462nd Meeting - May 6, 1999

UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
MEETING: 462ND ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
(ACRS)

U.S. Nuclear Regulatory Commission
Two White Flint North
Rockville, Maryland
Thursday, May 6, 1999
The subcommittee met, pursuant to notice, at 8:30 a.m.
MEMBERS PRESENT:
ROBERT L. SEALE, Chairman, ACRS
DON W. MILLER, Member, ACRS
DANA A. POWERS, Member, ACRS
WILLIAM L. SHACK, Member, ACRS
ROBERT E. UHRIG, Member, ACRS
GRAHAM B. WALLIS, Member, ACRS
MARIO FONTANA, Member, ACRS
THOMAS S. KRESS, Member, ACRS
GEORGE APOSTOLAKIS, Member, ACRS
JOHN J. BARTON, Member, ACRS
MARIO V. BONACA, Member, ACRS. P R O C E E D I N G S
[8:30 a.m.]
DR. POWERS: The Committee will come to order.
This is the second day of the 462nd meeting of the Advisory
Committee on Reactor Safeguards. During today's meeting the Committee
will first consider the proposed resolution of Generic Safety Issue
GSI-158, performance of safety-related power-operated valves under
design basis conditions. After that, if anybody thinks I know exactly
what's going to happen in the meeting, I've got news for you. It's a
little confused.
I think we will get a status report on Generic Safety Issue
165, spring-actuated safety relief valve reliability, and I think we
will get a status report on fire protection functional inspection
program. Then we're going to hear about the Westinghouse Owners' Group
proposal for modifications of core damage assessment guidelines and
postaccident sampling system requirements, which has been the subject of
a subcommittee meeting. The balance of the day will be devoted to
proposed ACRS reports.
A portion of today's meeting may be closed to discuss
Westinghouse Electric Company proprietary information.
The meeting is being conducted in accordance with the
provisions of the Federal Advisory Committee Act. Dr. Richard P. Savio
is the designated Federal official for the initial portion of the
meeting.
We have received no written statements or requests for time
to make oral statements from members of the public regarding today's
session.
A transcript of portions of the meeting is being kept, and
it is requested that speakers use one of the microphones, identify
themselves, and speak with sufficient clarity and volume so they can be
readily heard.
To begin the morning session I want to make the Members
aware that David Diec's last meeting has been held with us, and I want
to take this opportunity to acknowledge the important work that he did
with us and excellent work that he did with us in the course of his nine
months with the Committee. I know that he worked on several letters and
reports with me and was an outstanding example of an engineer in
training.
MR. DIEC: Thank you very much.
DR. POWERS: Now I want to introduce a note of sadness for
the Committee. We are losing a longtime member of the team, seven
years, Donna Anderson has been a member of our team here, and she has
discovered greener pastures to go to. I can't imagine there would be
such a thing. Actually, I want to tell you how cruel and mean Donna is.
She made me write a letter of recommendation for her to leave.
[Laughter.]
MS. ANDERSON: Thank you very much.
DR. POWERS: Donna's contribution to the Committee goes
beyond mere technical skill and ability. I have personally been
impressed with exactly her team spirit and team contributions. I know
that the first time that the Committee met in front of the Commission
while I was a Member that it was Donna who came back and gave me the
best, most authoritative review of our performance, and it was
immediately obvious to me that she had a real interest in this Committee
doing well and that it was important to her to contribute to this team.
After that initial exposure, I have seen numerous examples
of where Donna was working for the best interests of the Committee as a
whole and had a spirit of teamwork that set an example for us all. So I
thank you very much, Donna.
[Applause.]
MR. BARTON: I am going to really miss her. She's the only
one that can read my writing.
[Laughter.]
DR. POWERS: Let's see, may I ask are there any Members that
have any opening comments that they want to make?
Seeing none, we'll move to the first item of business, which
is the proposed resolution of Generic Safety Issue 158 and, Dr. Bonaca,
I think that you're the cognizant Member.
DR. BONACA: Correct.
Yes, Mr. Chairman, we have Frank Cherny here of the staff to
present to the ACRS the basis for the staff proposal to close GSI-158
without imposition of new requirements on licensees.
MR. CHERNY: Good morning. Before I start, I think John
Craig wanted to make a few introductory remarks.
MR. CRAIG: Good morning. As you know from the
presentations that you've had, the past presentation by myself on
generic issue process and the one from Ashok earlier in the week on the
things that the office is doing with respect to the prioritization and
self-assessment in the budget, our plates have been very busy.
I'd like to apologize to the Committee for the switch in the
agenda. As we got ready for the presentation and got down to the final
hours with respect to GSI-165, it became clear that we difficult have
enough time to just turn the crank and make it happen. We are prepared
following Frank's presentation on 158 to go over an overview, a summary
of the issues.
Nothing has changed with respect to the proposed approach to
resolution, but rather than come down here not fully prepared for the
presentation, we thought it would be better to request that it be
delayed. So we can talk about 165 following the discussion on 158.
As you know, some of the generic safety issues are older
than others. We're going to be talking hopefully about Generic Issue 23
on coolant-pump seals in a few weeks. We're working to identify I guess
closure plans for the other generic issues as we discussed a few weeks
ago, including those that were going to be addressed by the IPE program
and some the IPEEE program.
Generic Issue 158 involves inputs from all of the offices.
We have now staff from Research who used to be in AEOD. In addition to
the support in the Division of Engineering, Technology, and RES, we have
support from two other divisions within Research and from NRR and their
representatives here today that are prepared to answer any questions
that you might have related to the various aspects of this issue.
So with that I'll turn it over to Frank Cherny. Thank you.
DR. POWERS: John --
MR. CRAIG: Yes.
DR. POWERS: Before we go on, you indicated that you've
got -- are putting together a plan of attack of all those outstanding
GSIs.
MR. CRAIG: Yes, sir.
DR. POWERS: Is there an appropriate time for us to hear
about that plan of attack?
MR. CRAIG: Since Jack Rosenthal has the lead for that, now
the answer's clearly yes, and having said yes, I'll have to come up with
a date. But we'll do that, and we'll get back to you to do that.
DR. POWERS: Yes. I think we've asked a couple of times
where some sort of an overview for our own planning purposes and
understanding, because otherwise we keep harping on what happened to
this, what happened to this --
MR. CRAIG: Right.
DR. POWERS: And so if you could pick a time when you're
comfortable with saying here's what the overall plan of attack, because
we need to get those off the books so we can get into this new process.
MR. CRAIG: Exactly. We'd be glad to do that.
DR. POWERS: That would be useful for us, again, not looking
for something with a tremendous amount of formality to it, but rather a
planning kind of discussion.
MR. CRAIG: We'll be able to do that.
DR. POWERS: Thank you, John.
MR. CHERNY: Okay. We're here to discuss the staff's basis
for proposing to close GSI-158. What we're going to do this morning is
present a number of elements that go into that basis for closure. We're
going to try and relate this GSI to the new GSI process that we were
just talking about, and I'll go through a little bit on that. We're
going to talk about staff actions and activities that have taken place
while we've been working on this issue, which have led us to the
conclusion that we should close it. We're going to talk about some
requirements that are in place today that were not in place a few years
back when analogous concerns were raised on motor-operated valves and
resulted in the issuance of Generic Letter 89-10. We're going to talk
about some industry activities and initiatives that are going on related
to these types of valves which are in the context of DSI-13,
codes-and-standards type activities and other initiatives.
Okay. Just by way of a little background, the scope of this
GSI is particularly broad. It contains three valve types, pneumatic or
air-operated valves, solenoid-operated valves, and hydraulic-operated
valves.
The basic safety concern that was raised or potential for
safety that was raised at the time of the request to prioritize it, and
that was for the potential for such valves to not perform satisfactorily
under design-basis conditions based on the MOV experience that we
learned from Generic Letter 89-10 and its predecessor, both in 85-03,
this issue was prioritized in 1994, which we were just talking about how
long some of these issues have been on the books. This one would be a
relatively young issue in that regard.
Without going into great detail about the prioritization,
the GSA was prioritized as medium. It was not a medium issue based on
the value-impact calculation, it was based on an estimated change in CDF
of 1 times 10 -5 per reactor year at that time.
Back in March, at least I think it was in March, we briefed
the committee on the proposed change in the process for handling GSIs,
the new management directive that is going to have a number, 6.4. Built
into that process, as you may recall, was something -- you know, there
were a couple of early screenings that take place in that process, one
of which is an initial screening which involves among other things a
rather rigorous review of the proposed issue by a screening panel.
It is our view today that if this issue was coming in today
with a request to be prioritized and we applied the new, revised
process, the issue would probably have received a much more initial
review and we think would have been screened out as not being either a
cost beneficial safety enhancement issue or a burden reduction issue.
The concern about valve performance under design basis
conditions is very similar to the MOV concerns resolved with the
issuance of Generic Letter 89-10. This Generic Letter was issued to
ensure that licensees take actions necessary to comply with existing
regulations.
The POV operability under these same design basis conditions
is also largely a compliance issue, thus we feel that under the proposed
new management directive it probably would not have made it into the
process at all. It probably would have been kicked out in the early
screening. Now that is not to say that that is the real reason we are
closing the issue, but I think that's interesting background.
DR. SEALE: The burden reduction screening requirement or
whatever you want to call it, can that be either positive or negative?
MR. CHERNY: Well, the burden reduction initiatives are, at
least on the front end are intended to be things where there is a
potential for, you know, to use positives and negatives where it is felt
to be that there would be a positive burden reduction for the industry.
Now if you do a detailed evaluation, I think the answer to
your question is yes, as a result of a detailed evaluation it could come
out positive or negative.
DR. SEALE: The thing I am thinking of is you have an issue
that is identified and one of the things that comes out of it is well,
we ought to do this, but if we do this it's going to cost something in
burden, and that is what I would call a negative burden reduction.
MR. CHERNY: Yes.
DR. SEALE: And there is room for that in that level of
assessment?
DR. POWERS: Well, it seems to me that if it came out
negative, Bob, it would have to be justified under the safety
enhancement clause.
DR. SEALE: Well, then you would get into the cost benefit,
I guess.
DR. POWERS: Well, unless it is a compliance issue.
DR. SEALE: Yes, right. Yes. Okay.
MR. CHERNY: Here is a summary of considerations. Just sort
of a quick run-through and we are going to talk about each one of these
in more detail.
We have concluded as a result of the work that we have done
on this issue that current regulatory requirements for these kind of
valves are adequate, and we will talk about that a little more as we go
along.
We have also decided that no new generic cost beneficial
safety enhancement has been identified, and we don't think we can
identify one. One thing that has occurred since the MOV Generic Letter
was issued was the maintenance rule has been issued, and as most of you
know, the maintenance rule has some pretty good things for risk
significant component and systems in it which include identification of
risk-significant components, trending of their performance, establishing
goals for their reliability and taking appropriate action when those
goals are not met. That would have, we feel, been a significant
contributor to the MOV situation had it existed at the time.
Another thing that is about to be implemented is the NRC
risk-informed inspection and assessment process, which is going to
result in inspectors focusing on risk-significant components and
verifying that appropriate corrective actions have been taken for those
kinds of components.
DR. POWERS: It seems to me that the generic issue here had
two components. One was valves simply not being properly maintained or
failing, and the other one was the question of whether static testing of
the valve was indicative of its performance under DBA conditions.
What you have listed here doesn't seem to address that
question of static versus dynamic testing.
MR. CHERNY: Well, as I said on my earlier slide, the
original concern that was identified when we were asked to prioritize
the issue was the second of the two things that you mentioned, so our
work has encompassed both things, both points that you just made, okay,
the general maintenance problems and general upkeep problems, and
setting up problems and so on, and the other case too, where there is
concern about whether they would perform under the design basis
conditions.
We have looked at both things. There may not be a specific
bullet here that says that, but I think that as we go along it will be
more clear.
DR. POWERS: Okay.
DR. MILLER: On the issue of testing, are you going to
address why it couldn't be dynamically tested? Is there a reason for
that?
MR. CHERNY: The issue of the dynamic testing actually is
quite analogous to the MOV situation and let me try and get into that a
little bit more as we go along, if I could.
Another thing that is going on, which we are going to talk
about a little bit, is there are improvements in the industry approach
to addressing POV performance which are somewhat recent and also the
kinds of things that when Generic Letter 89-10 was written did not exist
for MOVs at all.
There are owners group and utility activities going on
specifically in the area at this time to address air-operated valve
reliability and a lot of the things they are doing can be extrapolated
to the other two valve types in the future.
Another thing that is going on is the ASME has an OM code
for inservice testing and the requirements for air-operated valves are
continually being updated in there. At the present time there is a lot
of effort being put into writing a risk-informed code case which is
being specifically written for air-operated valves and hydraulic
operated valves, and it's fairly far along in the approval process. I
think it is at the ASME OM committee level as we are talking here. The
Staff has been actively participating in the writing of that case and so
our input will be in there.
On the next slide we have a listing here of some things that
we have done to learn and to understand more about POV performance as we
have been working on this issue, and as it says on the lead bullet
there, we feel that the input from these things, these various
activities support the lack of an identified generic cost beneficial
enhancement and support issue closure.
The Staff has spent a lot of time reviewing LERs of various
POV failure events. We have also had contractor INEL review LERs of POV
failure events and also do some reviews of some NPRTDS input in that
area, and we have gotten a lot of understanding of the different kinds
of failures. A have a separate viewgraph coming up on that subject
which will talk about it slightly more.
We have also reviewed some of the accident sequence
precursor program evaluations that have been performed, particularly the
last few years, and I have a separate viewgraph on that one. We have
had a contractor working on some plant-specific PRA sensitivity studies
that show that a few POVs can have significant impact on CDF. What we
have learned from those studies.
We have looked at representative PRAs that represent every
type of NSSS type of plant. We have found that if you raise the failure
rate high enough for these valves, what you find is that you can raise
the CDF high enough to be at a level of concern, but what you find out
as you do those evaluations is that the types of valves that are
responsible for raising the CDF are just a very few per plant, very few
really risk-significant valves per plant, and they tend to be completely
different from plant to plant. They are not the same valves from plant
to plant -- very plant-specific.
DR. POWERS: When you find something like that, don't you --
is there some move to say, okay, well the GSI really needs to be changed
from valves as a general class of things to valves that have significant
impact on CDF?
MR. CHERNY: I think what it has convinced us as we have
gone through and done all this work is that resolving this generic issue
as it was originally constituted is not amenable to a generic fix, if I
can call it that.
DR. POWERS: I mean I can see how that would come about.
Later when you said, okay, the valves that are influential in CDF are
different in every plant and ergo it is not subject to a generic fix,
that might well be, but my question is of more of a philosophical
nature.
DR. SEALE: Where do we draw comfort?
DR. POWERS: Well, you have a generic issue that says look
at all these valves and you say, well, gee, most valves not surprisingly
are fairly inconsequential if they fail individually, but now you have
something that is significant, and that is that there is a subset of
valves which do affect the CDF and maybe you want to start focusing your
attention onto those, and you might subsequently discover this is not a
generic fix because every valve is different. I mean that's a very
conceivable thing, but --
MR. FLACK: Yes, if I may, John Flack from Research.
What you try to look for is a common thread, something that
is generic even in the valves that you find propagate to the top. If
you see a similar type of environment, similar types of maintenance
procedures that apply to those particular sets of valves even though
they may fall into different systems if they generic valves in the sense
of being air-operated valves and are seeing the same types of
environments that might affect its performance, for example, you may
still pursue it as a generic issue, but at some level I mean certainly
you get into a very plant-specific nature of the fix and then it becomes
no longer a generic issue.
I think some of these valves do apply across systems, which
may it more difficult. You may have some in the aux feedwater system,
MSIVs might be affected, so there is always this difficulty of trying to
find something generic that you can really work on and fix versus, you
know, the plants should be taking care of this themselves as part of
their performance -- maintenance rule performance, for example.
But you are right. I mean there's this line there that is
drawn that you try to still work it as a generic issue but ultimately it
comes down to plants --
DR. POWERS: Here is what I am concerned with. You go
through and you look at these valves as a generic class and you say,
gee, there's only one failure per thousand plant years and things like
that, or you come up with some statistic and you say, gee, this is
closed. I just don't have any problems with these valves except perhaps
on an individual plant basis, but hidden within that is an actual issue,
that there are some valves that just deserve more attention than the
others, and I am afraid that the conclusion which, true, is applicable
to a vast majority of valves, gets applied to those that deserve this
closer attention.
MR. ROSENTHAL: Can you put up slide 3, please?
Jack Rosenthal, RES.
It's the very maintenance rule that says that licensees will
go look at their plants and figure out which are important valves and
establish a program to address those valves. And I know as part of
AEOD's former life, we did go to seven plants and licensees, in fact,
under the maintenance rule had examined their plants and had identified
specific valves that were important, and some of these valves have high
risk achievement worths, but there are -- but the point is that there's
programs in place to address those single-valve issues, and that's why
the top -- we've tried to make this presentation like a very top-down
presentation, is that's why we feel that no new requirement is needed.
DR. POWERS: That's a good point, Jack. Thanks.
DR. BONACA: In fact, I have a question regarding the
report. The report postulates, you know, ten times the failure rate and
then 30 times the failure rate just to determine the sensitivity, but
then it reacts to that kind of findings of sensitivity by saying maybe
we have to recommend some additional programs.
The bigger question is, do the failure rates that we
experience come close to those kind of factors? What I mean is the
sensitivity, are the numbers used in the sensitivity analysis -- do they
have any relationship with the failure rates observed in the field? I
don't think so from what I saw. It wasn't very clear. I mean, it was
clear up to a certain point, but there were certain recommendations that
were inconsistent with that kind of relationship between what you
postulate for a sensitivity and what you see in the field which
represents those.
MR. FLACK: Yes, I think that's a good question. I mean,
when you do the sensitivity study, you ask yourself the question of
whether these valve rates could get as high as you use in your
sensitivity studies, and then what would cause them to get there, and I
think Frank may address some of that later on, about finding things that
would drive the valves that high. I mean, it's just, you know --
DR. BONACA: It would be good to put that issue in
perspective because the report is somewhat moot on that issue.
MR. CHERNY: Well, let me make a couple comments on the
report, if I may. This is probably a good time to do it.
As I said, we have done some plant-specific sensitivity
studies. You have the -- I think the July 1997 version of that report,
I believe is what we had in the package. The people out at INEL are
currently working on revising that report to address a number of peer
review comments that we have received from other offices, so the report
is still being finalized as we speak.
You mentioned the failure rates. One of the peer review
comments that we -- and we've had a lot of discussion about failure
rates -- one of the continuous peer review comments is sort of along the
lines that you've asked about the failure rates and whether what we've
used is high enough and so on.
As you probably recall from looking at that report, INEL
took a look at 44 IPEs to come up with the failure rates that were used
in those sensitivity analyses, and I think the version of the report
that you have I think they had used like the second highest failure rate
or something like that.
To address the peer review comments, they've taken the
highest one and they're going back and doing some reanalyses with that,
and that is probably the -- probably, as I speak, the final version of
the report is probably going to show rather than the multiplier times 30
and so on that you were mentioning, I think it's going to have just the
bounding failure rate calculations in it.
And there are still some people -- by the way, that failure
rate is three times ten to the minus two, the one that they're going to
be using, at least as we last talked about it. There are still some
people that feel that under certain conditions, that's still not a high
enough failure rate, but I think it's -- from what we have seen in the
sensitivity studies, it is a high enough failure rate to show, you know,
the nature of the concern, that it's confined, that the risk significant
contributions are confined to a very few valves. As Jack was just
saying, they are the same kind of valves that the industry was supposed
to be focusing on because of the maintenance rule. So, you know,
we've learned -- without going to failure rates, I mean, you have some
people that talk about the MOV case and there were certain MOVs when we
first started doing dynamic testing that, you know, under those kind of
conditions, had a failure rate of one, for example, okay?
And you could put failure rates like that into these PRAs
and you could do those kind of calculations, but in terms of the number
of valves and what the contributions are, you wouldn't learn any more,
you would just crank out higher CDF numbers by doing that. So we're not
really thinking of putting those high failure rates in at this time.
Any other questions on the sensitivity analysis? Because I
wasn't really going to get into any more detail on that unless you all
want to.
DR. BONACA: Just one observation, too, that some plants are
better than other at doing certain things.
MR. CHERNY: Right.
DR. BONACA: For example, bleed and feed. Okay. And so
that is a plus for the plant. But of course, if you have that success,
then the reliance on the equipment that you use for the bleed and feed
becomes very important, okay? That shouldn't be a penalty for the
plant; it should be actually the fact that those plants achieve a much
lower core damage frequency because they're good at that kind of
function, for example, should be recognized. And of course, anything
that will prevent that success also comes out as a penalty in the
report. I don't think the report puts that in perspective sufficiently.
Identifies some sequences, but it doesn't put it all in perspective. So
it gives an impression that certain types of plants are much worse
because they have the sensitivity to this POV. It doesn't, however,
show that they have really much lower core damage frequency because
they're successful in some functions like bleed and feed.
Just an observation, the report doesn't have --
MR. CHERNY: Just to comment on that, the report is somewhat
limited in the way it's written because that's how the scope of work for
the contract was written. We asked them to do just that kind of work
and they stopped there they were asked to stop.
DR. POWERS: Let me understand a little better. INEL goes
in and they look at -- and they come up with these failure rates and
they put it into the sensitivity study. Now, the failure rates they're
looking at are failure rates of what? Things like installation errors,
maintenance errors, things like that?
MR. CHERNY: Yes. I have a viewgraph and a couple of pages
that talk about the kinds of things that were considered and the kinds
of things you find in a typical LER search, which all enters into that
kind of a failure rate.
DR. POWERS: Well, what I'm -- I'm coming back to the
definition of the issue again, is at what -- how do they adjust that
number -- that's an experiential number, I assume -- to address this
question of does the valve fail under the accident conditions?
MR. FLACK: I think's a -- you're talking about a capability
type question, and that would be a compliance type question. That
wouldn't be a performance under demand type question.
DR. POWERS: It's a question of exactly what the LER -- I
mean the generic issue has two parts to it. It says a concern that
testing under static conditions may not be able to predict how the valve
will perform under design basis conditions, okay?
MR. FLACK: That's -- yeah.
DR. POWERS: And so, I mean, it seems to me that you have a
certain frequency that you know the valve has been unable to do its job
for a variety of reasons, and since you haven't had a whole lot of
accidents, you've got to say, okay, now I've got to adjust that for the
fact that this valve may not perform under the actual accident
conditions because I haven't tested them under actual accident
conditions, and I'm wondering how you do that.
MR. CHERNY: Well, how you do it is -- or at least one way
that you do it is the same way they did it on the MOVs. You have more
advanced diagnostic equipment that people are using these days. There's
a lot of things that have been learned from all the testing that was
done on the MOVs that can be extrapolated to these other types of
valves, too. There is more advanced diagnostic equipment being
developed for these other valve types I think as we're sitting here, and
when we talk about some of the Owners Group activities and so on that
are going on, we'll get into that just a little bit.
But as you may recall, as much a concern as that was on the
MOVs, the Commission decided at the time that there were enough
regulations on the books to cover the issuing of that generic letter and
its many subsequent supplements.
DR. POWERS: That is an approach, I suppose. What you do is
an analytic approach, I would have thought an experimental approach, but
maybe you can do it analytically. Where is it done? Where can I go
read about it for these valves?
MR. CHERNY: I don't know that we have anything --
MR. ROSENTHAL: I think that it's embodied in, in fact, the
licensee's identification of valves. Let me say that we've struggled
over this thing where PRAs were the reliability, and we have a
capability or a testing issue, and how do you make this bridge between
reliability and capability, and it's clear to us that to just simply
jack up the failure rates or jack up a common mode failure rate beta
factor, of course it will give you a high delta CDF, but that's not what
you're really trying to model when you're looking at capability, okay.
And the sensitivity studies show mostly that if you make the failure
rates high enough, beyond that which you even observe, yes, you'll get
high CDF.
So now you go to something like risk achievement worth,
which asks the question, okay, I have a perfectly acceptable failure
rate for the valve, but what would happen if, in fact, the valve
wouldn't work at all, and you identify those valves at your station who
have high risk achievement worths, low failure rate, high risk
achievement worths, and those are the very valves that one should ensure
will work, and that a good -- okay.
So now, individual licensees, and as I said, we went to
seven plants, so that's a pretty good sample of America --
DR. POWERS: We'll get into that sampling issue --
MR. ROSENTHAL: Okay.
DR. POWERS: -- as the day goes on.
MR. ROSENTHAL: Okay. But licensees in fact have been doing
that. They take their IPE, they take their review boards and they
figure out which are those valves which are important to them, and then
-- I mean, but they're doing that under existing requirements. And then
for those valves, yes, we would -- we've been working with them, it
would be very appropriate, and a good practice would be to do dynamic
testing using test equipment and ensure that they would work. But that
activity, in my mind, although not across the industry and not uniform,
is, in fact, going on at many plants.
DR. POWERS: Okay. I'm still struggling here, and a lot of
it has to do with the general philosophy of JSIs here, but, I mean, you
seem to have said, okay, yes, I know that there are valves that
contribute to CDF and there are valves that don't, okay? But it's not
an issue because the licensees are taking care of it under the
maintenance issue. But then you said, but it's not uniform across -- it
seems now I'm back to a generic issue. Why isn't it uniform across the
industry that those valves that are important to CDF are getting this
higher attention?
MR. CRAIG: We have had a discussion of that issue for
several hours over the past few weeks, that very issue, and the answer
is not as perhaps satisfying as we would like it to be, but the logic
that we I suppose are relying upon goes in part to the experience from
the MOVS where we see that some of the -- the testing programs and
analytical techniques, the good ones, we believe are adequate to
demonstrate that the valves will function under design basis condition.
We're seeing those implemented at plants.
We are trying through the various Owner Groups' activities
to work with the industry to get them to make those kinds of practices
more broad-based, in fact, implemented at more utilities. We believe
that as a result of the activities to identify the risk-significant
valves, both the utilities, the Owners Groups and the staff will have
the scope of potential valves to look at pretty clearly identified and
will know which valves to look at to see whether or not these improved
testing and diagnostic programs are being implemented for those -- for
the risk-significant valves at an individual plant.
So that's -- that thrust of working with the industry,
working with the ASME to address this, if you will, is the approach that
the Commission directed us to take when it made its decision on
direction setting issue 13 industry initiatives. So that's the approach
that we're taking. That is not to say that a different approach akin to
the generic letter on motor-operated valves wouldn't be a little more
satisfying in some respects, at least from the regulator's perspective
or the inspector's perspective. It's a little more definitive, I think.
The former is a little more diffuse. Maybe the lead time is a little
longer than the generic letter approach that we used on MOVs.
DR. BONACA: Well, I have a question on the report along
this same line of thought. The report identifies a specific type of
plant that has sensitivity to POVs in two different systems, and that's
the Westinghouse type of plant, three loops and four loops. The
question is, does the Westinghouse Owners' Group have activities right
now focused on improvement of those POVs?
MR. CRAIG: Yes.
MR. TERRO: This is David Terro. I am with NRR.
Well, first of all it is not only the Westinghouse Owners'
Group, it is a joint owners' group that's addressing the issues of AOVs,
so it includes Westinghouse Owners' Group, the BWR Owners' Group, and
CE, as well as B&W Owners' Group. And this AOV JOG, Joint Owners'
Group, was formed about a year ago, and at this point the staff has been
following the activities of the JOG, but has not formally met with them.
The first meeting is going to be June 3 of this year, and at
that point we will find out more definitively what the formal JOG
program is for addressing the AOV concerns. And so at this point NRR
has not taken any action, any further regulatory action, as far as
issuing any generic letters or information notices until we've had a
chance to discuss this issue with the industry.
DR. BONACA: So you view this interaction as important.
MR. TERRO: Well, at this time we view it as important, but
we are not -- let's say we don't know the extent of the concerns for
AOVs as -- if you look at the MOV concerns, we don't know how those MOV
concerns carry over to the AOV side.
The concerns are similar, but the extent of the concerns
could be different, as well as the scope of the valves that are
affected.
DR. BONACA: Thank you.
MR. CHERNY: The next bullet on the viewgraph talks about a
draft AEOD area study on AOV operating experience. Jack was mentioning
a few minutes ago that there have been site visits to seven plants, and
there's been a number of detailed findings written, and there is going
to be a report published on that in the very near future.
We know what the general findings are from that, and I've
got in your handout a couple pages of summary findings from that work,
and we also have here today the project manager for that work, formerly
of AEOD, who if you really want to get into some of those things, we can
have him talk about that. It depends upon how you want to do it.
I would suggest doing that after we finish a few more of
the -- a little bit more of the briefing.
Another thing, and just to give you a little bit of an
insight as I guess we got from how much involvement in, you know, plant
events POVs that are not motor-operated valves have. There's two
studies quoted here, two reliability studies that AEOD had done, one on
auxiliary feedwater systems, and another on emergency diesel generator
systems. And as it says there identify POVs as causing only a small
fraction of system failures.
In the case of the auxiliary feedwater study, that covered a
period of nine years from 1987 to 1995. During that period there were
2,000 unplanned demands on such systems and 65 unrecoverable train
failures. For the emergency diesel generators that covered a period of
seven years, 1987 to 1993. There were 376 unplanned demands, eight
train failures. We consider the auxiliary feedwater systems and
emergency diesel generator systems to have sufficient reliability and
depending upon who you talk to that's done a detailed review of those
studies, they were either only a small fraction of system failures
related to POVs or none, depending upon how you interpret the data. So
it's very small, very small contributor.
DR. POWERS: And when they looked at this the kinds of
failures they were looking at were of the installation and maintenance
variety, or was it a performance-under-accident-condition variety?
MR. CHERNY: Can one of the former AEOD people help me with
that?
MR. ROSENTHAL: The diesel generator study starts out by
taking actual on-demand failures in the middle of the night where the
4160 bus goes dead and asks does it load. It dismisses the monthly
data, because we know that that's stylized testing data. It does
include the typically an integral ECCS test of refueling outages, which
is another integral test. So I think that that's a fair representation
of how the diesels will work under real accident conditions.
For the auxiliary feedwater study, again it takes actual
demands, and I think it is a fair representation. It doesn't use
monthly test data again, although, you know, we're taking aux feedwater
performance given a reactor trip. We're not able to observe auxiliary
feedwater performance following a steam line break in which because of
the depressurization the delta P's across the valves might be somewhat
different.
DR. POWERS: But isn't that --
MR. ROSENTHAL: But it is as operational and as real demand
as you can get.
DR. POWERS: But I thought it was this higher delta P
that -- I remember my former colleagues, Michaelson and Catton --
railing on this issue at some length it was the delta P that was the
issue.
MR. ROSENTHAL: In terms of the capability.
DR. POWERS: Of the valve.
