Reactor Fuels (MOX FFF) - April 10, 2002
Official Transcript of Proceedings
NUCLEAR REGULATORY COMMISSION
Title: Advisory Committee on Reactor Safeguards
Reactor Fuels Subcommittee
Docket Number: (not applicable)
Location: Rockville, Maryland
Date: Wednesday, April 10, 2002
Work Order No.: NRC-322 Pages 1-274
NEAL R. GROSS AND CO., INC.
Court Reporters and Transcribers
1323 Rhode Island Avenue, N.W.
Washington, D.C. 20005
(202) 234-4433 UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
+ + + + +
MEETING
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
(ACRS)
REACTOR FUELS SUBCOMMITTEE
+ + + + +
WEDNESDAY
APRIL 10, 2002
+ + + + +
ROCKVILLE, MARYLAND
+ + + + +
The Subcommittee met at the Nuclear
Regulatory Commission, Two White Flint North, Room
T2B3, 11545 Rockville Pike, at 8:30 a.m., Dr. Dana A.
Powers, Chairman, presiding.
COMMITTEE MEMBERS:
DANA A. POWERS, Chairman
MARIO V. BONACA, Member
F. PETER FORD, Member
GARY L. JOHNSON, Guest Lawrence Livermore
THOMAS S. KRESS, Member
GRAHAM M. LEITCH, Member
MILTON N. LEVENSON, ACNW Member
COMMITTEE MEMBERS (cont.):
STEPHEN L. ROSEN, Member
WILLIAM J. SHACK, Member
JOHN D. SIEBER, Member
ACRS STAFF PRESENT:
MAGGALEAN W. WESTON
C-O-N-T-E-N-T-S
PAGE
Impact of DOE Announced Changes on MOX FFF
Peter Hastings . . . . . . . . . . . . . . . 6
Ron Jackson. . . . . . . . . . . . . . . . .45
Jon Tanner . . . . . . . . . . . . . . . . 76
Gary Bell. . . . . . . . . . . . . . . . . 103
Impact on DOE Announced Changes on MOX FFF and
Summary of Unresolved Items
Drew Persinko. . . . . . . . . . . . . . 112
Safety Analysis
Rex Wescott. . . . . . . . . . . . . . . . 128
Radiological Consequences
Dave Brown . . . . . . . . . . . . . . . . 150
Chemical Safety
Alex Murray. . . . . . . . . . . . . . . . 185
Fire Protection
Sharon Steele. . . . . . . . . . . . . . . 216
Discussion and Adjournment . . . . . . . . . . . 225
P-R-O-C-E-E-D-I-N-G-S
(8:31 a.m.)
CHAIRMAN POWERS: Let's come in order.
This is a meeting of the ACRS Subcommittee on Reactor
Fuels. I'm Dana Powers, Chairman of the Subcommittee.
ACRS members in attendance are Mario Bonaca, Peter
Ford, Tom Kress, Graham Leitch, Steve Rosen, Jack
Sieber and Bill Shack.
We are assisted today by Gary Johnson from
Lawrence Livermore. We all bless that particular
institution. He's going to be consulting with us
especially about the electrical instrumentation and
control system.
We are also assisted by Milt Levenson from
the Advisory Committee on Nuclear Wastes. This should
not be interpreted as our feeling that MOX is waste
but rather that there is an interest by ACNW in the
development of this facility. The purpose of this
meeting is to discuss that mixed oxide fuel
fabrication facility construction authorization and
the DOE announced changes to the application for this
facility.
The Subcommittee as usual have been
gathering information, analyzing relative issues and
facts, formulate proposed positions and actions as
appropriate for deliberation by the ACRS as a whole.
Mag Weston is the cognizant ACRS staff engineer for
this meeting. The rules for participation in today's
meeting have been announced as part of the notice of
this meeting previously published in the Federal
Register on March 22, 2002. I'm sure everyone has
studied that closely.
A transcript of the meeting is being kept
and will be made available as stated in Federal
Register Notice. It is requested that any of the
speaker first identify themselves and speak with
sufficient clarity and volume so they can be readily
heard. We have received no written comments from
members of the public regarding today's meeting.
Let me begin by saying are there any
comments that the members of the Subcommittee would
like to make before we start on our deliberations
today? Seeing none I'm told that Drew Persinko from
the Office of Research will introduce our speaker from
Duke Cogema Stone & Webster.
MR. PERSINKO: Thank you. My name is Drew
Persinko and I'm with the Office of Nuclear Material
Safety and Safeguards not the Office of Research.
First on the agenda there will be two presentations by
the MOX applicant. The MOX applicant is Duke Cogema
Stone & Webster.
The first will be discussion of the
changes to the MOX facility as a result of DOE
announced changes. The second presentation by Duke
Cogema will be on electrical and I&C. We often refer
to Duke Cogema Stone & Webster by the acronym DCS.
With that I will introduce Peter Hastings, the
licensing manager for DCS.
MR. HASTINGS: Good morning. I am Peter
Hastings. I'm the licensing manager for Duke Cogema
Stone & Webster. We appreciate the Subcommittee's
endorsement that MOX is not waste. It's always a good
start.
MEMBER LEITCH: That also has the
endorsement of the ACNW.
MR. PERSINKO: That may be even better.
The subject of my talk this morning is the impact on
the facility and the licensing process from the
recently announced changes by DOE on the surplus
plutonium mission. Please feel free to stop me if you
have a question or if something I say is not clear.
I'll very briefly give an introduction to
the topic and then go into the details of the changes
to the program which includes two primary unrelated
changes by the way. The first of which is the
processing of plutonium that was previously slated for
a mobilization through the PIP facility. P-I-P.
Plutonium immobilization plant facility which has been
canceled as part of the DOE decision. The second is
a change in the waste processing regime at Savannah
River for liquid, high-alpha waste coming out of a MOX
facility and the Pit Disassembly and Conversion
Facility.
The plutonium disposition mission
originally consisted of a two pronged approach whereby
some surplus plutonium material was scheduled for
processing through the Pit Disassembly and Conversion
Facility which we refer to as PDCF and then sent to
MOX for production in the MOX fuel. The second prong
of which was send material through the plutonium
immobilization plant. That second prong is the piece
that has been canceled by DOE.
The PDCF obviously remains as part of the
mission as does the MOX facility. This new waste
solidification regime which we'll go into in some
detail will handle liquid, high-alpha waste from both
PDCF and MOX facility. You also will see as the MOX
facility referred to in slides and in discussions as
MFFF, Mox fuel fabrication facility.
Then obviously there are changes to the
environmental report and the construction
authorization request as a result of those changes.
We will go over those in some detail as well.
As I said the two elements of the program
changes are first to process some material originally
slated for mobilization and second to solidify waste
at the Savannah River site in lieu of processing that
material through the Savannah tank farms. The changes
to the facility for the alternate feedstock that is
the buzz word for this material that was originally
slated for mobilization will involve some changes to
the design but we are as with the MOX facility using
very similar equipment and a proven design without
introducing significantly different hazards from the
existing safety basis facility.
With the exception of some changes to the
aqueous polishing line to remove some additional
impurities and some powder pretreatment changes there
is a minimal impact to the remainder of the facility.
There are minimal additional environmental or safety
impacts.
The change to the facility to accommodate
the alternate feedstock materials does result in a
delay in the schedule and a minor change in the design
but it's an impact that allows for the continued
success of the overall program and continued support
of the nationally important vision.
MEMBER SIEBER: How does that extend the
expected lifetime of the facility?
MR. HASTINGS: It doesn't extend the
lifetime but it extends the schedule for going into
construction.
MEMBER SIEBER: But now you're going to
process more material so the facility will operate
longer in order to it.
MR. HASTINGS: There's a minimal impact to
the capacity of the facility because our contract
capacity was originally 33 metric tons of plutonium
which was in excess of the 25.6 tons originally slated
for MOX. The MOX facility will now take care of the
entire Russian agreement scope which is 34 tons. So
it's an additional ton. It's minor change.
MEMBER LEVENSON: Can I ask a
philosophical question on the environmental issue?
Since now there is not going to be immobilization can
you get any credit for any environmental impact that
might have occurred there as a write off against any
you might have?
MR. HASTINGS: That's a good question.
I'm not sure that philosophically that's how we'll
approach the environmental report. I'm not sure that
the staff would approach it that way from the EIS
perspective but it's certainly something to keep in
mind. We do believe that it provides for an overall
reduction in the environmental impact because we're
building less facilities. There's less operations
going on and so forth.
I'll skip over the title slide there.
There are two primary changes as I mentioned: the
waste solidification and the alternate feedstock.
It's worth pointing out at this point that the changes
from waste solidification don't really impact the MOX
facility significantly. They do impact our schedule
because we have to account for the new waste
processing building as part of our environmental
report but it doesn't significantly impact the design
of the MOX facility because we were always going to be
sending our high-alpha waste to Savannah River. They
are just changing the way that they are doing their
processing of that material.
So here we have a summary of the alternate
feedstock and waste processing changes. As you see
here the original 25.6 tons of plutonium and
significant digits notwithstanding all of these
numbers are approximate. The original baseline amount
coming through the PDCF is about 26 tons. There's an
additional six or so tons that was originally slated
for plutonium that will now be coming to the MOX
facility and the balance to reach the 34 tons of
material to meet the Russian agreement is future
declaration of surplus by DOE. That material has not
been identified to date.
MEMBER ROSEN: When you say approximate,
how uncertain are those numbers?
MR. HASTINGS: The numbers that we have
seen are plus or minus a couple of hundred kilograms.
So the six metric tons is on the order of 6,000
kilograms to 6300 kilograms that sort of range.
MEMBER ROSEN: Okay.
MR. HASTINGS: The numbers are reasonably
accurate but they certainly are not to any significant
precision at this point. The significant difference
in the alternate feedstock that results in a
requirement to change the design of the facility is
that the material does include additional impurities
that require additional aqueous processing at the
front end of the facility.
As a separate change and again the change
to the waste processing regime and the change to
accommodate alternate feedstock are entirely
coincidental. They are unrelated. It is fortunate
for us that we are making the changes at the same time
so that we don't have two hiccups in our schedule.
But they are unrelated changes.
As I said the high-alpha and also the
stripped uranium waste stream from the MOX facility
and PDCF will be solidified by Savannah River as
opposed to going through the tank farm. This is a
change that was made by DOE to minimize the risk
associated with possible availability or
unavailability of the tank farms in the future. It
also happens to be responsive to some of the concerns
that have been expressed by members of the public and
others about adding material to the Savannah River
tank farms. As we discussed before we think this
results in an overall net reduction of our little
impact across the program.
Just a little bit on what the material
looks like. As was the material coming from PDCF the
material will be unclassified, oxide powder when we
receive it at the MFFF. It will come in in DOE-3013
canisters as with the PDCF material. It's still
weapons grade material. The plutonium and uranium
content is well characterized but the impurities are
not necessarily. So part of the changes required
include characterization of the in-coming material.
We'll get into that in some detail.
MEMBER ROSEN: What do you mean by
"unclassified"?
MR. HASTINGS: "Unclassified" in terms of
we won't receive Pits. The fundamental purpose of the
Pit Dissembling Conversion Facility not only is to
convert the metal pits into oxide for us to process
but also to convert the material from a classified
form into an unclassified form in terms of national
security information.
MEMBER ROSEN: Okay.
MR. HASTINGS: The baseline impurities are
characterized as you see here by americium, gallium
and uranium. Those impurities are the basic reason
for the aqueous polishing front end of the facility to
strip out primarily gallium for fuel spec reasons. We
also strip out the uranium and americium in those same
steps.
The alternate feedstock is broken up into
several categories depending on the content of the
impurities. Feed Type 1 is similar to the current
PDCF spec but it's material that was going to go to
immobilization. So Feed Type 1 would require by
itself very little in the way of changes to the
facility. That amounts of about 1,000 to 1,200
kilograms of plutonium.
Alternate Feedstock Type 2 contains
additional salts but not chlorides. The chloride
content is the breakpoint between Alternate Feed Type
1 and Type 2. We see a list of the main impurities
there. The primary impact of the facility there is
the requirement to strip these impurities out and the
waste stream goes up somewhat. Alternate Feed 2
contains chlorides and that requires additional
processing to pull the chlorides out. We'll go into
that in some detail.
Let me back up. Alternate Feed Type 2 I
mentioned -- Excuse me. I misspoke. Type 1 is about
1,000 kilograms. Type 2 is 1,000 to 1,200 kilograms.
Type 3 is between 3,800 and 4,000 kilograms. So it's
about half of the alternate feedstock material. Then
there is a Type U which is material with limited
depleted or enriched uranium content. That's only on
the order of a couple of hundred kilograms. That's a
small amount of material.
There is feedstock that was not considered
for processing by the MOX facility. That's material
that contained significant quantities of thorium,
beryllium, neptunium and uranium, things that would
have represented too much of an impact on the design
for us to process efficiently.
MEMBER KRESS: Do you have to have a
separate processing in line for each one of these
feedstocks?
MR. HASTINGS: Yes. We'll go into that.
MEMBER KRESS: Oh, you're going into it.
MR. HASTINGS: We will go into the changes
to the facility and the process itself. It does vary.
That's an important point. The changes to the
facility are not for the entire 34 tons of material.
The changes to the process, the changes to the
facility are only to accommodate this alternate
feedstock so it will get limited use.
As I mentioned before there are two
primary impacts to the facility to accommodate
alternate feedstock and that's pretreatment of powder
and then some changes to the purification line. We
are again as with the baseline facility maximizing the
reeves of the available experience. We don't believe
we are introducing new hazards or significant
additional risk.
The pretreatment changes are shown here.
The receipt and storage of incoming 3013 canisters or
containers is unchanged primarily because we currently
assume maximum theoretical density for plutonium
powder coming in of 11 and a half grams per cc so
that's already an abounding analysis for that incoming
storage.
MEMBER KRESS: What's the material
density?
MR. HASTINGS: It's in the neighborhood of
four to seven but we use 11 and a half to just abound
the criticality controls. The powder pretreatment
changes are driven by differences in the powder
characteristics including particle size and as I
mentioned earlier, the need to characterize the
impurities. But again this is for the alt feedstock
material only not for the entire feed stream.
So for the powder pretreatment we had a
couple of ball mills to get the particle size down for
dissolution and homogenization and also to control
down stream density so that we don't have to continue
assuming 11 and a half grams per cc for downstream
criticality controls.
We will characterize each can to determine
what the impurities are and determine which additional
processing steps have to be utilized. Also to allow
for an appropriate blending of cans if we get a can in
that has a higher impurity than we like we can set it
aside and reserve it for mixing and blending with
future incoming materials to limit liquid waste and to
provide for isotopic homogenization.
Recanning is a change and an additional
process step to provide for again longer term storage,
recanning of the material and putting it into the
vault for blending flexibility later. This is very
similar to providing for buffer storage in the new
process itself.
There are also additional laboratory
equipment obviously to do that additional
characterization of impurities. You can see that the
various glove boxes here and laboratory processes that
are added. There are also some miscellaneous changes
to the facility that aren't shown on this slide.
Structural changes are one for example. The MOX
processing building part of the MOX facility footprint
has not changed but there are some internal
rearrangement of compartments and so some changes in
radiation zone, HVAC zones, some incidental changes to
the HVAC and electrical I&C design as a result of the
addition of the glove boxes and so forth. We have
added a mezzanine level at one level of the facility
to accommodate the additional laboratory equipment for
example.
The changes to the process itself are
shown here. Again for Type 1 and Type 2 feedstock
there are no significant changes in the process
itself. There are some minor process variables that
get impacted, recirculation and flow rates in silver
recovery for example because of the additional salts.
But the primary change for Type 1 and Type 2 is the
change in the additional salts in the waste stream.
Type 3 is where the significant process
changes occur. It's the changes to remove the
chloride from the feedstock primarily for process
reasons to avoid precipitation of silver chloride for
example. Also this will provide for polished
plutonium that will meet the fuel spec. It also
limits downstream corrosion problems.
I don't mention on this slide but I'll
mention it here there is also an additional process
step for the small amount of Type U, the uranium
bearing material. We added a uranium stripping column
because we may be getting material with uranium
content that exceeds the PDCF spec but it's still low
content but high enough that the plutonium stripping
column wouldn't necessarily have high enough
separation factor to take that uranium out.
I've discussed the process changes to
remove the chlorides. Again it's for process and fuel
spec reasons. It also limits downstream corrosion as
a result of chloride.
We sent the feedstock through a two step
electrolyzing process to remove the chlorine and then
dissolve the feedstock. We send the off-gas through
a filter and then wash it to convert the chlorine into
sodium chloride. This process is based on a process
developed at the La Hague facility in France, the UCD
plant which is a dissolution line for various wastes.
It is a process that was developed by Cogema to treat
scrap material that has both chloride content and
plutonium that they want to extract. So it is a
proven process.
That's the process change. The additional
equipment involved includes a couple of dissolution
lines with a hopper and electrolyzer and then filters
and slab tanks, then the washing column as I mentioned
before and the subsequent storage tanks for the liquid
waste that includes the chloride salts. This isn't
the Type 3. This is the Type U. We also have the
additional uranium stripping column as I mentioned
before.
So the AP part of a MOX facility the
building does change. We're adding a process step so
in that building we insert a process line of about 20
feet or so into the middle of the building so the
building actually stretches. The resulting impact to
the overall MOX facility is less than 10 percent
change in the footprint of the area.
As with the MOX processing part of the
facility, the AP area also requires some interior
reshuffling of spaces and HVAC and radiation zone
changes as a result of that. The waste
characteristics are impacted primarily again by the
Type 2 and Type 3. There are additional salts in the
waste stream. The raffinates volume goes up about 50
percent resulting in an overall increase in the high-
alpha liquid waste volume of about 10 percent.
Also there is a 10 percent increase in the
low level liquid waste volume as a result of primarily
the change in the size of the building. There is a
slight increase in silver content as you see here as
a result of the changes in the efficiency of the
silver recovery unit because of the additional
impurities.
We talked about what this means to the
licensing of the facility. This presentation
originally included information on the schedule change
but I believe the staff is going to cover that later
so we won't go into that in any great detail.
There are two primary documents that we
have in staff review right now, the environmental
report and the construction authorization request.
You will recall that the licensing process for the MOX
facility is a two step process. First construction
authorization is needed which will be granted on the
basis of a favorable environmental impact statement
conclusion and an SER on the basis of our construction
authorization request. Subsequent to that we will
submit the operating license application, the
application for possession and use.
So we currently have the two documents
that I mentioned before the staff. Both of them will
change for reasons that we will discuss. We obviously
need to revise the environmental report to address
alternate feedstock because we are eliminating
immobilization so that element of the mission goes
away. We will be receiving the additional material
that doesn't match the original PDCF spec and the
intended process changes and the waste changes as a
result of that. It will also reflect the fact that
we're increasing the capacity of the plant over its
lifetime from 33 tons to 34 tons.
We did present the original impacts on an
annual basis though so going from 33 to 34 won't
impact things very much. We also did our original
impacts based on the maximum design capacity of the
plant which the annual design capacity of the plant
times the operational life of the plant way exceeds 34
tons. So that should be a trivial change.
The environmental report also will
obviously have to be revised to reflect the changes in
how our waste is processed by Savannah River. We've
talked about that in some detail already so I won't go
into the details on that again. Also we have a number
of RAI questions and clarifications. There are two
that we've responded to but the document has not been
formally revised and resubmitted to incorporate those
changes so we'll take advantage of the opportunity to
go ahead and fold those changes into the environmental
report as well.
The changes will include obviously a
description of the process changes and we've already
discussed what those are, the powder processing
equipment, the chemical processing changes for
chloride removal, the uranium stripping column, the
storage for waste, the additional chlorides and the
small increase in the building footprint.
It's worth noting here that even though
the footprint of the building changes, the disturbed
area associated with the facility does not. The minor
increase in the footprint of the building didn't
create additional disturbed area for the facility in
terms of environmental impact.
We also will discuss the minor additional
airborne effluents associated with off-gas from the
chlorine stripping column. As indicated here, the
clean condensate and stormwater effluents, those are
nonradioactive effluents, will not be changed
significantly.
To continue on, we'll also discuss the
waste processing changes. As I mentioned before, the
liquid waste volume increased by about 10 percent.
That's both the high-alpha waste and the low level
waste. Solid waste volumes are not expected to
change. The impacts of the changes are expected to be
bounded by the analysis that we have already done
because the changes are not that significant in terms
of additional risks or additional consequences.
Now we obviously have to conduct the
analysis to demonstrate that. That's why we can't
send the ER in today.
CHAIRMAN POWERS: This statement really
puzzles me because the physical changes you are
talking about as far as building footprint and things
like that, they are all small. The complexity of the
operation however is quite different now. The
potentials for human error looks to me like they've
gone way up.
MR. HASTINGS: I'm not sure why because
the processes that we are using are analogous to the
processes that were in place as part of the aqueous
polishing process to begin with.
CHAIRMAN POWERS: Just the potential of
mixing one waste stream with another seems to have
gone up.
MR. HASTINGS: We obviously will have to
confirm this but we're not aware that the waste
streams are going to present a problem in terms of the
Savannah River waste acceptance criteria for example.
CHAIRMAN POWERS: I meant the feed
streams.
MR. HASTINGS: I see.
CHAIRMAN POWERS: I mean the whole flow of
work for the facility now has the potential of people
just forgetting what they actually have and mixing it
with something else.
MR. HASTINGS: That's certainly true but
the emphasis on control of a product not for safety
reasons but for product quality reasons to meet the
fuel spec which is verified at the tail end of the
process anyway is going to dominate the controls
associated with this.
CHAIRMAN POWERS: It seems to me that
that's where the big change is going to be. I don't
see how that can possibly be bounded by the previous
calculations.
MR. HASTINGS: Well, when I refer to the
previous calculations bounding I'm referring to
primarily the consequence analysis associated with
normal operating accidents. We've made some fairly
significant conservative assumptions about material at
risk, release fractions and so forth.
CHAIRMAN POWERS: I think I would be
willing to stipulate for purposes of discussion that
your consequence analysis probably are bounding. Now
let's talk about frequencies of getting to
consequences. There I don't think you can be bounding
with the additional complexity involved.
MR. HASTINGS: It's certainly something
we can address. Most of our analysis are done on a
purely deterministic basis so we assume the event
occurs. As you will hear in subsequent presentations
I'm sure, our safety assessment to date has screened
any internal events on the basis of frequency.
CHAIRMAN POWERS: I'm sure that your
analysis have screened things on the basis of
frequency not explicitly because you didn't think
about them.
MR. HASTINGS: We hope we thought of
everything but I understand the point.
CHAIRMAN POWERS: In that regard can you
give us any insight how the events of September 11
have impacted your thinking about the facility?
MR. HASTINGS: Certainly. I'm not sure
it's going to be particularly insightful though. We
understand that both the Department of Energy and the
NRC are in the process of evaluating the adequacy of
the current design basis threat. We're waiting with
bated breadth for either or both of them to give us
additional guidance.
We haven't done a lot of speculating in
terms of what the answer might be because we really
can't predict what's going to happen. We're trying to
stay on top of developments in that area as much as
possible so that we can anticipate what those changes
might look like when they come out. But we've been
talking with the staff and they understand that we are
keenly interested in any developments in that area.
However, we haven't heard significant.
CHAIRMAN POWERS: You said you are
interested in what the NRC is thinking than what the
DOE is thinking about.
MR. HASTINGS: They are actually working
fairly closely together to try and make sure that the
changes that they make on either side of the fence are
at least coherent with one another because we do have
a security regime for our facility that is responsive
to both DOE and NRC requirements. Those requirements
are generally analogous. There's not a lot of
difference between the two. We're as interested as
you are in what the new design basis threat is going
to look like assuming there are changes.
CHAIRMAN POWERS: If someone came down and
said locate this thing significantly underground, how
much of an impact do you think it would have on you?
MR. HASTINGS: I wouldn't want to
speculate. It would significant in terms of schedule
if nothing else.
CHAIRMAN POWERS: Well, schedule I admit
but in terms of facility design, safety analysis,
things like that.
MR. HASTINGS: I would think that the
safety analysis would get easier. I think the design
would get harder. I'm certainly no expert but I would
surmise that the design impact would be significant.
That's admittedly somewhat speculative on my part.
CHAIRMAN POWERS: Thank you.
MR. HASTINGS: Continuing on with changes
to the ER to reflect the waste processing changes.
Again the waste processing changes at Savannah River
impact almost exclusively the ER because it's not part
of our facility so the CAR itself or Construction
Authorization Request that contains the safety
analysis in safety space isn't impacted. But the ER
certainly is because it's a related action.
We will reflect the changes in the SRS
waste processing strategy. Again I'm getting a little
repetitive and I apologize but the Savannah River site
will process the liquid waste in a facility that's not
on a MOX site and we will be doing that in lieu of
going through the tank farms. It will be to process
both MOX facility waste and PDCF waste.
The conceptual design of the facility is
currently underway. We expect the information for the
input to our environmental report which is going to be
submitted in the middle of July that is the amendment
to the environmental report will reflect these
changes.
The process that the MOX facility will use
to get that waste to Savannah River has not
substantially changed though because we were always
planning to pipe it to a Savannah River facility off-
site. Again the waste treatment characteristics
include the MOX raffinate stream and PDCF sources as
one type of stream and then the stripped uranium
stream is a separate stream.
The environmental impact and this is not
an exhaustive list certainly will include construction
impacts from building the waste processing building,
normal and accident releases, impacts for
transportation of waste and deposal of waste. There
are some other changes to the ER as a result of waste
processing and alt feedstock. We will be addressing
all those in the ER that's submitted here fairly soon.
CHAIRMAN POWERS: Your environmental
impact statement should go and address deactivation
and decommissioning of the facility itself.
MR. HASTINGS: I don't recall frankly the
extent to which we treat deactivation.
Decommissioning is not in the DCS scope. We're going
to deactivate the facility and we have on our list of
things to do to define the bounds of what that
deactivation means. It will probably mean getting the
building decontaminated to the point of release and
then turning it over to the Department for some
possible future use. So they have the responsibility
of deactivation. I don't recall frankly what the ER
says about that and how much detail we go into. But
the deactivation of the MOX facility shouldn't be
impacted by the change.
MEMBER ROSEN: The difference between
deactivation and decommissioning is that in
deactivation you don't tear down the facility.
MR. HASTINGS: Correct. You turn it over
to the DOE and they will decide what they are going to
do with it.
The tentative conclusions as a result of
the work that we've done on the ER amendment for
alternate feedstock and waste solidification lead us
to conclude at this point that we're not going to have
significant changes in affluence. We're not going to
have significant increase in individual or cumulative
radiation exposure or consequences from accidents. We
don't expect a significant change in construction
impact either from our facility or the new waste
processing building relative to the impacts that we've
already discussed in the ER that's before the staff
today.
CHAIRMAN POWERS: How much of a change
would have to occur to be called significant?
MR. HASTINGS: I can't answer that
question off hand.
CHAIRMAN POWERS: I mean essentially
you're getting six more metric tons of material to
process. Discounting even the complexity, it's
roughly a 25 percent increase. There has to be a 25
percent increase in the cumulative --
MR. HASTINGS: No. Because we've already
assumed our contract value of 33 tons. That's only an
increase of one.
CHAIRMAN POWERS: Good point.
MEMBER KRESS: Except that could have been
viewed as margin and now you have reduced that margin.
MR. HASTINGS: It could have been but we
didn't. The construction authorization request and
the safety assessment that is embedded within it again
will not require significant change for waste
processing but will require changes for the alternate
feedstock again as with the ER with the updating of
process and system descriptions as we've discussed
previously and confirmed that the safety analysis that
we have done are still bounding or do the additional
analysis that are required to evaluate any new
scenarios and identify any new items relied on for
safety.
As I mentioned we only anticipate a minor
revision to the CAR itself to address the waste
processing changes primarily in terms of the
description of the waste processing regime. As with
the ER, we have RAI responses and clarifications some
of which are still open and staff is going to discuss
that later today that will be folded into the amended
construction authorization request. That's currently
scheduled for submittal in October of this year.
Again staying with the CAR we'll also
discuss as a result of alternate feedstock anticipated
changes on the existing facility as with the ER that
the CAR used significant conservative assumptions so
we don't anticipate that those consequence analysis
are going to be challenged by the changes in the
facility. That's something that we obviously will
confirm before we submitted the amended CAR.
If there are any new scenarios, if there
are any analysis that are not currently bounding, then
it's conceivable that we would identify new PSSCs
which are principal SSCs that is those things that are
anticipated to be relied on for safety. They are not
called items relied on for safety at this point in the
process because we haven't been through the complete
safety analysis but the terms are generally analogous.
As part of a later presentation the staff
is going to discuss changes in the licensing schedule
as a result of the alt feedstock and waste processing
changes. We've certainly talked to them about those
in a couple of meetings and discussions. But the
upshot of it is we are delayed by about a year. That
delay is dominated obviously by the design changes.
We currently are scheduled to submit the
supplement to the environmental report in July of this
year, the amendment to the construction authorization
request in October of this year, and the schedule that
I think the staff is going to show you will provide
for construction authorization obviously assuming
everything goes well in October of 2003 which is about
a year beyond the original baseline schedule.
That concludes my presentation but I'd be
glad to answer any questions.
MEMBER LEITCH: I'm still a little
confused by the changes in waste processing. There is
now going to be a new waste processing facility at
Savannah River but not connected with the Fox
facilities. Is that correct?
MR. HASTINGS: Right.
MEMBER LEITCH: Not on that site. Now
what was the situation previously? Wasn't that always
the case?
MR. HASTINGS: Yes. The original baseline
was for us to send our liquid waste stream to a
Savannah River neutralization facility for
introduction into the tank farm. Instead of going to
the neutralization facility and then into the tank
farm and then presumably to the defense waste
processing facility, we're now going into a
solidification facility to bypass the tank farms and
the presumed DWPF deposition path.
So in terms of the changes to the facility
it's really no significant change. If it were only
the waste processing change we might not have the full
year delay because we don't have to do a lot of design
work to accommodate that change but we do have to
understand enough of the design to do the
environmental report to understand the changes
associated with that document.
MEMBER LEITCH: I just have a little
trouble following some of the flow paths and so forth
as you went through your discussion. I was just
wondering if is there available a simply flow diagram
of the process with the major pieces of equipment on
it.
MR. HASTINGS: We don't have anything
prepared today but we can certainly put something
together. We did have some slides that we presented
to the staff that had some flow information on it.
Unfortunately those slides are proprietary. We
haven't yet gotten the redacted version of those
slides into them. I think we can turn that into a
nonproprietary process flow chart and provide it to
you that might give you some more information.
MEMBER LEITCH: That would certainly be
helpful to me.
MR. HASTINGS: I'll take that as an
action.
MEMBER ROSEN: That certainly would be to
me as well. Maybe we should distribute it to the
whole committee.
MEMBER LEITCH: Right.
MR. HASTINGS: We can certainly do that.
CHAIRMAN POWERS: I keep coming back to I
think it's your slide six and the number of feeds that
you have now. In the original design how many
different types of feed did you anticipate?
