ACRS Meeting on Fire Protection - January 21, 1999
UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
ACRS MEETING ON FIRE PROTECTION
***
U.S. Nuclear Regulatory Commission
11545 Rockville Pike
Room T-2B3
Rockville, Maryland
Thursday, January 21, 1999
The above-entitled meeting commenced, pursuant to notice, at
8:35 a.m.
MEMBERS PRESENT:
DANA POWERS, Chairperson, ACRS
GEORGE APOSTOLAKIS, Member, ACRS
THOMAS KRESS, Member, ACRS
DON MILLER, Member, ACRS
. P R O C E E D I N G S
[8:35 a.m.]
DR. POWERS: We will come back into session.
This is the continuation of the meeting of the ACRS
Subcommittee on Fire Protection. I'm still Dana Powers, Chairman of the
subcommittee.
ACRS members that are in attendance consist of me right now,
but two stragglers have staggered in here, wind blown and disheveled,
and I'm assured that a Fed incontent Professor Apostalakis will join us
shortly.
The purpose of this meeting is for the subcommittee to
review reactor fire protection activities, to gather information,
analyze relevant issues and facts, and formulate proposed positions and
actions as appropriate for deliberation by the full committee.
This morning we are going to continue our discussion of the
NFPA 805 fire protection standard and then pursue discussions of
research activities in the area of fire protection, status of insights
of fire protection derived from the IPEEE reviews, and we will conclude
by a discussion of what things we think should be brought forward to the
full committee and when.
I think we've got a couple of candidates for the February
meeting in the form of the 805 and the regulatory guide and possibly
something for the March meeting in connection with the FPFI program, but
we'll have an opportunity to discuss that at the close of the meeting.
We do have a pretty firm closure time for this meeting,
simply because there's one that immediately follows us, and they are
charitable fellows, but they might not appreciate having fire protection
intruding into the activities. I can't understand why, but.
DR. MILLER: We have to have our priorities right.
DR. POWERS: We might have to do some educational efforts
there.
I'd like to proceed ahead now. Ed Connell, without the
benefit of the discussions we had at the close of yesterday's meeting,
is going to offer his views, as a representative of the staff,
concerning the NFPA 805.
Ed?
MR. CONNELL: Good morning. Thank you, Dr. Powers. I'm
still me, just like I was yesterday. Happy to be here again.
I'll cover quickly a little background. Again, this effort
resulted from a staff recommendation in SECY 98-958, where we proposed
to defer the rule-making and work with NFP and industry to develop
performance-based risk-informed consensus standard for nuclear power
plants.
Industry has indicated their support for this effort in
their May 5 letter to the Chairman. The end of June, the Commission
approved the staff proposal and in October of last year, we provided the
Commission with an update on the status of the NFPA activities, the
assessment of progress and direction, and the resolution of the ten
potential issues from 97-127.
Some of this may be a little bit duplicative of what you saw
yesterday, so we'll go through kind of quickly. The structure of 805,
you have goals, which are high level, not quantifiable, have "motherhood
and apple pie" statements.
Performance objectives which are measurable, but more
qualitative than quantitative; performance criteria, which are
quantitative, expressed in engineering terms, temperative, K effective,
kilowatts.
Then within the performance -- to meet the performance
criteria the way it's structured now is you can select either the
deterministic approach, basically the existing Appendix R type approach,
or a performance-based approach and there will be some methods in
Appendix B of the standard, which are currently being worked on.
To top this all off, we have a site-wide risk evaluation to
kind of see how well the program does from an global perspective.
DR. POWERS: The goals that you set for yourself certainly
include things that can be related to CDF and LERF and things like that
and traditional measures that appear in risk analyses.
They also include things that don't appear in usual risk
analyses, life safety and whatnot.
In your view of this site-wide risk evaluation, do you see
some modification of the risk assessment to include these other
measures?
MR. CONNELL: Yes.
DR. POWERS: And how would that be done?
MR. CONNELL: That's what we're working on. As you notice,
that is not in the current draft of the standard. That material will be
included in Appendix B of the standard, in a future draft.
I have kind of a graphic here to give you an idea of the way
I see it being structured right now. You have the baseline fire
protection program, which is the foundation, not subject to risk
insights, not subject to performance-based approaches, mostly because
the things that are in the baseline program do not lend themselves well
to this sort of analytical tool, and I will go through what some of
those things are.
Then the second part of the pyramid is where you're meeting
the performance criteria and you have the choice of using a
deterministic approach or performance-based approach, and that can move
either way. You could have some deterministic, some performance-based,
all deterministic or all performance-based, and that will be a
flexibility to the licensee that implements this.
Then over on the top of all that you'll have a site-wide
risk evaluation, which we view as an enhancement of the existing IPEEEs
to kind of assess how you did in developing your fire protection
program.
DR. POWERS: If we look at the flowchart that you have in
the document itself.
MR. CONNELL: Yes.
DR. POWERS: It shows you going down, first, to a box that
says what you call your base fire protection program, which is a series
of, in some cases, very deterministic sorts of things; in other cases,
somewhat less explicitly deterministic.
Then you come down and you go into this selection. Then
once you're through with that, you come down to this site-wide risk
evaluation, which is cast as a means to see if you need to add
additional requirements or be more scrupulous in your meeting of the
requirements.
It is not obvious one can use the risk analysis to come away
and say, gee, I didn't need lots of those things that I did either in
the baseline fire protection program or in this selection between the
deterministic and the performance-based.
MR. CONNELL: The intent is that the risk insights would not
be used to delete things from the baseline program. Risk information
can be used as part of the performance-based approach. That's fairly
clear in the way the standard is structured right now.
But, no, the intent was -- and, of course, we're still
working on it. We're talking about a draft -- was that the base line
program would not be subject to deterioration due to risk information,
because the things that we put in the baseline program we don't believe
lend themselves well to analytical approaches to remove them.
They're basic, good industrial fire protection engineering
practices that you would have at any industrial facility, not just a
nuclear plant.
DR. POWERS: I mean, there are some that are a little bit
surprising when you say that. I can pull out things in which it says,
well, you'll have a fire standpipe every 76 meters, not 75, not 74, 76.
MR. CONNELL: And it doesn't say that. It says you'll have
a standpipe in accordance with NFPA 14.
DR. POWERS: No. It says specifically 76 meters. I pulled
it out yesterday and read it. This is in the baseline program and it's
hard to believe that that's not susceptible to some sort of engineering
analysis.
MR. CONNELL: I don't see how you can -- if you're going to
bank everything on performance-based approach, we had this discussion
before, you've got to have something to fall back on in case your
analysis is in error or something unforeseen shows up, and that's why we
have the baseline program.
We have that manual suppression capability. Your fire model
is inaccurate or if the combustibles that you assumed were there, one
day the combustibles are ten or a hundred times the heat release,
potential heat release of what you analyzed, or the fire frequency that
you thought was so tremendously low turns out to be incorrect.
So to me, that provides the defense-in-depth and the margin
of safety which you do not get with a strictly performance-based
approach.
MR. MARSH: Ed, let me ask a question that came up yesterday
a little bit, maybe it's a different kind of a spin. If you did the
site-wide PSA and you found out that one of your baseline requirements
was insufficient; in other words, for some reason, some vulnerability
showed up that showed that you need more on your fire brigade or you
needed to have hose stations that were more frequent than the standard
would recommend, is there a proviso to enhance the baseline program
because of those findings?
MR. CONNELL: Yes. Yes. The site-wide risk evaluation
looks at the entire fire protection program, including the baseline, and
if, based on some risk insights, you need to make enhancements to your
program, then you need to do that.
DR. POWERS: The concern oft expressed yesterday is, in
fact, that's the way it is, that the risk analysis only allows you go
one way.
MR. CONNELL: Well, that's not true.
DR. POWERS: Well, it's certainly the way that the flowchart
is written.
MR. CONNELL: Let's look at my pyramid again.
DR. POWERS: Your pyramid, of course, does not appear in the
document.
MR. CONNELL: No. I've been involved with the development
of the standard for about a year and a half now, I've been to all the
meetings, and I'm one of the substantial contributors to the text that
you have before you.
Risk information and -- you could look in Section 2.7 of the
standard and look at the PSA evaluation of specific areas, zones and
features, and you can use the PSA to determine whether the fire
protection features are adequate to ensure the risk to the general
public is low.
So you can use risk information as part of the
performance-based approach for those things that you would put in above
and beyond the baseline program; things like fire barriers, thermal lag
type barriers; things like automatic suppression systems in
safety-related areas, other things.
So risk information can be used to relax from the current
deterministic criteria that you find in Appendix R.
MR. MARSH: I think Dr. Powers was headed towards the
baseline program, too, were you not? You were questioning whether the
site-wide PSA --
DR. POWERS: I was starting slowly.
MR. CONNELL: Yes, but the thinking of the committee right
now is that risk information would not be used to reduce the baseline,
which is the basic industrial fire protection level. Another
consideration is that, don't forget, the insurance company has to agree
to licensees implementing this program, as well, and the insurance
companies are not going to allow their insured to reduce their baseline
program either.
So this is a fact of life. The NRC is not the only agency
that is involved in the fire protection at these plants.
DR. POWERS: But it is the agency that looks for the
opportunity to put this standard in as a matter of law.
MR. CONNELL: As an alternative.
DR. POWERS: As an alternative to existing regulations. And
how does the agency propose to distinguish between those things that are
essential to its mission and those things that the insurance agency
institutions feel are essential for their financial viability, which is
not part of the agency's mission?
MR. CONNELL: Right. That's my next slide here. You can
see that typical with all the NFPA standards, it is a comprehensive fire
protection document. It is not just satisfying the areas of regulatory
concern and authority of the NRC.
It goes beyond that. It addresses life safety issues, which
this agency typically has not provided a lot of regulatory guidance and
enforcement on. It also addresses economic loss, which is something the
insurance carriers -- we have members of the nuclear insurance pool on
the committee.
So that the standard is comprehensive and the hope would be
that if a licensee would adopt this, a plant operator would adopt this,
it could satisfy both the NRC's requirements, as well as the insurance
carrier's requirements. So that's why it is a comprehensive standard.
DR. APOSTOLAKIS: I have a couple questions on the goals.
The nuclear safety objectives are reactivity control and fuel cooling,
that's on page four of the standard.
MR. CONNELL: Yes.
DR. APOSTOLAKIS: Radioactive release objective is in terms
of probabilities and societal risks. But the life safety objectives are
in terms of prevent loss of life and so on. Why aren't these
probabilistic?
MR. CONNELL: Because that's not the NFPA's approach in NFPA
101, which is the life safety code, that's provided for most building
authorities. Some of those objectives would not be within the scope of
NRC jurisdiction.
DR. APOSTOLAKIS: They are not, I agree, but it seems to me
that it will be very hard to show with certainty that you can provide
safe egress.
MR. CONNELL: Those are objectives. Those are not the
criteria. Remember, the objectives are more qualitative than the
criteria themselves, where we can talk specifically about carbon
monoxide concentration, flux to the exposed skin, egress times, things
like that which are more quantifiable. That would be a
performance-based approach, but not a risk-based one.
DR. APOSTOLAKIS: But what I'm saying is it would be
probably easier to show that the probability of safe egress is low
rather than showing that you do have safe egress. See, the
deterministic proof is always more difficult, unless, of course, you do
it by fiat. You say if you show this, then you have safe egress.
Now, that's not part of the NRC, so we don't care about it.
MR. CONNELL: Okay.
DR. APOSTOLAKIS: Now, radioactive release objective.
MR. CONNELL: Yes.
DR. APOSTOLAKIS: First of all, does this include releases
from the core?
MR. CONNELL: No.
DR. APOSTOLAKIS: That should be made very clear.
MR. CONNELL: I thought that we were clear that the nuclear
safety objectives related to reactor fuel, wherever it may be, and the
radioactive release objectives were for radioactive release other than
reactor fuel. But if it's not clear, then we need to --
DR. APOSTOLAKIS: It's not clear to me.
MR. CONNELL: -- we need to tighten that up, because that's
clearly the intent.
DR. APOSTOLAKIS: Okay. Now, on the next page, actually,
there is a hint that that's true, because it's it says the performance
criteria with respect to release, radiation release caused directly by
fire or fire suppression activities, but not involving fuel damage,
shall be within the limits of 10 CFR 20.
Now, fuel, you mean anywhere?
MR. CONNELL: Yes.
DR. APOSTOLAKIS: Including the spent fuel pond.
MR. CONNELL: Yes. The nuclear safety criteria is for
reactor fuel, wherever it is, in the spent fuel pool, if it's being in
dry storage, if it's on the truck getting delivered to the site, or in
the reactor vessel.
DR. APOSTOLAKIS: I see. Okay.
MR. CONNELL: Which is beyond what we currently have
deterministic criteria for.
DR. APOSTOLAKIS: So if we look at the nuclear safety
objectives, then, you're talking about reactivity control capable of
rapidly achieving and maintaining shutdown reactivity conditions and
fuel cooling capable of achieving and maintaining decay heat removal and
inventory control functions.
So in essence, then, what you are doing here is you are
looking at the shutdown, obviously, reactivity control, and then the
cooling function. So that would include the safety systems, the
emergency safety systems.
MR. CONNELL: It could potentially. What the standard is
intended to do is allow the implementer the flexibility to choose the
systems that they want to meet those criteria and objectives.
It may be a safety system, it may be another system.
DR. APOSTOLAKIS: So the nuclear safety goal is provide
reasonable assurance that the fire will not result in nuclear fuel
damage and then what I just read were the performance objectives.
MR. CONNELL: The performance criteria.
DR. APOSTOLAKIS: Well, it says performance objectives here
on page four.
MR. CONNELL: Okay. Okay. Okay.
DR. APOSTOLAKIS: Now, that raises a question. Why, when
are dealing with fires, we have to worry about fuel damage or achieving
and maintaining shutdown reactivity conditions and when the Commission
issues safety goals, the Commission talks about very high level goals,
like the individual risk and so on.
MR. CONNELL: Okay.
DR. APOSTOLAKIS: Which is supplemented by principals of
defense-in-depth. I mean, the Commission obviously does not regulate
based on those -- in fact, it doesn't regulate using those at all, but
there is a statement from the Commission that individual risk should be
one tenth of one percent and so on.
Why isn't your nuclear safety objective then stated in
similar terms and then as an implementation of defense-in-depth, you may
want to go down to more detailed events.
MR. CONNELL: It could be. Don't forget, this is intended,
if it's adopted by the staff, to be a requirement, whereas, of course,
the safety goals are more of a policy type statement.
I believe that if we do this, we will be meeting that
policy.
DR. APOSTOLAKIS: And I agree with you, because this is more
stringent.
MR. CONNELL: But it's also something that you can sink your
teeth into, whereas the safety goals, by themselves, don't mean a whole
lot.
DR. APOSTOLAKIS: But that's the thing, now. I'm under the
impression that the move over the last three years in this agency has
been toward less intrusive regulation and that's why we have the safety
goals and then we'll go down, because you're absolutely right, you
cannot really regulate with such high level criteria.
But the question is how far down do you go, because to get
to individual risk, you have to have a level three PRA; now we worry
about core damage frequency, which is level one; then we put something
from level two, which is LERF.
So far, 1.174, for example, is based on those, too. It
doesn't really go down to details such as achieving safe shutdown. Now,
that I'm sure we still regulate because there is defense-in-depth and so
on.
But here your goal is really very detailed. You really
don't want the fuel to be damaged.
MR. CONNELL: You mean the objective?
DR. APOSTOLAKIS: Yes, the objective. I'm sorry. The
objective. Well, even the goal. The goal says provide reasonable
assurance that a fire will not result in nuclear fuel damage.
MR. CONNELL: I don't see how that's significantly different
from the policy safety goals.
DR. APOSTOLAKIS: The policy safety goals say that even if
there is fuel damage, the individual risk should be below one tenth of
one percent of all other risks.
MR. CONNELL: Right, for design basis accident, which fire
is not. Fire is an anticipated operational occurrence.
DR. APOSTOLAKIS: I don't think that the safety goals refer
to design basis.
DR. KRESS: Not in any sense at all.
DR. APOSTOLAKIS: No. It's total.
DR. KRESS: It's total, and that's the problem. It's total,
and this is only fire. That's one of the problems. It's referring to
only the fire sequence.
DR. APOSTOLAKIS: That's right. But my concern, Tom, is
that we have this big umbrella of the safety goals, plus everything
else, the principles and so on. Now, when we study or when we develop
standards for individual initiators, shall we try to be a little
consistent with the goals of the Commission or set our own criteria?
DR. KRESS: You run into a real problem there because you
have to -- that's an apportionment of the risk among the sequences and
that gives you a difficulty.
DR. APOSTOLAKIS: I understand that, but you don't really
have to say that the fire contribution has to be 12 percent. You don't
have to say that.
MR. CONNELL: And we don't say that in here.
DR. APOSTOLAKIS: I know you don't say that, although
somewhere in the big chart it says is the risk acceptable. So somehow
you have to make a judgment there that the risk from fire is acceptable.
But that's a different issue.
MR. CONNELL: Sure.
DR. APOSTOLAKIS: The issue here is -- so okay. Then I go
to earthquakes and maybe then I will say there I don't want to site the
reactor anywhere where the peak horizontal ground acceleration is
greater than .6g. Why? Because I'm earthquake expert and that's how I
think.
Now, how that is related to the Commission goals is not
obvious. Then somebody else says, well, gee, now we have a discipline
of human error and we don't want to have this and that.
My concern is that we may find ourselves in a situation
where for individual initiators, we have different objectives which may
not be -- actually, that will not be consistent with the top goals that
the Commission has set.
So I would rather see a top-down approach that starts with
the Commission's goals and I admit there will be difficulties on the
way. I mean, don't think that I think it's a trivial exercise. But go
down and maybe -- I mean, if the Commission says that the individual
risk should be acceptably low, that should be reflected at least where
we talk about goals here. Right?
Now, practically, I agree with that. You can't really do
much with that.
DR. KRESS: I've wrestled with that question just a little
bit. The problem I have is in priority with the goals, that that's an
integration overall sequence.
DR. APOSTOLAKIS: Sure.