MR. ROSENTHAL: We'll get to the capability side. But, I
mean, you know, what we want to do, and you struggle with this, is that
if you do a sensitivity study, and I say that all AOVs have a 3-percent
failure rate, then I get a bad answer. Well, that's fine. That's a
sensitivity study.
So now to just pick up on Mario's point, so now you do a
little bit of reality testing. One thing you say is wait a minute,
there are hundreds of AOVs using the BWR scram circuit -- scram system.
So if I have such a failure rate, then I ought to be observing AOV
failures every time I scram the reactor. And I don't. So I know that
in fact at least the average reliability has got to be better than that.
Okay, there are hundreds of AOVs at some reactors, so I
ought to be routinely -- I'm only talking the reliability side now --
every time I take a reactor trip, I ought to be reading about an AOV
failure if it's 3-percent failure rate, and I don't. So I know that
it's better than that.
And then the last thing was to look at these reliability
studies that the Committee has been briefed on before, and said okay, on
the reliability side, and under those accident conditions that we can
observe, are we seeing a problem, and the answer is no. That's not to
say that there aren't valves that individual licensees have found
important, have high-risk achievement worths, that there have been at
least in prior years ASP events that -- individual events. And that's
where it stands. We'll get into the capability issue later.
MR. CHERNY: The purpose of this viewgraph is to show just
kind of a typical breakdown when you do a LER search on POVs, AOVs or
HOVs. You get, for a typical year, for one valve you get -- you tend to
get a breakdown sort of like I have got tabulated here. And this isn't
intended to be any particular search, it is just sort of a
representative thing.
But the main point here is that you find when you look --
spend a lot of time looking at these, that you get 50 percent human
errors reported in the LERs and very commonly it is things like failing
to follow maintenance procedures. And, you know, these are older LERs,
most of them are reflecting experience before the implementation of the
Maintenance Rule and we are expecting the Maintenance Rule to help
alleviate a lot of this kind of stuff for the risk significant valves.
Now, we were just talking about the ASP program. The staff
has done a review of the last several years of the ASP evaluations. I
am told that back in 1994 there was a significant change in the ASP
methodology, so we haven't gone back too far because if you do that, you
wind up comparing apples and oranges, and you can't really learn
anything from that.
So what we have learned from what we did do, I got tabulated
up there with the ASP screening criterion is. And a couple of
interesting points, prior to 1995, regardless of what methodology you
used, there were two to three POV events per year that contributed to
events that exceed that criterion. But the interesting thing is that
there haven't been any POV events that exceed the screening criteria for
the last three years of the ASP program, there haven't been any.
So that seems to be an indicator that utilities are starting
to pay more attention to these kind of valves. The Maintenance Rule is
starting to kick in. Owners Group activities are starting to have some
benefit and things like that. So this is not -- you know, this is not
an all-conclusive kind of thing, but it shows you an indicator and a
trend kind of thing.
Now, we have been talking about Owners Group activities and
utility efforts and I might make mention of the fact that one of the
things that the Maintenance Rule requires you to do is to take industry
experience into account when you are evaluating your component
performance and reliability in setting the goals.
As Dave was saying a few minutes ago, this JOG AOV is
relatively young, but there is an Air Operated Valve Users Group that
was formed in the early 1990s, it has been around a little bit longer,
and I have got just a few words there on what, you know, we think they
are doing. Some of our people have participated in some of those
meetings, and so we sort of know what they have been talking about.
Recently, they formed this JOG AOV Users Group and, you
know, by attending at some of the public sessions where they have let us
sit in, we sort of know what they are doing, but our first real briefing
on all this activity is going to be at the public meeting on June 3rd
with is going to be held here at NRC headquarters.
So just to restate our bottom line, we are proposing to
close GSI 158. We have concluded that current requirements are
adequate. We have concluded that, from our own evaluations and from
ongoing activities that we know are getting underway from the industry
and the Owners Groups, we know from things that are going on in the ASME
code development, implementation of the Maintenance Rule, we are going
to be starting the NRC risk-informed inspection processes and so on,
that POV performance is being addressed.
Our feeling is that, you know, we are going to watch these
thing, take these kind of things into account. The Commission has been
encouraging us use industry initiatives and codes and standards
developments and things like that to address problems of this type, and
if we still feel that the payback on utilizing all those things is not
sufficient, then some sorts of plant-specific actions will have to be
taken. But we feel that current requirements are in place already to do
that kind of thing.
So that is really the end of my basic presentation. I do
have, as I said before, the project manager for the AEOD studies is here
to talk about some about some of those findings if you all want to hear
them.
DR. POWERS: I guess I am slow. I am still asking this
question, do the valves that are risk significant work under actual
dynamic conditions of a DBA accident?
MR. CRAIG: Let's go to backup slide number 1. I think the
answer to the question has several parts. The first one is based on the
MOV experience and the improvements in testing programs and analytical
techniques to evaluate the valve performance. As we have concluded, as
a result of that effort, what it takes to ensure that the valves will
work under design basis conditions, that that information is being
transferred to and we are building upon that in the other classes of
valves.
DR. POWERS: Where can I read about that?
MR. CRAIG: That process is going to be evolving. There is
not a report that talks about that because it is largely going to be
dealt with in the compliance arena between NRR and the various -- the
Joint Owners Group. And if there is a determination that is made for a
particular valve type that some additional testing is needed, either the
industry or we will do some research to test the valves on the design
basis conditions if that turns out to be necessary. That is part of it.
The other part of it is based on, in part, the second bullet
that we see up there, based upon the looks at the plants that were done
by Dr. Orenstein. And his conclusion, looking at those, was that there
are programs that are out there that are capable of ensuring they
perform under design basis conditions, and he can talk to that in more
detail.
DR. MILLER: Okay. I would like to hear that.
MR. CRAIG: Okay.
DR. MILLER: You say there are programs. Does that include
dynamic testing? Have we tested these valves, or any of these valves?
I keep hearing we are going to, but I don't hear that we have.
MR. ROSENTHAL: Hal, why don't you go sit up at the table.
I think you will be here for a while.
MR. ORENSTEIN: Good morning, my name is Hal Orenstein. A
lot has been said about the work that we have been doing in my former
life in AEOD and my present life in Research.
Essentially, we initiated the program about two years ago in
which we had the assistance of Idaho Nuclear National Engineering and
Environmental Laboratory accompany us. We tried to encapsulate the
status of air operated valves. We were not looking at SOVs or hydraulic
reoperated valves, we were focusing on the air operated valves. We
chose to visit seven different sites in which there were 10 reactors.
We chose the plants to visit to see what was happening out there, in a
manner, to try and get a good mix.
We visited -- I won't get them in the exact order, but it
was Palo Verde, Palisades, LaSalle, Three Mile Island, Turkey Point,
Indian Point 3 and I am not sure if I mentioned Palisades. But, anyway,
if I didn't get all seven, I got pretty close. We visited each of the
four reactor manufacturers' types. We visited all the new plants. We
also had a pretty good mixture of architect engineers who had built the
plants. I think I left out Fermi and LaSalle. Anyway, you had cases
where the utility was the architect engineer as well.
In any event, what we found, and I have been a participant
in the Air Operated Valve Users Group meetings from the second meeting
through the number 16. I think I missed one or two that I was unable to
make, but I do make presentations at each of those meetings trying to
highlight some important AOV issues and operating experience that has
occurred through time.
What we did was, when we went to the plant, what we found
was two of the plants were of great interest to us because Palisades and
Fermi were considered to be lead plants. They had a contract --
actually, they were receiving funding from EPRI, and what they were
doing is they were setting up an air operating valve program and they
were being funded to try to determine what valves are important, that
they should know more about, as well as to try and determine whether or
not the calculational methodology that has been developed under the MOV
program by EPRI was applicable or might be transferrable to air operated
valves.
In particular, you get a wide diversity of what was
observed, but what we found the people at Palisades being the lead plant
had done a very thorough job in identifying plants of -- valves of
importance, and we found that just about -- not all, but most of the
plants had gotten to different degrees of completion of examining the
valves, and a good deal of this work was not an added burden from the
standpoint of separate AOV program, it was really a combination of using
the -- applying the maintenance rule methodology with expert panels
trying to superimpose on it or use the IPE results to try and
characterize the valves through each function that it would have,
through all combinations of events, and the plants, for the most part,
did a decent job identifying valves in their report, which is presently
in draft which we are trying to get out. We have a table which
indicates how the plants divided up the population of valves, and
amongst them how many were determined to be important from the
standpoint of risk importance.
Again, we have a nonuniversality of terms, what people
considered to be important at one plant that may not have been important
to another, which we may or may not consider to be important here.
They were concerned about releases, they were concerned
about operation during -- recovering from transients. There was a very
wide array of things that they were looking at.
But the bottom line was this: Fermi and Palisades were both
being subsidized, should I say, being supported by EPRI funding, and
they were doing calculational work. Fermi had yet, at the time we were
there, to determine what they were going to do with regard to actual
testing of valves. They did hire an outside organization, I believe it
was Sargent & Lundy, to help out with the calculational techniques.
On the other hand, Palisades had done a large amount of
static testing and they are in the process of getting ready to do
dynamic testing, and they were doing all the test work themselves,
whereas the Fermi plant, the impression I got was if and when they were
going to do actual testing, they would probably bring in an outside
contractor to do the work. There are several companies out there who do
provide these services.
Another plant that we visited that we had a very good
understanding of what was happening was Palo Verde. They had
implemented their own air-operated valve program back in 1989 when they
had common cause failure of four CCV valves in their, I guess, the
atmospheric dump valves had failed.
They had actually, by the time we were there in late '97,
had categorized the valves, found out in many cases which ones had
specific risk importance, and they had done a lot of static as well as
dynamic testing. In their case, we got into some interesting
discussions about what margin they had at the valves, what was adequate
margin, what they were finding, and in many cases, they had done
testing, dynamic testing, not so much because of -- I should be fair to
them. They had done some testing from the standpoint of risk
importance, but they had also done some testing from the standpoint of
what they had observed, certain valves were acting sluggishly. But they
seemed to be in the forefront.
LaSalle plant had done a lot of work in static testing, had
not done any dynamic testing as we knew it.
When we went to Turkey Point, we found a very interesting
situation there, where they were doing a lot of work from the standpoint
of fixing problems with the valves as they had them working on a
day-to-day basis, and their position was they were not going to do the
type of thing that we are talking about today; that is, they are not
concerned about verifying capability of certain valves that would be
subjected to conditions different than the daily operation, if they were
undergoing a transient. That is if you had design basis event, they did
not plan to do any testing or any calculation to determine that that
valve would work. They were focusing primarily on the day-to-day does
the valve work today under these conditions.
What I think Jack had mentioned earlier, and something I
think you picked up on, was the fact that each plant is doing their own
thing. Some people -- in case I have to be a cheerleader for Palo
Verde, I think that's how Jack described it in my early draft of my
report -- they're doing what they think is the right thing, completely
categorizing and understanding all the valves.
On the other hand, you had the case of Turkey Point that
wasn't going to do much more than what they had to, and they had people
out there who hadn't even decided to do. But it did have a wide range
of it. And essentially I can get into a lot of other things on
maintenance which I don't think you are focusing on now, but I think the
question is stated about capability. People have the ability to use
operating experience, calculational techniques which are being improved
on, and test capabilities that exist if they decide to do it, and that's
a mixed bag as to what's happening.
DR. POWERS: I guess I want to understand a little bit. You
mentioned calculational capabilities. I haven't seen any. I just have
to ask what it is. I am familiar with some German work on valves which
is extraordinary calculations on the finite element, more nodes than I
care to describe, coupled with an experimental program with thousands
and thousands of strain gauges and what-not on valves, trying to
validate this model, and it's taken them years to do this. Is that the
kind of calculational capability you were talking about?
MR. ORENSTEIN: What EPRI was looking at was primarily some
simple methodology to characterize or to determine what kind of margin
you had on the valves. They were not asking each plant to sit down with
a very complex computerized system. They were trying to come up with
some simple formulae or something that could be simply used with the
results of even static testing to get better understanding of the valve
factors and certain features of the equipment.
I am not exactly sure to what level INEL has gone or would
be able to go, but I do know that as part of our program, two of the
gentlemen who were very heavily involved on generating the calculational
techniques and verification for the industry valve tests at Idaho were
working with us, and in addition to that, the lead person from INEL who
was working on the project, who visited all seven plants with me, Owen
Rothberg, is in the room here, he is the person who wrote the original
89-10. So I mean I cannot tell you the degree or the depth of
involvement that people are planning to do, but I know that they are
trying to get some simple techniques that can be used at the plant in a
very quick way to accurately determine if the valve would have the
capability to work under the other conditions.
DR. BONACA: For some of the dynamic testing that you
observed, okay, was it done under accident conditions, first? And if
yes, how successful was or did you identify problems? I think that that
is an issue, I mean --
MR. ORENSTEIN: I did not witness the test, but my
understanding -- Owen, you can correct me if I'm wrong -- what I
understand is that in the case of the tests that were done at Palo
Verde, they simulated the conditions as best as they could, whatever
they means, and they did find that the valves would not be capable of
performing their safety function under the design conditions, and they
did have to modify the valves.
I believe Palisades, in doing similar type tests, also found
there were conditions where the valves had to be changed. I think it is
also interesting to note that the static testing was very important, and
we have a -- there was a Canadian study that was done jointly by the
person who formed the -- who led the formation of the air-operated valve
users group, he's a fellow by the name of Brian Ferguson from Ontario
Hydro, he, in conjunction with Bill Fitzgerald from Fisher Control, who
had used the Fisher flow scanner, did a study on the Bruce Station AOVs
and they found essentially 45 percent of the air-operated valves as they
were found in place for the first set of tests needed adjustment in
order to be sure that they would be able to function properly.
Subsequently, they found that each year when they were doing
maintenance on them, the population of valves that had to be adjusted
and changed on the set-up and bench set were less, but still
significant.
MR. FLACK: The question that was raised, though, was the
kind of accidents that would occur. I mean we talk about design basis
accidents, some of these are very low probability events that would
have, you know, need to occur to get the --
DR. POWERS: Let's set the ground rules very clear. We are
either in design basis space or we are in severe accident space.
MR. FLACK: I understand. I understand.
DR. POWERS: Don't tell me that DBAs need to be discounted
because of their low probability because then I'm going to take you over
to the severe accident space, and you don't want to go there with this
kind of information.
MR. FLACK: No, I understand, and I'm not trying to argue
that point. We are trying to put things in perspective from a reduction
issue as well. If we are going to request licensees to perform tests on
valves under certain conditions, we have to ask the question, what are
the risk implications of those conditions? Are they going to -- do they
present a high risk to the public? I mean those are the kinds of
questions our branches are asking ourselves as we revisit the
regulation. So it's just in that light that we are asking that
question.
DR. POWERS: If you're going to have 45 percent of the
valves don't work under DBA conditions, I presume that is 45 percent
won't work under severe accident conditions. I think you can take your
risk achievement words to judge whether there is a significant issue
here or not.
MR. FLACK: That could be one way of demonstrating it, yes.
MR. ORENSTEIN: Okay, I don't want to be -- give you the
wrong impression. I'm not saying 45 percent of the valves would not
perform the safety function during an event. I said 45 percent of the
valves had to be adjusted.
DR. POWERS: I understand you've come down from my original
coming in here, which was 100 percent, okay?
MR. ORENSTEIN: I didn't say that, did I?
DR. POWERS: No, but that's what the generic issue is.
DR. MILLER: The testing program at Palo Verde said 45
percent --
MR. ORENSTEIN: No. Ontario Hydro at Bruce Station had 45
percent of the AOVs had to be changed in their set-up and adjustment in
order to make sure that they would travel properly from minimum to
maximum pressure in that position.
DR. MILLER: How did they determine that?
MR. ORENSTEIN: By using the diagnostic equipment that was
made available, is available to everyone today, from one of the
manufacturers. In fact, that's been a burgeoning industry. It started
with one company with equipment which was on the ragged edge on its
capability, and now you have about six companies which are coming up
with very sophisticated equipment which is better designed for AOVs than
the original ones were, which were essentially an extension of the MOV
testing equipment. But there is a lot of equipment out there.
In fact, I was in Germany back around 1992, and I think it
was a Nickel-Westheim plant where I was shown by Siemens people and
Herion people that they did have some very sophisticated valve
diagnostic equipment that they were looking to add onto AOVs, and at the
time I was there they had like 55 valves connected to their computerized
system. So rather than doing an intrusive test or doing a separate test
later on, they had all the valves hooked up, waiting for a transient,
and they were going to record all the data simultaneously.
DR. MILLER: Those are in situ type instruments, and they
watch how they operate?
MR. ORENSTEIN: That's what they were doing over there back
like eight years ago. Now what -- or seven years ago, now.
DR. MILLER: You say now they have better techniques?
MR. ORENSTEIN: I don't know what they are doing today, but
I know that we do not that here. People here have concerns about the
problem that the cabling may have associated with everything in the
plant and our requirements, I guess, are a little bit different than
what theirs are.
DR. BONACA: Well, one of the bases you presented for
closing this issue was that the core damage frequency associated with
this issue was marginal in justifying further action. Provided that
there are no further insights to show clearly some specific and unique
deficiency that have to be addressed now.
I have a couple of questions. One, first of all, you seem
to indicate that dynamic testing is done only in a scattered way, and
when done, was not necessarily successful under design conditions.
DR. BONACA: I don't understand we -- I don't think I said
that, did I?
That's what I heard.
DR. MILLER: Well, you said at Palo Verde they did dynamic
testing and they didn't work and had to adjust them.
MR. ORENSTEIN: No, they did dynamic testing. The dynamic
testing told them that something had to be done to the valve so that the
valve would work properly under its design conditions that you had it
made for. The valve was not set up right. The testing was good. There
was no problem with that. I think the -- we may have some disagreement
amongst the experts from INEL and the people at Palo Verde as to how
much margin they have on the valve. But they definitely were able to
determine, as was the case in Bruce and the case in LaSalle and almost
all the other cases, where they found that the diagnostic testing was
considered to be reasonably correct, calculations that were done and
tests that were done showed that leaving the valve as it was might not
have given the valve the capability of -- would not have had the valve
perform as you had determined that it should be working. I don't think
there was any lack of success.
DR. BONACA: Okay, I heard something else before. Just a
question, going back to the CDF contribution, what was the CDF
contribution associated with the MOV issue, just to put it in
perspective?
MR. ORENSTEIN: I don't know. I am not sure. All I know is
this. The thing that was interesting about the MOVs was people looking
at MOVs initially having failure rates on the order of one, two times 10
to the minus three. They did diagnostic testing and they found that the
failure rates were eight 10 to the minus 2, and this was associated with
torque switch setting and other things.
In the case of AOVs, I don't think we have that type of a
database that we have actually put together. I do know that in some
cases, for example Indian Point Unit 3, they did testing on -- the
numbers escape me -- I think it is 20 valves, 20 air-operated valves,
many of which were in important systems, and they found that half of
them had to be adjusted and had to do things, change spring setting, et
cetera, in order to make sure that they would work properly.
This is not -- say 50 percent is bad, but what I am saying
is they did find a fair number of valves that had been acting in a funny
way under normal conditions, some of which would have had to go ahead
and operate under more severe conditions, and they did the testing. In
that case it was static testing. They just did not feel comfortable
with what they were seeing, with what they thought they had margins, and
then they made adjustments.
They have not done dynamic testing there yet. In their case
they used an outside contractor and I think they used Crane MOVATS
equipment, but there is a wide range of this type of thing.
Now as far as the AOVs go, you talk about the study that was
done back in July of '97. There is a whole slew of variables in there
and one of the things that I noticed as I was coming into the meeting
today, in fact I read it yesterday, was the original writeup for the
Generic Issue 158 used a generic failure rate that was obtained from an
AEOD study from NPRDS data. That study said that the general AOV
failure rate for NPRDS data is .042 and the failure rate of AOVs in
risk-important systems was .011. Now the numbers that were used in the
INEL-158 study that you have were taken to be I think something like
.001 -- 10 to the minus 3 or two 10 to the minus 3 or one 10 to the
minus 3.
However, there is a part of the report that is very
important that is sort of not very clear to the reader and that is the
beta factor, which you are using to consider the common cause
contribution even though they said certain numbers in the report, the
actual numbers that were used in the calculations were extremely low and
what we are doing now is we are looking at this more -- as Jack said, if
you pick a wide enough range of failure rate and wide enough range of
beta you are going to come up with a high CDF.
The bottom line that we have gotten to now is that the
report you have says that with all these variabilities that you put into
the failure rates on the POVs, AOVs -- in particular, my concern -- you
don't get much of a core damage frequency. However, what some recent
work that is correcting some errors and omissions there is saying is you
shouldn't look at those numbers because those are probably going to be
drastically changed because the beta factors that were used were not
prototypic and we are trying to get new calculations to give you a
better range.
I mean I can't tell you what a CDF number is. Again, each
plant is different and the main concern as I see it, and I think most of
the people in the Agency see it, is that it makes sense to identify the
risk-important valves, not necessarily AOVs, and then go ahead and
address them to confirm that they will work, and then do additional work
to make sure that they will continue to work.
That is the thrust of our report and I think that is the
thrust of the whole Agency. The question is under what umbrella, under
whose label you have it, whether it is a generic safety issue area or
whether it is a compliance issue or if it is an NRR item, whether it is
a Generic Letter -- I don't know. But the thing is I think we all
recognize that what has to be done, rather than trying to chase around
10 to the minus what it is, depending on the failure rate which is
variable, and we ought to really address the issue, which I think has
been stated by Dr. Powers earlier today.
The other thing I want to mention is in the 158 study that
you have, July of '97, it used the failure rates that were presented in
the 44 IPEs and what we have observed in many cases, that some of those
were extremely optimistic on the common cause or the beta factor, and to
me it appears that the most important issue on air-operated valves and
solenoid operated valves and I am not so sure about hydraulically
operated valves -- it may be but there are less of them and they don't
have them appearing in as many important areas -- the important thing is
the commonality, the fact that if you go to Three Mile Island, as we
did, and we sat down with the utility and they start to explain what
they found on some of the valves, and what they found was a valve was
acting in a funny way.
They went back to get information on the design of that
valve and they couldn't get anything. Eventually they were able to
extract from the manufacturer information that told them the valve was
okay, but when they looked at the manufacturer's analysis they found
they had a friction or valve factor of zero.
As a result, TMI went back and asked them to please
recalculate what the valves' margin had if they use present day
technology using what we have learned from the MOV program and
diagnostic testing, and lo and behold, they found out that the valve did
not have any positive margin, and they did make changes to improve it,
but this is something they have done on their own, and how many things
like this occur? I don't know.
A similar valve at a sister plant, in particular Crystal
River, made by I guess it was architect engineer was also Gilbert, they
had problems with the same valve but it was in a different system, and
they were trading horses on or trading information on explaining how
they could go ahead and fix the problem at the other plant.
MR. ROSENTHAL: Can I?
MR. ORENSTEIN: Yes.
MR. ROSENTHAL: Hal is an expert on this, so a week ago I
wanted to describe individual valve failures at length and let me just
back up a little bit.
Number one, we are trying to present a balanced presentation
where I mean our starting out point, which I still think is the point is
that no new regulatory requirements are necessary. That is the basis
for closing the GSI.
We have tried to give you some balance on the risk side,
saying what studies were done, what the operating experience is -- there
are individual failures, what is going on in the field in order to
provide some balance and not present a particularly rosy or particularly
glum situation.
The fact of the matter is that with respect to capability,
we could look at -- we don't see that as a new requirement that
demonstrating the capability is a compliance issue, so we would not
advocate a new requirement.
Let me note that two big things that are different from 1989
of the MOV work and now is that we have got a maintenance rule on the
books and there is diagnostic testing equipment out in the field that
didn't exist 10 years ago.
Okay. Given our perception of the risk and plant-specific
or system-specific valve-specific nature of the issue, and just the
overall operating experience, we believe it would be appropriate to work
with industry to promote, enhance good programs. We see some evidence
that that started -- there is a Joint Owners Group -- and so we believe
it is appropriate to -- again, not to have a new requirement but to work
with industry.
DR. BONACA: I have just one last question on this. Now
still it seems to me that because it is a significant issue you would
still -- I mean this issue seems to need some leadership. You are
planning this June 3rd public meeting and it is not clear here from all
we heard what is going to happen there. Some people will do something.
Some people may not do something about it and the question I have is, is
the timing of proposing a closure of GSI-158 the right timing right now?
MR. CRAIG: Well, Dave Terro is going to talk about where
the responsibility and leadership for the issue lie. Closing the GSI
has no effect on what utilities have to do to demonstrate compliance.
What was hanging out there, if you will, was this potential for an
additional requirement that would pass 50.109, the backfit criteria, and
what we have concluded is, for the reasons that you have heard, we can't
come up with any.
There is nothing we can identify and as we looked at it we
reflected back on the MOV activities and the basis for that was
compliance and we don't see a logic or a rationale that would get us to
an additional requirement as opposed to those kinds of interactions that
we would have with industry to determine whether or not some compliance
action would be appropriate.
Go ahead, Dave.
MR. TERRO: This is David Terro again. I just want to say
that about a year ago Research first proposed to close out this GSI and
asked NRR if we agreed with it, and about a year ago we said the same
thing. We said no, we think it is premature. There is not enough
information out there with respect to AOVs and how that issue is being
resolved.
In the past year quite a bit has happened, and let me just
summarize that again.
One, the AOV JOG has formed, and they are specifically
taking the initiatives to address the AOV concerns.
Two, DSI-13, industry initiatives, the Commission policy
came down that the NRC should now rely more on industry initiatives to
resolve many of these generic concerns.
Three, the ASME is addressing AOV concerns through a
risk-informed approach and is developing code cases and we are working
with the ASME to incorporate diagnostic testing of AOVs into that code
case.
Four, the NRC has come a long way, the Staff has come a long
way with risk-informed initiatives and specifically risk-informed
inservice testing initiatives, and we have developed a Reg Guide 1.174
and Reg Guide 1.175, which gives us a lot better guidelines and
direction on how to approach risk-informed reviews and testing issues.
Lastly, of course, we have the AEOD research study on AOVs
and that is about ready to come out, so after all these initiatives,
after we have taken a look at all these initiatives today, a year later,
we said yes, we believe now is the proper time to close out the GSI
because all of these other factors have kind of taken the ball and is
now running with it --
DR. BONACA: Does NRR agree with the proposal by RES to
close this GSI?
MR. TERRO: Yes. Yes, that was my final statement -- yes,
NRR does agree that we can close out the GSI. It does not mean that the
concerns with AOVs are totally resolved but that we intend to work with
the industry in solving those concerns.
DR. BONACA: Are there any more questions for the presenters
or comments from the members?
[No response.]
DR. BONACA: With that, Mr. Chairman, I will give it back to
you.
DR. POWERS: Okay. John, you were going to close out with
anything additional on 165 or have you pretty well covered it?
MR. CRAIG: I have asked Owen Gormley to come down, who is
the lead engineer for that issue, and he will give you a thumbnail
sketch and just so he doesn't confuse any of us, the resolution that you
saw in the package is going to be the same. What we need to do is we
just needed a little more time to turn the crack and do the reviews to
get a quality presentation to you.
But having said that, let me ask Owen to briefly summarize
what he would have said, and if you have any questions it is an
opportunity to ask them.
MR. GORMLEY: I am Owen Gormley from Research.
I would like to assure you that there are no reactor plants
out there in an unsafe condition because of the small safety relief
valves.
I'm sure if you looked at the package you recall that we
looked at the five major plant types and we winnowed or screened the
systems and trains and valves down to one worst case valve. We did a
fairly rigorous analysis on it, and we found that it had an acceptable
increase to CDF, if any increase is acceptable. It certainly fell
within prescribed limits.
At that point we became concerned about hanging our hat on
just one valve so we went and looked at all the other valves -- all the
other valves in those five plant types. Then people kept raising
questions of LERs and so we went and searched the LER database and found
that only the Shearon-Harris event which had precipitated the GSI had
any relevance to this issue.
At this point we asked ourselves how did this thing get to
be classified high priority in the first place? We went back and looked
at the prioritization. What we found in our analysis was that there are
no valves in any of these plants that have the capability of failing
their train. There are a number of assumptions and concerns on the
prioritization but the key assumption was that 10 percent of the 45 to
55 or perhaps 60 valves in a plant would have the capability of failing
their train and if you make that assumption you then come up with a
relatively high core damage frequency, and if they don't fail their
train you can't calculate a significant core damage frequency.
So those things have not changed. In addition, one of the
other factors that caused the issue to be characterized or prioritized
as high was that it looked like it would be fairly easy and economical
for the utilities to do tests right on their plant sites of these
valves, so we could pull them into a testing program like other valves
in the plant and we have been wrapping up or tying up loose ends and
tucking in strings for so long that this has happened without any action
by NRC.
I would like to assure you that there are no problems that
we have seen with the Generic Safety Issue. Probably if we had looked
more closely at the beginning or if there had been more information
available at the beginning it would not have even been raised as an
issue.
DR. POWERS: When I looked at the package the first thing
that struck me and the first thing you opened up your discussion with
was we selected five plants and we have looked at their valves.
And I said well, gee, five is 5 percent of the population. You came to
the conclusion that there was only one out of the -- one valve at one
plant that was a real problem. That's fine, except now I have to ask
about the sampling, okay? Clearly there is the possibility that 98
plants out there still are at risk on this issue. You selected five and
you haven't looked at the others. How do you know that the sampling
that you took is appropriate to this study?
MR. GORMLEY: Perhaps I failed to say five major plant
types. We've got a --
DR. POWERS: No, I understood, and I understood the plants
and I know the plants that you picked. But I also know that three of
those plants have had the benefit of rather extensive examination in
connection with other issues, and so I say I also know that there are
plants that have not had the benefit of those extensive examinations in
connection with other issues.
So my question comes back, it's really a theoretical
question. You may not be the right one to answer it here, but John is.
What is the strategy or the logic that's involved in your sampling? I
mean, you've done it several times. You've done it on the previous
study we just heard about. And it's being used frequently. How do I
have confidence that the 98 plants you did not examine aren't all
suffering the worst-case thing that I can possibly imagine?
MR. GORMLEY: Well --
DR. POWERS: That's really the question I'm asking.
MR. GORMLEY: Okay. I'm glad to have that question this
month instead of next month.
DR. POWERS: Yes. You would definitely have got it, and
that seems to be, when I look at your package, my personal examination
of your package was that was the Achilles heel on the package.
MR. GORMLEY: Okay.
MR. CHERNY: Could I try and give a partial answer to that
question today?
DR. POWERS: Sure.
MR. CHERNY: For that issue there was a representative
number, types of plants chosen, all the different plant types were
represented. The important thing to remember is that the overpressure
protection requirements that were used to size and protect all the
systems and all the plants is the same as what was used on those five
plants, and that's the ASME code requirements for overpressure
protection.