MR. HASTINGS: Just one.
CHAIRMAN POWERS: Now you have four.
MR. HASTINGS: Correct.
CHAIRMAN POWERS: Yet the tenor of your
presentation is this is a very modest change. But it
seems to me that the complexity of the operation has
gone up, way up. I'm sitting here wondering why
should the changes be so modest if I've had greatly
enhanced changes in the complexity.
MR. HASTINGS: Well, I'm not sure that the
changes are as complex as perhaps I've led you to
believe. The material will be evaluated upon receipt
and fully characterized for impurities. If the
impurities warrant they will be sent to a separate
process for chlorine stripping or uranium stripping.
CHAIRMAN POWERS: Do you anticipate feeds
coming in times sequence that is you would handle feed
one for some protracted period of time and then you
would be done with that and you would know switch to
feed 2 or are you just going to get these feeds all
willy-nilly?
MR. HASTINGS: I certainly wouldn't
characterize it as willy-nilly but it certainly will
be a carefully controlled process and appropriately
scheduled. I'm not aware that there is an intent to
sequence Type 1 and then Type 2 and then Type 3.
Again Type 1 is processed as per the
normal PDCF spec material with the exception that it
goes through the laboratory analysis to confirm the
impurity level first. Type 2 is very similar. The
only change there is the impurity analysis to confirm
that the only difference between that incoming
material and PDCF spec material is the additional
impurities that will increase the waste stream
impurity content slightly. So the Type 3 material
which is about half of the alternate feedstock
material and the Type U material are the only
materials that take downstream of the laboratory
analysis any significant additional processing.
MEMBER ROSEN: This bears basically on Dr.
Powers' question. This is inherently a batch process.
Is it not?
MR. HASTINGS: Correct. There are
elements of the process that run essentially
continuously but the fundamental process to make a
batch of fuel is a batch process.
MEMBER LEVENSON: Let me ask a question.
If a mistake is made and --
CHAIRMAN POWERS: He himself makes no
mistakes.
MEMBER LEVENSON: And any of the
categories of materials are assumed to be category one
and run through the process, is there really any
safety connotation or is it just that you get off-spec
product?
MR. HASTINGS: You just get off-spec
product. Back in the process all of the material --
CHAIRMAN POWERS: I think that is not the
case. I think that if you ran type 3 feed through
thinking it was type 1 feed that would substantially
contaminate your process system with chlorides with
obvious impacts on corrosion and things like that.
MR. HASTINGS: Well, that's true but it
wouldn't be an immediate impact. It's not going to
create an accident.
CHAIRMAN POWERS: The metal would
certainly think it was immediate.
MR. HASTINGS: But it's not going to
result in an instanteous accident consequence. It's
something that would have to go on for some protracted
period of time uncaught by the plethora of controls
that we have in the facility in order to create a
substantial hazard.
CHAIRMAN POWERS: You wouldn't be the
first to create a latent error that suddenly appeared
as I understand.
MR. HASTINGS: It's clearly something
that's going to require nontrivial process controls.
But those kinds of process controls again are
primarily dominated by product quality concerns.
After all we're a supplier to reactors of basic
components. It is something that's already going to
be in place. This is really just more of the same
types of controls that are already required both for
product quality, for criticality control and for
controlling other hazards.
MEMBER ROSEN: Now that we've started
digging at this let's dig a little more. Let's say it
happens. Now you come up with stuff at the end of
this process that doesn't meet the specs. What do you
do then?
MR. HASTINGS: You scrap it. It goes back
to the front end of the line and gets reprocessed.
MEMBER ROSEN: That's not scraping.
That's reprocessing.
MR. HASTINGS: Well, scrap is a term of
art for this facility certainly. Scrap material is
referred to in our process in off-spec material that
is returned back into our processing and recycled back
into the process. I make this point because you'll
probably see this term in subsequent discussions.
You're right. It's certainly not waste.
MEMBER ROSEN: You respectively start
over.
MR. HASTINGS: Right. There are
provisions throughout the design for capturing and
recycling scrap material. That's the case with the
entire process anyway. If off-spec material is
produced at the end of the line it's returned and
certainly the entire batch would be evaluated for its
quality. You obviously shut the facility down and
find out where your problem was.
MEMBER ROSEN: Well, that's true typically
of chemical processes in the interim stages as well.
MR. HASTINGS: Right.
MEMBER ROSEN: I mean if you get an
interim step that's off-spec you recycle it at the
interim.
MR. HASTINGS: Absolutely.
MEMBER ROSEN: You don't go all the way to
the end and then recycle.
MR. HASTINGS: And that's a very good
point. We certainly do not fail to evaluate the
product at every major step in the process. But the
ultimate product quality is verified at the end before
we ship it off to the reactor customer.
MEMBER KRESS: Excuse me. Why are you
guys doing this? Is this a money making operation or
what?
MR. HASTINGS: You mean MOX in general.
MEMBER KRESS: Yes. You don't make a
money out of this.
MR. HASTINGS: Well, we don't work for
free but we're certainly not in it for the money. I
happen to be a Duke Energy employee as part of the DCS
consortium. I can say very clearly that Duke's
involvement in this process and I think the same is
true for Cogema Stone & Webster as well as all of our
subcontractors is primarily and fundamentally because
of the importance of the mission.
MEMBER KRESS: So if you ended off-spec
quality, you don't really care. You just go ahead and
send it back.
MR. HASTINGS: Right.
MEMBER KRESS: Because you will get
reimbursed.
MR. HASTINGS: Well, we're certainly not
motivated by inefficiency.
MEMBER KRESS: That was my point.
MR. HASTINGS: That is we are not
motivated to be inefficient. We certainly have
provisions in our contract for encouraging efficiency
in the process. But in terms of safety ramifications
there is no impact of off-spec material with the
exception that Dr. Powers mentioned that certainly a
long term misdirected process could result in our not
evaluating conditions.
MEMBER KRESS: I agree with Dana in that
stress grows in cracking the chloride. It doesn't
necessarily mean long term. It can happen pretty
fast.
MEMBER LEVENSON: How about room
temperature systems?
MEMBER KRESS: That's another issue. You
are right. It's just pretty slow at room temperature.
CHAIRMAN POWERS: It seems to me that I
can find lots of corrosion mechanisms at fairly modes
temperatures. It also seems to me that we originally
had a product feed. It was a pretty clean feed. It
was a little bit of gallium and a little bit of
americium in here. Now we're going to get a feed that
has a Duke's mixture of stuff.
MEMBER KRESS: Was that a pun?
CHAIRMAN POWERS: Yes, intended. So now
our quality assurance activities have gone way up at
this facility. Again adding in a complexity I'd like
to see Dr. Shack's reaction if I told him that I was
going to put a lot of fuel in a reactor with copper in
it. Maybe a little lead too, Bill. I mean it does
seem to me that it's more complex than it's been
before. And then add far more than the footprint of
the building or the amount of disturbed ground that we
have is really the impact here.
MR. HASTINGS: It is certainly not a
trivial change to the design. It's minor in terms of
a challenge to the processes that are involved because
the processes are very similar to the polishing steps
that are already involved. But it is a separate
process to address specifically the additional
impurities and embedded within those changes are the
additional laboratory analysis that are required for
all that material so that we do fully characterize
what's in them and make sure that we get it out so
that we do meet the fuel spec.
MEMBER KRESS: You dissolve all this
powder in acid before you use it.
MR. HASTINGS: Yes.
CHAIRMAN POWERS: The good thing is it's
an acid system.
MEMBER KRESS: That's exactly right. The
material is going to be able to stand the chlorine if
they can stand an acid.
CHAIRMAN POWERS: Any other questions?
MR. HASTINGS: With that I'll introduce
Ron Jackson who is our electrical design lead. He's
going to give you an overview of the electrical system
followed by Jon Tanner who will give you an overview
of the I&C system.
CHAIRMAN POWERS: Let me just as a point
of introduction say that following our first meeting
on this facility, we asked specifically that this
subject get a lot of attention because this has to be
one of the more novel features of the facility they
put together. Otherwise it looks like an awful lot of
other processing facilities I've looked at.
In thinking about process facilities I
reminded myself that the last time I looked that PUREX
facility at Hanford that year they had 2,000
misdirected feed operations over the year. Now all
their valving and whatnot of course is done annually.
This electrical instrumentation, computer-control
system that they've created is intended to somewhat
inhibit those errors so I found it quite interesting.
MR. HASTINGS: And let me point out before
Ron gets started certainly without disputing what you
just said that the fundamental design of this facility
is based on a fourth generation design of an operating
facility in France. I think I mentioned to one or
more of you off-line or at the last meeting that I
attended we certainly welcome any or all of you to
come tour those facilities at your convenience. I
think it clearly helps get a handle on it since you
aren't aware of the processes.
CHAIRMAN POWERS: Yes. Since you said I
had swarms of requests for visiting that facility by
a most circuitous route.
MR. HASTINGS: And for that I apologize.
Thank you.
MR. JACKSON: I'm Ron Jackson. I'm the
lead electrical for DCS. I just want to give a brief
overview of the electrical system and the design basis
for it. Our electrical distribution system has
several voltage levels. We get two independent feeds
from off-site at 13.8 kV and then we step the voltage
down to 4.16 kV. We have several large loads at 4.16
kV mostly large ventilation fans and HVAC chillers.
From them we also step down to 480 V where
most of our distribution is done and most of our users
are. We also have 120 V AC UPS system for violet type
instrumentation and 125 V DC system for control power
for switch gear controls, breaker controls, that sort
of thing.
Our design basis consists of having
sufficient capacity and capability to meet all of the
operating modes of the facility. We prevent any
single failure vulnerability. We have electrical and
physical separation for the IROFS equipment. We have
adequate protective relaying and for breaker controls.
We are able to monitor our system and stay on top of
the status of system. We are also able to test and do
surveillances. We're designed in our IROFS for
protection against natural type phenomena,
earthquakes, tornadoes, that sort of thing.
MEMBER ROSEN: Hold on a minute. I'm
coming a little late to this whole discussion being a
relatively new member of the committee. I need to
know when you talk about design basis and all these
things you've listed here whether the standards for
that are the same or similar to reactor plant
standards.
MR. JACKSON: We use our IEEE standards
for the nuclear industry. For instance, 308. Our
separation criteria is --
MEMBER ROSEN: Reg Guide 1.75.
MR. JACKSON: We've committed to the IEEE
standards. 384 for separation. The 1992 version. I
have a slide just a little further on that discusses
that.
MEMBER ROSEN: Okay. So you are going to
talk about what standards you use.
MR. JACKSON: Right. On a high level.
CHAIRMAN POWERS: Mr. Jackson, I really
appreciate this slide two, this nice summary of what
your design basis is is very helpful.
MR. JACKSON: Thanks. In terms of
capacity and capability, as I said we have two off-
site supplies. We come in at 13.8 kV. Both feeds are
capable of supplying the entire facility. We don't
normally run in that configuration. Normally our
loads are split between either side. Just to show you
because I did not provide this in the handout because
it gets a little difficult to see.
CHAIRMAN POWERS: You know you have a
spelling mistake there on that third one.
MR. JACKSON: At a high level this is the
composite configuration of the system. You can see we
have off-site feeds coming from two different feeds
from off-site. The tie breaker is normally opened and
each feed supplies its own 4160 bus through a
transformer. Then we get down into the 480 V
distribution system and what you would classically
call a Class 1E electrical system is this dashed area
in here where emergency diesels are and emergency
buses where emergency loads are supplied.
MEMBER ROSEN: Do they have the same kind
of duty? Do they have to start very quickly or are
they rather --
MR. JACKSON: No. The way our system is
set up if we lose one feed the first thing we try to
do is transfer over and supply everything from one
side.
MEMBER ROSEN: Automatic transfer or is it
manual?
MR. JACKSON: Automatic. If that fails we
have standby diesels that are capable of supplying
certain loads, not every load in the facility, but
certain loads. For instance the sintering furnaces
have no safety and significance but it takes several
days to get them up to temperature therefore we want
to keep them running if possible, those types of loads
as well as being able to supply everything that is on
the emergency bus.
If that standby diesel fails we isolate an
emergency diesel for that particular site. We will
start and supply all of the emergency bus loads.
MEMBER ROSEN: And all of that takes how
long? Are they quick start, rapid start or is it a
slower process?
MR. JACKSON: The transfer is automatic.
The start of the standby diesel is within four or five
seconds, just long enough to make sure if something
has gone wrong and the transfer hasn't happened. We
recently decided to make our start of the emergency
diesel about two minutes, just enough so we don't have
a lot of conflicts and systems fighting each other.
MR. JOHNSON: The application didn't
describe the off-site power system. Is it necessary
to understand outside power provisions at this stage?
MR. JACKSON: We basically are attempting
to have an off-site system two feeds that are to 765
as far as the physical independence of the off-site
power sources. These power feeds come from Savannah
River site via South Carolina Gas & Electric.
MR. JOHNSON: When is that all going to
get worked out?
MR. JACKSON: Right now we are in the
process of all of our work task agreements with
utilities the site supplies us. We're in the middle
of working those details out and I would think by the
end of this year that should all be finalized.
MR. JOHNSON: What kind of substation or
interface will you be having to the off-site system?
MR. JACKSON: That's the detail that we're
working out right now. Originally and conceptually
Savannah River was going to add a couple of breakers
to the two existing substations. We were going to get
our own feed. There is some question about capacity
at this point and a new substation may have to be
built but that's still under study.
MR. JOHNSON: Now you mentioned using the
reactor standards and I guess I have this question
kind of broadly a heck of a lot of the stuff in the
reactor standards really address issues and
environments that are of concern to a nuclear power
plant but it may not be of concern so much here.
765 is a good example. If you look at 765
there is a good chunk of that standard addresses the
fact that you have a 1,000 megaWatt generator hanging
on there and if you lose the plan it can be
destabilize the off-site grid and the need for
continuous supply of power is pretty high.
Presumably you're not going to go apply
every bit of those standards even where they don't
have any useful guidance to you.
MR. JACKSON: Right.
MR. JOHNSON: How are you going to pick
and choose what parts to keep and what parts to ignore
and what kind of interaction do you expect to have
with the staff in making those decisions?
MR. JACKSON: That's been part of our
review process. We've gone through and identified
those standards that we felt were the best guidances
available and that were appropriate. In our
discussions with the staff many of the discussions and
questions have been about whether we should be apply
a particular regulatory guide or a particular standard
that may not have full applicability to this facility
versus a power plant.
So we are going through an evaluation
process and trying to identify those standards that we
felt were applicable. We are committed to using those
portions that we felt were appropriate.
MEMBER ROSEN: Using a deterministic
safety analysis. Is that correct? That's what I
heard earlier that the safety analysis was
fundamentally deterministic. You assume that an event
is going to happen and then go ahead and design for
it.
MR. JACKSON: Right.
MEMBER ROSEN: Now have you gone the final
step which I think is to say okay well if none of this
works we go to station blackout. We lost all the off-
site supplies and both these -- what happens then?
MR. JACKSON: What happens is the most
critical loads we have are the very high differential
exhaust fans. They keep the negative pressure on the
glove boxes so that you don't lose confinement. What
we've done in that case is we have four 100 percent
fans and we have each of them on a UPS. Each UPS has
a one hour battery back-up. So even if we should lose
all power we do have a battery back-up that will keep
those fans running. In fact we only need one of them.
And we have four.
MEMBER ROSEN: But if four fans come on
and they're all running on a battery backed-up power
supply that could last for an hour, right?
MR. JACKSON: Right. Presumably if they
came on the operator would say I only need one of
these. I'll cut three of them off.
MEMBER ROSEN: So he cuts three of them
off and one runs for an hour and you still don't have
power back. You've had a major hurricane or something
like that.
MR. JACKSON: Right.
MEMBER ROSEN: You then could switch to
the second one.
MR. JACKSON: You could then.
MEMBER ROSEN: And then to the third and
ultimately the fourth. Then after that you're --
MR. JACKSON: And ultimately you have
static boundaries that would prevent lose of --
MEMBER ROSEN: What is that? What is the
failure mode? What happens if you lose negative
pressure completely after you go through this whole
series of steps? It's increasing improbably of
course.
MR. JACKSON: Right.
MEMBER ROSEN: But at the very end you
lose the pressure control in each NVAC. Right?
MR. JACKSON: Right. You have no negative
pressure relative to that.
MEMBER ROSEN: And that's the consequence?
MR. JACKSON: That's ultimately what
happened if you lost all of these fans.
MR. KAPLAN: Maybe I can help.
MR. JACKSON: Yes. Gary Kaplan.
MR. KAPLAN: I'm Gary Kaplan with DCS.
Basically if you lose all power the aqueous polisher
parts shuts down safely with loss of power. All the
processes would shut down with loss of power
obviously. The only thing we need running are the
fans. If they shut down then you have basically three
static barriers before you have a problem with the
plutonium powder. They are in glove boxes. They are
in process rooms. Then you have the building outside
of that. So it would have to leave three confinement
areas to get out to the public basically.
MR. JOHNSON: Does the design basis for
the confinement system assuming no power or is power
required?
MR. JACKSON: Active confinement for the
BHD fans requires power. Those fans have to run. We
do everything that we can to keep them running all the
time.
MR. JOHNSON: And my eye sight is not as
good as it was. What size are those fans?
MR. JACKSON: These fans are constantly
changing. But the last rating I saw was 35 horsepower
range. It wasn't very large. That's being
reevaluated now also because there is an ASF impact.
They are adding some additional glove boxes.
We talked about the two independent
feeders, the medium voltage distribution system
supplies 100 percent, each bus can supply 100 percent.
We talked about the normal off-site power being our
normal source of power. We have the stand-by diesels.
Should we lose one or more of those feeds and then
should those diesels fail, we have the emergency
diesel generators that supply just the IROFS loads.
We also run our 480 V system with a high
resistance Wye grounded system. We limit the fault
current should we get a ground to a very low value of
5 amps or so. So we will get an alarm. We'll have a
little time to try to isolate that ground before it
escalates into something larger. So this allows us to
continue to operate while we search out less serious
types of grounds. It certainly limits the fault
current and limits overvoltages.
As far as types of loads that the standby
diesels supply, we mentioned the sintering furnace
that and back-up for fire protection, those types of
loads as well as being capable of supplying the entire
emergency bus. The storage tank for the stand-by
diesels has a 24 hour capacity. These two stand-by
diesels both are supplied from one tank.
MEMBER BONACA: You need them both
simultaneously.
MR. JACKSON: Excuse me.
MEMBER BONACA: You need them both
simultaneously. I mean they are 50 percent each you
said.
MR. JACKSON: The way the plant is
designed we actually have two processing lines and
essentially we've divided the loads between the two
different sides. So if we lost one feeder we would
start one diesel on that side if we couldn't transfer
over to the other side. We wouldn't have to start
both diesels at the same time.
MEMBER BONACA: Okay.
MR. JACKSON: As far as the emergency
diesels go, the emergency diesels are 100 percent
capacity diesels. We only need one of them to run the
supply of the IROFS loads. Those loads are the high
differential exhaust fans and the AC feeds to the very
high differential exhaust fans. Each diesel has its
own storage tank with a 7 day capacity. We start
automatically on a loss of voltage or a degraded
voltage.
MEMBER BONACA: How many do you have?
MR. JACKSON: Two.
MR. JOHNSON: I want to make sure I
understand. Oh, I'm sorry.
MR. JACKSON: Yes. We have the two
emergency diesels.
MR. JOHNSON: And by 100 percent you mean
100 percent of each division?
MR. JACKSON: I only need one HD high
differential exhaust fan to perform my safety
function. So either one will do it.
MR. JOHNSON: Right.
CHAIRMAN POWERS: When you have these
hypothetical disruptions to your electrical supply
system, I guess two questions come to mind
immediately. I mean you're getting your feed
basically from the Savannah River site.
MR. JACKSON: Correct.
CHAIRMAN POWERS: And what's this for you,
a disruption in that feed?
MR. JACKSON: If I'm not mistaken over the
past I forget how many years it's been but there's
only been like a four hour interruption that we've
been told about. It's probably over four or five
years I believe is the time frame. So it's a very
reliable source of power.
MR. JOHNSON: You have drawn our attention
to the sintering furnaces for the reasons that nobody
likes their sintering furnaces to change temperature.
But you haven't mentioned the impact of a disruption
on one leg of our two inputs to computer systems.
MR. JACKSON: Computer systems will be on
UPS power.
MR. JOHNSON: Okay so.
MR. JACKSON: They will just keep running.
MR. JOHNSON: They would never notice.
Not even a hiccup.
MR. JACKSON: Exactly. We did mention
that the VHD fans have their own UPSs. They are in a
similar position. If we lose AC, they keep running.
You wouldn't know it.
Vital UPS is our term for the instrument
type power that is fed from the emergency diesels.
This would be the instrumentation that supports IROFS
equipment. The normal UPS is the instrument quality
power that supports the process. All of the PLCs that
control are fed from this normal UPS system. We have
the same division on our batteries. We have two
normal batteries that supply control power for switch
gear and breaker control and that sort of thing. We
have two emergency power that do the same for the
emergency buses.
MR. JOHNSON: You have an awful lot of UPS
systems in this design and each one has its own
battery. I'm accustomed to --
MR. JACKSON: Well what we've done is we
decided to configure the UPS by hanging an inverter
off of our battery system so we made our own UPS
system in essence instead of buying a packaged unit
for the vital and for the normal.
MR. JOHNSON: Okay. So basically where
the application describes a package UPS now those are
inverters running off of the station batteries.
MR. JACKSON: For the vital and normal
UPS, yes. Now the VHD is a packaged unit. A packaged
UPS.
MR. JOHNSON: Okay. I may have
extrapolated what I read about that to all of them.
Still there are a fair number of UPSs and a fair
number of batteries. I'm used to batteries in nuclear
power plants which take a reasonable amount of
maintenance. What kind of maintenance problems is the
proliferation of batteries through the station going
to cause you and how are addressing that?
MR. JACKSON: The ones that are in the
packaged UPS are sealed type units that should be
relatively maintenance free type batteries. The
others are station type batteries and we'll have the
normal maintenance that every plant has to go through
with its batteries. Periodic discharge. Tests.
Measures of resistance on a cell terminations and
specific gravity. That sort of thing.
MR. JOHNSON: If you are not doing cell
measurements or specific gravity measurements and
those kinds of surveillances on the packaged
batteries, how do you survey them?
MR. JACKSON: We will certainly
periodically have to load test them and test them for
capacity.
MR. JOHNSON: When you mention that the
computer systems were powered off of the UPS at least
on the normal systems there is a provision for back-up
power off of a regulated instrument bus versus the UPS
which then would be subject to the transients that of
loss of outside power.
MR. JACKSON: You mean like a maintenance
bypass.
MR. JOHNSON: Well, nominally a
maintenance bypass. I worked at a plant where over a
five year period we had that kind of maintenance
bypass in effect for about two years and it caused a
lot of mischief. So I guess I would ask Dr. Powers'
question again. Under that kind of configuration,
what are the impacts a transience on the AC power
system in that case or loss of the outside AC would
cause?
MR. JACKSON: Again if we were bypassing
and we had our batteries for some reason out of
service and we were feeding directly off an AC bypass
then if we lost power, it would only come back up when
the diesels came back up. In terms of the process, it
would mean that the process would simply stop.
MR. JOHNSON: Computers can sometimes
reset themselves in odd configurations. Sometimes in
the arrangement where you are putting power on and
taking power off and putting power on again, we can
get some race conditions. What's the process for
addressing these kinds of issues on the design?
MR. JACKSON: That we'll have to evaluate
what kinds of problems we would ultimately end up
with. I don't know if Jon knows. Jon Tanner is our
I&C lead. He might have some input on that.
MR. JOHNSON: Okay. Thanks.
MEMBER ROSEN: Now I'm taking away from
this discussion the conclusion that loss or complete
loss of power is totally a benign circumstance. That
there is no likely safety consequences or feed
consequences from a power loss that gets very severe
in terms of its extent as well as its duration. Is
that correct? I mean has a failure mode in effect
analysis been done for all of the different alternate
feeds that Dr. Powers was worried about earlier on.
MR. JACKSON: Our safety analysis group is
in the process of going that route and doing those
analyses.
MR. KAPLAN: Let me try and answer that.
We haven't analyzed yet all the new changes for AFS.
we are in the process of doing that so I can't address
if the new feeds will any impact on that. But I don't
believe that the new feeds will any impact on that.
Basically the facility shuts down in a
safe condition. The only thing that we try to keep
running all the time are the ventilation systems. If
we lose power to those ventilation systems which we
would call that a beyond basis event to lose power to
the VHD systems which is the glove box. Then we go to
the static confinement. We have the three layers of
static confinement at that point.
I would agree with you at that point we
believe it's a benign condition. We wouldn't want to
be like that for months and months. But you would
eventually get some transport of getting the dust out
of the glove box and into the process room.
MEMBER KRESS: What's the driving force
for transporting that? Just natural circulation?
MR. KAPLAN: That's right. If you have a
stack and notice the stack is out so there would
something like that. But the facility would be shut
down completely. There would be no action going on if
we lost power obviously.
MEMBER ROSEN: But you have four different
feeds and you have lots of different process steps in
the various process lines. You can think of no case
where if flow stops that sitting there whatever that
feedstock was at that particular point in the process
where flow is not in some way keeping the pipes from
being corroded at a very high rate. There is no
nonbenign failure mode I'm trying to think of from a
power loss.
MR. KAPLAN: On the lock side the actual
powder pellets side there is nothing that you are
talking about. If you are talking about the AP side,
we're going to have some liquids in the tanks
potentially.
MEMBER ROSEN: And pipes and pots and heat
exchanges and whatever else you have.
MR. KAPLAN: We also have potential
radiolysis that's going on all the time. If for a
long period of time we had no dilution air we could
have a problem. So right now the plant is designed
with emergency scavenging air. You use your normal
air. You have the scavenging air which lasts for
seven days right now of scavenging air. If we were to
lose all air for a long time we'd have to consider
that.
MEMBER ROSEN: Scavenging air which is air
being pumped or bubbled through ventilation.
MR. KAPLAN: Bubbled air to make sure you
don't reach a certain concentration of hydrogen.
Right. So right now it's designed for a seven day
supply. We don't contemplate losing power or losing
that system for longer than that without being able to
bring in additional air. We would have to consider
that.
The chemicals actually sitting in the
tanks I know the process people said that it would
muck up their tanks and they wouldn't want to do that.
But they haven't come up with any actual safety
concerns other than the radiolysis.
MEMBER BONACA: You said something about
the loss of power to the fans is beyond design basis
before.
MR. KAPLAN: Right. Our design basis is
to keep the VHD fans running. That's what we designed
the facility to do. The glove box fans.
MEMBER BONACA: But you're analyzing the
consequences of losing all power. You just discussed
this now.
MR. KAPLAN: We've discussed it. Right.
We've looked at it qualitatively. That's where we are
with that point.
MEMBER KRESS: So that gets out of your
design basis because of the single failure criteria.
You can stand a single failure therefore it's part of
your design basis. In order to get the loss of all of
it you have to have more than single failure.
MR. KAPLAN: That's correct. Multiple
failures and not be able to repair it.
MEMBER KRESS: Yes that's beyond design.
MR. KAPLAN: That's correct.
MEMBER BONACA: Yes but I mean for normal
nuclear facility that's not beyond design basis.
That's why I was asking. That's a difference I see
there. You have to think about it.
MR. KAPLAN: Okay.
MEMBER LEVENSON: Steve, I think that's a
hypothetical question you're asking but there are
several cases that have already occurred. In their
infinite wisdom when people were ordered to shut down,
I think the PUREX plant at Hanford, they just turned
off the switches and walked away and the columns were
left full of liquid for years. This kind of thing has
happened in several plants. A similar thing happened
in some parts of the Idaho chem plant when it was shut
down. It was just turned off, and people walked away.
Nothing ever happened. We're talking about room
temperature, atmospheric pressure systems which are
much more benign than high pressure. No stored energy
in the systems.
MEMBER ROSEN: Thank you, Bill.
MR. KAPLAN: Can I add one more thing?
Even if we lose all the fans, we still have final
filters through all the exhaust paths in our facility
that are seismically qualified so there will be no
direct release. In fact any outside piping coming in
there are isolation valves and we can shut those
valves also. The only direct path that we could
conceive of if you lost all the pressure controls are
through some doors that people would go in and out of.
They are double locked doors.
MEMBER KRESS: Are these filters for
particulates or for devices?
MR. KAPLAN: They are for particulates.
They're HEPA filters. Multiple banks of HEPA filters.
MEMBER BONACA: So you do have provisions?
MR. KAPLAN: That's correct. We do.
MR. JACKSON: For our IROFS electrical
systems, we are designed to prevent single failures.
Emergency systems are redundant. They are physically
separated. They are electrically independent. Of
course the support systems for instance battery
ventilation room fans are independent so that we don't
have single failure vulnerability there.
We talked about our separation criteria.
We have used IEEE 384-92 as our separation criteria,
an industry standard. In cases where we can't
maintain the minimum distances then we will erect
barriers. We of course keep redundant equipment in
separate rooms.
For our protective relaying and breaker
control, we try to remove faulted equipment
immediately and isolate the minimum portions of the
systems necessary. We also have automatic supervision
of manual and automatic operations. We initiate
automatic operations for switching such as the
transfer if one feeder should be lost. We're also
capable of monitoring the system both on the utility
control network as well as locally at the distribution
equipment itself.
MR. JOHNSON: I'd like to ask about the
controls systems for the electrical system that those
things are getting more and more sophisticated as time
goes on. Are the criteria that are described for
process instrumentation and control systems the same
criteria that would be applied to the design of the
electrical system controls for example diesel starter
or diesel generator control, load sequencers, that
kind of thing? Maybe even packaged microprocessor
based relaying?
MR. JACKSON: On our emergency diesels and
emergency controls systems it's all hard wired. We're
not using PLCs or computers for controlling that
system. On the stand-by system we do have a PLC that
monitors the electrical distribution system. It will
be loading the stand-by diesels. As far as the
criteria we use in general the same types of standards
apply instrumentation side as well as the electrical
side. It's our criteria the IEEE 308, 384, etc.
MR. JOHNSON: I'm wondering about for
example 7432 or the EPRI criteria for acceptance of
commercial software for example. I'm thinking a lot
about embedded microprocessors not necessarily the
more overt networks of PLCs. For example it's getting
hard to buy a mechanical speed controller from
Woodward anymore. If you go to the Switcom, motor
control center vendors, there are a lot of choices for
motor control centers that basically have embedded
microprocessors rather than a network of mechanical
relays. What is the philosophy on the use of those
kinds of systems?
MR. JACKSON: The newer type of equipment
for instance the Smart MCCs are used on the normal
system. The emergency uses the old fashioned well-
proven relay technology. When Jon comes up he will be
able to address a little more about the application of
computer standards as far as software and the
qualification of software and that sort of thing.
MR. JOHNSON: Okay. Thanks.
