468th Meeting - December 3, 1999
UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
***
MEETING: 468TH ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
Nuclear Regulatory Commission
Conference Room 2B3
Two White Flint North
11545 Rockville Pike
Rockville, Maryland
Friday, December 3, 1999
The Committee met, pursuant to notice, at 8:30 a.m.
MEMBERS PRESENT:
DANA A. POWERS, Chairman
GEORGE APOSTOLAKIS, Vice Chairman
THOMAS S. KRESS, ACRS Member
GRAHAM B. WALLIS, ACRS Member
ROBERT L. SEALE, ACRS Member
JOHN D. SIEBER, ACRS Member
MARIO V. BONACA, ACRS Member
JOHN J. BARTON, ACRS Member
ROBERT E. UHRIG, ACRS Member
WILLIAM J. SHACK, ACRS Member
P R O C E E D I N G S
[8:30 a.m.]
DR. POWERS: The meeting will now come to order. This is
the second day of the 468th meeting of the Advisory Committee on Reactor
Safeguards. During today's meeting, the committee will consider one of
my favorite subjects, fatigue, and the proposed resolution of Generic
Safety Issue 190 and 166. We also look at a technique for human event
analysis, the ATHEANA. We will have a report from the Thermal-Hydraulic
Phenomena Subcommittee.
Our attentions then will be looking at the report on the NRC
Safety Research Program. We do intend to elect officers during this
day's meeting, and we will be looking at our other reports.
The meeting is being conducted in accordance with the
provisions of the Federal Advisory Committee Act. Mr. Sam Duraiswamy is
the Designated Federal Official for the initial portion of the meeting.
We have received no written statements or requests for time
to make oral statements from members of the public regarding today's
session. A transcript of portions of the meeting is being kept and it
is requested that the speakers use one of the microphones, identify
themselves, and speak with sufficient clarity and volume so they can be
readily heard.
A point of interest, there is a get well card being
circulated around for Jay Carroll, and the members will recall that we
will be taking a lengthy lunch break today to celebrate the season's
holidays.
I now ask if there are any opening comments other members
would care to make.
[No response.]
DR. POWERS: Not seeing any, then I will move to the agenda
items. Our first agenda is, I say, one of my favorite topics, fatigue.
Fatigue, the people that have been working on it. Bob, I guess you are
going to take us through this.
DR. SEALE: Yes. Yes, Mr. Chairman. Actually, this is a
trifecta on this particular one, because there is GSI-78, which is
"Monitoring of Fatigue Transient Limits for Reactor Coolant Systems,"
GSI-166, "Adequacy of Fatigue Life of Metal Components," and GSI-190,
which -- on "Fatigue Evaluation of Metal Components for the 60-Year
Plant Life."
This is an issue, a GSI that has been hanging out there for
quite a while. I think the last time the ACRS really went into any of
this in detail was back in about '96, and at that time one of the
recommendations of the committee was that the work that had been done up
to that point on 78 and 166 for the 40-year plant life be extended to
cover the environmental effects of fatigue on pressure boundary
components for 60 years of plant operation.
That has been, of course, the thrust of 190 and the staff is
here now to report on that to us. There are several things I would like
to call to the attention of the members and to the presenters, because
they are things I think we want to be aware of and be sure that we
cover.
For the members, I would urge you to take note that the
environmental effects are extremely important in this particular issue.
Crack frequency goes up with extended lifetime. I think we have here a
very real example of an age-dependent phenomenon that will influence the
operation of these systems.
The staff position, and I want them to try to bring this out
as clearly as we can get it, is that, while the frequency of cracks go
up, a management program should address monitoring those cases such that
you continue to control the amount of leakage, the total leakage that
you get from the system. And I point out to you that the consequences
of enhanced leakage, if that is the consequence of enhanced crack
frequency, is a contamination problem which has all kinds of ugly
consequences on the competence of maintenance, ALARA considerations, and
the cost of maintenance for the plant.
I would also appreciate some comments from the staff on the
effect of these increased crack frequencies on catastrophic failure
probabilities, because that is still a problem that you worry about in
some cases.
And, finally, I think this is an example of a case where the
research activities of the Commission have been an example of an on-time
product which is, in fact, having a significant impact on the response
to the life extension requests that are coming from -- that we are
beginning to process.
Dr. Bonaca, yesterday, as we went over the letter on the
Baltimore Gas & Electric application for Seabrook -- I mean for Calvert
Cliffs, pointed out that there were some considerations of these fatigue
effects that were in their aging management program. This is, if you
will, an on-time product as it so happens.