DR. POWERS: Had you found no flaws, I'd say hey, pretty
good answer. But you found what?
MR. CHERNY: We found one that was sized bigger for -- I'd
let him explain why it was big. I don't remember why it was big.
MR. GORMLEY: There was a possibility that the charging
pumps could through a valve misalignment --
DR. POWERS: And you explain that in the -- and what not,
but it doesn't change my question.
MR. GORMLEY: Right.
MR. CHERNY: Again, I think it points out the fact though
that you may have on a couple of plants a couple of outliers that the
utilities would be responsible for taking some kind of special action on
if there are any. The so-called one valve that he found, he was able to
show was not a real problem when he looked into it in some more depth.
DR. POWERS: And some sort of engineering judgment you
based, you say yes, there may be a couple of them out there. The
question I'm asking you is how do you refute the individual that says
no, it's not a couple, it's 98.
MR. CRAIG: We'll have a much better answer when we come
back in June.
DR. POWERS: Thank you, John. I guess you've already given
it to me.
[Laughter.]
In that case, I'll ask do our Members have any additional
questions they want to ask on this issue?
John, as you can tell, the Committee is very interested in
GSIs, not only individually but also globally in this area, and so we'll
look forward when we come back and, quite frankly, we've enjoyed your
presenters, especially your authority on valves. He obviously knows
more about valves than I will know if I stay up nights studying. And I
will take a recess until 25 after the hour.
MR. CHERNY: Thank you.
[Recess.]
DR. POWERS: Let's come back into session. We are going to
have some change in the original plan of attack, but we're still going
to spend some time discussing the fire protection functional inspection
program and its fallout. I have some opening comments, and I've
provided the Members with background material here that I'd like to go
through a little bit, maybe not as extensively as I had originally
planned.
When we get into this presentation, we're really dealing
with fundamental issues of fire protection, what should the licensees do
to assure adequate protection of the public from accidents initiated by
fire or exacerbated by fire, and what does the NRC need to do to verify
the licensees provide this assurance.
There's some background on all this that the Members need to
be aware of as we discuss these issues. First and foremost, of course,
is our fire protection regulations are indeed prescriptive, that despite
the existence of the fire protection regulations, the IPEEEs apparently
are showing that CDF from fire-initiated accidents to be significant,
significant at least in comparison to CDF values that we derive from
analyses of accidents initiated during normal operations.
One of the questions that promptly comes up is in fact do we
believe those results, that is, are methods that were used in the IPEEE
process sufficiently reliable to come up with CDF values. That's not
going to be a part of this discussion, but it's a larger discussion that
the Committee has.
The real issue here is that if you do believe these results,
then you have to remember the peculiar nature of our fire regulations.
They do not require the kinds of redundancy and diversity and safety
class that we require for the protection systems during normal
operations. Yet associated with them are these relatively high CDF
values.
The fire protection and functional inspections were
conducted on four pilot plants, and inspections were indeed costly to
the industry, and I think it's fair to say that they were costly to the
staff as well. I think some of our speakers are well prepared to
explain to you that their tongues were hanging out trying to do both the
functional inspections and all the other work that came along with them.
One of the questions we're going to have to understand,
though, in thinking about the costliness of this is how much of that
cost arose because the licensees were reestablishing the design basis
information that should have been routinely maintained. One of the
conclusions that comes through in the report of the fire protection
functional inspections has repeatedly said that its success lay in
refocusing attention on the importance of fire protection at the plants.
The other thing to bear in mind is that the licensees are
comfortable with the existing prescription regulations and the existing
inspection process. What's going to be discussed in the fire protection
functional inspection report that we have is that there are proposals to
change the inspection process.
When you think about change, then you have to think about
all of these pilot programs that are going on now in connection with our
changes in the way we inspect plants and assess plants, and the issue
comes up if we do go about changing the fire protection inspections, do
we want to inject them into the pilots that are now under way. It's a
challenge, because those inspections rely upon performance indicators,
and we really don't have fire protection performance indicators now the
way we do in many of the other performance areas.
Finally I go into background for the Committee to always
bear in mind is the fire protection is different than many reactor
safety issues, in that it has a very high level of visibility and
tangibility both to the public and the legislature.
I've included in your background some points of contention
that exist between proposals of the staff and responses from the
industry. I don't know that it's pertinent to go through these now,
because there's going to be some changes in the staff position, but
these are points of contention that we may want to bear in mind as we
think and learn more about this issue.
So at that point I guess I will turn to Steve. Are you
going to --
MR. HANNON: John Hannon, Assistant Branch Chief. I'd like
to make a few --
DR. POWERS: I'll turn to you and let you take over the
discussion from that point on.
MR. HANNON: Thank you, Dr. Powers. I appreciate the
opportunity to come and meet with the ACRS to discuss our current status
of our fire protection functional inspection program. Steve and his
staff have been working very hard and closely with the oversight task
force that is responsible for integrating the fire protection inspection
program into the oversight activities.
As Dr. Powers pointed out, this is a controversial issue.
We have received at least two letters recently, one from NEI and one
from Clearinghouse on Fire Protection commenting and giving us their
concerns with the proposal. And there seems to be an emphasis on
timeliness and trying to go too fast here with this new program. But
hopefully you'll see that we have come up with a reasonable approach,
and we think it's appropriate and necessary, and at this point then I'll
turn over to Steve West to make the briefing.
MR. WEST: Thank you, John.
I'm Steven West, the Chief of the Fire Protection
Engineering, and now Special Projects Section also, since the
reorganization.
DR. POWERS: Didn't have enough to do?
MR. WEST: I didn't. Fire protection wasn't enough.
So we're actually going to break the staff's presentation up
into two parts today. First I'm going to talk a little bit, give you an
overview of the fire protection functional inspection pilot program,
kind of the background. I'll go through that quickly, because I think
most of you are familiar with it -- but ask any questions -- and give
you the status where we're at and what we have left to do. And then
we're going to have Pat Madden from the Plant Systems Branch and J. S.
Hyslop from NRR's PRA branch discuss with you a method that we've
developed for assessing the risk-significance of fire protection program
deficiencies such as inspection findings, FPFI findings or any other
inspection. And they'll be able to talk to you some also about some of
the specifics about the findings from the FPFIs and their risk or safety
significance.
Before I get started I just wanted to I guess apologize a
little bit. We thought we'd be further along when we got here to talk
to you about the program. We're a couple of weeks behind in getting our
final report and our final Commission paper with our recommendations to
the Commission. And as you can imagine, because a couple of people have
already mentioned it, it's not only a very important area, and we want
to make sure that we do the right thing, but whatever we do obviously
could have significant impacts on both the industry, the reactor
licensees, and the staff.
So we're trying to be very careful in coming up with our
recommendation and doing the right thing based on the insights we got
from this FPFI pilot program and other things that have happened over
the past few years that give us some insights into the state of reactor
fire safety. And I'll discuss some of those as we go through the
presentation here.
As you'll recall, and Dr. Powers mentioned, one of our
principal objectives of this FPFI program was to renew industry
attention to reactor fire safety. In light of the Thermo-Lag experience
when we started looking into the state of fire protection and indeed
looking at the staff's focus on reactor fire safety, we thought that it
may have dropped below that which was in place at about the time when
Appendix R was being implemented. So actually probably what happened
was, you know, the staff was very active in fire protection, in getting
Appendix R implemented.
Our activity in the area started tapering off, and of course
the licensees follow suit. So it's not really -- we're not trying to
cast any aspersions on industry, but there was a concern that there was
not being adequate attention paid to reactor fire safety.
Along those lines we were interested in getting information
as to whether licensees were in fact maintaining their licensing and
design bases for their fire protection programs.
DR. POWERS: Let me ask you a question, Steve.
MR. WEST: Yes, sir.
DR. POWERS: I mean, as you know, I've had the privilege of
attending these fire protection forums that the industry holds. They're
well attended. I mean, I think the last one I was at there were 160
people there. That is not indicative to me of a lack of attention by
the industry. I mean, that seemed to be a very active bit of attention.
What led you to believe that there might -- that things may have fallen
off?
MR. WEST: Well, they didn't have those forums before.
[Laughter.]
MR. WEST: Before Thermo-Lag.
DR. POWERS: Not before Thermo-Lag, but --
MR. WEST: At least not at the scale they're at now.
DR. POWERS: I mean, they seem to be self-curing pretty
quickly here then.
MR. WEST: I think there were a lot of changes that were
brought about in response to the Thermo-Lag issue, and I think Fred
Emerson or Dave Modeen's going to be talking to you later, and they may
be better ones to ask about the industry response to some of these
issues.
But our perception was that after the Thermo-Lag issue, when
we did a thorough self-assessment of the NRC's reactor fire protection
program we did a couple pilot inspections for that and reviews of LERs
and a bunch of other things, that it looked like the emphasis on fire
protection both within the staff and with the industry had fallen,
dropped, from the time of Appendix R.
I believe NEI began conducting these forums initially to
address Thermo-Lag issues because they were so pervasive and so many
issues that had to be dealt with, and it made sense for industry to get
together to talk about the issues and how to resolve them. And then
they grew from that. They started getting more staff interaction
through those forums and they have continued them, and they have been,
as you mentioned, a very good indicator of industry's interest in
reactor fire safety today.
Okay. Inspect design bases, inspect Thermo-Lag corrective
actions, which was a commitment we had made to Congress, actually. We
had done a self-assessment of our fire protection program, as I
mentioned, and we are kind of continuing that through the FPFI pilot
program. We wanted to see how effective our inspections had been in the
past and today. And so that was a part of it.
And then, of course, falling out of the program, we should
be able to make a determination on what the appropriate level of fire
protection inspections would be for the future. It could be anything
from do nothing to continue to do full scope FPFIs or something in
between. So that was kind of the objectives we set up going into the
program.
Okay. So what did we do? And I think you know what we did.
You have mentioned most of it. We developed an inspection procedure to
conduct the FPFIs. It is a very comprehensive inspection procedure,
very thick. It covers all aspects of reactor fire protection programs
in quite a bit of detail. It is an inspection procedure for fire
protection like never existed before.
We have gotten very good reviews on the inspection
procedures. We found them to be very effective in helping us plan and
conduct our inspections. And during our workshop with industry, we got
some good feedback that they are good inspection procedures.
So we used those inspection procedures to conduct four pilot
inspections at River Bend, Susquehanna, St. Lucie and Prairie Island.
And Prairie Island was a little bit different because we were -- it was
not a full scope FPFI but we were looking at the licensee's
self-assessment that they had done using the FPFI procedure and lessons
they had learned through the previous pilot inspections. And one of the
things we are trying to determine is could licensee self-assessments be
an effective way for licensees to go and look at their programs and
relieve some of the NRC inspection burden, if we had confidence that
those self-assessments could achieve the same types of results that a
FPFI would.
We also, during the pilot period, we didn't actually conduct
FPFIs, but we had two major inspections, team inspections, one at Quad
Cities, actually, we went there a few times, and at Clinton. And we
used FPFI-like inspection techniques at those inspections also. They
were kind of that level, that scope, that level of detail, and that
comprehensive.
Now, one thing I want to point out is that we have, through
the pilot program, tried to improve or increase our use of
risk-information and risk insights to plan inspections and to assess
inspection results. And we actually, in the procedure, after I think
the first or second FPFI, put an appendix into the procedure that
provides the team leader and the inspectors guidance on how to
risk-inform their inspection plan.
And for the pilot inspections, the four pilots here, we used
a risk analyst to help plan the inspection. And, actually, I think for
most of them, they came along on the inspection. J.S., who is here
today, helped us with those. You probably have some questions in that
area. He may be a good one to ask about that.
DR. POWERS: Let me interrupt, Steve.
MR. WEST: Sure.
DR. POWERS: Just to remind members that we are planning to
have a subcommittee meeting of the Fire Protection Subcommittee at
Susquehanna in June and that would be an opportunity for the committee
to get the inspectee's point of view on the FPFI.
MR. WEST: That would be a good one, a good thing to do
while you are there. Susquehanna did fairly well on their FPFI. They
had a fairly strong program. We found strengths as well as weaknesses.
The licensee's engineering staff has been there a long time and they
have been involved in their program, much more so than consultants, so
they have good control over their program, understand it, were very good
at answering the questions raised by the inspection team. I would say
overall they got very high marks at Susquehanna.
We did have a one-day workshop attended by, I don't know,
160 or so stakeholders, mostly licensees but also members of the public,
vendor owners groups, NEI staff, our Region staff from here and
headquarters. We got some good insights from the workshop.
And then one of the things that we had in mind that we
needed to do before the workshop was to develop a method, kind of a
systematic method that could be used to assess the risk significance of
fire protection deficiencies. And that was one of the topics of
discussion at the workshop, and there was pretty much total agreement
that that would be something that would be worthwhile to develop, both
from industry saw the benefits of that as well as the staff. So we have
been developing a method and that is what J.S. and Pat are going to talk
to you about later.
We didn't have it in time, you know, during the inspections,
to use it throughout the pilot inspection process, but we have gone back
and looked at some of the inspection findings and run it through the --
we call it the Hyslop maneuver, and assess some of the FPFI findings
that way.
Okay. What are our kind of observations at this point,
having got to the point where we are putting together the final -- in
the final stages of our Commission paper and our final report? We think
there is renewed industry attention to reactor fire safety. That has
come out in forums such as the NEI Fire Protection Information forums,
in our workshop on the FPFI program.
In response to the FPFI pilot program, a number of licensees
went out and on their initiative starting conducting self-assessments,
even though they were not selected as pilot plants. NEI has a program
underway to develop self-assessment procedures that the licensees could
use to conduct self-assessments. So I think that objective was
achieved.
We did find, during the FPFIs, that a lot of the findings
that we came up with during inspections had probably existed for quite a
while and they were not revealed by our previous inspections. And we
think our NRC core inspection procedure, which is the procedure that is
performed at each plant about once every three years, is weak and that
it doesn't turn up some of the more risk significant findings. It
doesn't direct the inspector to look in the right areas.
And, similarly, licensee QA audits, or in self-assessments
that may have been based on the core inspection program, also had not
found these types of problems. We did find that the self-assessments
that licensees were doing in preparation for an FPFI, like the one at
Prairie Island and St. Lucie had also done one, where they looked in the
right areas, at the right depth, were effective in finding problems with
the programs. So we concluded that self-assessments can be beneficial.
I think if you just took our inspection reports and counted
all the items where we said, you know, we found this noncompliance or
deficiency or weakness, going back to the regulatory requirements, I
think you would come up with a list of about 140 items. Some of those
were unresolved items and they have subsequently been resolved to our
satisfaction. And, of course, they were varied safety and risk
significant. Some would be, you know, very low and some are potentially
high.
With the exception of our inspection procedures themselves,
or our inspection program, we didn't really find any significant
problems with the reactor fire protection program. And what I mean is
if we looked at, you know, what the existing requirements and guidance
are, we didn't see any big holes or items that we have missed where we
should be paying attention to reactor fire safety and we have not.
DR. POWERS: Did you find or look for the opposite, that is,
where the fire protection was excessive, unnecessary, redundant?
MR. WEST: I don't think -- no, I would have to say no, we
didn't do that. Now, I want to mention that, in this topical area, that
we have actually briefed at least the subcommittee, I am not sure about
the full committee, on an issue that we are working on on circuit
analysis, and that problem came up independent of the FPFI program. But
it is an area where questions have been raised about the adequacy of our
guidance on how you would do a circuit analysis. So we are continuing
to work through that. There are some industry activities underway.
DR. SEALE: Steve, --
DR. POWERS: You must have surely found something else
because you are doing a complete rewrite of the guidance. I mean it is
more than just fire induced circuit failure.
MR. WEST: You are talking about the comprehensive Reg.
Guide. Yeah, we are -- we do have the program to take all of the
existing guidance that is scattered throughout many documents and try
and consolidate them in one place. It is really -- we are really not
doing that to resolve any problems with the guidance. We have found
that there are some cases where there is --
DR. POWERS: Other than it is dispersed. I mean that is a
problem, it is dispersed.
MR. WEST: It is dispersed and there could be some
conflicts. You know, one thing may say hoses should be 100 feet long
and another one way say they should be 75 feet long. So there are some
things like that. I think the only -- in the comprehensive Reg. Guide
right now, the only place where we think there may be a hole that we
need to try and fill is on compensatory measures, providing some
guidance on how you would establish what an appropriate compensatory
measure could be for a particular fire protection program deficiency.
DR. SEALE: Steve, I have to chew on your ear a little bit
here.
MR. WEST: Sure.
DR. POWERS: That is the gentlest thing that has happened to
him in recent weeks.
MR. WEST: Yeah, it is usually much lower.
DR. SEALE: I find it incomprehensible that you could have a
finding up there that said problems were found during the FPFIs, were
not found by the NRC core inspection or licensee QA audits, and then
come down and say that there were no significant problems found with the
NRC fire protection program. It seems to me that you need to have a
sense of ownership for what the people in inspection and QA are doing on
issues associated with your programmatic responsibilities.
If they didn't have the kind of working information that the
inspectors could use to maintain a high level of fire awareness in the
inspection program, then it is your fault, at least partially. You
should have a sense of ownership for what they are using as the basis
for the inspection program.
MR. WEST: And I agree with you. That's what I said. I
said with the exception of inspection procedures, looking at the
regulation itself and the guidance that's used to implement the
regulation, we didn't find --
DR. SEALE: Well, that didn't come across very well.
MR. WEST: I thought I said that, but if not.
DR. SEALE: Okay.
MR. WEST: No, definitely, I think the, you know, the core
inspection procedure is not adequate to find risk or safety significant
fire protection problems, and there could be problems with the skill of
the inspectors, there could be a number of reasons why --
DR. SEALE: Well, you know, there's even a cue or a hint
here that might help you. One of the things that the people in the
training programs in the utilities found was that the training program
process seemed to not exactly fit with the training requirements until
the idea of ownership on the part of the users for the information base
that was included in the training program was developed, and this was --
then this was now an INPO kind of problem in terms of delivery of
training and so on. But the idea of ownership is an excellent way to
articulate the relationship that ought to exist with a, if you will, a
third party deliverer, which is what the inspection and QA people are
relative to your technical area and the plant. And if you can develop
that concept --
MR. WEST: Right.
DR. SEALE: -- maybe it'll help define the things you need
to do.
MR. WEST: Yes. Okay. I agree with you, and I think maybe
it's not coming across in my slides or in my presentation, but in our
Commission paper and our final report on the FPFI program, we do
acknowledge that some of these problems exist because of our own
inactivity --
DR. SEALE: Shyness.
MR. WEST: Right. So, I mean, that's a valid point and it
is one that -- as I mentioned, one of the reasons we did this whole
program is we weren't sure how good or how thorough we had been, either,
and we did implement this program to help us achieve a better
understanding of that.
Okay. Also, we kind of have concluded that some level of
NRC inspection is warranted, and probably some level of licensee
self-assessment also is warranted. I think we really think the licensee
self-assessment or their -- ownership of their program, their pride of
ownership, could be a big part of what we do in the future in a way of
our oversight and inspection process, and presumably Fred or Dave will
talk about that some more later because they do have some activities
underway that should prove to be very beneficial.
DR. SEALE: There again in the training area,
self-assessments are an integral part of the process.
MR. WEST: Right. Right.
So we are now developing, you know, I say some level, and we
are now trying to put getting a recommendation to the Commission that
would specify what that level of NRC inspection would be and how
licensee self-assessments can play a role in what we do.
We're trying to also be true to the objectives and concepts
of the new reactor oversight and inspection process. So whatever we're
going to do should be incorporated into that.
DR. APOSTOLAKIS: You mean someone will talk about it later,
how you do that?
MR. WEST: Excuse me?
DR. APOSTOLAKIS: You will talk about it later, how you do
this?
MR. WEST: How we do what?
DR. APOSTOLAKIS: How do you coordinate it with the
oversight program and the performance indicators they have and all that?
I mean, at which point are you going to get into the documents?
MR. WEST: I can talk a little bit about that.
DR. APOSTOLAKIS: You don't plan to cover this?
MR. WEST: Well, I --
DR. POWERS: These documents are defunct now.
DR. APOSTOLAKIS: Defunct? We spent all this time reviewing
them.
DR. POWERS: Thanks.
MR. WEST: We have developed a -- let me address that. We
in the Commission paper that went to the Commission in March on the new
reactor oversight process recommended a fire protection inspection
program that consisted of resident walkdowns, their normal duties, and a
triennial fire protection team inspection. That would not be a full
FPFI; it would be a much reduced scope from an FPFI. And we're now
putting together a Commission paper specifically on the fire protection
inspection programs, providing much more detail and is providing our
bases for that recommendation.
It was -- that paper was supposed to be finished before this
meeting, and unfortunately, it's not.
DR. APOSTOLAKIS: I have here a draft --
MR. SINGH: Excuse me. George, please don't discuss that.
That's pre-decisional, and that's the --
DR. APOSTOLAKIS: I can say from whom to whom.
MR. SINGH: Oh, sure.
DR. APOSTOLAKIS: I'm not going it read the whole thing.
From Mr. Travers to the Commissioners, status of reactor
fire protection projects and recommendations for reactor fire protection
inspections.
Is that obsolete now, or that doesn't tell you anything?
Yes what? It doesn't --
MR. SINGH: Yes, it's obsolete because that is not good
anymore. They revised the whole thing.
MR. WEST: Wait, wait, wait, wait. The paper may be
revised, it may go like that. It's pre-decisional right now. We're
working through the concurrence process. It's up through the director
of NRR and we're discussing comments with him.
DR. APOSTOLAKIS: So the comments I have are useless to you?
I mean, is it really dramatically different, what you plan to do?
MR. WEST: No, your comments are very useful if you have
comments.
DR. APOSTOLAKIS: You don't know what they are.
[Laughter.]
DR. APOSTOLAKIS: Tell me at which point, then, I should
give you my comments. Since you're not going to cover what is in here.
At the end of your presentation? Or you don't want them at all? I
mean, I don't care.
MR. WEST: No, I think we would like to have your comments.
It's up to the committees when you want to provide comments.
DR. APOSTOLAKIS: I don't know. If this is now completely
rejected -- what do you think?
DR. POWERS: I think we're going to try to adhere closely to
the schedule, which means I'm going to close this session at 11:45, and
that means I need to complete the staff presentations no later than
11:30.
MR. WEST: Okay.
DR. POWERS: Is that going to give you adequate time? Good.
MR. WEST: So right now, the -- what's before the Commission
would be a triennial fire protection inspection, you know, each three
years, go to a plant and do some fire protection inspection with a
three-person team. That's kind of where we've settled in on, but until
the paper actually gets signed out by the EDO --
DR. APOSTOLAKIS: Well, that's what you say here as well,
don't you?
MR. WEST: Yes.
DR. APOSTOLAKIS: That there will be triennial meetings. I
mean, inspections.
MR. WEST: Right.
DR. POWERS: What I've never understood was three people,
three -- every three years. Why not four people every four years or one
person every other month or -- I mean, how do you come up with that
number?
MR. WEST: Do you want to answer that, Leon?
MR. WHITNEY: Leon Whitney, NRR.
The three people refers to the fact that it's a synergistic
integrated team of fire protection engineer, electrical engineer, and
mechanical systems engineer, and we don't feel that -- unless you have
that group of people working on it as far as a shutdown, that they can
get below the surface and dig out the analysis and validate it.
DR. POWERS: You used more for the FPF --
MR. WHITNEY: Well, we used more people. We used a regional
representative, we had the risk representative with us. We're not
planning to, within the triennial draft, to have the risk representative
actually travel to the site during the inspection, although he may come
during the information gathering visit. He's certainly going to be
providing a major input into the inspection plan. So he's part of the
team; he's just not necessarily on site, and therefore, if you look at
the way the inspection program, DIE, direct inspection effort, is
calculated, he wouldn't show as a DIE, a direct inspection effort,
because he's not on site during the actual one week of inspection.
As for the duration, I don't know if you -- duration of one
week. It's adequate to certainly do a vertical slice of some aspect of
post-fire safe shutdown and/or fire protection in the sense of
sprinklers and detectors, et cetera, and barriers. Triennial -- partly,
that's driven by an intent to ensure and maintain adequate attention to
the issue and to -- if we're going to have a one-week -- say a vertical
slice, that means that various issues every three years at any given
plant can be addressed, disparate issues, different vertical slices can
be addressed, and over time, you get a good look at the entire program.
DR. POWERS: I think the real issue boils down to why these
-- I can't call it big, but visible every-three-year inspections versus
a regular inspection by the on-site inspectors and the regions?
MR. WHITNEY: Well, for traditional combustible control,
ignition control, and status of sprinklers in terms of plant status
looks, a single inspector who is adequately trained can do that.
Now, when you get into the post-fire safe shutdown area and
its interaction with fire area boundaries, barriers between equipment,
electrical analysis in particular, and all this integrated look, you
have to have the three people working together to adequately review the
complex analysis and its implementation in the reactor plants.
DR. SEALE: Could I ask a related question? How many fire
protection specialists do you require in order to be able to support 30
inspections a year?
MR. WHITNEY: Well --
MR. WEST: You would probably need one in each region.
MR. WHITNEY: And considering follow-up activity, you would
be a very busy person, yeah. However, it wouldn't be 30 a year. If you
look at -- generally, we go on a site basis, and we've worked out the
math and it's six to eight per region per year, and then if you add in
the fact of these, you know, 2,000 man hours and do all the
calculations, he's a very busy person, especially with follow up. Now,
you also need other people to staff the electrical and mechanical.
MR. WEST: You know, there are a couple of other
considerations. One that we've mentioned a couple of times is the
expectation that the licensees will be conducting self-assessments, and
this gives them an opportunity to conduct them over a period of time
looking at their whole program, probably over several years, could be
two to three years, really. And that way, when the inspectors go in,
they can focus on the results of the self-assessment with some
independent inspection, but they'll be able to take advantage of the
work the licensees have done.
The other aspect is that at the current time, there are no,
as Dr. Powers mentioned, fire protection performance indicators.
So that throws fire protection into an area, into an
inspectable area, NEI is working on developing a set of fire protection
performance indicators, and I think that'll be done in -- I think
they're going to propose something to us sometime in the year 2000. And
one thing that we've said is that we would reconsider this baseline, say
we went with a triannual inspection, we would reconsider that after we
had conducted some triannual inspections, reviewed some licensee
self-assessments, and determined that there were some performance
indicators that could help reduce the amount of direct inspection that
was required.
DR. APOSTOLAKIS: Now let me understand that a little bit.
What kinds of fire frequencies are we talking about here? If I look at
the performance indicators that the oversight program has developed,
they have frequencies on initiating events, right? And basically they
are using unplanned scrams or scrams with loss of normal heat removal
and so on.
Now you're initiating event is the occurrence of a fire.
MR. WEST: Right.
DR. APOSTOLAKIS: What if I have a facility where in the
auxiliary building for the last 15 years they really never had a fire?
Why shouldn't that be an indication that they are doing something right?
MR. WEST: That may be an indication that they're doing
something right, but it can't be the only indication that we rely on to
not conduct any inspections.
DR. APOSTOLAKIS: But you didn't say that.
MR. WEST: The fire frequencies are -- there should be an
attachment to that draft paper you have, Attachment 1, that has all the
data on fire risk and fire frequencies.
DR. APOSTOLAKIS: Yes. But, I mean, we're not talking about
events that appear once every thousand years. I'm telling you, there
was no fire at all. Nothing. Nothing. Small, or anything.
DR. WALLIS: There can still be malfunctions of the fire
protection system even without a fire, as we had out in Washington with
the water hammer, which actually led to a significant event.
DR. APOSTOLAKIS: But the fact that you haven't had a fire
should affect your inspection. I mean, you may want to have additional
performance indicators for other things.
MR. WEST: It may affect your inspection. There may be
information that you consider when you're planning your inspection,
because the idea behind these inspections is to focus first on the risk
and safety-significant areas, and that could be an input that the
inspector uses to help develop his inspection plan, tells him where he's
going to look, where he's going to do his inspection.
DR. APOSTOLAKIS: Which was something that I couldn't find
in the big package that is now obsolete. Was it there?
MR. WEST: That the inspections are going to be
risk-informed, or that they're going to --
DR. APOSTOLAKIS: Focus on the -- or the critical locations.
Is it in there?
MR. WEST: I think it's in there.
MR. WHITNEY: Excuse me again. Leon Whitney, NRR.
The baseline inspection procedure talks in large measure
about how the inspection plan is put together and calls upon the
inspectors to take all risk and event information into account.
MR. WEST: They may not have that procedure.
MR. WHITNEY: I don't think you have that right now.
MR. WEST: It is in the paper, but --
DR. APOSTOLAKIS: Now when are we going to see these things?
Are we going to -- you're not going to discuss those when you go to
Susquehanna, right?
DR. POWERS: No.
DR. APOSTOLAKIS: So there will be another presentation?
DR. POWERS: We'll have to deal with it when they're ready
to deal with it.
MR. WHITNEY: We've developed the baseline; I believe it
would be published and presented by the oversight program.
DR. APOSTOLAKIS: I mean, it seems to me that would be a
good indicator of something. It doesn't tell you much about the
detection and suppression system. You may want to do something there.
But the fact that they haven't had any fire should play a significant
role.
Now, let me go to the second one. Another indicator or
class of indicators that the oversight program is using is the
mitigating systems, okay? So they want safety system unavailabilities
for 36 months, and they give you the numbers. And the facility, you
know, you have stated that you want to reach safe shutdown. So if you
go now to your critical locations, or any location, and identify what
may be affected by the fire, why can't I have performance indicators on
the staff that is independent of the fire, and then if I meet the goals,
I'm happy.
If there is a train that is not affected by a fire in this
room, then I want a certain unavailability of that train, and if the
utility demonstrates that they meet it, we don't inspect anything,
because they met the goal. I mean, that was the whole idea of the
oversight program, that you have goals, and if you don't meet them, then
something is triggered.
MR. WEST: Right.
DR. APOSTOLAKIS: Increased management attention.
MR. WEST: And that may be what comes out once the
performance indicators are developed.
DR. APOSTOLAKIS: By NEI? Or by you?
MR. WEST: Well, NEI has a program to develop them for
industry with our -- I guess we'll have to review them and buy into them
at some point.
DR. APOSTOLAKIS: But, I mean, if you are developing a
functional fire protection program, you could use some insights like
that without having the benefits of a major performance indicator
development program. It's kind of obvious. You want to achieve safe
shutdown, these are the trains that do it. If you gentlemen convince me
that the unavailability is less than 10 to the minus 2, that's fine.
I'm not going to do anything. And in fact you can make that part of the
maintenance rule, I guess.
What's wrong with that kind of thinking? Why do we need a
research program to decide that? I mean, we've been doing five PRAs for
15 years now, 18 years. Or that may very well be in the program.