MEMBER ROSEN: Did you skip the discussion
of seven or was I asleep?
MR. JACKSON: Seven. Yes. Again we
talked about criteria for separation and IEEE 384 is
our criteria for separation. Again we chose to apply
the industry standard as our criteria. We thought
that was the most appropriate standard to apply for
separation criteria.
MEMBER ROSEN: And that's a standard that
is referenced by Reg Guide 1.75?
MR. JACKSON: Right. Although I think the
versions of it, the years that 1.75 represents are
probably 74 some timeframe like that. It hasn't been
updated. One of the reasons that we felt this
particular version of it was appropriate because it
reflects the results of IEEE working groups as far as
actually testing different configurations of cables
under different fire scenarios. The results were
incorporated into this later standard.
As far as testing calibration, all of our
diesels, the emergency and stand-by, are capable of
being synchronized and load tested. Of course we
don't run them parallel to each other. But they are
capable of being fully load tested and we expect to
certainly have a test program that tests them
periodically. You can certainly take one diesel out
of service and test it while the other remains in
service.
Our switch gear/MCCs are drawout type
constructions. Again we tried to divide our redundant
type loads so that we can operate at least one side
and either perform maintenance or testing on the other
side. Most of our normal buses have an alternate
feed. So if one feed is lost, there is typically
another way of supplying that bus.
You can see the primary feeds on a bus.
You have an alternate feed that we can supply the same
bus. It goes right down through the MCC level. We
typically have an alternate feed. You notice no such
connection on the emergency side.
MEMBER ROSEN: Would this facility have
something analogous to the typical tech specs you see
in a reactor plant where if you lost or had a
malfunction of some of these back-up sources that you
have a certain amount of time before you would have to
place the facility on stand-by?
MR. JACKSON: I think we expect to have
something analogous to tech specs. What those are I
think we've concluded that. It's probably an
outgrowth of the safety analysis.
MEMBER ROSEN: Maybe that's a question for
the staff.
MEMBER BONACA: On the same issue, you
talked briefly about the design basis. I'm sure that
the basis for your design of the electrical system has
to be thought in terms of what scenarios do you have
to coop with and what can you exclude from it? I'm
trying to understand. Do you have a logic that you
use? How do you determine that a scenario is remote
enough that you do not have to address it?
I mean you do not have a full blown PRA.
I understand that. But even before PRA, the word
criteria that the industry has always used in nuclear
to define what is an event that you do not have to
consider as part of your design basis. Do you have
some structure criterium, a self-analysis for example?
Why is the loss of all power to the fence
beyond design basis? It has to be that you believe
that that event is such low probably that you don't
have to address it in design. Right?
MR. KAPLAN: That's correct. The
regulation identifies different frequency criteria
unlikely and highly unlikely. It requests the
applicant to define that. We in our CAR in our
further clarifications have defined that basically
deterministically with four items: meeting the single
failure criteria; application of the NQA 1 program;
application of the codes and standards that he's
describing; and being able to detect when your IROFS
systems fail. That way you can repair them or shut
the system down. We think that combination provides
you with good deterministic background.
In addition we've committed to supplement
that deterministic analysis for events that could
impact outside the building with some quantitative
analyses. So for specifically this system and the
ventilation systems we are doing fault-tree type
analyses to quantify and come up with reasonable
liability and availability rates.
MEMBER BONACA: So you do have some
criteria you use.
MR. KAPLAN: That's correct.
MEMBER BONACA: But then you made an
estimation that said that the likelihood of losing
off-site power and the 50 percent diesel and the two
100 percent back-up diesels, it's very low. I could
agree with that.
MR. KAPLAN: And the batteries.
MEMBER BONACA: All right.
MR. KAPLAN: The four batteries.
MEMBER BONACA: Okay. So you do have some
criteria you use there. It would be interesting for
the committee at some point to see what they are.
MR. KAPLAN: We could provide this.
MEMBER BONACA: But we have NC standards
40 years ago for nuclear power plants.
MR. KAPLAN: That's correct.
MEMBER BONACA: And you use those.
MR. KAPLAN: Correct.
MEMBER BONACA: Okay. Thank you.
MR. JACKSON: In terms of our equipment,
all of our IROFS equipment would be purchased under
Appendix B QA program. It would be seismicly
qualified per IEEE industry standard and
environmentally qualification where required. Of
course, the equipment will be qualified for natural
phenomena and installed in buildings that are designed
to handle those phenomena. Standby diesels on the
other hand are commercial quality and are designed for
the UBC type seismic requirements not the design basis
earthquake.
CHAIRMAN POWERS: The seismicity of the
Savannah River site has always been controversial both
because of uncertainties concerning the Charleston
earthquake but also because of seismic zones in the
vicinity of the site. I don't want to get into a
discussion of that. I'd like to know what kind of
seismicity you're considering when you impose these
seismic requirements.
MR. JACKSON: What the ultimate design
basis earthquake for our facility is?
CHAIRMAN POWERS: That's it.
MR. JACKSON: I don't know if you have
that. The design basis earthquake numbers.
MS. WESTON: Would you please give your
name before you speak?
MR. HASTINGS: Certainly. This is Peter
Hastings. At the risk of going out on a limb in an
area I know nothing about, we are using as our design
basis earthquake the Reg Guide 160 spec anchored at
0.2 G.
CHAIRMAN POWERS: You're going to have to
remind me of that.
MR. HASTINGS: That's about as far as I
can go with any of that.
MEMBER ROSEN: You said 0.2 G?
MR. HASTINGS: Correct.
CHAIRMAN POWERS: 0.2 G.
MR. HASTINGS: We can certainly give you
more detail on that.
MEMBER ROSEN: That is the design basis
earthquake.
MR. HASTINGS: Correct.
MR. JACKSON: Okay. That --
MR. HASTINGS: Excuse me. This is Peter
Hastings again. Which is the same spectrum that is
used at the Vogtle plant which is right across the
river.
MEMBER ROSEN: You're saying that's the
same as the Summer plant.
MR. HASTINGS: Vogtle.
MEMBER ROSEN: Oh, Vogtle plant.
MR. HASTINGS: It approximates a 10,000
year return frequency.
CHAIRMAN POWERS: The issue of course is
that no one knows exactly where the Charleston
earthquake occurred, how often it occurred. Similar
earthquakes occur and there's been revelations of new
seismic zones in the near vicinity. The site is
susceptible to soil/structure interactions. It's a
complicated seismic site. I'm sure when we get into
seismicity we'll go into this in great detail. I just
wanted to know what they actually used.
MR. JACKSON: That concludes the formal
part of the presentation. Unless there are questions
I will have Jon Tanner come up and talk a little bit
about the instrumentation and control system. Jon.
CHAIRMAN POWERS: Jon is a little
reluctant to come up.
MEMBER ROSEN: I thought we were being
rather gentlemanly for us.
CHAIRMAN POWERS: We're being kind and
generous today. It's a good presentation so we don't
need to be too radical here.
MEMBER KRESS: We're changing our
attitude.
CHAIRMAN POWERS: What we have is this
tension that this is a single failure design basis
here and we're coming from a context of people who
have found a wanting approach and what not so there is
a tension here. All right, Jon. Welcome.
MR. TANNER: My name is Jon Tanner. I'm
with the DCS. I'm one of the assistant lead
electrical engineer and I'm responsible for putting a
control system in place. I thought I'd like to touch
on four areas here: a review of the design basis and
whence it came, the standards we are using to realize
this design of the control system, an overview of the
functional requirements of use in the instrumentation
in the control system, and a review of the
configuration of this system.
Some of the staff have already seen of
these things but there has been a couple of changes
since the staff last saw it. They were expecting it
I believe so they shouldn't be surprised by that.
What's driving the configuration of the
control system is the design basis that is essentially
found in the performance requirements of 10CFR70.61 B,
C and D which were touched earlier by Peter and by Ron
a few minutes ago. The control systems specifically
has design requirements of 10CFR70.64 that we have
controls that we can look and monitor the behavior of
these systems that are relied on for safety. We're
doing that.
The systems are designed to provide
multiple layers of control and measurement for process
parameters and the plant parameters so that if
something goes wrong something else is there to take
the place of that thing that is not working properly.
MEMBER KRESS: Does that translate into
redundant and --
MR. TANNER: Yes. We've been very
conservative about this. As it's been mentioned
earlier, we've taken the position that the nuclear
power plants standards are largely applicable in terms
of controls. That really means three things: IEEE
603 and I believe we are using the '98 version. Is
that right? The most recent addition.
In terms of the software for the control
systems which would be invoked we're using IEEE 7.6 7-
4.3.2 which is as those of you who are not familiar
with this a paragraph overlay of the 603 requirement.
Then obviously it's single failure requirement which
is identified in the 603 document. So the answer to
the question is yes.
As I said we've been very conservative
about that. We feel that those are well demonstrated
in a nuclear power plant use. We recognize that the
MOX facility is not a nuclear power plant. I believe
the staff recognizes that also.
In 603 it almost says nothing if you just
look at the document and not the appendices. You
could use it for anything. It's a very nice little
specification. It works. We're going to use it.
In any event, I think I mentioned earlier
that the policy this IEEE 603 7.432 are nuclear power
plant standards which have the largest impact on the
control systems and for industrial safety which is not
a nuclear safety issue set down by OSHA which is
29CFR1910. We will be observing those requirements
also.
MR. JOHNSON: I notice that you have a
defense in depth up there. I can see from the
application that --
MR. TANNER: -- what it is.
MR. JOHNSON: That's okay. I can see from
the applications some tracks of a defense in depth and
a diversity philosophy of the design but I haven't
quite formed the full picture in my mind of what that
philosophy is. Is there a stated philosophy on how to
provide defense in depth on the I&C system?
MR. TANNER: Well, a stated philosophy.
MR. JOHNSON: Well, what you're thinking.
MR. TANNER: It's not overly stated. But
it's clearly there because and you'll see this in a
few minutes. I'll put some illustrations up here
which will show you how things work. The 603
requirement gives us two independent channels of
safety control. We don't rely on safety controls
around the plant. We rely on nonsafety controls.
Those are pretty robust. To keep the facility safe we
have a layered control system also which has three
layers of control capabilities plus we have the
passive controls which has been mentioned earlier in
terms of HVAC.
The entire building is HEPA filtered both
coming in and going out so there is passive boundaries
there. In my narrow perspective of control systems we
have multiple layers to do the job and the civil
structural guys and mechanical people have put
together systems which themselves are robust and not
likely anyone of them to be a problem to you.
MR. JOHNSON: Is there a diversity
philosophy associated with the multiple layers of
control?
MR. TANNER: We don't require diversity.
It's nice if we have it. I was afraid that might come
up and I don't have a little picture here. Yes. If
we can get away with it, if it works, we'll use it.
It's not necessary. We don't want to invoke it
because it's not always easy to do or even possible in
some cases. Does that answer your question?
MR. JOHNSON: Yes, but you said you had
something else to show. I'll wait.
MR. TANNER: No. I said I wish I did.
MR. JOHNSON: Okay.
MR. TANNER: I thought about that very
issue.
MR. JOHNSON: I noticed that there are
some places that you've made a case of using hard
wired systems.
MR. TANNER: I can discuss that in a few
seconds. I'll put some illustrations up here for
covering this. The design will wrap this together.
The design basis issues in addition to the overall
safety requirements we'd also like to have the product
to be a part 21 product. It's a basic product. So we
need to be able to make the stuff. Economically we
would like not to have the scrap as was talked about
earlier that we have to recycle.
We have automatic systems which are
preplanned. We put programs together and the system
is running and does its thing without having much
manual intervention. I can tell you that
operationally when you work or you are given a build
order or worksheet.
So the people who make the recipes have
thought about what they need beforehand and that's
calculated and put on paper. That is entered into the
systems and the process is automatically served. They
are watched over by operators so at the top level you
have operations people making sure that what's
supposed to happen is happening in accordance with the
construction or the processing requirements.
As I said it's fully automated. Another
advantage of that is that the people aren't required
to get into the process and get potentially exposed in
some way. That's another advantage of that.
Of course our systems are going to be
reviewed to a new Reg 1718 and that's clear. There's
a number of items in there that they are looking to
find. We have to satisfy that. So those items of
single failure create a city of testing. Components
fail in the safe mode. These will be designed into
the control systems. There are part of the control
system design.
I believe this was mentioned earlier but
we've been very conservative in the use of the IEEE
nuclear power plant standards. These are the three
from my narrow perspective of controls and
instrumentation systems, 603, 7-4.3.2 and 379. That's
what we believe will give you a very reliable control
system. It's been demonstrated in the nuclear
industry and power plant industry to be effective. I
can see no reason why it can't be effective here.
The safety systems I think you will find
in 603 and I tried to put together a little example of
what the fundamental requirement of 603 is. It's that
they will perform and maintain the plant parameters
within the appropriate limits. There will be more
than one safety group for any safety function and any
better discussions about the single failure and what
happens if you have a failure. Any safety group can
accomplish the safety function. Just the same
principles in the nuclear power plant. It won't be
any different here.
The instrumentation systems. I'm going to
touch on what the measurement systems are and they are
pretty straight forward. In the process industry
there aren't really very many standards. There is
some ISA stuff and some IEC 61.508 and 511. We don't
use those and we're not using them anymore in this
country anyway.
What we want to do is to be able to
monitor variables and the systems over their expected
normal and abnormal ranges to see what's happening.
You need to be able to control the systems. We need
to be able to bring the systems to a safe state which
in the case of the AP systems at almost every state
means stop and the MP systems it means stop and for
the facility control systems we're down to as it was
mentioned earlier HVAC. I'll show you a slide here in
one second which will show you how we maintain those
operations. Really that is the only thing that has to
be positively maintained, actively maintained all the
time.
The processing systems just bring them to
a stop and the AP systems are all at a low pressure,
atmospheric or slightly subatmospheric. The --
systems are making solid components and there is no
pressure or temperatures there. There are some
economic issues but I don't want to talk about that
right now. That's not a safety issue but sintering
furnace for example we would not like to compromise
it. We want to measure the safety parameters but we
don't want to even get in that area. We want to stay
above that and into the normal operations.
The manufacturing systems are highly
computerized and we're using modern human system
interfaces. So everything we see is on the TV screen
in front of you or on a human system interface PC
screen. So rather than using minipanels as in the old
days like steel panels 10 feet high and 25 feet long,
everything is on a little graphic in front of you.
The manufacturing systems as well as the
facility systems are modularized or systemized. So I
have for example powder systems and I have a work
station that's looking just at the powders. The
pellet systems and I have a work station just looking
at the pellets.
In the chemical area, I'll have
dissolution work stations just looking at the
dissolution system and it's get moved from the
dissolution to the next stage to the next stage. Each
one of those systems has its own work stations with
its own graphics that are manned by the operators.
The systems are fairly robust because you
have the graphic displays. You have the numerical
displays telling you what the values are. When the
components change the state of --
(Noise on microphone.)
The desirable conditions are shown. The
undesirable conditions should they occur are
identified. You have alarm systems which we'll
display what an alarm is and why the alarm is there.
There are some hierarchy rankings that are going to be
imposed. So that will make the operational leverage
rather more effective rather than have to dig through
things.
MEMBER ROSEN: And all these CRPs that you
described are in one place? In a centralized
location?
MR. TANNER: That's a good question. No.
In the MP systems you have a control room for a
certain area. For example, pellets and there's a
group of people in the pellet areas. If you are doing
pellet operation, making pellets, grinding pellets,
whatever, people are there. There's another control
room that is centered around the powder processing
areas. People are doing things in powders, grinding
them or milling or mixing them or whatever. There are
people in there. If you are making assemblies, there
is another control room where that operation is
supervised. The MP systems are pretty well
distributed.
The AP systems are less so. There is a
central control room. That's with D301 right? Yes.
It is. That control room is where people are. Again
they're modularized and distributed. Each functional
unit in the AP systems has a control station. A guy
has a CRT in front of him but it's all in a control
room. That control room is also where we look at
other parts of the facilities, the utility controls,
the HVAC, power dispatching, fire systems, some
security systems. There are several things in there.
I don't want to go into the details right now because
they are moving around a little bit. That's how that
is set up. Does that answer your question?
MEMBER ROSEN: Yes. I take away from that
is that there is one central control room that deals
with all the facility support stuff.
MR. TANNER: Yes.
MEMBER ROSEN: Plus the aqueous processing
and a number of satellite stations.
MR. TANNER: Yes. There are actually a
couple of different facility support areas. I'm
referring to reagents, supplies, gases, HVAC, heating
and cooling, and some of the processes, chilled water,
heating waters. There are actually two control rooms
for that also. There is a secondary control room for
that over on the other side of the plant. So there is
a good deal of diversity, alternate ways of looking at
things.
I can tell you that we had a little
building out to the side of our plant where we mixed
up our chemicals that were going to used in the liquid
fuel processing systems. That has a small control
room that anybody could go down there and watch for
some reason. There's a small workstation in there.
MR. JOHNSON: To what extent are the
multiple control rooms provided to address that
potential need to evacuate one of the control rooms as
a result of some facility upset?
MR. TANNER: The ability exists. Most of
the safe conditions are just stop what you are doing.
Just stop and review what's happened. The control
rooms for the utility systems are there for what you
mentioned. There are certain things you can do from
those alternate control rooms if you need to.
MR. JOHNSON: What are the provisions for
isolating one control room from the other electrically
and for resolving any conflicting control demands?
MR. TANNER: All right. Let's talk about
that for a second. Starting from the most degraded
state, should the facility find itself in a degraded
condition we do in fact have two separate control
rooms called emergency control rooms. Not much goes
on in there except to maintain the confinement and a
few other things. There are two separate isolated
rooms one next to the other and there is a wall
between them. Those are the so-called emergency
control rooms. This is your traditional IEEE 603
nuclear power plant fundamentally separate, redundant,
isolated control rooms, different power, different
cables. There is nothing in common between them.
Coming from down here some place. For
example, this could be one of the HVAC, HDER or VHD
fans. This would be the other one over here.
MR. JOHNSON: Different power.
MR. TANNER: All the controls up here are
all the electronics or electromechanism. There is
precious little software involved in these things
which answers another question which was asked
earlier. That's the A and that's the B control room.
(Presenter indicating.)
As we go up the ladder to our less
degraded facility controls this is facility controls
here. We're in this mode here. The manufacturing and
processing systems have long been shut down. In fact
we actively close them down under certain conditions.
We turn the power off to them all. They just stop.
MR. JOHNSON: You're always doing that
from here.
MR. TANNER: You just turn the power off
and they are done. They are mechanically designed or
set up so that they will be safe in those conditions.
Perhaps that is not desirable but they are safe.
The most degraded to the lesser loading
going toward normal, the facility controls have two
levels of control. We have what we call the back-up
control system. We are using the term "back-up" to
differentiate it from normal controls. This is not a
safety system. It's not a safety but it's another
layer of capability. Should you need to use this you
can operate not the complete system but enough to keep
the plant healthy.
The controls are implemented through
electric and mechanical systems and there are some
software controls which drive the facility through the
MCCCs and they operate the various systems that are
necessary to keep the plant happy and keep things
normal. Perhaps it would not be fully operational but
one without a lot of problems.
We don't want to be using this system
right here as a back-up. We want to be using this
system over here which is the normal controls for the
facility.
(Presenter indicating.)
There are a couple of networks up there
which we can watch the systems and observe their
behavior. The operators can see what's happening.
MR. JOHNSON: Now there is a little tiny
square box on that picture that has three arrows
pointing into it and a relay coil coming out of it.
MR. TANNER: This one that says I/O right
here.
MR. JOHNSON: No. The one immediately
down and to the right.
MR. TANNER: Okay.
MR. JOHNSON: What happens in there?
MR. TANNER: What we are using is
distributed I/O systems for the most part. They are
not all distributed but a lot of them will be. We are
trying to minimize the cabling and use the modern
technology. We don't run one cable for one sensor.
We run one cable shortly for about 10 feet, 20 feet
into a remote I/O system and then we field bust
things, multiplex things to put into the control room
one fiber optic cable for example.
MR. JOHNSON: I was actually asking about
the box that the output of that I/O point into.
MR. TANNER: Normal controller A.
MR. JOHNSON: No.
MR. TANNER: This box.
MR. JOHNSON: Follow the I/O output down.
MR. TANNER: This one.
MR. JOHNSON: I'm sorry. The other I/O.
Right there. That tiny little box right there.
MR. TANNER: The tiny box. What I'm
trying to there is what we call priority management.
I didn't detail this out. The normal controller does
not have priority over the back-up controller. It's
more important. The hierarchy says that the emergency
controller is more important than the back-up
controller. That's the hierarchy of who's going to
make the command.
If you need to use a back-up control
system it tells normal control system for example
software fault or a controller fault. Then the back-
up controller takes command and runs the show. That's
how that is done.
We're trying to show here that there would
be a normal control signal coming into this little box
right here which is the priority management. If this
system is told by an operator or for whatever reason
that it needs to be running then the command will come
down here. This command will be obeyed ultimately by
the actuator fan. This command will be ignored.
(Presenter indicating.)
MR. JOHNSON: How does that happen?
What's the concept there?
MR. TANNER: The concept would be just
relays and what you make happen in the relays.
MR. JOHNSON: So that's essentially a
relay logic.
MR. TANNER: Yes.
MR. JOHNSON: Are the functions that you
are going to be involving there are on/off control
functions? Will there be no continuous functions?
MR. TANNER: The answer to your question
is that there will be some continuous functions in
there. Not very many. Most of them will be on/off.
It gets complicated. I haven't given you all the
details because I couldn't put them all on it.
MR. JOHNSON: That is expected.
MR. TANNER: But there are methods of
providing what you are looking now on control signals.
That's not shown on here. This is the turn off/turn
on commands that are shown here. How you get the
alternate control center on here would be these are
the analog paths.
MR. JOHNSON: I know this isn't a reactor
but a committee on next generation reactor they have
been arguing for four years over the internals on that
and exactly that little box.
MR. TANNER: I'm sure. We're not creating
this control system whole cloth. We're using a method
that's been used for a while in our prototype plants.
That's the method that they've used and it seems to
work. I don't see any reason why we should depart
from that. We know the details.
Moving up the line here we're down to the
facility the manufacturing and processing controllers.
(Shuffling of papers.) -- at IEEE 603 configuration.
This is a configuration for the manufacturing, the MP
and AP systems. There is a nozzle control which we
just got the recipes or the will-build instructions of
the AP or MP processing in this. This is typical of
what every function you're looking at.
There are a couple of safety controllers
which look at a small number of important parameters
and if those parameters are not where they are
supposed to be they have the ability to prevent the
process from continuing. To stop it.
MR. JOHNSON: I want to make sure the fact
that there are no arrows pointed back into the safety
controller.
MR. TANNER: No there is not. That's a
good point. 603 says that you have to separate the
two safety systems and you have to separate the safety
from the nonsafety systems. We have no choice. We
have to comply with that. We fully intend to.
Now you'll note I think that there are
some arrows going from the safety controller into the
normal controller. What's happening there is that if
the safety controller is not satisfied with what it
sees it issues a command to the normal controller
which technically we call it "putting it in the freeze
mode" which would drive all the actuators to zero. So
all the actuators stop actuating.
MR. JOHNSON: Your application has a fair
amount of information about criteria and about the
general approach to the design of these systems. It's
really pretty vague on what specific functions the I&C
systems are going to perform especially the personnel
protection and the safety systems. Is it reasonable
to expect the staff to make a decision on an
application without understanding the specific I&C
functions that need to be implemented?
MR. TANNER: I guess I don't quite know
what information is needed here. Peter, do we? You
have some request for additional information which we
are trying to address right now. But I don't know.
Peter?
MR. HASTINGS: This is Peter Hastings.
Let me infer what is an additional level of detail
about what you are asking. We say in several case
that some of the safety functions for example
prevention of an explosion is satisfied by the process
safety I&C system and we don't give a lot of
additional detail on that. We try to keep things in
the CAR at the design basis level and provide
additional design detail when it was available at the
time but limit what we call design basis so that we
maintain our flexibility in implementation of the
specific controls on how we use the I&C system to
prevent or mitigate that event. Is that the upshot of
your question? Maybe I didn't understand the
question.
MR. JOHNSON: Yes. I think my question is
that I'm accustomed to seeing a description of here
are specifically the things the I&C system does and
here's the arrangement and the functions for these
specific things. What I found for example in looking
at the applications --
MR. TANNER: I think I know what you are
asking.
MR. JOHNSON: -- is that there is
something that are called safety controllers.
MR. TANNER: Yes.
MR. JOHNSON: But not much about what
actually it is that a safety controller does.
MR. TANNER: You are asking for specific
things that a safety controller does.
MR. JOHNSON: Yes.
MR. TANNER: I can address that. We're in
the process of identifying those items and that's what
Mr. Kaplan's group is doing. This temperature, this
value, this condition, whatever it is. These have to
be monitored and a response to those at a certain
valve has to be accomplished. And we do know what
some of them are. We are identifying those. We will
be publishing in our internal documents those specific
items that have to be put in the safety controller's
list of functionalities.
MR. JOHNSON: When does the staff get a
look at that?
MR. TANNER: Gary.
MR. HASTINGS: This is Peter Hastings
again. That information will be fundamentally part of
the ISA that is provided with the license application.
MR. TANNER: It's a schedule and it's when
they do the ISA process. They are going through even
as we speak they are evaluating these individual
functional units to find out what has to be done.
MR. JOHNSON: There you go. ISA. Okay.
How late in the game does that come?
MR. HASTINGS: It comes in with the
license application which is currently scheduled for
submittal in the fall of 2003.
MR. JOHNSON: So I guess my question is
what kind of risk do you run at that point of finding
that you have some significant difference of opinion
with the staff over what this system should actually
do? If you do find that case, what risk?
MR. TANNER: I know what you're asking.
It's really addressing the wrong person on this.
That's the licensing and the safety analysis group.
MR. HASTINGS: This is Peter Hastings
again. I think the answer is that the risk is that we
can't implement the design basis that we've committed
to and that's been approved by the staff for
construction authorization.
The details of the design will be feted
through ISA and the operating application. The
construction authorization attempts to get concurrence
from the staff that the design basis is adequate for
authorizing construction.
MR. JOHNSON: Okay. But if you look at
IEEE 603 for example it talks about a design basis for
an I&C system and in view of that construction --
MR. TANNER: Yes. It requires that.
That's the very first several paragraphs. 3.1 or 3.2
as I recall.
MR. JOHNSON: Yes.
MR. TANNER: I understand what you are
saying. You have to identify what the problems are
and how you mitigate them.
MR. JOHNSON: Yes.
MR. TANNER: And we're doing that. That
is being done and it's part of our effort.
MR. JOHNSON: If you were looking for
acceptance of the design basis and haven't provided
that part of the design basis, is it reasonable to
accept the other parts?
MR. TANNER: Go ahead, Gary.
MR. KAPLAN: This is Gary Kaplan. I'm not
sure what your question is exactly. What information
do you think that should be provided on the CAR that
we haven't already provided?
MR. JOHNSON: Well, I'm wondering what the
I&C system actually does specifically. The applicant
says it does some safety stuff and it does some
control stuff and it does some personnel protection
stuff but below that there is no detail beyond that.
I'm accustomed to and maybe because I'm accustomed to
reactor applications which are more in depth.
MEMBER LEVENSON: You're talking about
licensing application.
MR. TANNER: This is Jon Tanner. Correct
me if I'm wrong, Gary or Peter. The license
application will identify just as it would for a
nuclear power plant and I will use that as an example
the steam generator level low stage umptiscratch.
That will be done here for our facility. Is that
correct?
MR. KAPLAN: Yes. This is Gary again. I
think in the CAR we provided a little bit more detail
than you suggested. I think we provided that we are
going to control temperatures where appropriate.
We'll control flow rates where appropriate. The
specifics on every single tank and level control or
temperature control that we're doing through the ISA.
We need a detail design drawing to do that. At the
stage of the CAR two years ago it was a very
preliminary design. We don't have that detail to
analyze that.
MR. JOHNSON: Perhaps it's my problem that
I haven't read enough of the application but it was
hard for me to tell even that you control fans.
MR. KAPLAN: You probably read section
11.6 which is the I&C. If you go in to chapter 5
there is a detailed list of what we think are specific
functions that the I&C will perform.
MR. JOHNSON: Okay.
MR. KAPLAN: There might be 15 things
listed there or 20 things listed there.
MR. HASTINGS: This is Peter Hastings
again. Clearly there are some areas where the staff
has requested additional information on those kinds of
details and we have provided or are continuing to
provide in on-going discussions with them some
additional detail. We try to be as clear as we can
where we are providing design detail versus design
basis because the approval threshold for the
construction authorization is design basis not the
implementation of those.
MR. JOHNSON: Okay. Thanks.
MR. KAPLAN: One more thing. This is Gary
Kaplan again. But certainly in the ISA portion we
will identify the specific controls and what they are
supposed to do. So there will be a lot of detail in
that part.
MR. JOHNSON: Gary, I guess I didn't
expect to find a complete set of drawings in this
version. But when you say safety controls. Well,
what is that? One other question I had was on
criteria for the normal systems. What failures in the
normal control system might be considered as
initiating event for accident sequences and what kind
of criteria do you need to put in place for the design
of those systems to reduce initiating event frequency?
MR. TANNER: Yes. Initiating an event
caused by the control.
MR. JOHNSON: Right. By its system
control failure?
MR. TANNER: That's been anticipated and
that's why we have these differing layers. It could
be many things. A software fault, a hardware fault,
who knows. The different layers are there to
compensate or mitigate that problem. I guess I can't
exactly answer your question without sounding like I'm
waffling. The defense in depth concept is how we are
trying to address this.
MR. JOHNSON: I understand that. I guess
my question was more along the lines of what quality
standards and design standards do you apply to the
normal control system in an effort to reduce the
likelihood of failures in that system that can create
initiating events.
MR. TANNER: We have a software group
which could address that rather nicely. Gary Bell.
MR. BELL: My name is Gary Bell. We have
a set of software which is the IEEE Computer Society
software standards for configuration management for
verification validation for software requirement
specifications, for design descriptions. So we are
following a rigid life cycle for normal software to
evaluate how the software is put together and to
minimize those types of errors.
I believe also, Gary, on the ISA we have
treated the normal system as one of the deterministic
failure modes and it can fail.
MR. TANNER: It's assumed it will at some
point.
MR. BELL: It's assumed it will fail. But
we do have a fairly rigid life cycle for the normal
control software development.
MR. TANNER: Did we address that?
MR. JOHNSON: Yes.
CHAIRMAN POWERS: Let me ask a question
probably revealing a great deal of ignorance. What I
know is that anytime you do a design of a facility to
handle chemical processes of any type it doesn't
matter how careful you are you will eventually get
contamination events occur. What I'm wondering is how
tolerant these digital systems that you are making
heavy use of here are to contamination with alpha-
generating materials?
MR. TANNER: Good question. Yes. Gary.