DR. KRESS: Then when you want to talk about regulating
individual sequences or sets of sequences like this, the question is how
do you decide which part of this goal you're going to apportion to a
specific sequence.
Well, the rational way to do that is to pick out an
apportion of it, if there is such a thing, and minimizes your
uncertainty in the overall answer.
That technology doesn't exist yet and that's the problem.
DR. APOSTOLAKIS: The British said one tenth.
DR. KRESS: And then you can arbitrarily decide.
DR. APOSTOLAKIS: It's a policy issue, of course.
DR. KRESS: Yes. Like all goals, you can arbitrarily decide
what they ought to be.
DR. APOSTOLAKIS: Exactly. Exactly. Anyway, I think that
the committee should think a little bit about it, making this -- using
the language of the Commission and recognizing the difficulties.
Again, I don't want to --
MR. CONNELL: I agree that there should be a link between
what this standard does and the policy statement of the Commission. I
thought we had that. I think that if you meet these criteria and
objectives, you're meeting the policy safety goals.
DR. APOSTOLAKIS: That's correct.
MR. CONNELL: But if we weren't doing that, then that would
be a big problem and we'd need to fix that.
DR. APOSTOLAKIS: It's the other way that concerns me. Can
you meet the Commission's goals without being as stringent as you are?
MR. CONNELL: I don't know if I can inspect an enforce if I
don't have something more specific.
DR. APOSTOLAKIS: You have to have something more specific.
The question is how do you produce that specific.
MR. CONNELL: This is our attempt.
DR. APOSTOLAKIS: I'm just giving you a third party's view.
You can start from the top, from the Commission's goals, and work your
way back to where you want to go.
Now, for example, it's not obvious to me that you have to
have separate goals for the fuel damage and separate for the safety
functions. Your top level goal might be a combination. And then in the
name of defense-in-depth, you may want to say a few things more about
how you apportion that. But you are working from the top down.
MR. CONNELL: Right.
DR. APOSTOLAKIS: You are right. If you meet what you have
here, you will certainly meet the Commission's goals, but that's not my
concern. My concern is, is there any way that I could meet the
Commission's goals by relaxing your requirements and unless I think
top-down, I will never ask that question.
Again, you don't have to answer it right now.
MR. CONNELL: Okay. I'll think about it.
DR. APOSTOLAKIS: You're just getting input from the
meeting.
MR. CONNELL: Okay. And I appreciate that.
DR. APOSTOLAKIS: Now, there's more.
MR. CONNELL: Okay. Go ahead. Fire away.
DR. APOSTOLAKIS: If I go to page 15 -- I don't know if you
plan to go into more detail here, but it's related to the goals. I see
a step one, for example. There is a figure 2-3 that says on the left,
identify fire protection objectives.
I guess you will also have to hand out a magnifying glass
when you give a copy of the report.
MR. CONNELL: Yes, well, the graphics -- this is a draft.
DR. APOSTOLAKIS: I understand. So in the final report, it
will be larger.
MR. CONNELL: We'll improve that, yes.
DR. APOSTOLAKIS: Okay. It says equipment to protect; e.g.,
from nuclear safety analysis. Now, I'm wondering how you define the
equipment you will protect, because in the first 14 pages, I couldn't
find the way.
How do I go, in other words, from what you just told me as a
performance objective that you want to be capable of achieving and
maintaining decay heat removal and inventory control functions, how do
you go from the functions to the equipment that you have to protect, or
are we skipping that step and we go back to the equipment that we know
now we have to protect?
MR. CONNELL: No. No. The intent was to allow flexibility
that the plant could select the equipment and it may be more diverse
than what we currently have. Right now, we basically are addressing one
division and we protect one division and say that's it, whereas the
IPEEEs and the IPEs have indicated that, well, you may have more
diversity equipment that you can credit, it may not be safety-related
equipment, that you could use for meeting the same criteria.
As long as it meets the criteria, and we think that's where
the risk comes in, you look at the availability and reliability of those
systems, as long as it meets the criteria, maintaining the fuel design
limits, maintaining reactivity control, you can select whatever
equipment that you choose.
So that allows licensees flexibility; instead of saying,
well, you have to have this, now you may be able to select a few
systems.
DR. APOSTOLAKIS: I agree with what you just said. I guess
my point is then that this is not very clear.
MR. CONNELL: A lot of that information, I think it will be
in the appendix. The way the standard is structured is clear
requirements are in the body and in guidance on implementation, which
are not necessarily requirements, they're just one method of meeting it,
is in the appendix. There's a lot of other stuff that's going into the
appendix on risk assessment and fire modeling and things and I've got a
little bit to show you later on.
DR. APOSTOLAKIS: Okay.
MR. CONNELL: Any others? I think I covered that. We kind
of talked about objectives already.
DR. APOSTOLAKIS: So since you have it there, will you put
that up?
MR. CONNELL: Sure.
DR. APOSTOLAKIS: Maybe the whole --
MR. CONNELL: I'm sorry.
DR. APOSTOLAKIS: I guess another way of saying what I was
just saying earlier is to take the two bullets you have under your
radiological release and put them up there under nuclear safety, as
well.
I mean, the Commission is talking in terms of risks to life,
health and safety, right?
MR. CONNELL: Right. That would be one approach. I'm not
sure that we want to make that jump, but we'll consider it. Then these
are the ones, of course, some of them will not be under the NRC's
purview. Of course, the third bullet under life safety and the fourth
bullet will be, to some extent.
And then the real meat is in the performance criteria and
basically these are attained from the general design criteria, ten and
34, and the standard tech specs for nuclear safety, and then, of course,
Part 20 for radioactive release, treating fires that are not related to
the reactor fuel as anticipated operational occurrences, trying to
minimize like a rad waste building or some truck that's carrying waste.
And then the life safety approach is pretty much dictated by
the way NFPA 101 committee is addressing it, where it's a scenario based
approach, looking at egress time versus incapacitation time of the
occupants. This is where you have carbon monoxide concentration,
radiant heat flux to the skin, light obscuration, can people see to get
out, things like that, typical issues with life safety, and that will be
part of the standard. But it will basically follow what the 101 life
safety committee is working on and then the plant damage business
interruption is basically the insurance part that the NRC won't have any
direct regulatory authority on.
DR. APOSTOLAKIS: Now, now now.
DR. KRESS: Go ahead.
DR. APOSTOLAKIS: Fuel cooling design limits not exceeded.
MR. CONNELL: Yes.
DR. APOSTOLAKIS: Again, this is a sufficient condition for
meeting your performance objective of being capable of achieving and
maintaining decay heat removal. I agree with that.
But, again, it seems to me that as you go down from the
goals or the objectives to the criteria, you give more restrictive
conditions. For example, let's say that in my plant, according to what
you said earlier regarding the equipment, I have identified, under
certain accident conditions, four different ways of cooling the core.
MR. CONNELL: Certain accident conditions or fire
conditions?
DR. APOSTOLAKIS: Fire. Fire.
MR. CONNELL: Okay. Because they're different.
DR. APOSTOLAKIS: I'm sorry. Four different ways of doing
it, four different scenarios. They may share some equipment, but they
also have something different. And to make it more interesting, in one
of them, there is also human intervention.
And then I do my calculations and I come up with a
probability of failing to cool the core of ten-to-the -- frequency,
frequency of ten-to-the-minus-nine per year, which means there is a
frequency of ten-to-the-minus-nine per year that, in fact, will fail to
cool the core, which means I have clearly exceeded my design limits.
According to this, this is not acceptable, because there is
a probability of exceeding the design limits.
DR. KRESS: You just asked the question I was going to ask.
DR. APOSTOLAKIS: Sorry, Tom.
DR. KRESS: Thank you for putting it well.
DR. APOSTOLAKIS: So you are interpreting the word capable,
which you had in your objectives, as meaning design limits not exceeded.
I would take a more relaxed approach and say capable means that there is
a sufficiently low probability of not exceeding the limits. I guess I
said it right.
DR. KRESS: The only way you can get around that, it seems
to me, is if you select, once again, certain design basis accidents
related to fire and specify what those are, then say for these, this is
the result you have.
That's the only way I see to get around it to have this kind
of -- you have to have something more than this to do it, because this
is a probabilistic world we live in.
MR. CONNELL: And I don't know if this will satisfy it, but
if you look at 171, we do say fire protection features shall be capable
of providing reasonable assurance that the plant is not placed in an
unrecoverable condition. Then we list those specific measurable
criteria. The intent here was to have something that could be measured.
That's why we have those performance criteria.
DR. APOSTOLAKIS: The problem, though, is with --
MR. CONNELL: This way, we knew the systems have that
capability. If you have a system that's not capable of maintaining the
fuel design limits, then that's not a good system to put in your bag of
tricks.
DR. APOSTOLAKIS: What do you mean by it's not capable?
MR. CONNELL: If it doesn't have adequate flow or pressure
or it doesn't have the heat removal capability, there's lots of
engineering reasons why one system would not be adequate.
MR. MARSH: I don't think he's talking from a reliability
standpoint. He's talking about a design standpoint.
MR. CONNELL: Yes. Just the engineering design.
DR. APOSTOLAKIS: For design purposes, you're absolutely
right.
DR. KRESS: That would seem to be taken for granted.
DR. APOSTOLAKIS: Yes, that's taken for granted. Of course,
you have to make sure that the system --
MR. CONNELL: Well, it would be nice if it was taken for
granted. Some of the reviews that we've done show that's not
necessarily the case; that some of the systems that have been protected
are not capable of meeting those.
So we need to have this somehow, and then the risk
evaluation should address what you're talking bout.
DR. APOSTOLAKIS: But then it should be very clear in the
standard that that's what we're talking about.
MR. CONNELL: And if it's not, then we need to address that.
DR. APOSTOLAKIS: It's not, because you can't say that the
nuclear safety performance criteria is -- the design limits should not
be exceeded. There is always a probability they will be exceeded.
MR. CONNELL: Right. But if you read the standard, it says
reasonable assurance. Now, you can argue about what that means, but for
the criteria portion, I think -- I don't know if we could stick a number
in there right now. I think reasonable assurance, at least right now,
is about the best we can do.
DR. APOSTOLAKIS: So you should put that there in the slide,
too.
MR. CONNELL: Well, don't forget, the slide is just an
abstract of the standard. The standard, where it has these criteria,
says reasonable assurance.
DR. APOSTOLAKIS: I think it's important enough to put it on
the slide, too. Then you wouldn't get the questions.
MR. MARSH: We want to make sure it's clear and if we need
to present it that way, then that's the way we do it.
DR. APOSTOLAKIS: The reasonable assurance issue is key
here.
MR. MARSH: There is a delta here that we were talking about
yesterday in terms of how we protect these criteria currently compared
to this standard and what the standard is doing. Ed, put that other
slide on a minute, please.
In terms of reactivity control, K effective less than one,
that's a relaxation. We normally go from like .95 or .99, depending
upon the particular even that's going on. Fuel cooling limits, that's a
step backwards, a relaxation, if you will, from the current fire
protection criteria, which is to not allow uncovery, not allow the event
to go beyond a normal loss of off-site power. We like normal systems to
be used.
This is a very different approach that's being taken, a much
more risk-informed approach. And as we were saying, I view this as a
broader and not as deep protection. In other words, you cover many more
events, you cover many more situations, and so from that standard,
you've broadened out your protection. But we're not -- we're looking at
it from a risk way, which is the site-wide assessment.
But the particular criteria, much less quantitative, much
less proscriptive in terms of .95 and in terms of fuel limits. It's
certainly a delta.
DR. APOSTOLAKIS: I guess part of it is that I see the
statement of criteria and objectives in different language than I'm used
to, because if you put the words reasonable assurance that the design
limits are not exceeded, I guess that's the same as saying low
probability of being unable to cool the core, right?
MR. MARSH: Right.
DR. APOSTOLAKIS: It's the same thing.
MR. MARSH: Right.
DR. APOSTOLAKIS: Okay. Language sometimes is important.
MR. CONNELL: It's very important and we tried to, instead
of inventing new terminology, tried to use existing terminology.
DR. APOSTOLAKIS: In the fire community.
MR. CONNELL: Well, in the NRC regulations. Reasonable
assurance is in Part 50.
DR. APOSTOLAKIS: Okay.
MR. CONNELL: Low probability is not.
MR. MARSH: It's the same terminology up here.
DR. APOSTOLAKIS: Yes, but we usually say cooling the core,
not the design limits not exceeded.
MR. CONNELL: Right.
DR. APOSTOLAKIS: But I guess it's the same thing.
MR. CONNELL: That criteria came out of the general design
criteria. So it's something -- cooling the core isn't measurable. This
is. So we wanted to have in the criteria something that we can measure.
DR. APOSTOLAKIS: I guess the words reasonable assurance are
carefully selected to also answer Dr. Kress' problem of allocating risk.
DR. KRESS: Once you choose that number, you --
DR. APOSTOLAKIS: So you put in here that that should be a
reasonable allocation and let those guys worry about it, because we
tried something like that when the new production reactor was designed
by DOE.
DR. KRESS: You probably had lots of problems.
DR. APOSTOLAKIS: And we saw the Sizewell B approach of one
tenth, no sequence should contribute more than one tenth of the
frequency of the event, and do it, a seismic risk dominated everything.
It was 95 percent of the contribution, but itself was very low. So it's
very difficult to have generic criteria about these things.
So you have to leave it up to the plant or the facility, but
you put some word there like reasonable, so then you debate what
reasonable is.
MR. CONNELL: Okay. Do you want to move on?
DR. KRESS: The problem I have is reasonable in context with
the overall risk status and it can't be taken in isolation.
DR. APOSTOLAKIS: Yes, that's right. You cannot.
DR. KRESS: That's a bit of a problem.
DR. APOSTOLAKIS: You cannot take it in isolation.
DR. POWERS: Can you explain to me why we want to have a
firm adherence to defense-in-depth in fire protection?
MR. CONNELL: Fire protection is not -- fire protection
systems and features are not safety-related, so redundancy is not
provided, which is typical for most other design basis events. So,
therefore, we want to maintain defense-in-depth, so that we don't place
reliance on a single system or feature and we have diversity of systems
and features, though they may not be redundant.
DR. POWERS: What you've explained to me is what you mean by
defense-in-depth.
MR. CONNELL: Right.
DR. POWERS: And what I'm asking is why do we want to have
defense-in-depth. Let me explain how I come about asking that question.
I see defense-in-depth as a strategy to achieve safety that's borne of
three things.
First among those is a hazard that's difficult to quantify
and you're fairly uncertain about it. Second, defense-in-depth was
adopted in the nuclear business because there were no industrial
standards to go by. We lacked experience with nuclear power plants to
have a large amount of empirical data on these things work and these
other things don't work.
So you had no industrial standards to fall back on.
And the third thing was that a failure in the nuclear
systems at a particular installation was likely to have ramifications
throughout the nuclear business. But fire is a little bit different
than that and, in fact, your standard is predicated on there existing a
base fire, industrial fire protection that's fairly well known, a lot of
empirical data, this is what you need.
So why is it that we have to appeal then to defense-in-depth
on top of that good empirical database on what a base fire protection
program should be?
MR. CONNELL: I believe that we have to do good fire
protection engineering and part of that, I don't think it's okay to say,
all right, I don't care how many fires I have, I'm going to put no
effort into prevention of fires and minimize combustibles. I'm going to
rely solely on my detection and suppression capability, which is
adequate for the hazard.
So I'm going to eliminate that level of defense-in-depth. I
don't think that's a good idea. I think that's poor engineering and
that's poor operational planning and if I was owning a plant, I would
want to minimize the amount of fire events. I would want to minimize
the challenges, the potential challenges to my fire protection systems
and features. I wouldn't want to eliminate manual suppression
capability, even if I have automatic suppression capability, because
automatic suppression systems are not 100 percent reliable, they're far
less than that, and I'd like to have that in my back pocket.
Since we don't have a quantifiable margin of safety like you
would have if you were designing a structure, if you were designing a
building, you design a building with this much margin of safety and it's
an engineered number. Since we can't have that for fire, we're not
designing it for this kilowatt fire that burns for this period of time,
because we may not have that fire. We may have something worse than
that, we may have something less than that.
With defense-in-depth, that kind of gives you the appearance
and a little bit of comfort zone of a margin of safety, although it's
not as quantifiable as it is in a lot of other engineering disciplines.
DR. POWERS: I think what you've told me is that fire
engineers naturally gravitate toward a defense-in-depth, as it's defined
within fire safety contexts.
MR. CONNELL: Yes.
DR. POWERS: And that they do that naturally, and so you've
written your standard to do that naturally.
MR. CONNELL: Yes.
DR. POWERS: That it's not --
MR. CONNELL: It's not unique to the nuclear industry
either. I mean, most of the stuff that we have today, most of the
requirements we have today were initially based on a highly protected
risk insurance model or high value, high risk facilities, where you want
to prevent fires, you want to detect them early, you want to suppress
them early, you want to minimize the consequences of those fires.
I don't see any reason to get away from that good basic
industrial fire protection approach. I think we can enhance it with the
performance based and the risk information, but I don't think we should
eliminate it.
DR. POWERS: You see, what I see here is we have a
codification of defense-in-depth at a microscopic level and a
microscopic feature of the plant, instead of a macroscopic feature of
the plant, and it's codified. It's engrained in the industrial
practice.
It's a very different spin on defense-in-depth. It no
longer becomes an option because the industrial practice itself is
defense-in-depth.
MR. CONNELL: Currently it's not an option. Currently it's
a requirement.
DR. POWERS: I understand. And we're developing an
alternative, which is no alternative. I mean, it's just a different set
of words to create the same defense-in-depth.
Is the intent of the standard to -- you have these basic
elements of defense-in-depth as it's defined within the fire context.
Is the intent of the standard to allow some, but not unlimited
variations in the emphasis on the elements of the defense-in-depth?
MR. CONNELL: Well, yes, you would be able to -- the
mitigating capability or safe shutdown capability, those things are
going to be changed using the performance-based approach.
DR. APOSTOLAKIS: In terms of the cornerstones of the
inspection program, which I failed to mention earlier, but I think in
the context of your goals and performance objectives, you should go back
and look at it and see how you can tie that top-down approach to yours.