I think we probably ought to try to make note of this in any
communication we have to the Commission because we have perhaps been
remiss in the past in highlighting those cases where the research has
made a direct impact, contribution on what is going on.
DR. POWERS: That is a good thought, Bob.
DR. SEALE: So, with those pleas and highlights and so on, I
am going to turn it over to Mike Mayfield, and let's go from there.
MR. MAYFIELD: Thank you, Dr. Seale.
DR. POWERS: I wonder if I could ask a couple of open
questions as topics maybe you can touch on as the presentations go
through. I wonder if you would give us some idea of where the state of
the art, the technical community lies relative to the resolution of this
issue. I ask the question because I see lots of new books coming out on
issues of fatigue now, and I wonder where we stand with it as a nuclear
community within the state of the art of the larger materials community
on fatigue issues.
And the other question that has always perplexed me a little
bit on this is that fatigue tests are done by cycling specimens in an
apparatus, in an environment, at some frequency, and oftentimes that
frequency is an important issue, whereas, the fatiguing of actual
components in a plant doesn't go through regular cycles. There is a
transient, then a hold, then a transient, then a hold. They look rather
different than the testing. And why is it we have any confidence in the
testing process as being indicative of what goes on in the materials of
interest?
MR. MAYFIELD: We will try and pick up on both of those
items.
DR. POWERS: To the extent you can tutor me a little on
these, I would appreciate it.
MR. MAYFIELD: I am Mike Mayfield from the Division of
Engineering Technology. We appreciate the opportunity to come to the
committee today and present to you our rationale and basis for the
proposed closure of Generic Safety Issue 190. I have with me today
Chris Grimes from the License Renewal Group, -- I don't quite remember
the name of his new organization -- and Jack Strosnider, who is the
Director of the Division of Engineering in NRR.
DR. POWERS: Chris is spending enough time down here, we are
thinking of giving him an office.
MR. MAYFIELD: The presentation this morning will be made by
Ed Hackett from the Materials Engineering Branch in the Division of
Engineering Technology. He is going to talk -- touch on the basis for
closing GSI-190, and then give you a look at the integrating plan for
handling fatigue issues which go beyond GSI-190. And then Chris will
have some observations on the impact on license renewal. And along the
way, we will try and pick up the points that both Dr. Seale and Dr.
Powers have raised.
So with that, Ed.
MR. HACKETT: Thanks, Mike. I will start by saying good
morning, and I will apologize in advance for the voice.
DR. UHRIG: Microphone.
MR. HACKETT: How is that working? Can everyone hear okay?
Does everyone also have a copy of the handouts? So they have made it
around.
Again, I was going to start by apologizing for the voice, I
have gotten another one of these annual sinus infections, I have got a
good nasal quality going here.
I think I can also start by saying I have got a good deal
less history with this particular issue than a lot of my colleagues in
the room, but I think, hopefully, between myself and the experts we have
arrayed here, including Dr. Simonen from the Pacific Northwest National
Lab, and the benefit of having Dr. Shack here, of course, whose work was
key to a lot of this issue, we should be able to answer any questions, I
hope.
Dr. Seale did such a good job of summarizing this, I may be
able to skip a lot of the background. But at any rate, the objective is
obvious, to present the closure, actually, of GSI-190, which is "Fatigue
Evaluation of Metal Components for 60-Year Plant Life," and Dr. Seale
mentioned the importance of the environmental influence, which hadn't
been explicitly addressed prior to this. So those are the two key
components extending to the license renewal term and the environment
effect, and, obviously, to seek your endorsement for closure of the
issue.
In terms of some of the background, I think a lot of this is
pretty widely known. But the ASME Boiler and Pressure Vessel Code,
Section III, has had design fatigue curves for many years, that the
design of the plants were based on from quite a ways back now. They
were based specifically on fir environment tests. There were safety
factors built into those to account for a variety of things, including
what they hoped at any rate at the time would be the environment,
surface finish, geometry effects with the specimens and other factors.
However, recent, and I guess you could put "recent" in
quotes, we have known this for quite some time, recent fatigue strain
versus life data indicate a very significant effect to the coolant
environment on fatigue crack initiation in nuclear plant materials.