MR. BELL: Again this is Gary Bell. We've
taken several design measures. For one thing the
safety controllers, the normal controllers are not
located in the region of the building with the
contaminated material. They are off in their own
electronic rooms in separate cabinets. For the local
I/O we have selected devices that have been used in
our model plants in France that have operated suitably
in the alpha environments that they were subjected to.
MR. TANNER: I understand what you are
saying and I've worked in places where this was a bit
of a problem. The fluid systems are in their welded
equipment. Those tanks, pipes and so forth are in the
negative room cells, process cells which themselves
have a high level of ventilation integrity.
CHAIRMAN POWERS: You're telling me you're
being careful. And you're not willing to stipulate
that what I'm saying is that no matter how careful you
are eventually sooner or later there will be a
contamination event of some sort. If there isn't then
you will be the first in the history of mankind to
avoid one. The question is how hard are these digital
electrical systems to contamination and the most
insidious contamination events are those that of
course you don't know about until long after they
occurred.
MR. TANNER: Right. I can't address that
question because I have not looked at that particular
question of an alpha contamination event. We're doing
everything we can to not have it.
CHAIRMAN POWERS: Sure.
MR. TANNER: Let me say this. We have an
HP group which is interested in finding out if that
happens real fast because there is a human exposure
problem involved here. If we get that some of that
stuff becomes in places it shouldn't be, we need to
know about it immediately. Yes sir.
MEMBER LEVENSON: This is a completely
different type question but it was triggered by Dana's
question. This isn't really to you but you're sitting
there. The feed material you are getting you
discussed significant variation, impurities,
contaminants as it affects the chemistry and
processing. Are there among those impurities enough
light elements to impact the neutron dose due to alpha
N that one might expect from this material?
MR. TANNER: In my reading of the AFS
systems, I don't know enough to answer that. I would
address that question to our ISA group over there.
Gary Kaplan.
MR. HASTINGS: This is Peter Hastings. I
don't think we know the answer to that question off
hand. We can certainly look into it. I think the
answer is no but I can't confirm that.
MEMBER ROSEN: Let me follow Milt's lead
and ask you a question I know you're not responsible
for. From the earlier presentation on page 10, we
talked about equipment qualification. There is a
statement made that the items relied on for safety
equipment is provided on potentially 10 CFR 50
Appendix B QA program. That mean I assume purchased
under that program. But is the general philosophy of
this system that it will be operated under the
Appendix B program, the IROFS would be operated,
installed not just provided but installed, maintained
under the Appendix B program?
MR. TANNER: That's correct.
MR. HASTINGS: That's actually a mandate
of the regulation for a plutonium facility.
MR. TANNER: We have no choice.
MR. HASTINGS: We also happen to like
Appendix B.
MEMBER ROSEN: That means a lot of things
including corrective action programs and so forth.
MR. HASTINGS: That's correct. Our QA
plan has been approved by the staff for up through
construction and it is a fully Appendix B compliant.
MEMBER ROSEN: For the scope --
MR. HASTINGS: For all 18 criteria. Yes.
MEMBER ROSEN: But just the IROFS.
MR. HASTINGS: IROFS and certain
applicability to some non IROFS as well.
MS. WESTON: To follow up on Steve's
earlier question about tech specs, we didn't get an
answer to that, Staff. I think Drew you were about to
answer.
MR. PERSINKO: No. Could you repeat the
question first though?
MEMBER ROSEN: Well as Mag was referring
to was the question about would there be an analogous
set of operating rules to the kind of rules that are
embodied in tech specs in power plants for this
facility?
MR. PERSINKO: The Part 70 regulation
doesn't specify tech specs like the Part 50 regulation
does so we haven't been using the term "tech specs"
per se. We haven't gotten to that point yet but I do
anticipate there will be what we do call "license
conditions" added to this part of the license and with
certain parameters specified in the license conditions
but we haven't gotten there yet.
MEMBER ROSEN: Well, the question arose if
you recall in the context of what happens if one of
these diesel engines is either out of service because
it failed or is down for maintenance. How long can
you continue to run the facility normally in that
condition? Those kinds of circumstances are covered
in power plants in tech specs. Are you saying that
those types of circumstances would be followed in
these license conditions or rules?
MR. HASTINGS: Let me try to answer that.
This is Peter Hastings. The short answer is yes. We
do anticipate as a result of the ISA things like
specifications on limited conditions for operability
and things like that.
Even though Part 70 doesn't specify tech
specs it does in its most recent incarnation specify
management measures associated with control of IROFS.
Those management measures include along with a lot of
the criteria out of an Appendix B like program
recalled them. In Part 70 Appendix B is only
applicable to plutonium facilities and 70 is written
for lots of other people also. So there is some
overlap between management measures and the NQA 1
program.
But there is also other stuff like
addressing maintenance requirements and things like
that. We think that derived from those management
measures and derived from just the natural results of
ISA, the safety analysis, we will end up with
operating limits, LCOs, all the tech specs like stuff.
MEMBER ROSEN: Surveillance. Test
intervals.
MR. HASTINGS: Right. And all controlled
through plant procedures controlled under the QA
program.
MEMBER ROSEN: Let me follow up with
another question. It's really addressed to the ACRS
and ACNW. Do we at a later stage get to see all of
this? How many more bites of this apple are we
getting?
CHAIRMAN POWERS: We have been asked
specifically by the commission to watch this process
of licensing this facility closely. So I suspect that
you will be sick of this facility by the time we are
done.
MEMBER ROSEN: I'm delighted.
CHAIRMAN POWERS: Let me ask a question
back to the digital I&C system. Another thing that is
evitable for any facility no matter how careful you
are are nuisance fires. Fires that produce smoke.
They don't do any damage. They don't initiate
accidents. They produce smoke. Smoke goes around.
Digital electronic systems have a magnetic attraction
for smoke. How tolerant are the digital systems to
that kind of smoke?
MR. TANNER: We've looked at this. We've
addressed this. There are a number of NUREG
publications out there discussing that particular
problem. Our response to that is this. Two things.
The control systems are physically distributed. So if
there is a fire in a certain area the ventilation
systems will draw that smoke away from it. So it
limits the spread problem. That's the first thing we
want to do.
The second thing is should we have a smoke
exposure problem to some of these electronic control
systems, they have to either be repaired or replaced.
There is a document out there and I don't recall the
number of it right now. It's a NUREG study that
evaluated that very problem. Their conclusion was
essentially that.
Coatings if that is what you are looking
at are problematic at best. In a previous lifetime I
worked in electronics and they are something that you
don't want to get into unless you actually have to.
So DCS's position will be if something is exposed to
smoke it gets repaired or replaced under the plant's
QA program.
CHAIRMAN POWERS: Superb. Excellent
answer.
MR. TANNER: There's no other answer.
CHAIRMAN POWERS: Any other questions in
this particular area? Any other questions that you
would like to direct toward DCS? We're going to go
back to working primarily with the staff after a
break. With that I propose that we take a break until
11:15 p.m. I want to thank DCS for their
presentations and comment again that the commission
has specifically asked us to watch this process and
advise them directly so you'll get to see us a lot I
suspect.
MR. HASTINGS: We look forward to it.
CHAIRMAN POWERS: And if your
presentations are as effective as the ones you gave
today it will be a very smooth relationship.
MR. HASTINGS: Thank you very much.
CHAIRMAN POWERS: Off the record.
Whereupon, the foregoing matter went off
the record at 11:01 a.m. and went back on
the record at 11:17 a.m.)
CHAIRMAN POWERS: Let's come back in
session. The members have complained about the delay
in the break. We will note the generosity of the
Chair in extending the break beyond the zero time that
was originally allotted. Drew, we are going to come
back to you and you're going to discuss first impacts
and then summary. You have a long session.
MR. PERSINKO: I think it's going to be
shorter than it shows on the schedule actually.
CHAIRMAN POWERS: So breaks are longer
than shown on the schedule and presentations are
shorter. Is this a trend or what?
MEMBER KRESS: I interpretted that to mean
24 hours.
CHAIRMAN POWERS: Your interpretation was
entirely erroneous as usual.
MR. PERSINKO: Good morning. My name is
Drew Persinko. I'm the MOX project manager at NRC
with the Office of Nuclear Material Safety and
Safeguards. My first presentation is just on the
impact of the DOE announced changes on the staff's
review of the MOX Fuel Fabrication Facility.
The effect largely is on schedule. I'm
just going to go over what this did to our schedule.
As the schedule currently stands now, what we intend
to issue a draft SER for the construction phase
aspects at the end of this month, April 30. But I
want to emphasize that this SER does not take into
account the alternate feedstock changes you heard
about this morning.
This SER will be based on the construction
authorization request that was submitted to the staff
last February 2001. That's what this SER will cover.
It won't cover the changes.
The schedule also now calls for that we
will be receiving from the applicant a supplemental
environmental report on July 15. We also will be
receiving a supplemental construction authorization
request in October 2002 as the applicant informed you
earlier. We intend to issue a draft environmental
impact statement for public comment in February 2003,
a revised draft SER in April 2003, and then a final
EIS in August, the final SER and the construction
licensing decision in September 2003.
CHAIRMAN POWERS: Okay. Now the question
that is posed to us is this SER you're going to issue
here in May, do you need a letter from us on that?
MR. PERSINKO: I don't believe so.
CHAIRMAN POWERS: It seems to me like we
don't.
MR. PERSINKO: No, that's correct. We do
not need a letter from you for the draft SER. Now
when we issue the final SER which will be some time
from now because have to get the additional
information from DCS and evaluate that, then we would
be looking for a letter from you.
CHAIRMAN POWERS: The operational question
is whether we bring anything to the full ACRS in May
or not. My prejudice coming in here was that not just
because this is an interim SER. A dry run SER or
something like that.
MEMBER ROSEN: Can you tell when we're
going to see the ISA? To me that is a very important
document to this whole process.
MR. PERSINKO: We'll talk in a minute
about this but this is the two step licensing so
you're going see the construction part. You'll see
the ISA as part of the licensing application which the
applicant said earlier would be submitted in the fall
of 2003.
MEMBER ROSEN: So right around the time
you issue a final SER for construction.
MR. PERSINKO: That's correct.
MEMBER ROSEN: In other words, they're
going to be off and building something --
MR. PERSINKO: If we conclude
satisfactorily in our SER that we find it adequate and
we approve the construction of it then the applicant
is free to go construct the facility at the same time
that the license application is under review by the
staff.
MEMBER ROSEN: They are going to go
construct something but we really don't know what it
is.
MR. PERSINKO: The way the regulation is
set up it's the design basis at this stage were to be
approved by the staff per the regulation 1070.23(b).
CHAIRMAN POWERS: You're reproducing here,
Steve, a debate that has occupied the licensing
structure since 1963 to my knowledge. Trust me. It's
a dry hole.
MEMBER ROSEN: So I'm told by my
distinguished colleague, Dr. Powers, that I'm not to
worry about that. That if Duke Cogema Stone & Webster
choose to build something in September presuming the
staff said it's okay and the commissioners have agreed
and we've agreed they can go ahead and do it. Then we
get to look at the ISA and say what you're building
doesn't make a whole lot of sense to us now that we've
seen the safety analysis. It seems like there ought
to be a whole lot of different things involved.
CHAIRMAN POWERS: That's exactly right.
You have a keen insight on this whole process here.
MR. PERSINKO: I mean that's the risk --
CHAIRMAN POWERS: And like I say what
troubles you now has bothered people since 1963.
MR. PERSINKO: Short of receiving the
complete application up front it is the risk that one
takes. It's similar to like you said in the reactor
days you had a construction permit and then the OL
stage.
MEMBER ROSEN: I'm left speechless.
CHAIRMAN POWERS: Steve, relative to what
went on in the early days of reactor power there's
less speculation here like civil orders of magnitude.
MEMBER ROSEN: And one would hope that the
risks are at some civil orders of magnitude too.
CHAIRMAN POWERS: We don't have risk.
We're doing an ISA remember?
MEMBER ROSEN: That's right.
CHAIRMAN POWERS: Drew, go ahead.
MR. PERSINKO: The provision that you have
instituted the two step process for plutonium
facilities that I mentioned the 1070.23(b) was
instituted back in the early 1970s. If that wasn't
there the applicant according to the regulations could
go out and build a facility without even coming to the
staff in the first place. But putting that regulation
in place it inserted a staff review at an earlier
stage. But granted it is only at the design basis.
MEMBER ROSEN: As I said I'm speechless
which means I don't have anything else to say about
it.
CHAIRMAN POWERS: Which is also so unusual
that I'm appalled. Go ahead, Drew.
MR. PERSINKO: So that's the schedule.
That's the new schedule that we've developed as a
result of learning of the changes recently by DOE and
DCS.
Next slide. The summary of the impacts
are that we had originally intended to issue a draft
environmental impact statement this past February and
we did not. We felt that the changes were significant
enough to affect the draft EIS so we did not issue it.
CHAIRMAN POWERS: Let me just inject here.
I probably will discuss what we've been doing so far
in this area with the commission in July. It will
probably be nothing more than just a progress
statement much like you're first couple of view graphs
and what the anticipations are. The problem is the
ACRS has a specific request to address this. So we
have to tell them what we're doing every once and a
while. I don't think we're telling them anything
substantive about what we're doing here other than
we're doing.
MR. PERSINKO: The impact as was stated
earlier essentially as you cut through the chase is
that it delays issuance of the staff's final EIS and
SER by approximately one year. The other thing it did
is we did not originally intend to issue a second
draft. We intended to issue a draft and then a final.
The result is that we will now be issuing a second
draft.
So you questioned will you get another
bite at the apple? I'm certain staff is willing to
come and talk to the ACRS staff at any time. But you
will get to see a second draft issued which really
hadn't been originally planned.
Lastly we expect that the areas most
affected by these changes will be in the safety
analysis area and the chemical safety area. There are
other areas that affect design but you always have to
remember that we are at the design basis at this
stage. That concludes my talk about the impact of the
changes on the staff's review.
Now I would like to move onto an
introductory presentation prior to the four more
detailed presentations you will be receiving. As I
mentioned this is a two step licensing process
according to the regulations in 10 CFR Part 70. For
construction the regulations require that the staff
must approve the design basis of the principal
structures, systems and components, quality assurance
program, and also there's a paragraph in subpart (h)
of 10 CFR 70 called the baseline design criteria and
that's in 70.64.
One thing I just want to clarify. You
have heard the term IROFS, the items relied on for
safety. You also heard PSSCs, the principal
structures, systems and components. The distinction
is is that the regulations required staff to approve
principal structures, systems and components at the
construction stage and at the license application
stage we move into what's known as the ISOFS, items
relied on for safety. So the term PSSC is linked to
construction.
I also want to mention that the applicant
stated that they also used the regulations 70.61 to
define what are the PSSCs. Staff issued its QA
program for safety evaluation report in October 2001.
So that's been out since late last year. As a result
of that, the applicant has just recently submitted a
revised QA program to match the SER requirements.
Let's briefly talk about open items other
than those you will be hearing about later after my
presentation. You'll be hearing more detailed
presentations in the area of safety analysis,
radiological consequences, chemical safety and fire
protection.
Many of you I think have seen this slide
before. It's just to set the stage of where the
jurisdictional and the geographical boundaries lie in
this project because it's different. The geographical
boundary is the Savannah River site for the pit
disassembly and conversion facility and mixed oxide
fuel fabrication facility.
Both of those facilities are located on
DOE's Savannah River site. Yet the jurisdictional
relationship is that the NRC has regulatory oversight
of the mixed oxide fuel fabrication facility.
So the PDCF, the pit disassembly and
conversion facility, and before that is DOE's
jurisdiction. Once the material is received at the
mixed oxide fuel fabrication facility then the NRC's
regulatory oversight begins.
One thing I would like to mention on this
slide though is that what doesn't show is the recent
changes. It shows all of the material coming from the
PDCF. As you heard this morning some of the alternate
feedstock may be coming directly to the mixed oxide
fuel fabrication facility.
The two reactors that have been identified
are Catawba and McGuire. There has been discussion
about potentially adding additional reactors but we
don't have any information on that. Next slide.
CHAIRMAN POWERS: Nor is it pertinent to
this SER.
MR. PERSINKO: It doesn't really matter
that you would react.
CHAIRMAN POWERS: It goes to unless they
change the fuel type. Right? Cladding type or
something like that.
MR. PERSINKO: Correct. It doesn't affect
the staff's safety evaluation. It does have an effect
however to some degree in the environmental aspect.
CHAIRMAN POWERS: Okay.
MEMBER LEVENSON: Dana, just because some
things get lost in history, does the ACRS have access
to the information on the MOX fuel radiated in
commercial power reactors back in the 1970s, the EPRI
program? Was MOX fuel put in both PWRs and BWRs?
CHAIRMAN POWERS: The ACRS has not looked
at it as far as I know. But do they have access to
it? If they wanted to. Right now of more interest to
the ACRS has been getting a hold of information on the
behavior of MOX fuel under accident conditions. There
they have not been so successful. But neither one of
them are pertinent to this discussion.
MR. PERSINKO: The next two slides are a
high level overview of the processes. I just want to
be clear though that this is part of the mixed oxide
fuel fabrication facility. You've heard the term
"aqueous polishing." This is in the MOX facility.
This is not in the PDCFs. This starts the staff's
regulatory oversight.
The AP process, aqueous polishing process,
consists of high level the three steps that you see in
this slide. We'll go into it a little bit more when
we talk about chem safety. I just want to note also
that this is the process that is based on the
processes at the La Hague facility in France.
Next slide. Now you'll hear the MP
process, the fuel fabrication process. This is the
dry side of the process. This is where the purified
PU02 is blended to make pellets and then eventually
the fuel rods. This part of the process is modeled
after the Melox facility in France.
I'm just going to go over briefly some of
the open items in our SER not the ones that you'll
hear more about later. You'll hear more about a
particular one in confinement. I'm just going to go
over at a high level view some of the open items that
are in our SER right now. Keeping in mind we are
reviewing it at the design basis level not the design
level.
We have a couple of issues on site
description. We asked the question concerning the
sensitivity of measurements that were made of soil
samples regarding radioactivity. This statement was
made that there was no radioactivity detected. We
asked about the sensitivity of the equipment to detect
it.
Another item regarding site description is
that there was an analysis performed of aircraft
hazards. One of the items was though it didn't
include projected future aircraft travel. There is a
requirement for that. Keeping in mind though that
this aircraft analysis did not include any aspects
after 9-11. This is the traditional aircraft analysis
that was done according to standard review plans.
CHAIRMAN POWERS: Accidental impacts from
adjacentary ports and things like that. Not directed
air.
MR. PERSINKO: Right.
MEMBER SIEBER: I was under the impression
that the Savannah River site was a restricted area as
far as aircraft are concerned all the way to the
Savannah River. So there are no commercial flights
allowed over Savannah River.
MR. GITTER: This is Joe Gitter. They did
look at aircraft from Bush Field in Savannah and the
possibility that there could be a wayward aircraft.
That could have an impact on the facility. I'd have
to check that.
CHAIRMAN POWERS: Also flying golf balls.
MR. PERSINKO: The next area was nuclear
criticality safety. We had a number of open items
there but I'm just going to mention a few. We asked
for information concerning bounding densities assumed
for the powders. There was a table provided to us
about assumed bounding densities and we wanted to
justify those values that were put in the table. We
also requested clarification of the term "other
justification" because the CAR said other
justification will be used to extent code
applicability and we wanted clarification about what
"other justification" meant. We are also asking a
justification for the administrative margin and the
upper safety limits that were assumed for criticality,
K-effective.
Regarding confinement I'm just going to
mention one item here but you'll get into this when we
talk about reg consequences. We probably have the
most significant outstanding item there which regards
HEPA filter efficiency. The applicant has used the
99.99 percent efficiency for the two banks. Staff is
questioning that number and asking for further
justification of that number.
Regarding fluid systems, there is
outstanding information concerning the classification
of the nitrogen system. Whether it's a PSSC or not by
reading the application, the CAR, it seems like it
could be because it has certain functions which may
need to be a PSSC but yet it wasn't identified as a
PSSC. For example, it provides cooling to the
calciner bearing. It also is used as a blanket in
some tanks. It also is used as sweeping an airlock in
from the sintering furnace. So it seems to have some
safety functions yet it's not a PSSC. So we are
questioning that.
We also are questioning the classification
of seismic isolation valves. There are certain valves
that were not classified as PSSCs and they perform a
function during a seismic event. We asked the
classification of that. Lastly, you mentioned
corrosion. We are asking about the corrosion
allowance in areas that are not readily inspectable.
So that gives you a high level overview of
an introduction to the speaker who will be following
me. Are there any questions?
MEMBER ROSEN: Yes. Each of those
speakers will address the open items in those
particular areas.
MR. PERSINKO: Yes.
MEMBER ROSEN: Thank you.
MR. PERSINKO: Any other questions?
CHAIRMAN POWERS: Could I go into this
corrosion issue just a little further?
MR. PERSINKO: Sure.
CHAIRMAN POWERS: This is mostly
administrative. Procedural and things like that. It
seems to me that the introduction of multiple feeds
has increased the opportunity for inadvertent
admission to the systems of corrosive materials. Is
that being examined in your process or are you just
looking the steady state corrosion problems here?
MR. PERSINKO: We have outstanding issues
on corrosion in general. Like I said, this SER is
based on the existing CAR so we haven't gotten into
the effects of alternate feed where it shouldn't. But
in the chem safety area as well as in the fluid area,
we have asked the applicant questions and still have
some outstanding concerns regarding the corrosion
issue. You'll hear about the corrosion issue more in
chem safety. We've asked certain issues regarding
corrosion on stainless steel and silver and things
like that.
CHAIRMAN POWERS: Okay.
MR. PERSINKO: Thank you very much. The
next speaker I would like to introduce is Rex Wescott.
Rex is the safety and ISA team leader, integrated
safety analysis team leader, safety analysis team
leader since we don't have an ISA but I'll just turn
it over to Rex now.
MR. WESCOTT: Good morning. I'm Rex
Wescott. I'm going to talk about the review of the
safety assessment. The safety assessment may be
thought of the front end of the development of the
integrated safety analysis which is prepared at the
operating license stage. This is what was used by the
applicant to develop the principal structure systems
and components, to identify the hazards and events and
the strategies needed to mitigate or prevent these
events.
Next slide. I intend to talk about the
purpose of the safety assessment review, the scope of
the safety assessment review and the criteria used to
reach conclusions and the results of the review in
terms of unresolved issues or additional information
needs.
Next slide. The major purpose of the
safety assessment review is to review the hazards
analyses which the applicant used to develop the PSSCs
for the facility. The safety assessment review is a
team effort and was complimented by detailed technical
reviews of the discipline or process specific sections
of the application. I'm going to add, the review in
the safety assessment part did not include the design
basis of the PSSCs. The review of the design basis
took place in the technical reviews.
A number of issues came back to safety
assessment review from the technical reviews. These
issues are being identified by the staff SER as
unidentified events. That means events that we think
could affect the facility but weren't identified by
the licensee.
Next slide. Additional information needs
that is from incomplete strategies where they actually
identified the event but we don't feel that the
principal structure, systems or components or the
strategies that they are being used with are going to
be effective in mitigating or preventing the events.
Throughout this review process, the safety
assessment team meetings served to help reviewers
become aware of each other's issues and provide other
technical input that is necessary so it served as an
integrating function.
MEMBER BONACA: I guess this analysis
provides also an input to functional requirements of
SEFTA systems if you have any that respond to these
events. Right?
MR. WESCOTT: Absolutely. That's right.
What the licensee or applicant identified was
principal systems, structures and components. Many of
these are multi-functional. Some functions were
necessary for mitigation and some types of accidents.
Some in other types. So you had a PSSC and maybe
three functions associated with it. That's what I'm
referring to as the strategy. That was their
mitigation or prevention strategy.
MEMBER BONACA: So this functional
requirement will be pulled out of this analysis in a
formal fashion and then used as parts of the design of
the rest. I'm trying to understand how far into
details have they gone to date.
MR. WESCOTT: At our last session here we
tried to outline where the application for
construction review left off and where the operating
license will start. I guess in a nutshell the CAR
left off at the denotation of principal SSCs, their
functions, their strategies and their design basis for
these principal SSCs, in other words, what types of
standards to be used in designing these and some cases
values. It differed depending on the actual PSSC.
At the O/L stage, that's where they are
going to actually build from the conceptual design to
the more the detail design, components and
reliabilities and that type of things.
MEMBER BONACA: Set points.
MR. WESCOTT: Set points. Right.
MEMBER ROSEN: But at this stage if I read
the hazard analysis from what you said I should find
a list of initiating events.
MR. WESCOTT: That's correct. The next
slide. The scope of the safety assessment review
consists of reviewing of applicant's analyses of
natural phenomena such as seismic events, floods, high
winds, for example, external manmade events such as
potential industrial explosions, chemical releases,
aircraft crashes and process hazards. For the review
of the process hazards we had to look at worker
consequences, public and site worker consequences and
environmental consequences.
The natural phenomena hazards for the most
part were external so you designed against failures
inside the plant so you didn't have the consequence
analysis to go through. The same with the external
manmade events. But for the process hazards if you
weren't preventing the event you had to mitigate it.
And in mitigation you had to worry about consequences.
CHAIRMAN POWERS: Let me ask a couple of
questions here. In the earlier discussion we broached
the issue of the controversies associated with the
seismicity of the Savannah River site. Did you get
into that or did you just take what people use on the
site?
MR. WESCOTT: No we did fairly thorough
review. The Center for Nuclear Waste Regulatory
Analysis was actually the contractor that reviewed the
seismic. Drew can probably tell you more about that.
But no.
CHAIRMAN POWERS: You got into the then
endless debate.
MR. WESCOTT: Luckily DOE had also
reviewed much of this.
CHAIRMAN POWERS: Yes. They've been
looking at it a lot.
MR. WESCOTT: But there's a lot there.
CHAIRMAN POWERS: I noticed that you have
used the distinction public and site worker. When you
say site worker do you mean the Savannah River site or
do you mean the actual MFFF site?
MR. WESCOTT: No when I say site worker
and I apologize. That first bullet should have been
facility worker consequences. The site worker is the
Savannah River site worker.
CHAIRMAN POWERS: So you deducted on
whether the site workers are public or not by just
making a distinction between the two.
MR. WESCOTT: True, but I think there is
still is a debate there. I think Dave might be able
to talk to you about that far more intelligently than
I can about that particular aspect.
CHAIRMAN POWERS: Members of the
subcommittee should be aware that there are about
25,000 workers on the Savannah River site so it's like
a small city. The Department of Energy has
historically concerned people working on the site as
site workers. Consequently that has ramifications on
how they do the safety. Where here you have a little
problem that they are not working on this particular
site.
So now do you treat them as site workers
or do you treat them as members of the public? You
can make arguments either way. The one truism is that
they are probably more controlled than the average
member of the public. But it is also hard to draw
distinctions between a secretary in a Savannah River
office and a secretary in a bank.
MR. WESCOTT: One distinction certainly of
the site worker is much closer than the public.
CHAIRMAN POWERS: Well, because of the
peculiarity of the site.
MR. WESCOTT: Yes.
CHAIRMAN POWERS: But if I were to compare
this to a reactor site and my secretaries, one in a
bank and one in the Savannah River site office, they
could well be sisters, twins in fact.
MR. HASTINGS: This is Peter Hastings.
Let me just clarify to make it a complete thought.
The one distinction is to the extent that the
secretary at the nearby Savannah River facility has
unescorted access, she is also subject to minimum
training requirements to achieve that access under DOE
systems.
CHAIRMAN POWERS: And she's a little more
controllable. If they say evacuate she probably will.
Whereas a secretary in a bank is a 50/50 spot.
MEMBER KRESS: On your first two bullets
you mentioned that you don't carry those to
consequence level because they designed against. I'm
interested in just what those words mean. "Designed
against."
MR. WESCOTT: There is a couple of aspects
of this. Number 1 is the 7061 performance requirements
which says that consequences that would be above the
threshold and we just assume that the consequences of
an earthquake or high winds, something that would
destroy the structure or threaten the PSSCs inside it
would result in a consequence above the threshold have
to be highly unlikely.
MEMBER KRESS: That's what you mean by
"design against." You render it into the highly
unlikely.
MR. WESCOTT: That's right. We design it
for a level that its availability to performance
mission should have a probability of failure or not
performing its mission should be highly unlikely.
MEMBER ROSEN: And there's no
quantification of that number?
MR. WESCOTT: Yes there is some
quantification. The SRP specifies a probability of
10-5. But it also says you can be qualitative about
it. What's happened is the applicant's basically used
reactor type guidance and also what the DOE has gotten
and in almost all cases I think with the exception of
seismic event has come out with a probability of the
event less than 10-5.
When the seismic event analyses were
performed it showed using fragility analyses and this
type of thing that given the earthquake the fractional
probability of failure of one of the systems would be
less than 10-5. So it came out acceptable under our
SRP.
MEMBER LEITCH: I'm very much concerned
about operator staffing levels, training,
qualifications and so forth. I assume that's further
down the road. That are discussions that are not yet
appropriate.
MR. WESCOTT: That would be correct. I
think some of that at least what's been done so far
came under the human factors review but that wasn't
part of this presentation. I think from what you just
said most of that would O/L stage.
Next slide please. Also as part of the
scope the applicant established six event categories
and numerous event groups. Event groups are things
like the 3013 container drops or corrosion dose leaks.
I talked about those later within these six
categories. And the purpose of the event groupings
was really to put together events that could prevented
or mitigated by the same PSSCs.
So all together the applicant evaluated
well over 100 different events and actually formulated
almost 50 event groups to evaluate these events in.
Just to give a very simple idea of the structure of
his hazard analyses. There are many different types
of events but they came within these six categories.
He did it by looking at groups so he could determine
a consistent strategy that would cover a number of
similar type events. Next slide.
MEMBER LEITCH: Just a question here about
security or sabotage. Is this MOX facility separate
from the Savannah River site security or that again an
issue that is up in the air?
MR. WESCOTT: I don't know if that's a
future issue or if that's an issue that I'm not aware
of.
MR. GITTER: This is Joe Gitter. In terms
of physical security, it's our understanding that the
applicant plans to rely on physical security available
at the Savannah River site. That's one of the reasons
that we wanted to talk to DOE very early on in this
process in the aftermath of 9-11 to make sure we
shared our concerns and that the approach the DOE
takes to address this issue is consistent with the
approach that they are taking at the Savannah River
site as a whole. But we have talked to DOE about this
and they are aware of our concerns in this area.
MR. HASTINGS: Let me add to that just
briefly. This is Peter Hastings. We are relying in
large part in some of the elements of the existing
security infrastructure at Savannah River but we do
expect and were required to demonstrate that it meets
the requirements of NRC regulations as well under part
73.
MEMBER LEITCH: I guess I always think
that the most secure site is the smallest site and
that only the people that are required to go into that
area have access to the area. In other words, what
I'm picturing based on what was just said is that this
25,000 or whatever people once they get into Savannah
River site have unfettered access to this facility.
Is that the right picture?
MR. HASTINGS: No. This is Peter Hastings
again. That's not the case. The details of how we
work within the construct of the DOE badging program
has not been worked out yet but there will be a
limited number of people who are separately badged to
get into the MOX facility.