But one of the cornerstones is that the prevention -- well,
not the prevention -- the minimization of frequency of initiating
events. So you might be able to argue here that your initiating event
is not really any fire, it's a fire that is of sufficient size to do
some damage.
So in trying to satisfy that cornerstone, you're asking
yourself, well, how can I make sure that I will not have that fire.
Well, by taking measures, making sure that fires will not occur, that if
some of them start, I will have detection and suppression capability.
So it's a manifestation or a realization of that particular
cornerstone.
MR. CONNELL: Right. But you're not making sure. You're
providing reasonable assurance that you're not going to have that fire.
DR. APOSTOLAKIS: That's where the risk parts come into it.
But even the cornerstones, it's the same thing. They're saying nuclear
safety is our objective, so risk and all that, but then they have
minimization of the frequency of initiating events, making sure that the
barriers are intact and then there is emergency planning.
So I think this fits very nicely into that and, again, from
the perception point of view, it will be of great benefit, I think, to
you. It would behoove you to go back and tie this to that, because that
has already acquired consensus, I guess. This committee has been very
excited by it, the staff is excited, the Commission likes it.
There is no defense-in-depth here. If the Commission likes
it, that's it. Now, this is the baseline protection program, right?
MR. CONNELL: Yes.
DR. APOSTOLAKIS: And minimum requirements are not part of
defense-in-depth.
MR. CONNELL: Sure they are. Sure. The administrative
controls are part of defense-in-depth. The procedures, the fire
barriers, the fire brigade, detection and alarm, manual suppression
capability, the water supply. Those are all part of defense-in-depth.
They're not all of it, but they're part of it.
DR. POWERS: An issue that arose in yesterday's discussion,
and it bears repeating just to see your different spin that you might
have on it.
MR. CONNELL: Okay.
DR. POWERS: Focuses on the fire brigade. I, as a plant
owner, might well decide that I have to reduce costs and one of the most
expensive things I have --
MR. CONNELL: Why don't you cut your salary?
DR. POWERS: -- is maintaining a fire brigade of five people
on each of five shifts, maybe it's only four for fire brigades, but it's
a lot of folks that I have to maintain and I said, gee, I can pay their
salary, training, housing, et cetera, every year or I can once buy into
a super-duper fire suppression system. We trade capital for labor,
classic NBA type analysis.
Why should that be precluded?
MR. CONNELL: Well, what if your system, your super-duper
fire suppression system is unavailable?
DR. POWERS: It's the same thing. What if my fire brigade
fails?
MR. CONNELL: No. You have that -- you have the suppression
system. You needed a fire brigade.
DR. POWERS: Now I have two suppression systems.
MR. CONNELL: Sure. It increases the reliability of your
suppression capability.
DR. POWERS: I can make a judgment on what the reliability
is with a suppression system and a fire brigade and I can make an
evaluation of what the reliability of two suppression systems would be,
and I'll match them.
MR. CONNELL: What if you're wrong? I mean, the ones that
pay the price here is the public. The fire brigade is there to protect
the public, not to protect you.
DR. POWERS: But I can be just as wrong about the fire
brigade and the suppression system as I can about two suppression
systems.
MR. CONNELL: No, because the two suppression systems may be
subject of a common mode failure, whereas the fire brigade --
DR. POWERS: I'll get that common mode failure probability
down to a level I have to have.
MR. CONNELL: I think you're going to spend a lot of money.
I think that --
DR. POWERS: But, I mean, why is that a dictate and not an
option?
MR. CONNELL: Because I think that we don't have a good risk
assessment tool to be able to quantify fire brigade performance versus
automatic suppression performance versus some other fire protection
system or feature.
They're apples and oranges and they are complimentary, but
they are not necessarily direct replacements for each other.
DR. POWERS: Why is it that you say we don't have a tool
that you feel is adequate and we will never have a tool that I feel is
adequate?
MR. CONNELL: I look at industry experience. Industry
experience shows that most of the fires are suppressed by the facility
personnel.
DR. POWERS: And that may well be true here, because, in
fact, your industrial experience is that the fire brigade is not the one
that does most of the fires. Most of the fires, in fact, are suppressed
by the people in the immediate vicinity of where they occur.
MR. CONNELL: Right.
DR. POWERS: That won't change.
MR. CONNELL: Sure it will if you don't train them, if you
don't provide them with the systems.
DR. POWERS: That won't change at all.
MR. CONNELL: It could.
DR. POWERS: The fire brigade does not suppress most of the
fires in a facility.
MR. CONNELL: That's true. Most of the fires are suppressed
by facility personnel.
DR. POWERS: That's right. And I'm not changing that.
MR. CONNELL: Whether they're the fire brigade or whether
they're some other personnel.
DR. APOSTOLAKIS: So are the minimum requirements
non-negotiable?
MR. CONNELL: Yes.
DR. APOSTOLAKIS: No matter what.
MR. CONNELL: No matter what.
DR. POWERS: No matter what.
MR. CONNELL: No matter what.
DR. POWERS: And I fail to see why.
DR. APOSTOLAKIS: Let me understand, though. When you say
fire brigade, you stop there, you say there has to be a fire brigade,
but you're not really specifying how many people.
MR. CONNELL: We specified five people per shift, because we
don't know how to determine 4.3 people is the appropriate number for the
XYZ plant. There is no way of doing that.
DR. APOSTOLAKIS: There is an alternative not specified.
You can say I want to see a fire brigade that's appropriate for this
facility.
MR. CONNELL: And how do you determine whether it's
appropriate or not?
DR. APOSTOLAKIS: But if you look at the facility, there is
reasonable assurance.
DR. POWERS: If you go to that step, George, then why can't
you say I will see -- I will expect to see a fire brigade, unless I see
something that replaces it, that makes it unnecessary.
DR. APOSTOLAKIS: Maybe that is too bold a step for these
guys, but taking the first small step, I can understand having a
requirement of having a fire brigade, but it escapes me why, as part of
the minimum requirement, I have to specify the number of people.
MR. MARSH: There is a basis for that number. It wasn't
just imagined.
MR. CONNELL: The basis for the five is the ability to be
able to put hose lines in service. It takes so many people to put -- I
mean, you cannot -- with less than five people, you cannot put two hose
lines in service. You just can't do it.
DR. APOSTOLAKIS: And you can raise that argument when the
utility comes to you and says we're going to do it with one guy. But
that does not mean it has to be part of the minimum requirements.
MR. CONNELL: But I don't have to -- if it's in the
standard, it's no argument.
DR. APOSTOLAKIS: Because the technology might change five
years from now and you will be convinced that four people can do it.
MR. CONNELL: The thing is, if it's in the standard as five,
then it's not something I have to argue with the utilities about. I
want to reduce the amount of argument and uncertainty, if possible, and
there is no tool available right now that can give you a quantifiable
number of how many fire brigade members you need to have. And five is a
traditional number and there is some basis for it. The basis is we
believe -- and I was on a fire brigade at a nuclear power plant. That's
how many people you need to put two effective hose lines into service.
DR. MILLER: I thought yesterday's discussion of five was
not relevant for the nuclear plant. It's just that fire protection
standard to have five in a fire brigade. Is that --
MR. CONNELL: Actually, if you look at the OSHA standard,
it's more than that. The OSHA standard requires more than five and it
looks at things beyond just putting the two hose lines in service. It
looks at people for safety and all that other kind of stuff. So it may
be an academic argument anyway, whereas another regulatory authority may
dictate that we have one and how many people there are.
DR. MILLER: I thought that minimum requirement was
irrelevant to nuclear and that's just national fire protection standard.
MR. CONNELL: No.
DR. MILLER: That's not true.
MR. CONNELL: No.
MR. BACANSKAS: Vince Bacanskas, BWR Owners Group. The
question I had also relates to the brigade and one of the things that
some plants are looking at now is whether or not we should allow the
brigade to respond to fires on site, but outside of the protected area,
because of security considerations and other.
The question being then, is there any limitations in this
baseline program, and I'm sure the insurer's interest would be that the
on site trained brigade respond to anything. But are we putting
limitations in the standard that would require that when our policy is
leaning more towards maintaining them within the protected area.
MR. CONNELL: No, no. The standard, the way it's written
right now, does not restrict the fire brigade's activities. It
prescribes the number of members, prescribes that they shall be trained
and equipped and things like that, but it doesn't restrict their
activities.
I mean, the example of last week, there were seven fire
departments at the Fitzpatrick for the hydrogen fire. So you've got to
do what you've got to do.
DR. APOSTOLAKIS: The problem is that this is the technology
now, this is the state of affairs, and you put it in the regulations and
15 years from now, the state-of-the-art is different and because it's
part of the minimum requirements, it takes two years to change. For
example, I'm sure there was a time when starting the diesels within 30
seconds, given a LOCA and a loss of off-site power, made perfect sense.
That was part of the regulations, it's part of the design
basis. Now we know better and now the utilities have to go through a
lot of pain to change it because it's embedded in the heart of the
regulation. It's Part 50 and it's a big thing and so on.
You don't want to find yourself 15-20 years from now in that
situation. I mean, why don't you just say the fire brigade, give some
flexibility to it. It is essential, but don't specify the number.
MR. CONNELL: If we had a way of determining what the
appropriate number is, that would be fine, but we have no way of doing
that. I gave you the basis for the five.
DR. APOSTOLAKIS: You gave us an argument.
MR. CONNELL: I think five is a minimal amount. Many plants
have more people than that. So from practical application, the plants
themselves have found that they need more than five.
DR. APOSTOLAKIS: So there's no problem then.
MR. CONNELL: And there's no problem meeting the five. I
have seen no objection from the industry about having the five fire
brigade members. I think we're chasing something that's not a problem
for them. Very few plants have dedicated fire department personnel,
Palo Verde does, some other plants do, but most plants use people,
maintenance people, operators, security people, that their fire brigade
duties are collateral to their normal duties.
So you're not going to eliminate plant personnel by reducing
the amount of fire brigade personnel. It's just not an area of big
savings.
DR. POWERS: I chose fire brigade more as an example. It
was a studied choice, because I know it's an article of faith and when
the fire protection community -- let me turn to another one that's maybe
not so much an article of faith.
MR. CONNELL: Okay.
DR. POWERS: Again, under the baseline program, hydrants
with individual hose gate valve shall be installed every 250 feet apart
on the yard main system, 250 feet, not 300, not 125, 25 feet.
Why?
MR. CONNELL: That's an easy one. That's the hydraulic
capabilities of two and a half inch hose. It's based on how much water
you can get through 250 feet of two and a half inch hose, based on
normal hydrant pressure of about 100 psi.
DR. POWERS: So that if I want to design a system that uses
three inch hose, I am dead meat, sorry, you can't do that.
MR. CONNELL: It's not sorry, you're dead meat, you can't do
that. The standard that we reference is the standard NFPA standard for
outside underground piping systems and that's the standard and if you
want to make a recommendation to change that standard, you're free to do
that.
Don't forget, everything in here, as in every other NFPA
standard, allows alternatives, provided they're acceptable to the
authority having jurisdiction.
DR. POWERS: This, however, we're talking about is a
possible requirement.
MR. CONNELL: Right, but understand that the plants already
have the hydrants installed where they are. They're not going to be
ripping out hydrants to move them another 50 feet.
DR. POWERS: Again, I'm simply taking it as an example.
MR. CONNELL: Right. Well, most of this baseline stuff
plants already have. There are not going to be any changes.
DR. POWERS: That's fine. I just suffered through a review
of a -- for a certification of a plant in which nothing existed. It was
a clean sheet of paper.
MR. CONNELL: Which we don't have.
DR. POWERS: And in fact, I think that if you were to ask
them, they felt that they were -- had difficulties bringing innovation
into their fire protection because the existing regulations were
stringent in their prescriptive nature.
I'm just asking why we have to do that.
MR. CONNELL: The hydrants -- there is a reason --
DR. POWERS: Why can't all of this that is in the baseline
program also fall within this envelope of the risk assessment and that I
can be allowed to make engineering tradeoffs to achieve an end?
MR. CONNELL: You are allowed to make engineering tradeoffs,
to the extent that they're supported by the analytical tools. The
analytical tools basically do not support --
DR. POWERS: The fire brigade. You won't let me get rid of
my fire brigade.
MR. CONNELL: No. You have no analytical tool that can
justify getting rid of your fire brigade. I'm not going to write a
standard for ten years from now. I'm writing a standard for the plants
that are existing today.
DR. POWERS: You are not prescribing the tools to be used.
No where in here do you prescribe. You promise to have something in
Appendix B, but I guarantee you that's not going to be a very in-depth
prescription on the tool I'm going to use for the risk assessment.
MR. CONNELL: No.
DR. APOSTOLAKIS: And you will assume that the tools will
become better as time goes on.
MR. CONNELL: Sure.
DR. POWERS: And why can't I possibly take the rest of this
baseline fire program into the evaluation there and --
MR. CONNELL: Again, don't forget, we are not the only
interested regulatory authority in this effort. Part of it is the
insurance industry, part of it the local fire marshals, and I think you
would have zero cooperation with them as far as deviating from NFPA
standards because they're the ones that are going to be holding the
monetary bag for this, and I think that's -- we've got to look at
reality, what we can do versus what we would like to do if we had a
clean sheet of paper and we didn't have 103 plants out there with all
this operating experience, that already have established mature fire
protection programs.
I mean, if this was important, this is the approach that
should have been taken with the advanced reactors, but it was not, with
the concurrence of this committee.
The advanced reactors have the most prescriptive
deterministic fire protection requirements there are. There was the
opportunity there.
Are we ready to go on?
DR. POWERS: Yes, please.
MR. CONNELL: Okay. We've kind of covered all this already.
The last thing on this is give the idea that both the performance-based
approach or the deterministic approach meet the performance criteria,
the measurable engineering terms. That's the important thing.
This is something we haven't talked too much about. The
site risk evaluation. The purpose of this is to provide additional
assurance that public safety is maintained, which is the objective of
the standard. The way it's drafted now is it does address CDF and LERF
and shutdown risk. Those last two, which are not addressed in the
current IPEEEs.
The risk limits are set by the facility owner/operator and
those limits will be acceptable to the AHJ, which is, in this case, the
NRC, already having jurisdiction. But they're not set by the NRC.
There will be absolute limits that the licensee sets for CDF and LERF
and fractional limits for contribution from a single fire area.
The program would be modified if the risk limits are
exceeded, even if the performance criteria have been satisfied.
DR. APOSTOLAKIS: Now, as part of this site-wide risk
evaluation, the licensee will have to screen the locations, right? And
some of them -- and let's say that the screening includes adjacent
compartments, so we don't have the problem with propagation.
MR. CONNELL: Okay.
DR. APOSTOLAKIS: Okay. So in some of them, in fact, the
majority of them are not contributing. There are a few areas where a
fire really can result in CDF and so on.
Would you still require the -- would you have the same
requirements regarding fire prevention, detection, suppression and so on
for these areas or can the licensee come back to you and say, well, gee,
for those, perhaps I have a minimum effort to make sure that I don't
have combustibles, but the areas I really have to protect are, for
example, the cable spreading room, bla, bla, bla, bla.
Would you relax anything, in other words?
MR. CONNELL: Well, the baseline, the only thing the
baseline program -- most of the baseline elements are site-wide. The
water supply, for example, is for the site. It's not for a particular
area. The fire brigade is for the site. It's not for a particular
area.
The baseline requires that there be administrative controls.
It doesn't say what they are. You can adjust your administrative
controls and say, hey, this is a risk significant area, I really have to
have a tight control, I'll do a daily inspection or a once a shift
inspection. Over here it's not that important, I'll do a monthly
inspection.
The baseline says you have administrative controls, it
doesn't say what they are. The licensee has the flexibility under the
baseline program to adjust things like that.
The procedures, okay, you have to have procedures. Well, I
could have a pre-fire plan for all those on-important areas, but maybe I
need a specific pre-fire plan because I'm trying to protect this pump if
this other pump catches on fire, and I want to prevent propagation to
this valve or whatever.
So that's the kind of detail that we went into in the
standard. We didn't prescribe what those elements are, with the
exception of water supply, except for the fire brigade, just that they
exist.
MR. SIU: George, if I may also. By the time you get to
this point, you've already gone through the performance evaluation and
you have a chance to use your risk tools at that level, inside that box.
DR. APOSTOLAKIS: No, this is fine. Again, for perception,
I would drop the additional assurance from the first bullet. I don't
want to see the word additional related to PRA anymore. But you
probably don't understand that.
I want to raise another issue, though, maybe because that's
really important to me. Go to page 29 of the standard. You have a set
of deterministic requirements and a set of performance-based
requirements.
MR. CONNELL: Yes, this is chapter three.
DR. APOSTOLAKIS: So I'm reading now -- let me tell you what
my problem is.
MR. CONNELL: Okay. I probably have the same problem you
have.
DR. APOSTOLAKIS: From the deterministic requirements, D,
each pump and its driver and controls shall be located in a room
separated from the remaining fire pumps and from the rest of the plant
by fire barriers with a minimum rating of three hours.
Then I go to the performance-based requirements, D, if fire
pumps are powered by electric motors, then electrical supplies shall be
independent, such that the fire involving on electrical supply and a
simultaneous failure of any one fire pump shall not prevent delivery of
the required fire flow.
I can't see the difference.
MR. CONNELL: And I can't either.
DR. APOSTOLAKIS: Why is the first one deterministic --
okay, good.
MR. CONNELL: I can't either. That's one of the comments
that I have on chapter three, is basically my comment on chapter three,
and I'm not -- I'm not responsible -- I didn't have much input into
chapter three.
DR. APOSTOLAKIS: Okay.
MR. CONNELL: But, yes, my comment on chapter three was to
delete most of the performance-based requirements out of chapter three.
That's not where they belong.
DR. APOSTOLAKIS: Now, Ed, let me ask you another more
general question, because I have also seen documents from the fire
protection community that have nothing to do with nuclear power,
especially from Australia, as you know, a lot of activity and so on.
MR. CONNELL: Right.
DR. APOSTOLAKIS: I suspect that that community interprets
the work performance different, in a different way than I interpret it,
and I looked it up and the Random House Dictionary says, number seven,
because the first six have to do with music and so on, performance is
the manner in which or the efficiency with which something reacts or
fulfills its intended purpose. I like that. The manner in which
something fulfills its intended purpose.