And I am not sure this curve exactly shows that, but I can
try and walk you through it, in terms of a standard S-N type approach,
stress versus number of cycles type fatigue. What is not shown on here
is that the air curve would be off way up here somewhere. And as I
said, for the ASME design approach, what was done is they took the air
curve and they adjusted that down by a factor of 2 on stress or 20 on
cycles, and that curve is what you see here in terms of the dotted line.
What you do see here, though, is this is an example of some
of the work that came out of Argonne National Lab. This is a carbon
steel in water at PWR type conditions, 550F with a low strain rate, high
oxygen content. The median curve for the water for the environment is
actually down here. So now you have come basically from off the chart
down to here, pretty close to this ASME design curve. And then you can
see, as you start getting down here to these curves that are 10, 1
percent, you are about there, you have about chewed up your margin.
DR. WALLIS: I don't understand your off the chart bit. A
factor of 2 on stress is not very much in that picture.
MR. HACKETT: Yeah, it is either 2 on stress or 20 on
cycles, so it would be --
DR. WALLIS: Which is not much either.
MR. HACKETT: It would be off the chart, but not much off
the chart. We just didn't show it.
DR. WALLIS: It doesn't make sese.
DR. SHACK: No, no, he is talking about the air curve. This
is in water. It is a factor of 50 to 100, depending on which --
DR. POWERS: You are going to have to be careful, because
error and a-i-r, air, are too easily confused and what is off the curve
-- chart here is cycling a sample --
MR. HACKETT: In air, laboratory --
DR. POWERS: -- in an atmosphere like that we breathe.
MR. HACKETT: Exactly. Exactly. And this one is now coming
down to -- now you are picking up the LWR environment, so that is what
is going on.
DR. POWERS: And, again, a factor of 2 on stress and a
factor of 20 on cycles on a log-log plot like this is not going to be
readily visible, is it? I mean that is the question.
DR. WALLIS: It certainly doesn't pull something that is off
the chart onto the chart like that.
DR. POWERS: That's right.
DR. APOSTOLAKIS: But can we -- could you explain to me how
I should read this figure? How do I enter, I enter with a stress sample
kit?
MR. HACKETT: Yeah, the basic --
DR. APOSTOLAKIS: Let's say, 100, okay.
MR. HACKETT: Basically, what you are doing, if you are
looking at tests like this, which this is obviously generated from a lot
of test data, you are going to be cycling, and this gets back also to
one of Dr. Powers questions, you are going to be cycling at a constant
stress amplitude. Basically, a lot of these tests are done either in
axial or in rotating type fashion. And then you are going to look for
cycles to crack initiation. And, usually, what you are going to be
looking at there in the specimen is some type of load drop and increase
in the compliance of the specimen. So at that point you have got some
kind of an engineering crack going on in the specimen, but don't have
two pieces.
DR. APOSTOLAKIS: So if I draw a horizontal line at 100, I
hit a bunch of curves there.
MR. HACKETT: Right.
DR. APOSTOLAKIS: So I can find a 90 percent interval within
which the cycles for crack initiation will be. Now, why am I uncertain?
MR. HACKETT: A whole lot of reasons, but, basically, what
you are going to be seeing, especially in the environment, and I guess
we wanted to get into some elaboration on this. One of the big
influences of the LWR environment is to cause like a micro-pitting on
the surface fatigue. As most of you probably know, it is very sensitive
to surface conditions. That will exist to a variety of degrees,
depending on the material type, the temperature, dissolved oxygen
content, other factors that relate to the environment. So you have got
an enormous range of scatter just due to those types of things.
DR. APOSTOLAKIS: If you knew the environment, you wouldn't
have this.
MR. HACKETT: No, that is not true either, because then you
are going to get into, also, other ones I didn't mention, the surface
preparation of the specimens, geometry effects, things like that. And
the process itself is inherently scattered metallurgically. That
underlies the whole thing, and then you add scatter on with these other
factors would be the way I would explain it.
Well, that moves us on from that one. Again, Dr. Seale gave
us the background. This is just a perspective. We are going to be
coming from the perspective of having previously visited this issue in
two other GSIs, 78 and 166. This was for the 40-year lifetime. In both
cases, the risk from fatigue failures, in the case of 78, was evaluated
using the PC-PRAISE code, I will come again to pc-PRAISE as we go
through this presentation, because we also used it for GSI-190.
Basically, the risk was low, and the ACRS wrote a letter, I
think it was Dr. Kress wrote a letter in 1996, basically agreeing with
the outcome. GSI-166 also basically working in tandem with John Fair's
fatigue action plan, evaluated adequacy of fatigue life of selected
metal components, in I believe it was seven plants, and there was no
significant safety concern that was identified that licensing basis
fatigue criteria were exceeded. Both issues were resolved.
