           isn't it?
                       MR. LEVENSON:  What liquid water?
                       DR. KRESS:  In the concrete.
                       MR. POWERS:  Every time I've heated up
           concrete, the back side of it got wet with hot water.
                       DR. KRESS:  It'll do that.
                       MR. LEVENSON:  That's not rapid.  Not for
           the quantity of heat you need --
                       DR. KRESS:  -- to loft a plume.  Yes.  I
           suspect you're right.
                       MR. MARKLEY:  Mr. Ashe, you're back on
           line now.
                       MR. ASHE:  Thank you.
                       DR. KRESS:  We can't see you but you can
           see us.
                       MR. ASHE:  Well, actually I can hear you. 
           I can't see you.      
                       MR. HACKETT:  Alan had some summaries.
                       DR. KRESS:  I guess, Jason, you leave us
           to wait for developments on these three things here
           and we'll hear more about them later.
                       MR. SCHAPEROW:  It's kind of hear for me
           to do too much without a scenario.
                       DR. KRESS:  You have to have some sort of
           driving force, don't you?
                       MR. SCHAPEROW:  And I think once the
           scenario is established, then the source term is going
           to be the all important parameter for the
           consequences.  The release fractions from the cask to
           the environment are going to be critical.
                       DR. KRESS:  You plan on using the stuff
           that Jerry Sprung is developing for that?
                       MR. SCHAPEROW:  If we can reach those
           conditions.  His conditions were quite severe.  He had
           a train crash with a fire.  The train crash had up to
           120 miles an hour with a fire and also the kind of
           cask he had had a bolted lid on it so the bolts bent
           a little bit and that provided the opening for the
           fission products to come out.  This is a very thick
           weld.  I don't know how thick it is.
                       MR. HACKETT:  It's three-quarters of an
           inch on the structural lid and then there's also a
           shield lid so it's double sealed.
                       MR. SCHAPEROW:  So this is going to have
           a less severe accident impacted on it probably and it
           also seems to have a much stronger closure.
                       DR. KRESS:  Have you considered working
           backwards and saying what is my acceptance criteria
           and see what release fraction I need for that and say,
           isn't no way I can get that.
                       MR. SCHAPEROW:  We don't really have one
           for consequences.  We're going to have to do the
           combination of frequency and consequences.
                       DR. KRESS:  You're going to get a
           frequency eventually.
                       MR. SCHAPEROW:  Okay.  When we do get
           that, then we'll apply it.  If it's appropriate, we'll
           apply the consequences to that.
                       DR. KRESS:  Thanks.  
                       I guess we'll move on to you, Alan.
                       MR. RUBIN:  I'll be fairly brief in just
           wrapping this up.  what I'd like to do is you've heard
           where we are  and what we've done, and I'm going to
           just briefly tell you what we're going to be doing to
           finish up this project.  These are the items, the
           types of analyses that we're going to be doing.  You
           haven't heard about the human reliability analysis. 
           That's ongoing work.  It's looking primarily at the
           handling phase of the accident.  
                       DR. KRESS:  Question.   You're using
           ATHENA for that?
                       MR. RUBIN:  Yes.  ATHENA THERP.
                       MR. RYDER:  I think they're doing both,
           but that work is ongoing.
                       MR. RUBIN:  I think it's modeling with
                       MR. POWERS:  To quote the esteemed
           chairman of the ACRS, if you've done what you're
           advertising to be doing in that work, you will have
           wowed him.
                       DR. KRESS:  Yes.  I guess the
           advertisement was at a recent conference somewhere.
                       MR. POWERS:  It's something that was put
           out on what they were trying to do with the ATHENA.
                       MR. RUBIN:  Part of the work, there's been
           a close look at the procedures and observations during
           actual fuel loading of the cask, looking at events,
           what could be the likelihood of misloading fuel, of
           improper drying or sealing the cask or inerting the
           cask or events that could cause tip over in the fuel
           handling building or in transfer to the storage pad. 
                       We were looking at coming up with
           probabilities of cask drops, both from human errors,
           human actions as well as equipment failure, crane
           failures.  In the mechanical loads, the work that's
           continuing is looking at drop heights of greater than
           60 feet.