MEMBER LEITCH: Okay. Thanks.
MR. WESCOTT: Next one please. In terms
of review criteria there are four basic criteria. The
criteria likelihood was directly applied as I just
said before to an evaluation of the natural phenomena
and external manmade events. For process hazards the
licensee assumed that all process hazards that could
have an over-the-threshold consequence had a
likelihood of not unlikely which basically means
having a probability of one. They will occur. So we
didn't apply likelihood in terms of what the event
probability was to the process hazards but we did
apply it to the natural phenomena and the external
events.
The next criteria that was often used was
what we call deterministic approach or deterministic
argument. Deterministic arguments were applied for
many of the facility worker consequence evaluations.
In these evaluations sometimes the staff required
additional information such as dose calculations to
evaluate the reasonableness of the argument.
The applicant also applied deterministic
reasoning for excluding some natural phenomena and
external manmade events from consideration such as
amounts of explosives that would be required to reach
an over pressure, things like that as opposed to
probability.
The use of safe and accepted practices was
often applied to the selection of PSSCs and mitigation
and/or prevention strategy. In some cases the staff
actually researched the history of certain types of
events and upsets to establish what practices may have
caused the event. In other cases adherence to
standards, regulatory guides and practices safely used
in the nuclear industry was accepted as an indication
that the strategy would be a safe and accepted
practice.
CHAIRMAN POWERS: Many of the features of
the design that has been put forward are not unlike
features of designs in DOE processing facilities.
Many of the features of course parallel or draw from
the system that's available in France. Did the staff
attempt to look at the event history of DOE facilities
and the event history of La Hague?
MR. WESCOTT: I think you will see in our
chemical process review there is certainly some
history of the DOE facilities. I don't know how much
history from La Hague is in there. But when Alex
gives us his presentation he can probably give you a
much better answer than I can on that.
Finally the last criteria was the
availability of mitigation prevention strategies.
That was primarily applied to the prevention or
mitigation of consequences to the site worker or
public or in some cases environment from process
hazards. One guide that we use was a table A5 in
NUREG 718 which basically assigned an average
probability of failure on demand to types of controls
generic names and controls such as passive engineered
control or robust passive engineered control or active
engineered control or administrative control and so
on.
And by looking at these probability
assignments taking the description of the PSSCs we
could come up with a gross idea of what we thought the
reliabilities could be. Then by recognizing that by
proper selection of a surveillance interval, you can
greatly increased reliabilities and decrease the
probability failure on demand.
We basically accepted the strategies
providing that it would surveillable. The strategies
would probably be able to meet the performance
requirements in 70.61. We did not require the
applicant to do a demonstration at this point of what
the probability or reliability would be. We just
accepted that if it had certain characteristics of
design and surveillance could be applied to it they
could probably reach the performance requirements.
Next slide. My last year's slide, this
one and the next slide represent the organization of
unresolved issues from a performance perspective.
This slide is a listing of unidentified events which
will be talked about in more detail by the speakers
following me. I want to note that the steam explosion
was probably actually the one event that was
identified from the ISA review or SA review that took
place on site. We had noted that steam explosions
were part of the Los Alamos safe analysis from a water
cooled sintering furnace. We felt that steam
explosions should be part of this review when the
applicant is providing us information on this.
CHAIRMAN POWERS: When you speak of steam
explosions you are referring to the explosive
interactions that occur when molten material contacts
water?
MR. WESCOTT: No. In this case I don't
believe we are. I think we are more concerned with
the possibility of water in the cooling jacket
contacting the furnace or I think the applicant is
also looking at the possibility of moisture through
the bubbler system going into the furnace. I think
there is a number of different modes. But no, I don't
think the molden metal contact.
CHAIRMAN POWERS: So you're not talking
about a shock wave here.
MR. WESCOTT: Not to my knowledge.
CHAIRMAN POWERS: Just a pasteurization
event.
MR. WESCOTT: I don't believe that's one
of those initiators that is being watched.
CHAIRMAN POWERS: So steam explosion means
something else.
MR. WESCOTT: Yes. When we did our tour
review for melter we were looking at just that. But
that's not a situation here.
MEMBER BONACA: Is there a difference
between you and the applicant about what should be
considered or simply the application ignored this?
What I'm trying to understand is did they present
these events and say that they are so unlikely that
they don't need to address it in the design basis or
did they simply not address them all together?
MR. WESCOTT: I think the best way to
characterize these are that we did not see evidence in
the CAR that this events were addressed and we thought
they should be. Now it's possible we could get a
response back saying well we really did address this.
It's part of such and such. If we agree that would be
an acceptable answer. So I wouldn't like to
characterize these as disagreement at this point.
These are just things that filtered back up from us
that we thought should have been looked at.
CHAIRMAN POWERS: I'm fascinated by the
last one on the list.
MR. WESCOTT: Titanium fires. Yes. Alex
will talk to you about that.
CHAIRMAN POWERS: Okay.
MEMBER SIEBER: So everything burns.
MR. WESCOTT: This final slide is where we
had problems with the strategies. Like I said in most
cases this is where we did not feel that the strategy
that they were using filled our criteria for safety or
accepted practice. We thought there should be a
little more there or something a little different.
That's why we identified these.
I want to note that the laboratory
explosion and the sintering furnace leak are both
facility worker only. We don't have a problem with
the consequences to the site and public. We think
they've solved that problem. But they just have a
problem with the worker dose.
The process safety I&C system is one I
think primarily of nomenclature. They are going to
rename this system but they haven't done it yet to
make two other systems. But that is still an open
item. So this is just a listing of our open items
which require additional information in the strategy
area.
MEMBER LEITCH: The fact that criticality
preventions is not on these lists that implies that
you are satisfied with the information that you've
received.
MR. WESCOTT: I think there are some open
items in criticality but they are more or less --
Drew, I think you'd better speak to that one. I don't
know if Chris Tripp is here or not so we can
characterize the criticality problems better.
MR. PERSINKO: No. There are open items
in the criticality area as I mentioned two or three
early on in my presentation but they're not on this
slide right now. But I would also like to say that
this is the significant open items. This is not the
all encompassing list. So don't think that because
it's not on here that it's closed. There are open
items in the criticality area.
MEMBER LEITCH: Okay. Thanks.
MR. WESCOTT: One thing I might add that
there are some issues concerning design basis that are
very significant but the way we did the review they're
not really coming up back through the safety
assessment presentation because they are more in a
technical review area.
In other words they don't represent a
problem with identification of hazards or formulation
strategies. They have the right hazard. They have
the right strategy but they don't have the right
design bases on the system or whatever they are using
to mitigate it. That concludes my presentation.
MEMBER KRESS: I thought red oil was
placed in the category of a red herring. Is it still
around?
MR. WESCOTT: It may well be. We're in
fact going to talk about that. That's another one for
chem safety.
CHAIRMAN POWERS: I don't think there's
anything red herring about it at all.
(Discussion off microphone.)
MEMBER KRESS: Tributyl phosphate will
really explode on you.
CHAIRMAN POWERS: It definitely can form.
It definitely is problematical. It's definitely a
mystery.
MEMBER KRESS: What is meant by laboratory
explosion?
MR. WESCOTT: Well what they've done in
their safety analysis is they looked at explosions in
the laboratory and basically in the CAR stated that
they are going to develop a strategy at the O/L stage
for protecting the worker from laboratory explosions.
It was our opinion that really that needs to be done
to meet the requirements of the regulation at the CAR
stage.
CHAIRMAN POWERS: That's a challenge.
MR. WESCOTT: Yes. It probably is.
CHAIRMAN POWERS: That's a challenge. I'm
always fascinated to watch that. A suit of armor that
would work. Make it a little cumbersome to work.
MEMBER KRESS: What was your problem with
the HEPA filter efficiency? Is it because you expect
them to not be installed correctly or you have the
wrong particle size or what?
MR. WESCOTT: I think the problem there
and someone should correct me if I'm wrong was that in
a fire we did not feel that the applicant should take
full credit for the filter. I think he wanted to take
99.99 percent efficiency credit for that. During a
fire we felt that soot loadings and other problems
could significantly reduce the filter efficiency so
that in the consequence analysis and other lesser
filter efficiencies should be assumed then that's as
yet unresolved.
MEMBER KRESS: Yes. That seems like a
problem to me because filter efficiency is either
99.99 or zero usually.
CHAIRMAN POWERS: Well in this case I
think there is a different issue in my mind on HEPA
filter with plutonium particles is "knock-along." The
radioactive decay causes the little particle to jump.
So it sits on one filter and decays and goes through.
Now you have just a single filter.
MEMBER KRESS: These are alpha decays.
CHAIRMAN POWERS: Sure. It's called
knock-along.
MEMBER KRESS: It knocks them along.
CHAIRMAN POWERS: It's been something that
they've been fighting with at Los Alamos for a long
time. It moves little particles down pipes and things
like that. It's fun to watch.
MEMBER LEVENSON: Especially 238.
CHAIRMAN POWERS: 238 is by far the worst
on that.
MEMBER ROSEN: On your eight bullets on
this slide you characterized the nature of the issue
pretty well except in the case of the red oil and the
HAN. Do you want to say anything more about that
here?
MR. WESCOTT: Well, they are both
explosions and they'll be talked about in chemical
safety. I think the reason they are where they are on
the list is because even though they were identified
as events we don't feel that the preventive strategy
is truly sufficient for preventing the event.
MEMBER ROSEN: So we will hear more about
that this afternoon from Alex Murray.
MR. WESCOTT: That's correct.
CHAIRMAN POWERS: In the area of red oil
I know no way to do it except the empirical definition
of regimes not to get into. How do you mitigate or
prevent something happening that you don't know why it
ever forms. The only way to do is say empirically I
know it doesn't form here.
MR. WESCOTT: Yes. I'm afraid to answer
that one way or another. I better let Alex address
that.
CHAIRMAN POWERS: Sure. You have
completed your presentation.
MR. WESCOTT: That's correct.
CHAIRMAN POWERS: Any other questions?
Seeing none, I think I will recess us until 1:15 p.m.
(Whereupon, the foregoing matter went off
the record at 12:08 p.m. and went back on
the record at 1:15 p.m.)
A-F-T-E-R-N-O-O-N S-E-S-S-I-O-N
1:16 p.m.
CHAIRMAN POWERS: I think we've now moved
on to the specific topics, beginning with radiological
consequences, chemical safety and fire protection, and
I'm going to turn to somebody. Am I turning to you?
MR. BROWN: Good afternoon. My name is
Dave Brown. I'm the radiation safety and
environmental protection reviewer for the MOX Review
Team. I'm going to speak this afternoon specifically
about the applicant's consequence assessment
methodology, and the results, and even more
specifically about radiological consequences that were
devised as part of this assessment.
First slide please. Within this area, my
review consisted of reviewing the applicant's source
term calculations for events postulated in the hazards
analysis. We also looked at for the facility worker
some radiological consequences, even though the
applicant's position here is that through the facility
worker, if he's involved in an event that's determined
to be unacceptable, therefore they're going to apply
PSSCs to protect him or her.
There were some areas where the staff had
questions about the PSSCs applied and we asked for
those calculations to show that those PSSCs were
actually going to do the job.
MEMBER KRESS: Were these radiological
doses or did they have any toxic?
MR. BROWN: There's certainly a chemical
hazard present at the plant. Alex can speak best to
that.
MEMBER KRESS: Oh, that's another
presentation.
MR. BROWN: Chemical safety, next
presentation. And then for the other receptors,
namely the site worker, the public and the
environment. They looked at how the applicant
performed downwind consequence assessment and
hopefully what we're looking at is once the PSSCs were
applied, they reduced the risk from the event to
acceptable levels, and acceptable being defined in the
new Part 70.
CHAIRMAN POWERS: How do you judge risk?
I mean you've got consequences, but you don't have
frequencies.
MR. BROWN: Well, the way the Part 70 is
written, specifically 70.61 is the high consequence
event, which is defined as greater than 100 rem to the
worker, 25 rem to the public, must be highly unlikely.
So, they can choose to reduce that consequence to
acceptable levels, so therein it lies the
CHAIRMAN POWERS: So you have risk in the
sense of pretty unlikely, highly unlikely, very highly
unlikely.
MR. BROWN: And the second one I should
describe is what we call the intermediate consequence,
which is 25 rem to the worker, 5 rem to the public.
Those must be unlikely or be mitigated to acceptable
levels. So that's our risk scheme as it were. Can I
have the next slide please.
MEMBER SIEBER: Did you evaluate the
equivalent ODCM type chronic releases?
MR. BROWN: I'm sorry, I'm not sure I
understand you.
MEMBER SIEBER: Did you evaluate the issue
of chronic releases, you know the things that happen
every day to some extent and what impact that has on
the environment?
MR. BROWN: What we focused on here in the
safety assessment were events that are not what I
would call the anticipated events, but less likely
than that. So for routine emissions, we certainly are
looking at that within the scope of the EIS.
MEMBER SIEBER: Okay.
MR. BROWN: So far we don't have any issues
in that regard. I think they fall well within, for
example, the 10 millirem constraint on air emissions.
I'll just briefly outline the applicant's
approach here. They use our nuclear fuel cycle
facility accident analysis handbook and the so-called
five factors, which I'll talk a little bit more in a
minute about.
For downwind consequences, using a 9th
percentile atmospheric dispersion parameter of chi
over Q (X/Q), using site specific date from the H-area
met tower, and I'll just reiterate that the four
receptors we're kind of looking at independently is
the facility worker, the person say right next to the
glove box, the site worker who's outside the plant's
restricted area on DOE controlled property, a member
of the public generally considered to be at least
eight kilometers away, because this plant would be
located pretty close to the center of the Savannah
River Site. The west boundary is at least that far
away.
CHAIRMAN POWERS: How about the highway
that runs through it.
MR. BROWN: The highway runs through closer
than that, and in the context of Part 70 and
performance requirements, we consider those folks a
transient population. We disregard the Part 20
requirement is adequate protection for them. We will
certainly get more into that as we look at the site's
emergency plan later on, how they plan to control
access to the site.
CHAIRMAN POWERS: They can control access.
The fact is there's access. It's not like it's an
abandoned highway. I mean there are people out on it.
MR. BROWN: Yes, and as I say for the sake
of this assessment, we've accepted them as a transient
population. They're not specifically say a member of
the public for the purposes of the accident analysis.
CHAIRMAN POWERS: I mean why is that? I
mean I don't understand. People are driving cars on
the highway. They're going to be there if you have an
accident because they'll be driving on the highway.
MR. BROWN: Well, I think it's a good
question, and it was addressed as far as the rule
making for this regulation, and it was the
commission's position that this would be, that these
folks would be adequately protected by Part 20
requirements.
I just want to spend a couple more seconds
on that. You asked a question earlier about the
public and the site worker, and I think it's worth
stating that the regulation does address the so-called
site worker in a different way. The word that's used
is non worker.
CHAIRMAN POWERS: Which might cause
substantial resentment.
MR. BROWN: The purpose of defining the non
worker is to say that if to describe which
performance requirements apply to that individual and
would apply to your example of the secretary. The
regulation has provisions for the training and posting
requirements.
If the applicant meets those requirements,
then they can treat these individuals as workers for
the purpose of the safety assessment, and later in the
ISA, and they've made that commitment to provide that
training and to provide the posting.
MEMBER KRESS: Is there something in the
Part 70 that requires them to use the 95th percentile
chi over Q?
MR. BROWN: No, it's not required by
regulation.
MEMBER KRESS: I'm just asking is that
actually conservative?
MR. BROWN: This comes out of really a
handbook, I think.
MEMBER KRESS: A handbook?
MR. BROWN: We've got, the staff, any
applicant using a nuclear fuel cycle facility accident
analysis handbook, and it's supposed to
MEMBER KRESS: And that recommends the 95th
percentile?
MR. BROWN: Yes, it does. There's a
section in the back that specifically, an appendix
that describes meterology.
MEMBER KRESS: That's sort of doubling up
on the highly-unlikely posture.
MR. BROWN: No. It's credited as part of
reducing the likelihood of an event.
MEMBER KRESS: You have unlikely. This
makes it even more unlikely. It seems like you're
doubling up on it to some extent.
MR. BROWN: I think I understand. The
regulation requires the event be provided, so and what
you're kind of addressing is what's the likelihood of
that consequence would occur, and we're treating it as
really separate.
CHAIRMAN POWERS: Let me understand exactly
the 95th percentile of what? This is a chi over Q and
taking the 95th percentile of?
MR. BROWN: Hours, typically. In other
words, for hourly observations in a year.
CHAIRMAN POWERS: So you're taking the 95th
percentile meteorological conditions?
MEMBER KRESS: The worst in terms of dose.
MEMBER ROSEN: It isn't the worst at all.
MR. BROWN: No, it's not the worst, no.
CHAIRMAN POWERS: What I'm interested in
MEMBER ROSEN: It's stable right? I always
assumed it was a Class F.
MR. BROWN: Which would be the one hour
during that year, the basis for a year of
observations, where the conditions were most favorable
and the wind speed was lowest.
MEMBER KRESS: Ninety-five percent of that.
CHAIRMAN POWERS: Let me ask this question.
MEMBER KRESS: Ninety-five percentile is
better than this chi over Q.
MEMBER ROSEN: Right, and I'm saying that
a worst assumption than that could be made.
MEMBER KRESS: Yes, one could assume that
it was stable, that everything that was released just
stayed there.
CHAIRMAN POWERS: I'm not sure that that's
the worst. I guess is this chi over Q methodology
that's used, the staff is engaged in an uncertainty of
consequence analyses, and in that they of course were
interested in more sophisticated modeling than just
chi over Q methodologies. How does the chi over Q
methodology compare to those more sophisticated
techniques?
MR. BROWN: Which can you describe the
more sophisticated technique?
CHAIRMAN POWERS: Well, I mean the chi over
Q is kind of a Gaussian plume sort of modeling and
especially in Europe, they're going away from the
Gaussian plume type models toward other kinds of
processes that I don't even begin to understand, but
far more sophisticated, and the objective, of course,
was to understand what kind of actual dispersal you
got at some distances away.
And so what I'm interested in is if I use
chi over Q and I use a more sophisticated method, is
the chi over Q bounding on that more sophisticated
method, or in the case that they found for the max
code, that's not the case, if I'm looking at things
other than prompt fatalities.
MR. BROWN: I don't think I'm really
prepared to talk about that. I think one of the
issues you may be touching on is this issue of dose
reconstruction from an event where the meteorological
conditions are recorded and known versus predictive
assessments of this type, where you're just
postulating future conditions.
CHAIRMAN POWERS: That's one way to lead
you to more sophisticated methods all right. If you
try to do that.
MR. GITTER: This is Joe Gitter. Let me
just comment on that a little bit. We know in reality
that Gaussian plume models aren't what you would see
in reality following a release, but if you assume, you
know, if you make conservative assumptions or you use
a 95th percentile chi over Q data, you're going to be
looking at and use that in conjunction with the
Gaussian plume model, I would think that would tend to
be conservative, relative to what you would see in
reality.
You know, we know from experience from
Three Mile Island that the wind can change directions,
and if you're looking at dose projections to a
receptor downwind and that direction doesn't change,
I would think that would tend to be conservative.
But without knowing the details of the
models that you're talking about, I think it would be
difficult to answer that question.
CHAIRMAN POWERS: In general, what they
found was that plumes, real plumes, tended to disperse
more and what you get with the Gaussian plume model,
you might think well, that's good and it's good if you
only looked at prompt fatalities, but you probably
aren't looking at any prompt fatalities. You're
probably looking at cumulative dose, in which case
that's bad to get more dispersal.
MR. BROWN: I'll bring this issue up in a
subsequent slide. It's a quick overview of their
methodologies.
CHAIRMAN POWERS: For the source do they
use Machima's database?
MR. BROWN: Yes, that's right. That's what
we were reviewing is their application of essentially
Machima's database, making sure that for the
approximated event category, say fire, and material,
say a powder, that they used to look at release
fractions and respirable fractions.
CHAIRMAN POWERS: Using the word
appropriate and Jofu's database, it's a bit
congruent, isn't it?
Well, I mean Jofu's got I mean some of the source
terms were creative to say the least. He burns things
on a piece of filter paper, and from that and furs
which get out of a fire.
MR. BROWN: I think for this stage of
review, for construction authorization, in many cases
we don't have an advance concept of the design of the
glove box where it is in a room and that sort of
thing. Experimental data of that type is the best
information we have, and it is the guidance that we've
recommended that the applicant use.
MEMBER KRESS: How do you arrive at the DR,
the damage ratio for the material at risk?
MR. BROWN: For the most part, the damage
ratio is assumed to be one. All of the material in a
given processing that's involved in the event is
involved.
MEMBER KRESS: Okay.
MR. BROWN: And that's I'll talk a little
bit about that too. I'll just say quickly, we did
verify by independent calculation that the chi over Q
is reasonably conservative. In other words, we asked
for the site specific data and ran the codes ourselves
to verify that they were using correct values.
MEMBER KRESS: You used RASCAL?
MR. BROWN: In this case, ARCON 96 for
close in, and MACCS for the site.
MEMBER KRESS: For the site boundary.
MR. BROWN: Total area boundary for the
public eight kilometers away. And then using that
information, the staff independently derived
information, we would go on and assure ourselves that
the accident risks were adequately reduced.
My next slide, please. Again with regard
to those terms, we looked at each of the five factors.
For material at risk, the applicant provided inventory
for all of the rooms in the plant that are going to
have material. There are more than 100 materials at
risk or inventory units.
The damage ratio was conservatively
assumed to be one, so if I had 60 kilograms in the
glove box in that room, all 60 kilograms would have
been involved, whether it was fire or load handling of
that.
Atmospheric fractions and respirable
fractions are the areas where we certainly had to make
sure we were careful to get values that were chosen
that were at least as consistent as possible with the
types of phenomena that are provided in the handbook.
CHAIRMAN POWERS: You must clearly use a
specified respirable. You've got some sort of a model
in mind when you define respirable fractions?
MR. BROWN: In this case, respirable I
believe is defined as one micron.
CHAIRMAN POWERS: One micron?
MEMBER KRESS: I thought it was point four.
CHAIRMAN POWERS: No.
MEMBER KRESS: It's point two to something.
CHAIRMAN POWERS: It's virtually any number
you want. It depends on what material you're using
and things like that. But one is a pretty
MEMBER KRESS: It's a pretty big particle,
I think.
CHAIRMAN POWERS: I've seen people using as
high as ten. Anything less than ten microns went to
point 05 or something like that.
MR. BROWN: I'm not sure. I may have
mispoken on that. We haven't made any assumptions
with regard to particle size for specific areas to
that process. It's, for example, for those
conversation factors, the particle size is assumed to
derives at those conversation factors, they would be
in the federal guidance.
CHAIRMAN POWERS: The one conclusion I get
on respirable fraction is you need to ask what it is
because everybody seems to use a different set of
numbers for that and they can defend it papers and
literature, of which there are several hundred, and
people will it depends on how you do the test.
MEMBER KRESS: It's too big to move by
diffusion, too small to
MEMBER LEVENSON: It also depends on what
you mean by respirable, because CDC is a ten but they
don't deem that that gets to the one. It gets to the
nose. They take a fraction of about one as ending up
in the gut. So respirable means different things to
different people.
CHAIRMAN POWERS: To different people.
MR. BROWN: The last slide in the course is
the leak path factors, and for this application, what
we're talking about pretty much exclusively are HEPA
filters, a factor to 10-4 production in the source
term for two HEPA filters and series. You notice I
have the words "open" next to the last two items.
The open issue with regard to respirable
fractions has to do with taking that credit when
you're deriving a source term for an environmental
consequence. In other words, one of our performance
requirements is not to contaminate the environment.
Producing a source term by that value wouldn't be
appropriate, because it's not a human health
consequence.
MEMBER KRESS: But it's all constrained to
be back out on that filter. Are you figuring that's
a problem? I mean it's not contaminating the land or
the buildings like it says right there on that filter.
MR. BROWN: Well you're deriving an un-
mitigating consequence and you haven't even applied
the filter to the principal SSC, as it were. Using
the filter isn't there. In some cases, for human
health consequences, you would reduce the source term
to include only the respirable fraction, per se, a
downwind human health consequence. But production
isn't appropriate for the environmental health
calculation.
MEMBER KRESS: I agree with the respirable
fraction part of it. I'm not sure about the HEPA
filters.
MR. BROWN: That's open for another reason.
I'm sorry.
MEMBER KRESS: Oh, I'm sorry. I was
mistaken to your point.
MR. BROWN: I'm sorry. The second reason,
the reason for the HEPA filter being open is, as I
think we described before, for severe conditions, the
staff haven't accepted the use of a leak factor of
10-4 which equates to an efficiency of 99.9 percent.
MEMBER KRESS: Why is it you're questioning
that efficiency? Aren't they required to go in and
measure that after they install the filters?
MR. BROWN: Later on, certainly they'll
I imagine they'll have a commitment to a surveillance
program for the filters, but at this stage, again
referring to our handbook, and other regulatory
guidance, for severe conditions, the staff would say
that across the whole system, the efficiency of this
credit, it shouldn't be any more than 99 percent. It
is cited in our handbook, and I think they got 1.52.
MEMBER KRESS: That brings down the 10 to
-2?
MR. BROWN: Yes, a leak factor of 10-2 .
MEMBER KRESS: Where is this active decay
moving of the plutonium part of your thinking, part of
the knock off?
MEMBER ROSEN: Knock along.
MEMBER KRESS: Knock along.
MR. BROWN: Not a consideration in this.
CHAIRMAN POWERS: I think in setting those
things of people under severe conditions, people were
worried about overloading and what
MEMBER KRESS: Getting a delta P across it
with some moisture and then actually failing the
filter.
CHAIRMAN POWERS: Well, water even
penetrate the filter. I mean it's not a hole, but it
ends up on the other side of the filter.
MEMBER KRESS: The history that I'm
familiar with on HEPA filters is not a bad number to
use all the time, because the likelihood of
misinstallation is high enough.
CHAIRMAN POWERS: Well, unless you use a
DLP and check it after you install it.
MEMBER KRESS: Yes, and when you do that,
I mean most of the time you find 10-2 is not a bad
estimate.
MR. JOHNSON: My name is Tim Johnson.
Maybe I can add a little bit more information on this.
There have been cases in plutonium facilities and in
fuel fabrication facilities where under severe
conditions like fires, filters have been damaged, and
that's a principal concern. You know, even though you
have redundant filter banks, one of them could be
damaged, and basically the efficiency of one of those
banks, you know, may go to zero.
I mean that's one of the key reasons why
we've asked DCS to provide additional justification to
support their proposal to use that 10-4 leak path
factor.
MEMBER ROSEN: Why do you say on one of the
two factors in a series configuration, I guess you're
talking about, would be damaged in the event of a
fire. If a fire occurs, it could damage both of them,
couldn't it?
MR. JOHNSON: Well, hopefully in a well-
designed HEPA filter system, you've got additional
protections. There are spark arresters that are going
to be in place that would help remove larger pieces of
material that may be very high temperature. You have
pre filters that will also act to protect the HEPA.
You have in the final assemblies, you also
have two banks of HEPA filters. The design strategy
that DCS has proposed is to try to limit a fire to a
specific fire area, and that way air from other areas
could dilute the temperature. So when you put all of
those together, I think we can conclude that a HEPA
filter system design that they have, you know, can be
effective.
The question is, how much credit do you
give for it, but we're not proposing that the HEPA
filters in the system that was proposed won't do the
job. The question is what should the credit be for
it?
MR. BROWN: The next slide, please. Okay
going back to chi over Q, we believe there was, using
ARCON 96 and MACCS 2 and the site specific data, we've
independently verified that those values were
reasonably conservative.
Again, my last statement there is on the
applicant's safety assessment for environmental
protection, they incorrectly I brought this up in
November, incorrectly used the controlled area
boundary as the boundary beyond which we're concerned
about the environment, when it's really the restricted
area boundary very close into the plant that is that
boundary beyond which we're concerned about the
environment. So, they had to revise their safety
assessment for that one performance requirement.
MEMBER KRESS: That's a difference of six
kilometers?
MR. BROWN: They went to eight kilometers,
when it should have been more like, less than 100
meters.
MEMBER KRESS: One hundred meters.
MS. WESTON: Could you give us some of
those specifics on ARCON 96.
MR. BROWN: Some of the specifics?
MS. WESTON: Yes.
MR. BROWN: This is a code which used as a
standard Gaussian model is used in other NRC codes.
It includes two additional
MEMBER KRESS: That's the one you used for
control room habitability?
MR. BROWN: Right, and for control room
habitability it does include taking a credit for
building wake effects, and one item I'm sorry I didn't
list here is low wind speed plume meander, is another
correction that the code applies.
CHAIRMAN POWERS: Is there a document on
this?
MR. BROWN: Is there documentation?
CHAIRMAN POWERS: Yes.
MR. BROWN: Yes.
CHAIRMAN POWERS: Can we get that?
MR. BROWN: You can get it's a new reg
published. I don't unfortunately have the number with
me, but I can get the document number.
MS. WESTON: Would you?
MR. BROWN: Okay.
CHAIRMAN POWERS: Areyou going to ask them
to do a wind tunnel test on their facility before this
is all over?
MR. BROWN: That's not anticipated at this
point. No.
CHAIRMAN POWERS: Truthfully, the only way
you can get accurate wake effects.
MR. BROWN: I think it's certainly
something we can look into, but I don't think it's
anticipated now.
MEMBER KRESS: The ARCON 96 correlations
are based on wind tunnels, and dual configurations.
CHAIRMAN POWERS: I know any time you try
to do it on an actual facility, the only way to
actually do it is to do the facility itself. I don't
know anybody that can protect, even with fancy codes.
They end up having to refine it based on the wind
tunnel test.
MEMBER KRESS: I wouldn't be a bit
surprised.
CHAIRMAN POWERS: It's not that difficult
to do, a wind tunnel test. You just build a role
model.
MEMBER KRESS: And blow out on it.
MR. BROWN: Okay. The last area of the
staff's review, seeing how all that built up to show
that the safety strategy that the occupant proposed
would actually reduce the risk, again what we were
looking at is the controlling events. There are event
categories, you know, fires, flow drops, loss of
confinement events. There are about six of those.
Within each category, there are event
groups and the total number of event groups as Rex
mentioned earlier is about 50, and it's at that level
that the applicant has identified a safety strategy
for an event group, and it's at that level that the
staff verified that that strategy was adequate, which
is two issues.
For the facility worker, there was an
event, a loss of confinement event. It was a
sintering furnace seal leak, and the question that the
staff had was pertaining to this PSSC training and
procedures, which we now commonly understand to be
worker action. The worker takes an action that's self
protective, either to leave the room or to don a
respirator.
It wasn't clear to staff how that worker
would become aware of such an event. In many cases
where the strategy's applied, the incident itself is
self evident. Fuel assembly drops and makes a big
noise.