DR. WALLIS: Excuse me. You showed us this curve, this S-N
curve.
MR. HACKETT: Yes.
DR. WALLIS: For some purpose. Okay. Are you going to show
us how this relates to the reality of what is happening in the plants?
MR. HACKETT: It was really just to illustrate what is going
on in S-N fatigue. And what I was going to --
DR. WALLIS: But unless it is related in some way to the
problem we are considering, I don't know what to make of it.
MR. HACKETT: Let me try and pick that back up then.
DR. WALLIS: Where are we in terms of plants on this curve?
MR. HACKETT: The way I would --
DR. WALLIS: Where will be in 60 years?
MR. HACKETT: Yeah, the way I would address that is -- what
I was going to come to, and I will get to this in a later slide. What I
didn't address on this slide was the concept of a cumulative usage
factor. This is, again, I think something Dr. Seale asked us to
address. It is not a perfect thing. Again, Dr. Powers' comments on
fatigue being, you know, a nonlinear process necessarily. Cumulative
usage, basically, is a linear damage rule that goes all the way back to
1924, I think, with Palmgren and Minor. In 1945 they put together a
rule called the Palmgren-Minor Rule or -- Palmgren did later on, or
Minor did, and, basically, it is just an N where your N is the number of
cycles that you are accumulating over a large N, which is the number of
cycles you would predict to failure.
And then what you want to do is you want to keep this number
less than 1. That is the way ASME used these data to design the plants,
on the basis of a cumulative usage factor approach.
DR. WALLIS: Well, again, these are generalities. Are you
going to show us how they apply to the plant?
MR. HACKETT: I am not sure I am tracking.
DR. WALLIS: I don't see the purpose of introducing this
unless you are going to relate it to the problem we are discussing, the
reality of what is happening in the plant.
MR. MAYFIELD: Let me try and see if I can pick up on where
Dr. Wallis is going. In the design stage for the nuclear power plants,
for the plants that were designed with a fatigue analysis, they started
with a design -- the design specification where a series of transients
were identified from that. They determined stress ranges and then
stress amplitudes for each of those design transients. They them went
to the ASME fatigue design curve, which is similar to this one, it is
just for the air environment, and determined the allowable --
DR. WALLIS: And it is off the chart, we were told.
MR. MAYFIELD: The one that would be characterized as off
the chart. They determined an allowable number of cycles for each of
those transients, and then used the Minor Rule to determine whether that
aggregate was an acceptable design. If not, they either revised the
design or sharpened the stress analysis so that the cumulative usage
factor for each of those locations was less than 1.
What we have subsequently found, and the issue being
addressed here is that the air environment fatigue design curve did not
adequately account, including -- when you consider the margin that was
imposed, did not adequately account for the environmental effects on the
fatigue life of the metal components.
So the issue that we are trying to -- or that was being
addressed under this Generic Safety Issue is whether that
non-conservatism was a sufficient concern to require generic -- some
generic action for the plants, and, specifically, looking at 40 to 60
years on GSI-190. GSI-78 and 166 looked -- going for the first 40
years, the committee then asked the question, well, what would this mean
for license renewal specifically going from 40 to 60?
But what it means to the plants is that -- and Ed will come
to this later in the presentation, is that there would be an expectation
of an increased leak frequency during the extended period of operation.
Does that get to what you were asking?
DR. WALLIS: No. I just want to know, what is the design
curve or the curve that represents the sort of -- the materials in the
plant and their behavior? Is it this dashed curve here, or it something
off the chart?
MR. HACKETT: John Fair looks like he wants to take a crack
at this one. John.
MR. FAIR: Yes, I am John Fair with NRR. What they have for
this study is some real plant stress calculations that we used in the
original study that we presented several years ago. And the purpose of
these curves is we have these actual stress amplitudes, so they use
those to go in and get a probability of crack initiation.
DR. WALLIS: The question is, where are they on the chart?
Where are those points on this chart?
MR. FAIR: Well, there are a number of points, and they are
various. There is not point on that chart. There is a number --
DR. POWERS: That is his point, is there is not one single
point on that. Could you give an idea where one of them is?
DR. WALLIS: If you showed us the points you know about,
where would they be?
DR. SHACK: Let's try it this way. Every location in the
plant has a point on that chart.
DR. WALLIS: That's right. There is a fog, there is a mist
of points, but where are they?