Now, is performance -- I mean, obviously a design
requirement is not performance, in my mind, although it does fulfill its
intended purpose. I mean, to say that you will have two redundant
trains for delivering water and then you go and check and say, yeah, did
they have two, can you really say, yeah, they satisfy this performance
criteria? That's not a performance criteria. That's a design criterion.
Performance, in my mind, is something that changes with time
and with time it meets certain criteria. For example, the frequency of
any fire on the plant is kept below a certain number. That would be a
performance criteria, in my mind. The unavailability of an individual
train remains below ten-to-the-minus-five, that's a performance
criterion, because unavailability is time dependent and I have made sure
that over time it stayed below a number.
I don't think the fire community interprets performance that
way.
MR. CONNELL: Let me read you what the fire community -- how
it defines those terms. The first thing is an NFPA document that came
out in 1995.
DR. APOSTOLAKIS: I'd like to have a copy of that, please.
MR. CONNELL: I'll be happy to let Jit borrow them and he
can make all the copies. But a performance based document, reading from
this, is a code or standard that specifically states its fire safety
goals and references approved methods that can be used to demonstrate
compliance with these requirements.
The document maybe phrased as a method for quantifying
equivalencies to a prescriptive based code or standard or it may
identify one or more prescriptive codes or standards as approved
solutions. Either way, the document allows the use of any solution that
demonstrates compliance. That's a 1995 version of that NFPA.
The Society of Fire Protection Engineers has a draft
performance-based fire protection analysis design and it's only a month
old and I've been involved in the development of this.
Performance-based design specifically addresses a building's unique
aspects or uses as well as specific stakeholder needs and considers
those of the broader community, where appropriate. Performance-based
design provides a basis for development and selection of alternative
fire protection options based on the projects needs.
Performance-based design allows the safety levels provided
by alternative design options to be compared. This provides a mechanism
to determine what level of safety, at what cost, is acceptable.
Performance-based design requires the use of a variety of
tools and analysis, bringing increased engineering rigor and often
resulting in innovative design options. Performance-based design
results in comprehensive fire protection strategy in which all fire
safety systems are integrated rather than designed in isolation.
So that's basically what the fire protection community --
how the fire protection community views performance-based design.
DR. APOSTOLAKIS: I guess we can debate that.
MR. CONNELL: And that's consistent with Australia and New
Zealand and what's being done in Europe. I mean, a lot of this stuff
came from there and they were involved in the development of this.
DR. APOSTOLAKIS: See, that bothers me. I read a document
from Australia where basically after numerous assumptions, what they're
showing is that the egress time is sufficient. Okay.
MR. CONNELL: Well, they also protect the fire department
personnel, too. There's three criteria.
DR. APOSTOLAKIS: I understand. Let's say one other
criteria. So the egress time is smaller than the incapacitation time
and that is taken as a measure of performance, so the building is safe.
That would never happen in this agency. That would -- we would never
say because a PRA shows that the core damage frequency is below
ten-to-the-minus-four, that's a performance criteria, so the reactor is
acceptable.
No one will accept that, because there are so many
uncertainties in that. So there is more to performance-based
regulation, perhaps as unique to the nuclear business again. I don't
know. And the fire protection community uses a certain broad
interpretation and we are restricting it.
But very clearly the core damage frequency cannot be the
performance measure. The unavailability is because it doesn't require a
lot of calculations and assumptions, but the core damage would.
Anyway, I'm done, Mr. Chairman. You should be done, too.
MR. CONNELL: A little graphics, just to give you an idea of
what a program might be. We expect a large part is going to be the
baseline program. You will see that there is some overlap. The
site-wide risk evaluation we view as an enhancement to the existing
IPEEE and then you're going to have the deterministic and
performance-based approaches that will complete the program.
I thought I'd give you guys some insight into the committee
deliberations here, just to get an idea of what we've been involved with
the past year and a half.
DR. POWERS: Is that an important slide for us to have in
our package?
MR. CONNELL: Oh, did I not give that one?
DR. APOSTOLAKIS: What are those guys on the left doing
there?
DR. POWERS: Those are ACRS members on one side.
DR. MILLER: They're looking at the risk of playing hockey.
MR. CONNELL: this is why we're having those interesting
discussions, as some of the outstanding issues we have to resolve within
the committee.
The documentation, how much documentation, what kind of
documentation, where is it going to be and who is going to approve the
different levels of documentation.
The scope of the baseline program, monitoring of fire
protection program performance and feeding that back into the program to
make modifications, the traditional stuff of performance of fire
protection systems and features, but other elements, as well.
Addressing fire protection for degraded plant conditions,
following a non-fire event, tornado, earthquake, flood, what have you.
And then the methods for evaluating the compliance with the
performance and risk criteria, what analytical tools are we going to
use, which ones will be acceptable, we're addressing that or making an
attempt to address that in Appendix B of the standard.
Then, of course, I touched on this before, the roles of the
authority having jurisdiction other than the NRC.
DR. MILLER: A couple questions, Ed. You mentioned Appendix
B. I'm trying to figure out what's the objective of Appendix B, because
it doesn't -- I'm looking at some issues related to circuit analysis
methodology.
MR. CONNELL: Right.
DR. MILLER: It refers to Appendix B. I go to Appendix B
and it doesn't tell me what I --
MR. CONNELL: Right. We haven't drafted Appendix B yet.
DR. MILLER: So the Appendix B I have in my document isn't
really the final Appendix B.
MR. CONNELL: No, no. Appendix B is still a work in
progress. And as far as on the circuit analysis, what the committee was
hoping was we would be able to stick in the process that the BWR owners
group and NEI is working on when that gets done. So we're not working
specifically on the circuit analysis part since there's already an
effort by another body working on that. We kind of defer to them in
kind of a wait-and-see approach on that.
We are working on fire modeling, we are working on PSA, the
life safety assessment and some other areas.
DR. MILLER: How about the -- I go through the separation
criteria you use. Is that also --
MR. CONNELL: You mean as far as the circuit analysis?
DR. MILLER: Right.
MR. CONNELL: We're not working on that.
DR. MILLER: There are separation numbers listed here, which
are prescriptive, of course.
MR. CONNELL: Are you talking about in chapter four?
DR. MILLER: Right.
MR. CONNELL: Okay. Yes. That's for the -- that doesn't
give you information on circuit analysis. That's a deterministic
approach, that if you did that, that would be acceptable and that's
basically a mirror of the current Appendix R criteria.
DR. MILLER: So like the 20 feet from --
MR. CONNELL: That's a mirror --
DR. MILLER: That comes out of Appendix R.
MR. CONNELL: That comes out of Appendix R. The reason we
did that is we realized that plants have mature programs and they're not
going to want to make wholesale changes throughout the plant. There
will be some areas where they say, hey, look, we like what we have, we
comply with the existing regulations, we're going to maintain that and
805 would allow them to do that for those plant areas where they do not
want to go into a performance-based approach.
DR. MILLER: Now, this is a question, since this is my first
meeting of this subcommittee. So the answer, probably everybody else
knows it.
How does this relate to NFPA 803?
MR. CONNELL: Okay. 803, of course, is an old standard.
803 addressed things other than those that are within the jurisdiction
of the NRC. It did not address safe shutdown. That's why it was never
adopted or one of the reasons why it was never adopted by the NRC as an
acceptable approach, because it does not address safe shutdown. It
addressed property protection, it addresses life safety, continuity of
operations.
DR. MILLER: So it addresses some of the issues in this one,
but not all of them.
MR. CONNELL: Right. This one was comprehensive. This
captures all the things in 803 and includes the nuclear safety and
radiological release that were specifically of interest to the NRC.
DR. MILLER: So for example, if I'm looking at an IEEE
standard that references 803, that will not change anything.
MR. CONNELL: No. And someday 803 may go away, because it's
not widely used and the committee may withdraw it someday when this
comes out.
DR. MILLER: Another point. You referenced reactivity
control by maintaining K effective less than one. There is a definition
later on where you stated K effective should be less than .99.
MR. CONNELL: Okay. That's a problem when you don't do it
all at the same sitting.
The status and schedule.
DR. POWERS: The schedule was gone over in some detail at --
MR. CONNELL: So we don't need to cover that.
DR. POWERS: -- yesterday's meeting.
MR. CONNELL: Okay. Just to give you an idea of the kind of
stuff that we're looking at for Appendix B, and since the NRC was nice
enough to spend $15,000 for me getting my Master's degree, and if I took
two semesters of combustion, I had to put this up here. These are the,
as everybody is aware, the conservation equations for energy, mass,
momentum, species and air and vector notation, and this is the kind of
information as far as guidance and understanding, this is what all the
fire models are based on that we think are necessary to put in the
appendix to make sure that the implementers of the standard have a feel
for what they're really doing and understand the limitations.
All the fire models take these and then simplify them so
they can get them to work.
Any other questions?
MR. MARSH: Dr. Powers, we asked Ed to give any kind of
problems that he's got with the standard, too. I mean, each of the
staff is reviewing the standard. As I said earlier, this has not got
any kind of endorsement of the agency at this point. It's
developmental. Our staff has a lot of concerns about the standard, so I
don't want to represent it as something that we're all happy with.
Ed, can you just take a few minutes and any kind of concerns
you've got about the standard?
MR. CONNELL: Sure. The primary concern that I have is in
chapter three, you'll notice there's a lot of performance-based
alternatives to the baseline program and right now I don't support that.
I don't think there is a good performance-based approach to determining
adequate water supply, numbers of fire brigade members, things like
that.
There are some concerns with how chapter two is going to be
folded in. That's basically the analytical portion of the standard, how
chapter two is basically going to drive everything else,
performance-based, deterministic, the site risk evaluation. It's not
clear to me that that's imlementable in its current format. So we need
to work on that some more.
And then of course, the appendix material, whether we take
the approach of, well, you can use these fire models, CFAS, the LES
model, or do we say, well, if you're going to choose a fire model, these
are the things you ought to be thinking about, that's the way I would
lean to go.
Some people want to say, well, if you use this model, it's
good. My experience with fire modeling in nuclear power plants is there
isn't a single fire model that you can say is good for the plant. I
think an understanding of the limitations of the model, what the model
is -- what kind of empirical information we use in the development of
the model and verification of the model is important. So those are the
kind of things that we have some concerns and comments on.
And we'll work them out. We're still in the developmental
process. It's not a final document, by any -- I'm not selling it as
one. But it's taken a lot of work, a lot of my time, a lot of other
people, and the industry has put a lot of effort into this thing and
it's moving forward. It's better than where we were a year and a half
ago, but we're not done yet.
And we'd appreciate feedback. We're trying to do a good
thing.
MR. MARSH: Okay. Thank you very much.
DR. POWERS: We will discuss what we will do in the full
committee at the end of the day. It's very likely we'll have -- it
looks to me like it's very likely we'll ask him to reproduce this
presentation in his presentation on the reg guide, in perhaps somewhat
truncated form at that meeting.
MR. MARSH: Okay.
DR. POWERS: Do members have other questions they want to
pose on this general topic?
[No response.]
DR. POWERS: Then I propose that we break until 10:15, at
which time I think we will cover the subjects of research and IEEE and I
look to the speakers to decide what order we do them in.
[Recess.]
DR. POWERS: We are going to come back into session. And
because I don't know what's going to be said and because there is a
potential of some institutional conflict of interest, not personal
conflict of interest, I'm going to ask Dr. Kress to assume control of
this part of the meeting. I take it we made an executive decision here.
DR. KRESS: Okay. I guess we're back in session and I will
turn the floor over to Nathan Siu.
MR. SIU: Thank you, Dr. Kress. My name is Nathan Siu. I'm
with the Office of Research, Probabilistic, and Risk Analysis Branch,
and I'm going to talk about the fire risk research program, its current
status.
In terms of timing, we figured that depending on the number
of questions and the depth to which the discussion goes, we could run
this discussion till about 11:30, and that will still leave some time
for Alan Rubin to give a presentation on the current status of the
IPEEE, if that's okay with the committee.
DR. KRESS: That sounds good.
MR. SIU: Obviously, we'd like to talk about what we're
doing in this program. We last briefed the committee last January, so
it was about a year ago. Some things have happened since that briefing
and we'd like to bring you up to date on that.
Also, I'd like to keep this as a working session. I'm sure
you guys will ask right away any questions you have, and provide us with
feedback on the particular objectives we've set for ourselves in this
program and the manner in which we're achieving those objectives.
One thing that we're interested in, although I don't know
how much time we'll really have for discussion, is how we measure the
progress in this particular research program or, I guess, for that
matter, in any of the research programs we've got. I understand it's an
issue of interest to members of the committee.
Just as a matter of background, we know that internal fires
are important contributors to risks in some plants. As you may know,
Quad Cities, Commonwealth Edison came in, I guess, last week and made a
presentation on their fire risk analysis. They have -- and this is an
analysis, by the way, that we have not yet reviewed, but according to
the presentation, their CDF has gone down, but fire is still an
important contributor to risk at that plant.
DR. POWERS: Let me ask you a question. On the perceptions
that you feel that you, as a knowledgeable individual in the area fire,
and the perceptions of others who may not be so knowledgeable in the
area of fire, had about internal fires as an important contributor to
CDF prior to these submissions of IPEEEs and things like that.
Did you anticipate it to be as high as it often is?
MR. SIU: Yes. Actually, when we first did Indian Point
back in 1981, I believe, fire turned out to be an important contributor
to CDF at that plant. Now, at that time, it might have been a little
bit of a surprise, but that was one of the very first assessments that
was done.
As you recall, even before then, Big Rock Point had done a
study that showed that fire was a very big contributor to risk or to
CDF, but that was a fairly broad level analysis, as I recall.
So Indian Point was quite detailed and the numbers were
fairly high. The same analysis team had also looked at other plants and
shown that risk was, while not minuscule, was smaller at these other
plants, like Zion, for example.
So it was clear that there were plant-specific issues that
came up, that would come up that would affect the risk.
DR. KRESS: Do you feel like the contribution to the CDF at
these plants is too high and ought to be reduced or is it just that it
seems like it could be reduced by your second bullet, by cost-effective
means?
MR. SIU: You're not talking about analytical revisions to
the risk numbers.
DR. KRESS: I'm talking about real contributions.
MR. SIU: Well, I don't know if I'd say it's too high. I
guess I don't -- I haven't thought about it from that perspective.
Certainly, the plants that have looked at their programs and looked at
using the IPEEEs and decided that there were places where they could
make cost-effective fixes, they found it worthwhile to at least identify
them, and I'm not sure about the status of these fixes.
I assume, Alan, that some have actually done things to the
plants.
MR. RUBIN: Yes. Some have, some have proposed fixes that
will be implemented in the future.
DR. KRESS: I was searching for the motivation for the
research program. Is it to reduce uncertainties? Is it because the
risk is too high? Is it because it --
MR. SIU: The motivation for the research program is
actually in this third bullet here. The point is that we -- as part of
this move towards increasing the use of risk information.
DR. KRESS: So it seems like it's the question of
uncertainties.
MR. SIU: Well, uncertainties is obviously important. You
want to reduce uncertainties, so that in the tools and the data, so that
when you're actually making decisions now, you are more confident in
those decisions.
Now, there is a different question, should we be making
decisions about reducing the risk at plant X and that's not something
that we've considered as part of this program.
Anyway, the point of that bullet, again, we have seen
significant variability in results, for example, in the IPEEEs, due to
differences in modeling assumptions that right now are allowed by the
current state-of-the-art.
We don't have definitive positions, for example, on the
likelihood of self-ignited cable fires when those cables have jackets
that are qualified according to the IEEE 383 standard.
DR. KRESS: It seems like the motivation is current
state-of-the-art just doesn't allow a confident PRA assessment.
MR. SIU: I think that's too broad, and, again, I'll go back
to my second bullet. I think that the current state-of-the-art does do
some -- allow you to do some things. It can identify vulnerabilities in
plants or potential vulnerabilities. Clearly, we're at a point where if
we identify potential vulnerability, that looks really important, we
have to go look at it in more detail to make sure that vulnerability
really is there, and that's basically the process that was followed at
Quad Cities.
This is a process that's just part of the risk paradigm. In
the risk assessments, as was pointed, I guess, yesterday, have a certain
level of granularity. And a fire risk assessment is no different from
that.
If you find a potential problem, you may not be able to
resolve it in risk space. You have to go dig in to the engineering to
find out what really is the problem now, but at least the risk
assessment has identified that place to look at it.
DR. POWERS: I guess a concern that I've always had is that
w have these analyses coming in and sometimes they show plants have high
CDFs from internally generated fires. Similarly, where we have
attempted to look at risks under shutdown conditions, we have nominally
elevated levels of contribution to overall CDF, from what analyses we've
done, but I think no one believes those analyses under shutdown risk
because there are a lot of things that lead you to believe that an
accident under shutdown could be arrested fairly quickly.
Though you can certainly find accidents under shutdown
conditions that progress very rapidly and you might not be able to
arrest them. But the fact is people don't believe shutdown risk.
My concern is are we in a position where we think that the
current risk assessments are about right, there is nothing being left
out that really makes a big difference in these things, and that though
the numbers you can argue within factors of two or five, they're about
right.
MR. SIU: They are -- the current technology -- that's a
difficult question. There are -- for the second sub-bullet here, there
are significant weaknesses where we're not sure what the risk
contribution would be. So that's the first part.
Let's exclude those parts of the assessment and let's talk
about smoke, as an example, where we don't know what the risk
contribution is at this point.
DR. POWERS: Right.
MR. SIU: There are other parts where, with some
improvements to the current state-of-the-art, we could be more
confident. If we don't do those improvements, would be confident in the
risk assessment, I guess that's what your question is.
Again, for certain purposes, for identifying
vulnerabilities, I don't think -- I don't feel too badly about that,
because, again, the engineering lying that search. You're looking at
the frequency of fires, you're looking at detection, suppression, you're
looking at mitigation, and you can dive into these analyses and
understand where these vulnerabilities are coming from and if somebody
has identified a vulnerability, you can, again, show that whether or not
it's something you really should worry about.