MR. HANNON: This is John Hannon. Let me point out one of
the revisions to the paper you're looking at builds in a placeholder.
In the event that kind of performance indicator is demonstrated by the
industry in the future, we would consider that and modify our inspection
program accordingly.
DR. APOSTOLAKIS: The inspection program as it is now does
not do this.
MR. HANNON: It allows for that eventuality to take place,
but it does not do it now. That's right.
DR. APOSTOLAKIS: You state very clearly in this paper which
is obsolete that -- in fact say simply stated the underlying purpose of
the NRC fire protection program -- I cannot read one sentence?; come on,
they've said it many times -- is to reasonably assure that one means of
achieving and maintaining safe shutdown conditions will remain
available. Okay?
That's not really your objective, Steve, is it? You really
don't want to see any fires, because the New York Times may publish
something and people may get upset. I mean, you said that in your
opening remarks, that people are paying attention. Because if I go to
the rest of the document that is now obsolete and I have this as an
objective, then a lot of the stuff that you require is not needed. So
clearly your objective was different. You just don't want to see
anything. I mean, except maybe a wastebasket, but you don't care about
that.
So I would suggest in the new document you really state
clearly what you want to achieve, which you know already. I mean, it's
not new to you. And if you really don't want to see fires, then perhaps
you should state what kinds of fires that cause what, because that's
your objective. I mean, from reading the rest of the report, it seems
to me that's really one --
DR. SEALE: George, you just have to recognize that the
program has to include both prevention and mitigation components.
MR. WEST: Yes, I think you have to read two sentences,
because that is the underlying purpose of the regulation, and it's
achieved through fire protection defense in depth, which includes as the
first element preventing fires, which you cannot do in all cases.
DR. APOSTOLAKIS: That's not defense in depth.
MR. WEST: That is fire protection defense in depth. We've
had this discussion before. If you look at the fire protection
regulation, it's stated in there.
DR. POWERS: The fire protection regulation is the only one
that defines defense in depth, and it defines it very explicitly, and
the delightful thing about it for PRA types is it follows exactly what
you do in a fire protection PRA. I mean, the two are totally aligned.
DR. APOSTOLAKIS: The fact that you have defense in depth
has to do with the uncertainties you have.
DR. POWERS: No.
DR. APOSTOLAKIS: Not necessarily with your objectives.
DR. POWERS: No.
DR. APOSTOLAKIS: If you had a perfect assessment method
that would tell you where fires would occur and, you know, with all the
detailed probabilities and so on, that's an ideal world, defense in
depth would play a minimal to next-to-nothing role, because you wouldn't
need it.
DR. POWERS: Not in this case, George. This case I think
defense in depth the way it's defined would exist even if I had the
perfect analytic tool.
DR. APOSTOLAKIS: It is defined because at that time you
didn't have the perfect analytic tool. It's a vicious circle here.
DR. POWERS: Now you really --
DR. APOSTOLAKIS: Are you saying because we defined it that
way and now I have the perfect tool, I'm in trouble?
DR. POWERS: There is no trouble here. The fire protection
should be able to absorb risk-based methods of analysis more easily than
any other world that exists, because the way they define defense in
depth is the way you do a risk analysis. You start by preventing fires,
then you find you can't prevent all fires, so you try to detect them and
suppress them, and you can't suppress all fires, so you try to protect
the equipment that they might damage.
DR. KRESS: There is nothing wrong with that definition,
George. It's in line with our definition pretty much. The only problem
with it is it doesn't seem to be a good way to set limits on how much --
DR. APOSTOLAKIS: My objective is safe shutdown, and I
demonstrate that I can have a 10 to the minus 6 probability frequency of
not achieving this, and at the same time I can have a fairly large
number of fires. I have met my objective, but Steve is unhappy, because
he doesn't want to see many fires.
So what I'm saying is that the purpose is more than just a
shutdown.
DR. POWERS: I'm really going to have to intercede, just to
maintain schedule, because I've been losing schedule for the last two
days. And since I only have two days left, I have to make up someplace.
So I'm going to have to insist that we stay on schedule here.
MR. WHITNEY: Sir, if I could just respond to that last --
DR. POWERS: No.
MR. WHITNEY: Okay.
DR. POWERS: Let's press on with the presentation and
recognize I'm going to hold you to schedule.
MR. HYSLOP: Can everyone hear me?
My name is J. S. Hyslop. I'm in the PRA branch of NRR, and
together with Pat Madden in the Fire Protection Section, we've developed
a fire protection risk-significant screening methodology to be used to
detect the risk significance of fire protection weaknesses.
I'm going to talk about the methodology, and Pat Madden will
be discussing the applications afterwards.
DR. APOSTOLAKIS: So we haven't seen any of this yet.
DR. POWERS: No.
MR. HYSLOP: We have some objectives of the screening
methodology. The first is to focus inspectors on risk-significant sets
of inspection findings, and to screen out findings which have minimal or
no risk significance. In addition, this fits into the plant oversight
assessment process. Therefore, it produces a potential risk
significance which is tied to a color which is tied to a recommended
regulatory response.
Now here are some of the characteristics of the model.
First of all, it's a screening methodology. If a fire scenario can be
developed, then the frequency of challenging fires is conservative,
challenging fires are defined by those not extinguished by
extinguishers, all equipment and cables in the room where the fire
initiates has failed, the barrier is challenged, and it failed.
Equipment and cables in the adjacent room fail. And the
characterization of the degradations to defense in depth due to the
inspection findings is conservative. It's a screening method.
It's qualitative. The degradations in defense in depth are
characterized by high, medium, and low. The method looks at inspection
findings collectively. As you know, degradations in defense in depth
have a synergistic impact on risk. The model produces a change in
risk -- this is in CDF -- utilizes a paradigm similar to that of the
inspection finding risk characterization process as defined in its
SECY --
DR. APOSTOLAKIS: Excuse me, J.S.
MR. HYSLOP: Yes.
DR. APOSTOLAKIS: How do you produce the change in risk when
the whole thing is qualitative and very conservative?
MR. HYSLOP: I'm coming to that.
DR. APOSTOLAKIS: Okay.
MR. HYSLOP: Would you like me to answer it now or --
DR. APOSTOLAKIS: No.
MR. HYSLOP: Okay. So the frequency in fire is integrated
with the defense in depth mitigation capability, and we produce
risk-significant categories consistent with the regulatory response
thresholds used in the licensee performance assessment process.
We have an underlying quantitative foundation for this
method. First of all, we consider ignition frequency, that is ignition
frequency of fires, and this is divided into ranges, and the upper
frequency of the band represents the entire range, and the range is over
a factor of 10.
DR. APOSTOLAKIS: Again, I have to understand that.
MR. HYSLOP: Yes.
DR. APOSTOLAKIS: What do you mean by ignition frequency?
MR. HYSLOP: The frequency of fires.
DR. APOSTOLAKIS: You said you have a room.
MR. HYSLOP: Yes.
DR. APOSTOLAKIS: And if there is a fire, everything goes.
MR. HYSLOP: Right.
DR. APOSTOLAKIS: Is that what you said?
MR. HYSLOP: If you can define a fire that ignites and
propagates, then everything in the room goes. However, the ignition
frequency has been developed by the AEOD database for the different
rooms, for the cable spreading room, for the switchgear room, et cetera,
and that is based on at least 10 years of data.
DR. APOSTOLAKIS: But these are not fires that are sizable
enough or in the right place to do a lot of damage, right?
MR. HYSLOP: Well, there is an ignition frequency, and then
we convert that to a challenging fire through something akin to a
severity factor, and I will be showing that on the next slide. So we
don't say all fires produce challenging fires even if we say there is a
part of those.
DR. KRESS: So you have a database for these frequencies for
each particular room, it is a set.
MR. HYSLOP: Yes.
DR. KRESS: And then you take, for a given room, you are
going to divide it up.
DR. APOSTOLAKIS: For each room?
DR. KRESS: You know, you are going to divide that up. You
are going to divide that up into bands and do something with each band.
MR. HYSLOP: Well, first of all, we look at one fire area at
a time, okay. And there is an ignition frequency for that fire area.
And if it is -- say it is 5 times to the minus 3, then that fits into
the 10 to the minus 3, the 10 to the minus 2 band.
DR. KRESS: I see.
MR. HYSLOP: So we use 10 to the minus 2 to represent that
ignition frequency, which is the set of fires.
DR. KRESS: I understand.
DR. APOSTOLAKIS: Well, but why didn't you put the
challenging probability in your room?
MR. HYSLOP: Because all of those fires don't --
DR. POWERS: Let me interrupt and say I don't know how we
are going to do this. You have got five minutes.
MR. HYSLOP: Both of us have five minutes?
DR. POWERS: You have five minutes. I think this is going
into the detail that is appropriate for a subcommittee.
MR. HYSLOP: Okay. What I will do is go quickly through the
next couple of slides. First of all, I have said we integrate
defense-in-depth with the frequency. There we get core damage
frequency. There are certain dependencies between automatic suppression
and manual suppression modeled.
Here we tried to illustrate the concept. Auto-suppression
controls fires. Manual -- the fire brigade is necessary to go in and
extinguish the fire. So if we have a significant degradation in the
fire brigade and a degradation in the automatic suppression, the credit
for that combination is reduced.
Likewise, there are common mode failures between
auto-suppression and the fire brigade. Both water systems have common
valves, pumps, et cetera.
I will put this up here. I am just going to talk a little
bit about these. These are the values which underlie the model. We
have several degradations in the defense-in-depth element, low to extra
high. These are the defense-in-depth elements which are modeled, safe
shutdown, we have a three hour, one hour barrier, automatic suppression,
and here we have manual suppression. It is different in the control
room and outside the control room because the control room is constantly
manned.
The reason the fire brigade is up here is for degradation of
the fire brigade, we credit these values for manual suppression. Note,
for the high degradation, we don't -- we do credit manual suppression a
little bit because of fire extinguishers.
Five minutes. Okay. Let's go on to the next slide. These
are exponents of 10. Any particular questions about this?
[No response.]
MR. HYSLOP: Okay. Here in the quantitative value assigned
to the dependencies. I elected to negate the credit for automatic
suppression when it has medium degradations and the fire brigade has a
high degradation. And then for a low degradation of automatic
suppression, this credit is reduced but not eliminated. And then for
the low degradation of the auto-suppression and the fire brigade, a
certain value is added. This is essentially a common cause contribution
of .005, it is an estimate, an extreme --
DR. WALLIS: I'm sorry. Did these numbers come by guesswork
or by analysis of data or something?
MR. HYSLOP: Okay.
DR. WALLIS: They look awfully round.
MR. HYSLOP: Well, they are round. They are round because
this is a screening method, that is the first thing, and it is an
approximate method. These values in the low degradation come from NRC
studies, countless ones, industry studies.
DR. WALLIS: Okay. So there is a basis of experience, they
are not just pulled out of the air.
MR. HYSLOP: This is the basis for experience. These values
came about because I am not going to allow any credit for the high
degradation. These values came about because the are in between. There
is some data on these -- on this value. And here, for safe shutdown, we
are doing essentially the Morris method technique. For no trains, zero
credit. For a manual recovery, 10 to the minus 1, for a full train, 10
to the minus 2, and for two trains with common cause, 10 to the minus 3.
So there is a basis for these numbers. I just didn't go into them
because I have got five minutes.
DR. SEALE: You've got one now.
MR. HYSLOP: Well, I've finished.
MR. MADDEN: Good job, J.S. -- and I am not going to say
anything.
[Laughter.]
DR. POWERS: I think you have introduced this new screening
methodology that I think the committee is very interested in, in truth,
but I think we are so interested in it that it is one of these things
that is better pursued in a subcommittee forum where we can go into the
details and explore the numbers in some depth. We will try to find a
time to do that, when it is mutually convenient.
MR. SHACK: Let me ask one question.
DR. POWERS: Sure.
MR. SHACK: The high, medium, and low -- that's the judgment
of the inspector? He goes in and he says this is a high, medium, low
degradation --
DR. POWERS: Right.
MR. SHACK: It's his qualitative judgment.
DR. POWERS: Right.
MR. SHACK: And then he comes back and he plugs it in.
Okay.
MR. MADDEN: That is where we are kind of marrying the two
sciences together, looking at that qualitatively, and we are developing
a guidance document for the inspector to make those judgments. It is
the degree of conservatism you can probably argue over but it will give
us a starting point for a more detailed analysis. It will allow the
inspector or reviewed to make a judgment to either no, this isn't
safety-significant or risk-significant or potentially risk-significant,
or it is.
What it is trying to do is look at fire protection in an
integrated fashion, even though George doesn't believe we had
defense-in-depth, but that is what this process is trying to do, okay?
MR. SHACK: You say --
MR. MADDEN: All right, well, you know, you say it is a
perfect world but it is not a perfect world, George.
DR. SHACK: In the fire protection functional example --
when you went back and you screened these through, the noncompliances,
how did they bin?
MR. MADDEN: Oh, well, that is an interesting question. I
am kind of glad you brought it up.
We went back and we looked at the findings from the fire
protection functional inspection. We looked at approximately 33 percent
of the findings. When we started the process with the fire protection
functional inspection we didn't have this tool available to us, so the
inspection wasn't really governed or geared to that, but yet some of the
principles still held true.
What we did is we came back, we looked at the findings, we
binned them and we binned them based on areas that are associated with
what I want to call the top risk players -- control room, cable
spreading room, and aux feedwater pump room for example, charging pump
room for example, and we found that some of the findings would have put
you onto the borderline Red category if you were to look at them in a
integrated approach under a certain set of scenarios.
You have to develop the scenarios, and that is where there
is a new burden put on the inspector, that he has to come up with what I
want to call a scenario where you could have a fire, the trains could be
either affected by the plume or the fire could be sufficient enough or
the fuel sources could be sufficient enough to develop a high gas layer,
so if you were to get into a room, for example, that had nothing but
conduits and pumps in it, it would be hard for him to enter into this,
other than having findings, and those findings would end up being turned
over to the licensee to be put in their corrective action program to
weight against the regulation or compliance with the regulation.
So there is some what I want to call bringing the risk sense
into the inspection and forcing the inspector not to just go get a
rulebook but to think about the process and how it interacts.
DR. POWERS: Did you have any more questions on these
presentations?
Fred, did you want to say some words?
MR. EMERSON: I'd like to say a few words.
DR. POWERS: Now I have a presentation by Fred Emerson from
NEI -- I think the committee is familiar with Fred.
MR. EMERSON: I would like to thank the ACRS for the
opportunity to say a few words about industry views on fire protection,
inspection and assessment. I have four slides and I am going to go
through them fairly quickly, and I think in many respects we go along
with the Staff thinking that there are some areas that we don't, and the
areas of agreement and the areas of disagreement I think will be
apparent by the time I finish.
In summary, we believe and the Staff has indicated that
current fire protection inspection programs are to be subsumed into the
new oversight process, and we also agree with the Staff that there needs
to be a balance between NRC baseline inspections and industry
self-assessments.
In keeping with the spirit of the oversight program, both
need to be risk-informed and we also agree with the Staff that the FPFI
should be reserved for reactive inspections when poor performance has
been indicated by the licensee.
DR. POWERS: I guess you have to elaborate on the square
bullet a little bit. I seem to have read a letter that would indicate
to the contrary and maybe it's just the timing in which you want it
subsumed into the oversight process.
MR. EMERSON: I'm sorry, you said it shouldn't be?
DR. POWERS: Well, what I read was not subsumed into the
pilot.
MR. EMERSON: Oh, yes, I understand you point. The FPFIs or
whatever their successor are should be subsumed into the new oversight
process. Now we don't think the module, the inspection module that has
been generated, should be evaluated in the oversight process. I was
going to get to that in just a few minutes.
DR. POWERS: Okay.
MR. EMERSON: Steve alluded earlier to what the industry is
proposing. He talked about performance indicators and he talked about a
plant self-assessment program and we are proposing this basically as a
two-step piece as to how the industry should engage itself in this
oversight process.
In the short-term, and by short-term I mean during
approximately the next year or so, a voluntary plant self-assessment
program should be in place to address NRC concerns about
self-assessment, that they perhaps were not comprehensive enough or deep
enough on a broad enough scale to assure that the necessary findings or
the necessary depth is achieved to determine what the state of the
programs really are.
We need to establish a baseline for the long-term assessment
process, bring licensees up to a certain level to get ready for that,
and NEI is developing guidelines to maximize the cost effectiveness of
that. By that I mean rather than telling each licensee to go out and do
a full-blown FPFI type self-assessment that there are ways to approach
it to focus licensee resources in areas that really need attention
without digging into every area in a great deal of depth, and that is
the goal of our committee.
In the longer term, we need to balance licensee
self-assessment and NRC oversight. We are developing performance
indicators to do that. We propose to work with NRC to assure that there
is an adequate balance and that the appropriate level of self-assessment
and inspection is achieved without it being unnecessarily burdensome.
There was always some burden associated with it, but we want to assure
that it is not unnecessarily burdensome to the licensees or the Staff.
DR. POWERS: When you make these judgments --
MR. EMERSON: On burden?
DR. POWERS: On how much to credit the self-assessment
versus independent inspection and when not?
MR. EMERSON: I don't know that I can answer that yet. I
think we are going to have to see to what degree we can develop
performance indicators successfully.
We need to see what shape the NRC's baseline module, how
that works out, and I don't know that I can really characterize what
that balance needs to be.
I know the industry is very interested in moving it away
from total reliance on the NRC baseline inspection program as it
currently is reflected in the SECY-99-007A because we think that -- Dr.
Seale talked about accountability and the licensees need to take some
accountability for their own programs, and in some ways are the
best-qualified to assess them, but obviously you need regulatory
oversight of that process, and what the balance is I think is yet to be
determined.
DR. POWERS: I just wondered if you look at this you see
that there are certain obligations from the NRC, there are certain
obligations from the licensee. There is a certain public interest. How
does that public interest get factored in -- and fire definitely
attracts public interest.
MR. EMERSON: Yes, it does.
DR. POWERS: It attracts interest from the legislature.
MR. EMERSON: The public is definitely interested in making
sure that fires that have an effect on the public don't occur and that
you reduce the danger to the public through adequate implementation of
defense-in-depth, and the public would like to be sure that the
regulator is taking an active enough interest in nuclear fire protection
issues such that the licensees have to either through their own efforts
or the NRC's achieve those goals.
I believe some segments of the public don't have a high
degree of confidence now that that is occurring, and we want to assist
the NRC in achieving a higher degree of public confidence that it is.
DR. POWERS: I think you have answered my question. You are
aware of the issue.
MR. EMERSON: Yes.
On my last slide, to address your question about the
baseline inspection module that the staff has proposed for discussion in
the pilots, we have sent a letter to the staff with our comments, and
you probably have that letter in your documents at your disposal. The
basic premises or the basic conclusions -- our principal comments are
summarized in the four bullets. We think that the risk-information is
only selectively used in this document. The risk-information should be
applied to a broader area than just selecting the areas to be inspected,
and then doing a deterministic type inspection. That was our principal
comment there.
We believe that there is an over-emphasis on safe shutdown.
We heard Mr. Whitney indicate earlier that they felt that the triennial
inspections were necessary to look at the safe shutdown element. We
think that any inspection needs to address all of the elements of
defense-in-depth with equal emphasis.
DR. POWERS: That was more striking to me than any other
comment that was made in the letter. I mean it struck me that, gee, if
I was the NRC, that is exactly where I would put all my attention,
because I have very great confidence that the licensee has a very
deep-seated financial incentive to focus on prevention and detection
suppression of fires and whatnot. So I look at the back end of things,
a shutdown -- get this plant shut down safely in the event of a fire, if
I am regulator.
I just have great confidence that the licensee is going to
work on all the prevention and detection things. It has got an
insurance agent that wants him to do it. He has a financial incentive
to do it. Let him work that problem and probably rely heavily on his
self-assessments. I mean why isn't that good logic? What am I missing
here?
MR. EMERSON: I don't have any problems with your logic.
DR. SEALE: Dana, if I may comment.
DR. POWERS: Sure.
DR. SEALE: One comment. It is interesting logic. There is
a problem, though, and that is we want to be sure we don't throw the
baby out with the bathwater. And that is if we are going to somehow
turn this into a risk assessment, I still need quantitative methods to
handle the suppression and the front end of the problem in doing the
risk assessment.
DR. POWERS: We never get those from inspection, we get
those --
DR. SEALE: No, I agree with you. I mean you still have to
have the analysis part of the front end in order to get the risk number.
MR. EMERSON: A third of our more significant concerns with
the module is that we think that the triennial inspections are not the
best way to determine the health of the licensee program. And if you
send a team in once every three years, it would seem that it is much
better to have more focus on more routine oversight of self-assessments
and a more frequent look than just a visit once every three years to
make that assessment of the health of the program.
DR. POWERS: Whereas the previous bullet was the most
striking, this was the most intriguing. I mean there is a certain
attraction of what it says there, but it is an assertion. And I
listened to Mr. Whitney tell me, well, you can't do that. I have got to
have these specialists in here to look at things in a great deal of
detail every once in a while. Well, how do you respond to him on that?
MR. EMERSON: I wouldn't argue that --
DR. POWERS: I know what my response was.
MR. EMERSON: I wouldn't argue that reliance on specialists
-- because there needs to be some reliance on specialists who know what
they are looking for, and I would agree that in the safe shutdown area,
that might be appropriate. But there might be a way to do that on a
more routine basis in assisting the residents in interpreting what they
are seeing on a day-to-day basis at the plant than actually sending this
team in every three years.
DR. POWERS: Well, I think I got the impression that he was
going to do all those things that he could do on a routine basis, but he
could get the kind of detail that he was looking for in the triennial
from that routine basis, simply because the guy he is asking to do it
has to do a lot of other things, too. He can't take a vertical slice
down through things and factor in all the things that he has to and
still get all the other jobs he has to do done.
MR. EMERSON: If, in fact, there is to be an increased
reliance on looking at the licensee's self-assessments. The licensees I
think know how to look at their programs, and they have people at their
sites who are well versed in their own safe shutdown programs, and I
would say that an increased reliance on the licensee's ability to assess
himself in that area would alleviate a lot of that concern.
The last areas, there is a concern that trying to evaluate
this model -- it is question of timeliness. You know, there has been
some structured preparations for the oversight pilots, and to throw this
in at the last minute, now, the pilot plants I think would be very
nervous trying to accommodate this sudden influx of new information into
their program that they have carefully evaluated and prepared for. And
we don't think that the speed with which this is being done is
warranted. There are perhaps other ways that this program can be
piloted once more thought is given to what it should include and how it
should be balanced against licensee self-assessments.
DR. POWERS: Events themselves may cure this problem.
MR. EMERSON: That may be. That is all I have.
DR. POWERS: Do members have any other questions for Fred?
[No response.]
DR. POWERS: Well, Fred, thank you very much. I appreciate
your comments whenever you come. It is always useful to get your
perspective on things.
MR. EMERSON: May I say one thing? There was a discussion
before about the NEI forums and what they were intended to do. I need
to point out that the predecessor to NEI, the Edison Electric Institute
has been conducting forums long before Thermo-Lag and they continue to
do that. So the NEI forums were not -- were basically a successor to
the EEI forums, not created just exclusively to focus on Thermo-Lag, but
we continue to find them useful.
DR. POWERS: And as I do, and I would encourage members that
any time they have an opportunity to attend one of those, they are
really very, very useful to get some insights on what is hot in the
field of fire protection.
DR. SEALE: When is the next forum?
MR. EMERSON: October 18 to 20.
DR. POWERS: It is just up the road a ways.
MR. EMERSON: In St. Pete, Florida.
DR. POWERS: Down the road a ways. Okay. I am going to
recess until 12:45.
[Whereupon, at 11:48 a.m., the meeting was recessed, to
reconvene at 12:48 p.m., this same day.]. A F T E R N O O N S E S S I O N
[12:48 p.m.]
DR. POWERS: Let's come back into session.
Paul, could you -- Bonaca's in the -- okay. We'll hold for
about 2 minutes. I'll apologize for the sluggishness in the start. We
just had a valued employee who's leaving us, and so there's, it's been a
little slow to get started after lunch here, Tom.
DR. KRESS: The subject of this particular part of the
meeting is some proposed modifications to the core damage assessment
methodology and the post-accident sampling system that's required in
plants. Our severe Accident Management Subcommittee met on April 30 to
hear about proposals from the Westinghouse Owner's Group to modify the
system. The guidance for the requirements can be found in a couple of
documents -- NUREG-0737 and Reg Guide 1.97.
The general purpose of these things, which were instituted
as part of the TMI requirements were to have timely information on the
extent of core damage or release of fission products in hydrogen for
purposes of aiding decisions on emergency response and perhaps on
accident management of recovery.
The current requirements that are found in these documents
have been around for awhile, since, I think, about 1984. And they
relied primarily on sampling from the RCS and sampling from the
containment. And these samples then or others subjected to analysis,
chemical or otherwise, radiological -- to determine things like fission
product content, a very specific range of fission products;
hydrogen;dissolved gasses; boron.
The licensees have exercised these systems and tests in
emergency drills, and their experience has been that this sampling, to
determine things like fission product content, has a real delay in it.
It's hard to deal with, analyze a sample that's radioactive and stuff
like that -- you know, to take a sample and remove it and take to a lab
takes a lot of time.
It's their experience that the information that you get
these comes in, actually, too late to be of real substantial benefit in
making their emergency response decisions. So instead of making those
decisions on the basis of those samples, they've relied on what were
secondary indicators -- things like core exit thermocouples and
radiation monitors in containment, and even water level in the vessel,
to actually infer, what I would call core damage states, rather than
fission products.
Core damage states being things like clad damage or
substantial melt or onset of real hydrogen production and things like
that. So, since they couldn't use these samples very well in practice,
they've proposed modifications to the requirements that would -- it
would basically put into place the way the actually do it now.
There are, in my mind, maybe two or three issues that we
need to think about when we hear this proposal. One of these would be
-- since they're not actually looking for fission products anymore, but
rely on a calculational methodology to go from temperature readings, for
example, to information that they can use for emergency response.
One issue I would ask you to think about, is this
calculational methodology sufficiently good or sufficiently accurate.
Another one is, will the proposed modifications result in
sufficient information, even with those calculational tools on to base
emergency response decisions and recovery actions, and even worker
protection.
And, the third issue -- which may sound a little funny, but
it's one that I'd like for you to think about -- is there a better way
than either current rule or the modification to this? Is there an
option that hasn't been considered?
We do plan to have a letter on this, so I'd like for you tho
think about these things carefully and help me make up my mind on what
will be in the letter. You do have a draft that I've developed, and for
the benefit of those here that aren't familiar with the ACRS process,
generally the Subcommittee starts the process by gathering information
and is charged with developing a preliminary position. I want to
emphasize that word "preliminary" -- it's a position. It's for
consideration by the full committee.
When we arrive at these preliminary positions in the
Subcommittee, we try our best to communicate these to all stakeholder;
that's including the full committee and it's including the licensee or
the Owners Group, and it includes the staff who are a part of this, so
that they can think about what our issues are and maybe be prepared to
address them in the full Committee.
I want it known that such a preliminary position gets
debated and discussed -- I would say ad infinitum in the full Committee
meeting. And quite often, these preliminary positions get changed, and
they're going to get changed as the result of a full meeting of the
minds in their discussion. But sometimes they don't, also.
With that as an introduction, I will turn it over to, I
think, Bob Brian of Westinghouse Owners Group. He's going to start us
out.
MR. BRYAN: Good afternoon, Mr. Chairman, members of the
committee. My name is Bob Bryan, I am from TVA, and I am representing
the Westinghouse Owners Group as we discuss our proposals on core damage
assessment methodology and post-accident sampling system.
There were a couple of key points that I felt like it was
important to make up front, and one is that the methods that we have
right now are ones that were developed shortly after TMI, and there has
been a lot of research, and lot of work, and a lot of discussions about
what happened in TMI, and we have a better knowledge today of how severe
accidents progress and what kind of information is available, and our
new methodology takes advantage of that. And we feel like that it is
important to update our methodology to today's standard. There are
things in the current methodology that are basically not correct
phenomenologically.
Second, the revised methodology meets all the regulatory
requirements, and by that I mean the specific requirements in 10 CFR.
As a consequence of these changes, there will be no request for
exemptions, there will be no request for rule changes. We will have to
revise licensee commitments related to guidance documents, i.e., NUREG
0737 and Reg. Guide 1.97.
Most importantly, we think that what we are proposing better
supports our post-accident needs. We have been doing a lot of severe
accident training, we do drills regularly, and I think we have a better
understanding today of what our needs are and what the timing for those
needs are as compared to what we had when the methodologies were
originally developed.
And last, the method we are proposing is accurate for making
the kinds of decisions that we need to make. We need basically order of
magnitude kind of projections of where the plan is with respect to core
damage. It is not critical for us to know whether it is 37 percent of
the fuel is melted or 47 percent of the fuel is melted. We need to know
in broad senses where the plant is. And so our proposed methodology has
that accuracy built into it.
DR. WALLIS: Have you actually formally written down or
analyzed just what it is you do need?
MR. BRYAN: Yes.
DR. WALLIS: So you can compare this formally with what you
are going to get?
MR. BRYAN: Yes. And I think I will address that in a
minute.
Our outcomes, I just wanted to show you that what we propose
provides the protection of the plant and the public that we would like
to have. We also hope to show that what we are proposing does meet the
needs for looking at emergency based decisions. And in terms of the
future things we need to do, we still have a couple of issues that are
open between the Owners Group and the staff to be resolved.
I wanted to try to give you some flavor of how the core
damage methodology and PASS enters into our emergency planning
processes. If you have an event, there are a couple of things that
happen. As you are trying to decide emergency action levels, i.e.,
whether you are in an unusual event, a site emergency or a general
emergency? These things are made based on indications directly from the
plant.
They are made off of the status of systems. Are your ECCS
pumps running? There are direct requirements out of our emergency
operating procedures that say if core exit thermocouples are at certain
levels, that is an indication of the status of plant systems. They are
made off of high radiation monitors. If you are above a certain level
on the containment radiation monitors. If you are above a certain level
on the containment radiation monitors, you enter particular steps in the
emergency action levels.
The core damage assessment feeds somewhat indirectly this
process. There is not a direct feed from the core damage methodology
into any specific emergency action level. What it does feed is a
general knowledge for the emergency director and that team to help make
decisions relative to emergency action levels that he may want to take
based on his judgment of where he thinks the accident may be going, as
opposed to specific things that are going on right at that minute.
DR. WALLIS: Can I ask about CDA? Is that something that
someone has to sit down and compute or is there some algorithm which
takes these instrument indication and gives a direct printout or some
picture of the status of the core?