                       DR. KRESS:  Why is that?  Do you have to
           lift these things up that high to get them up?
                       MR. RUBIN:  There's an elevation distance
           when the track vehicle is at one elevation in the
           reactor building and the overpack is at the lower
           elevation.  There's something like a 98 foot elevation
           difference between the height and there's a shaft or
           opening where that cask is dropped.  It's lowered. 
           It's not dropped.
                       DR. KRESS:  Lowered.
                       MR. RUBIN:  Take that off the record. 
           It's lowered slowly.  This is a very slow process.
                       DR. KRESS:  Slow drum.
                       MR. RUBIN:  Slow motion lowering into the
           overpack.  One of the other mechanical loads is
           looking at a drop from the crawler which is the
           transfer vehicle to take the cask to the pad onto a
           yielding surface.  The analysis, as you've heard
           before, has been done to a rigid surface and we're
           looking at drops or most of the transfer distance is
           over asphalt or gravel.
                       DR. KRESS:  Why are you doing that?
                       MR. RUBIN:  Because we haven't got a low
           enough -- there's some probability of cask failure
           onto a yielding surface.  It's not zero, it's not 10-6
                       DR. KRESS:  You just want the number so
           you don't have such a bounding analysis.
                       MR. RUBIN:  Don't have such a bounding
           analysis and also it's going to be difficult for us. 
           We're not looking at coming up with frequencies or
           probabilities of drop of the cask from the transfer
           vehicle.  That would require a whole different kind of
           separate analysis.  So if we can eliminate this event
           from doing a more realistic analysis of the likelihood
           of failure of the cask and if it won't fail because
           it's impacting a yielding surface, then we have means
           to eliminate or screen out that sequence.
                       DR. KRESS:  I'd be interested in seeing
           that analysis because this surface, it's asphalt.  Not
           only does it yield, it flows.  That would be
           interesting.  It's a non-Newtonian fluid.  It would be
           an interesting analysis which may or may not be
                       MR. RUBIN:  But that's what we're doing
           and why.  Thermal loads.  Jason is going to be doing
           more detailed nodalization for the cask itself.
                       DR. KRESS:  And Dana would like to add one
           for you to look at the overpack.
                       MR. RUBIN:  We got that message.  The
           effect of temperatures on the overpack, the concrete,
           and we need to look at that.  There was some
           preliminary discussions, not discussions but looking
           at what the impact of higher temperatures would be on
           the overpack.  I think it was primarily though from a
           rapid heat up from lightning, not a long-term sequence
           or a 30 minute sequence from a fire.  The lightning
           was not the source, but we have not addressed that
                       MR. POWERS:  I have no idea what will
           happen, but it's one that just comes to mind that
           probably didn't take too long to go chew on.
                       MR. LEVENSON:  An early step might be to
           try to estimate the failure mode of the overpack.
                       MR. RUBIN:  To escalate the failure mode?
                       MR. LEVENSON:  To estimate.
                       MR. RUBIN:  Oh, estimate.
                       MR. LEVENSON:  Estimate the failure mode
           because that might eliminate a lot of need for various
           types of analysis.  The worse case, which I think is
           probably not credible but nevertheless, if the fire
           generates steam inside and the failure mode is an
           explosive rupture of the inner liner, it might damage
           the MPC.
                       MR. RUBIN:  We have to go back and also
           look, with the limited resources and looking at going
           back to the initiating event frequencies which you
           heard which are the aircraft impact.  If it's at 10-9
           frequency, maybe we don't spend our resources and do
           that.  It's an interesting question for sure, but
           that's something we need to determine.  But we hear
           the message but that's not part of what we looked at
           right now.  The longer term potential impacts on
           thermal loads from not drying or inerting the cask
           adequately according to the procedures.
                       There's also been some development work
           going on on looking at fuel failure models from both
           thermal and mechanical loads that you've heard about
           today.  You've heard about the mechanical and thermal
           loads.  You haven't heard about the fuel failure model
           because that work has not been done yet.
                       DR. KRESS:  Are those designed to feed
           into maybe a source term calculation?
                       MR. RUBIN:  Yes.  Rather than assuming
           it's in the transportation study 100 percent of the
           fuel has failed, if we can come up with gee, based on
           a certain drop height, for example, 50 percent of the
           fuel failed or less.  That would be where that input
           would feed into our overall source term and
           consequence analysis.