So the risk assessment is good enough to point you in that
direction. Is it good enough to tell you that you don't need a
sprinkler system in this particular room, for example, or, even worse,
should you have a four-member fire brigade or can you get by with a
four-member fire brigade.
DR. POWERS: How about no fire brigade?
MR. SIU: Or no fire brigade, yes. We don't -- it's not
able at this point to draw those kinds of distinctions.
DR. POWERS: I guess the question that is most frequently
cited in connection with fire, PRA results, is the fire initiation
frequency; that the fire is big enough to get you into CDF events or
considerably extrapolations of the database, that is basically done on a
linear or quasi-linear fashion, and that if that is catastrophically
wrong, if, in fact, the frequency of those fires is akin to the
empirical frequency of Brown's Ferry once and nothing since then, then
the results are bull.
MR. SIU: That's possible. I don't, at this moment, believe
that the frequency of catastrophic fires is at that level, but, again,
that's something that we have a task looking at.
And one other thing I'll say about this while we're on the
subject. The risk assessments, of course, are more than just the bottom
line number. It's everything that goes into the analysis, the
intermediate results that go into the analysis. And you can have
confidence, I think, in some of the intermediate level analyses. The
screenings, for example, that are done, I think we feel pretty
reasonable about, with maybe there are a few issues that need to be
addressed.
As you get more and more detailed, you start bringing in
more and more modeling, that obviously uncertainties start increasing,
and these are things the research program is trying to address.
DR. POWERS: I struggle a lot with these screening
processes, and I really don't want to go into them in this discussion.
Is there a document you can point me to that explains the philosophy
behind screening in a comprehensive fashion?
MR. SIU: Yes. I imagine the -- one that I recall, the EPRI
fire PRA guide, the implementation guide, which we have comments about
some of the things, but the overall process that they use I think was a
reasonable thought process.
The last bullet on this slide, I just wanted to point out
that there are some needs right now for improved fire risk assessment
tools. We've talked about the circuit failure mode analysis yesterday.
Clearly, one part of that is the question of what's the
likelihood of a particular failure mode, given a certain exposing fire.
Right now we don't have a good technical basis for probabilities of such
events.
DR. MILLER: Are you going to have time to spend on that?
MR. SIU: This is just my first background slide. We will
certainly talk about that one. I know the interest. We also talked
yesterday about the risk significance of inspection findings. In many
cases, we come very quickly to the limit of the technology; if somebody
says, well, I've got a degraded barrier between two important fire
areas, what's the risk significance of that. Our tools aren't really
able to come up with a satisfying quantitative result that everybody can
believe in.
NFPA 805, obviously, we've talked about that, there is a
need for tools to address some of the provisions of that.
As I said, we did brief the committee on potential research
issues last time we met. That was the infamous 42 issues. We had
grouped those into a number of topic areas and, at that time, had a
preliminary prioritization of those issues based on input from NRR and
AEOD, as well as within our office.
We have actually gone ahead and started some tasks, and I'll
be talking about those tasks later on, involving -- right now our
contractors are Sandia National Laboratory and the University of
Maryland. Actually, the University of Maryland, that's a cooperative
research program with them, so they are contributing resources as well
to that.
DR. APOSTOLAKIS: Which group?
MR. SIU: This is the reliability engineering guys.
DR. APOSTOLAKIS: Not the fire group.
MR. SIU: But they are involved, to some extent, as well,
through Fred Mowrer.
The staff is performing -- is pursuing some of the technical
work in this area and I will be talking briefly about the tasks being
pursued by the staff.
And obviously there are other Office of Research programs
ongoing that are doing things that are highly relevant to our program
and, in particular, the ATHENA project has been looking at fire as an
area of application. I will talk briefly about that, if we have time.
In October, we prepared the SECY paper, which you received
in your briefing package. Basically, we were told by the Commission to
tell them as to what we've learned from previous fire research efforts,
and this was not just fire risk, of course, and then to inform them if
we were -- or to gain their approval if we were going to do additional
fire research.
We've already started on our fire risk research program, so
that was basically our -- the point of that paper. We did talk about
some of the key lessons that we've learned.
I'm going to talk about some of the outside interactions
that the program is having with industry and international bodies later
on in this presentation.
Program objectives are high level, derived, I believe,
directly from the Office of Research's mission. Of course, they're
applied to the fire risk assessment in particular. I will get to the
detailed objectives, what we're really trying to accomplish, on a
technical level, a little alter in the presentation.
But I just wanted to point out here that we are developing
improved understanding of the fire risk and that's qualitative, where is
the risk coming from, as well as quantitative, what is the risk level.
We are trying to support ongoing activities in the -- particularly with
NRR and along the way, of course, we'll be developing tools and methods
as needed to support these top two objectives.
Again, sort of a high level slide here. We've got a number
of different functions covered by the program. We do have an explicit
task laid out to help identify problems. So hopefully we'll catch
things that maybe we've missed in our initial efforts to identify
issues.
We, of course, are developing information. That means,
among other things, developing databases, providing some preliminary
analysis of the data that we're putting into the databases. We are
going to be performing some technical analyses of specific issues.
We're developing tools.
We'd like to pay a little bit more attention to
communicating results than maybe we've done on the past to ensure that
the results don't just end up as being reports on the shelf. By the
way, Roy Woods is the project manager for this program. Roy is sitting
in the back there. He can help answers questions.
Program management, the only point of that bullet, again,
obviously we are interested in measuring how well we succeed in this
program. This slide here, which was adapted from the other NRC's study
on research organizations, distinguished between outputs and outcomes.
We think that we can measure outputs fairly easily. Outcomes might be a
little bit more difficult to measure. In fact, I'd go beyond might be.
I'm sure they are going to be much more difficult to measure. But we
haven't given a whole lot of thought yet as to how we're going to
determine how well we're succeeding yet and we're just trying to start
the work, to start developing results.
I also want to point out that the output of the program is
in a variety of modes. It's not just tools. We also are developing, to
some extent, guidance, recommendations where appropriate, facts and
knowledge and so forth. So there are a number of different kinds of
outputs coming out of this program.
In constructing the program, there were a number of
conditions that we were working to. One, we are working on a multi-year
program. Right now we have funding through fiscal year 2000. We are
expecting and counting on some coverage or some of our issues by other
programs; in particular, again, with the HRA portion, we've got the
ATHENA project.
One of the issues that we had raised earlier in the earlier
presentation to you was the methods for precursor analysis as applied to
fires. Again, that would be something that would be covered by the
precursor program rather than the fire program.
Of course, there are outside activities ongoing that we're
counting on.
The focus of the program is on improving fire PRAs. So
there are some issues that might be fire protection related that are not
fire PRA related. These issues have received lower priority in our
prioritization scheme.
The philosophy is to improve incrementally over what we've
got. We think the basic framework for performing fire risk assessment
is pretty good. It's basically the same framework that was set up when
the first studies were done and we're trying to improve the elements in
that approach. We think that there is a lot of information out there
that probably could be used better.
Vince mentioned the review of the NUREG reports for hot
shorts. I'm sure that that information is insufficient for direct
quantification of the probability of hot shorts. I hope that there is
information there that will help us as we take a more model-based
approach there, but that's a hope right now. I don't know that we'll
get that for a fact.
We understand that there are some difficult issues out
there. Hot shorts is one such difficult issue. So we'll start small,
we'll look at feasibility studies or scoping studies basically to see
what is the information currently available, can we use that information
to get improved estimates of the parameter of interest; if not, what
would it take to get those improved estimates; for example, additional
experiments. And the purpose of these feasibility and scoping studies
would be to identify what additional work needs to be done.
As I said, we're taking advantage of other programs and
we're trying to develop products as we go rather than wait until ends of
tasks to output reports. So we're trying to get things out sooner to
help some of the other programs, like the IPEEE program in their
processes.
You saw the high level objectives, what we're trying to do
to derive the lower level objectives. Basically the framework we've
used is the fire risk assessment framework, which follows very much
along the lines of defense-in-depth as defined by the fire protection
community. So you're talking about fire prevention or, in the case of
the risk assessment, fire initiation. You're talking about detection
and suppression and you're talking about mitigation.
Mitigation includes both the issue of barriers and it also
includes the safe shutdown concerns.
The fire risk assessment analytical framework, again, as I
said, that falls very much along those lines. You've got the core
damage frequency contribution for a particular fire scenario, for a
particular equipment damage mode and in a particular accident scenario.
That's the IJK index. It is just the product of three terms,
essentially.
You've got the frequency of the fire, you've got the
probability of equipment damage given that fire, and then you've got the
probability of core damage given that equipment damage and given the
fire.
The problem that we've got is that improvements are needed
in all three terms. So we've got a wide range of topics that we have to
cover. So you will see this, in a way, mandates this breadth versus
depth kind of approach that we've taken. We're trying to have
improvements across the board rather than coming up with a definitive
answer in any one particular area.
DR. APOSTOLAKIS: Well, improvements are needed, sure, but
it seems to me that the greatest need is in the second term, is it not?
MR. SIU: It depends how you view it. From a credibility
standpoint, if somebody says do you have the physics right, that's the
second term or that's a contributor to the second term.
Given the uncertainties that we have in the model parameters
and given the stochastic nature of fire suppression, and once you start
folding things together and account for uncertainties, I don't know if
that is the most important term. It's an important term.
Again, from a credibility standpoint, it's really important.
But I'd argue that with the fire frequency, for example, as Dan pointed
out earlier, the frequency of those fires, which are really significant
challenges to the plant, I'm lumping into that term. So the severity
factors, for example, go there.
DR. APOSTOLAKIS: In lambda (i).
MR. SIU: In the lambda (i). And not only that, but that
sets up the conditions that you're using for your fire growth models.
Again, so it's specifying what are those conditions, really. There is a
lot of uncertainty there.
DR. APOSTOLAKIS: But my point is, sure, the uncertainty is
everywhere, but the question is about the improvements.
MR. SIU: Yes.
DR. APOSTOLAKIS: I think that there is very little you can
do about lambda (i). You will have to live with this extrapolation, if
that's the right word. You will have to live with these factors we have
used in the past about severity and the geometry and so on. There isn't
any science you can do there to improve.
I mean, you may have improvements, but these are minor.
Whereas PED is the failure of equipment, right?
MR. SIU: That's right.
DR. APOSTOLAKIS: Cables or whatever it is.
MR. SIU: That's correct.
DR. APOSTOLAKIS: Given that particular fire.
MR. SIU: That's right.
DR. APOSTOLAKIS: And there we know -- and that's where
detection and suppression comes into the picture as well.
MR. SIU: That's correct.
DR. APOSTOLAKIS: We know we don't have very good
distributions for the detection. That's what I mean, that if I had only
$100, then it seems to me that's the factor that would deserve maybe 99
of the 100.
MR. SIU: Sure. If we had $100, it wouldn't do anything. I
understand. But right now, being an optimist, I'll say that we are
putting some money into the lambda (i) term, and we'll see.
DR. APOSTOLAKIS: But you're not going to get much out of
it. That's my point.
MR. SIU: It could very well be. That is actually one where
we are going to be asking for ideas, we're going to issue an RFP, get
people to send us ideas and if there are some good ones out there, then
fund them.
DR. APOSTOLAKIS: You're following the model that I proposed
some time ago, and that is we really don't know what to do.
MR. SIU: What a surprise.
DR. APOSTOLAKIS: You issue RFPs.
MR. SIU: Sometimes we actually listen, George.
DR. APOSTOLAKIS: Nathan, Nathan.
MR. SIU: Sorry.
DR. APOSTOLAKIS: Is it also -- I'm trying to confirm or
modify some of my preconceived ideas here. The PCD,K/I,J.
MR. SIU: Yes.
DR. APOSTOLAKIS: Is that thing in pretty good shape?
MR. SIU: Again, you've got the issue of the human
reliability, that's a big issue. You've got the issue of the circuit
interactions, that's a big issue.
DR. APOSTOLAKIS: Okay. So the circuitry. Okay.
MR. SIU: And the hot shorts is part of that.
DR. APOSTOLAKIS: Okay. Very good.
MR. SIU: So what are we really trying to do? At least
these are the objectives that we have identified that we are currently
working on in some fashion or another or will start working on this
fiscal year.
We've talked already about the first bullet, the improved
estimates of the frequency of challenging fires. Again, the hope is
that using more model-based approach, which will allow us to bring in
evidence, if not data, from other industries, that we might be able to
say something about that. I don't know that for a fact, that we will be
successful there.
DR. POWERS: I notice that nearly all of these on the
current detailed objectives begin with the word "improved."
MR. SIU: Yes.
DR. POWERS: And you're looking at an evolutionary nature of
things. You can always improve something.
MR. SIU: Yes.
DR. POWERS: And I can do it Friday afternoon before my
performance review and claim that I've done an improvement.
MR. SIU: Yes.
DR. POWERS: Do you have some idea of what kind of
improvement you're looking for?
The magnitude?
MR. SIU: No, not in terms of numbers, in terms of issues.
This is, again, looking at the framework, understanding how
these terms are estimated, and the problems that arise during that
estimation process, problems that other people have raised, why is the
fire risk assessment more or less credible?
These are things that come out now, so they're specific
concerns that we have to address.
DR. POWERS: So, the improvement is to be able to address
the concern.
MR. SIU: Yes.
DR. POWERS: Okay. So, you do have some idea.
MR. SIU: But not numerically. We have a target, yes.
DR. POWERS: You have some idea.
MR. SIU: Oh, yes.
DR. APOSTOLAKIS: And the concern may be that we get very
conservative results.
MR. SIU: Oh, yes. You know, I mentioned this at the last
briefing, when we were talking about Quad Cities, I believe, when we
were talking about feed pump fires.
DR. APOSTOLAKIS: Now, there is one area where improvement
can be immediate. Can you advise your secretary to put a staple in the
upper left corner rather than the lower left corner? All of the
view-graphs yesterday and today were like that, and it really is
annoying.
DR. KRESS: That's an evil of automatic stapling on the
xerox machine.
DR. POWERS: On a more directly applicable point, though I
sympathize with Professor Apostolakis, I would very much like to see, at
your convenience, this same slide and where you have a specific issue
that you're trying to resolve.
MR. SIU: We actually might get there.
DR. POWERS: Okay.
MR. SIU: I have supplementary slides which we can go into
more or less depth about the specific tasks and the objectives of those
tasks, and we can talk to the concern at that time.
DR. POWERS: That satisfies my concern. You don't have to
say I have to have a 25-percent reduction to say that I have some idea
of what I -- what will cause me to say that yes, verily, I have
improved, other than my Friday afternoon solution.
MR. SIU: In the case of the first bullet, in particular,
we, at this point, don't have a really good technical basis for that.
DR. POWERS: Improved modeling tools for risk-significant
scenarios might well say I can't address these issues -- by the time I
am done with this, I will be able to address these issues.
Now, someone may come back and complain, well, yes, he
addressed it, but it was very conservatively done. Okay. Fair enough.
MR. SIU: In the case of the fire modeling tools, the
emphasis at this point is almost more on identifying the limitations and
uncertainties in existing models rather than trying to go ahead and
develop the next.
DR. POWERS: That, too, is fine. Certainly in our work on
neutronics modeling, identifying where the sources of uncertainty is is
the big challenge. We may never resolve it. We just need to know what
they are.
MR. SIU: Let's see. Thermal fragilities for cables --
there again we're talking, clearly, about the probability of damage
given a certain exposing fire. Right now, our metrics are in terms of
temperature, and we may -- we'll probably still stick with them until we
come up with different fire models.
DR. MILLER: Is that what you mean by mode specific?
MR. SIU: Mode specific would have to do with how does the
failure actually occur, is it a short circuit between conductors, is it
a short-to-ground.
DR. MILLER: Now you've got me confused. I thought it would
mean that you had a fire that caused the insulation to fail, and that
would be the fragility of the insulation.
MR. SIU: It will go beyond that. It will get to the
particular failure mode of the cable. So, we're talking about, again,
conductor to conductor, conductor to ground.
See, this is kind of a fuzzy area in the assessment, because
right now fire risk assessments don't explicitly model circuits. They
say if I have a short or if I fail a cable, I've lost the component, and
then they go on.
At some point, we're going to have to bring the circuit into
the analysis, I think, and this I would include in there, even though --
and maybe you might say that's really part of the core damage analysis
rather than the cable failure.
DR. MILLER: Will that also include cables where, in a
sense, you have -- for whatever reason, you have too much current in the
wire, that causes it to overheat, and that type of thing?
MR. SIU: It conceivably could. I mean that will get back
to -- it may be that, once we start modeling fire initiation, what
caused the fire and we get to your line fault, for example, yes, you
might have that, but I don't know yet if we're going to go to that
level.
DR. APOSTOLAKIS: I think -- it's not necessarily a
criticism of this, but when people propose a research program, sometimes
they get into trouble by using the word "improved."
I would revise the slide, and maybe, if it is, in fact, the
case, emphasize that first you want to make sure you're addressing the
issue of completeness, that there are certain possible impacts of fire
that are not included in the present methodology -- smoke is obviously
one, the cable issues that you just discussed -- that's unfair that they
are not included, that are modeled very poorly in this case, and that
maybe the human performance under fire conditions and that your first
task or your first objective, actually, not task, is to make sure that
you have a fire methodology, fire risk assessment methodology that is
fairly complete, and I mean you don't worry about improving the
estimates of lambda to the same degree as you worry about including
smoke, because right now we do nothing in smoke.
MR. SIU: It may be -- I guess, you know, I'm bringing my
own biases to this process. I tend to think that it's actually more
important to work on some of these terms, that these are larger sources
of variability than the issue like smoke.
DR. APOSTOLAKIS: But the thing is that, if something is not
included at all, it really creates --
MR. SIU: Which gets back to your point that it's unfair,
maybe, to say that smoke isn't treated.
I mean you can argue that, if you are doing a screening
analysis that says that you've lost everything in the room whenever you
have a fire, you know, for whatever mechanism -- okay -- now, that
doesn't account for, of course, the possibility that the operator
actions are impeded by smoke or that suppression efforts are affected by
smoke.