MR. BRYAN: Okay. Okay. This is basically an action that
is done offline. It could be done in the Technical Support Center or,
in the case of my utility, it is done in a Central Emergency Center. We
do have a computer program that is in there that we feed information
from the plants into that we do routine updates to. We also have
basically a set of hand charts that we can work our way through in case
the computers weren't available or something like that. But this is a
pretty simplistic look at things, and I will talk about that a little
more in just a minute. But it basically says you are at one of three
pretty high level points in terms of where the plant is.
Similarly, in terms of protective action recommendations,
those things, once again, are made principally off things that are
actually happening. What is the status of the plant as determined back
here through your EOPs or direct instrumentation readings, through
measurements of off-site dose by your field teams, or by measured
releases?
You can, also, if you are looking at projecting protective
action recommendations, the core damage assessment may be used as a
feeder into off-site dose projections to help in making these, but the
protective action recommendations generally, you try to make those off
of measured data, not sampling, but actual releases that are out there,
or a specific plant state.
These things are all pretty short-term activities. We see
these in terms of minutes and hours, and in the middle of an event,
things are happening pretty fast. Where we see a real need for PASS is
in terms of longer-term recovery strategies, and in these things you
will have many hours or perhaps days to sit down and make decisions
about what actually happened, where the plant really is, and what are
the best ways to set up a long-term recovery plan.
The core damage methodology is basically a way for us to simplistically
quantify the state of the plant, and we basically look at it for three
things. Is our clad intact? Are we in a situation where we might have
clad rupture? And in this case you'd be getting your noble gases and
some volatiles out. And then finally, is the fuel in an overheated
state where you would be getting a lot of nonvolatiles out. And as I
talked about before, we use this as providing guidance to the emergency
team to help them in making decisions.
DR. WALLIS: This fuel temperature isn't directly measured.
It's measured by something else. You don't actually measure the
temperature of the fuel.
MR. BRYAN: That's correct. That is correct.
DR. WALLIS: It doesn't just look for those states. Doesn't
it look for how much damage is done?
MR. BRYAN: No, sir.
DR. WALLIS: It says yes or no, there is a rupture?
MR. BRYAN: That's correct.
DR. WALLIS: So there must be some level of sensitivity
where it decides rupture or no rupture then. That's all been worked out
presumably.
MR. BRYAN: Yes. I mean basically what we look for is if
the core exit thermocouples are under about 750 degrees and we don't
have -- and our high-radiation monitors are at fairly low levels
basically consistent with what you would have for normal coolant
activity, we say the clad's intact. If the core exit thermocouples are
in the 1,200-degree range and you're seeing elevated levels in the --
elevated levels of radiation in the containment, we make an assumption
for the core damage assessment that you're in a clad-rupture scenario.
If you see very high temperatures on the core exit thermocouples or you
see very, very high levels on your containment high-radiation monitors,
you make an assumption that you had fuel overheating and basically the
whole source term's available in some form that you have to deal with as
released under the RCS and potentially into the containment.
DR. WALLIS: The core exit thermocouple's a pretty indirect
measure. I mean, it depends on the flow rates of the steam and how much
is uncovered and all sorts of things. It's not a direct measurement of
what you want to find out.
MR. BRYAN: That's true, but you can make broad assumptions
about and conservative assumptions about where you are. I think we
picked end points for these things that if you make decisions off of
them, they are acceptable for making prudent decisions relative to the
state of the core, and once again keep in mind, to step back to the
emergency action levels, if I have an indication that I have as an
example 1,200 degrees on the core exit thermocouples, I assume that I
have essentially failed my ECCS systems. That requires me by my EALs,
independent of whatever I think the core damage may be, to take certain
steps relative to declaring either a site or a general emergency.
So while you may say the things are indirect, they are the
ones that we use independent of the core damage methodology for making
the key decisions about how we manage the accident and how we ultimately
decide on protective action recommendations.
DR. SHACK: I thought in the report you were making
estimates of the amount of core damage simply by how many thermocouples
were showing high temperatures.
MR. BRYAN: You can, but what we really care about, though,
is really just broad --
DR. SHACK: A go, no go.
MR. BRYAN: A broad sweep on the thing.
When we went back --
DR. WALLIS: I guess that's what we're going to have to be
satisfied with, that the broad sweep gives you enough information, that
maybe it needs to be less broad.
MR. BRYAN: Well, first, we felt like if we were going back
and looking at this thing, we felt we needed to revise it, what were
things that we wanted to make sure that we dealt with. Number 1 is the
timeliness issue. Even with online sampling, there are time delays that
are built into that. You have to send people down there. They have to
purge lines. They have to take samples. They have to analyze them in
the sample facility. And those things lag what's going on in the plant,
particularly if you have a transient that's moving with any speed at
all. Your core exit thermocouples, your online equipment, responds much
more quickly to that.
DR. WALLIS: I was very surprised about that. I mean surely
there's sophisticated instrumentation which is almost immediate, which
will tell you -- give you indications of what you're looking for. You
don't have to use some antique chemical sampling method.
MR. BRYAN: You may be able to go in and put in a plant new
instrumentation that nobody has right now that does much of this thing,
but the issue is, you know, one is we have to deal with what's in our
plants today and decide if that's appropriate. Number 2 is keep in mind
that the equipment that we have in now is believed to be and we
certainly believe it to be consistent with every regulatory requirement
that's out there and so from that standpoint was adequate. What we feel
like is what we're proposing here provides a scheme that provides better
information, more timely information, than what we have currently, and
so the net effect is an improvement in the way we deal with the
situation.
We talked about accuracy. It needs to be representative of
actual plant conditions, but the question is, you know, what's the
degree of precision we need to know it. And the answer is for making
decisions about -- we make our protective action decisions at fairly
high levels, so we don't need a great deal of precision in our numbers.
So the fact that I know precisely how much iodine or any fission product
is in a sample stream is really immaterial to our decision making
process.
We're going to make conservative decisions relative to what
the potential releases or actual releases are based on broad-sweep
things. If we think we have early indications of potential core damage,
we're going to do the evacuations that are consistent with that that are
conservative with respect to that. And so we try to keep the plant
looking ahead from a safe standpoint. Sometime later we can come back
and take samples and send them off to a laboratory, and we'll talk about
this and get a very detailed picture of what's transpired. But for
making our decisions in the minutes and hours after an event, we don't
need that degree of precision.
In terms of the availability of information, we feel like
the in-plant information -- the in-plant instrumentation provides that
information in a much more timely manner, and it's more effective in our
overall emergency planning because, as I said, you have to tie up
personnel to take samples, and if you're really in a severe accident,
any trip into the auxiliary building represents a radiation hazard to
the people that are doing it. And we feel like those operators are more
valuable to us to be able to be available to do recovery actions that we
may need to mitigate the event than taking samples for us. And we may
have to take, if we didn't have in-plant instrumentation, we would be
having to take those at fairly frequent intervals.
From our standpoint in terms of the way people actually do
this, the decisions right now are largely made on in-plant
instrumentation. We use sampling only as basically a means of last
resort. We have the capability, but largely because of these
considerations, this last consideration, that's not something we like to
do if we feel like the other information is adequate.
DR. WALLIS: Now at TMI there was lots of information which
was misunderstood, so confirmation of information is sometimes useful.
MR. BRYAN: That's true, and I think there are a couple of
things though relative to TMI. One is that was a huge lesson learned,
and I think we never need to lose that attitude of questioning that
should have developed after TMI. But we have put in a lot of things
specifically to look -- to fill information voids that we found existed
in TMI -- core exit thermocouples are a prime example of that. We've
gone to a whole different set of procedures now in terms of being
symptom-based as opposed to saying yes, this is my event, I'm going to
go down this path. There are a lot more places in the process that
bring you back to questions am I doing the right things, am I getting
the right information. And so I think we feel like overall we've
covered a lot of those voids that didn't exist prior to TMI. That's not
to say that when the next event happens, we're going to know it all.
The next couple of slide I am going to put up basically are
for information and I don't intend to go through point by point, but
this is basically a comparison of the existing core damage assessment
methodology with our new methodology.
It obviously uses in-plant instrumentation and we have tried
to account for physical processes that were not in the original core
damage assessment methodology.
DR. KRESS: Let me ask you about that, Bob.
MR. BRYAN: Okay.
DR. KRESS: Number one, you just said you really didn't need
fission products for your core damage assessment.
MR. BRYAN: Specific.
DR. KRESS: But you would get them anyway, you say, for some
reason or other.
MR. BRYAN: Okay.
DR. KRESS: You are going to project those based on the
calculation I presume using MAAP.
MR. BRYAN: We do a couple of things.
Relative to fission product deposition we have looked at
NUREG-1465, we have looked at MAAP, we have looked at -- there have been
comparisons with MELCOR work that that give us some feel for how things,
where things may be.
DR. KRESS: So these would be sort of general for low
pressure accidents and high pressure accidents or ATWS events --
MR. BRYAN: That's right.
DR. KRESS: You would have some indication of the effect of
the temperature transient on fission product release based on all this
knowledge and some guidance on how much it has held up in the RCS and
how much gets released, and then what happens if you have a containment
spray zone in accounting for what happens in containment.
MR. BRYAN: Yes, that's the idea. Just to use some
examples, if we have low RCS pressure we will assume we have a large
release in progress and the assumption for the core damage assessment
methodology is the fission product release would be anywhere from 50
percent to essentially 98 percent, very broad band.
For small accidents or small break accidents where the RCS
is at high pressure, we have a different set of criteria that cover a
band going from 2 percent to 50 percent, and basically what we do is
these bands are broad enough that even if I miss it, if the actual
release was 10 percent or 25 percent, it is not going to make any
difference in terms of the kind of information I am giving people and
saying it is basically we have a high pressure event, we have got a fair
amount of holdup in the RCS, and here's what we would project to be
going on in terms of release.
If you had a small event that actually had more than 50
percent, you are going to take actions as if all of this stuff was out
in the containment, which is still a conservative action relative to
making protective action recommendations.
DR. KRESS: I am not quite sure I understand that. You have
something, an event, going on and you want to tell your people down in
the emergency room we have got this event going on and in the next 10-15
minutes or so you could expect to see either somewhere between 2 percent
and 50 percent of the fission products in containment? I am not quite
sure what you are telling them.
MR. BRYAN: Okay. What we would do is what we would tell
them is that we had a -- if we were getting between 2 and 50 percent,
what we would tell them is we have had cladding rupture. It looks like
we have a small break in the RCS, and we would provide some information
to the offsite dose team where they could calculate, if you wanted to
postulate a containment release or if you had one in progress you could
make a projection about what might be going on.
At that point they would basically assume that they had clad
rupture. There is an event tree, but let's assume that we are not in an
overheat situation. We just had clad rupture. They would make some
assumptions relative to what the fission product mix in containment is,
and they are going to tend to err somewhat on the high side of that
relative to deciding what is the potential release offsite.
DR. KRESS: Might someone decide to evacuate on the basis of
this information, or do they decide to evacuate on the basis of some
other?
MR. BRYAN: Well, most of the time it is decided on other
factors. The Emergency Director always has the authority to declare
essentially a general emergency or a protective action that is greater
than that, make that recommendation to the state.
DR. KRESS: This is based on this information and other
information?
MR. BARTON: Do you have a PAR diagram or something with you
that could explain this to Dr. Kress, a logic diagram, fault tree you go
through with all the inputs that you use to make your protective action
recommendations?
MR. BRYAN: I don't have a slide like that.
DR. KRESS: That's all right. I have seen those. I am
familiar with it.
MR. BRYAN: To go back to this one, this is independent of
this block. The decisions are largely made off of specific set points
and instrument readings, equipment status or the Site Emergency
Director's judgment.
DR. KRESS: These are in the emergency operating procedures?
MR. BRYAN: Either in the emergency operating procedures or
in the emergency plan procedures.
DR. WALLIS: Well, I guess it goes back to that question I
asked some time ago, and I knew exactly what you need to know at this
EAL stage in order to make a decision, then we could perhaps tell
whether your proposal meets those requirements or not.
You are sort of doing it from the other end. You are saying
I can measure all these things but I still don't quite know what you are
going to do with it.
MR. BRYAN: But what I am saying is I basically do not use
this --
DR. WALLIS: But at the EAL stage somebody there needs
information. What does that person need? How are you going to give it
to him? That is all I am asking.
MR. BRYAN: Okay --
DR. WALLIS: Will you be able to answer all the questions
these folks have by your instrument?
MR. BARTON: He will be able to answer enough to be able to
make a conservative --
DR. WALLIS: I don't know yet because no one has told me
what those questions are.
MR. BRYAN: The questions I have -- I can enter this from a
lot of ways, but when I get far enough into the event I basically get
down to what is the status of my three fission product barriers.
DR. WALLIS: I don't need --
MR. BRYAN: And --
DR. WALLIS: I just need to know that you have gone through
this process.
I don't need all the details, but if you haven't, then I
can't evaluate it.
MR. BRYAN: And these I think both we, the NRC, and state
emergency people all believe that there's sufficient information in our
plans to make these decisions independent of this.
MR. BARTON: Graham, there is a table in the emergency
procedures that gives you certain symptoms in the plant which will get
you into this EAL listing and be able to -- you will be able to classify
what level emergency you are at based on the symptoms, and you get those
from the instrumentation and plant indications.
There are procedures in place and there are methods
available to get the information, to get you the EAL box without --
MR. BRYAN: That's right.
DR. WALLIS: Essentially what do you have to show, and you
think you have shown in presumably, and the Staff -- I don't know what
they think -- what you are proposing will give the information. That is
all you have to show.
DR. KRESS: And they are not proposing anything that affects
that top line --
MR. BRYAN: That's right, we are not changing the top line
at all.
DR. KRESS: The top line is fixed --
DR. WALLIS: Well, then I am unaware.
DR. KRESS: -- and it is not being changed. It just these
three areas down below --
DR. WALLIS: So it is the other line. My questions apply to
that.
DR. KRESS: And what he is saying is that the top line is
basically independent of these three others.
DR. WALLIS: Okay, I'm sorry. I was confused.
Anyway, the questions still apply but to the other line.
DR. KRESS: Yes, it applies, but that is another issue.
That is another question.
MR. BRYAN: This goes over, just very quickly, what our
existing methodology -- how it looked at things, what was and wasn't
considered and how they were considered, and what we are proposing in
our new methodology. Basically all we are saying is there were a lot of
things that weren't considered basically because we didn't know about
them and they weren't well understood, and the new methodology is an
attempt to take advantage of that, so we get a better look at it than we
had before.
DR. POWERS: Bob, one of the things I didn't understand --
there are quite a few things I don't understand, but one of them is what
you meant by a bounding aerosol model. Is that one that overpredicts
aerosol deposition or underpredicts aerosol deposition?
MR. BRYAN: Well, our intent in this is to underpredict what
the retention in the RCS would be, i.e., that there would be more
released --
MR. LUTZ: Opposite.
MR. BRYAN: We want to overpredict what is --
MR. LUTZ: Yes.
MR. BRYAN: -- in the RCS?
MR. LUTZ: Yes.
MR. BRYAN: Okay.
MR. LUTZ: Underpredict release to containment.
DR. POWERS: It seems to me to be the way and it is just how
you pick it, and so you did go with the bound such that you underpredict
the amount that would excite the instrumentation?
MR. BRYAN: That's correct -- from his standpoint. That's
right. What we did was we looked at it so that we assumed it was held
up, it would be in there so that a smaller number in containment would
drive us to a higher assumption on what the actual state of damage was.
DR. POWERS: You know, who came along and said okay, I have
looked at these aerosol physics models and by doing something I made
that bounding?
MR. BRYAN: Bob?
MR. LUTZ: This is Bob Lutz from Westinghouse. What we did
is we looked at a lot of analyses with the MAAP code, the MELCOR code,
and also looked --
DR. POWERS: Let me cut to the chase and ask you which one
of those models that you looked at considered the Coulombic interaction
between aerosol particles due to charging by radioactivity?
MR. ROSENTHAL: None of them. We also looked at the
research that currently is coming out of Europe from the FEBIS
experiments and others in Europe and concluded -- and when we look at
everything in total we believe that the predictions of the MAAP code
tend to predict more retention in the primary coolant system, in the
reactor coolant system, and less airborne radioactivity in the
containment.
Now the reason we did this is because we are basing in part
our estimate of core damage on the containment high area radiation
monitor, so if we set as our standard for coming up with core damage
estimate a low level of radioactivity in the containment, in an actual
event if there is less deposition in the reactor coolant system, less
deposition in the containment, then we tend to overpredict the amount of
core damage using this methodology, which is on I believe the safe side
rather than underpredicting.
DR. POWERS: I guess that is my question. What you want to
do is exactly what you tried to do. That is, I have got a signal in my
containment indicating the amount of radioactivity or something that I
have and I don't want to underestimate the amount of core damage that I
have based on that, and we use an aerosol model.
Okay. Those aerosol models have been based on aerosols that
are not radioactive, but aerosols are radioactive in this case and when
they are radioactive have a Coulombic interaction.
And I personally don't know what that makes them do, whether that makes
them deposit more or deposit less, so how do I know that I'm bounding
for the real case?
MR. LUTZ: Well, what we're saying is based on what we
understand today, what the current knowledge is, we're making our best
estimate at things. We know the existing core damage assessment out
there is not accurate because it doesn't consider anything, so we're
trying to develop the best tool that we know how today.
Now, even if you go to samples of containment atmosphere
rather than relying on the containment monitor, you still have to go
through this process of what does containment radiation represent in
terms of the core. So this is not unique to the proposal necessarily to
use fixed in-plant instrumentation; it's a generic problem that we have
if we're going to use any radioactivity measurements to make an estimate
of core damage.
So how do we infer core damage, whether it's -- whatever
process we use, it is an inference of core damage and not a direct
measurement.
DR. KRESS: How does that next line, the revaporization in
the RCS, fit into that bounding logic? Because that removes other
things. I mean, that takes things back into containment, it takes you
the other way.
MR. LUTZ: That's correct, and we've looked at it in I'll
say two ways. One is what we're trying to do with core damage
assessment is within the first minutes or hours, to try to follow what's
going on in the core so that it can be part of the information that the
TSC has. And in that time frame, based on what we know about aerosol
physics and what's happening, the revaporization does not drive what's
in containment.
Now, to account for things that go on during the event, we
base the estimate on the current RCS pressure. So in other words, if
you're going along for an hour and then suddenly open -- intentionally
open the PORVs, we say you're going to dump a lot of that out because of
revaporization, you're going to dump a lot of what was retained in the
RCS at that time, you're going to dump it to containment. So the
methodology does consider it from that standpoint.
DR. WALLIS: I would think you would want to know
independently the core damage and how much is in the containment, rather
than trying to infer one from the -- they're independent variables. You
can get more -- you know, lots of core damage with less in the
containment understand certain circumstances.
MR. LUTZ: Yes. And to understand, instead of the old
methodology where we based it on samples of radioactivity, we are now
using three indicators --
MR. BRYAN: Let me see if I can bring this back for just a
minute.
One thing to not lose sight of in here is that what we're
talking about is what we deal with in one feet of the decision process.
You know, we're not -- we're really not -- in our minds, we're not
taking away information that we were using to make these decisions with
anyway. The main line of how we decided what actions we were going to
take and what protective actions we were going to take were done sort of
independent of this model. This was a second order feed into that
decision process. So we think getting that better provides -- helps our
process, but I don't think it really changes what the know or don't know
as we progress through this per se.
DR. FONTANA: Isn't the decision you're going to make
whether to implement evacuation, for example. Okay. Now, in that case,
aren't you really just interested in what the activity that would be
released to the environment is, and you don't care too much about how
much core damage you've got unless an estimate of how much core damage
you've got goes into some predictive model that will tell you at some
time in the future, some bad thing is going to happen. Now, which one
of those?
MR. BRYAN: Well, okay, we do -- the short answer is sort of
both. I mean, what we do is, when you get to the point that you decide
that you have either lost or you're coming close to losing all three
fission product barriers, you take an immediate protective action right
then.
DR. FONTANA: Okay.
MR. BRYAN: Okay. And then you take additional protective
actions, preferably on actual readings of what is happening either out
in the field or at the plant from a radiation standpoint. You're
reading what's being released or what you're measuring by your field
team.
DR. FONTANA: Okay. If you're doing that, then why do you
care what the extent of core damage is, because you already have a
measurement?
MR. BRYAN: We don't. And in those cases, we don't at all
in terms of deciding protective actions. None at all.
DR. FONTANA: I see.
MR. BRYAN: Now, what we also do, though, is we do use this
process to help feed a predictive thing.
DR. FONTANA: Okay.
MR. BRYAN: We sit there and say, well, gee, the emergency
director might ask you, well, if I were to -- if I'm down on one train
of RHR and my electric grid, you know, my buses right then seem real
shaky, you may say, well, tell me what happens if I'm going to lose RHR
in the next ten minutes. And so you would make an assessment of, you
know, when you think the core might overheat and then what a release
would be, and he may make some -- he may make a recommendation to the
state that says, gee, I think it would be a good idea to do this at this
point.
So you can use it for projections, and we do use it for
projections.
DR. FONTANA: Okay. Thanks.
MR. BRYAN: We feel like that our new methodology makes a
fairly direct indication of the level of core damage in the sense that
it's consistent with the same decisions that our operators are making
and other people in the emergency planning group are making relative to
the indications they use for making their actions. It's done primarily
on core exit thermocouples in combination with radiation levels. But we
have other instrumentation -- hydrogen, source monitors, water level --
that can be used to help validate these things, and those are all built
into the methodology.
Once again, we think compared to what we have out there
right now, that this is an improvement. It is more reflective of the
actual situation than what we currently have.
DR. WALLIS: Is it not possible to have core damage without
radiation going into the containment?
MR. BRYAN: It may be. It's --
MR. BARTON: It is if your RCS is --
MR. BRYAN: Is completely intact.
DR. WALLIS: That's right. That's right.
MR. BRYAN: But --
DR. WALLIS: So you're using some very indirect measurement
--
MR. BRYAN: But core exit thermocouple --
DR. WALLIS: Yes, that's more direct perhaps, but then
you've got to have models to figure out what they mean. Thermocouple
doesn't tell you you've actually got damage. You have to --
MR. BRYAN: That's true. We infer levels of damage from the
thermocouples. That's --
DR. WALLIS: Really, you want to measure radiation in the
RCS.
MR. BRYAN: That's a very difficult thing to do on line.
MR. BARTON: You'll see it in your containment area
radiation monitor.
DR. WALLIS: If it gets out.
MR. BARTON: No, you'll see it if it's in the RCS. MR.
BRYAN: I mean, that's --
DR. POWERS: Yes, you would. You would. You've got core
damage, it's in the -- it's going to get in the RCS. You're going to
see it in the containment radiation monitor guaranteed.
MR. BARTON: Yes. You definitely would.
DR. POWERS: It would be pretty low, but -- but the fact is
the RCSes aren't tight, and the noble gases are going to get you no
matter what you do.
MR. BARTON: So then you worry about potential containment
failure, imminent containment failure, as part of your decisionmaking.
DR. WALLIS: So you're saying that because the RCS is never
really tight, you're always going to get something out?
MR. BARTON: Well, you've got packing, you've got mechanical
seals, you've got all that kind of stuff, and you're going to have some
leakage, small as it may be, but you're still going to get --
DR. WALLIS: It may be minimal.
MR. BARTON: Yes, but you're still going to get fission
product in containment. You're going to get stuff in containment,
guaranteed.
DR. WALLIS: Well, then you have to discuss sensitivity and
so on, it's diluted in the containment. I guess you're assuring me it's
all right. I'm just skeptical.
DR. POWERS: The other thing to recognize is that the -- at
least the plants that I'm familiar with, is the radiation monitors are
set to detect things that are pretty small, and then they -- when you
get this amount in there, they go crazy.
MR. BARTON: You'll see it in the monitor.
DR. POWERS: I mean, there's no such thing as ten times
crazy. It's just --
MR. BARTON: That's right.
MR. HARRISON: I'm sorry. I just wanted to also note that
you will get --
DR. POWERS: Please identify yourself.
MR. HARRISON: I'm sorry. I'm Wayne Harrison from South
Texas Project and the Licensing Subcommittee chairman.
I just wanted to comment, you would also get indications in
your fuel monitor and in your chemical and volume control system. So
you would know if you had some sort of fuel failure during -- without
escaping the containment.
DR. POWERS: I will hasten to also note that everything that
was on the previous slide was also available at TMI, and not only at the
time, but for months afterwards, they denied that there was fuel damage,
okay? But I think his last point --
DR. WALLIS: So you're assuming we know more now. You're
telling us that won't happen again.
DR. POWERS: Yes. That's the -- I mean, that's the
assurance, is that we know more now.
DR. MILLER: They didn't understand what they were seeing.
DR. POWERS: No. I mean, they had radiation monitors that
pegged on them, they had core exit thermocouples that fried on them,
they -- every single thing he mentioned up there -- hydrogen indications
-- they were all available, and on top of that, we were getting, about
every four hours, some samples coming out that were hotter than a
pistol, and still people said there could not possibly be any fuel
melting in the system. And that persisted clear up to the time that
they opened up the RCS. But maybe we're smarter now.
MR. BRYAN: Maybe. We hope.
In conclusion, we believe that our proposal gives us more
accurate and more timely information, and by more accurate, I mean it is
more reflective of the condition that exists at the time we need the
information than we get out of a sampling system. We believe that this
offers many advantages with respect to the availability of our
personnel. It reduces exposures that they have and frees them up to do
what we believe are more critical activities relative to accident
mitigation.
MR. BRYAN: and overall, since we are looking at it, we
believe more realistically, than we do with the existing methodology,
the effectiveness of our emergency planning is improved. Also, having
people available to do critical actions makes your emergency planning
more effective.
DR. APOSTOLAKIS: I'm curious. How many people get involved in all this
-- collecting information, transmitting information, making decisions?
Where are these people?
MR. BRYAN: Well, there are quite a few. There's -- you
have your technical support center that is located at the site, in close
proximity to the control room, that has a specific staffing requirement
for it. I would guess that there are approximately 30 to 50 people in
there for TBA.
In addition, any time we get to the alert level, we staff our central
office emergency center, which has another roughly 50 to 60 people in it
--
DR. APOSTOLAKIS: And what is this?
MR. BRYAN: Well, for us, it's in Chattanooga. It's a
central site. And it's activated -- if we get into an emergency
exercise -- at any site. Okay. When we declare an emergency at any
site, that center is also staffed. And just like the TSC, it has
procedures, it has a staffing hierarchy, and there's, there is a --
people are basically on call all the time to staff that, 24 hours a day.
DR. KRESS: George, was your question aimed at how many people were
involved in the sampling?
DR. APOSTOLAKIS: The overall process of collecting the information and
making decisions regarding, you know, this is what's happening?
DR. KRESS: Okay, then --
DR. APOSTOLAKIS: Who are these people and where are they? In other
words --
DR. KRESS: But that won't change by this modification. The only thing
that'll change is the one involved in the paths.
DR. APOSTOLAKIS: Well -- say that again.
DR. KRESS: The only thing that will change with this modification is
the ones that are involved in the sampling process.
DR. APOSTOLAKIS: I understand that, but I was -- yes, go ahead.
MR. BRYAN: Well, in terms of people, there are probably,
roughly, about 10 to 20 that would be directly involved in using the
information from the kinds of things that we're talking about, and
feeding information directly to the site director.
DR. APOSTOLAKIS: Who is the ultimate decision-making, maker here?
MR. BRYAN: Well, I'm gonna give you two answers. In terms
of the plant, it's the site emergency director; he's the one that's in
charge of it. He can only make a recommendation, though. The state is
the one -- he makes decisions relative to protective action levels. The
state makes the ultimate decision in what action they're going to take
relative to protecting the public. We can make a recommendation to
evacuate; the state has to actually issue the order and concur.
DR. APOSTOLAKIS: And with respect to core damage assessment, and all
the other decisions that need to be made, somebody has done an analysis
to understand what possible failures of communication there might be, or
mis-coordination and all that? In other words, are we focusing too much
on the technical aspects here, and forgetting again the human?
MR. BRYAN: In this particular instance, we --
DR. APOSTOLAKIS: I know -- that's out of the scope.
DR. KRESS: Yes.
DR. APOSTOLAKIS: I mean, I'm just curious. Have people done this?
DR. KRESS: Well, we have, yes.
MR. BRYAN: Yes, we have.
DR. KRESS: Yes, we spend a lot --
MR. BRYAN: Five times a year by most sites --
DR. APOSTOLAKIS: Have done what?
MR. BRYAN: Go through this whole scenario --
DR. KRESS: That's a lot of, that's a lot of
MR. BRYAN: They --
DR. KRESS: That's a lot of what the emergency drills --
MR. BRYAN: That's exactly what they are, and it exercises
our interfaces with the state, our interfaces with the NRC.
DR. APOSTOLAKIS: That's not quite an analysis; it's a drill. You see
the difference.
MR. BRYAN: No, but inside those drills, the core damage
assessment teams are exercised. The those teams are exercised.
DR. POWERS: Explain to me, isn't it better to do a drill than an
analysis?
DR. APOSTOLAKIS: Oh, yeah, but.
DR. POWERS: I'm confused.
DR. APOSTOLAKIS: Well, there may be some rare occurrence that you don't
catch with a drill.
DR. WALLIS: Well, this is a different part of the whole picture. I
mean, you're proposing to give different signals then you did in the
past, and it's important to know if you'll respond properly,.
MR. BRYAN: I don't think so.
DR. WALLIS: No?
MR. BRYAN: No. You give the same signal. Not to put this
-- let's not get this out of perspective. All I think we're hearing
here is, instead of -- as soon as I get some symptoms that I've got
something going wrong, I may have some fuel damage, or whatever, instead
of running down to the PASS sample room and grabbing a sample and
analyzing that and using that to make a decision, where I've seen enough
stuff going on in the plant, I know I'm in a general emergency, now I've
got 15 minutes, by the regulations, to make a recommendation to the
state. Meantime, there's some poor chemist trying to get a sample and
analyze it.
I can't use that data because it's not timely. So, instead of relying
on that, which -- the regulations now say you should get a PASS sample.
Instead of relying on it as part of the decision process, use the PASS
information for stuff after the initial emergency, use it for recovery
-- that's all that's being proposed here.
DR. WALLIS: You're being very helpful. I mean, you're telling me what
I've been asking all along. What does the person who has to make the
decision --
MR. BRYAN: No -- I've been that person. I have never made
a recommendation to the state on a PASS sample.
DR. WALLIS: I think that's the key thing, is whether this person is
satisfied with this information. That's the key thing.
DR. POWERS: John, let me ask you the ground rules. There is no
chemical analysis that I've seen mentioned that can't be done in an
extremely fast manner, if you were to use what's available now in the
market place. And I presume that means that there is -- is there a
ground rule that says, we can only use the technology that we have now
available at the plants?
