466th Meeting - October 1, 1999

UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
MEETING: 466TH ADVISORY COMMITTEE ON REACTOR
SAFEGUARDS (ACRS)

U.S. Nuclear Regulatory Commission
11545 Rockville Pike, Room T-2B3
White Flint Building 2
Rockville, Maryland
Friday, October 1, 1999
The Committee met, pursuant to notice, at
8:30 a.m.
MEMBERS PRESENT:
DANA A. POWERS, Chairman, ACRS
GEORGE APOSTOLAKIS, Vice-Chairman, ACRS
THOMAS S. KRESS, ACRS Member
MARIO V. BONACA, ACRS Member
JOHN J. BARTON, ACRS Member
ROBERT E. UHRIG, ACRS Member
WILLIAM J. SHACK, ACRS Member
JOHN D. SIEBER, ACRS Member
ROBERT L. SEALE, ACRS Member
GRAHAM B. WALLIS, ACRS Member. P R O C E E D I N G S
[8:30 a.m.]
DR. POWERS: Let's come into order.
This is the second day of the 466th meeting of the Advisory
Committee on Reactor Safeguards.
During today's meeting, the committee will consider the
following: proposed resolution of generic safety issue 23, reactor
coolant pump seal failures; status of the proposed final amendment to 10
CFR 50.55(a), codes and standards; reconciliation of ACRS comments and
recommendations; strategy for reviewing license renewal applications;
proposed regulatory guide on design basis information; and proposed
resolution of generic safety issue B-55, improved reliability of target
rock safety relief valves.
The meeting is being conducted in accordance with the
provisions of the Federal Advisory Committee Act.
Dr. Richard P. Savio is the designated Federal official for
the initial portion of the meeting.
We have received no written comments from members of the
public regarding today's session.
We have received a request from the Nuclear Energy Institute
for time to make oral statements regarding proposed final amendment to
10 CFR 50.55(a).
In addition, we have received a request from the
Westinghouse Owners Group for time to make oral statements regarding the
proposed resolution of generic safety issue 23.
A transcript of portions of the meeting is being kept, and
it is requested that the speakers use one of the microphones, identify
themselves, and speak with sufficient clarity and volume so that it can
be readily heard.
Before we launch into the session, I will ask if any of the
members have any opening comments they want to make.
[No response.]
DR. POWERS: Seeing none, I guess we'll move to the first
topic on the agenda, which is the proposed resolution of generic safety
issue 23, reactor coolant pump seal failures.
Professor Wallis, can you lead us through this issue?
DR. WALLIS: This issue is about 20 years old.
It started in 1980 because there was experience with a large
number of pump seal failures at nuclear power plants during normal
operation, and the leak rate for a major seal failure can be several
hundred gallons per minute, and if this occurs at one or a number of
pumps, this constitutes a small break LOCA which has a potential to
uncover the core in a few hours unless appropriate actions are taken.
Now, since then, there have been improvements in several
things. One is in the materials of pumps seals, and one is in the
reliability of methods for cooling them. Very often, the seals fail
because they are not adequately cooled.
As a result, there have been very few experiences with major
pump seal failures. I think we need to get straight what that
experience is, but I understand that, over the past 10 years, there have
been no significant pump seal failures, and the staff has essentially
determined that there have been so many improvements that this is no
longer a generic safety issue, although there may be some plants that
have perhaps not installed the materials or not made the improvements in
their cooling system, so they might still require attention.
So, probably on this basis, on the basis of determining --
also on the basis of risk analysis of this issue, it is probably
appropriate for this GSI to go away.
Now, there are still some technical questions we may want to
ask about, such as how many of these improvements have really been made
and how many plants remain that require attention.
There seems to be some question about what is the real flow
rate we're dealing with. You will see numbers of 182 and 300 gpm, but
if you go over the Westinghouse analysis, you'll see something around
480 gpm and so on. So, we might want to ask a few technical questions.
But essentially the case is there haven't been failures,
there have been improvements, this is no longer a generic issue, and
risk analysis shows that only very few plants require attention and,
therefore, this should no longer be a GSI, and John Craig is going to
get us started.
John, are you ready?
MR. CRAIG: Good morning. Yes.
While Jerry Jackson and Art Buslik come up to the front of
the room and get ready to make the bulk of the presentation, I'd just
like to add a couple of comments to the remarks that you just made.
This was an issue that was identified, in fact, some 20
years ago, and as a result of some staff work, we developed a model that
was based on work that Westinghouse had done, a considerable amount of
work in testing for their reactor coolant pump seals.
We built on that and the model that resulted, is referred to
as the Rhodes model, which is conservative, and you'll hear how we're
going to use that in some plant-specific analysis.
The staff proposed a rule that the Commission, for reasons
that Jerry and Art will go into, said that we should not move forward
with because of plant-specific considerations, that it was not generic.
There were other generic issues that were tied into this,
this generic issue, one related to station blackout, one related to loss
of cooling water systems for the reactor coolant pump seals, and you'll
see, I think, why those issues -- or how we're addressing those largely
as a result of plant-specific analysis.
This is an activity that's been coordinated closely with
NRR, and as we get to the end of the presentation, you'll hear about
continuing reviews and some plant-specific -- more in-depth
plant-specific analysis that will be conducted for some number of plants
that we expect to be in the neighborhood of about 10.
Following the results of those analyses, NRR will make
determinations about plant-specific back-fits.
So, with that as an introduction to -- and I agree with the
characterization that Dr. Wallis made -- that was originally perceived
as plant-specific, as we look at it more and more closely -- or as
generic -- more closely, there are plant-specific questions and
approaches, largely form the basis for the resolution of the issue.
So, with that, I'll turn it over to Jerry Jackson.
MR. JACKSON: My name is Jerry Jackson. I'm with Office of
Research, and the other two presenters will be Mark Cunningham and Art
Buslik.
I'd just like to quickly go through what our agenda will be
this morning, what we intend to cover.
We're going to have a short introduction and background.
Then we need to go into some discussion about how reactor coolant pump
seals are cooled, and then the bulk of the presentation will be
plant-specific analysis and risk considerations that we will get to
then, followed by a conclusion.
As was already mentioned, as John had already mentioned, the
reactor coolant pump seal failures that we had a concern about were from
the normal operation failures early on, when the issue was first
prioritized, and since that time, as has been spoken about, these have
improved, but even early into the issue, concerns began to develop about
methods of loss of cooling that would affect the seal failure, and these
were station blackout or component cooling water or service water, all
of which you will see later support the cooling of the seals, and so,
therefore, the bulk of the concern that the staff had has shifted to a
loss of all seal cooling and how that can affect or cause seal failures.
This led the staff into a number of research areas to
determine how the seal would behave under a loss of cooling event,
because the seal is designed to be cooled at all times.
Our first -- the first concern that was had were for the
soft materials, things like O-rings and so forth, that could fail under
high temperature. If the seal cooling were not available, then they
would be subjected to the reactor coolant temperature, and they could
fail.
Further -- and in this test, we identified -- at least in
the Westinghouse seal -- that some of the earl O-rings that they used
would, indeed, most probably fail. Since then, they have developed new
materials, improved materials, and tested them for those conditions.
Also, this led us to concerns about the hydraulics stability
of the seals, what will be referred to later on as a popping open, the
seal instability -- on loss of seal cooling, if you have flashing to
occur between the seal faces that can cause the mechanical seal faces to
actually open wide and allow a large leak rate, and after doing this
research, we developed a seal model that will be referred to later as
the Rhodes seal model, and it was based on -- primarily on the
Westinghouse seal model, with modifications that the staff thought were
necessary to the model to make it what we believe would be more
realistic.
DR. WALLIS: I think the Rhodes seal model is essentially a
risk model, not a hydraulic model. It draws on some other estimates of
thermal hydraulics.
MR. JACKSON: Right.
DR. WALLIS: The Rhodes model that plays such an important
role in your work essentially is a risk model.
MR. JACKSON: That's correct.
DR. APOSTOLAKIS: What does that mean?
MR. BUSLIK: That means basically that it's a set of events
with their probabilities -- events, timing, and probabilities.
DR. APOSTOLAKIS: You will talk about it today?
MR. BUSLIK: Yes.
MR. JACKSON: We'll talk about that in a quite a bit of
detail.
This led us to propose a generic rule that would be applied
to all the PWRs in 1994, and this rule was sent to the Commission, and
it basically said that the licensee should take action to reduce the
dependencies to ensure core cooling given a seal failure or demonstrate
that the risk from seal failures were sufficiently low that no further
reduction would be justified, and in 1995, the Commission took up this
rule, and in their SRM of March 31, '95, they disapproved putting this
rule out for -- to the public, and they gave as reasons, there was
insufficient basis for gains in safety, and they also believed this was
not a generic problem, that it was very plant-specific, and they had
concerns about the model that the staff used in coming up with their
risk numbers, and then they also pointed out that the industry was
addressing many of these concerns through their IPE program.
I'd like to put up this morning just one diagram to
illustrate a little bit of what we consider the important aspects of
this, not only that the seal -- the seal, as I mentioned before, needs
to be cooled at all times, and the seal is cooled by two different
methods.
You have seal injection flow that comes in that's provided
by the charging pumps, which are also cooled by component cooling water
or service water, and this comes in in the orange here.
It's higher pressure that the reactor coolant. This is the
pump shaft in this area, and reactor coolant in the schematic is here.
So, injection flow comes in at a higher pressure flowing
down along the shaft and blocking the flow of hot reactor coolant.
DR. WALLIS: What is that big pipe at the bottom?
MR. JACKSON: This is the schematic that represents the
second method of cooling, which is component cooling water, to a heat
exchanger that surrounds the shaft. This is -- in the Westinghouse
model is referred to as the thermal barrier.
So, you have two methods of cooling the seals -- the
injection flow which actually cools the seals and blocks the flow of hot
reactor coolant from coming up the shaft, and in the event that you lose
seal injection, then you still have component cooling water through this
thermal barrier, and when you lose seal injection, then you have hot
reactor coolant flowing past the thermal barrier heat exchanger and
cooled by the thermal barrier heat exchanger.
The flow then passes through the first-stage seal. In the
Westinghouse design, this seal takes up almost all of the pressure drop.
It goes from about 2,250 pounds per square inch of cooled water,
charging flow, and drops down to about 50 pounds pressure on the back
side of the seal.
So, the number two seal is just designed as a backup. In
the Westinghouse seal, the number one seal provides the primary sealing
flow.
If you lose all cooling in the hot reactor, coolant flows up
through the seal. There's a couple of ways that failure can occur.
There are O-rings that are critical, like this one that's
shown here, that can blow out due to the high temperature, and the seal
balance -- it's balanced depending on the pressure above this floating
stationary ring, a downward force there.
Opening force is balanced, comes from the flow and the
pressure drop through the seal.
If flashing occurs when the hot reactor coolant comes up
through the seal, when you've lost cooling, then there's a possibility
that the pressure distribution will cause this floating seal ring to
move up and open this face very wide, and that's what leads to the large
leak rates.
And the point we want to make primarily here, though, is
that you have two methods of cooling, and even the injection flow is
dependent on the component cooling water and the service water, as well
as, I think, high-pressure safety injection system, too.
With that, I think we'll go into the risk considerations,
and I will turn it over to Mark Cunningham.
MR. CUNNINGHAM: As John Craig alluded to earlier, the
original basis for the GI-23 was kind of the spontaneous failure of
reactor coolant pump seals.
Over time, it's evolved, and we recognize now that there's
actually a couple of other issues that are more critical, at least from
a risk context, about seal performance.
In particular, they deal with the issues of station
black-out-induced seal failures or losses of component cooling water or
emergency service water failures.
DR. WALLIS: Mark, could you clarify the matter of the last
10 years?
My notes of our subcommittee meetings said there had been no
seal failures in the past 10 years, but I understand it's not really no
seal failures, there have been some, but they haven't been of any
significance or something? What sort of failures have occurred?
MR. JACKSON: We looked back through -- we looked back at
the data, and we can find no seal failure since 1980 that would come
anywhere near challenging the normal charging system.
There have been no seal failures whose leak rate has been
above 100 gallons per minute. So the normal makeup would be able to
take care of that.
DR. WALLIS: There have been failures of some sort.
MR. JACKSON: There have been failures.
DR. WALLIS: Which involve what, the O-rings or what?
MR. JACKSON: Not necessarily, because our concern now is
primarily with seal cooling. Most of the failures are failures that
occurred just during the normal operation of the seal.
DR. WALLIS: Not loss of cooling water in some way?
MR. JACKSON: Not necessarily. They're not necessarily
cooling water events, loss of cooling water events.
DR. UHRIG: If you have that type of leak, do you consider
operation, 100 gallons per minute?
MR. JACKSON: No. The recommendations, of course, would be
to close down.
DR. UHRIG: As soon as practical?
MR. JACKSON: They have procedures for shutting down in an
orderly fashion.
MR. CUNNINGHAM: Jerry made the point earlier, these seals
are designed to be cooled. If you've lost the cooling to them, you
don't want to operate the pumps, basically.
From a risk standpoint, the spontaneous failure of reactor
coolant pump seals, in effect, is a small LOCA, and the original concern
was does this dramatically change our perceptions on the frequency of
small LOCA from spontaneous failures?
DR. UHRIG: Remember we had a lot of problems with seals
during startup back 20 years ago.
MR. CUNNINGHAM: Yes. That's related to the genesis of this
issue, if you will.
DR. UHRIG: Yeah.
MR. CUNNINGHAM: Again, over time, we've looked at it a
little more differently and come up to the point now that the interest
from a risk standpoint is a little different.
The interest is do you have initiating events that can lead
to seal failure and compromise the ECCS system that's used to cope with
the small LOCA, and that's where the station blackout and the loss of
CCW and ESW comes into play.
In the station blackout rule and things like that, it is
recognized that you don't have ECCS. The difference here is, if you
have seal failures, the rate by which you lose coolant from the system
can go up much more than you expected.
So, the issue then is, has the basis for the station
blackout rule somehow been compromised by our understanding of seal
performance, and this was recognized in the station blackout rule that
said that we'd come back at some point once 23 started to be -- had a
better understanding on 23 and say do we have a reason to question the
station blackout analysis?
So, the first thing that Art will talk about is the
evaluation of the implications of closure of this issue on the station
blackout rule.
The second part, then, is related to loss of CCW and ESW.
Again you have a situation here that these losses of these systems can
cause -- compromise the reactor coolant pump seals by the mechanisms
that Jerry was talking about earlier, where you've lost the capability
to cool the seals.
In some plants, in some designs, CCW and ESW are also used
to cool the charging pump bearings or a variety of things like that so
that you can -- a loss of CCW can, again, also cause failure of ECCS.
So, it's, in a sense, a common-cause failure that's much
more significant than the spontaneous losses of seal cooling.
So, the second part of Art's presentation is going to be
discussion of the loss of CCW and ESW systems. He's gone through some
review of different plant designs to see what the implications of this
might be, and what you'll see is there's a fairly broad -- the issue
becomes very plant-specific on the issue, based on the design of the
pump seals, on the design of the CCW systems and that sort of thing, and
Art will go through that now.
MR. SIEBER: I have a question. I have heard folks talk
about disaster bushings. Is there such a thing, and what is it and
where is it?
MR. CUNNINGHAM: I'm sorry?
MR. SIEBER: Disaster bushings, which is intended to close
the clearance in the seal package. Have you heard about that?
MR. JACKSON: There's flow limitations that are built into
the seal. They're called -- maybe the Westinghouse person in the
audience might address those. The name escapes me now, but yes, I've
heard of those.
DR. KRESS: Are you talking about the labyrinth seals?
MR. JACKSON: Labyrinth seals. Yes, the labyrinth seals
limit the flow somewhat through the seals.
MR. SIEBER: But not all plants have that, right?
MR. JACKSON: All plants, I think, have a labyrinth seal.
MR. TIMMONS: My name is Tom Timmons from Westinghouse.
The concept of a disaster bushing is something that has been
looked at but has not been installed on any Westinghouse plants.
What Jerry was referring to is a labyrinth seal, which is
tortuous path between the shaft and a clearance on the casing, which
limits the flow up through the thermal barrier heat exchanger into the
seals in normal operation or on loss of all seal cooling.
MR. SIEBER: Thank you.
DR. WALLIS: I have a question I'll raise at this time.
Mark, you mentioned common-cause failures, and you spoke
about component cooling water loss.
Now, I read all the stuff that came to me, and nowhere could
I find how many of these seals -- you talk about the seals or seal are
mentioned, but there's never anything in the literature about how many
pumps are affected, and you've got -- this flow rate is quoted, but
presumably it's a flow rate per pump.
Is there some common-cause failure where you lose cooling
water, you lose it to all the pumps?
MR. CUNNINGHAM: That's correct, and that's built into the
Rhodes model.
DR. WALLIS: Then you have to multiply the 500 gpm by four.
MR. CUNNINGHAM: That's correct.
DR. WALLIS: You will address that?
MR. CUNNINGHAM: We will talk about that.
DR. WALLIS: I didn't find that in any of the literature.
MR. CUNNINGHAM: But you're absolutely right, most of the
design that Jerry was showing -- there's an individual pump.
DR. WALLIS: So you lose all the seals.
MR. CUNNINGHAM: You have the potential for losing all of
the seals and having, instead of the leak rates we're talking about,
three or four times that, depending on the number of pumps, that's
correct.
I guess Art is going to start out talking a little bit about
the Rhodes model that we foresee.
MR. BUSLIK: The Rhodes model is common. You need to
understand that to understand how the seal behaves with a lack of seal
cooling, and so, before discussing two particular ways of losing seal
cooling and the ability to mitigate it, namely station blackout and loss
of component cooling water or ESW, I'll define what the Rhodes model
means.
Now, the Rhodes model came from Appendix A to NUREG/CR-5167,
which was a cost-benefit analysis for this issue, and basically, the
only paths which have any significant probabilities are, one, the
reactor coolant pump seals half open, and this, as Jerry said, refers to
hydraulic instability of the seals, when two-phase flow goes between the
seal faces, and the seal faces that pop open -- there are three stages
in a Westinghouse pump.
The first stage has a relatively low probability of popping
open and is actually neglected in what I'm doing. The second stage has
a -- is assigned a probability of 20 percent by Dave Rhodes of popping
open, and given that the second stage pops open, the probability that
the third stage will pop open is one.
Now, the pop-up that occurs when the hot fluid reaches the
seal faces, the inlet to the seal face, seal stage, once -- when there's
sufficiently low sub-cooling of the fluid at the inlet to the seal
faces, then flashing will occur during the seal phase.
DR. APOSTOLAKIS: Can you explain these three stages using
the diagram that Jerry showed earlier?
MR. BUSLIK: He would probably be able to do it better.
DR. APOSTOLAKIS: Just to help me follow you.
MR. BUSLIK: Basically the fluid seems to go through it in
series.
DR. APOSTOLAKIS: So, explain, please, the three stages?
MR. JACKSON: There are three stages in the Westinghouse
seal.
You see where seal runner number one is, is attached to the
shaft.
DR. POWERS: Okay. Yeah.
MR. JACKSON: And there is -- the first seal stage is the
mating part between -- this is the floating seal ring, and the first
stage seal is the mating part between this floating seal ring and the
runner which is attached to the shaft.
So, that limits the flow, and in the Westinghouse seal, this
takes the primary pressure drop, it's the primary limiting mechanism for
flow there.
Then, it's further reduced through the second stage seal,
which is this runner attached to the shaft, and the mating part is to a
floating seal part here.
So, the mechanical face is here. That's the second stage
seal.
And then the third stage seal is just -- it's similar with a
third stage runner and a part here. That's simply a low-pressure
atmospheric-type seal.
So, in the Westinghouse seal, the primary method of sealing
is all in the first stage, and in the event that it fails, then it
shifts to the second stage, but the third stage is not really designed
for the high pressure. That's why it has a probably -- a given of one
of failure if you have the other failure.
DR. WALLIS: Your analysis of loss of cooling water is
occurring somewhere else. Typically, if you broke something like the
first number one seal bypass, then the flow would go squirting out
there, would never go to the seal at all.
MR. BUSLIK: If you broke this, for example -- if something
happens and the flow here is stopped, your seal injection is stopped.
If both of those happen, you would lose cooling.
DR. WALLIS: If the mechanism for that had been the breaking
of, say, the number one seal bypass, your water would not have to go
through all these paths.
MR. BUSLIK: The concern is that can lead to a small LOCA.
What it doesn't do is -- because it doesn't lead to this situation where
you've lost the coolant and lost the ECCS.
If you have a small break LOCA and you're able to mitigate
it, then it's not as serious, and if it happened at a sufficiently large
frequency that it would increase the frequency of small break LOCAs --
but that was back to what we were considering originally.
DR. WALLIS: On that slide, you have the probability of
pop-open mode is 20 percent epistemic uncertainty as a statement?
MR. BUSLIK: Yeah.
DR. WALLIS: Is that an assumption, or is there some
evidence for that? Where does that come from?
MR. BUSLIK: That's basically expert judgement. If you look
at the NUREG-1150 expert judgement studies that were done, one expert
from Westinghouse gave a relatively low probability of it. Dave Rhodes
was another of the experts. He gave, I think, 20 percent, and later, we
attained that. And then there was a third expert who gave it 25 percent
probability.
It's state-of-knowledge uncertainty. Westinghouse has a
calculation which indicates that actually you don't worry about
two-phase flow going through the seal, but the seal, because of thermal
heating up, will pinch closed, and you won't get any flow through it, or
very little flow, but there are large uncertainties in that calculation,
according to various experts.
Jerry may be able to answer that one better.
MR. JACKSON: As Art said, the second stage -- on failure at
the first stage, the Westinghouse analysis and other analyses show that,
if everything goes as planned, the second stage rotates in a manner that
closes off or pinches off the flow, and it's held together thermally and
doesn't allow a flow to go through there, it becomes a limiter, but
there are things that could happen that would cause that to not occur,
and that would be too much -- it requires a small amount of leakage
through this second-stage seal, but that's pinched closed but just
enough to supply a boundary -- a boiling water boundary condition on the
back side.
So, this is -- we feel is open to some question if it will
really occur, and that's really the basis for the probability of 20
percent.
DR. APOSTOLAKIS: So, this is acting as an initiator? This
is the first failure, or this is in the context of something else that
this happens?
MR. JACKSON: This is given losses of seal injection and
component cooling water.
DR. POWERS: Okay.
MR. JACKSON: There's a 20-percent probability -- this
conditional probability of 20 percent of having this failure mode of the
seals.
DR. APOSTOLAKIS: Now, why did you choose to go with
epistemic here? I mean if you have 1,000 of those initiators, you would
expect exactly 20 percent?
MR. BUSLIK: No.
DR. APOSTOLAKIS: That's what this means.
MR. BUSLIK: If you 1,000 -- if it were epistemic, my
understanding would be it would be like a coin which is two-headed or
tail tails and you don't know which.
DR. APOSTOLAKIS: Right.
MR. BUSLIK: So, here, if you had 1,000, then nearly all of
them would pop open or nearly none of them.
DR. APOSTOLAKIS: That's what I'm saying.
MR. BUSLIK: That's the approximation.
DR. APOSTOLAKIS: Now, is that a reasonable approximation?
I mean why don't you have aleatory uncertainty?
MR. BUSLIK: There is some.
DR. APOSTOLAKIS: Some of them will fail, some may not. I
mean that's too drastic, is it not?
MR. BUSLIK: There may be some. For example, one of the
mechanisms which may make it pop open is there may be scratches or wear
on the seal faces, but I'm not sure how much of that is really required
there, and if there were wear, practically, as far as a point estimate
is concerned, it's a question of whether they all fail or only one of
the four fail, and if there were wear, you would expect that the pump
seal faces would be worn pretty much the same, I believe, for all of the
pumps.
DR. WALLIS: What did the experts say about this
probability? If you have four pumps, they said that, if one fails, they
all fail?
MR. BUSLIK: Dave Rhodes did.
Now, I believe there was a -- and I think probably Jerry
Jackson thought so. I believe that the Westinghouse expert did not
believe that was the case. It really depends, to a certain extent, on
whether -- on how important you think that -- how bad you think the wear
has to be, and they also gave a lower probability. I think that's part
of it.
MR. SIEBER: But the wear reveals itself as a change in seal
leak-off, right?
MR. BUSLIK: No, I don't think you have to have that much
wear for it to occur.
DR. APOSTOLAKIS: So, you had three experts, you say, and
they gave 20 percent, 25 percent?
MR. BUSLIK: You always have to worry whether experts are
independent. One expert gave 20, one gave 25 percent, and the other
gave a low probability. I don't remember what it was, but it was
perhaps 1 percent, 2 percent.
MR. CUNNINGHAM: Just to be clear, the three experts were
assembled. That was in work being done for NUREG-1150. So, that's been
a number of years ago.
DR. APOSTOLAKIS: They went through the training and
everything.
MR. CUNNINGHAM: Yes, that's right, all the expert
elicitation process that was used.
One of the issues in 1150 was reactor coolant pump seal
performance.
DR. APOSTOLAKIS: This was one of the few level one issues.
MR. CUNNINGHAM: Yes, that's exactly right.
DR. APOSTOLAKIS: Probably the only one. I don't remember
another one. Was there another one?
MR. CUNNINGHAM: I think there were a couple of others, but
you're right, the vast majority of them were level two.
DR. BONACA: Do all pump designs use the same materials for
the seals, and what are these materials, and what are the failure modes?
MR. JACKSON: No, they're different. Our early concern was
primarily just with the Westinghouse seal, and most of the work was done
with that seal, and that's what the model has been developed for. We
had to use this tool as a -- what we feel is a bounding case to apply to
the other seals.
Now, Westinghouse accounts for like 54 of the plants when
the other two seals involved are, I think, 10 Byron Jackson and nine
Bingham that are involved.
DR. WALLIS: We can read this slide. I'm puzzled by what I
see. I see this 182 gpm, and then your upper bound is 300. I read a
Westinghouse report where they predict 490 and an E-Tech report where
they say 440, and there's an H.B. Robinson experience where it was 500.
MR. BUSLIK: Let me explain.
When I say 182 gallons per million, that's a given for a
certain set of failures, that the second stage and third stage fail, so
to speak, pop open, so that basically they don't limit flow. Whatever
flow resistances there are are from the number one seal and the
labyrinth seal.
The 480 gallons per minute corresponds to essentially
removing the whole seal package and having left only that tortuous path,
basically, to limit things, the labyrinth seal, and then you would get
estimates on 480 gallons per minute.