                       DR. KRESS:  Generally in the reactor area
           we would have looked upon the difference between 100
           percent and 50 percent as not worth worrying about,
           but if it's a way to look at what the fuel looks like
           in order to estimate a source term from all the fuel,
           assuming all of it looks like that, then it's a
           different story.
                       MR. RUBIN:  We're going to see if we can
           do a little more than what was done in the
           transportation study in this area.
                       DR. KRESS:  It might be useful.
                       MR. RUBIN:  We don't have a train car
           impacting on this cask.  The cask is also surrounded
           by two and a half feet thick concrete.
                       One of the things we didn't talk about I
           just wanted to mention that's also going on is an
           accident during fuel handling.  If the cask were to
           tip over and the lid were not sealed and you had a
           spill and release of radioactivity in the reactor
           building, then typically normally you would have
           secondary containment isolation.  But we're looking at
           what the probability would be given that sequence.  If
           the HVAC ventilation system is not isolated and
           normally you would then initiate the stand-by gas
           treatment system and vent through a charcoal filter
           and if that failed also.  So that's the sequence that
           we'd be looking ta in the fuel handling building,
           looking at both the probability of failure to isolate
           secondary containment as well as decontamination
           factors that could affect the source term.
                       DR. KRESS:  Is this a manual isolation
           because I can't see any other way that sets it off?
                       MR. RUBIN:  I think with the radiation
           trip, I think there's a signal on radiation.
                       DR. KRESS:  I don't know if you're ever
           going to get that high from this accident.
                       MR. RUBIN:  But it's part of trying to be
           complete in our analysis so we don't over-estimate the
           consequences from this and, of course, you've heard
           the work on source term consequences will be going on. 
           Once we have all these pieces, we will be able to
           finally complete the PRA model and run it to look at
           where we're getting the overall risk.
                       DR. KRESS:  I'll tell you what the answer
           is going to be.  Focus on the handling.
                       MR. RUBIN:  I think that was my
           inclination from the beginning.  
                       MR. LEVENSON:  Tom, you could get there if
           this plane crashes into the handling building and you
           get the fire and the operator is so nervous he then
           drops the cask from 80 feet into the fire.  You might
           get a release.
                       DR. KRESS:  You're right.
                       MR. RUBIN:  There's not a cask always
           being lifted, by the way.  It's only a once in a while
           event.  So that's the work that needs to be done to
           finish this.  I'll call it the screening study.  As I
           mentioned earlier, we'll have a draft report in the
           June 2002 time frame which will then undergo a peer
           review.  If there's any need for additional analysis,
           it will be determined at that time and we will issue
           a final report.  And we hope to be back to you again
           when we have results and this draft report.  We'll let
           you know what we found.
                       MR. POWERS:  When you began this
           presentation, you indicated that you had not
           considered flaws in the fabrication of the casks.
                       MR. RUBIN:  Other than flaw distribution,
           for example, that you heard about.  Yes.  It's
           supposed to be two and a half inch gap or the concrete
           or steel wall is supposed to be half inch thick and if
           it's the wrong dimensions or something else, those are
           not part of it.
                       MR. POWERS:  In light of the relatively
           low probabilities that you're getting for all these
           things that you've looked at so far as far as the
           storage, doesn't that cause you pause to think well,
           maybe I better go look at the flaws in manufacture now
           as the quasi-initiating event?
                       MR. RUBIN:  As far as the dry cask, that
           could be.  First we want to finish up the handling and
           transfer phase to look at where the impact of human
           reliability is.  It's a question of how far do you go
           in terms of looking at the really fine detailed
           analysis of the dry cask system when you have the
           whole fuel cycle.  How much resources do we want to
           spend on this?  That's probably a decision to be made
           I think in conjunction with the Office of Research and
           NMSS if we go further along those lines.
                       DR. KRESS:  Generally, risk acceptance
           criteria end up having a time at risk in it.  You're
           assuming how long for these casks for just the dry
           storage part?  How long are they going to sit there? 
           Have you got a number for that and does that factor
           into your risk assessment at all?
                       MR. RUBIN:  Well, there's going to be risk
           during the handling and transfer phase.