MR. BRYAN: No. I guess we can spend more money and really
put the latest technology in and all that stuff. The question is, do
you really need to do that to be able to make these decisions? That's
the real issue. Or, use the existing technology and take that
information and use it where it best can be used in this overall process
of assessing the damage and recovery -- they're not giving everything
up. they're still saying they would take certain samples within a
certain amount of time, which is appropriate. But, to take the sample
and analyze all the things that was originally intended in the design of
the PASS system and use that for decision making, I don't think is
necessary, or is it timely.
DR. KRESS: Let me ask a little more about that, John.
Suppose you decided you don't really need all that stuff, because
apparently you don't. It's in the original. But it would be maybe very
useful if you had a direct monitor that just give you the gamma for
krypton and the gamma for cesium. You could infer an awful lot from
those two measurements alone, along with your total radiation. That
doesn't require you to take a sample and go analyze it by the chemical
processes.
That doesn't sound like too big a deal to me. What would be wrong with
something like that, as a replacement for a chemical analysis?
MR. BRYAN: It's another system; it's another modification;
it's something else that I have to add to the plant. And, do I really
-- is it going to affect the decision that I make?
I'm not so sure it will because I still have other indicators that are
going to tell me what is the state of my core, and it's going to tell me
what's the potential for losing other systems, what's the potential for
losing containment, what kind of release do I have? I don't think I
need that information to do that. It'd be nice to have, but it's not --
DR. KRESS: Well, it's information that --
MR. BRYAN: Pardon?
DR. KRESS: It's information that would allow you to not have to rely on
these bounding calculations for aerosol deposition in the RCS and
containment. It would give you the information directly; you wouldn't
have to rely on it.
MR. BRYAN: We did do a little looking into this to see what
people had. Very few plants have that. There are a couple of plants
that, that do have such monitors. It turns out that they're not
particularly simple.
You have to dilute the samples considerably because the meters saturate,
the detectors saturate. So, you're into dilution.
The other thing is, they're pretty exotic. They require a liquid
nitrogen cooling system on them. So, in terms of something that you're
going to put into a plant, they're a pretty complicated thing that would
require a lot of maintenance and upkeep.
DR. MILLER: Just to see -- what'd you say? Cesium --
DR. KRESS: Krypton.
MR. BRYAN: Cesium and krypton.
DR. MILLER: I think it would be pretty simple system.
MR. BRYAN: And a couple plants --
DR. KRESS: No, you don't have to have --
DR. KRESS: It's for cesium and krypton.
DR. MILLER: You don't need all that stuff. Get a teleron
detector and that's be it.
MR. BRYAN: Well, a couple of plants have had them and these
are the systems that they have to do that, and they're --
DR. MILLER: That's because they're using uranium, and you
don't need it for just seeing two isotopes.
I had a question on -- you chose not to use your exit core nuclear
instrumentation.
MR. BRYAN: It's used as a verification. It's not -- it's
not used as a part of the quantitative, to actually do quantification of
where you are, but it is used to help you verify where you are.
DR. MILLER: It seems to me that it's used -- you said
didn't use it, partly, because you had to go into the instrument panel
to read it out.
MR. BRYAN: Some of them may, but it's a -- I know, at least
at our plant, we do look at exit cores.
DR. MILLER: Because it would give you added information
over and above the thermal core thermocouple.
MR. BRYAN: But it's not part of the formal methodology.
It's the verification of where you are, as opposed to one of the trees
that we go through to say, this is the state you're at.
DR. MILLER: Is there a reason you've chosen not to use it
as part of that, or you just didn't think you'd needed it?
MR. BRYAN: We felt like the others were easier to get and
more direct.
DR. POWERS: It seems to me I've seen work in Germany, where they used
that exit core instrumentation to get -- and they built a little box,
and it really gave them some magic results on the state of the core as a
function of time.
DR. MILLER: Yeah. You had the same thing; you had a TMI,
plus you have your wide ranges, wide range chambers. You have some
more. I think with a little bit of innovation, you can get a lot of
information.
Plus, I would say I go along with Dr. Kress: for an in-core monitor for
something cesium, it would be a very simple detection system; not an
exotic uranium system with liquid nitrogen.
DR. BONACA: For one, I don't believe that PASS was ever intended to
perform emergency action level calls in the first half an hour of an
accident, of course. I think that what happened is that, when emergency
action level or the emergency plan were modified after TMI, then I since
PASS was available, it was incorporated as a means of getting
information.
So, the result of it was that it just never could perform the function.
I believe the driver of that was, if you remember, the debate on, you
know, what was interactive vessel versus the sample TMI. And the fact
that one could not make any call regarding non-condensibles or anything
of that kind.
That, I think, was the requirement for the PASS system. I'm only saying
that, I don't think it ever should have been in the emergency action
levels anyway, to start with. And, I don't know what changes you can
make to PASS system to do that.
DR. MILLER: Of course the only comment I have is, I'm
surprised we're so late coming with this kind of proposal because we're
not coming in with anything we didn't know two years after TMI, or less.
You know, all the information -- as Dr. Powers pointed out -- was there,
if you read the TMI instrumentation. It's just that no one understood
what they were looking at. And very quickly, we understood what we were
looking at.
I am surprised here it is 1999, it is 20 years later.
DR. BONACA: This MAAP and MELCOR, whatever was unavailable
then to make his proposal, that was to make those kind of correlations.
DR. MILLER: That's true, but what they are doing is fairly
-- as he points out, you don't need much sensitivity. You don't need
MAAP to tell you what is going on from your core exit thermocouples, it
is all there. Except you have wider range thermocouples today than you
had in TMI. That was part of Reg. Guide 1.97.
DR. KRESS: I think we had better move on. We have
additional presentations. The staff is supposed to make a presentation,
too.
MR. BRYAN: At this point, if there are no further
questions, I would like to turn it over to Wayne Harrison to talk a
little bit about PASS.
MR. HARRISON: I appreciate the intro, Bob.
Good afternoon, my name is Wayne Harrison. I am the
Chairman of the Licensing Subcommittee of the Westinghouse Owners Group.
And I think this last discussion is a good lead-in to a discussion on
the post-accident sampling system.
[Pause.]
MR. HARRISON: Bear with a moment.
[Pause.]
MR. HARRISON: He didn't stack them the way I stack them.
[Laughter.]
MR. HARRISON: There is a difference between Tennessee and
Texas. I want to go quickly to summary of the regulatory basis for the
Westinghouse Owners Group post-accident sampling. I think we talked a
little bit earlier in the presentation that we think this is properly
focused on the public health and safety and what is really required for
accident management needs.
The proposed PASS changes are in compliance with the
regulations. We are really not looking to require any exemptions per
50.12 to the regulations. What we are looking for, actually, is to
revise compliance with NUREG-0737 commitments, and I really should have
put up there Reg. Guide 1.97 as well, that is another set of commitments
that the changes would affect.
As we have been discussing, the current accident management
activities -- well, the current accident management activities have been
reviewed and approved by the Nuclear Regulatory Commission. I think we
talked a little bit about how we do severe accident management or how we
identify emergency action levels and so forth, which has typically been
reviewed and approved as far as the emergency planning at nuclear power
plants.
And as we have talked earlier, the current accident
management activities have no reliance on the post-accident sampling
system for short-term activities such as emergency operating procedures,
identifying emergency action levels or severe accident management
guidance. And the accident management activities have only a minimal
reliance on the PASS for medium and long-term activities, and I will
talk a little bit more about that as I go through.
You probably recognize that the post-accident sampling
system typically takes samples from three areas in the reactor
containment. Number one is from the reactor coolant system. At South
Texas, the post-accident sampling system takes samples from the reactor
coolant system hotlegs and the residual heat removal system. I think
the part about taking samples off the reactor coolant system hotlegs is
typical of the residual heat removal system may be unique to South Texas
projects since all of our RHR is inside the containment.
The other sample point for the reactor containment
atmosphere, it is typically taken at a number of places within the
reactor containment. South Texas takes it at the top of the dome, above
the steam generator cubicle, inside the steam generator cubicle and
inside the bioshield wall. And that is probably kind of representative
of where most plants take it, and there may be some variation from plant
to plant, and with --
DR. WALLIS: Excuse me. How does it take a sample? Is
there a hole and something is --
MR. HARRISON: We have some -- I can't give you a very good
description of the system. I'm sorry. But, basically, we have some
tubing and sampling where we can open some valves and draw samples into
our post-accident sampling panel.
DR. WALLIS: But that could be presumably be automated. You
don't have to have someone go and do it, the way it has been presented
before.
MR. HARRISON: What we do is, if it turns out we need to go
take a sample, the post-accident sampling system panel has a number of
automated functions associated with it. But if you have an event inside
the containment, it will isolate -- the containment will normally
automatically isolate.
If you had a significant event, you are going to have
operators going through a number of activities in their emergency
operating procedures as their first and number one priority. To get a
sample from the post-accident sampling system, operations would have to
go un-isolate the system such that the chemical and radiation protection
people can take their required sample.
DR. WALLIS: This surprises me because it seems to me that
you would -- on some signal, such as high exit temperature, thermocouple
measurements, you could automatically open some valve, let some fluid
out and so some certainly radiation measurements immediately. You don't
have to have anybody go do anything. Why is there this sort of delay,
the operators have to do something? I don't see why.
MR. HARRISON: Well, that is because we have really -- we
don't depend on the post-accident sampling system to drive any emergency
operating procedures.
DR. WALLIS: It seems you are sort of deliberately making it
awkward to use so that you can say you don't want to use it.
MR. HARRISON: Well, hardly. I think the first focus of the
operations -- of the operators in the emergency operation facility, or
emergency operations procedures is to mitigate the event.
DR. WALLIS: No, I am saying they shouldn't have to do
anything with PASS, it should just happen. It should be a passive PASS.
MR. HARRISON: And at the time the requirements are that you
need to be able to take a sample within three hours, and those were our
regulatory requirements. So the system is designed to comply with that
and to enable to take the sample within the required time, which
supports what we need for accident management, if we were -- or what was
perceived to be needed at the time for accident management.
But, again, as far as characterization of the event,
determination of what the emergency action levels are, and, ultimately,
the protective action recommendations, is really seen on the picture
that we showed where it depended upon implant instrumentation to get the
most responsive action on the part of the emergency team.
I am going to briefly go through, as I mentioned, where the
samples were taken. I want to just briefly just go -- have some tables
that show the reactor coolant system, the reactor containment atmosphere
and the reactor containment sump.
This is the changes that are proposed in the Westinghouse
Owners Group for what we do in the reactor coolant system. The primary
change, the most -- that we are going on -- excuse me. Where we would
retain the post-accident sampling is on reactor coolant system boron.
We would propose to relax the requirement for time from three hours to
eight hours and the accuracy from 5 percent to 10 percent, which is more
reflective of the current instrumentation capability.
The remainder of the Reg. Guide 1.97 and NUREG-0737
requirements with regard to timing and accuracy, we are proposing to
have no requirement on time and the accuracy would be as defined by the
procedure. Now, the subcommittee asked, when we gave this first
presentation, we originally said there would be no requirement on
accuracy, and that is really not true. The accuracy will be defined by
the procedure, it will be defined by the type of equipment that you
would use for taking that sample, and the methodology employed at your
facility. So that is what I mean by plant application specific on
procedure, and you will see that note on all of the slides.
It also may be dependent upon, what does the accident -- or
the Technical Support Center or the Emergency Operations Facility need
if you were going to take that sample?
With regard to these particular items, none of these are
required by emergency operating procedures, severe accident management
guidelines. For any response, we may use such -- this information for
long-term accident management, so we would propose to be able to
continue to take a sample, but we don't feel like that -- we feel like
that should be controlled within our own licensee guidance.
DR. KRESS: The time you have up there, eight hours.
MR. HARRISON: Yes.
DR. KRESS: That is eight hours from when?
MR. HARRISON: That is eight hours from attaining a stable
plant condition. One thing that I would like to point out, and in
talking to the South Texas project chemistry people, is that the
post-accident sampling system really needs a stable plant condition
before it is effective. If your plant is rapidly changing, or the
conditions are rapidly changing, number one, you won't get useful
results because it will only tell you what happened, and what is water
the bridge, essentially.
And, second, the post-accident sampling itself doesn't work
as well under conditions where you have rapidly changing plant
conditions.
So we feel like for when you would really need this reactor
coolant system boron, eight hours is appropriate. And the other factor
on reactor coolant system boron, what we are really looking for is to
make sure we have shutdown margin and the emergency operating procedure
that calls for that is the one for natural circulation cooldown, so we
are really looking a little ways down the road, and that was the
justification for the eight hours.
DR. WALLIS: It seems to me that quite apart from
regulations, you might have requirements to know some things about how
accidents develop. If you did, very unfortunately, have an accident
like this, then down the road you might have to justify, to someone like
you, your actions. You might have legal suits, all kinds of liability
problems. And the more information you can draw on to show that things
were done properly, the better.
MR. HARRISON: And I think if you at the way we would
propose to implement the post-accident sampling system, we would
probably still have access to that kind of information. If we were to
look at it from the purposes of doing accident management strategy, if
we took the samples, we would have the data available to us for
comparison to the decision making.
DR. WALLIS: I was wondering why -- I would think you might
be more nervous about those issues than just meeting some regulatory
requirements, if you actually thought through the worst case scenarios.
MR. HARRISON: We didn't really build this looking
specifically at the liability issues, but it would -- I think it would
give us some information.
DR. WALLIS: What would happen if somebody misunderstood
this and so on? Look at the worst case and how you might save yourself
from that.
MR. HARRISON: Yes, sir.
DR. POWERS: Now, on this slide, you indicate that you are
going to still measure boron, you are not going to try to get it --
derive it from just a mass balance?
MR. HARRISON: That's correct.
With regard to the reactor containment atmosphere samples, the main
quantity or quantification we need from the reactor containment
atmosphere is for hydrogen. There was a requirement or there is a
requirement to be able to get that from the postaccident sampling
system, and in discussions with the staff and in looking at what we
really have in the plant, the right way to do that and the most
effective way to do that is actually with the containment hydrogen
online monitor.
It's a safety-grade redundant system in the containment, and
it's better for determining hydrogen concentrations than is the
postaccident sampling system, so we're simply proposing that we're going
to eliminate from the postaccident sampling system that particular
function.
DR. POWERS: Is your online monitor environmentally
qualified --
MR. HARRISON: Yes.
DR. POWERS: For severe accident conditions.
MR. HARRISON: Yes.
Which by the way makes it a better monitor than most
postaccident sampling systems, because if you are aware, the PASS itself
is not required to be a safety-related system.
With regard to the other containment sampling requirements,
they're again not required by the emergency operating procedures or
other guidance documents or diagnostic documents, and there is also
concern as we mentioned earlier on the timeliness and the accuracy of
the postaccident sampling system to really support what our needs are
for that type of information.
And the third and last area that was subject to sampling is
the containment sump. The Westinghouse Owners' Group proposes to retain
a requirement for containment sump samples for plants that meet all
three of these conditions: that the plant has brackish water cooling,
with a single barrier between that brackish water system and the
containment, and has no passive pH control for the sump.
With regard to the remainder of the Reg Guide 197, I think
these are pretty much governed by Reg Guide 197 instead of the NUREG,
but with regard to the remainder of the other sump sampling again
they're not required by the EOPs or the SAMGs or needed for the short or
long-term response.
Again, to go back to questions that we had, it may be useful
on a plant-specific basis to have a capability to sample what's in the
sump for long-term accident recovery planning. That might be very
useful information to us.
DR. POWERS: Maybe I don't understand. If I don't have
brackish water, then I come down to sump pH all others? Or do I have to
not have brackish water and have passive pH control, whatever that is.
MR. HARRISON: You would need to have sump pH or, excuse me,
sump sampling capability. If you have a brackish water cooling system,
and if that brackish water cooling system has only a single barrier
between itself and the containment, and that's -- primarily the concern
there is chlorides and having a potentially infinite source of water
into the containment, or high-chloride water to the containment.
DR. KRESS: And if it's not pH controlled. Three areas.
MR. HARRISON: Three areas. Each one -- all three have --
criteria have to be met. You have to have --
DR. POWERS: Oh, okay.
MR. HARRISON: It has to have no passive pH, a single
barrier, and be a brackish-water plant. All three.
DR. UHRIG: Otherwise it's not required.
MR. HARRISON: Otherwise it's not required. That's right.
DR. POWERS: So I'm not at all interested in sump pH if I
have a double barrier.
MR. HARRISON: Right.
DR. POWERS: I mean, I can't imagine why I'm not interested
in pH just because I have a double barrier, but that's the requirement.
MR. HARRISON: For instance, I'd use South Texas as an
example, South Texas has a double-barrier system. We use containment --
component cooling water. We know what the pH of the component cooling
water is. It's a chemically controlled system. And if we were somehow
have a leakage from the component cooling water system to the
containment, we would be able to quantify that and have an idea of
what's in there.
DR. POWERS: Yes, but I'm worried about what's the pH in the
sump water. Why don't I care just because I have a double barrier?
MR. HARRISON: Well, you care what the pH of the sump water
is, but the way we look at this is that you will know based on the fact
that you have a passive pH, for instance, trisodium phosphate baskets in
the containment or in the case of an ice condenser the chemical contents
of the ice, so you'll know the quantity of that component, you'll know
what you put in from the refueling water storage tank, you'll know what
you already have from the reactor coolant system, and if you introduce
water from some other source, you would be able to quantify that water
that you had introduced from the other source. So we think we have a
way to get a very good idea on what the pH is, and the passive pH is --
DR. KRESS: I think he's interested in cases where there's
no passive pH.
DR. POWERS: Well, let's go ahead and let him have passive
pH.
Let me ask that question. I'm in the middle of a severe
accident. I'm dumping junk into this water, serious first-order junk.
A lot of these junks are metals, metal ions. And they look at this
trisodium phosphate and they ignore it. They sit there and say gee,
there's this nice lovely anion that I just love to complex with and form
a precipitate out of, but because this is a severe accident, I'm going
to ignore this, and because these guys need it for sump pH.
MR. HARRISON: I think you need to look and see why am I
putting that water in the sump in the first place. If I'm in a severe
accident, it means I've lost -- I've used up all my refueling water
storage tank or for some reason I don't have it available, and I'm
really in a bind trying to find another source of water for keeping my
core cool or providing cooling.
My first priority is going to be to get that water in there.
The next thing I'm going to have to look at is well, okay, long term
what's that going to mean to me. And then I can get an idea of what --
I can calculate my pH or determine what my pH is. But again it comes
back to being for --
DR. POWERS: Let me come back to this. You can calculate
your pH. Okay. You've got so much water with so much trisodium
phosphate in it, and x kilomols of an unspecified cation. Now,
calculate the pH.
I do this for a living. I can't do it with that problem.
My point is that you're putting stuff into this water that
has an affinity for your buffering material. It chemically interacts
with it. It removes it from the buffering equation. But a priori you
don't know how much you put in there. A priori you don't know how much
of -- how far the equilibria go. So it makes it extremely difficult to
calculate what the pH is.
MR. HARRISON: Well, I think you do know how much you put in
there.
DR. POWERS: How much of the reactor fuel's in there? How
much of the metal ions have vaporized out of the core and come there?
How much of the concrete has leached into the sump?
MR. HARRISON: Well, that's -- you're right. Obviously you
don't -- when you asked how much you put in, I was thinking in terms of
the quantity of water in the various sources.
DR. POWERS: You know how much that is, but you don't know
all this other stuff that's coming in there. Which is why I would think
that you would want a measurement to say what is my pH and what is my
buffering capacity.
MR. HARRISON: Right. And I think that would go back to the
design basis on the pH.
Do you have anything you can offer on that, Bob?
MR. LUTZ: Bob Lutz from Westinghouse.
The only thing that I'd like to add is that we're not doing
away with capability to measure pH of the sump water. For all of these
things that we're talking about removing regulatory requirements, and I
use that in quotes, the capability to obtain a sample from the sump and
to do whatever chemical analysis the TSC deems would be desirable is
maintained. What we're saying is that it's not required for the
short-term response to regain control of the plant, it's more a recovery
function than it is a mitigative function.
MR. HARRISON: Right. Thank you, Bob.
DR. POWERS: Well, I think in mapping this thing out that
you have neglected a major area. Now whether it dilutes your point,
your essential point, which is in the short time I don't need this
information, I only need it in the longer term, I think you're probably
right there.
But in the longer term, when you've thought about things, I
think you've left out major considerations. And those major
considerations are that under accident conditions you're going to dump a
bunch of junk into this water that interacts with it chemically, and it
interacts with it in ways we probably have a hard time predicting,
because we don't know how much comes in, we don't know how much leaching
there is, and things like that. And it's going to change things.
And the only way you're going to be able to have confidence
in where you think you are is not on a mass balance calculation, how
much I put in, but rather on getting a sample out and saying what is the
pH and what is the buffer capacity, and how many hours do I have before
I have some serious iodine partitioning coming out here.
MR. HARRISON: And I think as far as if you have iodines
coming out of solution, I think we may have some additional indication
of that from radiation levels.
DR. POWERS: I kind of doubt it. I think your radiation
monitors are going to be pinned and tinned.
DR. KRESS: Well, they'd never pick up iodine anyway. They
don't have a good gamma.
DR. POWERS: Iodine doesn't have a good enough gamma to
hit --
DR. KRESS: You won't see the iodine.
MR. HARRISON: Any other questions on the tables?
A summary of the basis is just a rehash of what I just went
through in tabular form. We don't need the post-accident sampling
system for an immediate response. Where there was sort of an immediate
response was with regard to containment hydrogen, but the containment
hydrogen is really more appropriately measured or handled by the
containment online hydrogen monitor.
We do use the PASS potentially for assurance of a long-term
stable state. We talked about having boron for shutdown margin within
eight hours of the stable state, and we just had the discussion of sump
pH for brackish water plants.
You obviously can use the post-accident sampling system for
planning recovery. We don't think there is a record response required.

One of the important things we wanted to point out is that
the technical support center engineers, the emergency operations
facility engineering staff will identify roles for post-accident
sampling system based on the individual accident scenario. It's going
to be plant-specific and it won't be something that we can necessarily
predetermine in a set of requirements.
Knowing that they still have this capability, this is where
that expertise and where we would rely on determining what we would need
for the long-term sampling requirements.
Basically, just looking overall, we don't believe that the
post-accident sampling system is critical to the public health and
safety based primarily on the long-term aspects of the system.
Our conclusions -- we believe the revised post-accident
sampling system that the Westinghouse Owners Group has proposed is
technically sound, that it meets the regulatory requirements for
sampling, and that the proposed changes will improve the effectiveness
of our emergency planning and that it will support the ability to
maintain the safe, stable plant following an accident.
DR. KRESS: Thank you. Dana, we are pretty far behind, but
we still have to hear Staff's side of the story.
DR. POWERS: My schedule is such a disaster this meeting
that one more delay or what-not will have a minimal impact on it.
DR. KRESS: I would ask the Staff to try to be brief, if we
allow them to.
DR. POWERS: Brief but thorough.
We have one of the outstanding speakers from the Staff here
with us anyway.
DR. KRESS: Yes, that's right.
DR. POWERS: Not known to be brief sometimes.
MR. HARRISON: Oh -- I'd hate to have you guys hear me snore
over here.
DR. POWERS: No, we were waiting for the comments out in the
hall.
[Laughter.]
MR. HARRISON: Now that you mention it, I was thinking of
one of the "Airport" movies but I won't go into that one.
[Laughter.]
DR. POWERS: What you need is to persuade us of your point
of view.
DR. KRESS: This is important so we don't want to
short-change it.
DR. POWERS: We are fixin' to write so you want us to write
things that are correct.
MR. PALLA: My name is Bob Palla. I am with the
Probabilistic Safety Assessment Branch, NRR, the lead reviewer on the
core damage assessment methodology, which is one of two topicals.
I want to just show the graphic here that we prepared. It
was prepared with an attempt to clarify and I hope it doesn't have the
reverse effect.
I wanted to point out that the post-accident sampling is
basically from the sump, from the RCS, from the containment atmosphere.
We are looking at dissolved gases, hydrogen, oxygen, conductivity, pH,
chlorides, boron. We are looking for radionuclide from the sump, from
the containment atmosphere.
The scope of these samples is really the issue of WCAP
14-986. What I want to talk about here is basically how the
radionuclides are used. You can have two uses for the information, the
radionuclide information from PASS. It could be for core damage
assessment, in which case you would derive estimates of core damage from
that information, or you can use it for source term assessment where you
would use that information as assumptions to dose assessment
calculations and from that you could go to protective action
recommendations and let me say in the longer term because it is really a
question of when is the information available, and we have got the three
hour time delay that is a factor there.
Now this is pretty much the situation today, that the core
damage assessment methodology that is in place now relies on PASS. We
don't get the sample upfront, and as a result we don't have a core
damage estimate upfront, early, so therefore we don't feed that kind of
information into the decision-making process. I have kind of shown it
separate there, but if one could make this information more timely, it
would be an additional piece of information that could enter into the
decision-making process potentially for the EALs and for protective
action recommendations.
What I am going to focus on here is just the WCAP 14-6-96
scope, which is essentially how do you come up with a core damage
estimate from in this case without the use of PASS, so we are currently
driving it with PASS. This proposed methodology eliminates that
reliance.
Now looking back at the regulatory basis for the core damage
assessment methodology, interestingly enough there isn't really a clear
statement about the need for a procedure or a method to translate
radionuclide information into core damage assessment. If one goes back,
looks at the record, this is really all that you'll find -- TMI, 0737,
item 2.B.3, Criterion 2. The licensee is essentially required to
provide the PASS system.
Now the way that the Staff has interpreted it and really the
only source of any guidance on core damage assessment methodology is
provided in what was called the Post-Accident Sampling Guide for
preparation of a procedure to estimate core damage. This document was
prepared in 1982. It was disseminated to utilities as part of the
Staff's review of the PASS systems.
Now this document, if you look at it, lays out some
expectations on the part of the Staff as to what this procedure should
do, and it was referred to as a procedure at that time.
Basically it says the primary purpose of this procedure is
to provide a realistic estimate of core damage and the primary interest
is to be able to differentiate between four categories of core damage,
namely no core damage, cladding damage, some fuel overheating, and core
melt. Now they called out those four categories.
They went further and they tried to define degrees of damage
within each of those categories. The result was they have like ten, the
expectation being that you would be really finely dividing the state of
the core into 10 different categories.
Now what they did not do is talk about and state in any way
how this information from the procedure would be used, so I think what
has happened, and maybe this is part of the problem, is we basically set
out a requirement for a system as part of our licensing reviews. We
required licensees to provide a procedure, and I don't think we gave
serious consideration to how the results of that procedure actually
entered into emergency response, so I think there's been a decoupling
there.
The procedure exists. It is used. It is tested in drills.
But it doesn't have a clear tie to decision-makings.
DR. WALLIS: Can you clarify something? I thought Mr. Bryan
told us that there was no need to change requirements by what they were
proposing and it looks as if you would have to change this requirement,
but it does call for a -- well, it says regulatory requirement.
MR. PALLA: I put it in quotes. It is a TMI requirement. I
don't know --
DR. WALLIS: I am not quite clear what is requirement, what
is not a requirement.
MR. PALLA: It's not a regulation.
DR. KRESS: It's not a reg.
MR. PALLA: I think he was saying there is no regulation.
DR. POWERS: What has happened is that licensees have made
commitments to follow this document and to them that looks as much like
a requirement -- in fact, you can't even cite against it, can you?
MR. BRYAN: This is Bob Bryan. That is exactly correct.
What I was speaking to is what we would call a regulatory requirement is
something that is a piece of the law, whereas a NUREG and a Reg Guide
represents a guidance document where we may have to make a licensing
submittal to but we would not have to request an exemption to the law or
make a change to the law.
MR. PALLA: I will proceed here. The way that the, quote,
"regulation" -- the requirement for procedure, the core damage
assessment procedure was met was in the case of the Westinghouse plants,
the Westinghouse Owners Group prepared at generic document. It was
called the post-accident core damage assessment methodology that was
subsequently used by individual licensees as the basis for meeting the
TMI requirement.
This was approved in 1984 on the basis that it met -- there
wasn't any thorough review of this process. It was basically reviewed
and the bottom line assumption is that it met the requirement even
though the requirement is not really explicitly there, so that is easy
to meet.
[Laughter.]
DR. POWERS: Or impossible to meet -- one or the other.
MR. PALLA: The methodology essentially, and I don't need to
dwell on this very much, but its primary thrust was looking at the PASS
results, radionuclide results, but there was some indication in the
secondary sense to look at things like core exit thermocouples, hydrogen
concentration, reactor vessel level instrumentation, as a means of
confirming this, but the result of having primary reliance on
post-accident sample meant that you really didn't end up with an
estimate coming out of this until the three-hour criteria sampled and
analyzed it.
DR. WALLIS: Many industries faced with this question of
having a delay would say okay, it's a technical problem. If there's too
much delay we'll fix it.
It is interesting that in this industry the approach is not
to fix it technically but to go and try to change the requirement.
MR. PALLA: Okay. I think you have heard from a couple
speakers already that the delays in this information has led to a lack
of use --
DR. WALLIS: Well, delays are inherent. It is just that no
one has tried to shorten them, as far as I can see.
DR. POWERS: On the other hand, the other way to look at it,
in fairness, is if we are perfectly capable of making these decisions
without getting this information, why get it?
MR. BARTON: You don't need to make the decision.
DR. WALLIS: I understand that too. It's just the attitude.
Many people would say here is a chance to do something technically. We
will fix it and it will go away. We don't need to involve the NRC and
ACRS at all.
MR. PALLA: And I think that the methodology that you have
in front of your is really an alternative to do it but do it by
different and less direct means than samples.
Just a quick statement about how did we review this. Since
there wasn't very much guidance on what this entity should be, we
basically looked initially at what is the rationale for the WOG
proposing to change this in the first place and obviously it is a
twofold thing.
There is an interest in elimination of the post-accident
sample system, and there is also a recognition that the current process
is not timely and could stand some improvement.
MR. PALLA: So we looked at the rationale for why is this
thing being proposed, and is it okay to eliminate the reliance on Pass.
We looked at the scope of the indications that were -- that
are being relied on in the revised guideline, and it's called a core
damage assessment guideline. Let me just clarify this. There's a
topical report that discusses core damage assessment methodology or
guidance. Within that document, in the back is the actual guideline,
and then as attachments to that are appendices that discuss how an
individual utility would establish setpoint values for their plant. So
what I'm talking about here is really the guideline itself and the
supporting appendices.
We looked at, you know, basically what's the scope of the
information that's being looked at, how is the information -- the
readings themselves translated into core damage estimates and how are
those estimates reconciled with each other, and then in the more
specific sense, did the setpoint values that are either inherent in the
methodology or determined by the utilities based on recommendations
given in the appendices, do those appear to be reasonable. I think that
you all realize that it's a -- generally, it's a simplified approach.