That has a low probability of occurring. Compared to this
20 percent, it has, I think, according to Dave Rhodes, something like
five times 10 to the minus three probability, and it turns out it won't
contribute.
DR. WALLIS: Well, I guess it depends on the consequences.
If you have a leak of 2,000 gpm, four pumps, rather than a leak of, say,
1,000, that makes quite a difference.
MR. BUSLIK: Well, it depends upon when you're trying to
recover.
DR. WALLIS: It makes a difference to your LOCA, that's
right, and you're talking about four hours, but you don't get four hours
with the 2,000.
MR. BUSLIK: Don't get four hours, that's true. If 480
gallons per minute had an appreciable probability and if there were --
if the curve for recovery of off-site power, let's say, of station
blackout went down very rapidly, conceivably it might make a difference,
but it doesn't.
DR. WALLIS: It seems to me you have to still assess it.
You can't just dismiss it. You have to look at the probability and the
consequences.
MR. BUSLIK: It was assessed, I believe, by Dave Rhodes.
DR. WALLIS: And your final evaluation of probability
appears, then?
MR. BUSLIK: I didn't actually include it. I neglected it
in what I did, but I could make a bounding estimate,
DR. WALLIS: The H.B. Robinson was an experience where they
started up a pump after -- they did get like 500 gpm.
MR. BUSLIK: That's correct, but what happened there, my
understanding, is that -- well, actually, Jerry can explain it.
MR. JACKSON: I think they had a problem with the pump that
failed, where the first-stage seal -- there was a sale failure, and they
shut down in the normal manner, and while they were shut down, there was
an occurrence that somehow blocked -- they got crud into the other seal
on the other pumps, into the seals, and they couldn't start up the pumps
because they couldn't get the minimum flow through the first-stage seal,
and they tried to restart the failed seal, and when they did that they
had a mechanical failure.
The parts of the first-stage seal were thrown into the parts
of the second-stage seal and into the parts of the third-stage seal.
So, mechanically -- they mechanically failed the seal by
trying to restart it when it already had a failure that resulted in a
high leak rate. It was a procedural error.
DR. WALLIS: They got 500 gpm. The only evidence we have --
these are estimates, these numbers here, is that 500 gpm is possible,
and these numbers here are based on theory.
MR. BUSLIK: These numbers are based on theory, that's
correct.
Now, you may also --
DR. WALLIS: Who calculated -- excuse me -- the 182 gpm?
MR. BUSLIK: Okay. This was initially calculated, I
believe, by Westinghouse.
DR. WALLIS: What you get from Westinghouse is this 490.
That's what bothered me.
MR. BUSLIK: Westinghouse considered various paths on an
event tree, which unfortunately I don't have with me. If all three seal
faces popped open, you would have 480 gallons per minute. If the first
stage does not pop open but the second and third stages pop open, their
best estimate is 182 gallons per minute. And there are various other
things that were considered.
DR. WALLIS: So, you're dismissing the worst case, saying
it's improbable.
MR. BUSLIK: I'm dismissing it based on the probability of
occurrence for a loss-of-coolant event.
Now, it could occur from a mechanical failure -- indeed, it
has occurred, but under those circumstances, you're able to mitigate the
LOCA.
It's more -- the problems we are concerned about is it
occurring on a station blackout. With the pump stopped or on a loss of
component coolant water, ESW, there's a loss of seal cooling. It's
conceivable that the operator would not stop the pump, but it's against
all his procedures, and with a high probability, he's going to trip the
pumps.
It is considered in PRAs.
If you had a different model where these probabilities
weren't as high, you might have to consider the operator error of
failing to trip a running pump.
Now, the other kind of failure has to do with the O-rings in
Westinghouse pumps, and there the model assumes that they fail at two
hours after a loss of seal cooling. Essentially, the temperature makes
them softer and they extrude out through a gap.
How fast they'll extrude out depends on the temperature, it
depends on the size of the gap, it depends on the pressure, and Dave
Rhodes did not give any credit -- the operator, in an accident such as
this, will de-pressurize the reactor coolant system.
He didn't give any credit for a delay in O-ring failure or
for that, and I mean he explicitly mentions that, it's not an oversight,
and he must have a reason for it, but I don't know what that reason is.
It isn't documented. It has to do with what experimental evidence he
had. There was experimental evidence for O-ring failure. They did do
tests on the O-rings.
MR. SIEBER: I presume there's only O-ring of importance on
that drawing that you had?
MR. JACKSON: There's one in each stage, at least certainly
in the first and second stage, of primary importance, the one that seals
the moveable -- the ring that moves up and down, in the up-and-down
direction.
MR. BUSLIK: He explicitly mentions that he's talking about
failure of O-rings in the first and second stages.
Now, what's the time to core uncovery? By the way, the
uncertainty -- I did do a sensitivity study where I assumed that you got
a 95-percent upward bound flow rate of 300 gallons per minute for this.
E-Tech said that there was a 50-percent uncertainty from
two-phase flow correlation, which was higher than what other people had
said in the literature, but it was from their experience. They expanded
the uncertainty.
DR. WALLIS: So, this was come up with by your consultants,
then.
MR. BUSLIK: Yes, that's correct.
DR. WALLIS: Did you multiply by two?
MR. BUSLIK: No. Fifty percent, I interpreted, from 180
would be 270, but there are other factors, friction factors and things,
so I just took a number of 300.
DR. APOSTOLAKIS: Do you have anything against diagrams? It
would have been much easier to follow this is you showed an event tree
to begin with, and second, the time axis and put all these things there.
It's really hard to follow.
MR. BUSLIK: That may be true. There may be something
against diagrams, because I find them hard to draw.
[Laughter.]
DR. WALLIS: You run 300 gpm per pump. So, you have a
four-pump plant, or what do you have?
MR. BUSLIK: There are three- and four-loop plants in
Westinghouse plants.
DR. WALLIS: These are plant-specific, these scenarios, now.
MR. BUSLIK: Yes, but it turns out that the inventory in the
four-loop plant is bigger than the inventory in the three-loop plant so
that the times to core uncovery are about the same for a given leak per
pump.
DR. WALLIS: You're talking about a loss of coolant accident
now with four pumps all leaking 300 gpm.
MR. BUSLIK: Yes, for one of the failure modes, that's
right, and actually, Westinghouse verified that they're basically the
same.
I basically took -- it's a small conservatism that you'll
get core uncovery in four hours whether you have the seals pop open and
then the O-ring failure or the seals don't pop open and the O-ring
failure, things like that.
DR. WALLIS: Did you run a LOCA scenario or something to
figure this out?
MR. BUSLIK: They were run for me beforehand. The results
are given in one place in a Westinghouse document.
Now, for non-Westinghouse pumps, I basically -- and this was
in agreement here -- I basically used the same model as for a -- as far
as pop-open and the same probability of pop-open as for a Westinghouse
pump, but we assumed that the -- basically, the elastomers are better,
and we assume they will not fail.
They're, I think, of a different material. They tend to
harden instead of soften with temperature. Indeed, the new Westinghouse
O-rings, which we assume don't fail, also have that property.
DR. WALLIS: Now, this is another question we had. You've
got Westinghouse pumps with models. You've got these other pumps where
you're making an estimate that they're probably better than
Westinghouse, so we'll use the Westinghouse number, but we haven't made
an analysis of them.
MR. BUSLIK: There was some analysis for a particular big --
it's difficult to really do a good analysis, because I don't think we
have, for example, the dimensions and the design information for those
pumps.
DR. WALLIS: If it's necessary to do it, then it has to be
done.
MR. CUNNINGHAM: Maybe we can come back to that in a little
bit, but there's a key point here that you're hitting on, which is the
Rhodes model was developed based on a lot of analysis by Westinghouse
and by the staff. There is no equivalent model for the Bingham pumps or
the Byron Jackson pumps.
So, we've had to apply it, as Art has said, to these other
plants, and it's to be, in one sense, some sort of bound on it, and that
drives us in a particular direction in terms of what we need to do as
followup.
DR. WALLIS: What did the plants submit? I mean this must
have been an issue. Did they just say we don't have a model and you're
going to get your own or make your own assumptions?
MR. CUNNINGHAM: In the IPEs, they had their model, which
was -- they have a model which is, in effect, very little leakage under
these conditions.
MR. BUSLIK: I don't think that the -- for example,
Combustion Engineering using a multiple Greek letter model where they
essentially assume that the various stages in this pump are like having,
say, three different diesel generators, and you may have some
common-mode failure between them. To me, it's not very sound, and --
DR. APOSTOLAKIS: I have another question.
MR. BUSLIK: Yeah.
DR. APOSTOLAKIS: To what extent did you rely on other
people's work when you did this?
MR. BUSLIK: As far as --
MR. CUNNINGHAM: I'm sorry, George. In what specific
context?
DR. APOSTOLAKIS: Well, it seems that all these rates,
gpm's, came from Westinghouse.
MR. BUSLIK: Oh. Yes, except that they were verified for
certain cases. It happens that the 182 gallons per minute wasn't
verified, but E-Tech, in a document that -- I think it's NUREG/CR-4294
-- did do -- go through the calculations, and basically, the model --
it's included in the uncertainties.
It used a steady-state two-phase flow model where you had
equilibrium between the phases and there was no slip, and it was all
mixed up, homogeneous.
DR. APOSTOLAKIS: Now, you also relied on some probabilities
that were derived by Rhodes?
MR. BUSLIK: That's right.
MR. CUNNINGHAM: David Rhodes is an employee of AECL who was
under contract to NRC to do this work, in effect.
MR. BUSLIK: Right. And it's not very different from the
central estimate or the mean estimate from the three experts. Of
course, there's dependence there, because David Rhodes was an expert.
DR. WALLIS: The E-Tech model gave the 400 gpm.
MR. BUSLIK: Yes.
DR. WALLIS: So, what did that confirm?
MR. BUSLIK: Well, that did confirm -- actually, it -- one
of the primary limiting factors there is the labyrinth friction factor,
I guess. I'm not sure what else is in the model.
DR. WALLIS: I guess, with all these different gpm's,
though, I'd be sort of reassured if you could let us know that it
doesn't matter if the flow rate is up to 500, because the risk analysis
shows that it's okay anyway. Then we would forget about all these
uncertainties in the flow rate.
MR. BUSLIK: For the loss of component cooling water in ESW,
it won't much matter, because even with the other flow rates, you don't
have much time for recovery, okay? So, you won't be able to recover.
I think that's true. I think, with 480 gallons per minute
-- I don't remember how long it will take for core uncovery, but --
DR. WALLIS: But if you get into some different mode of
failure which is more disastrous when you have these higher numbers,
then I think it behooves you to show that there's not a problem.
MR. CUNNINGHAM: The basic situation, as Art has kind of
suggested before, is yes, there were other failure mechanisms of the
pump seals that could have much greater leak rates.
They have a higher leak rate, but they have a substantially
lower probability, in our estimate, by our estimates, of occurrence, and
it's the trade-off between the reduction in time to core uncovery versus
probability that's built into Art's arguments, and he's basically saying
the ones that are the most important are the two, the pop-open mode and
the O-ring failure.
The other mechanisms, from a probability of leak rate, if
you will, or probability of time to core uncovery, are not very
important.
DR. WALLIS: So, if we get, then, to your bottom line, which
I guess we have to get to before too long, it wouldn't change the CBF
significantly.
MR. BUSLIK: No, it wouldn't. It couldn't, because it
changes the time you have for recovery, and it's not going to make --
DR. SHACK: Now, is that true for the 182 as well as the --
the 300 is sort of bounded by the 500. At least I have a bound there.
The 182 seems to me the number that kind of hangs out there.
So, if that was 300 instead of 182, would it make a big
difference?
MR. BUSLIK: No. These start at -- let me think. If you
had 300 gallons per minute, it will start in about 10 or 15 minutes into
the accident, and it will take -- I assume that core uncovery will occur
in two-and-a-half hours. That's conservative.
If you just had 300 gallons per minute constant, it would
take about three hours to core uncovery from the start of the accident,
and I've done a calculation like that, which you'll see.
Okay?
You see the result from station blackout.
Does that answer your question? I'm not sure.
DR. SHACK: I'm not sure. I'm having a hard time, as George
said, associating initiating events with each of these leak rates, you
know.
MR. BUSLIK: It's because I started with what happens if you
lose seal cooling to a pump, and I didn't start with the accident
sequences.
MR. CUNNINGHAM: In all of these cases that we've talked
about, the initiating events are loss of cooling to the seals.
DR. SHACK: Yeah, but there's the seal injection flow and
then the component coolant flow.
MR. CUNNINGHAM: It's the loss of both of those.
DR. SHACK: I need both of those for all of these scenarios.
MR. CUNNINGHAM: Yes, that's right. And then the different
leak rates are associated with different combinations, if you will, of
the three stages of seal failure.
DR. SHACK: Okay. But I do need those two things for all of
the scenarios.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: What kind of sequence are we talking
about, to have an idea of what space we're in?
MR. CUNNINGHAM: We'll come back to that.
DR. APOSTOLAKIS: In the imaginary time axis, what are the
events that are competing here? I'm losing coolant, and what are you
trying to do to prevent --
MR. BUSLIK: You've lost cooling and possibly the ability to
mitigate it, say, from a station blackout.
DR. APOSTOLAKIS: Okay.
MR. BUSLIK: The competing event would be the -- in the case
of a station blackout -- would be to recover electric power.
DR. APOSTOLAKIS: So, the key element here is we have a
competition in time, like we do in fires, where the bad thing is the
loss of coolant --
MR. BUSLIK: Right.
DR. APOSTOLAKIS: -- and something terrible will happen
after a certain time, and the good thing is that you are trying to
recover power, and we have those curves that have been used in all the
PRAs --
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: -- the probability of recovery.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: Right?
MR. CUNNINGHAM: Right.
DR. APOSTOLAKIS: So, the question is now who wins the
competition.
MR. BUSLIK: That's exactly right.
DR. APOSTOLAKIS: And what is the equation you use for that?
What is the probability that I will recover power before I will --
MR. CUNNINGHAM: You're getting into the station blackout
analysis.
DR. APOSTOLAKIS: I don't see any equations anywhere for it.
Do you have difficulty with software there, as well?
MR. BUSLIK: No, I can write equations.
DR. APOSTOLAKIS: Okay. Those diagrams, though, really
would have helped a lot.
DR. WALLIS: At least if there was some sort of summary that
says, if you assume 182, this is the uncovery time and here's the
probability.
MR. CUNNINGHAM: What we've done is basically translated it
to those conclusions in the context of the frequency of core damage.
DR. WALLIS: I think we have to move on.
MR. CUNNINGHAM: Yes.
DR. WALLIS: I think these are important points we've been
raising, but I think, from now on, we should be able to get to the
bottom line.
DR. APOSTOLAKIS: There is a report, Art, that has all these
things?
MR. BUSLIK: There is something. It's in draft form, and it
will be out shortly.
DR. APOSTOLAKIS: But it will have diagrams and equations.
MR. BUSLIK: I will put diagrams and equations in it.
MR. CUNNINGHAM: What we'd like to do is go now to -- as I
said earlier, we've got -- all of this issue of pump seal performance
under these conditions has implications in station blackout accidents
and loss of component cooling service water accidents.
In the interest of time, we're going to jump through some of
the slides.
DR. APOSTOLAKIS: In terms of presentation, I would have
started that way, from the end and worked backwards.
MR. CUNNINGHAM: Okay.
DR. APOSTOLAKIS: Because it's really confusing, I think,
for someone who sees it for the first time and you get into the details
of the 182 gpm versus the other, and we're losing the big picture here.
MR. CUNNINGHAM: Yes. We're back to the big picture here,
or one of the big pictures, if you will, which is the implications to
the implementation of the station blackout rule.
DR. APOSTOLAKIS: Okay.
MR. BUSLIK: So, the station blackout rule required that
certain -- that each plant must be able to cope for a specified time
with a station blackout.
The time for each plant depended on, essentially,
characteristics of the plant, which determined an estimate of how likely
it would be for a station blackout to occur, and the intent of the
station blackout rule was an industry average core damage frequency from
station blackout of about 1e minus 5 per year, on an industry average
basis.
Plants were either four-hour or eight-hour plants. That
means that plants were required to cope with a station black out of four
hours, some plants, and others, eight hours.
DR. APOSTOLAKIS: So, you have to recover power, in other
words, within four hours.
MR. BUSLIK: They have to show, under certain assumptions,
that they're able to cope, some plants for four hours, other plants for
eight hours.
DR. APOSTOLAKIS: What I'm saying is that is equivalent to
say that you better recover power within four hours, because beyond
that, you can't cope.
MR. BUSLIK: That's right. There's a residual risk if they
don't for a four-hour plant, and that's considered acceptable.
DR. WALLIS: So, if the core uncovers in two-and-a-half
hours, you've lost these plants. You haven't been able to do anything
to mitigate this loss of coolant in that time? Or have you?
MR. BUSLIK: There's a certain probability that the -- first
of all, the two-and-a-half hours corresponds to a sensitivity study.
The analyses for coping were supposed to be best estimate analyses.
This is actually --
DR. APOSTOLAKIS: Why was that, Art? I mean you are not the
kind of guy who would say something like that. Were you asked to do
this best estimate?
MR. BUSLIK: This has to do with the rule.
MR. CUNNINGHAM: Coping using best estimate not traditional
conservative regulatory analysis.
DR. WALLIS: I'm sort of confused, because we get this
four-hour coping and then we're told the core uncovers in, you know,
two-and-a-half, four, six hours, depending on which flow rates you
assume, and I'm sort of saying does this matter.
If it uncovers in two hours, does this mean this is a real
loss of something, because you can't cope with things in that period of
time?
MR. CUNNINGHAM: First it comes back to what's the
probability of it occurring in two hours.
DR. WALLIS: If the flow rate is over something, then you're
in real trouble when you weren't before.
MR. BUSLIK: No, because if electric power is not recovered
for a four-hour plant, it's not a question that, if you lose off-site
power, it's never recovered within four hours and it's always recovered
after four hours.
DR. WALLIS: If you've lost the core before you get the
power back, then you're in real trouble.
MR. BUSLIK: That's considered the frequency.
DR. WALLIS: You may not have time to do it.
MR. CUNNINGHAM: That's where you come into the probability
arguments in the station blackout rule.
DR. WALLIS: If your flow rate can be big enough to get you
in real trouble, then I think you worry about that, whatever you've done
for probability, but if you can assure us that the flow rate is low
enough that you'll never really get in trouble --
MR. CUNNINGHAM: That's one way to cope with the --
DR. WALLIS: -- then we'd be very reassured. But these
assessments are all very dependent on how much the flow rate is.
DR. APOSTOLAKIS: But they also have, Graham, curves -- and
I guess the epistemic uncertainties there are not large, because there
is a large database -- that give us the probability of recovering power,
off-site power, as a function of time.
MR. CUNNINGHAM: That's correct.
DR. APOSTOLAKIS: So, it's not that for four hours the
probability of loss of power is one.
MR. CUNNINGHAM: Correct.
DR. APOSTOLAKIS: In fact, the mean value is fairly low, as
I remember --
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: -- on a nationwide average. A couple of
hours?
MR. CUNNINGHAM: I think that's right. There's a long tail
due to certain types of weather conditions and things.
DR. APOSTOLAKIS: But it is an essential part of the
argument.
MR. CUNNINGHAM: But another way to think about it is that
you want to maintain the probability of having core uncovery in two
hours at a sufficiently low level that it's judged to be acceptable.
So, it's a probability of that core uncovery time.
MR. BUSLIK: Frequency.
MR. CUNNINGHAM: Frequency. I'm sorry.
DR. WALLIS: We keep asking questions. We have to get on.
I notice you've got a lot of detail on these slides, and if someone can
somehow distill from this what we really have to worry about, then we'll
finish on time.
MR. BUSLIK: On 14, you will see a table which indicates how
the core damage frequency varied for the eight-hour plants, the plants
which were required to cope for eight hours, and you see basically what
their core damage frequencies were, and for the best estimate case or
slightly conservative best estimate case of four hours for core uncovery
and for two-and-a-half hours.
MR. SIEBER: Before you leave that, that's just for station
blackout, but there's other initiators besides station blackout?
MR. BUSLIK: That's right. That was the second part.
MR. SIEBER: So, you could almost say that this is like two
orders of magnitude higher considering all initiating events, which
would make it a dominant contributor to the total risk for the plant?
MR. BUSLIK: I don't understand the point.
MR. SIEBER: Well, you know, for example, three weeks ago,
there was a loss of an emergency bus to the plant that lost safety
injection flow and component cooling water flow to two pump seals, which
did not fail.
MR. BUSLIK: This was Beaver Valley?
MR. JACKSON: Beaver Valley, yes.
MR. SIEBER: The probability of that happening is much
greater than the station blackout, and so, the number you have as
FSWLSP, which is your frequency of severe weather, which is a factor of
probability in this whole thing, is two orders of magnitude.
MR. BUSLIK: But the point is, in the other cases, you may
have had degraded ESSC, but you did have ESSC. Even if you had a LOCA,
you would have been able to mitigate it, and also, there's a question of
recovery of those incidents. It was recovered within three minutes.
MR. SIEBER: Yeah. Two minutes and 45. But if you look at
the IPE for that plant, it is a high contributor to CDF.
MR. BUSLIK: Yes.
MR. SIEBER: Okay.
MR. BUSLIK: That I treated, as a matter of fact, for that
plant, although I'm not going to give those specific results, but I did
look at that for Beaver Valley unit one. This event occurred at unit
two, but I think the bus configuration is pretty similar. But I treated
that as a loss of component cooling water, ESW. It's not station
blackout, at any rate.
So, plants which are required to cope with a four-hour
station blackout can still cope with a four-hour station blackout,
because core uncovery times are longer, using best estimate values.
DR. WALLIS: But if you use the 500 gpm, what does that do
to you?
MR. BUSLIK: It's not a best estimate value. You would
uncover in less than four hours.
DR. APOSTOLAKIS: Why not do an uncertainty calculation?
The rule doesn't say that, right? The rule is from conservative to best
estimate.
MR. BUSLIK: I did a sensitivity calculation, and you'll see
that it doesn't matter that much, if you look at the table for the
eight-hour plant.
MR. CUNNINGHAM: The question that we had put before us,
that we had to answer in a fairly short amount of time, was have we
compromised the ground rules, if you will, the station blackout rule, by
this set of assumptions, and we didn't try to go back and, if you will,
do something more elaborate.
We said have we done it, and I think the answer is this does
not compromise our situation on the blackout rule. That's the kind of
bottom line.
MR. BUSLIK: That's the basic argument, and the risk is --
yeah, that's right. You still have an industry average one times 10 to
the minus five per year.
The other kinds of ways of losing seal cooling is loss of
component cooling water and essential service water, and seal cooling is
supplied, as you've seen, by seal injection and component cooling water
to a thermal barrier in many plants, basically the B&W plants and the
Westinghouse plants and Palo Verde.
The other Combustion Engineering plants don't have seal
injection.
The classic sequence in one in which, say, component cooling
water is lost, and therefore, then, you may have seal injection, but the
HPI and charging pumps are dependent on component cooling water for seal
and pump motor cooling.
You lost the charging pumps and you lose the -- and you've
lost the component cooling water, so you get a seal LOCA with some
probability, and also, you can't mitigate it, because the HPI pumps are
failed.
DR. WALLIS: So, this is a bad story but it's very unlikely?
MR. BUSLIK: You have to figure out how unlikely it is.
DR. WALLIS: Okay.
MR. BUSLIK: And then there are pumps without reactor
coolant pump seal injection, and here you lose component cooling water
and you get a seal LOCA, and if the HPI depends on component cooling
water, you can't mitigate it.
But there are lots and lots of different variants between
plants.
DR. WALLIS: Component cooling water -- is this one of those
safety significant systems?
MR. BUSLIK: Yes. It's safety-related. Don't ask me what
safety-related and important to safety mean, because I don't remember.
MR. CUNNINGHAM: Yes, it's important.
MR. BUSLIK: So, the charging pumps may not require cooling.
They can be air-cooled, or they could be cooled by ESW instead of
component cooling water. Then loss of component cooling water isn't of
concern, but ESW, which is the heat sink for component cooling water --
if you lose that, you may have a problem.
You may have a back-up cooling system for the charging
pumps. Some plants have installed that -- Turkey Point, units three and
four, H.B. Robinson, Three Mile Island unit one.
You can mitigate a small break LOCA without HPI by cooling
down and de-pressurizing using the steam generators and using the
low-pressure injection systems.
Now, it turns out the low-pressure injection system -- I
believe the bearings there don't require cooling, it's only the seals,
but if you're pumping cold water, you don't need to have cooling to the
seals. So, what they do is have a way of refilling the refueling water
storage tank and continuing to pump cool water.
There are other types of designs. The Westinghouse reactor
coolant pumps, if they use the new O-rings instead of the old, you
decrease the probability. It depends -- the importance will depend on
the frequency for losses of component cooling water, losses of ESW,
which depend on the design of those systems.
We looked quantitatively at 14 units, and nine of these
units, the core damage frequency was below 1e minus 4. The highest one
was 1.4e minus 3 per year. This is a preliminary screening estimate.
We have to look at it further.
It wasn't a random sample of units. I had a IPE database
which gives me frequencies of losses of component cooling water, and I
tried to pick ones which were high.
DR. APOSTOLAKIS: This is what confuses me, Art.
MR. BUSLIK: Yes.
DR. APOSTOLAKIS: The rule, as you said earlier, speaks in
terms of averages.
MR. BUSLIK: The intent of it. That was for station
blackout.
MR. CUNNINGHAM: Station blackout.
DR. APOSTOLAKIS: Oh, this rule is different?
MR. BUSLIK: This is a generic issue.
DR. APOSTOLAKIS: So, we're not going by the average here?
MR. CUNNINGHAM: No, we're not. Here the issue is we have a
generic issue 23 on reactor coolant pump seals. Is it generic? Is
there a generic solution to this problem? And the answer -- what Art
has been doing is saying is there anything generic about this, and we
come back to it and we see great dependencies on plant-specific
features.
So, you can have a very low core damage frequency coming
from these, you can have a higher core damage frequency coming on,
depending on a series of plant-specific issues, and the bottom line, to
get to it, is we need to follow up on them plant-specifically, not
generically.
MR. BUSLIK: Obviously, you could have a generic fix, but it
wouldn't satisfy the cost-benefit criteria.
MR. CUNNINGHAM: That was in our proposed rule.