But in this case, it wasn't clear how the
workers would become aware, so we asked for additional
information. And, of course, the revised AP
assessment would be the consideration of the
environment being closer in, is something we're still
looking at. The applicant submitted their summary in
March, and we're still looking at it now.
MEMBER ROSEN: Before you get away from
that slide, help me understand what you really mean
with a bullet that says, staff independently valuated
where the applicant's safety strategy would reduce the
risk posed by controlling events. Let's take a case
in point. The low drop.
MR. BROWN: Okay.
MEMBER ROSEN: How do you reduce the risk
by controlling low drop? I mean you're either going
to have a low drop or you're not. Maybe you could be
sure you're not going to have a low drop by saying,
we're not going to pick up any load, just not have any
handling facilities. But a facility is typically
needed to be able to lift heavy objects.
MR. BROWN: That's right.
MEMBER ROSEN: So you will have plants and
rigging and all the accouterments that go with needing
to move heavy objects from one place to another. So,
how does one go about now you're going to tell me,
well we train our operators.
We make sure the slings are examined every
two weeks and before and after each heavy lift, and we
use heavy loads, tests before each spring, and you're
going to say we do that every time anyway and we still
drop things.
I mean there's no way to ultimately be
sure that you're not going to have such an event.
Does the strategy rely on being sure you're not going
to have, absolutely not going to have such an event?
MR. BROWN: No. The safety strategy is
usually first determined on the basis of what are you
going to do? Are you going to prevent this from
happening, or are you going to mitigate the
consequences so that the consequences are acceptable.
MEMBER ROSEN: Yes, but about mitigation
for the moment. When you say prevent, that means
none, right?
MR. BROWN: Well, it means unlikely or
highly unlikely depending on the consequences of the
event. That's the risk scheme that I talked about
earlier.
So, for example, if the consequence to the
worker was to be 35 rem from the event, that's an
intermediate consequence event. It should be shown to
be unlikely. The applicant defines that, but they
need to give us assurance that, in fact, that event
would be unlikely.
MEMBER ROSEN: They tell you what things
they're going to do to make it unlikely?
MR. BROWN: That's right.
MEMBER ROSEN: And you said, okay. What
would you do now to make it highly unlikely? They'd
have to tell you a few more things?
MR. BROWN: Well, more robust principal SSC
that achieves that goal in and of itself.
MEMBER ROSEN: I've been dying to ask this
question all day and I guess I'll ask it now. What's
the directional between likely and highly unlikely?
MR. BROWN: I think Wes would actually be
willing to address that question.
CHAIRMAN POWERS: Pretty damned unlikely.
MR. WESCOTT: Yes, this is Rex Wescott.
Our SRP defines the value of 10-5 for highly unlikely.
I think we had something like four times 10-3 for
unlikely. But actually in looking at most of these
actions and whether the mitigation strategy, or
prevention strategy is going to be highly unlikely, we
didn't attempt to get tied up in numbers.
Basically, it was looking at the
robustness of the type of procedure, whether
surveillances could be performed and thus increase the
availability, but we didn't try to get into worry
about whether that was four time 10-5 or, you know
five times 10-6 or whatever like that. But I think
actual numerical reliabilities we make, we're more
likely to get into at the OL stage. I would remind
you too that
MEMBER ROSEN: You do have a number in mind
as a threshold, but you don't calculate the actual
circumstance, because you don't do a risk analysis.
And so, I'm left, of course, with the question that
one concludes. Are you above or below the threshold
of quantitative analysis?
MR. WESTCOTT: Well, Part 70.61 doesn't
specify a number in itself. The number comes out of
our SRP, and in fact, 70.61 also allows a qualitative,
as opposed to a quantitative approach.
MEMBER ROSEN: I'm aware of that. I'm just
saying, leaving the regulation aside, and granting
that you're within the regulation, it doesn't require
a quality. I still don't know how you make a
decision? Say okay, that's enough. It's highly
unlikely, or that's not enough.
MEMBER KRESS: There's some criteria. You
kind of missed it.
CHAIRMAN POWERS: Steve, you'd be amazed at
how many of us make decisions without having
quantitative criteria.
MR. BROWN: Gary, would you like to say
something in this regard.
MR. KAPLAN: Gary Kaplan. I have a couple
comments. First, with regard specifically to the
assembly drop. Of course, we can't make those highly
unlikely because the likelihood of a drop is 10-5. So
for that specific case, we basically said, we'll do
what we can to prevent that, but the strategy is for
the operator to leave the area, and we've done
consequence analysis that shows a low consequence of
that basically.
So for that specific case, we're not
attempting to say we prevent those events, 10 CFR 61.
In general, for all the site and facility worker, and
public cases, we did not take credit in any case for
saying an event, the consequences were intermediate,
and therefore we only have to make the event unlikely.
In all cases, if it exceeded the low
consequence threshold, then we said we're going to
make the event highly unlikely, because the range
between 25 rem and 100 rem is too narrow. There are
too many uncertainties in the questions you've been
asking today, so we didn't want to credit that.
So, the only place where it makes a
difference is in the environmental compliance
calculation, where that specifically is if you exceed
that requirement, then you have to make the event
unlikely. There's no requirement to make that event
highly unlikely at that point.
MEMBER KRESS: And the other part of his
question was, how do you know that it's highly
unlikely? That's some deterministic rules that you go
by.
MR. KAPLAN: That's right. Well, the rules
we talked earlier were we meet single failure criteria
to start with. We apply NQA 1 to all those IROFS. WE
apply the code and standards that were describing and
discussing with the staff to agree on to get a certain
reliability of those IROFS, and also we are going to
describe how to detect failure of those IROFS, so
we'll know if we're surveiling them weekly, monthly.
We'll be able to describe that.
From that, you can on simple systems, you
can easily show that you meet a very high reliability
for that system. For more complicated systems, such
as like the HVAC system, those we've committed to
doing additional quantitative analysis to support the
deterministic analysis.
MEMBER KRESS: Using a fault-tree process?
MR. KAPLAN: Or something similar to that,
that's correct, what's appropriate for the system.
MEMBER ROSEN: And you can detect the
incipient testing a lot and you have high quality
equipment because it's NQA 1, you said?
MR. KAPLAN: That's right.
MEMBER KRESS: And you have redundancy
problems?
MR. KAPLAN: And we meet single failure.
MEMBER ROSEN: And you meet single failure,
but that clearly, we know that all, almost all high
consequence events are a result of multiple failures
of varying kinds, human and equipment.
So just meeting a single failure criteria
is not much comfort, because if you look at the
history of events that we know about, that have been
bad enough and people have written up and new LARs and
that kind of thing, there are always things that had
more than one thing happen that go wrong. So in
meeting the single failure criteria is a very low
threshold to serious events.
NQA 1, yes that's a quality standard, but
in another venue of mine, I know from looking at a lot
of data that high quality industrial equipment and
safety-related equipment, equipment that's been bought
to the equivalent to NQA 1, has the same reliability.
NQA 1 doesn't confer any special additional
reliability. So that's also not of much value in
terms of better. It's not any additional value beyond
specifying and buying and properly maintaining good
quality industrial grade equipment.
MR. HASTINGS: But don't exclude the
applicant this is Peter Hastings. Don't excude the
applicability of reactor type engineering standards to
the design and specifications of those systems that
are then procured and maintained under NQA 1. It's
the combination of those two that get you to the kind
of reliability indices that are indicated in the
standard review plan, Appendix A, as getting you to
highly unlikely with the appropriate single failure
treatment.
MR. KAPLAN: And again, I'll reiterate, for
those events that have the opportunity to impact the
public, we've also committed to an additional analysis
to demonstrate that the event is highly unlikely and
not just rely on qualitative measures.
MEMBER ROSEN: So the sanctions, what makes
it highly unlikely is not a detailed look at the
sequences, definition of split fractions and
calculation of the various sequences for that
particular accident. That's not how it's done because
that's PRA.
What's done here is simply looking at the
defenses, and saying with the high quality equipment,
it meets single failure criteria, and we test the
stuff so we know it will work, and therefore it's
highly unlikely.
MR. KAPLAN: This is Gary Kaplan again.
For each event in the ISA, we are going to identify
the event sequence, so we will spell that out.
MEMBER ROSEN: You're almost there. All you
need to do is put a split fraction on it and calculate
and run it through and you're there. But it's a
religious persuasion on my part and not on your part.
You won't do it, and I would insist that you do.
MR. KAPLAN: For most of our events, it's
relatively simple, because they're simple events.
MEMBER ROSEN: No, you don't need a
computer code for most of these events.
MR. KAPLAN: I could diagram for you right
now split fractions. We could argue for a few minutes
about the split fractions, and when we're done with
that argument, we'd calculate it by hand and that
would be the end of it. It seems like an easy thing
to do, but I won't argue with Part 70. That's not my
job.
MR. WESCOTT: Next slide please.
MEMBER LEVENSON: I got told when I made
that same statement a few weeks ago at a different
meeting, Steve, I should have raised that question
when Part 70 was being reviewed.
MEMBER KRESS: You weren't there when they
reviewed it.
MR. BROWN: In conclusion, these are the
open items we have for radiological consequences.
Yes.
MEMBER LEITCH: A question. At our meeting
in mid-November, it was indicated that there were 22,
I think, accidents involving high enriched uranium
facilities.
MR. BROWN: Criticality events are you
referring to?
MEMBER LEITCH: Many of those results in
personnel injuries, and I guess one or two fatalities.
And, this facility is somewhat comparable to those
facilities in terms of risk. I'm wondering, have we
gone back over the available literature, and I think
these numbers are worldwide, so maybe not all the
literature is available. We could learn from these 22
episodes.
MR. BROWN: I just want to be clear. These
are criticality episodes that you're
MR. GITTER: They're all criticality.
MEMBER LEITCH: They were all criticality.
MR. GITTER: This is Joe Gitter. We
commented on that in the November meeting when we
talked to you. We don't have anybody here today to
talk about criticality safety, but the answer to your
question is yes, we are aware of those events, and I
think all but one of those events occurred in an
aqueous solution.
So we are aware of the concerns with
criticality safety, especially with aqueous solutions,
and we have tried to learn from those lessons in
reviewing the safety of the facility.
MR. BROWN: Just in conclusion, these are
the open items we have for the consequence assessment
aspect of the safety assessment, though we've
requested clarification from the applicant on how the
facility worker becomes aware of a sintering furnace,
loss of confinement event.
The staff has not accepted the applicant's
use of 99.99 percent with HEPA filter system
efficiency during severe conditions, and we're still
reviewing the safety assessment for environmental
protection.
My last slide there is just the same thing
in a different way. We're expecting at this point
that the applicant provide some clarification on the
first two items, and the staff continues its review on
the third item. Any additional questions?
MEMBER KRESS: How do they justify the
second bullet?
MR. BROWN: At this point, they haven't
provided adequate justification for using that. I
think Sharon may speak a little bit later about set
loading analysis for fires and that sort of thing.
Tim, do you have anything to add, how they will
justify that?
MR. JOHNSON: Well, what DCS I'm Tim
Johnson. What DCS has indicated is they're going to
try to justify the use of 10-4 leak path factor by
trying to recalculate what the environment would be in
the event of a fire at the HEPA filters, in terms of
temperature, chemical effects, soot loading, et
cetera. And what they've said they're going to try to
do is indicate that that environment would be benign
and therefore would justify the use of a higher
removal efficiency.
MR. BROWN: Okay, thank you. Alex.
MR. MURRAY: Thank you very much. My name
is Alex Murray. I'm going to give a quick discussion
about some of the chemical safety findings at the
facility.
Can I have the next slide, please. I'm
going to discuss a little bit about the previous ACRS
meeting and the basis and conduct of SER review. Most
of my time, I'm going to be discussing some of our
main findings, and some of the significant open items,
including red oil.
Next slide please, when you're ready. At
our previous meeting last November, we discussed the
process of the proposed principal SSCs and design
bases and status of the review. We had noticed some
specific issues. I've listed them here, admin
controls, the high alpha waste area, the
electrolyzers, red oil again, and U assay isotopic
dilution.
Just on the subject of the U assay
dilution, that is now being followed via the
criticality safety reviews.
MEMBER ROSEN: Could you assume I know
nothing about red oil and bring me up to speed,
because you'll be so close to being correct.
MR. MURRAY: I have a discussion further on
and if that discussion is not adequate, I'm more than
willing to go to any breadth or any depth you all
would desire.
CHAIRMAN POWERS: With that challenge,
let's go into the details of the molecular structure
of red oil, shall we?
MR. MURRAY: When we get there. If I could
have the next slide please. This is just a very quick
overview of how we have done our review, a basis. We
have documentation from the applicant in the
construction application request or CAR. We requested
additional information RAIs. The applicant responded.
There have been a number of rounds of communications
on some of those. The applicant has submitted some
information on the docket.
We also have looked at information that's
being supplied and discussed in response to the
environmental report and environment impact statement
activities, and also issues and documentation provided
at public meetings.
We have used the standard review plan
NUREG-1718 as principal guidance for the chem safety
review, 1718 does its best to fill in the blanks as to
what is appropriate for both construction permit
stage, which is what we're looking at now, and
subsequent operating license review.
We also have taken a look, if you will,
outside the proverbial box. We've looked extensively
at open literature, including experience from DOE and
chemical process industry and other nuclear
experience. We also have performed a number of
independent calculations.
We also have looked at a number of the
different codes, which have been proposed by the
applicant in the CAR, as well as some other codes and
standards which are out there, ASME obviously. Some
of the NFPA codes have applicability or potential
applicability.
CCPS is the Center for Chemical Process
Safety and we have a number of guidance documents.
They are from the American Institute of Chemical
Engineers. Next slide please.
MEMBER LEITCH: Alex, just one more time so
I'm sure I have it straight. What we're talking about
here as far as chemical safety is the original one
feedstock scenario?
MR. MURRAY: That is correct, yes. Yes, I
do have a little comment later on about the change,
yes. Okay. Now our main findings from chem safety,
these are essentially the same as at our November
meeting. There are relatively few principal SSCs and
design bases identified for chemical type or chemical
initiate events.
WE have also found that in general there's
a lack of specificity about some of these PSSCs and
design bases. For example, we found things like
prevent explosions, which we think is a very noble
design goal, but as safety reviewers, the staff would
like to see something prevent explosions by something,
such as preventing hydrogen accumulation. There might
be a maximum value associated with that hydrogen
accumulation, et cetera.
As we have reviewed the applicant
documents, the staff has come to the conclusion that
more PSSCs and design bases may actually be needed.
As I say, we have looked. We've seen failures such as
limited by PH control, you know controlled by avoiding
excessive voltage, and as we read into some of the
functions, which are mentioned in the different
documents, we've come to the conclusion, these
potentially have safety implications.
And finally, a number in the chemical
area, a number of admin controls, which assume a great
deal of importance. Obviously, the chemicals do have
a lot of sampling and laboratory analysis. The staff
is concerned that some of those could be implemented
to give a more engineered approach.
Next slide, please. And I'm going to give
a brief overview and discussion of each one of these
on the following slides. These are the six issues,
areas of issues which have percolated as being more
significant. There are other open issues in the
chemical area. I've listed these.
There's the obvious red oil issue, which
is the tributyl phosphate organic compound, nitrate,
nitrate media concern. There's the hydroxylamine
nitrate hydrozine area. We have some questions about
open items in the electrolyzers in dissolution area.
Some of these include specific corrosion events.
There's the waste area, particularly the high alpha
waste area.
We have some open items concerning
chemical releases and modeling of those chemical
releases and then we have a number of open items in
the sintering furnace.
Earlier on today, it was promised that I
would give the where all and be all about corrosion,
and potential corrosion are open items. The applicant
in the CAR has identified a corrosion monitoring
program as a principal SSC, okay.
The staff has reviewed the aspects of that
corrosion monitoring program and from our review,
we've come to the conclusion that that is a general
corrosion monitoring type program in some specific
process areas, such as the electrolyzers. The staff
has some open items regarding specific corrosion items
that lead to or initiate events.
If I could have the next slide please.
Here we go, red oil. I should have worn my red
sweater for this one. Red oil phenomena, the
applicant has adopted a prevention strategy, and they
have proposed a single design basis, based upon
keeping the temperature below 135 Centigrade.
They have not proposed any direct
measurements, control or cooling of the areas where
red oil could occur or the phenomena could occur. The
staff has requested additional information from the
applicant via RAIs, and in office document reviews.
CHAIRMAN POWERS: How does this strategy
compare with the strategies adopted within DOE for
avoiding the problem of red oil?
MR. MURRAY: Well, I ws going to get to
that, but I can discuss that right now.
CHAIRMAN POWERS: If you were going to get
to it, that would be fine.
MEMBER ROSEN: I think for me, you need to
step back to tell me what is red oil.
MR. MURRAY: I will do that.
CHAIRMAN POWERS: It's a question many,
many of us have asked for several years. What exactly
is red oil?
MR. MURRAY: Red oil is just a collective
term that is given to nitrated organic compounds that
can occur in Purex and other solvent extraction
systems.
MEMBER ROSEN: Nitrated organic compounds.
MR. MURRAY: Yes. The catch is you have at
least one nitrate functional group in a molecule that
also is a fuel.
MEMBER ROSEN: I know what nitrate is. Now
you said organic compounds. That covers a fairly wide
range of
MR. MURRAY: Typical organic compounds are
things like tributyl phosphate. One of the
degradation products of tributyl phosphate is actually
butyl alcohol. It can become nitrated to butyl
nitrate.
MEMBER ROSEN: So it's at least those two
or three compounds.
MR. MURRAY: That's correct.
MEMBER ROSEN: Associated with the nitrate
ions.
MR. MURRAY: Yes.
MEMBER ROSEN: Something called red oil, is
it red in color?
MR. MURRAY: It's given the term red it's
named red oil because in a number of the events, which
we'll get to momentarily, after the event, a red
colored substance was found. It was found to be a
mixture of various nitrated organic species. Those I
mentioned, also some nitrated solvent products, some
allyl cyclic nitrates.
CHAIRMAN POWERS: Let me just make sure
Steve understands. It's not associated with the
nitrate ion. It's the nitrate functional group.
MEMBER ROSEN: The nitrate functional.
MR. MURRAY: Which is within the molecule.
CHAIRMAN POWERS: It no longer
MEMBER ROSEN: Well, it has the nitrate ion
complex that's something else.
CHAIRMAN POWERS: No, it's actually
chemically reacted. It no longer looks like an ion
anymore.
MR. MURRAY: Yes. It can be within the
compound, so as I just said, you have a fuel and an
oxidant within the same compound, within the same
molecule.
CHAIRMAN POWERS: Usually we call that an
explosive.
MR. MURRAY: Yes.
MEMBER ROSEN: It forms into blocks?
MR. MURRAY: Yes, but this is a liquid and
it has been found many times it is also the red oil
has been found in some of the laboratory experiments
on the subject.
MEMBER SIEBER: Used to replace gasoline.
CHAIRMAN POWERS: So far so good.
MR. MURRAY: So far so good. Okay. The
staff has reviewed this area extensively. We have
found from the literature review and the experience
from DOE and other nuclear facilities that red oil
reactions essentially occur when you have organic
compounds in contact with nitric acid or nitrate media
such as sodium nitrate or other heavy metal nitrates.
Yes, sir.
MEMBER ROSEN: Does this mean that the red
oil reacts with some other organics, or is this
statement meant to mean that's how you form the red
oil?
CHAIRMAN POWERS: It's how you form it.
MR. MURRAY: That is how you form the red
oil, yes. Okay, and again the organic compounds are
those that are typically found in PUREX type
processing systems. The proposed facility has a PUREX
solvent extraction system in it, and this is in the
aqueous polishing area. Okay.
Over the past 50 plus years of the nuclear
industry, there have been several reported explosions
that have occurred, and which have been attributed to
red oil. I've listed some here that happened at
Hanford, out in Washington State, at a DOE facility
out there. I believe it was PUREX.
That's happened at the Savannah River
Site. In fact, the Savannah River Site has had two
explosions that have been attributed to red oil. Most
recently, it happened at the Tomsk Reprocessing Plant
in the former Soviet Union. All of the events have
involved a rapid temperature and pressure rise,
equipment damage in the case of Tomsk. There also
was a significant contamination outside the building.
Because of all of these events, there has
been extensive lab work, obviously after the event has
happened in the 1950s, 1960s, and again in the early
1990s. The finding from all of this experimental
activity has been that it is difficult to completely
replicate the phenomena in the laboratory.
Different aspects of it have been
duplicated. The red oil itself has been made. Over-
ressurization has occurred. The hardest part, I think
has only been duplicated once has actually been the
true explosion.
CHAIRMAN POWERS: It seems to me you have
characterized the extensive work, and I'll admit
there's a lot of work. But do you think they have
really gone after this question.
If in the kind of way you would go after
a real chemical problem, it seems to me most of the
work has been a fairly empirical, put the stuff
together, heat it up and see if you get the stuff to
form and go bang and things like that.
I mean I have not seen high colored
synthesis, chemical characterization techniques
applied to this. Even in the stuff in the 1990s, it
looked to me like it was, you know, fairly empirical
kind of examination.
MR. MURRAY: Well, actually yes and a no,
because the complete phenomena has not been duplicated
in the lab, yes you know it is more empirical. The
guidelines, which have been developed based upon the
laboratory tests are empirically based.
On the other hand, there are some aspects
of the phenomenon for which kinetic equations have
been developed, which have been found to be
appropriate in some regimes, operating conditions, and
what have. Some of the intermediate species have been
identified. Some are quite unusual, quite complex.
So I would say, if I look back at the
data, the information that's being reported, I would
say the work progressed so far, but did not come to a
definitive conclusion, equation. You do this and you
will avoid it period.
CHAIRMAN POWERS: May I? It seems to me
you pretty well characterized it. Every time it
happens, people run off and do a bunch of stuff, and
then they come up and say, this is complicated. And
they say, if we just put these operational controls
in, we'll get away from it, so quite working on it.
And then something else happens and then it starts all
over again.
MR. MURRAY: Yes, that is correct. I will
mention, there is some commonality. For example, the
event that occurred at Tomsk was theorized by a
researcher in the early 1960s, so you know there is.
CHAIRMAN POWERS: So, DOE sent a team out
to Tomsk.
MR. MURRAY: That's correct.
CHAIRMAN POWERS: And looked at it closely
and came back and said yes, we would have not done
things this way is pretty much what they said.
MURRAY: yes, and they came out with some
recommendations and guidance. The Russian team, which
was reviewing the effects of the Tomsk explosion also
came up with guidelines and recommendations, which
were actually more restrictive than DOE
recommendations.
MEMBER ROSEN: And how do these compare to
the applicant's 130 C?
MR. MURRAY: Well, let me discuss that
right now. The Russian recommendation is to have a
temperature less than 70 Centigrade. At the accident
at Tomsk, the highest measured temperature in the
tank, which actually exploded, was approximately 50
Centigrade.
As part of the accident reconstruction
analysis, the Russian and American team that reviewed
the event concluded that maybe there was a portion of
the tank, about 80 or 90 Centigrade. So there is a
temperature difference.
CHAIRMAN POWERS: But it's also worth
pointing out that Tomsk chemistry is different than
PUREX chemistry.
DR. MURRAY: Tomsk actually was using a
PUREX process.
CHAIRMAN POWERS: And the pit chemistry is
different.
MR. MURRAY: It was more of a true
reprocessing plant. We did have fission products
present and what have you. Now as part of the
guidance, in addition to temperature, both DOE and the
Russian teams were coming in with recommendations for
monitoring and/or controlling other parameters, and
these included such things as a separate organic
phase, monitoring some of the organic concentration,
some of the nitrate ratios and what have you.
So there are recommendations out there in
the literature, which are different from what has been
proposed by the applicant.
MEMBER ROSEN: And more restrictive. The
applicant's proposal is less restrictive than what's
in the literature in terms of standards?
MR. MURRAY: Yes.
MEMBER ROSEN: They would allow the process
to go to much higher temperatures?
MR. MURRRAY: Yes, 135, 70 or 90
Centigrade.
CHAIRMAN POWERS: Let's turn those are
recommendations?
MR. MURRAY: Those are recommendations,
yes.
CHAIRMAN POWERS: Let's turn to what's
actually used at Hanford and Savannah River. Who do
the applicants limit compared with what's actually in
force at Hanford?
MEMBER ROSEN: It's kind of hard to say in
force at Hanford, because they're not doing anything
like this.
CHAIRMAN POWERS: They still have an
evaporator that still can operate and what not. I
mean isn't it just the same criterion there?
MR. MURRAY: The work that was performed in
the early `90s basically was imposing additional
criteria beyond what the applicant has to host. Now
the actual bio for the Savannah River separations
canyons where they use the PUREX process is actually
UCNI.
MEMBER ROSEN: It's actually what?
MR. MURRAY: UCNI, Unclassified, controlled
nuclear information by DOE.
CHAIRMAN POWERS: Well, my recommendation
and I can not swear to it, and you never know what
gets changed at Hanford, is that Hanford was just a
flat temperature limit on their evaporators.
MR. MURRAY: Initially, Hanford and
Savannah River did just have a flat temperature limit,
and this was actually repeated in some work, which was
performed at Oak Ridge in the 1980s, but the
recommendations in the 1990s were to impose these
other requirements, monitoring variables.
CHAIRMAN POWERS: So the recommendations
you speak of, is that the stuff that came out of Los
Alamos work?
MR. MURRAY: Some of it by Los Alamos.
Some of it was the Savannah River Site personnel.
Some was by the people at Clemson.
CHAIRMAN POWERS: Okay.
MR. MURRAY: Next slide.
MR. KAPLAN: Alex, Gary Kaplan. Can I give
a two-minute update?
MR. MURRAY: Sure.
MR. KAPLAN: On what we're doing at this
point, so we don't leave red oil alone at this point.
There's lots and lots of information about red oil out
there, and I think Alex has given part of the picture,
and we are working on trying to put the whole picture
together before we present another part of the story.
We're gathering the DOE experts together
and we've got dozens of documents, and in the `90s
they've done lots of research actually at the Savannah
River Site, and clearly what we're doing at our
facility will be able to show clearly that it's highly
unlikely to have a red oil event.
We're just going to put that documentation
together. It should be ready within three or four
months.
CHAIRMAN POWERS: The problem is everybody
that's ever built a facility at any one of these
periods of time has put together all the documents and
sworn on a stack of Bibles that it's highly unlikely
we'd get a red oil event until we did.
MR. KAPLAN: Right. The early events that
Alex described, they didn't even know it existed, so
the first few.
CHAIRMAN POWERS: That was in the `50s,
`49.
MR. KAPLAN: Right, and the one in the
`90s, people knew would be a problem, the one at Tomsk
if they did what they did in Russia, and clearly we're
not going to leave things in our tank for two years
and then add other stuff to it, which is what
basically happened in the Tomsk incident. So, we will
be providing a lot more information on this subject to
the NRC.
MR. MURRAY: Okay. Let me just mention in
the MFFF MOX facility, several areas which have the
potential for red oil, I've listed them here. There
are actually three evaporators in the proposed
facility. OML stands for Oxalic Mother Liquor. There
are the tanks associated with some of these
evaporators. There's also a calciner, which could be
impacted by the red oil phenomena. We have to see
about that a little further, and there are the
purification and solvent recovery areas as well.
Next slide, please.
MEMBER SIEBER: I take it these evaporators
are the type that use subatmospheric to keep the
temperature in check, as opposed to steam type of
evaporators, is that correct?
MR. MURRAY: They are actually stem type of
evaporators.
MEMBER SIEBER: Oh, they are.
MR. MURRAY: There is some question, will
they actually operate under subatmospheric conditions?
Gary, do you want to comment?
MEMBER SIEBER: That keeps the temperature
down if you
MR. MURRAY: That's correct.
MR. KAPLAN: They run around 130, 140.
MEMBER SIEBER: Fahrenheit?
MR. KAPLAN: Centigrade.
MR. MURRAY: They will be under pressure.
That will be above atmospheric pressure. Staff
conclusions on red oil, single temperature control may
not be adequate, okay. Additional principal SSCs and
design bases may be needed, and we are waiting
additional information and documentation from the
applicant that Gary just mentioned. Anything else on
red oil before I move on?
CHAIRMAN POWERS: A comment that has to be
one of the most seductive problems around. I mean you
could argue over this forever. You just get immersed
into it. After about six weeks of debating over it,
you begin to appreciate the people that just find an
operational regime where it doesn't happen and work
there.
MR. MURRAY: Yes, and those are essentially
the recommendations from the DOE and Russian review
teams in the early `90s.
CHAIRMAN POWERS: I think you don't want to
discount the fact that we don't have a lot of gamma
high intensity emitters in this system. I think that
has been a factor to consider in forming some of these
compounds.
MR. MURRAY: Well, the Russians actually
did a lot of work in their reconstruction up at the
Tomsk incident, where they used active solutions and
they defined some differences, compared to the
radioactively cold test.
Okay, I'm moving on to hydroxamine nitrate
and hydrazine now. This is another area. The
applicant has identified HAN and azide hazards. They
are proposing primarily admin controls to control some
other concentrations of the species. Other PSSCs and
design bases may be needed. As we have reviewed the
documentation, the staff has found terms like we
control the ph to avoid this or so that this doesn't
happen.
We have looked at various areas of the
facility that this could impact, and we've noted the
purification solvent, recovery, and waste processing
areas. Next slide please.
CHAIRMAN POWERS: Do you have some
documentation that I probably have. Can you point to
me where I should read and understand more on this ph
control business?
MR. MURRAY: There has been extensive work
by DOE after the middle bullet here, the 1997
explosion, which discusses a number of the ph control
parameters. It's also discussed in the accident
analysis reports on Hanford proper, and there's a
pretty detailed report on that.
CHAIRMAN POWERS: If you'd find those
things for me, I'd like to understand that a little
better.
MR. MURRAY: Okay, and if you can't find
them, I'm sure we'd be happy to supply them.
CHAIRMAN POWERS: Okay.
MR. MURRAY: I want to point out as we go
HAN and hydrazine, staff indicates that there have
been several events at DOE facilities and
manufacturers over the last ten, 20 years. I've noted
the 1997 event, which happened at the plutonium
finishing plant at Hanford.
This sort of caught everyone by surprise.
This was a mixture which was left in a tank, and after
about two years, it concentrated just by the breathing
effect through the plant ventilation system.
It occurred during the warmup in May of
1997, and the event was sufficient to completely
damage the tanks, the associated or nearby tanks in
the room of the facility. It blew a hole in the wall
and also dented the roof. And pictures are available
in the DOE documentation. Interestingly, perhaps 30
gallons of material involved.
CHAIRMAN POWERS: To say that it caught
everyone by surprise is a little bit overstatement.
The DOE suggested that they worry about that in 1986.
They shut TFT down. They had problems with the
storage of that materials.
MR. MURRAY: Yes.
CHAIRMAN POWERS: And it was going to decay
their the system was going to decay and they were
going to be evaporation hazards developing.
MR. MURRAY: Yes. And I should add that
the DOE investigation of the Hanford incident actually
led to a comprehensive set of guidelines for handling
Han, and this is actually accomplished at the DOE/EH
report. Next slide please.