As previous speakers have indicated, it's an order of magnitude kind of
an answer, and as our initial regulatory guidance indicated, the
post-accident sampling guidance document, you're trying to categorize
things into four broad categories of damage fundamentally.
DR. POWERS: And I guess I'm sitting here thinking a little
bit about what's the regulatory interest here? It seems to me the
regulatory interest is that you want to have a sound basis for making
these emergency action decisions.
MR. PALLA: Yes.
DR. POWERS: And that beyond that, you really don't care.
DR. KRESS: Well, I think there may be some public health
and safety and worker protection issues associated with recovery
actions.
DR. POWERS: Well, --
MR. BARTON: But that's down the road, Tom.
DR. KRESS: I understand.
DR. POWERS: I was putting that -- I agree with you --
MR. BARTON: I agree with you, too.
DR. POWERS: -- that recovery is an important thing, but I
put it, rather than on a second line, I would put it after the PR box on
the first speaker's presentation, and you want a sound basis for making
each one of the decisions in those blocks, and you really don't care
what that basis is as long as it's sound.
MR. PALLA: Yes, I think what we --
DR. POWERS: I mean, am I characterizing --
MR. PALLA: I think what we see is that there are problems
let existing situation, okay? There's problems with how representative
is the sample that we draw today. If you haven't factored in --
DR. POWERS: Are there problems with the existing situation?
MR. PALLA: There's confusion as to how -- if you drew a
sample and you tried it analyze it using the current methodology, it
does not account for the fact that you could have retained a significant
amount of fission products in the vessel itself and you might have hold
up just because the RCS is at high pressure. So you're going to pull a
sample and try to -- and actually, you've got problems with the
deposition in the sample line itself. The sample that you obtain may
not be representative, and that's where --
DR. POWERS: But I'm still able to make decisions despite
that. What I've got is --
MR. PALLA: Absolutely.
DR. POWERS: -- I've got an extra --
MR. PALLA: The top line of the first speaker's slide --
you've already got fixed instrumentation, it's currently being used to
drive EALs and to make, you know, PAR decisions. So that process is
already in place.
MR. BARTON: It's another data point that doesn't really
help make a decision but it could confuse the decisionmaking process.
That's the way I look at it.
DR. POWERS: On the other hand, I think you're saying -- you
know, there's one thing that I know about people in the middle of
accidents, is that they do a really bad job of estimating how bad the
accident is. I'm reminded of the Chernobyl incident there, you know,
they kind of blew up the reactor and they called up Moscow to say, well,
we've blown up the reactor, except they didn't say that, they said we
have an incident. The guys in Moscow said, well, how bad is it? He
says, it doesn't look too bad, we should be on line in the morning, you
know?
[Laughter.]
DR. POWERS: Well, they missed that estimate just a tad.
MR. PALLA: He was talking about the other unit.
[Laughter.]
DR. POWERS: He must have been, because he certainly wasn't
talking -- but I think you can go through and find anybody in the middle
of an accident -- they do a really bad job of estimating.
MR. PALLA: I think that's a good argument for trying to
keep things simple, and we have learned more. And what this methodology
does, it is pretty straightforward, it's got built into it these
assumptions about fission product retention. As the one speaker has
indicated, there's assumptions if you're at high pressure, a certain
amount of hold up; if you're at low pressure, a different amount of hold
up. That's built in. And what a utility would do when they implement
this is develop plant-specific curves that have that assumption implicit
in them, so they'll be expecting, you know, some -- only a residual
amount of the fission products to actually get out, and if they saw two
percent out there in a high pressure sequence, they might think they've
got a full-blow core melt.
Now, in the current way of thinking, if you saw that, you
would say, no, I don't have any damage -- not too much. This didn't
account for the fact that a lot of the fission product is left behind in
the RSCS.
So from what we see, the changes to the methodology are
warranted. There's good cases made with regard to timing and the
availability of the information. It could probably improve the
accuracy. I'm not going to make any claims that this is a highly
accurate measurement, though. But what they do in this -- I've got
another slide, but there is a cross comparison of various indicators to
come up with an estimate. So there's some degree of robustness to it.
DR. POWERS: How would you as an intellectual exercise gone
through the methodology and said, you know, if I'm sitting at TMI, would
I have drawn different conclusions than were drawn for the next three
years after TMI?
MR. PALLA: You're asking me if we used this methodology --
DR. POWERS: Yes, if you did that exercise.
MR. PALLA: I would think that if the information we're
dealing with truly was available, then, if you had this method, it would
be telling you you have a full-blown release of the fission products. I
think it would be pretty clear from the method that that --
DR. POWERS: We had all of that information that they're
getting now.
MR. PALLA: We didn't have the procedure for using it.
DR. POWERS: Yes, we didn't have -- and so it's really the
procedure that's --
DR. MILLER: And we didn't understand what -- the people
there didn't understand what it meant.
MR. PALLA: This is a number of things you're trying to --
from each piece of information, rad monitors, core exit temperatures,
hydrogen concentration -- you individual look at those, you individual
try to come up with an estimate percent. The speaker said we didn't
quantify. Actually, the methodology does quantify these things and then
cross-compare them and expect not a high degree of agreement, but some
degree of agreement between them, and you're kind of pulling this
information together. So there's some structure here in some, you know,
systematic use of the information that you had at TMI, but maybe 2 and 2
didn't equal 4 back then.
DR. SEALE: The problem with TMI was not a shortage of
wiggly needles.
DR. FONTANA: That's right. Maybe a couple of them that
were bouncing off the paper.
DR. SEALE: That's right, but it wasn't the shortage of
wiggly needles that was the problem.
DR. POWERS: Denial.
DR. FONTANA: People refused or didn't understand or denial,
exactly. As soon as I heard about --
DR. SEALE: Same thing at Chernobyl.
MR. PALLA: This will give you another piece of data to
deny, then.
DR. WALLIS: When there's another accident and it turns out
that they misdiagnosed it, which would allow them not to do something
with the power system, there's going to be a lot of questions about why
did the NRC allow them not to use -- to disregard these past
requirements?
MR. PALLA: Well --
DR. WALLIS: Didn't this cause them to do what they did and
so on and so forth? That's the worst scenario. MR. PALLA: What
we're trying to do here is fulfill the basic needs for response but not
give away the ability to sample, and in fact, Jim O'Brien will speak
about this as soon as I finish here. One of the things that we're
looking at and wrestling with the best way to do it is to assure that
the capability to do a sample is still retained. So we're relaxing the
time requirement but not eliminating the need for the system.
DR. WALLIS: So who takes the risk? If the NRC relaxes this
pass requirement and, in retrospect, after an accident, this turns out
to play a role in the severity of the accident, do the NRC people get
fined or go to jail or punished in some way?
MR. BARTON: The licensee goes to jail for making the wrong
recommendation.
DR. WALLIS: That's the way it is.
MR. PALLA: I would say this would improve the risk
situation because you will now have -- you'll have two things. Early on
in the event, when we all could probably agree that pass wouldn't even
be there, so you -- whether you have it or not is probably not relevant.
But early on in the event, with this methodology, you would have some
additional information on the state of the core that could be fed into
protective action decisionmaking. So that's an improvement.
In the long term, we would hope to retain the capability to
sample still. We would not have an explicit timing requirement, but we
would still have the capability to sample. So I would argue that we
weren't really giving that up, that the sampling makes sense late in an
event when you've got -- the core is stable. It's something that you
could -- the situation won't change between zero and three hours, for
the most part, the sample with mean something then. If you took the
sample in the first hour, the plant is still going through a transient,
that information is nice, but it's three hours old and you've got a
different situation in the plant right now.
So I'm thinking that this proposal is not really a
relaxation or an increase in risk. I think that this is an improvement
on the -- insofar as the decisionmaking goes, and there would still be a
capability to sample in the long term when sampling actually would seem
to make more sense.
DR. WALLIS: You're presenting some very nice arguments, and
I am happy to see you have the courage to do so because the -- the
regulator who is only interested in protecting himself would say, I'm
just not going to let them do anything because I'm going to be blamed if
anything happened. So he wouldn't be recommending what you're
recommending.
MR. PALLA: Well, I think it makes a lot more sense to try
to improve the decisionmaking process if we know there's a problem there
now.
Okay. So the first point is that we think the methodology
in fact does represent an improvement. It's --in a very approximate
way, it tries to account for some of the processes that we know plague
the situation, the fission product retention, the hold up issues.
There's some treatment of those issues implicit within the structure of
the revised guidance.
With regard to the fixed plant instrumentation that's being
used, essentially it has primary reliance on the containment high
radiation monitors and the core exit thermocouples. Hydrogen is also
looked at. These three indicators are compared with each other for
agreement. Within the guidance there are different discussions about
what could contribute to differences in those readings.
And then beyond that, there is the use of reactor vessel
level instrumentation. The RTDs in hotleg and the source range monitors
are used not in so much -- you don't calculate a percent core damage
with those, but you would, for example, with source range monitors, they
look for a decade increase in count rate to confirm uncovery. Now, I
think you could probably try to use that information to look for core
relocation, but that is not part of this, it is really used for
confirming the core uncovery.
And, similarly, with reactor vessel level instrumentation,
there are some predetermined levels and what the method does is look at
where is the core. You know, what have we put the core through? Have
we uncovered it below the level at which we would have expected to have
core damage? So, you are looking to correlate this information.
We think that the instrumentation that is being proposed
here is the right set of instrumentation. It is obvious there is not a
lot more information that you could use. I think they are making pretty
good use of the instruments that give you the most relevant information.
And the manner -- the hierarchy that is placed on it, the fact that it
is cross-compared with each other to try to add some robustness to the
estimate, we think is strength. So we think that it is a pretty
reasonable approach.
With regard to the set point values, we took a look at these
assumptions that -- I focused a good bit on the fission product holdup
assumptions and the retention issues. And we asked Westinghouse for
some additional information to provide the basis for these numbers, and
they provided us a table of MAAP calculations that supported these
numbers and we separately looked at what information was available using
the MELCOR calculations. Went back, looked at the source term fission
product expert elicitation for 1150 just to kind of see, and we actually
have a couple of committee members that were experts on that committee,
the expert committee for 1150.
The agreement is -- obviously, the fission product holdup
and retention, this is sequence-specific, and you can run various size
LOCAs that would all be low pressure, and you will see a fair health
degree of variation among -- from sequence to sequence. But I think, in
general, what has been done here is a pretty reasonable attempt to
select a value that is characteristic of the types of events that you
would be looking at. If you are looking at high pressure events, the
fission product holdup assumptions look reasonable. Low pressure, it
looks pretty looks.
There is going to be sequences -- I wouldn't argue that it
is bounding. We looked across the board at -- you know, not that many
MELCOR calculations. We did not go and run more calculations for this,
but looked at what few we had and looked at the MAAP things. I would
not go so far as to say it is bounding, but I would say it is pretty
representative and it appears to be conservative from the point of view
that what you would see in the atmosphere -- I will probably get it
crossed up, but let me just leave it at fact it is conservative.
You would probably -- you would over-predict the degree of
core damage is what would happen because you are going to be -- your
monitors are focused on the airborne part of that.
Insofar as sprays, there is like a DF of 100 that is
assigned to sprays, and I don't know that that would be bounding either,
but --
DR. POWERS: I don't know how you assign a DF to sprays,
since they keep operating.
MR. PALLA: Well, what is done is if sprays are operating,
there is a factor of a hundred reduction in the inventory. So the
utility, in pre-establishing these curves assumes a certain inventory.
So you would run a calculation, you know what your inventory is for
starters. Then you would say, for high pressure, I am going to hold up
a certain amount. So you only carry that much into the development of
the plant-specific curves for high pressure. And for low pressure, you
similarly make an assumption about how much is held up. You run that
curve out. If you have sprays, then you reduce it further by two
orders, and you run that calculation out.
What you would do in an actual event is figure out if you
have got cladding damage or whether you have got over-temperature
damage. You would then branch into different steps. There is a step A
and a step B that covers clad damage and over-temperature damage. And
you would look at it further and you would be comparing it, you would
compare the actual reading from the rad monitor, you know, in the plant,
which took into consideration the development of the curves, where the
rad monitors are and what part of the containment they are looking at.
But you would compare your reading against the reading that would
correspond to 100 percent release, you know, all of the core, as
modified by these assumptions, and then derive an estimate of -- you
know, a fraction of the core that is over-temperature failures.
And, again, that is cross-compared to the hydrogen. It is
cross-compared to the core exit temperature readings, with the hope that
you have got some range, probably a reasonable range of where you think
the core damage is.
I just want to mention very briefly, we had a few issues.
We had some concern that the -- we had a basic question, should you
retain the elements of existing methodology with the expectation that
latent event -- yeah, maybe it didn't make sense to do a PASS sample
early, but in the long-term, if you are going to have the capability and
you are going to go and use it, -- would it make sense to try to have a
piece of the methodology there still? So that you can convert your
radionuclide information from PASS into a core damage assessment --
estimate. Confirm core damage.
We concluded that that probably doesn't make much sense,
that you might tend to confuse the situation. And at that point all the
decisions have already been made anyway insofar as ones that would be
based on core damage assessment. So we don't see the need to have, you
know, elements of the existing methodology, you know, that would relate
core damage -- or radionuclides to core damage. We don't see the need
to drag them into the existing -- into the revised methodology.
We had some question about the clad damage criteria that was
proposed. And essentially, what the original version of the methodology
did was it sets up a pressure limit. If you are above that that
pressure, you use one temperature as an indication of clad damage having
occurred. If you are below that pressure, you would use a different
temperature value. We questioned, well, where do these numbers come
from?
And, as a result, Westinghouse went back, did some
additional looks at that, some additional calculations and revisited --
they looked at high burnup fuel effects, too. Actually, that wasn't
part of the original determination of the recommended set points, so
upon looking at the broader range of fuel burnup, they modified the
recommended set points. So that looked like -- again, this is still --
has uncertainty in all these numbers, but it did look like it was a
reasonable value selected for the high pressure and the low pressure
situation.
The final item, the effect of additional fission product
removal mechanisms beyond those considered in the guideline. What the
guideline made -- they made assumptions regarding how much fission
product is retained in the reactor coolant system and said anything not
retained goes into the containment and that is -- if it isn't removed by
sprays, and that is what the monitors see. And I guess the question we
had is, what about natural processes in the containment, and would that
have much of an effect or not?
And we -- again, in this area, we asked and Westinghouse
provided some additional information that showed the partitioning
between -- of the fission products that are in the containment, how much
of them are airborne, how much of them are deposited in pools? And the
airborne ones would be the ones that you would be looking at -- the
monitors would be the seeing the airborne, but not the ones in the
pools.
DR. WALLIS: Can I go back to the temperature pressure that
you were just talking about? There is some sort of analysis that is
done about how to interpret these temperatures at various pressures. Is
this a special analysis derived just for this application?
MR. PALLA: No. There are existing models for --
DR. WALLIS: This builds on something which is --
MR. PALLA: This is like clad ballooning, clad balloon
models and strain models that predict --
DR. WALLIS: It has a history of being reviewed and
scrutinized by people who know enough to -- if it is right or wrong?
MR. PALLA: Well, there are -- yeah, there are models that
are approved in the licensing space. Now, the models that were used
here were MAAP renditions of those models, so we did not --
DR. POWERS: Yeah, the database is old. There is some
additional work going on with respect to high burnup fuels. The
database is old, but it was thorough, shall we say.
DR. KRESS: Except it didn't really account for hydrogen
embrittlement very well.
DR. POWERS: No, it was all lower burnup stuff where you
don't get any hydrogen precipitation.
DR. KRESS: But other than that, it is pretty good.
DR. POWERS: It is a pretty impressive database.
MR. PALLA: Well, just getting back to the last item there,
we took a look at that, the effect of natural processes, and this effect
is within the range of uncertainty of sequence to sequence variation.
Really, it kind of bounds what you would see the natural processes
contribution, so we figured what is out there -- what is assumed to be
out there is still not a bad estimate, even though it didn't account for
natural processes.
Just the bottom line, preliminary conclusions. Preliminary
until our SERs clears internal review.
The revised guideline provides core damage information with
a sufficient level of accuracy to support decision making. It's
simpler. It's faster. It could potentially be a risk benefit. Now it
potentially may not make any difference at all, because if a utility
modifies this, it still doesn't factor it into decision making, you
haven't really changed anything, although you will reduce exposures on
taking samples and so on. But we think that if this information is made
more timely, it's right for being used as an additional piece of
information in decision making.
The method accounts in an approximate way for the effects of
fission product holdup, hydrogen deposition and holdup -- well, hydrogen
holdup, high-pressure sequences in particular is what I'm talking about
there. You could have produced a lot of hydrogen, but in fact you may
not see it in your sample measurement. Your online monitor may not
detect it because it's bottled up in the RCS still. It's taken into
account by looking at high-pressure and low-pressure sequences,
specifically when you look at hydrogen. And we think that the earlier
availability of this information could improve the decision making.
So the bottom line is we think it's a worthwhile change to
what's out there today, and meets, if you go back to the original
expectations of trying to categorize core damage into broad categories,
this seems to be an acceptable alternative to using PASS.
DR. POWERS: I just keep thinking maybe you're being too
timid here. I keep coming back to the fact the decision gets made
without all this information, and that satisfies the regulatory
requirement. That's a fact. Why would we want to go on? Why not
just --
MR. PALLA: Why even have this at all?
DR. POWERS: You know, if the licensee wants to do it,
great, but why do I as a regulator care?
MR. PALLA: Well, I think to some degree there's always
question about whether -- how are licensees doing this. There's one
utility may already be doing it without this information, and another
utility -- I wouldn't want to vouch for a utility being out there that
actually is relying on it. So I think it still makes sense to try to
make these assessments. I wasn't ready to walk away from the --
MR. BARTON: Also I think you walk away from it, utilities
may -- some utilities may walk away from it also and then wish they
hadn't, because it does provide some good data for recovery and later on
in the accident.
MR. PALLA: I think it would enhance your accident
management -- your assessment of where's the core, you know, how much --
DR. POWERS: Accident management's a responsibility of the
licensees. We don't really regulate accident management.
MR. PALLA: That's right. And this would be part of their
tools that they would use.
DR. POWERS: And if they want to use that, if they want to
use a ouija board, I mean, it's kind of up to them.
MR. PALLA: Maybe I'm being too timid.
DR. POWERS: Good
MR. PALLA: Anything more?
DR. WALLIS: Well, as I said before, you're more courageous
than the self-protecting regulator would be.
DR. SEALE: Well, maybe they want to have --
DR. POWERS: No one has ever accused Bob of being timid.
DR. KRESS: Before you leave, Bob, would you say there are
any defense-in-depth implications of this? You know, emergency response
is quite often viewed as a defense-in-depth measure.
MR. PALLA: The point of not having PASS samples early to
drive the core damage assessment.
DR. KRESS: Yes.
MR. PALLA: I guess that one might be balanced by the fact
that the chemistry issues and the question about how good is the result
that you get from PASS, if it is in fact skewed because --
DR. KRESS: If it doesn't reduce your uncertainties, then
it's not good defense in depth in the first place.
MR. PALLA: It may increase them, I think. If one doesn't
go back and actually revisit the way it's done today, it seems like you
might take it off the shelf today, you might kind of point in the
opposite direction, not the right direction.
DR. APOSTOLAKIS: And wasn't this the first time that we had
a staff member be brave enough to admit that he was timid?
DR. POWERS: Yes, but I know that he's not timid.
Tom, this is the discussion that seems to have taken on a
life of its own. Would you object terribly if I took a break?
DR. KRESS: I wouldn't. I think we could --
DR. POWERS: And before I declare a break, can you give me a
hint on what it is we're to learn from this next presentation?
DR. KRESS: Just a second. Or maybe we ask Jim to tell us.
DR. POWERS: If we're going to do that, I'm going to go
ahead and take a break. He can tell us when we come back.
MR. O'BRIEN: Well, I can tell you this real quickly, that
there's -- we could approve core damage assessment methodology changes
without addressing this other topic at all.
DR. POWERS: We'll come back -- we'll take a 15-minute
break. We will come back, and you're going to be limited to 10 minutes,
okay, because I have another presentation scheduled pretty firmly at
3:30.
We'll break for 15 minutes.
[Recess.]
DR. POWERS: We will come back to into session.
Mr. Brien, I'm putting enormous pressure on you; you will do
us an enormous favor if you avoid putting up the viewgraphs that say,
either boron or chloride can be estimated from the knowledge of the
sources of the water addition.
Or, you can provide me a demonstration of how you can do a
calculation that I am unable to do with some of the most sophisticated
aqueous chemistry modals in the world.
MR. O'BRIEN: With that challenge --
[Laughter.]
MR. O'BRIEN: In view of the limited time, I've cut my
presentation down to one slide.
[Laughter.]
DR. POWERS: You can't cut it any further than that.
MR. O'BRIEN: My names's Jim O'Brien. I'm in the
Emergency Preparedness and Health Physics at NOR. And, I did not review
this on my own; I had some help from Chris Parczewski, Lumbrose Lois and
Bob Powell in doing the review.
I wanted to, just briefly, discuss one very important
issue, I think. The change in the core damage assessment -- that's what
you guys have just discussed and reviewed -- is a paper change. There's
no change to plant capabilities or anything like that. It's a change in
the way you do an analysis. We think is better from the timeliness
perspective, and perhaps from an accuracy perspective also, in assisting
you in emergency response. But it's a paper change; it doesn't change
anything as far as plant capabilities.
The issue we're looking at is this WCAP; it's
something that could potentially affect plant equipment and capabilities
in the plant, as far as personnel training and so forth.
The close action sampling system, as you have already
heard, is from NUREG-0737 requirement, and Reg Guide 1.97. It covered a
number of samples that were required -- and I use the word "required"
as, not in the regulatory sense, but -- the title of NUREG was
requirements. The samples were from radionucleides and dissolved
gasses; pH; boron.
I think if I characterize it into three groups, I'd
say that you had radionuclides, you had boron -- four groups --
dissolved gasses, and the last one being boron. Did I say boron?
MR. BRYAN: Yep. You covered it.
MR. O'BRIEN: Okay, pH, then. pH is what I missed.
DR. KRESS: Chlorides and stress corrosion, cracking
concerns, and also the radionucleide. In brief, we looked at each one
of those areas and we made a determination on what is really being
requested is a change in capabilities. So we assessed what would be the
change in the capability to obtain and analyze these samples?
For the oxygen -- I'm sorry. For the dissolved
gasses, I'll start over here on the left and move to the right.
Dissolved gasses, which are used as indications of the potential for
loss of, creation of voids in the vessel dome -- we considered the
director vessel level instrumentation system. And the ability to vent
the vessel is adequate that we no longer need to sample for the
dissolved gasses.
Moving on. Hydrogen is the same thing. It's one of
the dissolved gasses and oxygen also -- well, excuse me. Oxygen is for
stress corrosion cracking.
The next issue that we're going to talk about is
oxygen conductivity, pH and chloride. And focusing in on the RCS
aspects of those samples, Westinghouse is requesting that those samples
be deleted for the plant, that the capabilities be maintained for
long-term monitoring but not within the licensing basis. From our
evaluation, we considered that this is acceptable, because we have
information enough to evaluate the potential for stress corrosion
cracking. In a nutshell, that's it.
DR. SHACK: My core is melting... stress corrosion
cracking.
[Laughter.]
DR. SHACK: The technical basis of the review just
really distresses me because, why would I worry about chloride in water
in the course of a severe accident? I guarantee you, it's not stress
corrosion cracking.
Now, I might worry about it because I changed the
iodine chemistry completely. I certainly have something in there,
gathering the things that will drive iodine down to a high oxidation
state so it's not volatile. That strikes me as something as something I
would worry about.
I see lots of things in here that say, gee, I can
calculate how much of x is in the sump because I know how much is coming
in. And yet, I have tremendous amounts of chemical processes taking
place in these sumps and other -- and even in the vessel, during a
severe accident, that are resulting in things becoming complex, becoming
hydrolyzed, becoming precipitates. These are challenging things to
figure out, but it does not at least show in the write-up that I've seen
that that's been recognized either by the applicant or by the review.
MR. KANE: Chris Parczewski is with the chemical
engineering branch --
DR. SHACK: One or both?
DR. POWERS: Both, Bill.
DR. SHACK: Both.
DR. POWERS: Both. Because I am definitely beginning
to hydrolyze both ziconia and Uo2 in hot water in these situations, and
I get some very interesting chemistries going on in there.
DR. KRESS: And your interest in this chemistry is for
what reason?
DR. POWERS: Because it sucks things out of the water,
and I lose buffering capacity or I inject protons and I suddenly drop
the pH down.
DR. KRESS: Well, your interest in that is concern
over fission products -- trying to get this out --
DR. POWERS: In the end, my biggest concerns are going
to be in a partition of iodine.
DR. KRESS: Yeah, iodine fission in particular. And
if one had ways of measuring fission products directly, you wouldn't
worry about all that crap.
DR. POWERS: Well, if I measure the pH directly and I
measured the buffering capacity directly --
DR. SHACK: It's going to be interesting.
DR. POWERS: -- I could probably do lots of things
with the liquid fission product.
DR. KRESS: Lots of things with that, before you ever
get to the need to measure a fission --
DR. POWERS: That's it.
MR. O'BRIEN: Okay. I think we're understanding your
point there, that it needs to be something that's considered in our
review, and also, I take it, in the topic itself -- we need to consider
it. And I think we need to consider it in the context of its use during
an event.
DR. POWERS: There are other things to consider, as
well as, where does the regulatory need end and the licensee's
responsibilities pick up? I mean, he is responsible for accident
management. I think we have to bear that in mind as well.
MR. O'BRIEN: The next sample is the boron in the RCS.
That was considered for the potential for criticality and post-accident.
Westinghouse would like to have that relaxed eight hours after
state-table state is reached. And our review -- we have concluded
preliminarily, and these are all preliminary conclusion -- is that it
should be obtained and analyzed eight hours from the time of initiation
of the accident.
DR. KRESS: If you sampled and the boron was too low,
what would you do?
MR. O'BRIEN: From the business perspective, I would
certainly look to put in -- it depends on what systems you were looking
to put in if you were going to try to take action --
DR. KRESS: If you were going to try to add boron in.
MR. O'BRIEN: -- before you maybe started something up
or whatever.
MR. LOIS: This is Lumbrose Lois in the Ecosystems
Branch. You add some more boron, if you needed to.
DR. KRESS: It wouldn't just be an indicator that
there's likely possibility of criticality; you'd just go ahead and add
more boron?
MR. O'BRIEN: And I'd be sitting over here, and it
would be the licensee that would be making those determinations.
DR. KRESS: Would you add that boron whether you had
the measurement or not?
MR. LOIS: What?
DR. KRESS: Would you add that boron whether you had
the measurement or not, to see what the boron was?
MR. LOIS: You have to consider the scenario in which
you are at. You assume that you are in the primary boron at time of
cycle, and also whether or not you initiated separation from the water
storage tank.
DR BONACA: Reactor storage tank.
MR. LOIS: Water storage tank, which of course does
have a design circulation in there. But in addition to that, all plants
do have the capability to add boron in the RCS.
DR. BONACA: Although you would be probably more in
circulation more right now, you would be feeling from sump.
MR. LOIS: Yes, that's what I was trying to suggest --
area that you have define what point in the scenario and be able to
listen to scenario you're at.
In the extreme, assuming that you have significant
core damage, the requirements for boron are much, much lower because you
lost geometry, and therefore you lost capability. Therefore, you need
to find out where you are at.
MR. O'BRIEN: Okay, the last piece of the categories
of information is the radionucleides, which you get from the RCS, the
sump and from the containment atmosphere. Our review of that -- the
request is to remove that sample from the licensing basis.
In a review of it -- we're still looking at that.
We're looking at it closely, and I'll give you the reasons why. We're
considering its use in emergency preparedness, in feeding it the source
term assessments and then subsequently into protective action
recommendations.
When we discuss that, we're not talking about the
initial protective action recommendations, which are done on plant
conditions. You reach the general emergency conditions. There's some
default PARs that are implemented automatically and the evacuations, if
necessary, take place.
It's after that initial PAR, what licensees are required to
do is continue to assess the conditions of the plant, including any
releases or potential releases, to determine if those protective actions
are adequate or maybe need to be expanded.
What we are considering on that is the fact that these PASS
samples are three hours in arrears of the timing to make a decision to
do it, to take the samples, and we are looking at the indicators that
may be available to provide the same type of information, and the type
of information we are looking at is the isotopic concentration of what
may be released to the environment, and we are looking at how other
information could be used, including core damage assessment information,
field team monitoring information, and so forth, in trying to determine
how much we are losing if we accept the Westinghouse proposal to do
this.
DR. KRESS: In what timeframe would you need that kind of
information?
MR. O'BRIEN: The requirement for obtaining these samples
within three hours really defined a capability, what you needed in the
plant to be able to do that.
The time you take the sample is up to the decision of the
decision-maker in an emergency organization. He can decide to take it
right away. He could decide to take it a day later, depending on when
he thinks that information is needed, but the idea is when he decides he
wants that information it would be available in three hours and
therefore the equipment in the plant would be there to support that
analysis, so when you would need it depends specifically on the accident
that is in progress.
DR. KRESS: Okay.
DR. APOSTOLAKIS: Okay.
MR. O'BRIEN: I lied. I'll go to one extra slide and then
that will be it and I'll look for any questions.
There's three outstanding issues in our analysis right now.
One is related to the timing of the boron analysis where there is a
disagreement between whether it is eight hours after achieving a safe
and stable state, or eight hours after the accident initiation, and that
still needs to be resolved. I don't think that is going to be a major
issue but it needs to be resolved.
The other one we have to address in the Westinghouse Owners
Group document they talk about removing the PASS requirements from the
licensing basis but maintaining the capabilities, and we are concerned
as to what actually will be in the FSAR and so forth, and we need to
work that out to make sure we understand what our conclusions are
related to.
The last one, which is the one I just discussed, is the
radionuclide samples, and whether or not we feel that removing the time
to be able to obtain and analyze the sample within three hours is a
prudent thing to do, given what pieces of information you may be losing.
So just in trying to make my presentation as brief as
possible, I apologize if it is not as organized as I had planned.
DR. KRESS: I would say it was very good.
DR. POWERS: I thought that was good. We should have you
down more often. You did fine. Are there any other questions?
DR. KRESS: Seeing none -- I guess we turn the meeting back
to you, Dana.
DR. POWERS: Okay, thank you. We have an issue that has
come up with respect to the maintenance rule that we discussed last
year --
MR. BARTON: Last month.
DR. POWERS: It seemed like a year ago -- last month, where
there's some revisions and differences in particular language with
respect to how one goes about classifying systems as being either
risk-significant, highly risk-significant and of low risk significance,
and so we have an ad hoc discussion of that language and the controversy
surrounding it.
I am informed that a letter from the ACRS is anxiously
awaited by the Commission on this.
DR. SHACK: Gee, our last one was so definitive.