So, again -- but in a screening sense, you possible could
come up with a bound on that impact, and I guess my feeling at this
point is I don't think it's as important as some of the other things
that we're looking at. It's not that we're not doing anything on it,
but in terms of prioritizing.
DR. APOSTOLAKIS: Somehow, improving the estimates of the
frequency of challenge of fires, which, you know, you already have
frequencies, you already have a lot of subjectivism there, and you know
you can eliminate some of it but not all of it, cannot be on the same
level as including smoke effects or making sure that you understand the
mold-specific thermal fragilities of cable. That's what I'm saying,
some sort of prioritization, probably, which, in the actual program, you
may be doing already.
MR. SIU: We've gone through a prioritization to get to this
point. You know, it hasn't been a fantastically rigorous
prioritization. We've looked at in a lot of factors. We've gotten
input from a lot of folks. You know, we've tried to avoid the problem
of spending more time on prioritizing than actually doing something.
But no, I understand the point.
DR. APOSTOLAKIS: Anyway, that's a comment.
MR. SIU: Okay. Thank you.
By the way, regarding smoke, we are participating in our
experiments with Sandia. This is another program that's ongoing,
actually an NRC program funded by the Office of Research from the I&C
branch, looking at digital equipment and the effect of smoke on digital
equipment.
DR. MILLER: I was going to ask whether you were interacting
with that program.
MR. SIU: Very much, yes. In fact, the same people who are
doing that are working with us. So, we are obviously benefitting from
the work being done there.
We're going to provide some incremental funding to do a few
additional things, but we hope to get some sort of recommendations as to
whether there are scenarios that are significant from a smoke fragility
standpoint sometime, actually, this fiscal year.
DR. POWERS: I see in the literature, without being rigorous
in my perusal of that literature, that the military has looked at fire
fragilities of digital equipment and things like that. Is there
anything we can draw from that, or is that primitive?
MR. SIU: Honestly, I don't -- I mean I would always assume
that there is something that we can draw from it. Have we looked at it
seriously, I don't know if we have -- if the contractors have at this
point.
There are, as pointed out yesterday, lots of things going on
in the world of fire, and we need to bring as much as we can into this.
DR. MILLER: I would think the airline industry also have --
MR. SIU: Yes. They've had interest in smoke, and that
interest has increased fairly recently. You know, again, the folks
doing this work for us are plugged into these different areas.
DR. MILLER: The airlines, over the last 10 years, in their
electronics have gone from control with pneumatics and so forth to
control with electrical circuits. So, I'm certain there's been some
substantial work. I think Boeing has done a lot of work.
MR. SIU: One of the things, of course, is that we need to
make sure we treat this in the context of the nuclear power plant risk
assessment, and so, it's not only whether the component is susceptible
to smoke, what level of smoke might you see in the sub-compartment of
interest, how likely are the different levels of smoke, and if it turns
out that it takes an awful lot of smoke to cause any kind of problem,
that's an interesting indication from a risk assessment standpoint.
Okay.
We are going to have to do something about fire barriers.
This is an issue that's come up in the past. There have been estimates
of fire barrier reliability in previous PRAs. We're not sure about the
basis for these estimates. Have done some preliminary looking at that,
we think that work needs to be done there.
By the way, this is not in order of priority. This is
simply a breakdown based on that framework that you saw earlier. You
can group these objectives into the initiation, into the equipment
damage, and into the core damage terms.
But we have -- we're looking at detection and suppression.
Our emphasis right now is on suppression just because that's something
we think we can get a handle on sooner.
We do have concern with HRA, and I mentioned that a number
of times.
I mentioned circuit interactions already, and one thing we
are also doing -- this comes under the banner of identifying areas for
improvement -- we are looking at actual fire events, not only in the
U.S. but internationally, and these are nuclear power fire events, to
make sure the issues raised in those events are, indeed, covered by our
risk assessments.
So, the Narora fire, for example, and the Vandellos fire are
particular examples of fires that we're looking at.
DR. POWERS: I have to say that one of the things that I
find when I read probabalistic-type arguments in connection with circuit
failure analyses -- I come away with the strong feeling that the author
of those probabilistic analyses, if asked, could Browns Ferry events
occur or not, would conclude that they couldn't.
Somehow we have to confront our own fire as well as Narora
and a few others like that, and undoubtedly other industrial fires offer
us opportunities to validate codes. I think it's very important that we
not end up with models that predict bumblebees can't fly and that Browns
Ferry didn't occur.
MR. SIU: Obviously, we're very sensitive to that. I had
come to the same kind of conclusion when I heard the industry
presentation on Browns Ferry at the circuit failure workshop, and it
seemed like a lot of spurious actuations had, indeed, occurred.
Whether or not you'd call them hot shorts in some sense
doesn't matter from the PRA perspective, and so, what we need to do --
and that's why the title is, indeed, circuit failure modes, because we
are trying to see what's the likelihood of these different failure
modes.
Browns Ferry, of course, was a data point, and we want to
dig into that data point in detail, learn more about circuits actually
affected.
Okay. This is what we're working on right now.
We've got a task looking at circuit failure mode and
likelihood.
This is a task that's basically trying to assemble available
information to see if the information is sufficient to make some sort of
credible estimate of the likelihood of different circuit failure modes,
and again, I would presume that's going to be a model-based approach.
I can't say very much about this, because we haven't gone
very far in this direction.
DR. MILLER: That's going to be internal, or that's going to
be a contractor?
MR. SIU: This is a contractor, this being done at Sandia,
yes.
DR. MILLER: I assume, again, you have the interaction with
the I&C group on that one.
MR. SIU: Yes. This is a task where, obviously, there's
some probability of failure that we won't be able to come up with the
estimates that we'd like to, and so, part of the task involves
identifying areas where we need to improve the state of knowledge, to
get more information, basically, so that we can, indeed, make credible
estimates.
DR. MILLER: Yesterday we had a presentation by NEI, and it
seemed like they were going to do about the same thing.
MR. SIU: Yes.
DR. MILLER: Are you interacting with them?
MR. SIU: Right. We've been interacting with NEI on an
informal level.
At one point in time, it sounded like perhaps they were
going to use the results of our work as part of their work, and now it
looks like they're pursuing this somewhat independently. Let me talk
about the interactions with other activities somewhat later in the
presentation, because there are a lot of other programs that we're
interacting with.
Fire modeling -- again, our objective here is, initially at
least, fairly limited. We're collecting data on a variety of issues
such as the failure temperatures of cables, for example, also on the
flammability characteristics of cables, and we're assembling information
that we'd already generated in the past on the results of some fire
experiments that had not yet published the results of those experiments,
so this is all being put together to assemble information that we can
pass on to other folks as well as our analysts.
We are performing some limited analysis of the data. For
example, we supported the IPEEE program recently with a particular
aspect of the heat transfer modeling and the validity of that model
given the lessons we're learning from the experimental data.
We have a project at the University of Maryland looking at
the model uncertainty, and we expect to also start something up with
NIST, looking at the fire models and talking about the applicability of
those models to different regimes, and I mentioned the smoke experiments
already being performed at Sandia.
I talked about the task we have ongoing looking at
experience from major fire events, and the Athena project, also I
mentioned this, looking at the impact of fires on operator performance.
Staff -- and Moni Dey is the staff person working on this --
is looking at the risk significance of turbine building fires, and we
also are looking at penetration seals from the standpoint of whether
current risk tools are good enough to prioritize those penetration seals
for various purposes, and Moni is the staff person working on that, as
well.
The fire risk assessment review for risk-informed
performance-based applications -- that's the work that led to the draft
NUREG-1521. That's also being done by Moni.
Roy Woods is working on an expansion, essentially, of the
SECY paper which is summarizing all the fire research performed by the
NRC, going through that SECY paper. Writing out the paper was, I think,
a useful experience. It puts a lot of information together for others,
and we figured we might as well make that available to the broader
community.
DR. MILLER: The list of topics I find interesting. There's
only one where you identify specifically real experiments going on.
MR. SIU: That's right.
DR. MILLER: Otherwise, we're collecting data and we're
doing modeling.
MR. SIU: That's right.
DR. MILLER: Is that implying that there's experiments going
on in other parts of the world and you're going to collect their data,
or does that imply we're not going to do any experiments, we're just
going to do modeling?
MR. SIU: That gets back to the style. The assumption here
right now is that we will try to make the best use of available
information, and where there are gaps --
DR. MILLER: We'd certainly encourage that.
MR. SIU: -- where there are gaps, we will identify those
gaps, and if we need to plug those gaps with additional experiments,
we'll identify it at that time.
The feeling was, going into the project or the program, that
we didn't have enough resources to really have -- to be able to get into
experiments right away.
DR. MILLER: I go back to IEEE, which was 1984, which is on
cables and so forth. Does that imply that 1974 was the last time we had
any real data to build up an IEEE standard on? Maybe it does. IEEE
would keep up on things. So, I'm now concerned we're basing everything
on 1974 data.
MR. SIU: There actually have been quite a few experiments
not aimed specifically at fires, necessarily. For example, with the
environmental qualification tests, some were done at Sandia, which we
feel are relevant, may not be directly applicable -- again, we're not
looking for information that we're going to get a numerator and
denominator, divide, and say this is your answer, but the point is to
try to use that information better before we start defining new
experiments.
Now, there are experiments going on in other parts of the
world, too, as you may be aware. The French have performed some
experiments. IPSN, for example, have done some experiments not so long
ago. We are getting information from them, as well.
So, we'll try to collect, but again, it's just a matter of
philosophy that we've adopted in this program, and your feedback, of
course, is welcome on that.
DR. APOSTOLAKIS: Now, what is Maryland doing on model
uncertainty?
MR. SIU: Maryland is developing a framework for -- which
would, first of all, of course, define what we mean by model
uncertainty, how we quantify it.
DR. APOSTOLAKIS: Model uncertainty in the whole process?
MR. SIU: Model uncertainty as a general term, and then they
will be applying it both to fire modeling and to thermal hydraulics
modeling. The thermal hydraulics obviously is outside the scope of our
program, but it is being -- it's part of the collaborative effort with
NRC. And again, I can go into a little bit more detail on these things
-- I'm not sure I have much on that particular program in your slides.
Okay.
Things that we hope to start this year or really need to
start this year -- additional work on the fire initiation. Again, we
talked about the -- you can call it severity factors, fire frequency
specialization, something to better characterize the likelihood of
different kinds of fires.
DR. POWERS: I really don't understand the use of the term
specialization.
MR. SIU: You're taking a fire frequency, typically for an
area like a cable spreading room, and then you're saying, well, some
fraction of that is applicable to fires in this particular part of the
cable spreading room with a specific frequency -- I'm sorry -- severity.
Okay. So, it's specialization in that sense. You're allocating
frequency of fires within that global fire area.
DR. POWERS: Is this akin at all to the practice I find in a
lot of uncertain areas where we take frequencies of rare events and
break them down into sub-frequencies, all of which we put half so that,
by the time we multiply it enough, one-halfs together, it goes away?
MR. SIU: Akin. Akin. Actually, what happens here -- in
the oldest studies, the severity fractions, as they called them, tended
to be pretty small, could be quite small.
What's the likelihood of having a three-foot-diameter oil
fire in the cable spreading room, in this particular location, and the
general consensus was that, boy, that's pretty unlikely, but if it does
occur, you're in trouble. So, it was put in the study at that level.
More recently, the severity factors have been less
aggressive, if you will, maybe an order of magnitude reduction, but now
they're being used in concert with credit for fire suppression systems,
and now, when you start multiplying those numbers again, you can knock
the fire risk to a lower level, and the question comes up, have we
properly accounted for differences now between those two factors?
So, these are some of the things that we have to look at.
I mentioned the self-ignited IEEE 383 qualified cable fire
frequencies. Certainly, there is a concern here. Some of the studies
we've seen have screened out areas which otherwise would be important
because of the presumed low frequency of fires.
Now, I'll say cable fires are relatively infrequent events
at plants. We know that. And so, we really don't have a strong
empirical database for dealing with this.
Again, that means we have to go back to the experiments, but
to take those experiments, somehow bring that information into the risk
assessment.
DR. MILLER: I might just mention I got the latest version
of IEEE 384, which is separation criteria, and the appendix -- this is
written in '92, of course. They talk about cable testing programs.
So, you might want to go back and look at that. It's in an
appendix, so it's not part of the standard, and they even say there was
even a conference in 1988 on this whole effort. That fire was started
by overheating of cables by too much current, that type of thing.
MR. SIU: Yes.
DR. MILLER: Okay.
MR. SIU: As I mentioned, we're going to be doing some work
on detection suppression analysis.
We're going to be trying to develop tools to estimate the
reliability of these systems which are sensitive to both configuration
of the system, which they are not at this point, and to the conditions
under which they're applied.
The fire modeling tool box, I mentioned that we're going to
be contracting with NIST to -- or we think we're going to be, we haven't
set anything up yet -- that would be looking at the limitations of
current fire models and sources of uncertainty, areas of applicability,
but also we're going to be collaborating with them in terms of applying
their state-of-the-art fire models to nuclear power plant situations,
and that's a collaboration where we give them data and they give us
expertise and codes.
DR. APOSTOLAKIS: So, this will replace COMPBRN?
MR. SIU: I doubt it. Well, there may easily be something
that replaces COMPBRN. What we're talking about with state-of-the-art
tools right now -- these are computationally intense kinds of things.
These are computational fluid dynamics codes that we're talking about,
and obviously, it takes a lot of effort to run these codes, it may take
a lot of input. I'm sure that geometry, for example, would be quite an
effort to put in there. So, I can't see using that on a routine basis.
DR. APOSTOLAKIS: But don't they have zone models, as well?
MR. SIU: Yes, they do. They do.
DR. APOSTOLAKIS: You're not talking about those?
MR. SIU: We may -- you know, we recognize that there are a
lot of zones out there. CFAST is one such model that NIST has been
developing for some time. They stopped development not too long ago on
that.
DR. APOSTOLAKIS: Because?
MR. SIU: They're simply focusing on their business
interests. But we're aware of those models, and the point of the model
limitations tool work would be again to say zone models, these are the
pros and the cons, these are what they're able to do.
You know, of course, a lot of folks have looked at different
zone models in the past and said -- you know, often the conclusions seem
to be -- you know, no one model is good for all situations. They have
different performances for different experiments. So, we'd have to be
able to recognize that.
DR. APOSTOLAKIS: But it is your objective at some point to
replace COMPBRN?
MR. SIU: Not yet.
DR. APOSTOLAKIS: Or you don't know yet.
MR. SIU: I don't know yet.
DR. APOSTOLAKIS: So this is in preparation.
MR. SIU: Yes. It could be -- if you could define model
regimes somehow and just say, in this cell, COMPBRN is just fine, as
well as CFAST, as well as something else, and in this cell, don't do
anything but CFD -- that's conceivable you could come up with that.
DR. APOSTOLAKIS: Which is going to kill risk assessment.
MR. SIU: If you do CFD, yes. I am presuming, again maybe a
little optimistically, that you can take CFD results and then bring them
into the analysis process.
DR. APOSTOLAKIS: Is part of your evaluation here the FIVE
methodology?
MR. SIU: Yes.
DR. APOSTOLAKIS: So, FIVE will be scrutinized.
MR. SIU: We've already done some of that work as part of
this heat loss factor thing. I don't know if you were out of the room
when I mentioned it briefly.
DR. POWERS: I think when you present this you ought to make
that explicit, that you're looking at the FIVE methodology. I think
that adds to an already -- the sense that you're addressing the issues
that we have now, your research program, and that makes people a lot
more comfortable with this than just the words "improve."
MR. SIU: Uh-huh.
DR. POWERS: Don't get me wrong. I am not opposed to the
words "improve." I just would like to -- I would like to see a slide
that has your sub-bullets under it that says improve and I measure that
by -- I can address this issue.
MR. SIU: Yes.
DR. POWERS: I am definitely getting the sense that this
program is very closely keyed into the issues of the day, the issues
that we've heard about. Maybe you're going to come in a day late and a
dollar short on fire circuit analysis as its confrontation exists right
now, but maybe you will prevent that confrontation from arising in the
future.
MR. MARSH: We've been working very closely with Nathan and
with the group, and it supports, actually, the interactions that we've
been having with NEI. In fact, NEI is wanting to know how this research
is going so that it is coupled together.
I don't sense that it's going to be a day late and a dollar
short, at least in that particular area.
DR. POWERS: I didn't mean to be critical, but with
research, you never know how it's going to come out exactly.
MR. MARSH: That's true.
MR. SIU: Following our -- the completion of the work on the
-- the broader work on HRA for fire events, which again is being carried
out under the Athena program right now, we'll be looking at the risk of
main control room fires, which will include both the issue of modeling,
operator performance under fire conditions -- well, it will address that
in a specific context, bringing in the issue of circuit interactions, as
well, into that problem area.
I talked about fire barrier reliability analysis already.
I anticipate a number of fire PRA applications issues coming
up just as we go along, just as the IPEEE reviews go along.
One issue that has come up we thought we might take a look
at -- and this is by no means definitive -- is the risk significance of
those fires that could cause transients in multiple units. It seems
that there may be some plants out there where that could be a concern.
DR. POWERS: It is a concern. It is obviously a bothersome
concern. Do you really think that you're far enough along that you
could make something -- say something definitive in that area?
MR. SIU: I would certainly hope we could say what it is
we've learned to date about the issue. The way the IPEEEs have been
performed has tended to focus on single-unit effects, and so, you know,
conclusions haven't necessarily been extracted to say, well, here's the
dual unit effect. So, that would obviously be the first step in this
kind of assessment.
DR. POWERS: Multiple-unit interactions has been something
on the ACRS's agenda for as long as I've known the ACRS, though they're
not thinking specifically in terms of fire.
MR. SIU: Yes.
Let me say, also, at the moment, based on what little I've
seen, I don't think there is any indication that these are
high-frequency events by any stretch of the imagination.
They're low-frequency events, but when you consider the
consequence, you might have to go below the screening frequency that
people typically apply to the single-unit analyses.
DR. POWERS: I think what people are really interested is
are there good multiple-unit sites and bad multiple-unit sites. You
know, are there things that you could do to reduce your vulnerability?
MR. SIU: Yes, right.