DR. SHACK: Well, most of them are well below the design
curve, that is, there are very few locations where the fatigue usage is
anywhere near the point where you are going to initiate.
DR. WALLIS: You know that, but I don't know that. No one
has said that yet.
DR. SHACK: Well, they will present calculations where they
have gone to what they think are the most critical locations.
DR. WALLIS: And they will show -- then they will refer them
to this chart?
MR. HACKETT: Not to this chart, to the concept.
DR. SHACK: Well, the problem with this chart, of course, is
that no plant sits there and operates with cycles of 100 KSI. That is
this whole notion of this cumulative damage, as Mike and Ed tried to
explain, there are ways to account for the fact that in the real world
you don't sit there as you do in a laboratory, neatly cycling at a
constant load, that you have a load.
DR. WALLIS: It is interesting that the number of cycles
goes from a tenth of a cycle on this chart. That is a very interesting
concept of a tenth of a cycle.
DR. SHACK: Well, that is -- you know, that is known as not
putting your lower limit on your log curve at the right place. But, you
know, I have explained that, you know, in the real world you have a
cycle at a certain stress amplitude and cycles at another stress
amplitude, and there is a way of accumulating that.
DR. WALLIS: Yeah, but these are --
DR. SHACK: Each of those locations would end up with a
so-called usage factor.
DR. WALLIS: Which would give us a point on this chart.
See, this is the key point of the presentation is -- where are things on
this chart? And that is what we need to see.
MR. HACKETT: No, sorry.
DR. WALLIS: If it is not, it is just invoking something
from a book in order to show you have read the book.
MR. HACKETT: This really was, at least in my view, this was
an illustrative slide for S-N fatigue, it really wasn't meant to be any
more than that. Sorry if I have confused the issue with that. Maybe it
is a good time to take this one down.
DR. SEALE: Well, the message, though, too, is that -- and
part of the message, if you will, I guess you would call it faith, to
wit, the S-N curve for the air environment is up here, out essentially
off the chart.
DR. SHACK: Well, let's not get too carried away.
DR. SEALE: And you put -- yeah. Right, yeah. Right. But
when you put the water environment, and not only, as I understand it,
for the exposure, but for the test as well, when you use the water
environment, you have a much more significant accumulation of --
DR. SHACK: All the curves shift to the right. So the
plants were designed on a curve that was moved substantially to the
right.
DR. SEALE: Right. The air curve was the design basis and
it turns out the correction that was put on that number to account for
environmental effects is perhaps not as conservative as we thought it
was.
MR. HACKETT: That is exactly the point that we get across.
DR. WALLIS: And if that is the case, then you need to get
definite and quantitative about it and not waffle about it. And I
wanted to see what -- how some number compares with some other number,
or how some curve compares with some other curve so I can make a
judgment.
MR. HACKETT: Okay. We will come to that, but that wasn't
the point of the slide. Sorry to confuse the issue here.
A little bit more background, then we will move on to
exactly what we did do with GSI-190. John Fair was the lead in NRR for
the fatigue action plan which paralleled, the resolution was obviously
involved with GSI-78 and 166. This was completed, and the SECY
reference here, 95, concluded no immediate staff actions or licensee
actions necessary for design basis fatigue issues, again, for the
40-year life. The ACRS letter I referred to earlier agreed with that
conclusion in 1996.
GSI-190 basically came out of the resolution of GSI-166 and
78 because by the process that we use to resolve GSIs, it is incumbent
on us to address the 20-year extension period. So there were some
letters that were transmitted between the offices and around '96 - '97
timeframe, they transmitted this responsibility to the Research Office
from NRR. It was designated a new GSI, GSI-190, instead of continuing
166, and, again, we had been there, but it is to evaluate fatigue for
the 60-year plant life with explicit consideration of the environmental
effects this time.
The approach, and we will go into some more detail on this,
is to evaluate high fatigue usage, the concept of the cumulative usage
factor. Plants do monitor transients. And maybe some of this will get
to answering some of Dr. Wallis' questions. So the idea was to target
components that were going to be high CUF, use design basis transients,
that is important because that links to the final point. We are not
solving all fatigue problems with this resolution of this GSI by any
means. I don't want to mislead the committee on that.
DR. KRESS: Could you elaborate a little more on that. What
were the design basis transients that were used?
MR. HACKETT: Again, I would probably defer to John.
DR. KRESS: These are not the Chapter 15 stuff, these are a
separate set of --
MR. MAYFIELD: The startup shutdown, 10 percent power
increase, decrease.