DR. POWERS: Yes, and they didn't seem to get the message
and so -- gentlemen, I hope that we can cover this topic in 30 minutes.
MR. KANE: We are prepared to do so. Let me introduce --
DR. POWERS: I think you are secure in knowing that we know
all of these gentlemen.
[Laughter.]
MR. BARTON: The usual suspects.
MR. KANE: My name is Bill Kane. I am the Associate
Director for Inspections and Programs with NRR, and actually it's been a
long time since I have been before ACRS.
I would like to just make a few preliminary remarks to set
this meeting in context and then we have a brief presentation to give
you.
We were asked by the Commission to go before them yesterday
to give a brief, not necessarily brief but a progress report on the
revisions to 50.65, the maintenance rule. In that discussion we
notified them of a recent change by the Staff that occurred after our
discussions with CRGR and ACRS for the need to provide some rule
language to clarify that the assessments that would be required would be
limited at least within the bounds of -- to not necessarily include
everything in the rule.
This was really precipitated by some public comments that
we'd received. It actually was always the intent and in fact I believe
the discussions that we had with you, that was the case, but we felt
that some anchoring language needed to be provided in the rule to make
this clear as opposed to just the statements of consideration and
regulatory guidance.
We advised them that the change was not discussed with the
ACRS formally and that we had preliminary discussions or at least
informal discussions to see if that was an issue and we got the
impression that we needed to discuss it further, so that was made clear
to them. Now the context of this is that they are expecting us to
provide them something on the 17th of May, which is the final version,
and I think they certainly want to have us talk to you about the change
and why we feel it is necessary and then a schedule of where we are
going, so we have for you -- that is the context of why we are here, and
then we have a brief presentation that we'll give you that Richard
Correia will go through. Also with me today is Frank Gillespie. Okay,
Rich?
MR. CORREIA: Thank you again for taking time to listen to
us again. We briefed you less than a month ago on what we believed at
that time was the final A(4) language for the maintenance rule. That is
why I titled this slide, "Modification to the Revision of A(4)."
[Laughter.]
DR. POWERS: And of course everything else is on A(4) but
the title is A(3), right?
MR. CORREIA: It is currently. It should be A(4). Thank
you.
This is the version of the rule that we shared with you last
month and actually in February also, which stated that all SSCs in scope
of the maintenance rule should be subject to a pre-maintenance
assessment.
We did explain though that we recognized that there is a
certain subset of systems in scope of the rule that contribute very
little or nothing to plant risk when taking out of service and we
proposed in our Draft Regulatory Guide a process to do assessments to
recognize these low and nonrisk SSCs and that a license could, once they
were recognized, not have to do another assessment, and that really the
scope of their assessments would be reduced to something that we
considered the most important structures, systems and components.
MR. BARTON: And at that time that all made sense to us --
those words plus your proposed revision to Reg Guide 1.160 meshed very
nicely.
MR. CORREIA: Right, and we still believe that.
MR. BARTON: I like to hear that.k
MR. CORREIA: The difference is the current modified
language is that we are making a statement that a licensee may limit the
scope of SSCs that would require this pre-maintenance assessment to
those that do a risk-informed evaluation process, having been shown to
be significant to public health and safety.
DR. APOSTOLAKIS: Isn't the word "significant" a relative
one? In other words, shouldn't you complete the sentence there by
saying "significant to public health and safety for the plant
configuration in which these activities take place."
MR. CORREIA: That is the intent of this. This would have
to be.
DR. APOSTOLAKIS: But why don't you say it? Would that
satisfy you, John?
MR. BARTON: That might help, as long as the words in Reg
Guide 1.160 stay as proposed and don't get changed, because the meat of
this whole thing is the Reg Guide, not in the rule.
MR. CORREIA: Right.
MR. BARTON: Because the Reg Guide really says what you need
to do to do the maintenance.
DR. APOSTOLAKIS: What is the page?
MR. BARTON: And it is page 3 in Draft Reg Guide DG-1082.
DR. APOSTOLAKIS: Do you have the paragraph?
MR. BARTON: Starts out with the scope of SSCs?
DR. APOSTOLAKIS: Yes.
MR. BARTON: The key here is about half way into the
paragraph there is a sentence that says, "The focus on the assessment
should be on the SSCs modelled in licensed PRA in addition to all SSCs
considered to be risk-significant by licensee's maintenance rule expert
panel. The assessment should also consider combinations of low safety
risk significant SSCs for planned maintenance that could result in high
safety risk significant situations."
That was also what we stated in our letter.
"To reduce the burden, the licensee may perform a one-time
assessment to identify low risk-significant SSCs in maintenance
activities" -- et cetera, et cetera, et cetera.
As long as those words don't change, these words are okay,
but if those words are what is intended to be used by licensees to
implement the rule, why doesn't the rule say that?
MR. CORREIA: We started writing different language in the
rule but what we found ourselves doing was taking the Reg Guidance words
and putting it in the rule and it became very lengthy, so we thought
rather than do that, this would acknowledge the fact that the scope
could be limited and just let this language serve as a bridge to the
Regulatory Guide, which would explain this process.
DR. APOSTOLAKIS: But would you change the Regulatory Guide?
Mr. Barton is happy with the way it is now.
MR. BARTON: Yes. What assurance do we have the Reg Guide
won't change between now and the time it gets issued?
MR. CORREIA: Oh, that's not a problem. If I can skip to my
last slide --
DR. APOSTOLAKIS: Would you do that?
MR. CORREIA: -- I guess there was never a doubt in my mind
that we would have to come back to the committee to discuss what we
believe is a closer version to the final version of the Regulatory Guide
and reflecting on the letter that you sent us April 14th recommending
workshops, we have incorporated this in our proposed schedule.
As you can see here, we would obviously need to modify the
Reg Guide to incorporate this language to make sure that it was
consistent, change that, come back to the committee, reconcile any
comments, issue for public comments, and have a workshop to make sure
that we have stakeholder feedback in this whole process.
As we told you in April, in my mind it is very important
that both the industry and our inspectors understand what this language
means and how it is to be implemented and inspected.
DR. APOSTOLAKIS: It seems to me that this paragraph has to
be revised anyway. I don't like words like "combinations of low
risk-significant SSCs that could result in high risk significant
situations." Then automatically they are not low safety significant
anymore.
MR. CORREIA: Let me explain --
DR. APOSTOLAKIS: You mean "low risk-significant as
specified by the PRA at power."
MR. GILLESPIE: Well, let me pull in some of the other work,
and you hit it exactly, George, and this got us into a discussion
yesterday in front of the Commission of the list of systems. The list
is not the point. Condition is the point.
DR. APOSTOLAKIS: Exactly. Exactly.
MR. GILLESPIE: So what we need to do is look at these kind
of words and get away from this plant has this list and this plant has
that list and by god, it's The List. It is the condition, and I
would key -- I have got circled in mine, because it gets in the back, we
have to work on what does significant effect really mean, because if you
look in the back it talks about CDF. Well, CDF is continuous through
the year and what are we talking about on a daily basis?
Because the Commission has some goals that we won't have at 10 to the
minus 3 condition, it's in our strategic plan, and if I take 10 to the
minus 5 and say 100 days, suddenly I'm in a 10 to the minus 3 condition,
which our strategic plan says we won't allow.
So there's some real places in here we have to do some work.
What's the daily limit in precursor kind of space, CCDF? And what's the
CDF limit, which is kind of a cumulative thing over a year? So we've
got some real clarification we have to work on this. And I think this
schedule recognizes that kind of aspect that we've got to bring into it.
DR. APOSTOLAKIS: I still don't understand, I mean, to make
it very, very clear, why don't you add those words or something to that
effect that I mentioned earlier here so there will be no
misunderstanding what you're talking about. That has shown to be
significant, and because most people automatically think of the PRA at
power, then you have all sorts of problems for the configuration during
which you have when you perform these activities. Then the regulatory
guide will really be constrained. They will have to address that.
DR. BONACA: I have just one more question at least
fundamentally. I don't know why we're here. Why is this last statement
being added? I would like to understand that. To me the licensee has a
burden to demonstrate himself that as he pulls out components or systems
out of service he can manage that safety of that configuration. Period.
And there is ample guidance within existing guidelines and management
rule and so on and so forth to limit that scope if there is a basis for
it. Why are we introducing this table? That's what I'd like to know.
Where is it coming from.
MR. KANE: Well, I can answer that. Again, it's as you say,
we made it very clear in the statement of considerations and in the
regulatory guidance that this is the approach that we were using. But I
personally believe, and I think we all believe, that some anchoring
language needs to be clear in the rule because after all it is the rule
that is the piece of paper that prevails, that there ought to be some
anchoring language in there that expresses as best we can. And I
appreciate, you know, the point that you made, to make clear that this
is the foundation for the development of the regulatory guidance as we
go forward, recognizing that we'll get many, many views, we got many
yesterday, we'll probably get many more on actually what are the precise
words that show up in this regulatory guidance.
That's why we developed, it will go out for public comment,
it will come back, public comments will be addressed, and it will be
reviewed again before it in fact goes final. And this is one of the
situations here with this rule that the rule comes first, the guidance
comes later, the implementation of the rule of course will wait the
guidance. But again, if you could go to that slide. So the answer to
your question is that as best as I can make it clear, is that some
foundation needs to be included in the rule we believe to express where
we're going and build the regulatory guide.
DR. BONACA: And the reason why I asked that question, this
is a definition of limitation. And, you know, on a generic basis I'm
somewhat uncomfortable about placing limitations to the responsibility
of individuals who are taking a system out of service on what they can
take out of service. I mean, they're responsible for assuring the
process provides a safe outcome. And so that was my simple objection.
I mean, when I see the statement that's a statement of limitation. It
may be accurate. It may support the process that is proper. But I
don't know. I'm not sure.
DR. APOSTOLAKIS: So what you're saying, Mario, is that the
requirement that the licensee shall assess and manage the increase in
risk is good enough?
DR. BONACA: Yes. I mean, that's the way it was. Right?
MR. BARTON: No, it wasn't that way, I don't think.
MR. CORREIA: The only change was that we added this last
sentence.
DR. SHACK: We took the structures and components within the
scope out.
MR. CORREIA: I'm sorry, yes, we moved the total scope of
the rule out, yes, saying that it may be limited.
But again, the process would define how that limited --
DR. BONACA: For me it's very hard to make a judgment
whether or not this limitation is implied limitation in the top
statement, okay, it's going to be in all cases, you know, provide a
sufficient protection. And that's why I said I would have liked to
leave it more general, because there are plenty of provisions within the
regulation to limit the scope based on assessments and so on and so
forth.
You know, when I see this statement, that to me says oh,
there's limitations, you can do less than.
I had just one comment, and some level of, you know,
question mark in my mind.
MR. BARTON: No, some people think that all you need to look
at is what's modeled in the PRA and what you'd list as a high safety
significant component or system. And that's a problem.
DR. BONACA: Yes.
DR. SHACK: With George's additions, you know, for the
configuration of interest it would solve that, wouldn't I?
DR. BONACA: And that's good.
DR. APOSTOLAKIS: There are actually two things, because,
see, that's a problem with concepts that are relative, like risk
significant. And I think John's concern touches on that, although he
does not express it that way.
Let's say you are at shutdown, and you do your risk
achievement worth calculations and Fussel-Vesley, categorize it. Now
typically I believe what we do there is do the components and structures
and systems one at a time. What Mr. Barton's concern is that even for
shutdown, so if you interpret the configuration at shutdown, when you
take out one system, then the risk significance of other systems may
change.
Is that correct, John?
MR. BARTON: Absolutely.
DR. APOSTOLAKIS: So he wants to see risk achievement worth
for perhaps combinations of components that may be taken out of service.
That's really the concern here, that even by taking out one component,
you have changed the configuration.
DR. SHACK: Yes, for the result of the configuration.
DR. APOSTOLAKIS: We typically don't do this, though.
Typically in a PRA we don't do this. We don't take two at a time, three
at a time, and say these are out, or if I set a probability of failure
equal to 1, this is the risk achievement worth.
DR. BONACA: And in fact the experience as the licensees
developed methods they were able to do that. There were a lot of
surprises out there.
DR. POWERS: That's right.
DR. BONACA: A lot of surprises. You know, some innocuous
system suddenly was becoming important because he has removed a couple
of lines of defense and now you are relying on that system for the
point. So --
DR. APOSTOLAKIS: Bill had a -- Bill, you wanted to state it
in a different way?
DR. SHACK: I just said for the resulting configuration.
DR. APOSTOLAKIS: Yes, that's exactly what it is.
MR. CORREIA: And we don't disagree with that position. As
Bill said, we thought anchoring, limiting scope language in the rule
would be a way for us to express that view, that not everything in the
scope of the rule is equally important. And there may be some that
don't.
DR. APOSTOLAKIS: Let me come back to Dr. Bonaca's point.
There may be -- although originally I was not really disturbed too much
until you sensitized me to it, Mario, by this sentence. It sort of
implies that you can -- well, it says maybe, of course, but the
significance with respect to risk is a way to do it.
We heard earlier from the fire protection people that what
they want is to make sure that they will have a path that will guarantee
shutdown given a fire. This is a very different way of approaching it.
You don't care anymore about the risk significance of anything. You
don't care anymore about combinations, at least at this level of
components being out of service, because you say I want this path to be
available, or I want these two paths to be available. So you get away
completely from the risk significance of SSCs. Right? Because now
you're talking about paths.
And that may in fact be a better way of doing it, because
now I don't have to worry about taking two at a time, three at a time,
out and calculating their relative risk worth. And maybe by putting
this sentence there you're leading people to do a certain analysis in a
certain way.
DR. BONACA: Yes.
DR. APOSTOLAKIS: In the regulatory guide you may elaborate
on these things if you wish.
MR. CORREIA: And obviously the regulatory guide would have
to reflect methods --
DR. APOSTOLAKIS: Yes.
MR. CORREIA: That would allow different options.
DR. APOSTOLAKIS: But I think the tendency has been in the
last couple of years to really base just about everything on risk
significance, and we forgot the original idea of accident sequences or
success paths.
MR. BARTON: Go ahead.
DR. BONACA: No, you go ahead.
MR. BARTON: I'm going to change the subject.
DR. BONACA: To me that statement, the scope of the
assessment, two structures, a risk-informed evaluation process as shown
to be significant. It doesn't say two at a time or three at a time, it
says one at a time. You have performed somewhere an assessment that has
ranked the systems. And I've never seen any ranking of systems done by
random choosing ones that you pull out. There is no way to do so. So
you're going to rank them by looking at them, achievement worth, by
pulling them out one by one.
Now when you say that, then it's like a license to say okay,
with the ranking now if I take out some system or component that is not
in the ranking or high in the ranking, I can do it without performing an
evaluation that sums up all the components out of service. That's what
I read in that.
MR. CORREIA: We state in the regulatory guide we're
concerned with the individual or combination of SSCs that are shown to
be risk significant. The combinations obviously is the stated purpose
of this regulation. The need to understand, assess, and manage the risk
due to that combination. Absolutely.
Licensees have already ranked individual systems regarding
their contribution to safety of risk, and that's what Mr. Barton was
referring to. That is one subset. But again that was done on an
individual basis, and we agree, it's the combination that needs to be
assessed and understood and properly managed. And obviously the
regulatory guide will have to be robust enough to reflect various
options of doing that.
DR. APOSTOLAKIS: I think you need in the regulatory guide a
very short tutorial as to what risk significance means, because if you
take it for granted now that it means a specific thing, and when you get
into this you have to revise your thinking. Maybe a paragraph or two.
MR. CORREIA: I understand.
MR. BARTON: Rich, what's the reason for the reference to
CRMP?
MR. CORREIA: There is no reference.
MR. BARTON: It's on this modified package we got, modified
A4 provisions, new wording, Commission briefing paper.
MR. CORREIA: Oh, yesterday.
MR. BARTON: One of the bullets on there is the CRMP.
What's the intent of --
MR. CORREIA: What we thought was CRMP already for technical
specification purposes, RE has a methodology for evaluating --
MR. BARTON: But its scope is limited.
MR. CORREIA: Its scope is limited.
MR. BARTON: Very limited.
MR. CORREIA: Right. And we recognize that.
MR. BARTON: Okay.
MR. CORREIA: And it may not be -- I think the issue comes
back to what is modeled in the PRA and is that the right modeling. We
understand that. And obviously -- and I think we have some language in
our draft guide that refers to the adequacy of the PRA model to make
sure that it captures all the right SSCs.
DR. APOSTOLAKIS: Now I mentioned earlier the success paths.
Don't pay too much attention to it. Because there would be many of
them. I mean, you really worry about the increase in risk. So if the
core damage frequency goes to 10 to the minus 3 or 2, you still have
success paths, I hope.
[Laughter.]
MR. GILLESPIE: To have it not be 1, you need at least one
success path.
DR. APOSTOLAKIS: So I'm not sure that that's -- that's
going to be much more analytical work than working with --
MR. GILLESPIE: It sounds like one of the hang-ups we have
here is the words has kind of a past tense to it, "has been shown," I
think, or that's what you were bringing up, that the analysis may have
not yet been done, and therefore it has been shown. I hadn't thought
about the tense that we used in it, but --
DR. APOSTOLAKIS: How about if you say the scope "is shown"?
DR. SEALE: Shows.
MR. GILLESPIE: And I'm sitting here staring at it, and the
tense of the verb --
DR. APOSTOLAKIS: Oh, shows. Yes. Yes.
MR. GILLESPIE: Leads to the problem you're talking about, I
think.
DR. BONACA: But still, you know, the scope of the
assessment may be limited. This just implies that what you're putting
in in the evaluation still is limited.
MR. BARTON: Or you can interpret that to say the scope of
this assessment you only have to do to those systems, structures, that
have risk significant evaluations significant to public health and
safety, so you only have to look at high risk significant stuff. Right.
Could I interpret it that way? And I've got a problem with that.
DR. POWERS: And demonstrably unjustified.
DR. APOSTOLAKIS: I didn't follow that. That what?
MR. BARTON: You can interpret that to only have to look at
high-risk-significant stuff.
DR. BONACA: Yes, that's what it says. And you can change
the --
MR. BARTON: And then I've got a problem, because now I'm
back, the only thing that's saving me is what's in the reg guide that
says I've got to do more than that.
DR. POWERS: And the reg guide can change.
MR. BARTON: And the reg guide can change.
DR. APOSTOLAKIS: But for the resulting configuration they
will not be significant any more. I mean, that's your concern, that
they may become risk significant.
DR. SHACK: Right, but I mean if you added for the resulting
configuration to that sentence.
DR. APOSTOLAKIS: Yes, that's what I'm saying, if you add --
MR. CORREIA: Again, the assessment is of the proposed
maintenance activity, 1, 2, 3, whatever it is they're removing from
service and understanding what that configuration does to plant risk.
DR. BONACA: But again the evaluation has to look at all of
them in the aggregate.
MR. CORREIA: Initially, well, without stating it, it
implies that the whole scope of the rule has to be considered, or any
system in the scope of the rule.
Then there is a possibility of some further evaluation.
Some may be eliminated from further assessment. That was the intent.
DR. BONACA: As you see, I mean that would be the biggest
disservice to the operator. He doesn't know what people are pulling
out, I mean if he approves it. But the fact is, he doesn't get any
insights that, in fact, he shouldn't allow for some system to be out of
service.
DR. POWERS: I think that is a singularly important point to
make. This is a disservice to the operator. He really does get
inundated with people wanting to pull things out and he has to make a
decision on the fly, limited amounts of -- I mean it is guided by
intuition and judgment.
MR. CORREIA: But it does have to be as shown because I
could well imagine that people will have a set of configurations that
are of interest to them and they will do the PRA once and for all, and
for those configurations, they will have an assessment.
SPEAKER: And the existing guide allows that one time
approach.
MR. CORREIA: Right. Just when we were talking about shows
versus as shown up here.
DR. POWERS: But I think it is okay, Bill, and it still -- I
think it is all right to have a set of configurations that you have
evaluated because you know you get into it every single outage that you
have.
MR. BARTON: That is a reasonable thing to do.
DR. POWERS: And still -- and that still shows that this is
of modest risk significance. So I think shows still works here.
Do you have more you are going to tell us?
MR. CORREIA: No, I have already shown you the schedule.
Obviously, we will be back here with the Reg. Guide at least twice more.
We would hope that we could have some of your staff's involvement during
the workshops, that is very important, too. But we appreciate the
opportunity again.
DR. POWERS: Well, we thank you for taking the time to come
down here on our emergency mission here.
MR. CORREIA: Thank you.
MR. GILLESPIE: We appreciate you having the emergency
mission.
MR. KANE: We hope this helps and I appreciate the comments.
MR. GILLESPIE: The feedback, that was very helpful.
DR. POWERS: Thank you. Gentlemen, I am going to take --
MR. SINGH: NEI also has a presentation.
DR. POWERS: We also have -- Tony has disrupted his
schedule, which I am assured is very, very busy, and come down to help
us with our emergency mission here. So, Tony, the floor is yours.
MR. PIETRANGELO: Thank you for the opportunity to come down
and chat with you about this. You have seen the letters we have sent
the NRC. We were proponents of reflecting in the rule the actual intent
of the staff and the Reg. Guide to focus on the most SSCs when they do
configuration assessment.
I wanted to ask a couple of questions of the ACRS, though,
because I think some people don't know what the full scope of the
Maintenance Rule is. Would I do an assessment when my emergency
lighting comes down, if I have to replace a light bulb on that system?
Would I do it on a gaetronics box in the plant?
MR. BARTON: You are giving me a list of what, low risk or
non-risk significant components?
MR. PIETRANGELO: Well, my point is that the scope of the
Maintenance Rule is quite broad, and given that broad scope, licensees
undertook a risk significance evaluation in the implementation of the
rule to try to focus on the safety significant SSCs. I think in a
perfect world, everybody wants to consider every combination that would
be potentially risk significant in the plant, but at some point you have
got to say, there are some things I need to focus on that are the most
important.
DR. BONACA: Can I just say one thing? But the rule allows
you, in fact, the flexibility to have a superficial evaluation that has
to be done, if in fact you have a lighting system. I know you have to
do -- say, not only to do it anymore. I mean that is as flexible as the
rule is, so I would like precise that.
MR. PIETRANGELO: Well, in discussions with the staff, I
mean it is not readily apparent that it is as easy as that, Dr. Bonaca,
either, in terms of documentation, in terms of combinations.
DR. POWERS: I thought it was very explicit. There is no
documentation on those things.
MR. PIETRANGELO: No, that is not explicit. That is not
explicit.
DR. POWERS: It was my reading that -- in fact, when we
asked him about that explicitly -- do they have to write something down,
even in the log book on that? And the answer was no.
DR. BONACA: It was an answer from the staff to a question
that said there is no documentation requirement. In fact, I had a
concern with that, but we left it that way.
MR. PIETRANGELO: Okay. Well, I am getting new information
now, too, because we did have an interaction with the staff last summer
as we were trying to revise the guidance.
MR. BARTON: We were concerned about that, too. You brought
up some examples, all right, of issues that you wouldn't look at as part
of your overall maintenance.
MR. PIETRANGELO: Right.
MR. BARTON: Because they had -- they are no-never-mind,
they are not risk significant. We asked the staff, would you have to
document that? Well, the answer we got was, no, we would be looking for
-- since it is a performance-based rule, we would be looking for the
licensee's program, procedures or how they are going to implement this.
Right.
MR. PIETRANGELO: Right.
MR. BARTON: We wouldn't be looking down in the grass.
Because the problem I have got is when you look at -- and you gave some
examples of non-risk or low risk significant components. But each
licensee has got these things broken down different. There is different
systems classified that way. And some licensees have got some pretty
significant systems that are in direct support of ECCS and other safety
systems that they classify as low risk.
And if you say if I don't have to look at those in
combination with, quote, the other systems, that is when I think I start
having a problem. When you say reactor water cleanup, intermediate
range, all neutron monitoring systems, rod position indicating systems,
source range monitor and feedwater control, there is one plant that all
stuff is non-risk significant. Are you telling me I don't have to look
at any of that because I am taking out a RHR train or something?
I got to look at it. So I just can't look at the high risk
significant. That is the issue that we are struggling with.
MR. PIETRANGELO: And what we are saying is that you have to
look at the whole process that has occurred here. First of all, you
have got tech specs as backstop in place. Those are not going away.
Okay. Secondly, you have got what was done in establishing the high
safety significant within the Maintenance Rule, it was put through an
expert panel.
I think a lot of the considerations that you just mentioned
were taken by those experts panels when they got down to the scope.
Okay. What we are concerned about is having to justify kind of finding
the needle in the haystack of low safety significant things that -- I
mean I could go through and find and put together a combination probably
that would result in something significant. It is not saying that what
has been done thus far precludes that from happening. But I think this
perfection for looking for any combination of low safety significant is
in the way of the good, which is being done in the field.
The regulatory analysis that was done to support this rule,
I don't know if that was looked as part of the ACRS review, doesn't
incorporate any additional licensee activity because voluntary programs
are already in place for this activity.
And so what is the incremental benefit of going -- I mean
there is safety -- a safety standpoint, and what is the cost of going
that extra -- looking for these low safety significant combinations? I
am just saying that work has not been done. And we know -- and there is
a history associated with the Maintenance Rule that kind of colors some
of the discussions we have had. And when you say the staff won't
question what -- they just want to look at your process and procedures,
well, during the baselines, they did question and wrote violations
against what the scope was.
MR. BARTON: I know they did. I understand that.
MR. PIETRANGELO: So to say that can't happen and won't
happen, and given that the rule is performance-based and somewhat vague,
you have to hang your hat on what is in that regulatory guidance and
what is interpreted. So we are not starting from a clean sheet of paper
here either.
I think our objectives are the same, though, in that no one
wants to put the plant in unmanaged or unassessed configuration. We
believe the rule should require awareness and should require action
appropriate with that.
And one of Dr. Bonaca's remarks, I think -- you said
something that struck home with me. In the original proposed words by
the staff, it was before performing maintenance activities on
structures, systems and components within the scope of the rule. You
could take out, I guess, mention of SSCs. I mean we have been focused
almost with blinders on on scope maybe for too long, instead of looking
at what the configuration is. The concern is that you place the plant
in an unassessed configuration and the focus has been on -- am I looking
at this big scope, or am I looking at a smaller scope that I know will
have significant impacts on plant risk?
So, I mean just the fact that we had to get to a scope
argument in this provision, I think that is the first time I heard it
said that way, and it makes me think longer about it.
But the other point I would like to make is that -- and I
think George noted that it was in the Commission slides yesterday, that
the staff has approved configuration risk management programs for
risk-informed allowed outage time extensions. And in that Reg. Guide it
says it was the intent of those programs to meet this particular portion
of the Maintenance Rule. And the scope of that CRMP is --
MR. BARTON: Is limited.
MR. PIETRANGELO: -- the high safety significant SSCs
identified under the Maintenance Rule, as well as what is modeled in the
PRA.
Now, I don't know --
MR. BARTON: Of these 50 systems of low safety significance,
how many are modeled on the PRA?
MR. PIETRANGELO: I think -- our understanding is probably
20 to 30 percent of the plant systems.
MR. BARTON: Six. Now that doesn't tell me there is a heck
of a lot of scope that I would have to look at if I was following a
CRMP.
MR. PIETRANGELO: But I would also ask you to put some
combinations together and tell me what would be the significant impact
of those. Okay.
MR. BARTON: There are some.
DR. BONACA: Well, I have seen some spiking, okay. We have
done it for years and I know that it wasn't very time-consuming once we
had a way to do it. And, second, that you got startling increases and
all you had to do was to shift an activity by eight hours and it was
plenty acceptable to the maintenance department and then the whole risk
profile was getting flat through time. Okay. That is what managing
risk seems to me. And I would like to see some success there before we
have all these provisos, because, also, I mean there has also been
experience in some plants where there were full trains taken out of
service and do maintenance on, so there has been the other excess, you
recognize that.
MR. PIETRANGELO: I understand.
DR. BONACA: So, you know, I don't think these plants were
designed for online maintenance. I think we want to get there, and the
way to do it is to do it right. And today we have the tools to do it.
But -- and the bigger issue, as we pointed out before, is you are doing
a disservice to an operator if you are convincing him, and he can't have
eyes all over the place, that you can take out of service three, four,
five components or systems and he says, okay. Yeah, he looks at his
charts, and he looks at everything and it looks okay. And now you are
putting him in a condition where he gets into trouble and maybe we could
have told him that he shouldn't have done that, because there was a way
to do it.
MR. PIETRANGELO: Yeah, but on the same token, I also don't
want to distract the operator to perform a required assessment under a
regulation on something that isn't going to matter. I mean that doesn't
help the operator either.
MR. BARTON: That's true.
MR. PIETRANGELO: So there is a balancing there. And,
again, the objective and intent is the same here, is to do it right,
okay, and to get people to focus on the right things. But we don't --
and from a licensee's implementation perspective, we want, I think as a
principle of going into this, a bounded scope. And I think that is
fundamentally different from what I hear you all saying. And that is
unfortunate, I think. But we think you can bound what you need to look
at in these assessments such that you don't distract operators
unnecessarily, yet appropriately consider and manage the risk of doing
online maintenance.
DR. BONACA: You see, for example, however, let me just say,
if you read 50.59, you have support systems that are not safety
significant. And yet, if you make a change there, you have got to
perform a safety evaluation. There is a burden that is much larger than
assessing the significance of taking that component out of service for
maintenance, where it is much more important than, in my book, than just
going through the 50.59 process.
MR. PIETRANGELO: Right.
DR. BONACA: So all I am trying to say is that we are trying
to limit so much the scope and, you know, the point that John made, that
Mr. Barton made about the list and only six of them being -- that list
of the systems that are so-called non-safety significant. I mean it is
an issue.
MR. PIETRANGELO: Well, again, we know there is one thing
that the staff has approved that says -- meets this intent. What we are
looking at is whether -- what licensees have already done to establish
the high safety significant SSCs, how that matches up with what is
modeled in the PRA.
I think the staff would tell you from their experience in
the baseline, they are pretty satisfied with people using the tools that
are out there today, the risk monitors, even the matrices. Okay. They
have limitations. You still need to have some judgment associated with
that. But all we are trying to do is get a rule that allows us to use
the tools that we have, not that we don't have. Okay. And if they want
it to go beyond that, then that ought to be assessed for the incremental
safety benefit in the regulatory analysis, as well as the additional
cost of implementation of that. That is our only point.
DR. POWERS: Are they are any more questions for Mr.
Pietrangelo?
[No response.]
MR. PIETRANGELO: Thank you for the time.
DR. POWERS: Thank you. Well, we now come the dilemma we
face, I think we are complete with transcription.
[Whereupon, at 4:20 p.m., the open portion of the meeting
was concluded.]

Page Last Reviewed/Updated Tuesday, July 12, 2016