DR. WALLIS: You're not saying it's not a safety issue. It
still seems to remain a safety issue. You're really concentrating on
the word "generic."
MR. CUNNINGHAM: Yes.
MR. BUSLIK: That's exactly right. For some plants, it may
matter; we have to look more closely.
DR. APOSTOLAKIS: This 1.4(10) to the minus 3, even if you
sharpen your pencil, how low can it go?
MR. BUSLIK: Oh, it can go low.
DR. APOSTOLAKIS: Lower than 10 to the minus 5?
MR. BUSLIK: I had a 20-percent probability of pop-open. If
that probability of pop-open became 1 times 10 to the minus 3, it could
go lower.
MR. CUNNINGHAM: The key piece here is that you're applying
the Westinghouse model to non-Westinghouse pumps. That's a key piece,
and that's why there's a big range in these things, and that's why we're
not willing to say that that's a real number, if you will.
DR. APOSTOLAKIS: I'm a little bit confused how the
calculation was done. The 20 percent was epistemic. The 10 to the
minus 3 is aleatory. So, how would that change change that?
MR. BUSLIK: I mean if I try to take in the uncertainty
range, it becomes a big number. The upper range becomes big.
DR. APOSTOLAKIS: But in terms of point estimates that you
are doing now, I do not see how the .2 enters into the calculation.
MR. BUSLIK: Because I use mean values when I do -- I
average over the epistemic uncertainty. The 20 percent is the mean
value of a distribution.
DR. APOSTOLAKIS: Of an epistemic distribution. That issue
arose many, many years ago, and the NRC had a workshop.
How do you combine the epistemic uncertainties in level two
with the aleatory uncertainties in level one, because in level two, the
event trees go yes, no, yes, no, yes, no. In level one, there is a
fraction of time you go this way, a fraction you go that way. We have
the same problem here.
Those things will be in the report you are about to publish?
MR. BUSLIK: No. If I did something like that, I may come
up with essentially a number for the 1.4 times 10 to the minus 3 plant
-- first of all, it has to be looked at. Maybe there are problems with
the way the initiating event was treated.
But if I did nothing but do an epistemic uncertainty and I
said it's either zero or one, or essentially that, it could go up to 70
minus -- I'd have two estimates, 70 minus 3 per year and zero,
essentially, not zero but a small number, and what that would say is
that you have to reduce the uncertainties, which we know already
actually, before we could go ahead.
MR. CUNNINGHAM: A key piece of this is we're making the
assumption -- to get to the 1.4e minus 3 -- that a Westinghouse seal
model or a variation on the Westinghouse seal model, a Rhodes seal
model, applies to a non-Westinghouse design pump.
One of the things we're trying to do is get better
information on whether -- what is an appropriate model for a
non-Westinghouse pump.
We've had some conversations with EPRI and with some others
to try and see if we can come up with a better model for those pumps to
reduce that uncertainty, if you will.
DR. SHACK: But you have the same problem with the
Westinghouse plants, where if you really did it as a zero, one, rather
than taking the mean of .2, you would end up throwing everybody, I would
assume, at the one.
MR. BUSLIK: Yes, that's true. It turns out that
Westinghouse pumps, because they use a model -- many IPEs use the model
more similar to our model. If they came up with a high value, they did
something about it.
DR. SHACK: But they came up with that value by plugging in
.2.
MR. BUSLIK: That's right.
DR. SHACK: And the question is whether that's a legitimate
procedure.
DR. WALLIS: Maybe the number you plug in is itself
aleatoric.
Can we sum up here? I think the key thing is whether you
really know enough to close this issue, whether your strategy is
something the committee is going to support.
MR. CUNNINGHAM: Maybe we can go to 22. In the context of
the emergency service water and CCW issues, we've got a couple of pieces
of future work, which are basically we want to go back and look at these
in more detail to try and come up with something better than what we
think is somewhat of a bounding estimate on core damage frequency
associated with these, and they are very plant-specific issues. That's
what our concern is. So, we're going to do the future work.
I guess, Jerry, there's one more slide, the summary slide,
the conclusion slide, related to 23 itself.
MR. JACKSON: I guess our conclusion, then, that we're
trying to make -- I'll give you the basis for our conclusion, was we'll
think back to the Commission's SRM. We proposed a generic solution to
the problem, and the Commission ruled against that generic resolution,
and they pointed out that they believed there was insufficient basis for
gains in safety and that it wasn't a generic problem, and I think if you
look through this analysis by Art, etcetera, it points out that it is
truly a plant-specific issue, and the Commission also had concerns with
our seal evaluation model, and they pointed out, as well, that the
industry was addressing many of our concerns by changes in the IPE
program, and if we look at changes that have actually been made in the
plants, the station blackout rule has reduced the likelihood of seal
LOCAs by the addition of alternate power sources, for one thing, and the
IPEs have resulted in specific changes to this particular problem in the
plants, like reducing the dependencies on cooling in certain instances.
The maintenance rule itself has reduced the likelihood of a
component cooling water, service water system failure, which affects
this seal failure probability, and then, as we talked about earlier, the
normal operation failures have improved.
There have been none of the large leak rates, since even
1980 was the last time we had one that anywhere near approached the
makeup capability, and to sum up our plant-specific analysis that Art
has done, I think we've shown that the station blackout -- when you look
at the station blackout plants, applying our conservative model, that we
still meet -- the intent of the station blackout rule is still met, and
for the loss of component cooling water and service water, when you
apply this model to the plants that we've looked at -- and Art looked at
39 of the 74 and only found five plants that were screened out with the
higher values.
So, we believe that that shows that the majority of the
plants have a low risk associated with this seal failure.
So, to summarize, the staff concludes that closure of
generic issue 23 is appropriate and would like to request your agreement
on closing this issue.
DR. WALLIS: Do we have anymore questions from the
committee?
[No response.]
DR. WALLIS: We have a presentation from industry?
Thank you very much.
MR. LOUNSBURY: Good morning.
My name is Dave Lounsbury. I work for PSE&G Nuclear, Salem
Station, and I'm here to discuss the WOG position.
What I'd like to do in this package that we sent out, slide
number two, three, and four is just there just to give you some sort of
indication what the WOG involvement has been.
I'm not intending to discuss each one of these items. It's
just there for a visual, so you can understand how much work has gone
on.
Here again this just all the work that we've done within the
Westinghouse Owners Group and Westinghouse to resolve this.
Part of our conclusions is the WOG supports the closure of
GSI-23. There's conservative analysis that has determined approximately
21 gpm per pump, RCP leak rates at full pressure and temperature.
DR. WALLIS: So, you're saying 21 gpm, and you heard numbers
of several hundred earlier on.
MR. LOUNSBURY: We'll get to that.
DR. WALLIS: Okay.
MR. LOUNSBURY: Emergency procedures are in place to cool
down and de-pressurize the RCS, further reducing the expected leak rate.
I'd like to stop right here and discuss that.
Part of the discussion that I heard was the 2.5 hours for
uncovery of the core and the 300 gpm. Westinghouse emergency operating
procedures -- that's ECA-00 -- for station blackout events -- I'm only
telling you this so you'll have an understanding of what the operators
are actually going to do in these events -- they have directions to cool
down and de-pressurize the plant using the steam generators, and that
de-pressurization occurs at maximum rate.
MR. BARTON: And that depends on whether they recognize the
alarm and respond in a timely manner, which they didn't do at Beaver
Valley. Luckily they got flow back in two minutes and 45 seconds, but
they didn't do what they are supposed to do, which was shut down.
MR. LOUNSBURY: I agree, but for the station blackout, I
think the operators would be pretty much aware they didn't have any AC
available. It's a different scenario. But the point being is that the
RCS would be de-pressurized in some amount of time, would cool down in
some amount of time, and would significantly reduce the 300 gpm.
Additionally, the loss of seal cooling is a safety concern
only when no RCS makeup capability exists for an extended time -- i.e.,
coping times.
Testing and actual experience support the above statements.
DR. WALLIS: Could you say something about that? Your
testing supports this 21-gpm number?
MR. TIMMONS: My name is Tom Timmons from Westinghouse.
Westinghouse, in conjunction with Electricity de France and
Framitome, performed a test in France in 1985 on a full-scale,
seven-inch reactor coolant pump seal.
The steady-state leakage in that test was approximately 14
gallons per minute, so that we believe, based on that test, which
confirmed the best estimate leakage estimate of 21 gpm --
DR. WALLIS: This is one test. Did you fail the seals in
the way that was presented to us by the staff?
MR. TIMMONS: No, we did not.
DR. WALLIS: So, you were looking at a particular scenario
where there's a small leak.
MR. TIMMONS: We were looking at loss of all seal cooling
and see how the entire seal package behaved during that test.
DR. WALLIS: You had one data point?
MR. TIMMONS: That's correct.
MR. BARTON: Has there been any actual similar events at
operating reactors in this country, where you've lost cooling and you
had seal failure? What was the leak-off rate? Because there have been
seal failures, right, due to loss of cooling?
MR. TIMMONS: There have been seal failures due to loss of
cooling but not seal failures due to complete loss of cooling for an
extended period of time.
The only other data point was during a production test of a
full-scale reactor coolant pump in which they were running a test of
loss of seal injection and they lost power at the facility, resulting in
a loss of component cooling water.
So, there was a loss of all seal cooling to a full-scale
pump in a test loop, and the maximum leakage in that case was about 13
1/2 gallons per minute. However, at about the time that the maximum
leakage was occurring, component cooling water was restored when they
restored electrical power, and so, that tended to turn the transient
around.
DR. WALLIS: This 182 gallon per minute, whatever it is,
came from Westinghouse.
MR. TIMMONS: That's correct.
DR. WALLIS: Hypothesizing some other scenario.
MR. TIMMONS: Yes.
DR. WALLIS: So, why is this conservative?
MR. TIMMONS: The 182 gallons per minute is a thermal
hydraulic calculation based on a model of how the seal parts react and a
model of the seal parts and the seal leak-off systems, and it assumes
that the number one seal operates as designed and that the number two
and number three seals don't.
DR. WALLIS: You say conservative is 21, yet you have a
model which predicts 182. So, for some reason you've discounted the 182
if you say this is conservative.
I don't quite understand. And the staff uses a conservative
of 300. I don't understand what is meant by conservative in this
context.
MR. TIMMONS: Twenty-one gpm was, again, from the
WCAP-10541, assuming that you didn't have a number two seal failure or a
number three seal failure. The test data that we -- that was done by
EDF showed it was 16 gpm. So, it's less than the 21 that was predicted
in the model.
DR. WALLIS: You did one test, and you didn't get the
failure which would have led to 182.
MR. TIMMONS: Correct.
DR. WALLIS: It doesn't mean to say 182 will never happen.
MR. TIMMONS: It's a probability.
DR. WALLIS: So, what do you mean by conservative?
Maybe we should move on.
MR. TIMMONS: Yes.
MR. LOUNSBURY: The risk associated with the RCP seal
failures is not significant from the CDF. Installation of
high-temperature O-rings would provide a long-term passive solution.
MR. BOEHNERT: Have all the pumps -- all the plants put in
those high-temperature O-ring seals?
MR. LOUNSBURY: No.
MR. BOEHNERT: Are they going to?
MR. LOUNSBURY: I don't know.
DR. WALLIS: This is something that came up in the
subcommittee meeting. There seemed to be this uncertainty of this
wonderful material which works so well but it hasn't been put in.
DR. SEALE: We don't know.
DR. WALLIS: We don't know if it's being put in. That seems
strange that you don't know.
DR. SHACK: Is this a case that the seals continue to
operate and they just haven't been replaced or is it a case they've been
replaced with the old material?
MR. LOUNSBURY: My understanding -- and I can't speak for
all the utilities, but there has been some position by utilities that
they choose not to incur the additional costs of putting
high-temperature O-rings until GSI-23 is closed.
MR. BARTON: What's the logic behind that?
MR. LOUNSBURY: Like I said, some utilities have taken that
position. I don't know what their justification is.
DR. SEALE: Oh, boy.
DR. WALLIS: If we close this issue, does it mean that they
will or will not put these materials in?
MR. LOUNSBURY: I can't speak for each utility.
MR. BARTON: For safety's sake, we better hurry up and close
it.
[Laughter.]
MR. BOEHNERT: Do you know how many plants have put in the
new material?
MR. LOUNSBURY: Yes. Seventy-five percent of the
Westinghouse fleet of pumps have installed high-temperature O-rings.
However, the WOG believes the NRC model assumptions are
overly conservative, specifically the 20-percent probability of the seal
popping open, which leads to your 182 gpm, and the 50-percent
probability of the number one seal O-ring failure if the number two seal
pops open. The WCAP-11550 predicts a lower probability.
DR. WALLIS: The staff indicated it was 1 or 2 percent or
something like that.
MR. LOUNSBURY: It's a single-digit number.
DR. WALLIS: Does it predict or guess?
MR. LOUNSBURY: Is it a prediction or a guess? I don't
know.
MR. TIMMONS: It's an assumption.
DR. WALLIS: That doesn't give ma warm feeling.
MR. TIMMONS: That particular behavior has been postulated
by the -- a consultant to the NRC based on his professional opinion. It
has never been observed in a plant, never been observed in a test.
MR. LOUNSBURY: To continue on, the operating experience and
test data do not show a high probability of excessive leak rates for
loss of seal cooling events.
The NRC assumptions are based on non-prototypical testing,
and use of these assumptions may lead to unnecessary expenditures for
plant modifications and analysis.
DR. WALLIS: What testing are you referring to?
MR. TIMMONS: It's our understanding that the NRC consultant
postulated that the seals would pop open based on some tests that he did
using non-prototypical-size parts and using hydraulic actuators to move
the seal parts to the point where they would fail.
DR. WALLIS: You're referring to E-Tech?
MR. TIMMONS: I'm referring to AECL.
DR. WALLIS: Oh, Rhodes?
MR. TIMMONS: Rhodes?
DR. WALLIS: But he didn't do any testing. He just did
guess probabilities.
MR. TIMMONS: Well, the AECL laboratories were involved in
testing.
MR. JACKSON: We had a test program at AECL. It was a
scale-model-type test to demonstrate whether there was feasibility of
hydraulic instability. I think that's what he's referring to.
DR. WALLIS: And it did show it?
MR. JACKSON: That's right, it did. It showed what
conditions it would occur under. It doesn't occur under all conditions,
but that was the purpose of the tests, were to map the conditions under
which it would occur, and they also did analysis of this phenomenon.
MR. LOUNSBURY: The WOG position is contained in WCAP-11550,
which presents the Westinghouse RCP seal LOCA model, and in the
correspondence with the NRC on proposed closure of GSI-23.
Fundamentally, our biggest argument or concern -- and this
has been going on -- is the 20-percent probability of the seal popping
open. The WOG disagrees with that number and with the 50-percent
probability of the number one seal failing if number two seal pops open.
DR. WALLIS: How will we decide? I mean the staff seems to
have a 20-percent, which doesn't have all that much of a basis, and you
have some other number which is much lower which doesn't have much of a
basis. What should be the basis of our judgement on this?
DR. SHACK: You said you mapped out the conditions under
which this could occur.
Now, what exactly does that mean?
MR. JACKSON: That means the approach angle that the seal
must have. It means that -- the degree of sub-cooling in the
conditions, of the approach to this seal. It shows at what back
pressure this would occur, behind this seal.
So, if you take -- these are all conditions that would
affect the seal in actual operation, and so, you look at the conditions
that would be expected in a real seal.
For instance, if the back pressure behind number one seal
were to be very low, failure of the second stage seal, for instance,
then you could have popping open occurring.
DR. SHACK: Okay. So, under these conditions, the
probability is one.
So, the real question, then, is what is the probability of
these conditions occurring?
MR. JACKSON: That's correct.
DR. SHACK: And the face angles we're talking about are
consistent with the design?
MR. JACKSON: Right. We look at the face angles that
occurred in the Westinghouse seal, and the conditions -- these change
with the thermal conditions, because normally the seal is cool, so
you're talking about what the seal will -- what will happen to the seal
under loss of cooling conditions.
MR. LOUNSBURY: In answer to your question, the 20-percent
probability and the difference between what we say in the context of the
Westinghouse model -- they're using the results partially from our test
data that we did and the work that was done with Westinghouse vice the
test data that was -- I don't even know if they actually had a
full-scale model but that they did with the NRC.
DR. WALLIS: We didn't have the benefit of your comments at
the subcommittee meeting. So, this is all new to me.
Are there any other questions?
[No response.]
DR. WALLIS: Thank you very much.
I'll hand this back to you, Mr. Chairman.
DR. POWERS: I will recess us, then, until 10:30.
[Recess.]
DR. POWERS: Let's come back into session.
We're going to progress now on to one of the topics that's
becoming a perennial favorite, status of the proposed final amendment to
10 CFR 50.55(a), codes and standards.
Dr. Shack, will you lead us through this effort?
DR. SHACK: Okay. We're going to hear an update today on
the status of this. In particular, the part of the amendment related to
the elimination of the requirement for licensees to update their
in-service inspection and in-service testing programs every 120 months
and the question of an addition of a requirement to perform volumetric
inspections of these small-bore high-pressure safety injection lines.
We'll hear from the staff, and then I believe NEI has
requested an opportunity to comment on our letter related to the
elimination of the 120-month update requirement, and Mr. Scarborough, as
usual, will be leading us through the show.
MR. SCARBOROUGH: Thank you. Good morning.
My name is Tom Scarborough. I'm with the Division of
Engineering of NRR.
With me is Matt Mitchell, also with the Division of
Engineering, and we'd like to go over briefly the status of our two
activities that we told you we would respond and come back to you with.
One is the 120-month update issue for in-service inspection
and in-service testing program, and the other is the high-pressure
safety injection class one piping weld examinations.
Just to give you a little background of where we are since
we last talked to you, in December, as you remember, of '97, we
published a proposed rule to incorporate by reference the '95 edition
with the '96 addenda of the ASME boiler and pressure vessel code and the
ASME code for operation and maintenance of nuclear power plants, with
certain limitations and modifications.
Then, in April of this year, we issued a supplement to that
proposed rule where we indicated a possible replacement of the
requirement for licensees to update their ISI and IST programs every 120
months with a voluntary updating provision, and in May of this year, we
had a public workshop where we had participants from the staff, the
Nuclear Energy Institute, ASME, several nuclear utilities, and private
citizens to talk about the update requirement and the need for it.
Then, in June of this year, we received further direction
from the Commission in terms of go ahead and finish the incorporation by
reference of the '95 edition of the ASME code into the regulations and
to defer the 120-month update issue until the next rule-making, and we
followed that direction, on September 22nd, the final rule was published
in the Federal Register, which incorporates by reference the '95 edition
of the code, and in that rule, that's where we brought up the point that
we would defer the issue on the HPSI class one piping weld examination
while we evaluate an industry initiative.
MR. BARTON: What's the status of the 120-month update now?
MR. SCARBOROUGH: We deferred it from -- well, we separated
it from the '95 --
MR. BARTON: -- '96 addenda.
MR. SCARBOROUGH: Okay? And now what we're doing is what
we're going to talk about right now, where we are with that status.
MR. BARTON: Okay.
MR. SCARBOROUGH: Okay.
So, we issued in April of this year a proposed rule
discussing the 120-month update. The public comment period ended on
June 28th, and we received about 34 comment letters from members of the
public, and we've been reviewing those comment letters and working up
responses to them and categorizing them.
As we began drafting a Commission paper to discuss this
issue before the Commission provided recommendations, we found that
there was widely varying views, both external and internal, regarding
the need for the mandatory updating of ISI and IST programs.
So currently we're considering various options. We've
currently worked our way up to four options, and we're looking at those
to see if there's any other options to try to resolve this issue.
But we haven't reached a decision yet as to which particular
option and recommendation that we might put forward to the Commission in
the Commission paper.
So, the next step of where we're going is we're preparing
this Commission paper, we're getting comments back from the internal
stakeholders. We've pulled together the comments, public comments.
Those have been addressed and responded to in terms of
developing positions regarding them, but now we're bringing in all the
internal stakeholders and their positions and developing a -- working
toward a consensus document so that we can provide options and
recommendations to the Commission.
We plan to come back and brief you again in December, at
your December meeting, and we have a subcommittee meeting that we're
arranging, as well, and we intend to have a draft Commission paper for
you at that time.
Currently, our schedule is to complete the Commission paper
by January 10th, year 2000, and following that, following direction from
the Commission, then we would proceed with a final rule-making, in
accordance with the direction from the Commission.
That's where we are.
DR. POWERS: Do we have a good understanding of the
positions, those advocating retaining and those advocating eliminating
the 120-month update requirement?
MR. SCARBOROUGH: I think for the public comments, I think
we do.
I think we've gone through those pretty carefully and we
have a pretty good feel. Both sides make strong arguments for their
case, for their position, which side they would lean to, but currently
we're pulling in internal stakeholders, as well.
There's a lot of comments and views out there that we
haven't been able to pull in yet and factor into the mix of preparing a
Commission paper.
DR. POWERS: Can you give me a thumbnail sketch of the
arguments that those that want to retain the 120-month update
requirement advance?
MR. SCARBOROUGH: In the sense of, for example, the
cumulative increase in improvements in the ISI and IST techniques over
time that would be -- that you might not see by an individual change but
might grow over time, I think that's part of what -- one of the
fundamental reasons that they feel that it would be a good idea to
continue the mandatory 10-year update. That's an example of one of
their comments.
The HPSI issue, to give you a little background on that, in
the proposed rule that was issued in December of '97, there was a
proposed back-fit that would have required licensees to supplement their
surface examinations of HPSI class one piping welds in pressurized water
reactor plants, PWRs, specified in the ASME code, was ultrasonic
examinations, and as we started working through the public comments on
that and coming up with a final rule, it was determined that, with an
industry initiative that was working its way through at this time, that
we would defer action and -- on this issue and continue to work with the
industry on it in the rule that we put out in September.
We did some preliminary risk studies that showed there was a
nominal effect from not conducting the ultrasonic examinations or the
surface examinations that were mandated by the code.
So, in the final rule that went out in September, we
endorsed but did not mandate the code provisions on surface examinations
of HPSI class one piping welds, and we also discussed in there that
there was an ongoing dialogue of what was the appropriate examination
for these particular welds and that that would be dealt with in the next
rule-making.
So, that's where we left it in September, the September
rule.
On August 20th of this year, the staff had another meeting
-- we've had several meetings with NEI and industry representatives --
on the HPSI class one piping weld specifically and whether there was a
need for interim action on this issue while the industry initiative was
underway.
There's a major industry initiative on thermal fatigue
that's going to go -- going to last until about the year 2001, and the
question is should the staff wait until that industry initiative is
complete before resolving this issue, and that's one of the items that
was discussed at the August 20th meeting.
The industry stated at that meeting that, in their view,
there was no effective interim inspection activities that could be
undertaken for the class one piping welds at this time, and in the next
slide, I want to point out some of the technical constraints that were
raised by the industry at the meeting on August 20th.
First, there was the comments that it was a very difficult
-- this small bore piping was a very difficult geometry to conduct
ultrasound examination.
Another was that the ability to reliably and effectively
detect cracking had not been demonstrated with this type of equipment
for this small piping and that it would require additional training and
certification of inspectors to be able to perform this type of
inspection.
Another concern was the lack of appropriate weld
preparation. There would have to be a lot of grinding to remove weld
crowns and such to be able to allow the inspection to take place, and it
might cause additional indications to be observed during the
inspections.
Another item there was that the inability to size the
indications reliably might lead to replacement of piping upon indication
of detection, and finally, they pointed out that, if they did find
indications, the inspection scope would be expanded as mandated by the
code and it might go beyond what the original intent was in the sense of
having a representative sample.
You might end up with a majority of welds being examined far
beyond what originally was intended as a representative sample.
So, those were the points that were brought out by the
industry at the meeting, and the staff considered them to be reasonable
points, but industry did indicate that they are working to assess this
inspection option for the small bore piping for HPSI class one and to
develop possible procedures and guidelines for the small diameter piping
inspection.
MR. BARTON: What kind of options would they be considering
other than UT?
MR. SCARBOROUGH: I think one of them that's been mentioned
has been monitoring.
MR. MITCHELL: As we understood it from the meeting that we
had on August 20th, within the nine-month timeframe, primarily they
would still be focused on ultrasonic procedures.
It would be a matter of understanding, I guess, a little
more about what the state of the art in UT is and how it could be
applied to addressing this particular piping geometry for the purposes
of detecting thermal fatigue cracking.
DR. SHACK: Do we know enough that inspection is really
helpful here?
I mean is it one of these things that, once the cracking
starts, you're going to through wall in three months or something so
that your chances of actually, you know, finding a crack except -- it's
either not going to be there or it's going to be a leak?
MR. MITCHELL: That has been another point that's been
raised by the industry in our discussions on this topic in that there
may be other options such as temperature profile monitoring which are
more effective at detecting the conditions which could lead to the
cracking rather than pursuing the inspection options.
The program which is being pursued by industry also has
tasks in it to consider a monitoring program and the implementation of
monitoring, along with the potential for inspection options.
MR. SCARBOROUGH: One of the options that had been proposed
during the discussions with the industry was to substitute some of the
larger piping diameter inspections that are required to be performed
with a few small-diameter piping, and decisions regarding that option
was that there were so many more small-diameter piping welds that you
might end up having so many you wouldn't be doing any large-diameter
piping weld inspection.
So, that option was explored, but it wasn't felt that it
should be pursued.
So, based on this new information, including the low risk
significance that was determined from the internal calculations
regarding the weld inspection, regulatory action was deferred for nine
months while the industry assesses the inspection option for the
small-diameter piping.
In the meantime, the staff will work with ASME to develop a
code case for HPSI class one piping, which as Matt was talking about,
might be a more structured sample for UT examinations, as opposed to the
way it is now.
Also, the Office of Research plans to participate on this
thermal fatigue issue, possibly sharing reviews of samples and things of
that nature to try to come up with a consensus opinion on this issue.
And finally, we plan to clarify the status of the HPSI class
one piping issue in the next rule-making, which is the 120-month
rule-making that we're working on right now. We plan to clarify where
we are with this issue at that time.
So, that's where we are on both these issues. I'll be happy
to answer any other additional questions you all might have.
DR. SHACK: Would you actually put some sort of interim
status on HPSI in a rule-making?
MR. SCARBOROUGH: Just in the sense that, in the rule-making
that went out on September 22nd, we did discuss that this was an ongoing
issue, and because of that, we sort of left an open door there, and it
would be good to provide some information. So, we'll have to figure out
some way to say it, just to let people know that it's a still ongoing
review.