The staff concludes that the proposed
admin controls by the applicant may not be adequate at
this time. We conclude that additional SSCs and
design bases may be needed, and we are awaiting
additional information from the applicant. Next slide
please.
Another area where we have some
significant open items are the electrolyzers. It
turns out that there are two areas in the MFFF.
Electrolyzers are used. They're used to generate a
silver plus 2 ion, which assists with the plutonium
dioxide dissolution and in a separate part of the
facility, electrolyzers are used to recover and
recycle the silver.
The applicant has identified an over
temperature hazard potentially leading to a potential
fire, and has proposed a single PSSC temperature
control, using a 770 Centigrade design basis value.
The applicant also, in a separate part,
has a hydrogen limit of one percent, based upon
radiolysis from plutonium. On this slide, we get the
staff conclusions. The staff has reviewed this area
and concludes that other PSSC and design bases may be
needed. These could include something related to
plutonium feed specification, air purge, something to
do with isolation.
Some of these items are mentioned in the
applicant's documentation. Their functions appear to
be safety related, but at the present time, the
applicant has not identified or clearly identified
that these truly are or are not safety related. And
we essentially are looking for some assurance here
that the system will shut down as planned, i.e., hit
a temperature of 70 C, shut down, and that the
temperature actually goes down and the fire does not
occur before the temperature increases, or you have
some sparking because of shutdown or what have you.
We also are concerned about some other
potential hazards associated with the electrolyer.
These include generation of hydrogen
electrolytically in the applicant documentation.
There's a mention that the hydrogen generation rate
is limited by voltage; however, that is not identified
as a design basis or PSSC control that is not
identified. We are waiting additional information from
the applicant on that subject.
Next slide, please. Okay. The waste
area. We're basically in the waste area. The staff
has reviewed this and has identified some open items
concerning the high alpha waste system. We conclude
that some additional PSSCs and design bases may be
needed. We note that inventories have not been
identified at this time.
As discussed this morning, the waste
management program is changing, due to the changes in
the ultimate feedstock materials. We do not know what
the impact will be on the waste area, and we will
reevaluate this area after we receive additional
information from the applicant on the impact of the
changes.
Next slide, please. Chemical release
modeling. The NRC
MEMBER LEITCH: Excuse me. This waste area
you just referred to.
MR. MURRAY: Yes.
MEMBER LEITCH: Is this part of the MOXX
facility or is this
MR. MURRAY: This is the waste unit, which
is within the MFFF.
MEMBER LEITCH: Okay.
MR. MURRAY: this is not the waste area or
waste processing areas at the Savannah River site.
MEMBER LEITCH: Okay, thanks.
MR. MURRAY: Chemical release modeling.
The NRC regulates chemical facts upon radiological
safety. The impact of chemicals upon radiological
safety is under review. At the present time, the
applicant has identified the emergency control room
and its air-conditioning or air treatment system as a
PSSC, and that personnel in the emergency control room
would be protected from chemical events.
However, the staff review indicates that
there could be other operator safety actions related
to rad safety outside of the control room that may be
needed and these have not been specified, and we are
waiting additional responses from the applicant on the
subject.
At the present time, the applicant has not
identified under any principal SSCs or design bases
for chemical releases and events, and the staff review
has noted that there were several chemicals on site
and I've listed these, which could exceed safe limits
for the workers, and when I say safe limits, we are
generally focusing on the emergency response planning
guidelines type of limits, such as TEELs or ERPGs,
usually at the TEEL 3 or ERPG 3.
Next slide, please. Sintering furnace.
The staff review notes at the sintering furnace
involves high temperature operations, typically above
1,500 Centigrade, with ARGON hydrogen gas mixture,
with water cooling. The water cooling, as we
understand it, will now be an external water jacket
around the equipment. This has a general hazard of
fires and explosions.
The applicant has identified several gas
sensors as PSSCs. The staff found that the hydrogen
flow was not terminated under all normal conditions,
and this has raised some open items related to
potential explosions and that we also know that
additional PSSCs and design bases may be needed to
address steam explosions.
In the documentation provided by the
applicant, there are a number of items which limit
water ingress or control pressure rise in the water
steam jacket system, which appear to have a safety
function, which are not currently identified as PSSCs
or with design bases barriers.
CHAIRMAN POWERS: Milt, do you want to ask
your questions about the ARGON hydrogen mixtures that
are going to be used?
MEMBER LEVENSON: In response to Question
1241. This is a prior paper. It says the ARGON
hydrogen mixture will be controlled to less than or
equal 91-9 ratio. Should that really be more than,
because less than allows you to go to pure hydrogen,
I think.
MR. MURRAY: That, I believe that was
clarified by the applicant and we can ask them again.
I believe that is nine percent or less hydrogen and
ARGON. I see Gary of DCS behind you is nodding.
MR. KAPLAN: That was the intent. We don't
intend to use pure hydrogen.
MEMBER LEVENSON: So, that's already done?
MR. KAPLAN: Yes, corrected.
CHAIRMAN POWERS: Mellencride supplies a
common gas mixture that's ARGON four percent hydrogen.
Why don't you just use that? It's unknown. Didn't
have enough for a decent capacity for you.
MR. KAPLAN: Gary Kaplan. The nominal
range, I believe, is five percent is what they use for
the process, but they didn't want an operating range
of one to nine percent. So for the process reasons,
I'm not the process expert, they want to use about
five percent.
CHAIRMAN POWERS: The nice thing about a
four percent hydrogen ARGON mixture is you're
absolutely guaranteed it will be in the combustion
range. I mean it is
MR. KAPLAN: That's correct.
CHAIRMAN POWERS: I mean, and it's usually
plenty reduced for if you're just adjusting
stachiometry a little bit. Why ask for problems.
MR. MURRAY: Yes, that is correct. If I
could have the summary slide please, next one. And
just summarizing, the staff issues and findings are
similar to our previous meeting from last November.
We have identified open items in the chemical safety
area, and the staff will review additional responses
from the applicant as they are submitted. And that
concludes my presentation. Any other questions?
MR. JOHNSON: I had a quick question from
the I&C perspective.
MR. MURRAY: Certainly.
MR. JOHNSON: When you talk about PSSCs,
are those implemented by safety controllers, PEP
controllers, emergency controllers, or some other
thing that's maybe not an active instrumentation and
control system at all?
MR. MURRAY: In the documentation that we
have, the parameters which have been proposed
typically would be controlled via what is coded safety
I&C system. And we had some questions on it which
were brought up by Rex this morning. So we do have
some open items on that, but they are in a different
area, other than chemical safety. Yes.
MEMBER LEVENSON: I just have a quick
question based on absolute ignorance of the system.
What is the source, this is in connection with a
response to question 123, what's the source of the
scheme to the evaporators? The context of my question
is, it says you guarantee that you don't exceed the
temperature by having redundant relief valves, but if
there's any potential for the steam to be super
heated, then the relief valves don't really give you
control of temperature.
MR. MURRAY: I believe there's a general
plan boiler, which provides the steam, but I would ask
if the people behind you from DCS.
MR. TANNER: I can address that. Can you
hear me?
CHAIRMAN POWERS: You have to come to the
microphone, identify yourself. Go through the whole
shooting match.
MR. TANNER: Are we working here?
MEMBER LEVENSON: I'll be glad to repeat
the question. The response to Question 123, which had
to do with controlling the temperature of the
evaporator, it says there are relief valves, and
therefore the temperature can not exceed what you're
set at. But if there's any potential for the steam to
be super heated, then the relief value per se is not
enough to really control temperature.
MR. TANNER: This is Jon Tanner. You're
correct, and we are aware of this, and the short
answer is, the relief valves are not the safety items.
The way that particular steam system works, we're
buying Savannah River steam and running it through a
reboiler. Coming off that reboiler, it enters into
the evaporator, and the original design concept, a
long time ago, was to put the two relief valves out
there.
You're correct in the statement that the
super heating, if it happened, would not work. So
what we're going to do, the next step was to put a
couple of temperature sensors in there, separate,
independent, redundant and isolated, which would cause
the steam to the steam supply from Savannah River to
be turned off. In fact, there would be two stop
valves installed.
MEMBER LEVENSON: What caught my attention
is the statement here is the temperature control of
the evaporator is accomplished by relief valves.
MR. TANNER: Well, again, that was in a
very early state of affairs.
MR. HASTINGS: Yes, this is Peter
Hastings. This is an evolving issue and we haven't had
the opportunity to close the loop on the documentation
on this, the evolution of design to date.
MR. MURRAY: Any other questions?
CHAIRMAN POWERS: You're going away from us
with the obligation of providing us a little more
documentation on the Han issue?
MR. MURRAY: I'm sorry, repeat that?
CHAIRMAN POWERS: Some documentation on the
ph control in Han? Is that the one we asked about?
MR. MURRAY: Yes.
MR. KAPLAN: We can provide that to you,
yes.
CHAIRMAN POWERS: I appreciate that. Okay,
if there are no further questions, Mr. Speaker, I
propose that we take a break until three o'clock.
(Whereupon, the above-entitled matter went
off the record.)
CHAIRMAN POWERS: Let's come back into
session and discuss something that's really important,
which is fire safety. This is an area that's of
particular interest to the subcommittee, and what we'd
really like to understand is the design bases for the
fire safety program at the facility. So, Sharon, I'll
turn it to you.
MS. STEELE: Okay, thank you. Good
afternoon. My name is Sharon Steele, and I'm the Fire
Safety Reviewer for the MOX Project. Today, I will
discuss the MOX 550 strategy, the basis and conduct in
performing the 550 review, and I will present the main
fire safety findings, along with the unresolved
issues.
The event categories for or event
groupings are identified in the preliminary event
hazards, and I think Rex went through that earlier.
Fire safety develops for each event category and the
even categories are based on potential, common,
prevention and mitigation features for radiation
protection, such as fire areas, confinement zones and
confinement stereotypes.
There are six main fire event categories
and they're listed here. I don't know if you can see
the ones, but you have your printouts. Basically, we
have the DCS looks at fires originating in the AP
process cells, the aqueous polishing process cells,
the size in glove boxes and the C2 area of the aqueous
polishing MOX processing areas, and it looked at fires
in the C2 areas, which is a part of the tertiary
confinement level, where there's little contamination
risk.
Just for background, I said what the C2
area was. C3 is the secondary, provides secondary
confinement and that's where you'd have like your
process rooms and so on. And C4 is the primary
consignment, where the spaces and codes like glove
boxes and vessels would be involved.
CHAIRMAN POWERS: So this nomenclature is
to help us out. C2 is the tertiary confine and C3 is
the secondary confinement.
MS. STEELE: I guess I probably should have
stuck with just one set of nomenclature.
CHAIRMAN POWERS: That's okay.
MS. STEELE: But the one that we normally
use is not very clear, so you get the benefit of both.
MEMBER SIEBER: I take it each of these
confinement areas is a separate fire area with fire
barriers?
MS. STEELE: Yes, they could be.
MEMBER SIEBER: But not always?
MS. STEELE: Right. You could have fire
areas within a confinement, a particular confinement
zone.
MEMBER SIEBER: Okay.
MS. STEELE: And the confinement zone,
confinement area should be bounded by fire barriers.
MEMBER SIEBER: Okay.
MS. STEELE: And it could include the HB,
the
MEMBER SIEBER: The ventilation systems.
MS. STEELE: Right, as well.
MEMBER SIEBER: So the glove boxes
themselves are three-hour barriers?
MS. STEELE: No, but the globe boxes
themselves are
MEMBER SIEBER: They're a confinement.
MS. STEELE: Primary consignments for
radioactive material purposes. Did I say that
correctly or does someone want to?
MEMBER SIEBER: So they aren't in
themselves fire areas with barriers? So if you got a
glove box fire, it could spread?
MS. STEELE: It could spread to the next
area.
MEMBER SIEBER: To another glove box.
MS. STEELE: Well, there are features that
would mitigate that. For example, glove boxes have
process doors that are rated. It depends, if they're
going through another fire barrier to be rated at the
rating of the barrier.
But if you had a breach of the glove box,
you would have the materials being released to the C3
or the secondary confinement area. But that would be
confined within a fire area, which is bounded by fire
barriers.
MEMBER SIEBER: Okay.
MS. STEELE: Then there would be another
set of another event category. The fires that occur
external to the facility itself. And then we have
facility-wide systems, a facility wide system event
category, which involves fires for example, fires
propagate through dumatic sampling tubes that will be
on fire barriers, and it could involve portions of the
facility that contain radioactive materials.
And then you have, the last event category
is the one where a fire would begin in a particular
fire area and spread to the next successive fire area
and potentially involve the entire facility.
Oh, okay, now I get to my table. Let me
set this up. The table, you have a copy of it in your
set. The attempt here is to give a bird's eye view of
all the primary, principal SSCs that could be applied
to each of the six main event categories.
One thing I didn't mention previously. In
the C2 area, divided into subcategories, depending on
what confinement areas are there, and so you have
canisters and fuel rods, transport casts and so on
having, being a subcategory or a subcategory within
that confinement area.
Once the strategy to implement the
safety strategy for each event group, the principal
SSCs are identified. First of all, if you'll notice,
the fire barriers are proposed as a principal SSC for
all event categories.
The fire barriers themselves are a minimum
rated at two hours. They're composed of non-
combustible reinforced concrete, and it's really a
fire barrier system, which involves self closing
doors, fire dampers, and these things and penetration
seals, which would have to be maintained during the
course of the facility.
To protect a lot of the confinement
barriers that are found in the C2 area, DCS is
proposing a combustible loading control as a PSSC, and
the combustible loading controls basically limit the
amount of transient and even fixed materials that
could be found in the fire area.
While fire barriers themselves confine the
fire to an area and also prevent it from going into
another area, combustible loading controls limit the
potential of the fire within the fire area. Then
automatic depression, detection and suppression is
proposed as a PSSC for areas that could involve
dispersible fissile material, and so it's proposed
with the PSSC for the glove boxes, for the C3 areas
outside the glove boxes to protect a fire that could
breach the glove box and vice versa.
Process cell fire prevention features is
proposed as a PSSC for process cell areas, and cell
prevention features, cell fire prevention features
include combustible controls and elimination of
ignition sources, so that this is DCS' way to propose
preventing a fire inside the process cell.
MEMBER LEITCH: That particular
nomenclature, the PSSC doesn't have a yellow
background there?
MS. STEELE: Right.
MEMBER LEITCH: What's the significance of
that?
MS. STEELE: That's probably more artistic
license than anything else. It should just be PSSC.
There's no
MEMBER LEITCH: That's significance to,
like down on the right there, same thing. Okay
thanks.
MS. STEELE: Where were we? With the
confinement barriers in particular the MOX transport
cask and the 1313 transport casks themselves are
proposed as PSSCs to prevent any credible fires in the
areas where there are transport casks from being, from
progressing.
The C4 confinement system. We had a
change to briefly discuss that in a previous
presentation, but that's proposed as a method to, as
a PSSC to prevent fires that could affect the C4 final
filter.
And the C4 confinement system is the
safety function of it is to remain operable while
there's a fire in a glove box for example. This is
achieved by one of the ways it's achieved is by
diluting air from areas that are not affected by the
fire with hot gases from the areas that are affected
by the fire, and with other design features, such as
pre filters and spark arrestors. This assures that
the final C4 filter is not impacted.
The C3 confinement system has similar
design features, and its stated function is to remain
operable during a fire and still effectively filter
any release.
Then you have the structures of the MOX
field fabrication building itself, and the emergency
diesel generating building performing as PSSCs to
protect from fires external to the facility. These
buildings are designed to meet and exceed Type 1 type
structures, which would have at least a three-hour
rating on the outside for the walls, the columns,
girders, and ceiling or roof area, and so their
function is to withstand any potential external fires
at the MFFF.
The waste transfer line itself, that
structure its function is to prevent to be able to
expand any potential external events and it is, I
believe, double lined and buried in a concrete trench,
and so it appears to be fairly robust.
The final PSSC that's listed here is that
worker action, which would require the facility worker
to take protective actions to prevent, to not be
impacted by a dose.
CHAIRMAN POWERS: What you've listed there
is what they're doing, and I'm struggling with is what
they're design bases for fire protection are. I
distill from this that there are at least two and
maybe three, one they want fires not to result in the
release of radioactivity outside of the system.
MS. STEELE: Okay.
DR. PARKS: Two, they want the building not
to fall down during a fire. And three, I think they
want the ventilation and control system to function
even if there's a fire.
MS. STEELE: Right.
DR. PARKS: Are those your design bases for
your fire protection?
MR. KAPLAN: Gary Kaplan. Fairly close.
There is one area, for instance in the process cells.
We claim we are going to prevent fires, and we'll
demonstrate that.
CHAIRMAN POWERS: You'll demonstrate that
it is impossible for fires to occur in a
MR. KAPLAN: Highly unlikely.
CHAIRMAN POWERS: Highly unlikely that
fires will occur in a process cell?
MR. KAPLAN: Right. That's correct, by
control of ignition source and the fact that there's
no combustibles in there, except for in the welded
process systems, there's some solvent. But other than
that, there's no combustibles.
In addition to these in those areas for
defense and depth, the ventilation systems we'll
demonstrate will survive a fire also, and our design
basis is to prevent them in those areas.
CHAIRMAN POWERS: Okay, I guess I would
almost call those a how you're doing this, rather than
what you're trying to accomplish. But okay, we'll
accept that there are four design bases for this
facility.
MEMBER ROSEN: As I'm sure you're aware, in
power plants one of the main lines of defense is the
fire brigade.
MS. STEELE: Right.
MEMBER ROSEN: And its training
qualification and retraining on and on and on. Is
this similar sort of strict protocol and regimen for
fire brigades going to be applied here?
MS. STEELE: Yes, DCS is committed to
evaluate the staffing, do a baseline design baseline
staffing criteria for fire brigade. I think they're
trying to have a fire brigade in addition to having
Savannah Riverside Fire Department respond, and
they'll be following FPA 600 requirements for that,
which is what reactor facilities follow for their fire
brigade. Rex, did you have something to add to that?
MR. WESCOTT: No.
MS. STEELE: Okay.
MEMBER ROSEN: Is that what is meant by the
PSSCs on the bottom line there? Is that how it's to
be carried out, facility worker action through fire
brigade?
MS. STEELE: Oh, no. These are all the
SSCs that are required to meet the performance
criteria of Part 70.61. There will be additional
health protection features, which I didn't go into as
yet, that would complement the fire protection
strategy, and that would include, what you don't see
on here would be suppression in many of the or most of
the fire areas, suppression detection system, a fire
brigade and the fire department as well, and that's
separate from this.
They're saying those things are not
credited in the ISA or will not be credited in the ISA
as needing to meet the performance requirement goals.
MEMBER ROSEN: The fire brigade, they're
not taking credit for the fire brigade?
MS. STEELE: They're not taking credit for
it for the idea that they're able to accomplish their
goals without them. They're able to reduce the
likelihood.
MR. KAPLAN: Sharon, this is Gary Kaplan.
You're completely accurate. I think that answer to
your question on the bottom line. That was our
MS. STEELE: Oh.
MR. KAPLAN: Yes, do you want to answer
that next. The facility worker is in the area of the
fire. We take credit for it and evacuate in that area
just to protect themselves.
MS. STEELE: Just to don maybe a mask and
leave. There's also, there will also be a fire
protection program, which includes training of staff
in moments of emergency evacuation.
MEMBER ROSEN: It is exactly the opposite,
I think of the philosophy in power plants. In fact,
in power plants, the first responder's job absolutely
of course is to make sure he doesn't get killed, or he
or she doesn't get killed. And then the second job is
to inform the control room. The third job is, if
possible, begin fighting the fire. What you've done
here is say, just get out.
MR. HASTINGS: Peter Hastings. Well, I'm
not sure it's exactly opposite, because as you just
said, is to make sure the operator doesn't hurt
himself. When we've got fire involving volatile
plutonium, that means run away, and that's the
fundamental action for worker self-protection.
If it's something that he can clearly
fight himself, then he will do that. But let me make
something else clear. What Sharon said is exactly
right, and the discussion is framed in the context of
meeting 70.61 requirements. There is an entirely
separate set of fire protection obligations that we've
committed to that have nothing to do with 70.61. It's
an entire chapter of the application.
We also control our fire protection
program under an augmented QA program under Appendix
B. It's an entire classification itself in our QA
Program. So it's not unimportant, it's just that we
don't want to have to credit, for example, a specific
response time from a fire protection team in meeting
the performance requirements.
Clearly, if that's the only choice we
have, we'll do that, but we think it's a lot more
conservative to assume that that doesn't occur,
prevent or mitigate the event anyway, and then you
have defense and depth, the additional protection
features of its entire set of fire protection
commitments that is not at all unimportant. It's
simply not credited in the ISA to meet the performance
requirements. So it doesn't mean it doesn't occur.
MEMBER ROSEN: if you were to make a guess
in terms of the absolute risk, if you had a risk
analysis of this facility, what would be in your view
the contribution to undesirable results of fire? Is
it one percent, ten percent, 50 percent? How
important is fire to the risk to the workers and
public health and safety?
MR. HASTINGS: In terms of unmitigated
consequences, it's very important. That's why we've
taken so many steps.
CHAIRMAN POWERS: What's the inventory of
normal paraffinic hydrocarbon you have in this
facility?
MS. STEELE: Alex, could you answer some of
that? What would be some of the largest, do you know,
hydrocarbon?
MR. MURRAY: Solvent, I would assume. Hi
there, this is Alex Murray again. If I recall,
correct me if I'm wrong, Gary, it's on the order of
several hundred gallons. Within the cells proper, it
might be lower. You might be talking under 100
gallons within an individual cell.
CHAIRMAN POWERS: Otherwise known as
kerosene,
by the way.
MR. MURRAY: Right, that's decking.
MEMBER ROSEN: What's the point?
CHAIRMAN POWERS: The point is there's a
huge combustible load in here relative to what you're
used to in nuclear power plants.
MEMBER ROSEN: So, the answer to my
question is that a lot of the risk, if we had a risk
analysis, we would say a lot of the risk to the worker
and public health and safety and site worker, meaning
other people at the Savannah River Site comes from the
possibility of a fire at this facility, correct? Yes?
MS. STEELE: I would say so.
MEMBER ROSEN: I'm just asking for a
judgment. I know you don't have the calculations.
MR. HASTINGS: Clearly, it's a significant
contribution to risk for unmitigated events, which is
why we pay so much attention to fire protection
systems.
MEMBER ROSEN: I'm going someplace with
this.
MR. HASTINGS: I gathered that.
MEMBER LEVENSON: Do you have you
mentioned Savannah River response, do you have the
turf political set of problems which sometimes exist?
I'm thinking of the INEEL test site,w here Argonne is
an island within the site.
They weren't allowed to have their own
fire department because the INEEL has one, but pretty
clearly response from somebody outside a fence is not
a very satisfactory thing. And how that was finally
negotiated was that, I know I did it, we built a fire
station and put the equipment in it, inside the fence,
and then the site people staffed it with firemen, so
that in case of a fire, you really got response.
Because if people have to come from afar
through gates and a security system, I'm not sure how
much you can depend on them.
MS. STEELE: There are a couple of things.
For the CAR, the purpose of the review is really the
system, the features and so on. DCS has committed to
providing information about manual firefighting, the
details of which are not expected until the operation
license stage.
So, the assumption is a lot of those
things would be worked out, at least the information
on it would be provided to us.
MEMBER ROSEN: I have consulted with the
chairman of the ACRS' fire protection subcommittee,
and he says
CHAIRMAN POWERS: And he disagrees strongly
with you, right?
MEMBER ROSEN: Which is me, and he says
that the fire protection subcommittee has a role to
play.
CHAIRMAN POWERS: That's why you think
you've been specifically invited to this. Your role
was identified from our first meeting.
MEMBER ROSEN: But in seriousness, we're
going to have to look in some detail at fire
protection provisions, not just the hardware, but the
whole fire protection prevention.
MS. STEELE: Yes, we're going to have to
look at the whole thing, and when we get to the
operation licensing, we have to look at the physical
features again to make sure that, you know, some
operation procedure is not impacting those features.
I know that DCS has also committed to
evaluate whether they would need a separate fire
brigade, so that would be just responding to MFFF
fires, and so that could alleviate some of those
concerns about coordination.
Another item I thought of was that for
this facility worker action, this is not necessarily
the operator, like you'd expect at a nuclear power
plant. These are the people who are right there with
the glove boxes and so on, and they have specific
procedures when responding to fires, probably don a
respirator or leave.
The operators would probably remain in the
emergency control rooms, which somehow I skipped, and
that air-conditioning system is listed as a PSSC. I
think in the chem safety portion, there was a it was
probably considered the basis for it was inadequate,
but the idea is that the emergency control room would
remain habitable for the operator.
MEMBER ROSEN: But it doesn't help in
putting out the fire.
MS. STEELE: No, it doesn't.
MEMBER ROSEN: It certainly helps protect
the people in the room.
MS. STEELE: Right.
MEMBER ROSEN: Which is a good thing, but
to fight the fires, you're going to have to go out
where the fire is, and in doing that in a plutonium
facility, frankly is a whole new game.
MS. STEELE: There will be procedures that
will be developed for
CHAIRMAN POWERS: No, come on. Buck up.
Let me ask a question you frequently cited, three-
hour, two-hour barriers here. That's all well and good
if the fire lasts less than three hours, two hours.
With this kind of flammable loading, is that
reasonable to think that fires only last
MS. STEELE: That's an open item for us,
and I'll get into more details.
CHAIRMAN POWERS: Okay.
MS. STEELE: You're on the right track.
Any more questions.
MEMBER LEVENSON: We talked about the
solvent from the process, but he fuel for the various
diesels and so forth is probably comparable, if not a
greater supply. Is that treated and isolated and
separated so that it can't contribute to an internal
fire?
MS. STEELE: You mean for the diesel
generators and so on?
MEMBER LEVENSON: Yes.
MS. STEELE: The diesel generators are
provided in their own separate fire areas as well.
MEMBER LEVENSON: I'm more concerned about
where is the fuel in the day tanks and so forth.
MS. STEELE: Those are separated by
MR. PERSINKO: They are separate buildings.
MS. STEELE: Right, in the generator
building. Okay, well I'll move back to the slides.
This next slide will just go over how we
perform the review and the basis of the review was the
construction of the authorization request. DCS
responses to some of our RAIs, the polycarbon report
and a summary of the preliminary fire hazards
analysis.
We followed guidance from the standard
review plan and from the NRC regulatory guides. We
looked in the open literature and noted protection
concepts from DOE, in particular the fire protection
design criteria standard that they have. We obtained
a lot of guidance from NFPA codes, in particular NFPA
801, which is the one that deals with facilities
handling radioactive materials. And again, the focus
reviewed for the CAR was the fire protection features
and systems, the PSSCs and design indices.
Next. This slide just discusses the main
findings that we had. Basically, the staff determined
that the fire safety strategy for this stage was
generally acceptable, because the PSSCs could provide
a reasonable assurance that radioactive material was
protected from fire. There are many additional
protective features, some of which I
CHAIRMAN POWERS: When you said that, it
seems to me that you've now taken three or four design
bases and condensed it down to one.
MS. STEELE: I was trying to get back to
the Part 70.61 design basis criteria, which is to
protect the facility from explosions and fires, and
that's basically what it boils down to for fires.
CHAIRMAN POWERS: Well, be careful about
boiling down because we're really interested in the
design bases. And, it's fine to protect the
radioactive materials from fire, but if the building
falls down, I'm not sure you've accomplished what the
regulations really wanted you to accomplish.
MS. STEELE: That's true.
CHAIRMAN POWERS: I think we need to be
very careful about this fire protection design bases
here because this is an area where you can get into an
awful lot of money and an awful lot of squabbles if
you don't agree on what you're trying to do here.
For instance, in one of the discussions on
fire, we asked about computer equipment exposed to
smoke, and they said, well we've handled that very
simply. If the computer equipment gets exposed to
smoke, it's gone or fixed. Something happens to it.
It's not just ignored, which is excellent. I really
congratulate you for taking that step. You got out of
a real mess by doing that.
But that has to show up in some of these
strategies as part of the design bases here, so we
don't get into any squabbles over these things. I'd
be very careful about this.
MS. STEELE: We felt that the additional
protective features that I mentioned before provided
some defense in depth and complemented the overall
fire safety strategy. The fire barriers are relied on
to protect redundant PSSCs and DCS discussed areas
today, for example, the electrical independence and
separation.
MR. JOHNSON: Yes, excuse me. I'd like to
ask about that. In the nuclear power plant world, for
systems that are necessary to assure safety in the
presence of a fire, response to a fire, the
regulations don't consider 384 to be sufficient
separation, and you get into the 20-feet separation,
no intervening combustibles, all the Appendix R stuff
and safe shutdown analysis requirements.
What applicability do those kinds of
design criteria have in this environment?
MS. STEELE: Well, I might be going out on
a limb here, but I believe that for Part 70, we're not
required to follow the Appendix R requirements to
demonstrate that you can achieve the independence of
separation.
MR. JOHNSON: Yes, I understand that Part
50 doesn't apply here, but I guess I'm asking about
the technical question. If it's a technically
appropriate set of design basis in the reactor world,
is it also a technically appropriate set of design
bases in this environment, especially since I guess my
impression is the fire loadings in this kind of
facility tend to be a lot higher. You got stuff that
can burn a lot hotter.
MS. STEELE: Maybe it could be that we
should require something more restrictive?
MR. JOHNSON: Well, I'm asking a question.
I'm not making a suggestion.
MS. STEELE: Is Fred here? Okay, Fred.
MR. BURROWS: Yes, I'm Fred Burrows. I'm
the electrical reviewer. I'm not sure I can do you
know what this question is. As she said we do not
have Appendix R requirements in Part 70, and I'm not
sure
CHAIRMAN POWERS: Well, I think the real
question is if in Appendix R they've decided that the
separations quoted in IEEE 384 insufficient, why do
you think that they're sufficient? I mean the bases
for them deciding those were insufficient were
experiments. They burn cables. Am I roughly correct?
MR. JOHNSON: Yes, well I think the basis
was as much the experience of Brown's Ferry as here.
Again, consider I think 384 is considered perfectly
fine for everything except for those systems necessary
to in the power plant provide safe shutdown under fire
conditions.
CHAIRMAN POWERS: Yes, but providing safe
shutdown under fire conditions, is there a design
basis?
MEMBER ROSEN: You have to recognize that's
a different task. In a power plant, the task is to
provide safe shutdown, which requires typically active
components to function, pumps, pipes, valves, pumps to
check to turn it on, valves to change state, be
powered and change state and stay in one or more
different configurations.
Now in this facility, what I understand is
that it's okay to just shut everything off, and then
that's from the earlier briefing this morning. And
the only thing that you have to keep running is the
ventilation, certain ventilation fans. So with that
single exception, which looks a lot like a pump
running or a valve in position, most of the facility
doesn't need the kind of protection for the safe
shutdown function.
It needs protection so you don't get
release to the workers and the environment. But that
is mainly accomplished by the IROFs that have to do
with the ventilation program. Am I correct in that?