DR. KRESS: The normal operational.
MR. MAYFIELD: The normal operational transients, that's
correct.
DR. KRESS: The normal ones you would expect.
MR. MAYFIELD: Right.
DR. KRESS: Okay.
MR. HACKETT: Just to differentiate, they are not -- you are
familiar, and I can touch briefly on the Oconee type failure --
unexpected thermal excursions and HPSI makeup line that ended in a very
extreme case of cracking. That is not what this is addressing
explicitly.
DR. WALLIS: But to go back to your curve that didn't mean
anything, the frequencies we are talking about here are small.
MR. HACKETT: Generally.
DR. WALLIS: There are 10 or 20, maybe 100 over the life of
the plant.
MR. HACKETT: Generally.
DR. WALLIS: They are not in the 10 to the 6 or something.
DR. SEALE: No.
DR. WALLIS: We are only looking at a very small part of
this picture, if we look at it at all.
MR. HACKETT: That is correct. When you get into thermal
fatigue, obviously, you can get into much higher cycles.
DR. WALLIS: But there may be some places where, you know,
thermal fatigue where there are some natural thermal hydraulics going on
which actually produces cyclic behavior daily maybe.
MR. HACKETT: Yes, absolutely.
DR. WALLIS: So there are perhaps some situations where you
get into high cyclic.
MR. HACKETT: Absolutely. And I guess vibration also, we
are saying the majority of those are -- what we found are beyond the
design basis, the designers did not consider those. This was also done
probabilistically. I mentioned the PRAISE code, we will go into further
detail on that, which, again, is maybe part of an answer, I will stop
for a second, to Dr. Powers' question.
One of the advances in fatigue is to be able, of course, to
do this on a modeling basis, with some of the more advanced computer
codes and the computer capabilities we have now that we didn't have even
five and 10 years ago. So PRAISE is a major advance and a tool for us
to use in this type of evaluation. I think the basic science of fatigue
hasn't change a whole lot in terms of, you know, where -- I don't want
to offend Bill, there's -- fatigue has been what it is for quite some
time, and there are refinements.
DR. WALLIS: Since Bill became a manager there has been no
fundamental advance in the field.
MR. HACKETT: I will leave that alone. We also estimated in
addition to through-wall cracking frequencies, core damage frequency
contributions and that is what is going to go to the bottom line here
pretty quick.
I mentioned earlier, again, the latest environmental fatigue
data was used in this evaluation. That is from Argonne National Lab.
The probabilistic fatigue calculations were performed on sample
components following what was done in the fatigue action plan. Six
locations, in this case, five BWR or five PWR and two BWR plants.
DR. WALLIS: Six locations?
MR. HACKETT: Six, I will show you those on the next slide.
There were six different --
DR. WALLIS: Is that enough? Why six?
MR. HACKETT: We considered that was enough of a sample,
both for the fatigue action plan and we saw no reason to think we needed
to change the sample for this evaluation.
DR. WALLIS: But you picked particular locations that were
likely to be more severe?
MR. HACKETT: High CUF locations, right. The core damage
frequency was estimated from the pc-PRAISE through-wall crack
probabilities, and then published PRA information, you know, for the
plants.
DR. WALLIS: I mean these calculations are not very
complicated, are they? You could easily have done 60 locations.
MR. HACKETT: The CDF computations.
DR. WALLIS: You said probabilistic fatigue calculations.
Is that -- are they complicated things, by the way?
MR. HACKETT: It is an interesting question. There are a
lot of assumptions that go into that. So I wouldn't say the framework
is necessarily complicated, but there are assumptions that go into those
that, you know, people might consider complex.
John, comment.
MR. FAIR: Yeah, this is John Fair again from NRR. The
reason they picked those locations, it was from our previous study, and
the amount of effort required was, in the previous study, we took the
existing design basis calculations and tried to remove the conservatisms
we could identify in them, and that is what took a bit of time. So if
we were to -- had 10, a factor of 10 more locations, we would have had
to do a lot of work getting the data from the plant, trying to remove
the conservatisms we could identify.
MR. HACKETT: The reason for my answer being what it was is,
I guess I would say, yeah, it is complicated, because there is a
sensitivity in these calculations for several of the key parameters, and
I will come to that. It was one of the criticisms in the ACRS letter
when we first went through this for 78, that we didn't address those
appropriately. We tried to go back and do that on a more rigorous basis
this time.