DR. POWERS: Is the situation that the NRC staff wants to
impose these inspections and the industry doesn't want them to, or is it
more complicated than that?
MR. SCARBOROUGH: I would say it's probably more complicated
in the sense that there is real discussions going on in terms of what is
the best possible monitoring or examination for these. I think it's
more than just one side wants the other one to do it and the other one
doesn't want to do it.
I think there's a real discussion as to what's the right
thing to do here, and that was one reason why, in the September rule, we
didn't mandate those surface exams, because there was a concern that our
people are receiving an excessive dose to do these surface exams and
it's not achieving them the goal that they wanted to have.
So, I think there's a real technical discussion going on and
not just one side wanting to do something and the other side not.
DR. POWERS: Well, my understanding is that the cracks of
interest are those that are generated on the inside, not the outside, to
begin with, right?
MR. MITCHELL: Correct.
DR. POWERS: So, an external examination tells you whether
you've cracked through, I guess, but it doesn't tell you much about it.
MR. MITCHELL: Right.
DR. POWERS: Have we had a history of cracking in these
particular pipes?
MR. MITCHELL: We have seen instances of thermal fatigue
damage in these pipe systems, the most, I guess, notable and recent of
which was the cracking which occurred at Oconee, I believe, in 1997 in a
high-pressure injection make-up, dual-purpose line.
DR. POWERS: And what's the consequences of having cracking
in that?
MR. MITCHELL: The qualitative assessment that the staff
looked at, at least at the time of Oconee, was to observe that you're
looking at a small-break LOCA potential, potentially affecting the
system designed to mitigate a small-break LOCA in the high-pressure
injection system, and to that extent, when we also noted, coming out of
that event, that there was an apparent discrepancy in the code in not
requiring volumetric exams on these particular piping welds was how this
issue was raised between us and the industry.
MR. BARTON: What was the size of that weld, of the pipe?
MR. MITCHELL: I believe, in the case of Oconee, that was a
two-and-a-half-inch-diameter pipe.
MR. BARTON: And the root cause of that failure was?
MR. MITCHELL: To the best of my knowledge, although I was
not directly involved in that, it was attributed to thermal fatigue
associated with a loose thermal sleeve in that nozzle location.
DR. SHACK: Keith, you had something?
MR. WICHMAN: Yeah. Keith Wichman, DE. A couple of
comments.
I think Matt alluded to how this issue was originally
raised. The code, in error, did not require volumetric examination of
high-pressure injection lines in PWRs.
DR. SHACK: Is that based on size, though?
MR. WICHMAN: Yes, less than four inches. However -- and
this was raised -- this was discovered because the class two portion of
the -- on the code does require volumetric examination, so -- you know,
class one versus class two.
So, I wrote a letter to the code and raised this issue in
1997. This is how this whole thing started.
Secondly, as far as being able to inspect these lines, the
B&W Owners Group and Oconee, for example, which had the failure, Oconee
unit two, are inspecting these lines successfully, okay, with UT. These
are two-and-a-half-inch lines, and I don't think the NRC staff agrees
entirely with all the industry objections to inspection at this point in
time.
And finally, as far as strictly high-cycle fatigue, that's
not the case with thermal fatigue, because you have -- you can have two
components.
If you have thermal stratification, you have very high
bending stresses, and that's really low-cycle fatigue, okay?
So, it's not -- you have a very complex mechanism at work in
some of these lines, and it will not necessarily go through in three
months, as you indicated.
So, inspection can be effective.
DR. SHACK: Any additional comments?
[No response.]
DR. SHACK: Thank you very much. I suspect we'll be hearing
from you again yet in the not too distant future, and Mr. Marion, I
think you wanted to give us some insights on the 120-month update issue.
MR. MARION: Thank you, and good morning.
For the record, my name is Alex Marion. I'm the Director of
Programs in the Nuclear Generation Division at NEI, and I recognize the
initial request of this committee was to speak to you about the letter
that you had drafted to the Commission on this elimination, but I
thought we'd discuss an uncertainty in modeling techniques used to
address GSI-23.
That seemed to be the topic of the day, but really, I
thought you would benefit from a focused discussion of industry's
position on this elimination that's being proposed in NRC's rule-making,
and what I'd like to do is kind of set the stage with some background.
In 1993, a utility submitted a cost-beneficial licensing
action -- CBLA, as they were referred to at the time -- that indicated
that they could not identify any safety benefit in applying the 1989
edition of the ASME code, and recognize this is in the '93 timeframe.
They did a cost analysis indicating that, for them to update their
program, they estimated it would be on the order of about $250,000.
Now, recognize this is one plant, but that cost estimate did
not include a lot of the implementation associated with training,
inspections, and testing that was not included in their current version
of the ASME code.
Now, when this was submitted to the NRC, the NRC recognized
the generic implications of this and contacted NUMARC at the time, which
essentially became NEI, and we began working with the NRC on the generic
aspects of this issue that was raised, and in 1995, there was a Federal
Reg. notice where NRC announced the intent at that time to baseline the
1989 edition and consider eliminating the 120-month requirement.
Fundamentally, industry supports the elimination of the
120-month update requirement, and that position is based upon our
understanding that there is no demonstrated increase in safety that's
commensurate with the cost of implementing that requirement.
It essentially is an unnecessary regulatory mandate.
We believe that base-lining the '89 version of the code is
adequate and sufficient, and the NRC, in their documentation supporting
the proposed rule-making, essentially feels the same way.
The industry submitted comments to the proposed rule-making
on January 25th, and a copy of those comments were distributed to you,
and I would like to draw your attention to particular areas.
On attachment one, I would like to refer you to -- I am
sorry -- enclosure one to that package, I would like to refer to page
one, item one, potential effect on safety.
One utility had conducted an evaluation in comparing the '89
and '92 edition of the ASME code, and that evaluation identified 84
changes, 77 of which were editorial, 8 were errata, 52 did not change
any requirements, 22 reduced requirements, and 25 increased
requirements, and these are requirements between the '89 and '92
edition, but fundamentally, the utility concluded that none of these had
any safety significance.
I'd like to refer to --
DR. POWERS: This was the transition between the '89 to the
'92 version.
MR. MARION: Yes.
MR. BARTON: It's a snapshot.
DR. POWERS: And we're talking about something that would be
more like the 1992 to the 2002 version of it. Do you have any basis for
thinking that this is indicative of the amount of change that you will
get in that time period?
MR. MARION: It's hard to say until we see the 2000 version
of the code or later versions of the code.
DR. POWERS: But you're asking people to prognosticate here,
and it must be that you think that this is the kind of thing that you'll
get in 2002 vis a vis the '92 version.
MR. MARION: No, we're not asking people to prognosticate on
what it's going to look like in the future. What I'm trying to do is
give you a sense of the industry's evaluation of the '89 edition of the
code and a comparison of the '89 to the '92 edition of the code. That's
the only purpose.
MR. BARTON: But you're asking for relief from the 120-month
update forever, right?
MR. MARION: Yes.
MR. BARTON: So, some later editions of the code may, in
fact, have safety implications and should be adopted by the industry.
MR. MARION: Well, whether the industry adopts the code is a
separate question from the NRC incorporating the code in the regulation
and making it a mandatory requirement.
If a future edition of the code, indeed, contains provisions
that relate to a safety improvement, then we support the NRC making the
regulatory decision, based upon the safety threshold and incorporating a
requirement of those safety provisions in 50.55(a). We're not arguing
about that.
What we're arguing about is incorporating and mandating all
of the other stuff associated with code provisions as this cycle of
10-year updates continues.
We have no argument about the safety case being made on
provisions. We're just concerned about wasting a lot of resources and
doing all of the other things that the code requires on this 10-year
cycle where utilities have looked at it and can't make a safety case for
it.
DR. POWERS: I guess I'm struggling here a little bit to
understand.
This group, the ASME, that makes this -- these are not
Martians that land here with the intent of making life hell on the
nuclear industry. I mean I presume members from the nuclear industry
participated in these -- in this code group to come up with these
changes and whatnot.
MR. MARION: Absolutely, and I participate in one of the
groups myself.
DR. POWERS: Okay. So, why would these people create things
that are simply burdens with no significance --
MR. BARTON: On themselves.
DR. POWERS: -- on themselves for no significant reason. I
mean there must be a reason they're putting in these changes.
MR. MARION: Basically, from the standpoint of standards
development, there are two fundamental reasons for standards to be
developed, and this is an opinion that I've been articulating to the
standards community ever since I've been involved in the standards
community, which has been about 23, 24 years, and those two reasons are
very straightforward: to capture current practice and to pave the way
or develop a framework for the application of new technology.
Now, the standards development organizations have been very
successful as long as they've stayed within those two mandates and
achieved those two objectives. The difference is standards are for
voluntary use.
In this particular case, with regard to ASME -- and I
believe it was cited in your letter -- 50.55(a) has existed since 1971.
So, for 28 years, we've had a regulation that mandates the ASME code.
Now, back in '71 and through the '70s, that was the right
thing to do and a lot of benefit was had in terms of improving
construction design techniques and inspection techniques of the nuclear
power plants.
Now, today, people are taking a good hard look at these
120-month updates, and they're questioning the safety case that must be
made by the NRC if they decide to impose these code requirements in a
regulation.
Now, that does not disparage or cast any doubt on the
standard development activity that resulted in the standard.
Our basic belief is that the standards that come out of
standards-development organizations have to provide value to the end
users, and historically, that value has been demonstrated as long as the
standard organizations satisfy the two objectives I mentioned a little
while ago, and when that value is demonstrated, those standards will be
applied by the end use industry, and I think the NRC is on record
indicating that that's happened.
There are several hundred standards that are used by
utilities across the industry that are not mandated by 50.55(a), but
they're in the design and licensing basis of the plants.
There are only about 20 or so that are addressed by
regulations.
So, our point is to make the regulatory decision on
revisions to 50.55(a) based upon the safety threshold. If the safety
threshold can't be demonstrated, then it should not be regulated as a
mandatory action. That's fundamentally where we're coming from.
I'd like to quickly bring to your attention enclosure two,
which is a tabulation of the burden on licensees related to this update,
and this is -- the first page represents an estimate that was provided
by one utility.
The second page tries to capture the range, if you will, of
costs based upon the input we've received from a number of utilities.
So, the total cost of the industry is somewhere between 55
to 155 million across all the plants.
MR. BARTON: This is the '89 and '92 update? That's what
this item is based on?
MR. MARION: Let me introduce Kurt Cozens. He was involved
in getting all this detail together to support this letter.
MR. COZENS: This is Kurt Cozens with NEI.
The process of updating the code is a procedural cost of
going through your entire program as it exists, comparing it to whatever
exists.
These costs represent the procedural incorporation of
whatever new requirements might be there, independent of the addition of
the update.
This does not include extra actions that might occur due to
finding something through whatever and having to take additional
licensees actions to implement some form of a code requirement.
So, this is just the procedural --
MR. BARTON: This is like a change that has nothing but
editorial errata data in it, it's going to cost $900,000 for each
utility to implement?
MR. COZENS: There's a lot of work going on, because you
have to validate how you stand against that requirement through all your
procedures.
MR. MARION: Thank you, Kurt.
I'd like to talk briefly about the rule that was issued in
final form. This was a revision to 50.55(a) that was issued the 22nd of
this month, last week, essentially incorporating by reference the '95
edition, '96 addenda, effective date November 22.
In the rule-making package, the NRC indicated that they are
giving consideration under a separate rule-making effort this question
of eliminating the 120-month update.
The situation we have now, gentlemen, is one of coherence,
for lack of a better characterization, because right now, in terms of
the regulatory process you have a requirement calling for a continuing
cycle of updates and it's fundamentally unnecessary.
There's no demonstrated safety benefit that's been
established, and it calls for a continuing expenditure of resources that
could and should be applied to matters of safety significance, and we're
encouraging the NRC staff to expedite their decision-making process on
this elimination, and we're looking forward to their decision, and we're
hoping that the decision is based upon the safety threshold that's
necessary and required to support rule-making on that particular item.
To answer Dr. Powers' question earlier, I got into a little
bit of a discussion of standards development, and I'd like to talk about
that a little bit more.
The National Technology Transfer and Advancement Act was
issued in 1995, and there's an OMB, Office of Management and Budget,
circular that provides guidance to Federal agencies on how to implement
that legislation, and it's OMB Circular A-119.
Fundamentally, it calls for Federal agencies to endorse
codes and standards or to endorse standards, because when a standard's
endorsed by a Federal agency, it automatically is characterized as a
code, so let's just keep it in the term of standards.
The guidance calls for the agencies to use rule-making to
endorse these standards and make them effectively codes.
Now, we don't have any fundamental agreement with that
process except that the rule-making decision needs to be based upon the
safety case being made and it should be consistent with the back-fitting
rule, and that's fundamentally the differentiation we're making on this
particular issue.
We're not arguing about the merits of the standard. We
think the standard, if it provides value to the end users, whether
they're utilities, constructors, architect engineering firms,
consultants or whoever, they will be used.
One position we feel very strong about is that the standard
development process, whether it be through ASME, IEEE, ANS, ISA, should
not be an extension of the regulatory process, and by that I mean where
the NRC unduly influences the standard development organization to
achieve NRC objectives that cannot otherwise be achieved by an open,
public regulatory process in making decisions on rule-making.
DR. POWERS: Let me say, if I can understand this, you're
saying that the NRC can flood this committee that makes these standards
up with folks and create something that they would not ordinarily be
able to do via the back-fit rule.
MR. MARION: Yes.
DR. POWERS: I don't understand the ASME standards
development.
I have been very curious about it, so we've had them here
several times to discuss it with me, and they spend quite a little time
explaining to me that, no, flooding it is not possible, that they
restrict the membership so that there's no more than one-third from any
particular group, identifiable group there.
So, now, how would one go about flooding this if one wanted
to?
MR. MARION: I would suggest that the way of influencing an
organization, a standard development organization, is through the
consensus process by holding on to a negative ballot, not justifying the
basis for the negative, and precluding the work product from a writing
committee to move forward until that negative is resolved, and
oftentimes to achieve consensus, individuals will defer to the desires
and expectations of the person casting the negative ballot, and I'm not
just speculating on this, I would suggest that you refer to the
transcript that was developed at the public meeting or workshop that Tom
Scarborough referred ton this 120-month elimination.
There were statements made by NRC staff involved in ASME
code activities that support that, and I would let that speak for
itself.
MR. IMBRO: I guess I would maybe take exception to that.
This is Gene Imbro from the NRC.
I think there have been many instances where ASME has put
things in the code, you know, above NRC objection, that the ASME process
has a second consideration ballot and that only requires a two-thirds
vote to be approved. So, I don't think it's a proper characterization
that ASME can influence the code.
I think, typically, there's only one person on each code
committee, at most, and some code committees have none, no NRC
representation. So, I guess I would take exception to that.
MR. MARION: Well, the public record of that particular
meeting speaks for itself, and I'd like to move on.
MR. WICHMAN: I would agree with Gene. I was at that
meeting, and I do not recall that that issue was as you state.
MR. MARION: Okay.
Let me make it clear that the industry supports the
consensus process. That's been very important in the success of
standard development over the years of nuclear energy, and it needs to
continue into the future.
But fundamentally, the products that come out of standard
organizations need to be of value in today's environment, value to the
end users, and I'm not talking about cost.
I'm talking about fundamental benefit in your processes,
whether it be a current practice or allowing you to apply a new
technology. That's where I'm focusing the question of value.
In order to continue this, there needs to be participation
by Federal agencies, by utilities, by consultants and others in the
standard development process. That participation is clearly the reason
that the process has been successful over the years, and it needs to
continue into the future.
To give you a perspective the NRC has 141 staff people
involved in 254 committees of 16 standard development organizations, and
I'm not suggesting they're flooding the process.
The consensus process will survive, but in the consensus
process, every member has one vote or every participant has one vote.
We believe that the use of rule-making is too slow and too
rigid and it creates a lot of confusion, especially when rule-making
decisions are not made or, rather, rule-making decisions are made on
things that relate -- have no relationship to safety whatsoever, and I
think that's where a lot of people are starting to question the basis
for rule-making to continually endorse and mandate the ASME code through
changes in 50.55(a).
Fundamentally, the tenet of standards development is
voluntary use, and the reason it's voluntary use is because the people
developing these things are confident enough that the end users will
apply their product, and I think that speaks for itself.
There are many, many standards, as I mentioned earlier, used
in the industry without NRC mandating their use through a regulation,
and again, if the NRC decides to incorporate a standard in a regulation,
then that incorporation must be consistent with the back-fitting rule
and a safety case or a safety threshold must be determined.
Let me just indicate that there is -- during this process of
discussion, public discussion on this elimination that's in the proposed
rule-making. There's been a tremendous amount of discussion about the
standards development process.
As a matter of fact, we got on it a little bit today, and I
want to make it very clear that our issue with NRC action is strictly
with regard to rule-making, and the basis for that I think I've stated a
number of times, but there is another aspect of this which is extremely
important, and that is NRC's process of endorsing code cases and later
editions of the code.
The NRC currently uses regulatory guides to endorse code
cases over a period of time. Unfortunately, that period of time could
be several years from the time that a particular code case was issued
and approved by ASME.
That process needs to be expedited and improved, and we feel
-- and matter of fact, back in 1993, one of the recommendations we made
to the NRC along these lines was that we think a way to expedite the
process is to provide the NRC a six-month window of opportunity to
identify whether or not a code revision or a code case is in direct
conflict with an existing regulatory requirement, and if it's not done
within a six-month time period, then the licensees will take as an
acceptance of that particular code case.
We feel that that would be -- will result in more
streamlining, more focus of NRC resources in evaluating these code cases
in the future.
I'd like to just point out that there is a effort that's
being spearheaded by NRC research in dealing with the National
Technology Transfer and Advancement Act and the OMB circular, and it's
part of direction-setting issue number 13, the role of industry, where
NRC is focusing on the organization's participation and endorsement in
standard development activities.
Fundamental objectives, we support, and right now, they're
spearheading an effort to foster better communications with all the
standard organizations and try to identify a better way, a more
efficient way, a more effective way for NRC participation and
endorsement, and I'm, quite frankly, honored and pleased to be part of
that process, and I think there will be some successful outcomes out of
that.
There was a meeting held in May, there's another one planned
in November, and I think that's probably something, at the right point
in time, this committee might be interested in hearing about, because I
suspect that the NRC processes in terms of their participation in codes
and standards will be something that sometime in the future is different
than what it is now.
One of the NRC principles of good regulation is clarity, and
this is one of the five guiding principles, and by clarity, it means the
regulation should be coherent, logical, and practical.
There should be a clear nexus between regulations and agency
goals and objectives, whether explicitly or implicitly stated.
Agency positions should be readily understood and easily
applied.
That's a direct quote from those principles.
NRC's strategic planning activity has changed over the past
several years, and one of the interesting things that's being identified
-- and I hope I'm not responsible for that gentleman's condition back
there -- nevertheless, NRC's implementation of their planning activities
focuses on the attainment of four outcomes, and this is something that
we've been hearing a lot in our interactions with NRC staff and NRC
management over a number of issues.
Those four concepts are very fundamental and
straightforward.
First is maintaining safety, the second is reducing
unnecessary licensee burden, third is increasing public responsiveness
and communication, and lastly, increasing the effectiveness and
efficiency of key processes.
So, in conclusion, let me make it very clear that NRC
decision-making related to regulation should be consistent with the
provisions of the back-fitting rule and a demonstrated threshold of
safety improvement.
In this particular case of continuing the 120-month updates,
there is no demonstrated increase in safety that is commensurate with
the cost of implementation.
We provided data to the NRC for the '89 code and a
comparison of the '89 to '92 code, and we think the time to make that
decision for the right reasons is here and now.
DR. POWERS: I guess I'm still perplexed. You have this '89
to '92 comparison, and it was what you said, and now there are a lot of
things that were of an administrative nature. There's some that
weren't. I don't know what they particular were, and I don't know their
safety impact.
But still, the issue here is not a three-year update, it's a
10-year update.
MR. MARION: It's a forever, continuing update.
DR. SHACK: Yeah, but you want it to be never.
MR. MARION: In a holistic way, the entire code, most of the
provisions that we've seen in '89 and '92 are not safety significant,
fundamentally, what it's all about. I believe Mr. Barton raised the
question about something in the future that may have safety
significance. That's fine. That should fall into a regulatory
decision-making process. We're not arguing about that.
We're just saying the process of continuing this 10-year
cycle and looking at the program in a holistic way is not providing any
value to anyone.
MR. MARION: Well, here's my problem, one of my problems, is
that if I looked in the sky tonight and I didn't see a comet, I couldn't
attest to you that no comets are ever going to come by, and if I look in
the right part of the sky for five years, I might not see a comet, and I
couldn't still say that a comet would never come by.
When people set up this rule a long time ago that requires
this update in here, were they not thinking, gee, things change, and
each individual thing that changes may not itself be very safety
significant, but after I integrate enough of them together, they really
are, and I don't see a way to easily have people go through an analyze a
lot of little things and make sure that they come up to be a huge amount
of safety significance, but because I've got this standards process of
lots of bright people and knowledgeable people working on it, it will be
a rational update, and I'll be sure to capture all these little things
that together add up into a big thing. I mean I don't see the back-fit
rule being necessary here because of the way they set it up earlier.
MR. MARION: I'm not personally familiar with the thinking
of the NRC at the time this was originally established as a regulation,
but as I understand the position from the Office of General Counsel --
and I don't know if there's anyone here from that office -- the thinking
was to allow a mechanism through 50.55(a) to provide a process for de
facto updates of future revisions of the code, okay?
Now, as I understand OGC's position, if it's something other
than a de facto update -- by that I mean update the code as published,
no clarifications or exceptions, but if there are clarifications or
exceptions, then, in effect that becomes a new regulatory position, and
that new regulatory position has to be consistent with the back-fitting
rule, okay?
That's what I understand to be OGC's position that was
articulated a few years ago.
If you're interested in a copy of that letter, I know we
have at it at the office. I can forward it to you.
But fundamentally, we're focusing on the regulatory process
here as it relates to rule-making action, and the data provided by
utilities to us so far have indicated there's no safety value in these
cycles of 10-year updates that have occurred over the past several
years, and fundamentally, if -- let's say in the 2000 edition of the
code -- well let's go to the 10-year -- 2009 edition of the code -- I
don't know if they're going to do one at that point in time -- if there
are provisions in that version of the code that clearly identify a
safety improvement to be had through the inspection process and
activities, then that should be incorporated in a regulation.
There's no question from the industry about that. It's all
of the other provisions that have no impact on safety.
And that essentially concludes the comments that I have. I
don't know if there are any other questions.
MR. IMBRO: I just wanted to mention one thing, I guess as a
point of clarification or maybe to take exception to one thing Mr.
Marion said.
I think he mentioned earlier in his presentation that the
staff supported the '89 code as a baseline, and that's not true.
As the rule presently on the street indicates, the baseline
is the '95 edition, '96 addenda, and I think the question of whether or
not we use the '89 code as a baseline is now -- is off the table.
Any update -- 120-month update would be beyond the '95-'96
code.
DR. SHACK: I guess that completes this session. We'll
probably hear more about the 120-month update in December.
Back to you, Mr. Chairman.
DR. POWERS: Okay. Thank you.
At this point, I think I can go off the transcript.
[Whereupon, at 11:23 p.m., the meeting was recessed, to
reconvene at 1:27 p.m., this same day.]. A F T E R N O O N S E S S I O N
[1:27 p.m.]
DR. POWERS: Let's come back into session, and the next
topic we're going to deal with is the proposed regulatory guide and
design basis information, and John Barton, you will take us through
this.
MR. BARTON: Thank you, Mr. Chairman.
The purpose of the session this afternoon is to hear
presentations and hold discussions with representatives of staff and NEI
regarding a proposed NRC draft reg guide and design basis information.
The staff has been working with NEI since 1990 in developing
guidance on what constitutes design bases information as defined in 10
CFR 50.2. In October 1997 NEI published a document entitled NEI 97-04,
"Design Bases Program Guidelines," and submitted a document for
endorsement by NRC.
After extensive interaction with industry on the subject,
the staff has prepared a draft regulatory guide, DG-1093, in which the
staff proposes to endorse industry guidance in NEI 97-04 as an
acceptable method for meeting NRC requirements. This afternoon staff
will present the status of the draft reg guide, and also NEI will make a
presentation regarding the 94-04 document.
The Committee is expected to prepare a letter on this matter
regarding the acceptability of the draft reg guide.
At this time I'll turn it over to Stew Magruder, who will
take the lead for the staff.
MR. MAGRUDER: Mr. Chairman, I'd like to invite Russell Bell
from NEI to sit up here at the table with me, if that's all right.
MR. BARTON: All right. Stew Magruder and Russ Bell will
make a presentation.
MR. BELL: Thank you, Stew.
MR. MAGRUDER: Good afternoon. I'm Stewart Magruder from
the NRR staff. I'm in the Division of Regulatory Improvement Programs.
And, as Dr. Barton said, I'm here to talk about a proposed draft
regulatory guide which would clarify the definition in 10 CFR 50.2 of
design bases.
The objective, as I just said, is to provide a clear
definition, and so that's understandable to the staff and industry, what
we mean by design basis in 50.2.
For convenience, I've got the 50.2 definition on a slide,
and I'd like to leave that up so we can refer to that for the rest of
the discussion today. I think it's important that we keep referring to
that and understand that we're not attempting to change the definition,
we're simply attempting to clarify it and make sure that we have a
common understanding of the definition among the staff and the industry.
I wanted to start out by briefly discussing the relevance of
design bases. In our discussions we routinely are asked why we worried
about this and what's the importance of defining design basis or making
a distinction between design basis information and other information. I
guess to start out with, as you see, design bases -- the term is used in
many regulations; 50.34 describing the content of the SAR -- it will be
used soon in the 50.59 criteria. It's used to define reporting
requirements, the GDC obviously refer to design bases, and Appendix B,
criterion 3 on design control, refers to design bases.
DR. APOSTOLAKIS: How does that fit into the definition on
the right?
MR. MAGRUDER: The term "design bases" is defined in 50.2
because it's used in the regulations.
DR. APOSTOLAKIS: Oh, in the 2(a) requirement.
MR. MAGRUDER: The --
DR. APOSTOLAKIS: How do they fit into the definition of --
MR. MAGRUDER: The term is used in criterion 3, design
control, which says a paraphrase that basically you need to keep control
of the design bases of the plant.