Okay. I promised I'd talk a bit about relations with other
programs and activities.
The relationship with the NFPA is -- 805 -- is only to the
extent that I'm helping out on that, on the development of that
standard. Obviously, I'm aware of issues, PRA-related, as they arise
and things that we need to address.
DR. APOSTOLAKIS: Are you a member of the committee?
MR. SIU: Yes.
DR. APOSTOLAKIS: Okay.
MR. SIU: A non-voting member.
DR. APOSTOLAKIS: A non-voting member.
MR. SIU: Non-voting member. NRC has one voting member.
DR. APOSTOLAKIS: That's a consensus vote?
MR. SIU: Yes.
DR. APOSTOLAKIS: So, you are, what, 20 percent of that
vote?
MR. SIU: I don't know what the weighting function is.
DR. MILLER: You consult with everybody in the NRC.
MR. SIU: Yes.
DR. POWERS: I'm going to hold him personally responsible
for some of those entries in 805.
MR. SIU: As well you should.
We have a memorandum of understanding with EPRI. This is
between EPRI and the Office of Research. Basically, that's something
that's fairly new. The idea is to exchange information.
It hasn't gotten to the point where we have identified
places where we can actually collaborate. It's not clear that we will,
but certainly, there's an intent to share information.
We've had interactions with NEI, talking about activities
that they have ongoing. We've asked them to participate a number of
times in meetings, public meetings, where we've tried to determine what
sorts of issues should we be working on as part of this program.
I've talked with NIST. We are going to have, I believe, a
collaborative arrangement with them. Hopefully, that won't take too
long to set up.
Through a variety of international organizations, we are
talking to people who are doing fire research as well as fire risk
research. The French are particularly active, and we have reasonable
ties with them. We've been exchanging reports at this point.
DR. APOSTOLAKIS: How about the Canadians? Don't they have
a large program? Or is it only on building fire safety?
MR. SIU: I'm not aware of a large --
DR. APOSTOLAKIS: They have a research laboratory.
MR. SIU: -- nuclear fire program, and this is focused on
nuclear power plant activities.
We haven't heard anything yet through CUPRA or PWG-5 which
would indicate that they have a lot of activity ongoing.
DR. APOSTOLAKIS: How about the Swedes and the Germans?
MR. SIU: We are interacting with the Germans. The Swedes
-- we haven't spoken with them too much yet.
DR. POWERS: As an anecdote, I once had a visit from
somebody from JRC Innsbruck, and the ostensible purpose of his visit was
to -- he was thinking of setting up a fire program for the European
communities. Has anything happened there?
MR. SIU: I don't know.
DR. POWERS: I may make contact with him again, and if I
find out anything, I'll pass it along to you.
The other thing that happens episodically is that DOE bends
my ear about their beauty contest they have for codes on fire in their
nuclear facilities. Is anything useful emerging from that?
MR. SIU: We've had some interactions with some folks in
DOE. We haven't really gone very far in those interactions.
Specifically regarding code comparisons, I don't know.
DR. POWERS: I honestly know nothing about it except that
the had a beauty contest between codes that were developed at Los Alamos
and PNNL and a few other places like that, but I never see how it came
out.
DR. APOSTOLAKIS: I notice the absence of non-government
organizations, except NEI, which is really nuclear industry as a whole,
but for example, as you know, Factory Mutual Research has done quite a
lot of work on fire modeling, and there are probably other organizations
in this country that have that are not really government organizations,
although most of their work really was sponsored by NIST or the former
National Bureau of Standards.
Are you interacting with them at all, or is that a business
proposition?
MR. SIU: I didn't intend for this list to say these are the
only people we're talking to, but these are the ones where we have some
programmatic interactions.
I mean obviously we meet at conferences, we talk about what
they're doing. Sometimes we'll hear, you know, ideas about
collaborating. Factory Mutual is one that, you know, we've spoken to in
the past. They're not off the list of people that we can work with.
DR. APOSTOLAKIS: You mentioned earlier that NIST is
reviewing models.
MR. SIU: Yes.
DR. APOSTOLAKIS: That will include models from
organizations like FMRC or just their own?
MR. SIU: No, no, it's not just their own.
DR. APOSTOLAKIS: Okay.
MR. SIU: It's the ones that they're aware of.
DR. APOSTOLAKIS: Because they have invested considerable
resources in developing these.
MR. SIU: Of course, some of the people at Factory Mutual
have left.
DR. APOSTOLAKIS: That's true, too.
MR. MARSH: Dr. Powers, I know there's a fairly active group
in Europe that gets together about once every year, with representatives
from the regulatory authorities and from GRS, and they meet at various
places and discuss mutual problems and regulatory concerns and safety
concerns. I think it's not headed up by any particular group, it's more
of a collaborative effort. Again, it's based on a communications scheme
and a yearly meeting.
DR. POWERS: I think that's more pertinent to you than it
maybe is to the research program.
MR. SIU: Yes.
DR. POWERS: I got the impression that JRC was looking
around for relevant research for them to pursue, and fire had come onto
their horizons, enough so that this fellow was trooping around and spent
a little while out in the desert with us and presumably with other
people, and if something came out of that, that would certainly be
something to tap into.
They tend to be able to get lots of folks together, and what
I've seen lately is that they tap into Russian and Eastern European
researchers who are cost-effective for experimental work.
MR. MARSH: Right.
MR. SIU: I will go to concluding remarks, and then I'll go
into the circuit failure supplemental slides just to talk a little bit
more about how we're going after that one.
The bottom line here, if you remember that list of detailed
objectives, we think we're going to make really good progress or
actually complete most of those objectives by the end of fiscal year
2000.
Some of them we expect to have done earlier, actually. For
example, most of the ongoing tasks that I indicated have milestones by
the end of fiscal year '99.
So, this may be optimistic at this point given the rate at
which we've been making progress, but this is the plan.
DR. POWERS: You're allowed to be optimistic in a plan.
MR. SIU: We've had some products to date. Obviously, the
SECY paper was one product. We have supported the IEEE review process
with some of the work that we did reviewing experimental data and
drawing conclusions from that review.
We did provide input to some cable tests that are going to
be performed by EDF, and these tests are in flammability, but this is
something that NEI has been working with EDF.
DR. MILLER: Do you believe you're totally aware of what EDF
is doing as far as research in these areas?
MR. SIU: Not totally aware. Again, we have interactions
with them. We've been interacting more with IPSN than EDF, frankly.
DR. MILLER: I found, fortuitously, through EPRI -- which
EPRI has a relationship with EDF, a formal one --
MR. SIU: Right.
DR. MILLER: -- that suddenly when EPRI went to EDF, more
doors opened than I could ever open or anybody else could ever open as
far as what EDF is doing.
MR. SIU: I would expect to approach EDF through our MOU
with EPRI.
In your supplementary slides, I just have the issues and
prioritization of issues that you saw from the last briefing, just for
your information.
I have a mapping of the areas that we've identified and some
of the -- a different cut at fire protection issues. These are the
so-called FPTAP issues, the fire protection task action plan issues that
were addressed in the SECY recently put out.
What was the number, Ed?
MR. CONNELL: 247.
MR. SIU: 247, yes. And so, this shows the coverage of our
program.
We're addressing most of the issues identified by FPTAP.
There are some that were not, but we don't think that these are really
research issues, or else, we just -- they were low on priority on our
list, and again, these are some things that you can look through perhaps
at your leisure and give us feedback, but I did want to get to the
circuit failure mode.
Again, you can see that the task -- it's very much an
initial look at the area.
So, we're trying to understand the mechanisms that lead to
failure. I mentioned yesterday we're trying to understand the factors
that affect the likelihood of failure.
Factors could be geometric, location within the tray, tray
loading. Obviously, circuit issues come in, as well, the protection of
the circuit, the function of the circuit.
These all affect the likelihood of the thing that we really
care about in the PRA, what kind of equipment effect do you have? Do
you have a spurious actuation of equipment or you have a loss of
function of equipment?
DR. MILLER: That approach, at this point, is gathering of
data that's available from other sources.
MR. SIU: Gathering of data and developing a model to put it
all together in at least a conceptual framework.
If we are able to, we will develop estimates of
probabilities of these failure modes that are applicable to, you know,
representative circuits and situations. It may be that we can't do
that, depending on the kind of information that we have available, and
then I mentioned the last bullet here is identify the areas where
additional work needs to be done, and the second -- the slide S-8 simply
points out what are the tasks that we're performing to try to achieve
these objectives, and they basically mirror the objectives that we have
up on this slide here.
I have also, as you see in your package, slides describing
the other tasks that we have, the objectives and the tasks that we're
performing to try to achieve those objectives, and these are for ongoing
work. We're still developing this for our plan.
DR. POWERS: Our vehicle for commenting on your research
program is actually the research report, it seems to me, and as we
prepare that input to that report, we may have to call upon you for
clarification or additional information, I would think. I don't know
who exactly is going to prepare that. Someone will.
MR. SIU: Okay. Thank you.
Any other questions?
DR. KRESS: Seeing none, I guess we can move on to Alan
Rubin.
Would you like the gavel back now, Dana?
DR. POWERS: You're doing such a wonderful job.
DR. KRESS: When I sit here and listen to a wonderful
presentation like that, it's not a problem.
DR. POWERS: It's an enormously dense presentation. I am
still struggling a little bit to know where the vision is for the end of
the tunnel on all of this, but it looks like we have good vision for the
short term. I'm not sure we have good vision for the long term.
DR. KRESS: It's a lot of information.
DR. POWERS: There is a lot of information in this.
MR. RUBIN: Good morning. I wasn't sure how to start my
talk today, whether the time was going to allow me to say good morning
or good afternoon. So, good morning, I'm glad to be here again.
George is not here, Professor Apostolakis, but I wanted to
apologize for the location of the staple in the slide package.
[Laughter.]
MR. RUBIN: We'll try to do better next time.
DR. POWERS: He's out looking for a staple remover.
MR. RUBIN: My name is Alan Rubin, and I'm a section chief
in the PRA branch in the Office of Research, and I'm heading up the
IPEEE reviews.
What I intend to tell you today is what's new since I
briefed the subcommittee last January in the fire area on the IPEEE
program.
Back in January '98, we prepared a draft report that we
presented to the Commission and provided to the ACRS which was a report
that gave preliminary insights on the IPEEE program based on the reviews
that had been conducted up to that time, which is about a third to a
quarter of all the reviews for the IPEEE submittals. Those were
preliminary reviews.
I briefed the subcommittee and the full committee last
January and February in the fire area and also briefed the risk and
reliability subcommittee on the IPEEE insights, including the seismic
and high wind, floods, and other areas.
So, what I'll do today, rather than go over anything I
presented last year, is provide an update of what's new, what is
significantly different, what we've learned since last year, and there
are three topics I'd like to talk about.
One is going to be interactions with NEI and EPRI. The
second one is going to be a task that we're working on in response to a
Commission SRM to address the question of what's the effect of
exemptions on fire risk, and a third, as you heard a little bit about,
some updates on the perspectives from Quad Cities and their fire
vulnerabilities.
Before I do that, though, let me just jump -- or ask you to
take a look at the conclusions, which in your slide package six, and
this is a reminder of what we said last year based on the reviews that
had been done to date, and these conclusions pretty much are staying the
same.
We think the IPEEE program has been successful in meeting
the intent of this generic letter and that there's been a beneficial
impact on plant safety.
Approximately half of the licensees have made improvements
to their plants in the fire area based on their IPEEE submittals. These
are both procedural as well as hardware modifications.
Third, the question that came up earlier, Dr. Powers, is
fire can be a significant contributor to overall core damage frequency
for plants. We found ranges, if you take out the outliers, of core
damage frequency of about 10 to the minus 7th, on the order of 10 to the
minus 4th per reactor year.
An important conclusion that I know will not change is the
next-to-the-last one, is that comparing quantitative results between
plants is not straightforward.
There's lots of assumptions that go into the analysis.
There's a variability in methods. Level of detail of the analysis make
it very difficult to compare plant to plant, and I want to make that
point, although given numbers and given a list of 70 IPEEEs and the
licensees' estimates of core damage frequency, I know people will line
them up side by side and present histograms and things like that.
The important point is that each individual IPEEE is looking
at plant vulnerabilities, and that's what we look at in our reviews to
see whether licensees can, indeed, identify vulnerabilities and whether
they've made improvements.
DR. POWERS: I could easily take the final E off IPEEE,
final two E's, and this slide would apply exactly to the IPEs.
MR. RUBIN: I think that's correct. And the last bullet
applies, as well.
DR. POWERS: Exactly.
Nevertheless, out of the IPE program, they produced an
insights document that I thought was insightful, and so, the question is
are we going to be able to produce an insights document out of the
IPEEEs that will be insightful, or are we hamstrung because of item
four?
MR. RUBIN: No, we're not hamstrung because of item four.
We will prepare an insights report -- it's called a perspectives report.
That draft report was the one that was issued last year. Once we
complete all the 70 reviews, we will provide a final report at the end
of the IEEE program.
DR. POWERS: I'm sure you would.
MR. RUBIN: And hopefully, it will be insightful. I'm sure
we'll be back here talking to you again and have some insightful
discussions.
DR. POWERS: You do have some confidence that you'll be
able, from the collective, gather some insights about fire
vulnerabilities that's useful.
MR. RUBIN: We talk about where the dominant fire areas
were, what some of the surprises were. Turbine building fires, for
example, can be a significant area for some plants. We saw that at Quad
Cities and maybe some others. So, yes, we will have those kinds of
insights and perspectives in the final report.
I just wanted to cover that, because things haven't changed
from a year ago, our overall conclusions.
To go back to slide two again, just to let you know where we
stand in our reviews, we expected originally to have 74 submittals to
review. We've completed the reviews of all 70 submittals. Four plants
have been permanently shut down. We haven't started the review for
those four plants. And we've completed and actually issued staff
evaluation reports for 10 submittals as of today, and maybe, if our
division director signs off on another one, we may have 11. I'll check
later on.
Let me go into now each of the three topics I had mentioned
earlier.
We have had and continue to have fairly extensive
interactions with NEI and EPRI. Let me just tell you why.
EPRI had issued a fire PRA implementation guide that came
out after the generic letter on the IPEEE program. The intent of that
guide was for -- to provide some additional clarification, reduce some
of the conservatisms in past PRAs, provide supporting technical
information for licensees in doing their IPEEE submittals.
At the time the guide came out, the NRC had not reviewed it
nor approved it or said yes, everything in there is great.
We started to see some of the submittals come in. We saw
references to the fire PRA guide. We looked at the guide itself and
came to some of our own conclusions that, yes, some of the
clarifications and improvements were very helpful in the guide, but
there were some areas that we felt could result, if the guide were used
in certain ways, in the way we had seen it being used, could mask the
identification of potential vulnerabilities for some plants, and I just
list three items on this slide here in which -- this is three of 16,
where we ask some questions to NEI.
One is on the probability of abandoning main control rooms
in the event of a fire, the assumption of high heat loss factors in
rooms that could result in low gas temperature layers in a room, the
assumptions on heat release rates in cabinets, whether taking one number
or whether you have to look at a range of numbers or realistic numbers
for heat release rates in cabinets.
There are some others such as human error probabilities in
the event of a fire, propagation of fire from enclosed cabinets, whether
fire can propagate outside a high-energy cabinet, for example, and
others. I don't think -- you know, I probably don't have time to go
into them all.
DR. POWERS: The subcommittee got a list of the RAIs.
MR. RUBIN: Right.
What we expect the outcome to be is that NEI has just
provided some draft responses to the questions. We expect to have
further discussions to see whether there's any residual issues that
still remain, and as a result, we expect NEI or EPRI will issue revised
guidance in these areas to the industry.
DR. POWERS: Do you have any idea when that revised guidance
would be?
MR. RUBIN: It's on the order of months from now.
DR. KRESS: Would you endorse this guidance?
MR. RUBIN: Well, we're not going to have a reg guide. What
we will do is when -- we've sent 16 questions. We're going to get a
formal response to those questions. We will formally say yes, these are
acceptable, up to a certain point these are good responses, and we think
that this will provide what we need.
The reason we were doing this -- and we're spending a lot of
effort -- is there are at least 15 utilities who have used the guidance,
and rather than getting potentially 15 or more different answers to the
same question on heat -- what's a correct or adequate heat release rate
for cabinets, we felt this was the most efficient and effective way to
complete the IEEE program.
I still think it's the case. It's been a long time to try
and come to a closure on these issues. We're not quite at a closure
yet, but you know, I see the end in sight.
So, once the industry guidance has been sent out to
licensees, we expect each utility that the NRC has --
DR. KRESS: I guess what I meant to ask, Alan, was if you
see any other NRC utilization of this EPRI guidance on the IPEEE.
MR. RUBIN: Could be, yes, particularly in looking at PRAs,
guidance on PRAs, where, you know, we'd like to say, yes, this is an
approach, if you use the guidelines in here, this would be an adequate
way to approach, it could provide a baseline for the use, yes.
Just to conclude with this slide, we expect that, after the
general guidance has been revised, licensees will provide plant-specific
responses to questions that were sent to them, which the NRC will then
review.
This is an interesting question that came up as a result of
Quad Cities.
Quad Cities, as you all know and we discussed last year, had
a very high core damage frequency from fire, and there was lots of
interactions between the staff and Commonwealth Edison, and the
Commission got involved, and NRR and Research.
The Commission and others asked a question -- well, has
there been any contribution from exemptions to Appendix R and other fire
regulations that have contributed to the high core damage frequency
estimates either at Quad Cities or other sites?
So, the Commission, in a SRM on SECY 98-058, asked the staff
a question. Has the cumulative effect of exemptions impacted fire risk
at nuclear plants? And we're in the process of attempting to answer
that question.
We have an outline, which I will just discuss here, on how
we're going to approach that. I can't give you an answer to that
question today.
But two parts to -- sub-parts to that question, what we're
trying to do is say has Appendix R exemption resulted in significant
increase to core damage frequency from fire at plants, and we'll try to
categorize that as having a minimal or no impact, significant impact, or
you know, possible we don't know, we just don't have the data to do the
assessment. That's how we're going to try and categorize exemptions.