DR. WALLIS: So you have some uncertainties and assumptions,
when you are in a world of higher uncertainty, you sometimes compensate
by taking more points.
MR. HACKETT: We tried, in this case it is done on a
modeling basis. We tried where we could to go off of, you know, actual
plant data in the design transients. So, yeah, I mean to the extent we
can, we are trying to use as much of the real data as is available.
DR. WALLIS: Are you going to show us that these six
locations were consistent, or they give mixed messages or are you going
to show us that?
MR. HACKETT: I will show it to you now. I will come to
that in terms of through-wall crack frequency and CDF, but let me show
you the locations first. These were the locations that were used for
the fatigue action plan, and, again, for this study. You can see they
cover a fairly good range here and some pretty critical components where
you get high CUF.
Plant types, again, the three primary vendors and newer and
older vintages in the case of CE, GE and Westinghouse were addressed in
this evaluation.
DR. WALLIS: So RPV is a big thing.
MR. HACKETT: Yes, sir.
DR. WALLIS: You are looking at what is in the RPV or some
location in the RPV? They are a monolithic thing.
MR. HACKETT: Yeah, the RPV in this case, it was the shell
and the lower head, I believe, John, is that correct?
MR. FAIR: Yeah, we -- although the usage factors are
generally low in the RPV, we picked that because it was the most safety
significant location.
MR. HACKETT: We talked about pc-PRAISE. One of the things
we had going into this study is we had some problems with pc-PRAISE,
some things we needed to modify. In working together with NRR, John
Fair raised some of these concerns. The previous version of pc-PRAISE
that was used for GSI-78-166, for instance, wasn't really capable of
properly modeling fatigue cracks with large aspect ratios.
DR. POWERS: I have to confess an ignorance. I am not at
all familiar with pc-PRAISE aside from the fact it gets cited very
often. Can you give me some understanding on what the level of
validation and verification, peer review of pc-PRAISE is?
MR. HACKETT: Yeah, that has come up before, and others may
want to chime in here, because, again, my history with this is
relatively recent. My understanding is that it was benchmarked
previously when it was developed, and that was at PNNL for the work that
was done on 78 and 166.
DR. POWERS: So PNNL developed it and benchmarked it?
MR. HACKETT: It was benchmarked independently.
MR. MAYFIELD: Ed, let me jump in here because I have got
history that goes back on this thing since it was originally written.
It was originally part of the -- was it SSMRP, the original seismic
study, and the code was originally written under subcontract to Lawrence
Livermore National Laboratories, it was running the SSMRP. It was
written for mainframe applications at that point in time.
At that time it was written under QA program and did receive
some peer review and benchmarking within the U.S. It subsequently was
reviewed and has seen a lot of review and benchmarking by the Germans,
some other sporadic benchmarked. It has been used, the PC version of it
has been used by the staff and some contractors, and some international
standard problems through CSNI.
The review of the code and its QA has been something that,
as PNNL took on this project for us, they picked back up and have
reviewed subsequently, going back to the work that was done for GSI-166.
So there has been periodic reviews and QA of the code to
assure that at least -- to assure that it is doing what we intended it
to do, that the modeling has been implemented correctly. The underlying
modeling has been reviewed and discussed in the international community
through a series of the standard problems and other meetings. So in
these kind of codes, you can always find fault with the modeling, but
the computer code itself is, we believe, functioning as we intended it
to function.
DR. POWERS: If I wanted to understand the strengths and
weaknesses of the code, what would I read?
MR. MAYFIELD: I need to think about that one a bit. Can we
-- I mean it is a reasonable question, but I need to think about what to
steer you to as the best example for it.
DR. POWERS: I see this code cited in enough things that
come to us, it would be a good idea for me to understand it a little
better.
MR. MAYFIELD: Can we take it as an action to get back to
you through the staff?
DR. POWERS: Sure.
MR. MAYFIELD: As to what would be some good examples to
take a look at.
DR. POWERS: Sure. That would be great.
MR. MAYFIELD: All right, sir.
MR. HACKETT: We probably, for that reason, in need of
starting to deal with versions of this code. The latest version was
done under subcontract to PNNL by Harris, and there was further
evaluation and separate benchmarking done of this revised version by
PNNL separately on that.
But the main things we were after here were, previously
initiation was assumed to start at basically year zero and then proceed
through the code that way. Now, initiation is basically left as one of
the random variables, that it will start when it is appropriate that the
probabilistic analysis says it should start.