DR. APOSTOLAKIS: Thank you.
MR. MAGRUDER: Yes, sir.
DR. APOSTOLAKIS: Now one last question.
MR. MAGRUDER: Yes, sir.
DR. APOSTOLAKIS: What's the difference between the
licensing basis and the design basis?
MR. MAGRUDER: The design basis is a subset of the licensing
bases. The design bases refers to the actual design of the plant,
whereas the licensing basis includes other elements such as programmatic
elements, maintenance, QA.
The last bullet here beyond just the utility of defining
50.2 or defining design basis in 50.2, we believe that understanding
design bases is important when you're making changes to the plant or
you're evaluating conditions in the plant. That's why we think it's an
important issue.
Very briefly some background information about how we got to
where we are with this draft reg guide in discussions with the industry.
This issue has been with us for several years. The engineering
inspections are not the first sure time that this issue's been brought
up, but for brevity I'll just start there.
We talked about these issues in the late eighties, and we
did big engineering team inspections. In response to those inspections
the industry developed guidance which was focused mainly on helping the
licensees reconstitute their design bases, understand what information
was important, and in some cases go back to their NSSS designers or AEs
to retrieve information it doesn't have. The term was defined in that
document; however, it wasn't the focus of the document.
The staff did a series of inspections to look at what
licensees had done and published NUREG-1397 in February of '91. And the
Commission issued a policy statement in August of '92 which concluded
that the NUMARC guidance was effective in allowing licensees to go back
and reconstitute design basis, and more importantly that the Commission
policy statement emphasized the importance of understanding your design
basis and maintaining your design bases.
Subsequent to that Millstone, Maine Yankee inspections and
shutdowns led to obviously a greater focus on understanding design bases
and controlling plant design bases, and then the Nine Mile Point issue
here is one where we've had discussions with the industry on when they
should report when they're outside design bases. And as you're probably
aware, we've undertaken proposed changes to the reporting requirements
partly in response to that.
At this point I'd like to turn over the rest of the
presentation or the next part of the presentation to Russ Bell from NEI,
who will go through the industry's guidance.
MR. BELL: Would you put this over there?
Thank you, Stew, and thanks to the Committee for having me
back. It's about I think two months ago I was here talking about the
FSAR update issue, and I'd probably respond favorably to an invitation
to come back soon on 50.59. Today is the third of what Tony Pietrangelo
and I -- Tony is with me in spirit in the back there -- call it the
triad of fundamental licensing issues that have been in play for a few
years. The FSAR was pretty well worked through as we talked about once
before. Design basis is reaching a climax, we think. And 50.59 is also
very well along with draft guidance out for industry and NRC comment.
These issues are all interrelated, and in the case of design
basis, as Stew pointed out, is the definition that appears a number of
places, the fundamental building block, okay? So it's very important to
us as well as to the NRC.
I've given you a package of slides. For the sake of
completeness, I included some -- in fact, Stew, I also have a background
slide, I talk about the Nine Mile Point issue, which was very important
in renewing discussion of this issue a couple -- a few years ago.
You'll see -- I'm just flipping through these because Stew's already
done it. We have a very similar objective in mind.
We do add a second bullet in terms of our objective. Not
only is it important to have the common understanding of the definition
to support the other regulations, but in and of itself the definition is
important in the sense that design issues that come up, that are either
identified from the past or come up in the future are characterized.
And they may be characterized as, you know, design discrepancies.
To the industry if it's characterized as a design basis
deficiency or a design basis issue, we take that extremely seriously, as
your see, because of the way we define that term. And we want that
characterization when it's used to be appropriate. It doesn't do the
NRC or the industry any favors to characterize issues that aren't quiet
so significant as design basis issues when in actuality there was never
any question that safety systems would have performed their function,
and so on. So that's the other important part of this activity as far
as we're concerned.
Stew's word was "relevance." My slide says "importance."
But again, similar material.
I might start to get right into the discussion of the
guidance on this slide. And I'm sorry, I don't think they're numbered,
but they are recognizable.
As I understand it, the Committee probably received our
August 19 version of this guidance. Now in the last few days we've we
think finalized that, and we've sent it -- this was after another
discussion with the NRC, and we've sent that over to Dave --
MR. BARTON: We just got it for the first time, Russ.
MR. BELL: Okay.
MR. BARTON: We haven't had a chance to review it.
MR. BELL: It is very similar to what you may have had for a
longer time, the August 19. The few changes that are in there, your
attention's drawn to them by rev. bars on the right-hand margin.
This guidance is actually in the form of Appendix B. What
you've got there is Appendix B to our Document 97-04, which was an
update of the document Stew mentioned that we did almost ten years ago,
NUMARC 90-12. We revisited that a couple years ago, and actually
reaffirmed it. Very little in the way of, you know, changes to the
document, but the design basis issue on account of the Millstone lessons
learned and the Nine Mile Point issue, we determined that we did need to
take another look at the guidance that was out there.
We did that, and after looking at 90-12, we made a few
changes, added a couple more examples I think to the back, and reissued
as 97-04. The guidance you have here is just Appendix B from that,
which zeroes in on the interpretation of the term "design basis" and
contains all the examples.
MR. BARTON: Is there a specific reason that we're not
asking for the whole document to be endorsed through the reg guide?
MR. BELL: The balance of the document -- in fact, look at
the title of the document, "Design Basis Program Guidelines." It was
very much to do with, okay, licensees, this is how you could go about
setting up design basis programs at your plant. This is where you might
go to look for design basis information. This is how you might want to
compile it.
That really is the bulk of the material. That's really not
the issue in play and it's probably more a licensee call as to how he
wants to do that.
MR. BARTON: Okay.
MR. BELL: The regulatory matter is the interpretation of
the definition.
MR. BARTON: Okay, thank you.
MR. BELL: And that is covered pretty much by Appendix B and
that is the piece we singled out.
In the last year we again revisited the issue of 9704 and it
was pointed out that we present the definition and we present examples
of design bases but in between there was a missing link -- what we call
framework guidance criteria for identifying or distinguishing design
basis information from the bulk of design information. I think that was
a fair comment and we undertook to fill that gap with general and
specific guidance and some additional guidance on doing that that would
help you link, see how you got those examples from the definition, so I
think that is what this latest guidance is going to do.
It is formatted in a way that highlights what we think is
very important, the linkage of design bases to the regulations, okay?
The design bases aren't all the design information at your plant.
Design basis functions are not all the functions performed by your SSCs.
They are the specific set of functions that are either required to be
regulations or that you take credit for in the safety analyses, in your
safety analyses to show you mean Part 100 limits, GDC-19 limits, that
kind of thing.
That is a key principle, as you will see on the next slide
that we think this guidance focuses on, the other one being the
distinction between design bases and what we call supporting design
information, which is a separate underlying set of design information,
much larger set of information, some of which resides in the SAR with
additional design description, but much of which resides at the
licensee's file specifications, detailed design drawings and so forth.
That is another key principle that we are trying to get.
I will just mention that the format is to present those
principles. Because you mentioned what is the difference between design
basis and licensing basis, because it is so important to understand the
role of design basis in the regulatory framework we spend a fair amount
of time discussing its relationship to other concepts like licensing
basis still gave you the perfect answer on that, but there are a number
of other relationships that we try and develop, again to underscore that
understanding of what design basis are.
We provide a number of examples. Design bases functional
requirements, design bases controlling parameters, which is where you
will get numerical values that are the reference bounds for design, and
then again examples of supporting design information.
You are well aware then that we provided the NRC that on the
28th. You have received it. We had a task force assisting us as we
generally do on such things.
We are pleased the NRC is on a course to endorse this thing.
That is an indication that we have really come a long way on this. I
think we have made some fundamental progress narrowing down a common
understanding of this thing.
There are a couple remaining issues I think Stu is going to
comment on after I get through and they are on a schedule to provide the
draft Reg Guide, as you know, by the end of this month.
I also had the definition in my package but this is a much
better idea. These are our basic principles or key principles, the
first thing you see in our guidance after our definition and it drives
home that point that -- well, a couple of points. There are design
basis functions. We think those are tied directly to the regulations,
the functions that are required to meet those regulations -- license
conditions, orders and tech specs, also the functions that you credit in
your safety analyses. The tie to safety analyses is critical in this
regard. It makes sense.
Those are the limiting values for your parameters are used
in the safety analyses. That is the basis on which you received your
license and so we think those actually become your design basis values,
which is the other category of design basis information if these are two
separate categories.
The values themselves -- they may be specified in
regulations; 50.46 has the 2200 peak cladding temperature right in the
regulation, so there is a design basis numerical value that came right
from the regulation. Others might be chosen from a Regulatory Guide or
other type of guidance document and used as an input to an assumption in
your safety analyses. Again, the tie to the safety analyses is very
critical. Those become the limiting values for the balance of your
detailed design, so these are key principles.
We call those general guidance in the document. Specific
guidance -- here is one I haven't mentioned. The design bases functions
include the conditions under which those functions must be performed --
I must provide this much water from here to there in that much time
against this much head. I also need to know under what environmental
conditions that might have to be performed, seismic conditions, fire,
wind loadings.
Those types of conditions under which design basis functions
need to be performed would also themselves be considered design bases.
Stu mentioned that they are a subset of the licensing
basis -- the design bases are required to be presented in the SAR. That
came from 50.34. That is how the applications were set up, so we think
the design bases are located in the SAR.
The last key principle is design basis information is at a
fairly high level and it is recognized that underlying that is a
significant amount of supporting design information. I think the
distinction is very important. That is why we come back to it quite a
bit.
I will not go through all of these. I mentioned that we
tried to place design bases in context with a number of other regulatory
concepts and terms including these. I mentioned Appendix B, licensing
basis. Some of these will come out as we continue.
If you peeked ahead I can dwell on the aux feedwater for a
little bit. After the general and specific guidance and the discussion
of relationships, we get to a number of examples. There's a note in the
front that says these examples are representative. They are intended to
be actual examples or all inclusive. A given plant may have different
design or additional design bases functions or values than are presented
here.
That said, we tried to pick a range of different types of
things -- aux feed, BWR containment. We included the MOV and turbine
generator example at the suggestion of the Staff and at this point let
me identify -- the guidance gives the licensee, and this has been true
since back in 9012 -- the licensee had the flexibility to address design
bases issues in a topic format.
You could take the aux feed system and say every component
in the aux feed system shall be seismic, EQ, you know -- tornado-proof
and so forth. On the other hand, that would create a very repetitive
situation. You need to repeat that kind of information over and over
for system after system. Why not take care of those topically? That is
what we mean when we say topical design bases.
In the guidance we did a couple examples. One very
important one is a single failure criterion. You can treat that
topically rather than over and over. Obviously numerous systems are
required to meet the single failure criterion and seismic, tornado. EQ
is another good one, but I don't think we did the example on that.
You won't be able to read this, but you have in your
package -- this is simply a page from the package. The aux feedwater
example I will just comment for a minute it reinforced a couple of
things I have said so far.
In better understanding design basis, we identified two
categories of information -- functions, design basis functions -- and
the controlling parameters used as reference bounds for design. This is
where your numerical values will show up.
On this side you'll notice we state a function, generally
understood function of the aux feedwater system, and we link it to the
basis in the regulation for that function.
Over here you will find the "xxx" gallons, "yy" pressure and
"in x seconds." These are the parameters and the values typically taken
from or used in the safety analyses as the basis for demonstrating that
the design meets all the NRC requirements. These are the key parameters
used in the safety analyses, which are the bounding analyses for the
balance of the design.
Also, the you may not get from that that it needs to
function without any AC power at all in the station blackout situation,
so we have a separate item here, and for I am not sure all but perhaps
many plants pressurizer vapor space is another limiting parameter used
in design in the AFW system.
There is a link here, a relationship to the refueling water
storage tank. That is a requirement here. This shows how the topical
requirements come in. You notice the topic design bases are in that
left-hand column and so tied to the regulation -- GDC-2 for natural
phenomenon and so on -- so these have equal importance, equal status as
those very functional, specific functional requirements that we were
just looking.
DR. BONACA: Is this page out of your guidance?
MR. BELL: Yes.
DR. BONACA: It is? Okay.
MR. BELL: Hopefully it is page 10.
DR. BONACA: I was just curious because nowhere I see it for
the auxiliary feedwater system specification for how much each pump
delivers but in mean in terms of decay heat, so the redundancy of the
system is not mentioned and yet the FSAR, Chapter 10, has definitions of
how redundant the system is supposed to be, so there is nowhere you have
a requirement for that?
Is it one of the issues being debated with the Staff?
MR. BELL: In fact, hopefully you found this one. I am
looking at my topical -- I want to say that we have got the single
failure criterion here, don't we?
DR. SIEBER: Page 10.
MR. BELL: I apologize. It is hard to read from here.
DR. SIEBER: That's it.
MR. BELL: Okay, so absolutely it needs to be redundant, and
that comes straight from the --
DR. BONACA: But single failures means that you've got to
have two trains but the FSAR establishes if you have to have three
trains or the level of reliability of your specs, so that would be a
requirement, right?
MR. BELL: That would be part of your -- that is how you
meet this requirement, or how you meet the GDC --
DR. SHACK: And that shows up on page 11?
MR. BELL: Thank you, that's a good idea. Let's go there.
DR. BONACA: What is there?
MR. BELL: How you meet that requirement, whether you have
two trains, three trains, six trains, whether you have a DC pump as your
diverse source instead of the turbine driven one, that becomes the
description of how you meet that requirement. That is the design in our
view rather than the design bases, okay?
You are right, that information, how you meet the
requirement, that you have two trains or three trains and a turbine
backup, that is in your SAR -- that is very important design information
that was reviewed and approved by the NRC in granting a license and you
maintain that information complete and accurate and so forth, so I think
that is an excellent example of a distinction between the design bases
and the design.
MR. BARTON: But it is also the basis that the Staff has got
for not endorsing the examples in Appendix B, and what they are trying
to endorse is your Appendix B with several exceptions, and when you take
into account the exemptions they have got for Appendix B, you kind of
get to what is the value of endorsing the NEI document.
DR. BONACA: Because that exception is humongous. I mean if
you go through and you take that exception, it makes a big difference on
every system.
I mean if -- I mean there were expectations after TMI that
your aux feed system would be more available, so therefore there was an
expectation that you would have three redundant systems and certain
diversities in the system and sources and so and so forth.
All that stuff is specified in Chapter 10, if I remember the
FSAR, and so if you do not specify those things, you have a very simple
definition in fact, and you don't meet those requirements of the
regulation right?
I mean if you are supposed to have a three redundant system,
which means an unavailability of maybe one in ten to the minus five, on
demand, that is a requirement, right, in the design basis -- or is it?
I am trying to understand.
MR. BELL: Well, you absolutely need to maintain redundancy
or else you are not meeting the GDC. If you are saying, well, I have
got four trains and I was licensed that way and I think I might want to
take out one of those trains, I will still be redundant, that would be a
change to the design that would clearly involve an decrease in the
reliability, let me put it that way, in the system -- presumably.
In 50.59 language it would involve an increase in the
frequency of an accident or a likelihood of a malfunction and you would
clearly be into a space where you need to go talk to the NRC about that,
so that is not something obviously we are talking about a case that is
somewhat hypothetical but that type of information, again how you
deliver that "xxx gpm" against that much pressure, that becomes the
design as opposed to the design basis.
Dr. Barton, you are absolutely right. That is one of the
few remaining issues we have. I can't argue with you that it is a minor
detail.
MR. BARTON: This is a major issue with what is really being
endorsed when the NRC really says, hey, we are endorsing the Appendix
except we're not and that is really what the Reg Guide is doing and I
am totally confused as to what we are really accomplishing here when we
don't seem to have come to closure on some major issues, this being one
of them.
DR. BONACA: The other thing is that these things have a
long history. I mean the reason why, for example, the number of
redundances in aux feedwater systems were increased was in part because
for the Westinghouse plants they had an isolation system that went in
because of steam line break concerns that isolated all the main feed
every time you scram, and that was a big concern because suddenly you
went from plants which normally did not isolate main feed, so you always
had main feed to a new generation of plants that had no main feed
because you isolated because of steam line break concerns, and now you
have to have more auxiliary feedwater pumps to deal with the fact that
you were by design removing available main feedwater systems, okay?
So, you know, that stuff brings in a history on development
of these power plants which were reflected in the Chapter 10s of the
FSARs that is fundamental to the design and that is really the design
basis of the plant.
I think that is the point Mr. Barton is making, that it is a
significant issue. There are not only four issues here, they are big
issues.
MR. BELL: There is no question that is important design
information.
DR. BONACA: I just wanted to get a sense of how far apart
you were.
MR. BELL: Well, one of our concerns -- I didn't list it an
objective. It goes without saying you want a definition that is clear,
implementable, workable. One concern that we have with that remaining
issue with the staff is once you begin to include certain design
information as design bases, it may become very difficult to draw that
line. And where does it, you know, where does it stop?
The thing we know we don't want is to identify something as
design basis where you're setting yourself up for a fall somewhere. It
might be a minor, or I should say a less significant matter, one with a
small discrepancy, and it would not undermine the ability of the system
to perform its function. That's where we've drawn the line at the -- if
you preserve the ability to perform that function as credited in the
safety analysis, that's where we think we've got a workable space to
work in.
So -- and you can see the range of the type of information
here. Take the third bullet, the system design pressure of the system.
By that I mean the, you know, kind of ASME code maximum internal design
pressure of the system. It might be 1,500 PSIG. To go back to the
design basis function here, we could say that it might be 500 gallons a
minute against say 1,200 PSIG if, for example, the design -- if this was
elevated from what we call supporting design information to design
basis.
This is a very important aspect of design. There's no
question about it. It's essential to have a robust design to support
the design basis AFW function. But, if you find one day that your
actual AFW system piping or a portion of it may be capable of
withstanding only 1,450 PSIG, okay, we don't think you want to be in the
position of declaring that to be an out of design basis situation
immediately.
We would say like all discrepancies you would evaluate that
first as am I operable? is it reportable? and now is it a design basis
matter we can categorize. We would say that the capability to perform
that function is still preserved, okay? And that's an indication that
this type of parameter would not be a design basis controlling
parameter. That's where we come from, and that's our rationale. Very
important design information and certainly figured prominently in the
staff's review of the design originally. And if there is a discrepancy,
obviously it needs to be appropriately dealt with.
But anyway, I think that's probably enough on that. I think
I've underscored some of the key principles, the structure, the
guidance, the tide of the regulations that we think is so important, and
the distinction between supporting design information. Again there's --
when discrepancies are identified, it's important that they be properly
characterized and not mischaracterized as design basis issues when in
fact there was never any question that design basis functions would have
been performed.
Just to wrap, we'll keep working with -- in fact we have a
meeting on the 14th to try and address these remaining issues. I expect
we'll issue a revised 97-04, and obviously comment on the staff's draft
reg guide as necessary.
If it's all right, I'm going to stick around while you
proceed.
MR. MAGRUDER: Yes, in case there are questions.
MR. BELL: Do you want to?
MR. MAGRUDER: Yes, let's switch.
As you've pointed out, there are some significant
discrepancies or exceptions between the staff and NEI still remaining.
I would like to say, though, that this list is much smaller than it was
a year ago, believe it or not.
MR. BARTON: Yes, but you've had several meetings in the
recent past and several revisions to the NEI guidance, and you still
have these large exceptions.
MR. MAGRUDER: We still do. That's correct. That's
correct. Our goal is to endorse the industry guidance.
MR. BARTON: I understand --
MR. MAGRUDER: If that's not possible, we think it's
important enough that we would issue a reg guide on our own to make
clear what the design basis information is, because you're absolutely
right that there are some significant differences.
And I'd like to try and explain why the staff feels the way
it does on these issues. And our goal obviously is to put this together
in a manner that's understandable and ask the Commission to publish this
for public comment to get more input on the process. But your views on
the subject are important to us and would be welcomed also.
There are four major issues that we are taking exception to:
redundancy and diversity, design basis values, normal operation, and
testing and inspection. And we've concluded a fifth exception in the
reg guide just basically stating that the examples are not based on the
staff's viewpoints, they're based on the industry guidance.
MR. BARTON: It says if the industry uses them, the
industry's out there hanging on a limb, because you don't -- you guys
don't agree with that.
MR. MAGRUDER: That's pretty much correct.
We would, if they looked carefully, it would be clearer
which examples we agree with and which we don't, but we agree that it's
not an ideal situation.
I'll start with redundancy and diversity, which we've talked
about already here. The staff believes that it's not sufficient to
include the statement that the system will be redundant and diverse and
meet single failure criteria in the design basis, and that -- a brief
discussion of how the system is designed to be redundant and diverse
should be included in there. That we think that redundancy and
diversity are design parameters that need to be addressed in the design
bases. And that's basically why we think that they should be included.
Design bases may include credited features beyond those
required to meet single failure criteria, and we think that it's
important to include those. Examples would be there are other design
requirements that go into design such as seismic requirements or
separation requirements. In addition, there are some instances, as Russ
has alluded to, where a plant chooses to install three trains of a
system where only two would be strictly required for a single failure.
We think that the fact that it was designed with three trains and the
staff reviewed it and, you know, for robust overall plant design with
three trains, it's inappropriate to say that only two trains are
therefore design bases and one train is not included in the design
bases. That's our basic position on that.
Design bases values is another exception, another area where
we're still working with NEI. The design basis definition includes we
think all functions, both -- and that would include active and passive
functions of an SSC. It also includes values associated with functions
that assure an SSC can perform its required functions.
Russ already talked about the system design pressure for the
aux feedwater system as an example. We think that the integrity of the
AFW system piping is critical to performing the safety function of
getting water into the steam generator. So we would think that the
function of maintaining integrity should be included in the design
bases.
MR. SIEBER: Can I ask a question?
MR. MAGRUDER: Certainly, sir.
MR. SIEBER: Just using that as an example, and the further
example of the discovery that it did not meet the original design
pressure, obviously there's relief valves there, but I don't see them
specified anyplace, and one could construe that if you could accept a
lower design pressure, also lower the relief valve setting to protect
that piece of pipe and thereby create the possibility of an accident
should you get an overpressure in the system which would relieve and rob
you of flow.
MR. MAGRUDER: Um-hum.
MR. SIEBER: And so where does the subcomponents like relief
valve settings or other instrument settings that are designed to protect
the integrity of the system fit in? Is that in some notebook someplace,
or is it in the design basis or a design value?
MR. MAGRUDER: We think that the relief valves or other
components such as that, that their functions are important, and that's
the reason why we think system design pressure should be included in
there, because when you size relief valves, obviously you need to know
what the important parameters are. The valves themselves, a description
of the valves themselves we don't think should be included in design
basis. That's supporting information about how the plant is designed.
But the fact that you need to design it so that it doesn't -- it can
relieve -- to maintain 1,500 PSI is inferred from the design bases.
MR. SIEBER: Right. Thank you.
MR. MAGRUDER: The third bullet here talks about code inputs
that we think should be included or may be included at times in the
design bases. An example of that is the cumulative usage factor used in
the fatigue determination for other ASME code requirement for design.
Where they are values associated with design basis functions we think
they should be included as part of the design bases.
Normal operation is another issue here. I think that if I
had to characterize these, I think the first two issues we talked about
are probably the most significant issues that we have. The remaining
two are important but less significant, I would say, and the reason I
say that is I think we are closer to agreement it covers a smaller
population of SSCs. We think that it is important to understand that
design bases values and functions can be generated or inferred from
normal operation as well as accident conditions in that systems that are
only required during normal operation also have design bases.
An example of this is the fuel that in most cases the most
limiting conditions are found during normal operation and most of the
design inputs are based on normal operation, so we don't want to leave
the impression that safety analyses or the Chapter 15 analyses alone
provide the design bases for the plant.
DR. SIEBER: Maybe I could ask another question.
MR. MAGRUDER: Of course.
DR. SIEBER: If you move to risk inform regulation you
somehow or other shift your emphasis from Chapter 15 to another set of
incidents that could occur at the plant. Does that change the design
basis?
MR. MAGRUDER: Under the current scheme, once we are through
with Option 3 or whatever, if we define a new set of design bases
accidents or include severe accidents in the analyses, then the design
basis of the plant would change, but the design bases are derived from
requirements in other regulations so they would follow from the
requirements in the regulations.
The next issue is testing and inspection. The point here is
that many general design criteria specify that design systems should be
designed so that they can be tested and inspected and Staff feels that
testing the capability, is an input into the design and should be
considered design bases.
I would point out though that we are rethinking that issue
and the issue comes down to whether testing and inspection are functions
and required functions and whether it is performed by the system or on
the system, and so I think we are still -- we get into these discussions
on these issues and I think we can talk some more about that.
For completeness, I would like to point out, as you
mentioned, Mr. Barton, that the examples as currently written in the
guidance do not reflect all the Staff positions in the draft Reg Guide
so that we have included that as an exception as well.
That concludes my presentation. I am sure Russ and I would
be happy to answer any more questions, if you have any.
DR. UHRIG: What is the implication of including, for
instance where you have optional three trains instead of two of
including it in the design basis? This then brings it into the tech
specs and all the rest of the requirements?
MR. MAGRUDER: No, we are not attempting to redefine the
tech specs. Some systems which are covered by tech specs -- let me put
it this way. Many more systems have design bases that are included in
the tech specs and the tech spec treatment is separate from the
definition of design bases. I don't know if that answers your question
or not.
DR. UHRIG: Well, in going back to the case where it was
four trains versus three trains on instrumentation and it was a question
of who got the margin, the margin for operation or the margin for
safety, I sort of see the same issue evolving here.
MR. MAGRUDER: We are not attempting to solve that issue
with this discussion here. I am not an expert on tech specs, so I
couldn't answer that question I don't think.
DR. UHRIG: I don't really see what the issue is then.
MR. MAGRUDER: I am not sure I understood --
DR. UHRIG: The difference between the two positions. What
is the significance of including that third train in there?
MR. MAGRUDER: Oh, I see what you are saying. Okay.
DR. UHRIG: What is the practical aspects of it?
MR. MAGRUDER: The practical aspects are that we think it is
important that the operators understand why three trains were installed
in the plant and why the Staff reviewed or approved the design with
three trains.
There may be other reasons that are not immediately obvious
to the operators why there's three trains there, and we think it's
important to include all the design or all the facility and the design
bases so that the operators will understand the importance of it.
DR. KRESS: Did those extra -- I will call them extra trains
play some role in the original decision to grant the license?