                       DR. KRESS:  I'm forgetting about that.
                       MR. RUBIN:  It's an annual per reactor per
           year basis.
                       DR. KRESS:  It's on a per year basis.
                       MR. RUBIN:  Yes.
                       DR. KRESS:  But you're going to say this
           is acceptable based on some number or some criteria. 
           My criteria would have said how long is it at risk?
                       MR. RUBIN:  I think you heard this morning
           some discussion of work going on in NMSS on developing
           safety goals.
                       DR. KRESS:  That would be part of your
           safety goal.  That's right.
                       MR. RUBIN:  When we started the study and
           still there are no safety goals that we have to say
           okay, this is a low enough number or a good enough
           number.  That's something we're going to be working
           closely with NMSS.
                       DR. KRESS:  That's another aspect.  Right
           now we're just getting what the number is.
                       MR. RUBIN:  Correct.  Whether that number
           is below a certain value so you can say it's okay,
           that piece is not part of the study  but it's being
           done separately.
                       DR. KRESS:  I understand.
                       MR. RUBIN:  I think you heard about some
           of that this morning.
                       DR. KRESS:  So we will consider this part
           a briefing of the status.  You don't need any more
           feedback from us.
                       MR. RUBIN:  Other than the comments we got
           which were helpful during the meeting.  We're not
           looking for any written comments from the committee.
                       MR. POWERS:  I think I offer one comment. 
           You just have to be awfully impressed about the
           horsepower of the team that they put together for
                       DR. KRESS:  Yes, and I also offer the
           comment that this was a worthwhile effort.  
                       MR. POWERS:  It's a worthwhile effort and
           it seems to be being done awfully well by a very
           competent group of individuals.
                       DR. KRESS:  I think those are both good
           comments, and we appreciate the briefing.
                       MR. RUBIN:  It's nice to hear those kind
           of comments.
                       MR. POWERS:  I don't know that they get
           said enough because we've had some people making
           comments about the capabilities of research and the
           staff and what not and they ought to sit in on some of
           these things and see what's going on.  Maybe it would
           change their mind a little bit.
                       MR. LEVENSON:  Maybe if there's marginal
           reasons for writing a letter, it might be worth doing
           just so it could incorporate a comment like that
           because otherwise it doesn't get anywhere.
                       MR. POWERS:  I think we target this June
           report.  Bear in mind that we do that because I mean
           you and I are familiar with some of these comments
           that we took a little umbrage at and this just gives
           us a little more ammunition.
                       DR. KRESS:  Sure does.
                       MR. RUBIN:  And I think you're saying that
           the Office of Research is getting involved more in
           areas in addition to reactors which we've been
           involved in for many years in supporting NMSS
           activities, and this is a high priority task for the
           Research Office.  It really is.  We've put the
           resources and the manpower on it and think it's going
                       DR. KRESS:  So are there any additional
           comments from anybody?  If not, I'm going to declare
           this meeting adjourned.
                       MR. MARKLEY:  Tom, I'd suggest if you
           wanted to pass around or ask for comments or see if
           the staff had any other remarks.  Some of the earlier
           presenters, if they wanted to say anything.
                       DR. KRESS:  I thought I did that.  I
           didn't see any hands raised when I looked around.
                       MR. MARKLEY:  Lawrence.
                       DR. KRESS:  I didn't look far enough, I
                       MR. KOKAIKO:  Good afternoon.  Our
           presentation this morning by the Risk Task Group on
           the Risk Task Group activities to date as well as some
           of the work that we are doing on safety goals.  If you
           had any feedback, we would like to hear from you on
                       DR. KRESS:  Our intention is for the
           subcommittee to get together and see if we can come up
           with some sort of letter on that one to give you some
                       MR. KOKAIKO:  I appreciate that.
                       DR. KRESS:  We haven't decided what that
           is yet.  We haven't gotten together, but we might have
           a letter on that.
                       MR. KOKAIKO:  I appreciate it.  Thank you
           very much.
                       DR. KRESS:  With that, I'll declare the
           meeting adjourned again.
                       (Whereupon, the meeting was adjourned at
           3:52 p.m.)
Page Last Reviewed/Updated Wednesday, February 12, 2014