Second question or second part of it is to look at have
Appendix R exemptions resulted in significant changes in dominant risk
contributors at sites or have they changed the plant's reliance on
various fire protection features?
We think, if there are exemptions that have affected those
areas, we would like to know and point that out.
So, the approach that we're taking is first to identify from
the IPEEEs a sample of plants that have high core damage frequency
estimates.
We're not verifying those numbers, but we're just taking --
we're taking 10 plants that have on the order of 10 to the minus 4th
core damage frequency, and we're looking at those.
We have compiled the exemptions for those plants. They
range from about three exemptions, typically eight or nine exemptions,
but up to, for Quad Cities, around 20 per unit, roughly.
There's quite a variety of the numbers of exemptions per
plant, but you can't quantify numbers to anything, just numbers of
exemptions.
So, we're reviewing the exemptions in detail. We're looking
at the dominant contributors to risk, the dominant fire sequences, and
see how these exemptions affect those dominant areas and to see if
there's a correlation between the two, between the exemptions and the
dominant sequences.
And we've got some preliminary look at a couple plants,
nothing to speak of to date, but we will have a report to the Commission
in May of '99, and I expect that we might -- you know, you might be
interested in hearing the results of that, as well.
DR. POWERS: I'm quite certain that we would. I'm almost
tempted to ask I wonder if there is any correlation on exemptions and
low CDF.
MR. RUBIN: We talked about that. Should we look at plants
that had very low core damage frequency estimates and the exemptions
that those plants have been granted and see the same thing, but with
limited resources, limited scope, limited time --
DR. POWERS: That's a fishing expedition there, if there
ever was one.
DR. APOSTOLAKIS: The reasons why you have high fire CDF
from the IPEEE in some of the facilities will be identified in a general
evaluation of the IPEEE program, just as the IPE program issued a series
of volumes.
MR. RUBIN: Oh, yes, what the contributors were, yes.
DR. APOSTOLAKIS: And why.
MR. RUBIN: Yes, what the dominant areas were, why, whether
there was was -- you know, Quad Cities, for example, whether -- we'd
looked at, before last week, the impact of human actions, recovery
actions outside the control room, was it separation, things like that,
yes.
DR. APOSTOLAKIS: Okay.
MR. RUBIN: Which is a good segue to my next slide on Quad
Cities, and as I told you, about a year ago, Quad Cities was the only
plant that identified a fire vulnerability from postulated fires in the
turbine building, and they came in with their own estimate of a core
damage frequency of five times 10 to the minus 3 per year.
There was a meeting last Friday, Commonwealth Edison and the
staff, both NRR and Research, and according to the licensee, they have
reassessed their core damage frequency and said their original analysis
grossly overestimated core damage frequency, for a number of reasons.
DR. APOSTOLAKIS: I really don't understand that. I mean
they submit an analysis and then they do the analysis again and it goes
down by two orders of magnitude without doing anything else to the
plant.
So, what happened? I mean they did not review the original
analysis? I don't understand how they can submit a number like 5 10 to
the minus 3 per year to the NRC without doing a detailed cable routing
evaluation, using success paths, using all available equipment. What
went wrong?
MR. RUBIN: That's an excellent question. I have the same
question, and I'm not surprised that you asked it.
DR. POWERS: It's even more serious than that. It's my
impression that, shortly after they submitted the high number, other
disinterested parties were reviewing it and came away saying that they
did not think that it was a grossly conservative number.
DR. APOSTOLAKIS: It puzzles me.
MR. RUBIN: The impact of the submittal had quite a number
of ramifications.
I see Steve West chomping at the bit over there.
MR. WEST: I'm not really chomping at the bit, but since
Alan wasn't at the meeting last week, he's at a little bit of a
disadvantage.
The licensee did -- we did ask that question. In fact, the
licensee was prepared to address that question without it being asked,
and we still need to look at the analysis and to answer the question for
ourselves, and we're planning a follow-up meeting with the licensee to
go over some of the details.
But one of the -- the licensee indicated that a significant
contributing factor was that they had basically ignored the results of a
peer review that they had performed of their analysis before they
submitted it, and we don't know what the results of the peer review
were, but obviously, if they had considered it, they never would have
submitted the original one.
I guess people lost jobs over that, from what they were
saying.
But anyway, we don't have a good answer for you today, but I
think, in the future, we'll have an answer for you after we get through
revised analysis with the licensee and go through some of the details.
DR. APOSTOLAKIS: So, somebody there thought that they would
submit a number like 5 10 to the minus 3 to the NRC and nothing would
happen or maybe there would be a meeting and then that's it?
MR. WEST: I can't speak for the licensee on that. I mean I
think they knew something would happen, because they had even called
ahead of time and gave us a heads-up.
MR. CHEN: My name is John Chen. I'm responsible for IPEEE
review for Quad Cities specifically.
Related to that, last week, they came in and they made a
presentation. This time, they specifically chased the circuit, the
cables. Also, in their original analysis, they have a gross
simplification in their analysis.
So, once you have a fire, immediately you go into utilizing
the emergency operating procedures, but their operating procedures is
very complicated, involves so much human action, recovery actions, and
there is a lot of potential for human errors, and that's the reason why
their original analysis ia a very simplified analysis, relatively
speaking, is rather conservative.
So, this time, they incorporate much more detailed analysis.
DR. APOSTOLAKIS: Who did the original analysis?
Themselves?
MR. CHEN: Themselves. But right now, they still have
themselves, but different people. They have, I think, people who are
more capable or at least understand what the fire PRA is.
DR. APOSTOLAKIS: And what methodology did they use?
MR. CHEN: FIVE.
DR. APOSTOLAKIS: FIVE.
MR. CHEN: The procedure is more or less FIVE, but those
areas which are not screened out, you use PRA. Essentially, that's the
same, but it depends on the modeling itself. You can incorporate
everything in there.
DR. APOSTOLAKIS: So, FIVE really was the screening part. I
mean the 10 to the minus 5 number comes from the PRA.
MR. CHEN: I think the whole thing is there is a
misconception related to FIVE. The FIVE itself incorporates part of
these things in the later phase of the analysis. It's the same as PRA,
okay?
My thinking is that it depends on the person who utilizes
the methodology, who made the judgement about what is screened out, will
make a lot of difference in terms of the entire result, entire outcome.
MR. RUBIN: Also realize that the licensee came in with a
high core damage frequency estimate, identified vulnerabilities, and
identified some fixes that they were going to make.
DR. APOSTOLAKIS: Fixes related to fire risk?
MR. RUBIN: Yes, related to fire risk. Yes, they were going
to look at an independent shut-down system.
DR. APOSTOLAKIS: So now they're not going to do it.
MR. RUBIN: That's correct.
MR. WEST: Well, let me make a couple of points.
First, I think the reanalysis does take credit for a few
changes that the licensee has already made to the program. I don't
remember what the changes were, and if you looked at them, you would say
no way those changes could give you as good a result.
So, I don't think they've taken great credit for that, but
there are few changes, and they have other changes planned, although
some of the changes they had originally proposed to us like the
dedicated shutdown facility, they've decided they're not going to make.
But they are making some changes just to improve fire risk,
not required for regulatory compliance but to improve fire risk.
DR. APOSTOLAKIS: I find it incredible that they submitted
such a number to the NRC. I don't know what they expected.
DR. KRESS: What do you mean it's incredible? The
probability is one.
MR. RUBIN: They were the outlier. We had an outlier on the
low end, also.
MR. WEST: I think a lot of the problem was lack of
understanding of the cable routing in the plant. Alan has on this slide
-- it says reanalysis takes into account a detailed cable routing
evaluation.
A lot of the problems that were revealed in the original
analysis, according to them, now never could occur because the cable
routings are understood.
DR. APOSTOLAKIS: No, I understand that. It's just that
what I find incredible is that they didn't go through this kind of
reevaluation.
DR. POWERS: I guess equally distressing is, if this number
hinges upon cable routing and one licensee takes a crude analysis and
ends up with a high number, is there a possibility that another licensee
too a crude but optimistic analysis and ended up with a very low number?
MR. RUBIN: Their assumption was that the cables in an area
in the turbine building were going to fail, and as John Chen said, then
they go to their emergency operating procedures.
As a result of this detailed cable routing evaluation, they
found that, indeed, the number of cables, particularly the 125-volt DC
cables would not all be affected by the fire. These are control cables.
It affects a lot of equipment that they had assumed was going to fail.
This more detailed analysis leaves more equipment available
to cope with the fire in the turbine building. They have more equipment
available for their success paths to achieve and maintain safe shutdown.
They have, you know, fewer operator actions that are required, less
complicated procedures to follow to recover from the fire, and they've
also done some fire modeling to look at the effects of fires in
different fire areas and determine the impact on equipment and cables.
So, I mean these are four major areas. The main one is a
very, very conservative assumption early on that those cables are going
to fail.
DR. APOSTOLAKIS: All right.
MR. RUBIN: Whether it was limited resources, I don't know.
I can't answer your question as to why it was originally done.
MR. SIU: Just a comment, also, by the way. Almost no
review that we can perform until we really get into details as to where
the cables are would be able to uncover this kind of issue.
So, if a disinterested party says, oh, that number looks
credible, obviously there is an assumption as to -- that they got the
cable routing right.
DR. APOSTOLAKIS: Okay.
MR. RUBIN: Okay. And licensee will resubmit their IPEEE
analysis, and we'll review it carefully.
DR. POWERS: Also its cable routing information, I hope.
DR. APOSTOLAKIS: Without making assumptions about cable
routing.
MR. RUBIN: For the scope of our review, except for unusual
circumstances, we look at what's given in the submittal, and sometimes
-- we have gone on a couple of site audits.
DR. APOSTOLAKIS: Okay.
MR. RUBIN: Okay?
DR. APOSTOLAKIS: Okay.
MR. RUBIN: Any other questions? If not, thank you.
DR. POWERS: I'd say we've come to the part of the meeting
that I wanted to know things to bring forward into the full committee.
It seems to me now that the staff is in the act of preparing
a paper for the Commission on fire protection functional inspection, and
their schedule is such that there would be something for the March
meeting.
MR. MARSH: Let me clarify what I told you. We did get
indication back that the Commission would like an interim report on the
FPFI status in advance of the Commission meeting in February.
So, there will be an interim report. It will be two pages.
It will give a rough status. You've heard much of it in the last couple
of days, but there is going to be a letter to the Commission on that.
The real analysis of FPFI and the recommendation will be in
the March-April timeframe.
DR. POWERS: I would suggest that discussion of the FPFI
before the full committee should await that real document. Your interim
report, I think we can communicate to the Commission adequately based on
what we've heard without need for staff to appear.
MR. MARSH: Okay.
DR. POWERS: Now, it also is my impression that the circuit
analysis issue is progressing along a pathway that looks to me like it
will lead to resolution --
MR. MARSH: Has potential to do that.
DR. POWERS: -- potential to do that -- and I would prefer
to let that go its course and see how it comes out. So, my suggestion
is we not bring forward the circuit analysis to the full committee.
The regulatory guide is an issue where the staff has
prepared an outline and has invited comment. Our vehicle for making
comment is, of course, comment to the EDO, and I would propose that we
ask that that presentation on the regulatory guide be made perhaps in
truncated form before the full committee to at least allow us to comment
on that formally, if we choose to do so.
DR. APOSTOLAKIS: Especially, I think the staff should talk
about what the scope of this guide is, because that was not -- that was
something we debated yesterday and why this is a wise thing to do.
MR. MARSH: Okay.
DR. POWERS: I would hope that, in that presentation, the
staff could also take one view-graph or so and also indicate the work
that's going on by the BWR owners group that has a similar nature.
MR. MARSH: Okay.
DR. POWERS: Just to inform the full committee.
I believe that NFPA-805 has progressed to the point that
they are inviting comment. Again, our mechanism for commenting is
through the full ACRS, and it seems to me that it would be useful to
have, again, someone make the presentation that Ed made perhaps in
somewhat truncated form, not much, because it was a pretty truncated
presentation.
MR. MARSH: It was truncated because you had heard so much
the day before.
DR. POWERS: That's right.
MR. MARSH: The full committee may -- whatever you think.
DR. POWERS: Well, I think there are half-a-dozen key points
that he wants to get across in there, the basic structure, the fact that
there is a baseline program, a basic program, and then there is this
optional program and a component of risk analysis, somewhat uncharitably
characterized as Prego spaghetti sauce, but you need not feel obligated
to use that term, I think so that the committee has some understanding
of the basic structure on that, and by doing so, then you trigger the
mechanism that allows us to comment backwards on that if the full
committee chooses to.
We can't presume, but what I know is that that is a
necessary condition for us to comment. It's not necessarily sufficient.
I mean that is a proposal I put forward. Do members have
alternate views?
DR. KRESS: Sounds pretty good.
DR. APOSTOLAKIS: How much time have we allotted?
DR. SINGH: Only one hour. We have a total of one hour
allowed.
MR. MARSH: For this part? For these two presentations?
DR. POWERS: That's right.
DR. APOSTOLAKIS: How about the research program?
DR. POWERS: I propose not to bring that forward into the
full committee.
I mean the way the research report is structured is the
subcommittee has the obligation to provide the input to the full
research program, and so, I don't -- sometime in March or April, I
believe the people developing the full research program are going to
invite managers of the research programs to come forward and discuss
their activities. I presume that they will allude to the kinds of
things that Dr. Siu talked about today.
DR. APOSTOLAKIS: You will also brief the committee, right?
So, you can mention something.
DR. POWERS: I will probably give -- we will give them a
relatively terse oral report and a relatively comprehensive written
report on the transactions of the subcommittee meeting, but I believe
that the research program gets covered through a different mechanism, so
I propose not to bring it forth.
I propose that we do not need to ask either the BWR owners
group or NEI to present before the full committee. Of course, if they
would like to, they're certainly welcome to, but I would propose that we
can summarize for them, for the full committee, what was said,
especially if -- I happen to be very enthusiastic about the BWR owners
group approach to issues here, but I think maybe we can do justice with
that orally without having a presentation.
DR. APOSTOLAKIS: Especially given we have an hour. I think
the NFPA standard could take --
MR. MARSH: That could take some time, yes.
DR. APOSTOLAKIS: So, I agree with you.
MR. MARSH: Should we tailor it that way, to take more for
the NFPA standard?
DR. POWERS: Absolutely. Absolutely. I think we can -- it
seems to me that you can cite the motivation for your regulatory guide
and cite what you're trying to accomplish, the product that you get, and
that's about all it takes there, because I mean you just literally have
an outline, and it's the outline we're commenting on, and I don't know
how many comments we have, and it's for your benefit.
I mean it's gee, we looked at this and it looks great to us
or gee, you left out this item. I mean the committee will decide what
to comment as it chooses. I have learned never to anticipate them.
Any other comments members would like to make?
MR. MARSH: When would this meeting be, the full committee
meeting?
DR. POWERS: It's the February meeting.
MR. MARSH: February what?
DR. SINGH: I think it's the 5th, but I'll call you.
MR. MARSH: We do need to make sure it doesn't conflict with
the Commission meeting.
DR. POWERS: yes.
DR. APOSTOLAKIS: It's already set.
DR. POWERS: It's set, but we clearly are not going to
interfere with commissioners.
MR. MARSH: Or dry runs for those things, too.
DR. POWERS: Yes.
Well, seeing no additional comments, I want to thank all the
speakers.
DR. APOSTOLAKIS: Actually, I do have a comment. It just
occurred to me that, yesterday, I thought -- I was under the impression
that Ed would come today and talk about 805 as an NRC staff member. In
fact, he was an advocate of it.
He spoke of it as a member of the committee that's writing
it. Nothing wrong with that, but I think it should be pointed out.
MR. MARSH: He tried to give you his concerns as an NRC
staff person.
DR. POWERS: I think it's premature to ask someone to look
at this from a regulator's perspective very comprehensively, because I
think there are several difficult issues there that really can't be
addressed until you have a completed document.
DR. APOSTOLAKIS: Well, okay.
DR. POWERS: I thought Ed's presentation was effective, and
I enjoyed it very much. I think all of the presentations were effective
and certainly informative, and I hope that the meeting was of value to
the people that presented as much as it was to the subcommittee.
MR. MARSH: It certainly was to me. I hope it was to the
staff that made the presentations. I appreciate the dialogue and the
critique, and I appreciate the feedback, and I think those are extremely
valuable to us, because some of these things are evolving.
A lot has happened this year. There's been a lot of forces
that are pushing us in different directions, and to a large extent, any
of these programs are out in front of or at least have the same edge of
-- as this agency effort for being risk-informed and for being --
working in the new assessment process.
DR. POWERS: It's my impression that fire stands somewhere
between normal plant operations and NMSS in its maturity in the
risk-informed area.
MR. MARSH: Right.
DR. POWERS: And the challenges that fire faces in becoming
risk-informed give us some insight in the challenges that the rest of
the agency may well face.
I think we have got to find some mechanism to communicate to
the Commissioners the challenge that you face in being able to risk-rank
your findings of inspections and that -- and it is my impression that
they're going to have to invest some money in order to carry that
activity out the way they want to see it done.
MR. MARSH: That activity and effort to do that is going on
as we speak. I mean we are meeting with -- communicating with Region II
tomorrow to try to put in some kind of context the St. Lucy inspection
findings so that enforcement can proceed, and we're caught, because
we're having to use a lot of judgement, you know, which is evolving.
DR. POWERS: If I was to characterize a disappointment in
the research program, I would say that I don't see a target to get to
the point that we have the kind of body of experience with risk
information that we have gotten out of NUREG-1150, and I understand that
the delightful thing about the research program is it's addressing so
many of today's issue in a very gung-ho, let's get it done kind of
fashion, but the fact is I think that, at some point, we're going to
have to have that body of experience with these tools that may not yet
be ready to be applied to it, but that kind of body of experience that
NUREG-1150 gave us on the operational events -- we're going to have to
have that for fire, and that will give you a much better handle for
doing risk-based assessments of inspection findings.
Well, at that point, let me just bring the meeting to a
close and thank all the participants and remind the members that we are
planning a subcommittee meeting in June in Region I.
[Whereupon, at 12:16 p.m., the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016
Page Last Reviewed/Updated Tuesday, July 12, 2016