MR. MAGRUDER: Very likely they would. They could have.
DR. KRESS: If they did, that to me would be a reason to
have them in the design basis.
DR. BONACA: To give an example, you know, if you look at
many Westinghouse plants, they have what they call the G spec, which is
the General Spec, and then they have the E spec, which is the equipment
spec. They are cookbook specification design to build, and if you go
through those and you can read through what requirements are coming from
the regulation.
In fact, the question I was going to ask is, you know, this
is in existence already. The designers had to deal with these issues and
they didn't put in four pumps because they liked to spend more money and
put in pumps. I mean there was some requirement there that came from
somewhere. I quoted before the requirement of isolation for the
Westinghouse plants, that they had a concern that if you had a steam
line break that you would have a runout condition and overcool and
return to power, so they put an isolation system on the main feedwater.
Well, suddenly you have this totally different design where
all your main feedwater system, which we have pumps running, are
isolated, so you are putting more demand on the auxiliary feedwater
system. They resolved that by going to three trains as a minimum
commitment. Actually, the packet explains it, also tells you when you
have to deliver the water, for example, before you dry out the steam
generator, so they have some calculation to show dryout time and the
time for delivery.
So those things I mean have -- that's the point you are
making. Exactly right, Tom. They were in the original design. Without
it, you could not make a PRA because you wouldn't know how many
redundancies you have in that system.
DR. UHRIG: But there are cases were -- and again I go back
to this example of the instrumentation trains. The fourth train was put
in for the purpose of giving you additional operational flexibility in
the event that you had one train out for testing and you had fault,
instantaneous failure on the third train, if you had a three hour to
four requirement, which is what got imposed on this instead of the two
out of three -- the original intent was to have two out of four -- which
would have been just the same from a safety standpoint as a two out of
three, but the three out of four got imposed because they wanted
additional margin. Of course, we wanted the additional margin at that
time for purposes of operational flexibility, and it was -- I don't
remember -- 10 million dollars or something was put in there
specifically to gain that margin that's got lost. Eventually it got
resolved but it was years.
MR. BELL: If I may, I heard a couple things I just wanted
to speak to and one is this notion that, well, it was considered at the
original time of licensing. It may have been very important and might
make it in this category of design basis. You see, that is exactly the
problem. An enormous amount of information was considered, okay? --
even more than is summarized in the SAR, so as a criterion we find that
to be not determinant --
DR. KRESS: It's not a real good quantitative --
MR. BELL: Okay. Our goal is to have a scope that is
finite, meaningful -- okay -- we want to distinguish design bases as a
meaningful term, meaningful concept from the balance of design.
You know, the folks who have got three trains versus four
trains, fluid systems, I&C systems may of course know why they have
those. They frankly don't need us to tell them, well, it's design basis
or it is not, to remind them how significant it is, so your question
about, well, what is the difference I think is very valid, and I think
it has come up at every meeting we have had, trying to remind ourselves
why this is so important.
DR. BONACA: But, see, you are telling me that if you can
deliver and can remove decay heat, it doesn't matter if you can do it
with one pump, five pumps?
MR. BELL: If you only have the one pump, you are going to
be in violation of a GDC requirement.
DR. BONACA: That's right. GDC is implying redundancies and
diversity and the design basis defines what it is. I mean it is in the
FSAR, so it is just hard for me to understand how that specific piece of
information would not be critical.
We would discuss here in the ACRS in fact the validity of
existing PRAs given that there are discrepancies in the design basis.
Well, assume there are no discrepancies in the basis, but you don't know
if a system is two redundant or three redundant. You can never know
what the PRA will give you. I mean then we can forget about that
because that is exactly the question the PRA will ask.
DR. KRESS: Why does the PRA necessarily have to be tied to
the design basis?
DR. BONACA: Well, as a minimum you have to understand how
many times you can deliver a function to have an availability for the
system.
MR. BELL: We would say, of course, the PRA reflects the
design.
DR. KRESS: Ought to reflect the design.
MR. BELL: Well, the design basis is almost a term of art
that the regulators have used and licensees have dealt with. You know,
in field it really has very little meaning to folks, but it is used
throughout the regs. We need to understand what it means.
It is misused at times when design issues come up -- because
I am down a train, it does not mean -- down a train might be
maintenance. It does not mean I am outside my design basis. We would
not want it to go that way.
I would still have redundant diverse capability as I must to
meeting not only -- you know, I misspoke earlier. If you had only the
one pump not only would you be in violation of the GDC but you would
also be out of your design bases because the single failure criterion,
as I mentioned before, we would consider that part of the design bases.
DR. BONACA: Don't take the one literally. I just wanted to
give you the difference between one and five.
DR. UHRIG: The difference between two and five may not make
any difference.
MR. BELL: To bounce these issues off of our principles, the
redundancy, diversity issue, okay -- how is that tied to the
regulations? You remember that is very important to us and it is one of
the key principles that we have up in front of our document.
Well, the tie relies by the single failure criterion. That
is as far as the regulations go, and so we would say that the design
basis of the system needs to satisfy the single failure criterion, and
that is as far as the design bases would go. How you do that would be
part of the design, a very important part of the design but still part
of the design.
MR. MAGRUDER: And the Staff would say that just stating
that you are redundant and reverse and you meet single failure is not
sufficient, that the parameters, the design basis parameters, as
discussed in the definition, include how you meet redundancy and
diversity, so that the two pumps or the three pumps or three trains or
however many trains you rely on, aside from what you installed for ease
of maintenance or whatever, that is a separate issue. I understand now
the issue you are talking about, that the Staff feels that that
fundamental design information is design basis.
DR. UHRIG: Well, it was more than ease of maintenance, it
was a case of remaining in operation if you had a glitch -- when you had
one channel out -- that kept the plant operating.
MR. MAGRUDER: Okay.
DR. UHRIG: Otherwise it would have gone down.
DR. KRESS: Well, certainly you would think diverse implies
an entirely different kind of system to provide the function and the
description of that in the parameters, how it works, ought to be part of
the design basis rather than just saying it is diverse.
MR. MAGRUDER: Right. That is our position.
DR. KRESS: Yes, but if you have more than one or two of
these that are needed to meet your design basis requirements in the
rules, then probably those spares that were put in there for some other
reason might not have to be part of the design basis.
MR. MAGRUDER: Right, and we want to make sure that the
operators and the engineers at the plant understand why they are all
there.
DR. KRESS: Why they are there.
MR. MAGRUDER: Right.
DR. UHRIG: But it isn't the case that you have to have
these two. It is "two of" that are the requirement. It doesn't make
any difference whether it is number one or number two or number one and
number three -- it's a two out of three or two out of four requirement.
There is no specific two.
MR. MAGRUDER: That's true.
DR. POWERS: But --
MR. MAGRUDER: That's true, but there's probably, like we've
stated before, there is a reason why all those were installed and the
reason why they are there is important, and it may not be for
redundancy. It may be for another reason.
DR. SIEBER: Well, regardless of the reason your design
basis ought to at least recognize that they are there, right?
MR. MAGRUDER: Right. That's correct.
DR. SIEBER: Then you could spell out further what
combination meets the design requirement or the licensing requirement.
MR. MAGRUDER: Exactly.
DR. KRESS: If there is a system put in or component put in
by the designer and the licensee because he wants it there for some
reason, it helps him do his job, but it's not needed to meet your design
basis requirement or your GDCs or anything. It is just there for his
use. I would view that as something like margin that ought to be his --
he ought to be able to put -- if he doesn't want it anymore, he ought to
be able to throw it out and he shouldn't have to worry about it being in
the design basis. Is that the feeling --
MR. MAGRUDER: I think the Staff would agree with that also.
DR. KRESS: Okay.
DR. POWERS: I don't understand that.
DR. KRESS: Well, I don't understand what the problem is
then.
DR. POWERS: It seems to me they gave an answer that I
wouldn't have given.
DR. KRESS: Yes.
DR. POWERS: Four systems and --
DR. KRESS: And you only need two --
DR. POWERS: -- and you only needed two, but it seems to me
your design basis would still have all four described.
MR. MATTHEWS: The Staff would agree with you. The design
basis would still include all four systems. The design basis can be
altered. This isn't inalterable, but it is the design basis for
whatever reason.
DR. SEALE: In order to meet the two out of four requirement
all four systems have to be of a certain qualify. They have to meet the
design basis.
DR. POWERS: You have got a two out of three requirement but
you put in four. I still think you need to have all four.
DR. SEALE: That's right, because all -- the two that are
there at the time have to meet the requirement.
MR. MATTHEWS: Because whichever two they might be, and they
may be any of the four, so --
DR. KRESS: Right.
DR. UHRIG: The issue that came up originally was not design
basis. It was tech specs.
DR. BONACA: We are confusing the things.
DR. UHRIG: That is why I was wondering whether this implied
tech spec --
MR. BARTON: Don't confuse the issue here.
MR. MAGRUDER: No.
MR. MATTHEWS: No. It does not also afford an opportunity
for discussion of what treatment rules need to be applied. It is a
question of what the design basis is and then your treatment rules deal
with that design basis -- excuse me. I am David Matthews, Director of
the Regulatory Improvement Programs.
I wanted to add that although we characterized it that the
Staff views it this way, or the Staff is of the opinion, that is clearly
how we articulate it, but we view the positions we have expressed as
deriving from the definition that we put up on the board. That is why
we continue to go back to that.
We take reliance on these interpretations out of words like
"specific function" and ranges of values and controlling parameters.
Those are the bases for us establishing these positions. It
is not just a question of our preference or what we would like to see.
We think that is what the regulation has directed us to identify is
design bases.
I think Stew did a good job of clarifying that, but we are
sometimes cast into the vernacular of speaking as if it's just a staff
preference. It's really not a staff preference in this instance, it is
a staff interpretation of what the regulations require.
I wanted to add another comment that we have gone hammer and
tong on some of these issues, as you might expect, and we have not
reached consensus on all issues, although I think, as was also commented
on, we have come to closure on many, many issues, like a lot of the
regulatory process issues we've been discussing over the last couple
years with all of you, 50.59 and issues related to FSAR updating, there
was a lot of areas that needed clarification. So I think we have come
to closure on a lot of those areas. And we're continuing to work, and
we do have a goal of endorsement.
And as Stew also mentioned, ACRS input on these specific
points, given the breadth of your experience in this area, would be
appreciated. But we are committed to generate a draft reg guide for
Commission consideration by the end of October. We have not decided at
this juncture to go forward with a separate guide. The significance of
the remaining discrepancies, as we meet once again in the near future
with NEI, may warrant such a separate guide, and in that regard Dr.
Barton and I appreciate that there's a point where you have to make that
go/no go decision or you end up with a questionable -- a document of
questionable utility.
MR. BARTON: Right.
MR. MATTHEWS: In all our activities of the last few years
in bringing to closure some of these issues, we have tried to look for
the practical impact of our outcomes with regard to what Sam Collins
likes to refer to as at the interface, which is clearly on the plant
floor and in the interactions at the staff and licensee level. So, you
know, if it isn't going to work there, there's probably very little
utility in generating such a reg guide. So we want that to be the
ultimate test with regard to whether we would go with a separate guide
or utilize the NEI document with a limited number of exceptions that
might be warranted and appropriate.
Upcoming management review of this issue is going to be
continuing through October as we progress. So, you know, we do not have
the final answer on this yet, but we will look forward to facilitate or
inform that process.
DR. POWERS: I guess that brings us to the question that's
uppermost in my mind right now, what is it that we're going to produce?
MR. BARTON: We're going to produce a letter.
DR. POWERS: We don't have enough information to produce a
letter, I don't think. I don't even understand the discrepancies
between the two positions based on these presentations.
MR. BARTON: Well --
MR. PIETRANGELO: Can I add something? I think I can help
Dr. Powers on that last one.
Tony Pietrangelo, NEI. The issue you just went through on
the redundancy and diversity, I mean, if we're going to be convinced
that the number of pumps or trains or whatever is a specific value or
range of values chosen for controlling parameters with reference bounds
for design, fine. Call it design basis.
I don't think that's the most significant issue. It really
doesn't have any practical impact on anything in the field in terms of
calling the number of trains design basis or not. So that one I'm less
concerned about, because again it doesn't have any practical impact.
The big one for me is the one that Russ went over on whether the design
pressure of the piping is part of the design basis.
MR. BARTON: The design basis values argument.
MR. PIETRANGELO: That's right. That's right. We think
that's a step beyond what's required by regulation or the function
credited in the safety analysis. If we found a design discrepancy in
the piping, we wouldn't be able to make a call at the outset of whether
you're inside or outside the design basis of the plant. If the staff in
the staff view of choosing 1,500 pounds is the design basis pressure,
you're already outside the design basis of the plant. We would have to
evaluate it and look at things like relief values and overspeed trip
settings and what you pressurize the header to and what that does to
flow to see if we met the 500 GPM at 1,200 pounds which you've got
credited in the safety analysis. But by going one step down to things
that I use to assure myself that the actual function will be achieved,
that's different than the 50.2 value.
That's our point. And that's what I think is the big
difference between the two positions. We think we can appropriately
bound the 50.2 definition using our general and specific guidance. But
the exception the staff took on this design pressure one would make it
practically unbounded.
I don't know -- and what really raised this issue, and most
of you are probably aware of it -- was this Niagara Mohawk blowout panel
issue where a bolt was missed on the blowout panel, and the lift
pressure went from 45 PSF to 55 PSF. It was designed to -- for the
integrity of the secondary building, which was 80 pounds. So it still
met its design basis function, yet that was called outside the design
basis of the plant, one hour reporting, and even in the discussion
between the licensee and the NRC, the position in the NRC letter was
that design basis was anything the staff relied on to approve the
design, quote unquote. And that's really what we've been up against the
last year, trying to struggle with and get a bounded, accurate
description of.
So that's what's at stake here, and I hope that helps you,
Dr. Powers, on what the issue is that we're trying to address. But the
redundancy/diversity thing, I mean, again, we can go either way on that.
I think the other two are also less important. We've already put normal
operations in our definitions. We don't think testing and inspection
are really 50.2 functions. But it's really the first issue on where you
draw the line from design to design basis that has the most impact.
DR. KRESS: Are we necessarily stuck with this 50.2
definition, because that seems to me like the problem. Everytime I read
it, I read something else into it, and it's awfully hard --
MR. PIETRANGELO: Well, at this point I think we are, Dr.
Kress.
DR. KRESS: We are stuck with it; okay.
MR. MATTHEWS: Notice my white knuckles gripping the table.
Let me simply answer yes, I think we are, unless we were to
demonstrate or somebody were to come to us and demonstrate that it isn't
serving a useful purpose.
MR. BARTON: Does that help you clarify --
DR. POWERS: I'm appalled at how little I can understand
what the differences in the positions are. I mean, it's just not laid
out in the way I can see that -- I seem to have a pretty good layout of
the staff's position on some things that apparently are the questions.
I just don't understand where the other people are coming from.
DR. SEALE: It's very ecclesiastic, isn't it?
DR. POWERS: No. It's not that either. It's just
confusing.
If we're going to write something on this, maybe we should
walk back through Mr. Magruder's presentation of positions and
understand where the difference is. Right now quite frankly do not
understand this.
MR. MAGRUDER: We can certainly do that, or we can try that,
Dr. Powers.
DR. POWERS: Well, I've got a problem. I've got another six
speakers coming today.
MR. BARTON: You've got 15 minutes.
DR. POWERS: And you guys just have not given me a
presentation that I can write anything on.
MR. MAGRUDER: Okay.
MR. BARTON: You've got 15 minutes to try and do it, and I
wouldn't spend much time on the testing --
MR. MAGRUDER: No.
MR. BELL: I'd spend most of the time on the design basis --
MR. MAGRUDER: Let's try to do the design basis values
again.
MR. BARTON: Design basis value is the biggie.
MR. MAGRUDER: The first point I think from the definition
is that the definition talks about specific functions to be performed.
It doesn't say only active functions or only passive functions. It just
says functions.
DR. KRESS: Is there any disagreement there? You guys agree
that passive and active are part of the design basis? So that's not an
area of disagreement, that first --
DR. POWERS: You see, I'm already getting into trouble.
These are the ones that I thought were the problems. And now they're
not problems.
MR. MATTHEWS: Could I maybe -- let's try an illustrative
example to try to bring focus to it. We would use -- forgive me for
this, Russ -- your handout, which is the one on auxiliary feedwater
system, and go to the page which NEI has entitled "Examples of Auxiliary
Feedwater Systems Supporting Design Information." That would be -- it's
page 11.
MR. MAGRUDER: Yes.
MR. MATTHEWS: And what I'm going to suggest is that the
three bullets on page 11, if you're all there, all three of those would
be statements which in the staff's view should be viewed as falling
within the definition of design basis and treated that way in the FSAR.
And all three of them, just happenstance they demonstrate the three
principal areas that the staff is concerned about.
The first one addresses the specificity that the staff
believes the definition calls for in terms of specific functions, and
addresses the issue of redundancy and diversity. The second one
addresses the issue of the staff's concern that design bases aren't
confined to mode or conditions such as normal, accident, off normal.
And the third one relates to the design basis values that the staff
views as being design basis information, such as piping design pressure,
temperature. So, you know, as an illustrative example --
DR. POWERS: No, it's not an illustrative example of
anything.
MR. MATTHEWS: Well, the staff --
DR. POWERS: It's a set of issues. What do you disagree
with him on?
MR. MATTHEWS: Are you asking that question of NEI?
DR. POWERS: Yes.
MR. MATTHEWS: Okay.
MR. BELL: I think as Tony indicated, the first one is the
redundancy/diversity issue, and in terms of its practical impact, it's
probably very little. And I think his words were we can go either way
on that. We have another meeting scheduled to resolve these.
The second one, these are legitimate uses of the aux
feedwater pumps. However, they are not the functions credited in the
safety analyses for that system, nor would I expect that they be the
source of bounding or reference values for the design of that system.
In other words, the accident demand on the AFW I would expect to drive
the design, because it's the most limiting.
So the fact that it's used during these other modes is part
of the design, not part of the design bases. To include these would
violate one of the principles, that being the tie to the safety
analyses, and the reference bounds for design.
DR. POWERS: So what you're saying is these functions, the
auxiliary feedwater system, are not the limiting function for that.
MR. BELL: I would expect not. I'm not a designer, but --
DR. POWERS: Out of hypothesis. Hypothetically --
MR. PIETRANGELO: For example, Dr. Powers --
DR. POWERS: Hypothetically, they are not.
MR. PIETRANGELO: You could use an aux feed system --
DR. POWERS: No, I'm trying to understand.
MR. PIETRANGELO: Okay.
DR. POWERS: We'll say hypothetically they're not. There is
other function performed by the AFW that you really think is really the
limiting design, taxes it the most. So it's just an omission on their
part.
MR. PIETRANGELO: An omission on --
DR. POWERS: The guy that wrote this just left out one of
the functions
MR. BELL: No. No. In fact, the safety or the design-basis
function of this system is of course the one, you know, in the table a
couple pages back. This is the function credited in the safety analyses
that upon loss of main feedwater, he needs to provide for heat removal
from the core. These other functions -- so this -- so you would not
list that function back here. These are other functions that might be
performed by the AFW pump. Okay.
MR. PIETRANGELO: For example, on startup a lot of people
feed their steam generators with aux feedwater pumps, particularly if
they don't have a startup feedwater pump. But that's not part of the
safety analyses that the staff goes through on this. That's just nice
to have that was built into the system.
That function we don't think -- although we do say in our
general and specific guidance that normal -- you should consider normal
operations as being a potential for being the bounding condition, and on
the fuel, that's probably correct.
MR. BARTON: But for a plant that doesn't have a startup
feedwater pump, this auxiliary feedwater pump is part of the design
basis for that plant, right?
MR. PIETRANGELO: No.
MR. BARTON: No?
MR. PIETRANGELO: The function -- not by our -- the
principles that we laid out. That function is not required by the
regulation and it's not credited in the safety analysis.
DR. SEALE: Is it required to run the plant?
DR. BONACA: Because in the safety analysis you have it only
as a backup to the loss of feedwater or feedwater line break. That's
the point they are making.
MR. SIEBER: But I'm not exactly sure what the harm is in
listing it as one of the design basis, because you actually do have to
design it to run in, for example, the startup mode. I mean, it just
doesn't happen to work out that way if it's designed just for loss of
main feed.
MR. BELL: Now you are into -- you've --
MR. PIETRANGELO: Should I do a one-hour report to the NRC
if I can't feed with -- starting up with the aux feedwater pump?
MR. BARTON: I see where your problem is, but I don't know
how to resolve it. Your problem is there are always going to be on
one-hour reports always outside the design basis --
MR. SIEBER: If it doesn't work and you can't start it up,
then you don't start up.
DR. BONACA: Right.
MR. PIETRANGELO: What safety issue? Why should the NRC get
involved with that aspect of it?
MR. MATTHEWS: The staff's of the view that the reporting
issue is separate from this issue.
MR. MAGRUDER: Right.
MR. MATTHEWS: The regulations that exist today do have
these issues crossing because of the definition of reporting
requirements being tied to whether you're inside or outside design
basis, but we have proposed a rule that would --
DR. SEALE: Separate those two.
MR. MATTHEWS: Separate those two issues.
So the reporting issue is not the one that --
MR. BARTON: All right, Tony, what's left?
MR. PIETRANGELO: What's left is -- even though the
reportability aspect is gone -- and Dr. Bonaca would probably know this
better than anyone up here -- how many plants have gone through this
design basis issue, okay? We find a lot of discrepancies when you go
through design basis reconstitution programs. A lot of them are paper,
a lot of them are in the field, and a lot of them have to get evaluated.
We've lost quite a number of plants in the last couple of years spending
a lot of money trying to address this issue. And that's why we put in
our letter about the characterization of what the design discrepancy is.
When you say a plant doesn't meet its design basis, that
ought to mean something significant, not that you can't feed, you know,
to start up with your aux feedwater pump, it ought to mean something
like you can't place the plant in a safe condition following an
accident. That's what we're talking about here. And that's the danger
of trying to say a lot of these bullets on the left here are, you know,
part of the 50.2 design basis.
MR. BARTON: But some of --
MR. PIETRANGELO: So it's beyond reporting, it's a
characterization issue also.
DR. BONACA: Let me just go back again. If you go back to
the original design, it's because -- one of the unfortunate things, that
on one side we have the industry, the other one we have the regulators.
But the guys who designed these plants, wrote the book on how you do it
are not here. But if you go to the book, having read it, it doesn't say
anything about these conditions for the auxiliary system, because design
of the system was for the most limiting conditions, which is full power,
and we assume if you lose all feedwater -- or you have a feedwater line
break, which case is more limiting, and from that you derive limiting
conditions going to the design of the system.
Some of those are relegated to design basis, because they
have regulatory significance. But the point is that -- so I can
understand why, you know, someone's definition -- I mean, some of this
may define expectations of the systems for which there is no basis
anywhere at the site. I mean, because it was never evaluated under
these conditions. It had no limiting. You use it as a system, but
there is no basis.
MR. SIEBER: I guess your argument stretches right back to
the definition in the next to the last line. It talks about postulated
accidents as opposed to any other form of operation.
MR. PIETRANGELO: Although we're not excluding. If normal
operation happens to be the bounding condition for the thing, fine.
MR. SIEBER: Like the fuel.
MR. PIETRANGELO: Like the fuel. Exactly.
MR. SIEBER: I understand.
MR. PIETRANGELO: All right.
DR. POWERS: I think we've got a problem here. I don't
think we can write a letter.
MR. PIETRANGELO: You can copy our letter.
MR. BARTON: Well, where do you want to go from here? We've
got five minutes.
DR. POWERS: Yes. I mean, it seems to me that the situation
is they're not done with their deliberations, and they certainly have
not toned down the differences in opinion closely enough for me to
understand them. If these are the ones, the slides related to the staff
positions, then I find out every other one of them the NEI didn't have
any troubles with. I don't know which ones they have troubles with and
which ones they don't.
MR. BARTON: Well, I think we're down to the design values
as the issue that we can't seem to get closure on.
DR. POWERS: So you're saying that out of all of this, the
only thing that we have to worry about is the design basis could include
values that are code inputs and values associated with function, assure
the SSC's will perform the required function. That's it? That's the
only difference in opinion here?
DR. BONACA: That's the one that --
MR. BARTON: Yes, I think so.
DR. BONACA: Dr. Pietrangelo said was the --
MR. BARTON: I think between now and the end of October the
staff and the NEI will come to some closure on the other three issues.
That's what I heard here, between -- I heard NEI and Dave Matthews
describing. I think those three will come to a mutual resolution by
which you can take the reg guide and endorse the NEI document. I have
not heard the path to resolution on the design basis values question.
DR. BONACA: Let me ask a question to see if he clarifies
it. It will take just about ten seconds, and he can provide an answer.
Now if I understand it -- let's take the example of the
third bullet, system design pressure is excess PSI in temperatures dot
dot dot. That has to do with -- say that you have a pipe for which you
have a commitment in the FSAR to pass say steam, and you have a certain
pressure for 1,000 PSI, okay? And certain temperature. There are
limits for those two values that you use in the design. I mean, that
you have to deliver in an accident analysis or whatever.
Now you go out and get pipe that is capable of 2000 psi and
twice as high a temperature as that. Is the position of the NRC that
now you are bound to have 2000 psi and I mean what was procured, is it
what you would consider your design basis for the pipe, the procurement
values, or the process parameters that is described with the 1000 psi
and the temperature?
MR. WESSMAN: Let me try and help out, Stu. This is Dick
Wessman from the Division of Engineering.
No, I don't think the Staff is looking at things like
procurement values. I think we are looking at things that develop
margin to support that function, and so the concept of it has to be
able -- the function is 1200 psi and the Staff would view as a design
basis value that there is -- the margin that gets you the 1500 pound
pipe, and then the designer buys whatever the right code is that gets
that margin.
I think we tend to think the same way in the area of
cumulative usage factor. That would be to us a design basis value and,
yes, if the licensee discovers that they have exceeded the CUF of one,
they would be outside the design basis and they would need to report it
to us. It may mean that the analysis is detailed analysis or some other
analysis determines that no, they are not really outside of 1.0, or they
really are, and yes, they must make a replacement, but these are the
type of numbers that provide this margin that I think where we on the
Staff think they are essential in reaching that decision on a design
basis.
DR. BONACA: So essentially it would be a process parameter
times some factor that you have for ASME codes or whatever that is a
standard process?