MR. KAPLAN: This is Gary Kaplan. That's
correct and the paths to the fire barriers that keep
the fire contained in one fire area.
MEMBER ROSEN: So you have the same
problem, but it's a much limited scope?
MR. KAPLAN: That's correct, yes. And we
will be looking at specifically, if they're not in
separate fire areas or separated for the HVAC, we'll
take additional precautions, but right now as far as
we know, the systems are completely independent.
MR. JOHNSON: I guess I was primarily
thinking about vent systems, but also remember that in
Appendix R that just removing power at the breaker
isn't necessarily considered adequate to shut down a
process either.
MEMBER ROSEN: I think you're referring to
the evolving understanding of hot shorts?
MR. JOHNSON: Yes.
MEMBER ROSEN: And how that's going to be
handled. That hasn't been fully resolved, even in the
reactor plant side, but I would suspect that when it
is resolved, then it certainly will be resolved, I
think before this facility is finally licensed.
I hope that this facility will take that
resolution of hot shorts into consideration for the
ventilation systems that are important to achieving
the design basis. Is that, Mr. Johnson, a
satisfactory resolution? I didn't mean to shut you
off.
MR. JOHNSON: No. I'm not sure what the
resolution is here, but I guess my only question was,
if you have these design criteria in a reactor plant
and there are functions that in this facility are
expected to work under the same kind of conditions,
why are the criteria different here?
MEMBER LEVENSON: I think the answer to
that is Part 70 was developed as recognition that
these are completely different type facilities. Now
whether they did it right when they did Part 70 is a
different question. The facilities are so different,
the risks are so different, questions like stored
energy, I mean there's a magnitude of difference in
consequences, but you need different criteria.
MEMBER ROSEN: And yet operationally for
some parts of the plant, it boils down to the same
kinds of things.
MEMBER LEVENSON: It might be worse, it
might be less. It's different.
MEMBER ROSEN: Yes, you have to keep
certain things running, even if you have a fire. You
have to achieve the same functions. Not as much
stuff, and the consequences are probably well limited,
but still you have to keep certain things running and
certain components have to change state in a
predictable way. So some of the same tasks are needed
to be accomplished by the same systems here in this
facility as in a power plant.
MR. WESCOTT: Gentlemen, my name is Rex
Wescott and I wrote the SRP section on fire
protection, and one of the reasons Appendix R
requirements were specifically left out was, for one
thing, Appendix R was kind of a back fit really to
nuclear power plants. It was plants that really
weren't built with proper separation of shutdown
trains in mind at the time they were put together, and
Appendix R was a way of fixing these older plants.
So my feeling at the time when I put in
criteria like two-hour fire barriers and stuff like
that, was that proper separation from a design point
of view could eliminate a lot of the problems that
Appendix R had to fix.
In other words, if you thought about
separation and you made your fire barriers, your fire
area boundaries sufficient in the first place, you
wouldn't get into these problems as a back fit, and I
think a lot of that has for the most part been
followed, both by the applicant and our review.
So I think 384 is a criteria, but I
suspect and I was kind of waiting for Fred to verify
this, that a lot of reality where your separate power
supplies are actually needed, like for the ventilation
system, for example, you probably have a separation
that goes far beyond the 384 requirements. That's my
suspicion. I'm just kind of waiting for verification
of that.
CHAIRMAN POWERS: Well, I guess the
question that comes to mind is this 384 separation.
I'm not sure. I can assure you I've never read 384 in
my life. I'm dedicated never having to go into
another EEE standard. Having done that once is more
than enough for me.
But what I do know is that the separations
that you find in Appendix R are have been the
subject of experimental investigations. The
interpretation of those experiments is not whether
those are too much, but whether they're not enough.
And they're more than what's in the EEE standards.
MR. WESTCOTT: Yes, that's correct. The
EEE separation, I mean I think that when I reviewed
things for plans in Appendix R, I'd much rather see a
three-foot fire barrier. Now the 20-foot separation
was kind of the last fall back. I'd like to see fire
suppression between the trains, but based on
experiments that were done at Oak Ridge or maybe it
was Sandia I believe is where the 20-foot separation
came up using, you know, what they thought was
reasonably appropriate fire loads from cable trays and
so on, and of course there's a lot of question about
that. If you double the size of the cable tray, you
have the required distance.
MR. BURROWS: Let me go back. The intent
of 384 is to insure that a redundant train is not
affected by a cable fire in the other train, and so
the distances are much smaller. Appendix R is way
beyond that, and I don't believe that the MOX
facility, you know addresses separation beyond 384.
CHAIRMAN POWERS: Just to be clear, let's
not get hung up over Appendix R. The question is, are
the separations being adequate here, appealing to 384,
are they adequate?
MR. JOHNSON: This is Ron Johnson. I
didn't bring a diagram of the routing of our power and
controls for the PHD fans. Let me describe it for
you. The power supplies come in from outside in
underground duct banks. Train A is roughly, when it
comes up into the MOX building on the first level,
there's roughly 150 feet away from the Train B. Train
A proceeds up to the second floor, goes into a separat
fire room. Train B goes all the way up to the third
floor and comes around to another separate fire room,
so in essence the trains are kept completely separated
and we made a conscious attempt to keep them in
separate fire areas so we wouldn't get into this
problem.
Not only that, we also have them in
enclosed conduit. We don't have the power supply
cables routed in an open tray. We put them in
enclosed conduit. So we try to alleviate that.
CHAIRMAN POWERS: Very helpful. The best
answer is don't get the problem.
MS. STEELE: We felt that I was down to
the fourth bullet stating that we followed guidance in
NFPA 801 for fire separation to be sure that, for
example, process areas are not comingled with storage
areas and so on. When I said we, I meant DCS.
And although the preliminary fire hazards
analysis is not a basis for the review, it gives us a
little bit more confidence that, and when DCS is
performing their analysis, that it would be able to
identify all the hazards, all the major hazards and
identify protective schemes to mitigate those hazards
as well.
We identified about four unresolved
issues. The first one has to do with glove box window
panels. DCS does not sufficiently provide design
basis criteria for the glove box window panels. We
want to assure that the stated mechanical, seismic and
fire properties were valid, and bound for the
environment that the glove boxes would be in.
One of the areas that you may have seen in
another slide might have been, for example, the issue
of creep in the window panels. That a creep at high
temperature.
CHAIRMAN POWERS: Vexing, creep.
MS. STEELE: Right. The next area
CHAIRMAN POWERS: I expect it's very high.
MS. STEELE: We feel that we identified
some inaccurate and incomplete analyses for the soot
loading on to the final filters and that remains an
unresolved issue for the CAR.
For the fire barriers, you were right that
there are some areas where you're going to have high
concentrations of not ordinary combustibles. Even
though DCS identified or evaluated what the average
combustible loading would be for each fire area, we
felt that we needed to get a better hold on what the
margin of safety was that was actually being afforded.
For example, we wanted to know where the
flash over could occur in some of these cases, and so
we're requesting more information there.
We were also concerned about the idea of
facility-wide fires, as I mentioned before, and in one
case there's a potential well not necessarily fires
but for the hot gases from a fire being transported
through the pneumatic transfer tubes. In summary
MEMBER ROSEN: Hold on for a minute. The
pneumatic transfer tubes, could you tell me more about
those?
MS. STEELE: We have a mechanical engineer
that could give some details. I know it transfers
radioactive materials through the facilities, possibly
in cans and so on.
MR. GLEAVES: Hi, my name is Bill Gleaves.
I'm a mechanical engineering reviewer. These pneumatic
transfer systems are designed to transfer material
through from one glove box to another, using air and
would have breakpots that would break the system so
that you wouldn't have carryover or material leaving
the systems, but apparently they're stainless steel or
some similar material, that in and of themselves would
have very little fire worth.
But the concern here was how these
isolation valves or some kind of valve on that system,
prevent hot gases from flowing from one gas box to
another and then therefore being a common way to
propagate fire between fire areas.
MEMBER ROSEN: How extensive is this
pneumatic tube system? Is it the way materials are
typically transported in the main process systems that
are already fluidized? It can't be pumped, that's
what I'm saying?
CHAIRMAN POWERS: It's like a bank.
MR. GLEAVES: I think if you're looking at
it on a program basis and I'm looking to DCS to
correct me if I'm wrong, if you're looking at it on
total material transport basis, I would assume that at
one point all the material is going to go through one
of these tubes.
But in general, most of the equipment is
located in the glove box and is transported by
different kinds of belts, conveyors, et cetera. But
the rate at which it's transported through these
pneumatic transfer tubes would be relatively low, and
I believe it's a batch process.
MR. KAPLAN: This is Gary Kaplan. I can
add a little bit more. There's two main pneumatic
tubes used, one to go from the AP process over to a
storage area, where the plutonium is put in sealed
cans and it's sent. It's like a bank, almost like
your bank, what you use in a bank, and it moves from
one on the AP area to the MP area and it goes to a
storage area. That's one.
The other one is mainly to send material
to the lab. Small samples go from glove boxes to a
laboratory glove box, and they'll also be in closed
containers also.
MEMBER ROSEN: I don't get a sense of
whether I should think of this facility as one with
almost everything interconnected by these pneumatic
tubes, or one that's only very limited in a very
limited sense.
MR. KAPLAN: Limited. I would say a
limited sense. Just to give you an idea, there's 350
fire areas in the facility approximately, so almost
every room is its own fire area, just to give you an
idea. So there's a few glove boxes in each fire area,
and you wouldn't have the pneumatic tube attached from
one glove box to the next globe box to the next glove
box.
Where you take samples in the facility,
where there are places you do that, that would be
connected to the laboratory area.
MR. TANNER: I can address the specific
route.
MR. KAPLAN: Okay.
MR. TANNER: This is Jon Tanner again. The
two areas we moved in the pneumatic transfer system
are taking the plutonium that comes out of the
furnace, the calciner furnace in the AP area. It's
dried and it goes into a can and the can is sealed and
that can is put in this, as Gary said, like when you
go up to your drive-in bank vault. You put your check
request in it. It sucks into the bank.
It's exactly the same concept, and it goes
to the storage vault. The other place we use it is we
take a smaller quantity and off the top of my head, I
can't tell you how big these transfer tubes are, but
one's 28 millimeters or something like that. I don't
remember. It comes from a small sample into the
laboratory.
The first system runs kilogram, small
numbers of kilograms of cans into the storage vault
and those are the only two places we use them, from
the canning area to the storage vault, and then from,
and I forget the source of it into the laboratory, and
that's it. So the answer to the question is it's a
small limited number of usages.
MS. STEELE: Just to summarize, the staff
found that the PSSCs and the design bases are
generally acceptable. The applicant will provide more
information on glove box design criteria and
subloading analysis for the I should say before the
final safety analysis is due.
We are expecting methodology on how they
will demonstrate the margin of safety, including any
models and input assumptions, and we're also expecting
methodology for the methodology description and input
assumptions for the propagation of hot gas through the
pneumatic transfer system.
CHAIRMAN POWERS: Any other questions on
fire protection? Thank you, Sharon. We come now to
the section of the agenda entitled "discussion" and
one I know everybody's hoping for, "adjournment."
MR. JOHNSON: I have a couple of things.
First, I would like to the commission's asked us
specifically to, as they said, weigh in on this, on
the MOX facility, and we're going to have a meeting in
I think July. What I would like everyone here to
think of are the points that I should bring up.
I think that when we schedule that meeting
with the commission that we assumed things would be
progressing along a little faster than they are now,
that because of the design changes, things are still
in a preliminary state, and basically that's all I
want to tell them is things are in a preliminary state
and we're looking at things. But if you can give me
points that I should bring up with Chairman Meserve on
this subject, in addition to the fact that we're
looking at stuff, I would appreciate it.
One thing I should make clear to everyone
is that in giving this job to the committee, one of
the questions they very much had in their mind is Part
70 adequate for this facility, and so several times
we've asked questions that seemed to go beyond the
structures inherited in Part 70 and people have been
puzzled by that. It is because one of the questions
we have to look at is what the adequacy of Part 70 is.
And in that context, a question that was
raised by Mr. Rosen that I think clearly caught my
mind was, we have a system here designed to meet the
single failure criteria, but in the history of
significant accidents, I think generally you see that
the really severe accidents are multiple failures, and
is this an issue that we need to wrestle with in
thinking about Part 70?
I think Mr. Rosen has also brought up the
clear cut point that fire is an important aspect and
that the fire subcommittee, either as a membership of
this committee, or on its own, needs to look carefully
at the issues of fire protection here.
And in particular, I would be interested
in knowing their view on the standards that are being
adopted here and applied to his facility, which of
course are different as they should be than reactor
standards. These are much more industrial standards,
and whether they think they're adequate.
With that, I'll ask are there any other
comments that you'd like to make. Gary, I know that
we're in a preliminary stage, but at some point, I'd
like to get a written report from you if I could. But
if you have any opening comments, or things off the
top of your head, I'd appreciate hearing them right
away.
MR. JOHNSON: Well, I guess I don't know
that I see anything that's of such earth shattering
significance to bring up the commission. There's
clearly a lot of work in this area that DCS is still
doing, and there will be a lot of developments over
the course of time that I'm sure the staff will be
interested in and that they're going to want to look
at carefully.
I think some of the ones that come to my
mind is that the application makes commitments to
certain standards in the electrical and
instrumentation and control area, but these are
reactor standards and they've said they're going to do
a they're going to use putting words in their
mouth going to use the part that makes sense.
Well, I'm sure that they'll do their best,
but we don't know exactly what that means at this
point, and exactly what the commitments are with
respect to those standards. I'm sure they'll be
evolving as well they should.
I think another one that I think is going
to involve some looking at is the specifics of the
priority management within the I&C system. That could
evolve to be a very simple relay based system that
ensures that the safety control always has priority
and ensures that when you have multiple controls rooms
trained to take control, that the right one always
gets control.
But in other places well even in places
where it's that simple, sometimes it becomes an issue
of some contention and study. But the tendency in the
reactor industry in the last few years has been to
make it more complicated than that, and if you look at
redundancy management systems, and for example,
Timaline or Creon next generation reactor, they're
fairly complicated systems that need a lot of looking
at.
So there's a wide range of possibilities
that could occur there. And, I'm sure also that
they're going to want to be interested in what really
are the functions allocated to which of the different
I&C systems, and specifically what's happening.
We heard discussions about clinical safety
and principal safe system structures and components to
respond to that, but exactly what's happening in the
I&C system. Where are those things. Where's the
implementation of those things, I think is still
evolving and is going to be of interest. I guess
those really are the main ones I have.
CHAIRMAN POWERS: Well, I think the message
of evolving is the primary message that I'll try to
give the commission. You know, things are evolving
and stay tuned. I mean I think that's true
particularly in the I&C but it's true of everything
else.
I think I will definitely highlight I&C as
one of the areas we're giving focused review.
Obviously we are.
MR. JOHNSON: Well, and as the processes
themselves, I think maybe are evolving, that it's hard
for the I&C system to settle down until
CHAIRMAN POWERS: Sure. You wouldn't want
it to settle down.
MEMBER ROSEN: Dana, I have some thoughts
I've been scribbling here that might be useful. This
is a facility where there are some extraordinary
hazards in the sense that we heard about red oil, but
that's not the only one.
We've got electrolytic composition
creating hydrogen. We've got high fire loads from the
organic solutions that are prevalent in the systems.
You've got the potential for fire, which could lead to
plutonium release, which is sort of an extraordinary
situation.
So then in the fire protection area, I
think we need to be concentrating heavily, review
heavily, and there again, they have two areas that are
not well described in this discussion. Milt brought
one of them up and that's the institutional issues on
the Savannah River Site.
Clearly that can be addressed, but it must
be ultimately in some clear cut way. The other one
that I think it also very important is the human
performance issue of the staff itself. You know, we
talk about the importance of the fire brigade, and the
fire brigade would be trained in a manner, qualified
in a manner similar to ones we see in power plants,
nuclear power plants.
But there's very little or no discussion
about it at this stage. Maybe that's appropriate, but
we need to keep our attention riveted to the fact that
it's what the institutions do and what the people do
after the designers and the builders have done
everything they can, which ultimately determines the
course and the consequences from the inevitable fires
that you're going to have or off-normal situations.
You're going to have off-normal situations
and you probably will have fires. That's a given.
It's what happens after that that counts. So the
fires just get put out by the first responder and it's
a no-never-mind. When you have an off-normal
situation, that ultimately degrades to a more serious
off-normal situation because of other latent defects
that haven't been addressed.
So institutional and human performance are
critical ultimately in the fire protection area and I
think we need to keep it in mind.
CHAIRMAN POWERS: I think it's a normal
question than human performance will finally be
important, but I encourage you not to get too far
afield when we're looking at design bases here. You
know, you just can't ask for too much at this stage.
MEMBER ROSEN: I grant that. I'm not
asking for it. I'm just saying we need to be aware of
the ultimate importance of the institutional and the
human performance barriers in the ultimate fire safety
of the plant.
CHAIRMAN POWERS: Sure. It would surprise
me if anybody disagreed with you, but at this point,
that's not where my questions come up on the fire
safety. I'm still going with what we're asking the
fire protection program to do.
MR. JOHNSON: I've got a pretty good idea
on how we're doing it. I just don't understand
exactly everything we're asking it to do.
CHAIRMAN POWERS: And I would not overplay
the level of hazard at this facility either, and I
remind you that when we do max calculations on reactor
accidents, the plutonium release is interesting but
not very serious compared to releases of other
radionucleides. This is not to my mind the most
hazardous facility I've ever dealt with.
MEMBER KRESS: Some other thoughts. The
look at sequence by sequence acceptance criteria seems
to me beg for an overall facility, acceptance criteria
that adds them up. I don't see any of that thinking in
this.
CHAIRMAN POWERS: In that regard, certainly
don't blame the applicant for that. That's the way
the ground rules are.
MEMBER KRESS: But we're asking if the rule
is adequate, and I'm questioning that. Some other
things, when you talk about source terms for some of
these things, the fires, just taking the values out of
the handbook seems to be like flatly inadequate. You
could develop facility specific source terms on a
fairly easy basis, given their processes and their
known materials they have.
I think with a little effort, you could
come up with a much better idea, particularly on the
termination of the particle size distribution and what
fraction that might be considered respirable. I hat
to say this again, but this would be a great
opportunity to do a full PRA and see how it compares
with the ISA results. It certainly would be nice to
see how that spells out.
When you have HEPA filters, and you have
specific areas where you may have say fires that are
not going to spread to other areas, you can have
different amounts of material, a hazard at risk, and
the HEPA filter efficiency, you assume, not to depend
on somehow on the maximum loading that it can get from
those particular things.
So just having one HEPA filter efficiency
doesn't seem right to me. It seems like it ought to
be specific for a given sequence, and I think more
looking in that area would be useful. I guess those
are just the comments I had in addition to these
others people are making.
CHAIRMAN POWERS: You know, on the
probabilistic versus ISA concept, I guess I'm
perfectly content to let the ACNW carry that torch.
MEMBER KRESS: Well, yes.
MEMBER LEVENSON: Let me say, I have a
problem with the way the words were used.
CHAIRMAN POWERS: Part of the problem with
the words you're about to use is the recorder can't
hear you.
MEMBER LEVENSON: I'm sorry.
CHAIRMAN POWERS: We get into the other
problems with the recorders.
MEMBER LEVENSON: My other problem, Tom, is
perception, and when people like the ACRS members say
full PRA, it scares the hell out of everybody because
that implies something as extensive and complicated as
a reactor system. I'd much prefer if you'd use the
word simplified PRA.
MEMBER KRESS: I would be very happy with
those words, yes.
CHAIRMAN POWERS: Some of us believe all
PRAs are highly simplified.
MEMBER ROSEN: Some of us who have done
them have found them quite complicated.
MEMBER LEVENSON: And you're both right.
CHAIRMAN POWERS: Some of us are much more
comfortable with ISA methodology. Milt, do you have
any other comments you'd like to make. I'm sorry Tom.
MEMBER KRESS: I just wanted the PRA to
complement the ISA.
CHAIRMAN POWERS: You just want to compare
us and see how good they are.
MEMBER KRESS: Yes.
CHAIRMAN POWERS: And we'll do a PSA on
your garage or something like that, do that with the
ISA. Do you have any other comments?
MEMBER LEVENSON: No, I've raised them.
CHAIRMAN POWERS: Doctor Shack? Graham?
MEMBER LEITCH: No, I guess this again is
something that hasn't been developed yet, but my
concern is still staffing levels, training,
qualifications of the operators and the other staff
that will be associated with it.
CHAIRMAN POWERS: I think that's our 2003
tour.
MEMBER LEITCH: I agree. You know it seems
as though we have made this facility somewhat more
complex than the last time that we heard about, and
it's going to be a fairly complex system for the
operators, because we're not just dealing with one
process. We're dealing with perhaps as many as four
processes, although some may be quite similar to one
another.
But yet, that introduces another variable
and I guess at an early on stage, it seems to me that
we need to be more than just an issue of staffing, but
rather what positions are going to be manned by the
operators. Has anybody thought that through? In
other words, where are we going to have operators? We
have a control room. Is there one operator there, two
operators? Are there other fixed positions? How does
that relate to the people that are in the on-site fire
brigade? If there's a fire, we still have to be able
to maintain some positions, staffed from an operating
viewpoint.
CHAIRMAN POWERS: Well, I think, I get the
impression that we'll have operators and whatnot.
That has been given some thought. I mean at least
they have identified these remote areas, separated
areas where they're going to have terminals and
whatnot like that in rough levels.
Now I think this fire brigade issue is
still up in the air a little bit. Is that roughly
correct?
MR. HASTINGS: That's correct.
CHAIRMAN POWERS: But the rough staffing
levels, I think they know. The details on training
and maybe even the numbers and things like that, I
think we have to wait until they get to the operating
license stage before we ask too many questions on
that.
MEMBER LEITCH: I just want to be sure that
the design doesn't get so frozen before we've really
factored in the operator input.
CHAIRMAN POWERS: Sure.
MEMBER LEITCH: That it's possible
CHAIRMAN POWERS: You'll get an un-operable
configuration.
MEMBER LEITCH: Yes, right.
DR. PARKS: You know one of the advantages
I'm always reminded is we are copying another system,
so I don't think they're going to get those tied in a
knot here, unless we help them tie themselves.
MEMBER ROSEN: Or unless the facility
they're copying has knots in it already.
DR. PARKS: It's not what?
MEMBER ROSEN: Or unless the facility
they're copying has knots in it already.
MR. HASTINGS: Let me address that briefly.
This is Peter Hastings, and this will probably do
nothing more than tease you for more information.
DR. PARKS: Sure.
MR. HASTINGS: The MOX facility, is that
actually counted as the fourth or fifth generation of
the MELOX process because of improvements they've made
throughout the evolution of MELOX. We also have full-
time representation on the design staff of real
contemporary operations staff from both MELOX and La
Hague facilities whose job it is to keep us from
making those kinds of mistakes.
MEMBER ROSEN: Rather than emulating the
mistakes, knowing about them and avoiding them.
MR. HASTINGS: That's exactly right, and in
fact, a good bit of our work involving the operation
staff from the existing facility has been in the area
of lessons learned, from previous evolutions of the
current designs of MELOX and LaHague.
DR. PARKS: Good.
MEMBER SIEBER: Well, it seems to me that
you know my vision of how this plant will work is that
the bulk of it is going to be batch processes
controlled from local workstations. In the large
control room, the emergency control room is designed
to be able to take over control in the event that some
event of consequence occurs.
So it seems to me, number one, that it
should be relatively easy to do some kind of PRA,
because there's a lot of little separate modules that
don't have these long event trees associated with
them. Secondly, I'd like to assure myself that when
you shut everything off, everything settles down and
just sits there like it's supposed to, as opposed to
being some explosive mixture or otherwise
deteriorating.
I guess the third thing that I am
impressed with is my vision of how high the fire
loading is and how complex it is and the fact that
using HEPA filters as the confinement mechanism to
isolate the environment to what goes on in this plant,
particularly during a fire, deserves an awful lot of
consideration from the standpoint of filter plugging,
filter failure, how much redundancy do you really
need, and with 350 fire trees in a relatively small
building, it seems to me everything is very
compartmentalized that could possibly be joined
together by the ventilation system, which is another
way to spread fire.
And so I think our attention should be
directed to the fire protection number one, because I
have an intuitive feeling it's probably the biggest
risk factor and also there's a potential for
spontaneous events to occur, as opposed to events that
are actually caused by an operator or the failure of
a peace of equipment, for example, a red oil
situation.
In addition to that, I think that we
almost have to wait for the operating license stage to
know enough about the process and the process control
features. The setting of trip set points for various
parameters and how they physically intend to control
the process to maintain its safety.
Right now, I don't think I could make a
judgment whether the list of accident sequence is as
comprehensive or that the protection actions or
protective features is sufficient, and until we get
that far along in the process, I think it's difficult
to make a comprehensive
CHAIRMAN POWERS: Just being asked can they
make good.
MEMBER SIEBER: That's right.
CHAIRMAN POWERS: And not whether they
have.
MEMBER SIEBER: Right. So I just guess as
far as setting the standards, which is what is being
done right now, I think the standards are probably
adequate even though I know that IEEE 384, when you
talk about separation of table that are in conduit,
the separation requirement is one inch, and the
separation is the criteria.
CHAIRMAN POWERS: And the cables and
conduits very seldom burn.
MEMBER SIEBER: Well they burn all by
themselves, one at a time. But in any event, I think
it's an interesting project, and I will feel more
comfortable when I know more about it.
CHAIRMAN POWERS: Mag.
MS. WESTON: No.
CHAIRMAN POWERS: We've already handled all
your problems, right Steve?
MEMBER ROSEN: Absolutely.
CHAIRMAN POWERS: Tom?
MEMBER KRESS: I have no other questions.
CHAIRMAN POWERS: Mario? Peter?
MEMBER KRESS: No, no questions. There's
no material with nitric acid going around in the
pipes.
MEMBER FORD: They got input from the
chemical process industry.
CHAIRMAN POWERS: Drew, let me turn to you
now.
Is there any question that I should have asked that I
haven't asked?
MR. PERSINKO: None that I can think of. I
think you've covered the bases quite well.
MEMBER SIEBER: I have a question that I
probably should have asked. To me this thing looks
analogous to an oil refinery.
CHAIRMAN POWERS: I'm fascinated to hear
this.
MEMBER SIEBER: I noticed another little
reference to CPI codes of standards or some of the
things that the chemical industry uses in their
protection systems.
CHAIRMAN POWERS: There are a lot of CPI
standards.
MEMBER FORD: There are CPI standards.
MEMBER LEVENSON: It's more like the lab
within an oil refinery.
CHAIRMAN POWERS: That's a little closer.
MEMBER SIEBER: It's a small oil refinery.
It just makes motor oil.
MEMBER ROSEN: Yesterday, it was boric acid
on carbon seal and I'd certainly worry under certain
circumstances. Here we've got nitric acid.
CHAIRMAN POWERS: Now we're worried about
real acid. Let me go to the people from Duke and ask
you the question. Is there any question I should have
asked that I didn't ask?
MR. HASTINGS: Of course not. You know, I
think you have done well in terms of being able to
digest the information that's been put in front of you
in the course of a couple meetings. I do want to make
sure that one perception that may be generated here,
that we have an opportunity to make sure it's clear.
We've heard a couple times in discussions
among the committee that there's a very high
combustible load for this facility, and with no intent
to diminish the magnitude of that hazard, I certainly
don't want to do that. I want to remind everybody
that the vast majority of our process fluid that's
combustible is inside sealed, welded tanks that are
designed to withstand the design basis earthquake, so
I don't think that's unimportant. I just want to make
that clear.
CHAIRMAN POWERS: That's a good point and
we shouldn't diminish that. I still think that when
you think about this facility, starting from the top
down, it's not long before you say what really is the
problem here?
MR. HASTINGS: It's clearly important.
CHAIRMAN POWERS: And putting your
combustible loading into sealed tanks is one of the
mitigation features to look at. Well, as a final
point, I want to bring up again this issue of visiting
the log facility. I'll remind members that you're
going to be wandering around aimlessly in Europe in
October, and I'd appreciate over the course of the
next couple of days thoughts about whether you would
like to tack ona visit to La Hague.
If we want to do that, we need to
institute things promptly. So I'd appreciate your
opinion on that informally over the next two or three
days, so that if it looks like it's reasonable to do
that, we can get back to DCS on this and try to
arrange something here.
MEMBER LEVENSON: How broad is the inquiry?
CHAIRMAN POWERS: Oh, it includes you Milt.
MEMBER LEVENSON: You're talking about
October because of the meeting in Berlin?
CHAIRMAN POWERS: Right.
MEMBER LEVENSON: I'm going to be there
also.
CHAIRMAN POWERS: Yes, it would include
you.
MR. HASTINGS: Let me suggest, just for
clarification, as people are considering that, and
I'll ask Drew to weigh in on this as well if he has an
opinion.
You're certainly welcome and invited to do
that. I think it would be helpful to the members of
the staff that have seen the facilities would echo
that. You should plan on two days at least. One for
a full day at MELOX, which is in the South of France,
and one day at LaHague, which is in the northwest.
MEMBER ROSEN: So we are going to take a
circuitous route.
MR. PERSKINO: I was going to say the same
thing. You just said LaHague. I strongly recommend
that you visit both facilities as well. I think it's
a very informative meeting.
MR. HASTINGS: LaHague is north of
Marseilles, near Lyon.
CHAIRMAN POWERS: Near Markul.
MR. HASTINGS: It's at the Markul side.
CHAIRMAN POWERS: Well, I mean we just need
to wrestle with it. You may also want to go to Rocky
Flats. Rocky is the place to go for the comparison.
You want to go to Rocky. Milt.
MEMBER LEVENSON: Is there anyone from DOE
here in the audience today? I have what might be an
unfair questions, but it rises from what was said
earlier. With the cancellation of the mobilization
program, we've heard a fair amount about the impact on
this.
How does that impact salt processing
process at Savannah River with which I've had some
involvement, because one of the main functions of that
was to provide concentrated cesium for denaturing the
plutonium. If it's not going to be mobilized is that
billion dollar effort now going the wrong direction?
Has that also been reevaluated? I don't want it
answered, I just wondered if it's been looked at?
MR. RHOADS: I can honestly say it's not by
us. I can't speak for anyone.
CHAIRMAN POWERS: That might be an issue
for you to take up offline.
MEMBER LEVENSON: I just wondered if they
would happen to know.
CHAIRMAN POWERS: Well, gentlemen, at that
point I will first of all thank everybody for
excellent presentations. Staff, really good
presentations, appreciate it. DCS, excellent
presentation. And, as I say because we've got one of
the few times I've had a commissioner tell me to weigh
in on this, I expect we'll see you more often, and
appreciate the efforts that you make in this
direction. And with that, I will close this
subcommittee.
(Whereupon, the above-entitled matter was
adjourned at 4:28 p.m.)
Page Last Reviewed/Updated Monday, July 18, 2016