MR. WESSMAN: Yes.
DR. BONACA: Which is not a procurement value but it is
somewhere below?
MR. WESSMAN: We are seeking that assurance of margin we
think fits within this overall concept of controlling parameter.
Obviously NEI and the Staff are not in agreement on this or we wouldn't
be having this discussion.
DR. BONACA: And NEI would propose what?
MR. WESSMAN: NEI would propose -- I am speaking for Russ --
that the bounding value of just 1200 psi and x flow is all that is
necessary, and we are seeking that margin on it.
DR. SHACK: If I go to the NEI guidance document, is it this
last phrase in the definition of design basis values that causes the
problems?
MR. BARTON: What page are you on?
DR. SHACK: I am on page 1 of the draft guidance of Appendix
B, and they are defining design basis values.
Do you guys want to put a period after "standard or guidance
document"? Would that make you happy?
MR. BELL: How would that change the meaning?
DR. SHACK: It is just that the values then would be set by
the safety analyses from the code, the standard or guidance document.
As I understand it, you guys then want to restrict that to only those
values which are necessary to meet the design basis functional
requirement as in Chapter 15.
MR. WESSMAN: I think we get closer with the period, but I
think we have to sit and think about it a little bit and again discuss
it with NEI. I mean this has been an ongoing struggle and this has gone
on in quite a succession of meetings.
MR. BELL: I would have just added to Dick's answer, which I
appreciate, you are right. We would choose the process parameters and
we would say that the design provides the margin to assure performance
and design basis functions, so when we identify design bases I am not
sure -- you know, margin does not come into it, except that design bases
values themselves have margin. We are not on the ragged edge when we say
500 GPM at 1200 psi.
DR. KRESS: I think that is where the problem is. We've got
all sorts of margins floating around.
MR. BELL: Yes. That word almost doesn't come up in our
meetings and I think that is appropriate.
Our view is the design is -- you provide a robust design to
assure that you perform those design basis --
DR. KRESS: You should put the margins in your value in the
first place and not say, well, we are going to put a value but we are
going to come in lower to get margin. You should have the margin built
in there in the first place.
MR. MAGRUDER: Right -- and the licensee chooses --
DR. KRESS: And then we wouldn't have this argument.
MR. MAGRUDER: Right. The Staff agrees. The licensee
chooses whatever margin they want. I mean it is based on code guidance
in a lot of cases, but whatever the licensee picks as their design value
we believe is the design bases because it controls not only that piping
but it controls the design of the rest of the system and other
interfacing systems too, so that is why we feel that value is critical.
DR. BONACA: But there are always two values because there
is one from the analysis that says 1000 psi and then there is the one
that the DAE implements, the 8 in 1000. He went back to some kind of
guidance from the ASME code and said apply 10 percent or apply 20
percent and then that was the value to each measure. Now then he got
something that was more capable than that so he can get that, so the
question is -- there are three values and the question is which one do
you pick.
It seems to me that you are at both ends of that spectrum.
One says the process parameter, one says I don't know what --
MR. MAGRUDER: Well, we'd take the middle one, I think.
DR. BONACA: -- so there is some confusion.
MR. MAGRUDER: To choose other than the process parameter
you are sacrificing the principle about the tie to the safety analyses.
It is only the process variables that come from there.
MR. PIETRANGELO: It might be licensing basis --
DR. KRESS: We can hear you but he can't.
MR. PIETRANGELO: It is not that those other values aren't
important and it's not that they are not described in the SAR. Most of
that is described in the SAR, but it is different from what is credited
in the safety analysis. We are trying to make 50.2 in the context of
nuclear safety focus on fission product barrier integrity.
We went through this whole discussion last year on 50.59 and
I think we came down the right way when we came through that discussion.
We think that the guides we put together on design basis is consistent
with that 50.59 guidance, okay? -- and again, just because it is not
50.2 doesn't mean it is outside the licensing basis. In fact, most of
this stuff is, but it is in terms of how do you appropriately bound that
term and characterize issues that come up in the field that matter or
are of concern to us.
DR. KRESS: And George, this has nothing to do with the PRA.
MR. PIETRANGELO: Yet.
DR. POWERS: I am coming to wish the PRA did have something
to do with it.
[Laughter.]
DR. POWERS: I think that we are going to have to move on.
MR. BARTON: Any other questions?
[No response.]
MR. BARTON: I thank the Staff and NEI for their insights
and opinion, et cetera, et cetera. Thank you.
I will turn it back to the Chairman.
DR. POWERS: The next topic we are going to deal with is the
proposed resolution to Generic Safety Issue B-55, improved reliability
of Target Rock safety relief valves.
Jack, you are going to take us on this one?
DR. SIEBER: Yes, sir.
For your information, the information that was provided to
the committee was developed by the Staff and is in Tab 16 of the black
book. We also got a copy of that in the mail, I believe, and actually
this is a pretty old issue.
The first occurrence of this occurred in the 1970s and was
described in NUREG-0462 in June of 1978. By my count, and this may be
different than yours, there's 22 older BWRs affected and it includes 166
safety or power operated relief valves, all power -- pilot operator
relief valves built by the Target Rock Company.
I am aware of at least one PWR that has the same kind of
valve that did not have the same kind of problems. The early valves in
about half of those plants were three-stage valves and in the later ones
were two-stage valves, and the problems that existed at the time were
spurious opening with excessive blowdown, failure to open at the set
point -- in other words, the pressure went beyond the set point before
it opened, and sometimes accompanied by excessive blowdown, a third
problem was that it opened properly at the set point or within the
tolerance of the set point but failed to reseat after blowdown, or
lastly excessive leakage.
It turns out that the older three-stage valves do not have
the set point drift, they don't exhibit that to the extent that the
two-stage valves will do.
During this session the Staff will describe and discuss the
issue, fixes, repairs, remediation, actually greater tolerance on the
setting of the set point and the current status of this valve issue with
the intent to try to close out this Generic Safety Issue. I am sure
they would like to do that today, at least with us, but I think that t
have a little bit more additional time should we need to consider that,
but certainly by the end of the year it would be appropriate to meet
their goals.
So I would like to introduce the Staff members. Could you
introduce yourselves and begin your presentation, please.
MR. HAMMER: Thank you. Yes, my name is Gary Hammer. I am
in the Office of NRR. I have with me my supervisor, David Terao, and
there are several other NRR Staff here as well as Research, who can help
me if you have questions.
As you mentioned, this is an old issue. You can tell that
by the nomenclature, the B-dash and the 55. They don't use that
designation anymore for generic issues.
DR. WALLIS: They must be very old.
MR. HAMMER: Yes, I think the B-dash designation comes
around the TMI time period, the late '70s.
DR. WALLIS: Most things that have the new nomenclature are
pretty old too.
[Laughter.]
DR. SEALE: They are mature, Graham.
DR. WALLIS: I wish I were.
MR. HAMMER: On BWRs safety relief values -- this is just a
real quick background -- are required for basically two functions. One
is overpressure protection and the other is the ADS function, which is a
part of the emergency core cooling for a BWR.
The Target Rock valves are pilot-operated valves with
auxiliary actuators that are pneumatically powered.
The original design was the three-stage design and the
two-stage design was developed a little later. Page 4 of your slides
has these illustrations.
You can see there is the main stage which has a big piston
and a disk that controls the main flow stream in both of them. One of
these is shown at a right angle. It is supposed to be the other way,
but anyway, for illustration purposes, and here on the top of the valve
is the air diaphragm actuator that is controlled by solenoid valves so
that you can actuate the valves with external power regardless of what
the system pressure is. That is basically -- let's see. Okay. Let's
go back. I am not quite finished with that slide.
Just as general statistics there are 11 BWRs that currently
have the three stage valves; also, 11 have the two-stage valves.
DR. SHACK: Of the 11 with the two stage valves, how many of
them have always had three stage valves? Are these the original valves?
MR. HAMMER: I believe that is true, except for Limerick
Units 1 and 2, which recently installed --
DR. SHACK: So it is nine out of the 11 are sort of
original?
MR. HAMMER: That's correct. Now there are some BWRs which
are no longer operating, like Shoreham, Millstone and Browns Ferry 1,
which also had Target Rock valves. I think those were all two stage
plants.
The newer plants have a little different design. That is
shown on page six of your slides, just for interesting background
information. This is what they look like. They are much, much more
massive than the pilot-operated valves. They have very large bonnets
and spring mechanisms.
The pressure basically has to overcome the spring force in
order to open. There is no pilot involved and they also have the
pneumatic actuators that physically compress this big spring, so those
are quite a bit different in design.
As mentioned earlier, there were several three stage
inadvertent blowdowns back in the 1970s, which were most troublesome and
basically when that happens you have an uncontrolled blowdown into the
suppression pool, which causes the plant to be shut down.
You basically have a small break LOCA that you are trying to
manage, heating up the pool. It was fairly undesirable. It is not
something that can't be coped with, with the available safety equipment,
but nevertheless it was something that the industry wanted to remedy,
and they designed the two stage valve as a modification for that.
What they did is they essentially replaced the top works,
which is this part of the valve. This is a blowup of just the pilot
stage of that other valve that I showed you a moment ago.
And what happens is this parting line here where these bolts
are bolted to this flange, basically you just hook the old three-stage
actuating mechanism off and put on the new two-stage, and what they
eliminated was basically a second stage, i.e., now it's only two, a
pilot and a main, instead of having an intermediate which -- and it was
this intermediate stage being actuated that was causing the blowdown
problem. So essentially they cured that problem with this particular
fix. There began to be problems with the two-stage design, though,
and --
DR. WALLIS: You've turned it around or something?
MR. HAMMER: Beg your pardon?
DR. WALLIS: Turned it around. The three-stage doesn't look
like your picture, that's all. You say you fixed the three-stage by
making it a two-stage.
MR. HAMMER: Oh, okay. Go back to --
DR. WALLIS: I have to sort of mentally turn it around to do
that.
MR. HAMMER: Yes.
DR. WALLIS: Yes.
MR. SIEBER: Yes.
MR. HAMMER: Yes. As I mentioned, this is not oriented
correctly for illustrative purposes. It really should be turned 90
degrees to the right.
MR. BARTON: Then you have to turn your head to read the
writing.
MR. SIEBER: Yes.
DR. UHRIG: Is there an error in this footnote on page 7
about Limerick? This is opposite to what I understood you said.
MR. HAMMER: Oh, I'm sorry. Maybe I did say it wrong. They
have had two-stage valves since their initial startup, but recently
installed three-stage valves.
DR. UHRIG: Which is going the wrong way.
MR. HAMMER: Well, it turns out the three-stage valve has
had better performance, so they've gone back to a previously known
quantity and they've had success with it at another plant, and --
DR. UHRIG: I must have misunderstood you. I'm sorry.
Okay.
MR. HAMMER: Yes. Yes, you're right, it is going in the
other direction.
DR. UHRIG: So the three is really the better --
MR. HAMMER: It has turned out to be the better.
DR. WALLIS: It has been replaced by a two-stage?
MR. HAMMER: Can you repeat that?
DR. WALLIS: It has been replaced by a two-stage?
The picture that you showed us with the color, which I'm not
sure is in here.
MR. HAMMER: Okay.
DR. WALLIS: That was used to replace the three-stage?
MR. HAMMER: This was the two-stage design, which is
basically the top works that couple onto the old three-stage body.
DR. SHACK: Yes, they replaced the three-stage in some
plants with two stages. It was a fix.
MR. HAMMER: Right.
DR. WALLIS: But it was not a good fix, because the
three-stage is really better. Is that what I'm hearing?
DR. SHACK: All fixes are not good fixes. We couldn't say.
MR. SIEBER: Well, they solved one problem and bought into
another one.
MR. HAMMER: Right.
DR. SHACK: I guess that was my question. What did they do
for the three stages to fix the blowdown problem that -- when it didn't
replace? Change the maintenance procedures?
MR. HAMMER: Yes. I'll get to that. Yes. They started to
have problems almost as soon as they put in the two-stage valves with
sticking. They had quite the opposite problem. They wouldn't open at
the correct pressure, they would stick, and it had positive set point
drift, and that became troublesome as well.
So some people, like I noted a moment ago, there were
several plants that kept the three-stage design. For those GE issued
some recommendations to raise the simmer margin, which is the difference
between the valve actuation pressure and the operating pressure, and
that made them less prone to leak and to inadvertently blow down. They
also improved the maintenance procedures and the testing frequency, and
basically that has proved to be successful. There have been very few
blowdowns since those events in the seventies.
But at the time the blowdowns were occurring, and shortly
after that, into the early eighties, the staff prioritized a generic
issue to investigate the problem, see how serious it was, and based on
the three-stage concern of the blowdown, the increased LOCA situation,
it was prioritized as medium. But at the same time you started having
these two-stage events were sticking, and that was also put into the
generic issue, and really that's the issue that we're left with today.
In a significant event which occurred in 1982 at Hatch
involved upward set-point drift of all 11 valves, and that was
troublesome to the staff.
DR. UHRIG: Was it a common mode failure?
MR. HAMMER: Yes, common mode failure. The owners' group
formed not long after that, and they began to investigate the problem,
and they contracted GE to develop a resolution for the problem. In
1984, about a year later, GE issued their findings based on
investigations of several valves, taking them apart, doing some
laboratory work. They even did some analysis work to see how
significant the problem was, how much overpressure the system could
withstand and still have a safe system. And they came up with these
findings.
They found that at that time it looked like more of the
drift was coming from up in this area of the stem, called the labyrinth
seal area. This stem also has to lift up in order for the pilot to
change position, and it looked like they were getting some misalignment,
poor clearances and this kind of thing, so they issued some
recommendations regarding that to improve those measurements and
refurbishment when they were refurbished.
As I mentioned, they did some analysis work, and they were
able to demonstrate that even with 10-percent drift on all valves, you
still had a significant amount of margin. You could stay within the
ASME allowable pressure of 110 percent of the design pressure, even with
that kind of drift, which is a nice thing to be able to fall back on,
but you're still left with this issue of compliance, the valves don't
meet their technical --
DR. WALLIS: I need to ask you, that margin would exist
maybe for other reasons as well, so you've now eaten it all up with this
one cause. Drift has now eaten up all the margin. If it's 10 percent
and you've gone from 100 to 110, drift has now eaten up all the margin
that may have been there for some other reason as well.
DR. SHACK: No.
DR. WALLIS: Am I misunderstanding?
DR. SHACK: All it is is he just wants to make sure he
doesn't overpressurize his thing, and so this thing has to lift before
he overpressurizes the vessel, and all he's saying is that even with
this drift, he's still going to relieve the vessel before it gets to its
limit.
DR. WALLIS: Yes, but I think what he was then saying was
there isn't any margin left. It was 10 percent before --
MR. SIEBER: You can't go any further.
DR. WALLIS: And now he's taken it all up with this drift.
There's no more margin left. Is that still true, what I said?
MR. HAMMER: Well, it depends on how you define margins. By
definition, you still have significant structural margin; even if you've
reached the ASME limit, you're allowed to reach that for upset events.
And so what you're doing is getting closer and closer to that limit.
MR. SIEBER: But the set point is set by tech specs, the
tolerance, right? The staff at one time for some plants -- from plus or
minus 1 to plus or minus 3. I'm not aware that they went any further
than that.
DR. WALLIS: Percent?
MR. SIEBER: Percent.
MR. HAMMER: That's currently the situation. We have a --
MR. SIEBER: So if you have a profile of plants that are
regularly exceeding plus or minus 3 percent, my memory is that you sent
in an LER, listed the valves and the as-found pressures, and sent them
out to a shop, got them refurbished, tested, put them back in the plant,
and you could do that refueling after refueling. How does the staff
tend to cause further improvement or at least compliance with the tech
spec?
MR. HAMMER: Right.
DR. SEALE: What's the process?
MR. HAMMER: Yes. The process of filing an LER, that's
interesting, and the LER's I've been seeing on this issue address fairly
well the corrective action part of it, which is something that's
important. You don't want to just put them back in service having reset
the set point and then have this happen all over again. You want to
have something that's going to make it better.
MR. SIEBER: Do you have data that shows that the number of
exceedences of the set point is declining through the years? This has
been going on for 20 years. Anything like that?
MR. HAMMER: Well, yes, I was going to present the data a
little later.
MR. SIEBER: Okay.
MR. HAMMER: I'll show you where --
MR. SIEBER: We can wait until you get to it. Okay.
MR. HAMMER: Okay. Okay, there was one other bullet there.
After they issued this report identifying a labyrinth seal area as the
primary area where this stiction was occurring, they started to see
greater and greater occurrence of disk sticking, and going back to the
drawing again, what they were seeing when they would take the valves
apart and do microscopic examination, they would see corrosion in this
conical seating area of the pilot disk, and they would do diagnostic
tests to measure the force it took to pull it out, and they found some
significant sticking in that area. So that became more and more the
focus, and this was after the issuance of that report.
So -- well, I'll tell you what I need to do. Let me show
you that plants that have a three-stage valve. This is what they --
this is just some various statistical information showing you the
numbers of SRV's.
A lot of the three-stage plants rely primarily on the
regular spring safety valves for overpressure protection. Some have a
few power-actuated relief valves, and the SRV's are in this column.
They're generally BWR 3's and 4's, with the exception of Limerick that
we've recently added to this table. It's got a lot of valves.
Two-stage plants are generally BWR 4's, with the exception of Pilgrim,
which is a little different design, and they have only, as you see on
the table here, four safety valves. So they were the focus of GE's
study in terms of a bounding situation.
If you're going to have a problem as a result of sticking of
valves, you would have the most effect on this one, because you'd be
affecting the overall relieving capacity the most. So -- and Pilgrim
had had a significant amount of sticking. So they -- so in 1984 they
embarked on an interim solution. They put in a new disk design,
Stellite-21, that they felt would or should perform a little better. It
shouldn't have the -- they thought it shouldn't have the interactions of
the carbides that were in the disk microstructure right at the seating
area, and even though you would get the corrosion, these large carbide
particles would not interact so negatively.
DR. KRESS: When they made this change, did they develop --
when they made this particular change, did they develop a prototype of
the new valve and stick it in a test bed and test it for quite a while,
or did they just make the change and stick in the reactor?
MR. HAMMER: They -- well, I'd have to refresh my
recollection about what exactly they did do. We did get a report from
them about their investigation.
DR. KRESS: Um-hum.
MR. HAMMER: I think it involved some actual laboratory
testing to measure the sticking forces and this kind of thing. But as
I'll get into later a discussion about how the owners' group and the
industry really came to understand the nature of this sticking problem a
little better, that they really didn't understand at this point in time.
So what they did was they came up with this interim fix. At
about the same time or a little after that the staff encouraged the BWR
owners' group to also pursue a permanent resolution, whether it would be
to adopt Pilgrim's interim resolution or to come up with a separate one,
and along in 1985 they came up with a new disk material that they wanted
to try, a precipitation hardening stainless, pH 13.8 MO, which they felt
like would not corrode in this environment as much as the cobalt alloy,
the Stellite alloy would.
DR. POWERS: What is it that precipitates in that alloy?
MR. HAMMER: Beg your pardon?
DR. POWERS: What is it that's precipitating in that alloy?
The pH 13?
MR. HAMMER: I don't think I can tell you what that is,
really. I don't know whether it's an austinetic or what it is. I think
it's a very hard alloy. You needed a very, very hard material for this
application.
DR. WALLIS: I'm looking ahead to the next two slides. You
seem to -- the history seems to be they get an idea, they try it, and
after a few years it didn't work so well, so they get another idea, they
try it, after a few years it didn't work so well. They still seem to be
in that state today.
MR. HAMMER: Well, yes, that's basically been the process,
in a way of speaking, that they would start down some path and not be
able to achieve much improvement, and then start on something else.
That's true. We think they're in a little better shape today, though,
than they were. We'll go into that a little later.
And they initially had some success with the stainless steel
material. That was installed in several reactors. I think they put in
like half of the complement for the plant in at a time, so they could
have some basis for comparison with the Stellite data, and -- but then
they started to see some sticking in that as well, and beginning in 1987
I think they started to see that they were sticking just about as bad as
the Stellite 6B disks had been sticking.
I guess what I left out of here is what's happened to
Pilgrim at about that time, and of course they've had a couple of cycles
there by the late eighties, and it turns out their data was looking
pretty good for the Stellite-21.
DR. WALLIS: So is anybody going to tell us if this is
risk-significant or not?
MR. HAMMER: Beg your pardon?
DR. WALLIS: Is this risk-significant, all this sticking and
not sticking?
MR. HAMMER: Yes, I'm going to try to address that.
DR. WALLIS: Get on to that, too?
MR. TERAO: This is David Terao. I just want to be clear
that at this point, this is still historical data; we haven't gotten to
the fix yet.
DR. WALLIS: Just wonder where it's going.
MR. TERAO: Okay. We're just talking about the problem so
far. We haven't told you what the solution is.
DR. WALLIS: Where we are today would seem to be important.
MR. TERAO: Right. So if maybe we could just hurry through
the --
MR. HAMMER: Okay. Well, we'll pick up the pace a little
bit, if that'll help. Okay.
In 1990 the BWR owners' group revised their plan again, and
this is a key point. They started to concentrate on the environment
that the valves operated within, talking about the internal steam
environment. What they found was that there's not really steam in
there, it's almost pure oxygen from the radiolytic gases that are
generated in the reactor, and it's a stoichiometric mix of hydrogen and
oxygen, and so it's a very corrosive environment. And so they
concentrated on that and said well, gee, maybe we can, you know, make
the environment less corrosive, which is what they've done.
DR. WALLIS: How does it get to be that way?
MR. HAMMER: How does the radialysis occur, you mean?
DR. WALLIS: That all the oxygen and hydrogens have
accumulated in this place rather than --
MR. HAMMER: Okay. What happens is the valves are at a
slightly subcooled temperature because --
DR. WALLIS: Is there condensation going on?
MR. HAMMER: Yes, there is condensation.
DR. WALLIS: -- breakup of the condensables, okay --
MR. HAMMER: The condensate just runs back out of the valve.
DR. WALLIS: That's what it is. It keeps concentrating.
MR. HAMMER: Yes, and it keeps concentrating. It only takes
a very short time for it to reach a saturation condition.
In parallel with that, the Owners Group about that time
recommended a parallel approach which was to put in a pressure actuation
system, which would externally actuate the valves with power.
DR. WALLIS: It's interesting -- excuse me -- if it had
leaked enough, it would have just swept out this oxygen and you wouldn't
have the problem, or am I --
MR. BARTON: Cheap modification.
DR. SIEBER: Now the installation of the pressure switches
is contrary to the current version of the code for a self-actuated
valve, is that correct?
MR. HAMMER: Yes.
DR. SIEBER: And would there be code relief for an exemption
from that code requirement to rely upon the pressure switches as part of
the actuating mechanism?
MR. HAMMER: You are asking whether the code would allow
pressure actuation --
DR. SIEBER: Does it now and, if not, will the code be
changed or will an exemption be granted?
MR. HAMMER: Okay. I can give you a little status on that.
We feel like, as I am going to cover here, we have reviewed
the pressure actuation system and feel like it is a reliable system
therefore we feel like it is sufficient to counteract -- counteract
being the key word -- the effects of setpoint drift.
Does it completely meet the code of record? A lot of the
old plants that we are talking about didn't have provisions in the ASME
code for using power actuated relief valves in this way. Now the later
BWR-6s incorporate this into their design. They take credit for the
power actuation mechanism and so there's been discussions between the
Owners Group and the ASME code and what they have basically come up with
is that since this is covered in the later editions of the code what the
licensee would have to do in order to get formal credit for this
overpressure protection function are the pressure switches.
They would have to reference the newer code edition and then
resolve any inconsistencies between the new code and the old code that
might exist in that area, so it is something that is -- I consider it a
fine point.
DR. SIEBER: It is a path to a solution --
MR. HAMMER: Yes.
DR. SIEBER: -- but maybe not the most desirable path, but
it's almost a combination hardware and legislative?
MR. HAMMER: Yes. Well, something that can be said for
their pressure switches, it is not, they are not susceptible to the
corrosion sticking. There are problems with electrical I&C systems, but
not the same kind of thing that you have got going on here.
Okay. I was going to give you a little current status then
on where we are at today --
DR. SIEBER: Let me ask one other question.
MR. HAMMER: Okay.
DR. SIEBER: I would presume that the phenomenon that is
going on is corrosion and so now you put a pressure switch and then when
you later on, at the next refueling or whenever you test the valves, you
test them with the pressure switch and pneumatic mechanism intact, which
then the valve would test okay.
Does that mean you don't clean out all the corrosion and the
next time you test it it doesn't work at all or just, you know, where do
you end up in the further maintenance because a fix that comes in from
the side, if you know what I mean, will cause somebody to say everything
is just fine and then the maintenance won't occur and the corrosion gets
worse -- is there a discussion or a plan that relates to that kind of a
consideration?
MR. HAMMER: Well, I could tell you, I just looked at an LER
from Browns Ferry. Now Browns Ferry has put in the pressure switches,
as you can see at the bottom of this slide. They are one of the plants
that have done that, yet they still credit the mechanical actuation of
the valve.
They took these valves off and tested them. There was
significant setpoint drift when they did the certification testing, and
they had to report that even though they got the pressure switches.
DR. SIEBER: Okay, and so you sent them over to Wylie or
someplace like that and do not use the pneumatics to test the valves?
MR. HAMMER: They do not, no. When they test the mechanical
setpoint, they are just testing that by itself.
DR. SIEBER: Will all licensees do that?
MR. HAMMER: That is required by the ASME code. You are not
allowed when you do the test to use a power actuated assist mechanism to
determine what the setpoint is, if that is your issue.
DR. WALLIS: When they do a test, they take this thing away,
they put it on some test facility and test it?
MR. HAMMER: Right.
DR. WALLIS: That's how they do it? So do they clean it up
ahead of time or sweep out the oxygen or do anything different? I mean
is thing as tested on the test the same really as the thing existing,
having sat in this environment in the plant?
DR. SIEBER: I might be able to answer that. They put it in
a box, put the box on a truck --
DR. WALLIS: Seal it up --
DR. SIEBER: Yes, and seal it. It's in plastic because it
has been in containment.
MR. BARTON: It's contaminated --
DR. SIEBER: And it is sent 500 miles or 1000 miles on this
truck, a whole bunch of them usually, and it goes into a lab so the
environment that it is in is different. It's not hot --
DR. WALLIS: So there's no pretest maintenance or anything
like that?
MR. HAMMER: No.
DR. SIEBER: No. It just goes in a bag.
MR. HAMMER: The setpoints, the as found setpoints that are
reported are the first lift and we have seen a lot of setpoint drift
when we do that, so apparently the shipping or the handling and that
kind of thing doesn't have any effect in breaking the bond.
DR. SIEBER: Well, the valves themselves, the springs and
all, are pretty strong.
MR. HAMMER: Yes, they are substantial components.
Let's see. Brunswick developed a process whereby they could
apply this platinum coating with an ion beam process.
The Owners Group tried something before, which was to
disperse a small amount of platinum throughout the melt of the disk.
Such that there is a very small, 0.3 percent. And
and that didn't change the metallurgical properties of the disk, but it
did provide some platinum.
Now that didn't work very well, but at the same time
Brunswick developed their own process, whereby they applied this ion
beam coating of platinum, and they've had very good results with that.
We think there's a few reasons for that. The platinum
applied in that way gives a greater surface area and contact with the
oxygen and hydrogen that you're trying to recombine, and it also
provides a barrier between the oxygen and the underlying Stellite, so
that the Stellite's not able to corrode. They've had very good success
with that.
As I mentioned earlier, Pilgrim has also had good success
with their Stellite-21, and Cooper has decided to also install
Stellite-21. They have a cycle of operating data with that, and that
also looks fairly good. And there is a short table showing you the
status of what all of these plants that have two-stage valves are doing
as of now. They've either all installed pressure switches or new disks,
one type or the other, and Fitzpatrick is the only one that hasn't done
it yet, but they've committed to do that in the fall of 2000.
Now as a -- they did get a few unexpected high pops on some
of the ion beam disks, and they weren't really all that high. I think
they were in the 3 to 4-percent range, which is fairly low compared to
some of the other data we had seen earlier with the Stellite disks. But
nevertheless they decided to investigate that and they found that some
of their maintenance practices had not been followed properly.
Some of those maintenance practices were performed by Target
Rock personnel, so right now the owners' group has a corrective action
program. They're going to be auditing Target Rock at their corporate
office to see if they have some breakdown in their organization or if
there's some problem in the field with the way they're training the
individuals that do the maintenance. So they've assured us that they're
going to get to the bottom of that, and they're going to do some of that
this fall.
So -- you had asked about the data, and I was going to show
you, here's the way these valves were performing in the form of a
histogram, a statistical sort of analysis, for the Stellite 6B disks,
and this is data that was taken up until 1995, which was the point in
time where we started to see some of the ion beam disks be installed.
So this is all data that we know looks pretty bad because of all the
sticking. You can see this is not a normal distribution. It's highly
skewed in the positive direction. They've got a big group of outliers
here that are even greater than 10 percent drift.
DR. WALLIS: What is your criterion for acceptability of
something like this?
MR. HAMMER: Well, I guess the short answer is that the
plants have a technical specification that says you've got to meet a
certain value, and that's either plus or minus 1 percent or plus or
minus 3 percent if they've justified that. If they don't meet that,
they're pretty much forced into taking corrective action to improve the
performance until it does.
DR. WALLIS: So we could say looking at this --
MR. HAMMER: Coming up with a program --
DR. WALLIS: This is a significant number of plants or
whatever that don't meet the tech specs with this kind of a picture.
MR. HAMMER: Right. Right. Yes, so there was -- yes, I
mean, your point's well taken, there were so many data points that just
didn't meet the criterion at all. And this is a large number of data
points, so this is statistically valid, and you can see the average
drift there doesn't look that high. It's 2.81, but it's got a big
spread, and you can see that reflected by the standard deviation
point -- I mean, over 4 percent.
DR. KRESS: Is a negative drift just as bad as a positive
one?
MR. HAMMER: The negative drift is in the calculation of the
standard deviation as well as --
DR. KRESS: Is it just as bad to have a negative drift as it
is a positive?
MR. HAMMER: No. Actually, in terms of overpressure
protection, it's not. But the ASME code for testing basically says that
you have to meet a limit on both. And the tech spec has a minus limit.
DR. KRESS: Okay. So as far as regulatory space, it's just
as bad.
MR. HAMMER: Right. But it could be argued there's a
different safety significance on the minus end --
DR. KRESS: Okay.
MR. HAMMER: Than the plus end, obviously.
DR. WALLIS: There's an adjustment -- you go ahead.
MR. SIEBER: This gets back to my earlier question. If a
valve fails to lift at its set point or a number of valves, you file an
LER, mail it in, tell the lab or the manufacturer, you know, see what
you can do about this. They refinish the valve, you put it back in.
You could actually do that for many years unless somebody steps in and
says this kind of performance cycle after cycle is unacceptable. Has
the staff or the region or anybody ever done that, where relief valves
have consistently failed to perform as expected?
MR. HAMMER: Yes. On my last slide I'll talk about the
regulatory mechanisms that we have to take action. But I think one of
the important things that has happened in recent years was the --
regarding problems like this -- was the issuance of the maintenance
rule, which basically says that for a valve or any component like this
the licensee is compelled to come up with an aggressive corrective
action program to -- now that took effect in 1996, I believe, so a lot
of this data we're looking at was pre-maintenance rule. But I think
with that and some of the other regulatory mechanisms we have, licensees
are pretty much compelled to not live with this kind of a situation.
DR. BONACA: For these statistics, I mean, do you have many
repeats for the same valve, or are they scattered through the whole
population of these SRV's.
MR. HAMMER: It's fairly scattered. It didn't seem to have
any correlation between actual valve, valve position -- all plants had
drift, significant drift at one point or the other. It didn't -- it
wasn't plant-related. The average of -- if you take the average of all
the drift, year by year, you can see it go up and down a little, but not
a lot.
DR. BONACA: So if left in the field now the same valve
could one day have a drift of 4 percent and another time have a drift of
2 percent?
MR. HAMMER: From one outage to the other.
DR. BONACA: Well, assume that you left it, and there is a
history -- I don't know if there is -- but would the same valve have
always the same drift pretty much, or would it be --
MR. BARTON: No. No, I don't think you'll find that.
DR. BONACA: Okay. There was no correlation of that type.
MR. HAMMER: No, it didn't -- fairly random I guess is the
word.
DR. WALLIS: How about repeatability? It goes to a test
stand, you pop it, then reseat it again and pop it again. Do you do
several? You just pop it once.
DR. SHACK: It's the first pop that's the --
MR. HAMMER: It's the first pop that counts. Now if you
want to do a signature to find out if it drops on the second pop --
DR. WALLIS: Does it go back to its original set point, or
does it -- what does it do if you pop it again?
MR. HAMMER: If you pop it again and it's the corrosion
sticking, generally it goes back pretty close to what the set point's
supposed to be.
DR. WALLIS: I would think it would.
MR. HAMMER: That's one of the signature tests that you can
do to see if it's corrosion sticking.
MR. SIEBER: Now this 6B data is pretty early data.
MR. HAMMER: Yes, this is pre-'95, and it's --
MR. SIEBER: And the other ones you're going to show us are
later on?
MR. HAMMER: Right. Right. Yes --
MR. SIEBER: Why don't we look at that?
MR. HAMMER: Right.
DR. WALLIS: There's a correlation with time or with
material, one or the other.
MR. SIEBER: Or both.
MR. HAMMER: Here's the histogram for the IM beam data. You
can see --
MR. SIEBER: Now this is pretty late. Right?
MR. HAMMER: It's about the same size chart, which is
unfortunate. I mean, this is -- you can see the -- but this only is
like a, you know, goes from minus 6 to 6, and all of the data is between
4 and 4.
DR. KRESS: Is that considered better performance than the
other one?
MR. HAMMER: Yes. Yes, this is much better performance, and
you can see it reflected in the average drift, which means that we've
got an equal or more number of minus drift than we do plus drift by
having a negative average.
DR. WALLIS: I was going to ask you about that, because this
drift is from some zero. Now the zero is determined by having been
tested at its set point prior to installation and adjusted in some way?
MR. HAMMER: Yes.
DR. WALLIS: How closely to zero does it get when it's
adjusted?
MR. HAMMER: Well, they're required to set it within plus or
minus 1, plus or minus 1. So you could have some scatter within the
plus or minus 1, and unfortunately that -- you suffer that penalty
later, maybe. But a lot of facilities are able to set it tighter than
that.
MR. SIEBER: Yes, but it is difficult, and it takes a lot of
pops. On the other hand, what it does is give you a spread within the
distribution that reflects your inability to set it at exactly zero or
at exactly the set point, along with whatever's happened over the
18-month or 2-year cycle. Just makes it wider.
DR. KRESS: Can you superimpose that other slide, the
earlier one, or just set it up there along with it, just to --
MR. HAMMER: Actually I have a slide where I squeezed all
three of these together. Maybe that's --
DR. KRESS: Now if I were looking at the top slide and the
bottom slide, and consider some sort of a statistical significance test
of it, I would judge them equally as bad, probably.
MR. HAMMER: You would judge --
DR. KRESS: I would judge the second slide equally as bad as
the top one if I did a statistical analysis of it.
DR. SEALE: The second one or the third one?
MR. HAMMER: I'd have to differ with that. This is, as I
mentioned, this has got drift all the way out here. There's a tail
that's not shown on this --
DR. KRESS: That's because you've got a lot more data.
DR. POWERS: Let's say, Tom, that you were -- that these are
normally distributed for fun.
DR. KRESS: Just for fun would help.
DR. POWERS: Okay. To what questions you would ask, what
question you'd ask, are the means from the same population?
DR. KRESS: Yes.
DR. POWERS: And --
DR. KRESS: A statistical --
DR. POWERS: That would be a student's T test.
DR. KRESS: T test. And you're going to do an analysis of
variance, and ask if the variance is significantly different.
DR. POWERS: Yes.
DR. KRESS: And --
DR. POWERS: That's an F test.
DR. KRESS: Yes, F test. I think your probably get
something like well, they're pretty close to each other. But without
doing it I'm not sure.
DR. POWERS: Yes.
DR. WALLIS: This is because of the inference of the small
number of tests in the bottom figure.
DR. POWERS: No, it's the -- the difficulty lies in the size
of the standard deviation, and the fact that they're from different
sample sizes, you can compensate for that.
DR. KRESS: You can compensate. That's part of the --
DR. POWERS: The problem really is the standard deviations
are so big here.
MR. HAMMER: Yes. Well, when I computed these standard
deviations, I followed the rule that you see in textbooks of including
in the formula N minus 1 points rather than N if it's a number less than
50.
DR. SHACK: He's not arguing over that computation. He's
now arguing over the significance of the difference that you see between
the two, which is a different statistical test.
MR. HAMMER: I'm not sure.
DR. POWERS: There are two questions that you have: Are the
means significantly different? and are the standard deviations
significantly different? And I guess I have to admit, Tom, I think the
means will come out to be the same within a substantial confidence rate.
I will bet that the standard deviations don't.
DR. KRESS: Yes, it looks like the standard deviation is
going to be smaller.
DR. POWERS: Yes, that's because the number in the F test,
anything -- get two or three in the --
DR. KRESS: But it's not much of an improvement.
MR. SIEBER: No, but there's one that they haven't showed
yet, which is the application of the pressure switches, at 3 percent,
everything else disappears.
DR. POWERS: If we looked at the bottom --
MR. SIEBER: Tolerance of the electrical equipment.
DR. POWERS: And compared to the top one, I say that those
two are different.
DR. KRESS: I would definitely say so.
MR. HAMMER: I have to apologize. I had a cold earlier this
week, and I'm having an awful hard time hearing you gentlemen. Is there
a --
MR. SIEBER: I think what we're searching --
MR. HAMMER: Some question that I could --
MR. SIEBER: Yes, I think what we're searching for and we're
not quite getting it because it probably isn't there is that we're
looking for a correlation that would tell us that through history, time,
all these fixes, the problem is getting better --
MR. HAMMER: Yes.
MR. SIEBER: Getting solved.
MR. HAMMER: Okay.
MR. SIEBER: And we really don't have that, and we're -- I
think that's what we're all trying to get at.
MR. HAMMER: Okay. All right.
DR. SHACK: Well, he thinks he's demonstrated it here, and
the question is, has he?
MR. SIEBER: Has he, and the answer is probably not.
MR. HAMMER: Yes. Well, you know, we thought about this,
how would be the best way to present this data in some concise fashion,
and we tried a different approach. Let me show you a backup slide that
I've got, and actually we got this suggestion from Mr. Sieber last week
to try to plot this kind of a -- let's see, it needs to go a little
higher. Okay.
Now this has got some -- this isn't a perfect representation
of -- because there's something arbitrary about it.
What I've done is I've tried to plot percentage of set
points that were greater than plus 3. Well, the plus 3 is an arbitrary
basis for comparison. So if I'd picked 4 or 5, then a lot of these
points that are down here are all of a sudden going to fall to zero. I
think you have to realize that when you look at this.
So it's not a -- but the thing you can see is that all of
these round dots are way up here in this range where you had, if you
were using a plus 3 percent criteria, all of these points were, you
know, in the 30 to 50 percent range, were above that --
MR. SIEBER: It would also appear --
MR. HAMMER: And here are the other materials down here.
DR. UHRIG: The ion beam suddenly went bad in '98.
MR. HAMMER: Well, you see, that's the funny thing about
this plot. This is only based on a couple of points, because, you see,
what you do when you try to divide it by year, you don't have very many
points per year. So now you've got a really heavy weight on a single
failure.
MR. BARTON: That's right.
MR. HAMMER: And the other thing that's not reflected in
this kind of a representation is yes, you've got 20 percent failed this
criteria, but this valve was only -- I think there was two valves. One
was 3.1 and one was 3.9, or something like that. Some of these valves
were -- you've got to remember were greater than 10 percent.
DR. SHACK: How many cycles of the ion beam have these
plants been through?
MR. HAMMER: I think Brunswick has had three on all -- both
of their reactors. Hope Creek has two -- one cycle, excuse me, one
cycle at Hope Creek. Fermi has installed them --
MR. BARTON: They're in their second cycle. They had some
last cycle and they tested them, and one of them was a 3-percenter -- a
3 point something.
MR. HAMMER: Oh, I was not aware of that.
MR. BARTON: Now they're in their second cycle.
MR. HAMMER: Okay. Now they installed a full complement, I
believe.
MR. BARTON: Yes, they did.
MR. HAMMER: Okay.
MR. BARTON: They got all 15 ion beams.
MR. HAMMER: Okay. And we were expecting that data a little
later this fall, I believe. Does that sound correct?
MR. BARTON: Their outage is next spring.
MR. HAMMER: Oh. Okay. Okay. So we won't have that. But
we're hopeful that --
DR. SHACK: A platinum coating is not terribly wear
resistant, and it's not very thick.
MR. HAMMER: Yes, it's --
DR. SHACK: The ion beams drives it in a little ways.
MR. HAMMER: Yes. My understanding is it's only a few
molecules thick, and it has to be reapplied each cycle.
DR. SHACK: Oh, they do reapply it each cycle.
MR. HAMMER: Um-hum.
DR. SHACK: Yes, so the ion beam, just make sure it lasts
the cycle.
MR. BARTON: Gets it through a cycle.
MR. SIEBER: Now this will be a challenging question, but
can you make a conclusion about anything by looking at that, and if so,
what would your conclusion be?
MR. HAMMER: Okay. Yes. In my thinking, realizing what
I've done here and how I've contrived this, it does show that -- some
significant improvement, I believe, over the previous valve performance,
all of these round dots up here, Stellite 6-B being so high, I believe
that that's what that tells me, especially realizing that some of these
exceedences here over 3 percent were so slight, and many of these were
so great.
That coupled with this thing, which tells me that I've got a
tighter band of the data around zero -- well, I can say that about the
ion beam. The Stellite-21 is still skewed to the right, but it's bound
by a much smaller band. Now that's reflected in the standard deviation
here. You've got a much lower number for both of these than you do --
so those two together help me with that.
Mary Wegner, who was formerly with AEOD, and who used to
compile data and look at it and analyze it and stuff, has been kind
enough to -- even though she's not in AEOD anymore -- to put together
another viewgraph for me.
This is a backup slide I don't have in the package, but
she's attempted to plot the averages of all of the plants -- there's a
different symbol here for each plant -- by year. Now this is just
average of all of the valves, so, I mean, it won't tell you anything
about any particular test.
So you can see how that moves it around and this is the
average of the averages, if you will, this line that goes up and down,
and this has basically come back down because what happened in '97 and
'98 was we added in some ion beam data.
DR. WALLIS: Well, this looks a bit like the story that you
presented early on, that every three or four years there seems to be
some new thing that goes wrong and it goes up again. Here there is no
consistent trend over this period of time.
MR. HAMMER: Right, and this probably isn't the best type of
a statistical analysis to look at because it doesn't tell you the spread
of the data. It's just an average. All of these points are just
averages and then this is the average of the averages.
DR. WALLIS: So any measure of an average against some
criterion, you are suggesting 3 percent might be a criterion, and it
looks here as if at least half the points are most of the time above
that 3 percent, so it's not all that reassuring.
DR. SIEBER: I am not sure that is a really good way to try
and get at what we are trying to understand.
DR. WALLIS: You've plotted it some other way to look
better, is that what you are saying?
MR. HAMMER: To give you some idea -- I didn't know you
would want to get into this to the degree that we have, but I also
brought along another histogram. Now this is not a Target Rock valve.
This is one of the spring safety valves, the Dickers model, that was one
of those that I showed you earlier.
Now you can see out here they have some valves, some
population that's greater than 3 percent, but they have an equal amount
that is less than three.
The thing that is interesting about this is -- I mean if you
want to say that Target Rock is on a par with these or not, you know, I
mean you could make that comparison, but the interesting thing is that
there is the spread. It is centered around zero and they are not
perfect but these are considered to be really nicely performing valves.
DR. WALLIS: It is kind of interesting that zero is one of
the least likely of these values.
[Laughter.]
MR. HAMMER: Yes. Right.
DR. KRESS: I think that is an artifact. You have to really
draw it with a perf through the thing, use all the data to fix the
curve. That is not a double mode curve, I'll bet you money.
DR. SIEBER: Maybe you could go to your conclusions?
MR. HAMMER: Okay. We need to get moving here.
Based on all of that, we believe that based on the success
for the three stage valve since they have improved the performance since
the 1970s, we don't believe there is any improvements that are necessary
at all for the three stage valves.
They were the valve that this issue was initially
prioritized for. The improvement is far beyond the value impact
statement that was made in the assumption for the prioritization so we
feel like we have got a pretty good case for closure on that.
For the two stage valve, we are not saying that the
performance is perfect, but we feel like because of the large margin in
the system, which is rather tolerant of setpoint drift it is not a very
safety significant phenomena.
DR. KRESS: The margin to the design pressure of the piping?
DR. SIEBER: Right.
MR. HAMMER: Yes.
DR. KRESS: Are there other functions of these valves like
rate of depressurization needed to avoid something like a
pressure-driven dispersion of material in case of an accident? Is the
rate of depressurization important and does this affect the rate.
MR. HAMMER: Rate of depressurization -- you mean once the
valves open --
DR. KRESS: Yes. I am assuming you pop open all the valves
at some pressure. I presume the rate is high -- the pressurization is a
little higher because it is at higher pressure because they are
sticking -- well, some of them not open at all.
DR. POWERS: Well, it's all going to be tripped -- I mean if
there is automatic depressurization, they are going to be open.
MR. HAMMER: Now the automatic depressurization functions --
DR. KRESS: It doesn't affect the ADS function is what you
are saying?
MR. HAMMER: It doesn't affect the ADS function at all, yes.
DR. SHACK: This is really a setpoint -- you know, this is
pressure vessel overprotection.
DR. KRESS: It's strictly overpressure protection we are
looking.
MR. BARTON: All these don't have to lift either, you have
got -- there's extra valves there. You may only need nine valves but
you have got 14 on the steam line.
DR. KRESS: Yes, but a lot of the time it is just one of
them that does that job, because it's set at the low value.
DR. POWERS: I think you are thinking about PWRs. These are
BWR things.
MR. BARTON: Yes, this is BWR stuff.
DR. KRESS: I knew that.
[Laughter.]
MR. BARTON: All I am saying is if some of these stick, you
are over-designed, to put more valves on the steam line than you need --
DR. KRESS: I caught a few of them.
MR. HAMMER: Okay, and the third bullet there is we feel
like the industry actions have significantly improved or counteracted
the effects of setpoint drift by using the ion beam platinum or the
stellite 21 disks. We feel like both of those things will be performing
rather well right now and even though not formally credited for
overpressure protection, it is sort of a -- I think it's been called a
suspenders and belt type thing.
You can add, you can increase the reliability. It is a
reliable system.
So based on that, the Staff is not recommending any new
regulatory requirements as a result of this issue, and we have got a
fallback. If the setpoint performance does not continue to be adequate,
we feel like there are already sufficient regulatory mechanisms
available to pursue any needed improvements -- for example, adding
pressure switches.
If valve disks just don't perform like we see them
performing now, and they have been performing at Brunswick and Hope
Creek, and the pressure switch option is available and, you know, we
could pursue that with the industry and we feel like we've got three
mechanisms for pursuing those things and there are even other things
that I haven't listed such as the general design criteria and some other
things but here are the three big ones, I believe -- the Appendix B
criterion, which is quality assurance, and, as I mentioned earlier, the
maintenance rule, and there is also 10 CFR 50.55(a) codes and standards,
which comes into play because that governs the inservice testing
requirements for the valves. If you don't meet those requirements, you
have to find out the cause and take corrective action.
So this is what we are proposing. I guess that is all the
slides I have.
DR. SIEBER: I might point out, while we are wrapping up,
that Mr. Joseph Ondish, BWR Owners Group, is here. He tells me he
doesn't plan to make a presentation but I wanted to acknowledge he is
here.
MR. HAMMER: I guess that is all we have right now. We
would be glad to answer any further questions.
DR. SIEBER: Are there any further questions from the
committee?
DR. KRESS: These valves -- are they tested every cycle,
fuel cycle? How often are they tested?
MR. HAMMER: I'm sorry?
DR. KRESS: How often are these valves tested?
MR. HAMMER: Oh, how often are they tested? The ASME code
generally governs the frequency, but in the case of these BWRs, and this
goes back to the three stage problem, they test them more frequently
than the code requires, which basically puts them into testing every
other cycle.
DR. KRESS: Every other?
MR. HAMMER: So every two cycles they will have tested all
of the valves.
Now there is a penalty portion of the ASME code -- now this
is interesting. If you fail a test, you have got to pick two more and
test them for every one that fails, so what happens at a lot of plants,
they send all of their valves every outage because they know they are
going to have some --
DR. KRESS: I understand.
MR. HAMMER: You don't want to have that on your critical
path, having to yank another valve off.
DR. KRESS: Do any of the valves every stick closed and not
open at all? They've got this percent drift, but do they ever stick
completely closed and not open at all?
MR. HAMMER: We have never seen that. We have seen some
that were stuck to the point where if you pressurized it high enough to
lift it you would have exceeded the design pressure --
DR. KRESS: The design pressure --
MR. HAMMER: -- and so they just stopped the test at that
point and say its adrift, but then in later diagnostic tests they take
those valves apart and they use a pulling mechanism and they measure the
force.
Now that has been done in a lot of cases, to see just what
the forces were, so the answer is no. If the pressure got really high,
they would open.
DR. KRESS: I think most of those valves have a way to
manually open them if you have to?
MR. HAMMER: Yes. Yes, the operator can open them simply by
turning a switch if he wants to with the electrical, pneumatic
actuators, and we mentioned earlier the ADS function, which is
completely automatic.
DR. KRESS: What I am searching for is to see if I can find
any risk significance to this problem and for the life of me I can't
find any.
MR. HAMMER: Well, it is interesting. I think the more
important function that the valves do perform in the ADS function.
If you didn't have that, there would be certain LOCAs that
you would have trouble --
DR. SIEBER: There may be some risk significance associated
with failure to reseat, just continue to blowdown to the suppression
pool, but I don't know what that number is, but that problem has
basically been solved a number of years ago.
MR. HAMMER: Yes.
DR. SIEBER: The failure to reseat.
MR. HAMMER: Well, in terms of risk significance on BWRs for
LOCAs, it is generally a small contributor to the overall core damage
frequency, and that is mostly because of all the makeup systems that you
have on a BWR.
DR. WALLIS: When we make decisions like this, I think we
should look at the consequences. You have given us this new information
that they test all the valves each cycle? That means they have to have
spare valves so they can ship away one group and leave the others on,
put the other ones on?
MR. HAMMER: No. They usually -- now some plants do have
spares but not all.
DR. WALLIS: So now if you close this issue, are they going
to stop testing all the valves? Are you going to stop getting the
information --
MR. BOEHNERT: No.
DR. WALLIS: Or are they going to keep testing all the
valves every cycle? So you are going to keep getting information about
valves --
MR. HAMMER: Yes.
DR. WALLIS: -- if you close the issue.
MR. HAMMER: Yes.
DR. WALLIS: The same way you do today.
DR. SHACK: They didn't pass any new rules.
DR. WALLIS: Yes, but I mean --
MR. HAMMER: Right.
DR. WALLIS: -- there might be some incentive after the
issue is closed to say the valves are no longer such a problem, we won't
test so many --
MR. HAMMER: We are not proposing to relax any requirements
at all.
DR. SIEBER: My impression is that if you close the issue
nothing will change. If that is incorrect, maybe you can --
MR. BARTON: Hopefully the valves will get better.
DR. SIEBER: If we start using more platinum with the
pressure switches on.
MR. HAMMER: Right.
DR. SIEBER: But is that or is that not the case?
MR. HAMMER: Yes.
DR. SIEBER: Nothing will change?
MR. HAMMER: Yes. In my discussions with the Owners Group
they have advised me that they plan to continue with their effort to
evaluate the setpoint drift, pursue any fixes that are necessary in the
future.
DR. SIEBER: Any further questions?
[No response.]
DR. SIEBER: If not, I would to thank the gentlemen from the
BWR Owners Group and the Staff for their presentation and turn it back
to you, Mr. Chairman.
DR. POWERS: Okay. What I want to accomplish tonight is to
try to hit each one of our Class A letters, okay? I don't think I
intend to do anything at all on the Class B letters tonight; that is,
GSI-148, the B-55 issue and the design basis issue we won't get to at
all.
I guess we can get off the transcript at this time.
[Whereupon, at 4:22 p.m., the meeting was concluded.]

Page Last Reviewed/Updated Tuesday, July 12, 2016