The growth is going to be from initiation to failure. And
failure is going to be through wall cracking. And that leads to, again,
another question I think Dr. Seale raised at the beginning.
Catastrophic or not, most of the time, if you are talking design basis
transients, you would not be talking something catastrophic, you would
be talking a leak before break type of situation. Not like what you saw
with Oconee, for instance, which was beyond the design basis, to address
that question.
Another really hard problem, and a lot of credit goes to Dr.
Simonen and his colleagues at PNNL, is what if you initiate cracks at
several places around a circumference, and they are growing, and how do
they link and what influence do they have on each other. A very
probabilistic problem inherently by its nature. That was not addressed
in the previous version, it was addressed explicitly in this version,
thanks to the work they put in on this.
I think, you know, Dr. Simonen and others would say it is
also not perfect. I mean there are assumptions that go into that that
you have to make to be able to do this in terms of aspect ratios, in
terms of how close does a crack have to get to another crack before it
is influencing it. But we at least basically had a decent shot at that
in this one, and that was the weakness.
DR. WALLIS: Doesn't the growth of a crack depend on how it
starts and what sort of orientation it has?
MR. HACKETT: Sure.
DR. WALLIS: So there is a lot of uncertainty in this model.
MR. HACKETT: Absolutely. Absolutely. There is uncertainty
with regard to those factors.
DR. WALLIS: So if there is uncertainty, we ought to be
careful to have a suitable safety factor or something in our plan?
MR. HACKETT: Yes. Yes, absolutely.
DR. WALLIS: Or evaluation.
MR. HACKETT: Absolutely. Yeah, this was done, of course,
like appropriate probabilistic analyses. All these were done, I
believe, Fred, on a best estimate basis, to the degree possible, but
there are conservatisms inherent in some of the things that were done.
DR. KRESS: Is there a natural database on this linking?
MR. HACKETT: A database?
DR. KRESS: Yeah, like tests that you take the thing off and
look and see how many cracks there were and what the orientation is.
MR. HACKETT: I think the only thing we have in that regard
is kind of the reality check with what we see in service, and how this
can simulate that.
DR. KRESS: Just talking as a hypothetical model.
MR. HACKETT: It is how things grow in reality, but in terms
of a database, I think we are short. If anyone wants to talk about
that, I am not --
MR. MAYFIELD: This is Mike Mayfield from staff. There are
a number of, in the literature, a number of compilations of component
fatigue tests. The problem that we run into for this particular
application is they are typically not run in typical lightwater reactor
environments. You will see air tests, tests in oil, occasionally they
will have room temperature water just as either a pressuring medium or
something so they can identify a leak. But the problem, and you can, I
am sure, imagine that it would get fairly complicated and something of a
laboratory safety concern to run fatigue tests on components at typical
LWR conditions.
So, database, per se, no. Compilations of fatigue data and
test results, yes, not specific to LWR conditions.
DR. WALLIS: This PRAISE code could produce curves like
these S-N curves for a particular piece?
MR. HACKETT: Those, the confidence bands you see in there
did come from PRAISE, I believe.
MR. MAYFIELD: Those curves you have, Dr. Wallis, are input
to the pc-PRAISE code.
DR. WALLIS: Input to.
MR. MAYFIELD: Yes.
DR. WALLIS: It seems very strange. If I want to grab a
component, I want to know, if I stress it at a certain level, and I
cycle it a certain amount, does it break?
MR. MAYFIELD: Yes.
DR. WALLIS: That is an output, that is not an input.
MR. MAYFIELD: That curve is the curve that tells you
whether or not it will break based on laboratory test data. So, if you
have a component that you are cycling at a particular stress level, and
you want to know how many cycles it can withstand, it is that curve that
tells you.
DR. WALLIS: Why do you need PRAISE at all then?
MR. MAYFIELD: Because the complicate -- the analyses are
more complicated than the simplistic example I just used.
MR. HACKETT: You need PRAISE to go from the laboratory to
the real world.
MR. MAYFIELD: The other thing is that those curves get you
cycles to some engineering definition of a crack. The pc-PRAISE code
takes that defined crack size and propagates it on through the component
of the wall, the wall of the component, that is where the growth and
linking come in.
DR. WALLIS: These curves are just for the initiation of it.
MR. MAYFIELD: That's correct.
MR. HACKETT: Yes, sir, that's correct. This part uses
fraction mechanics.
DR. WALLIS: So there might be other curves for the actual
failure which would --
MR. HACKETT: There would be other curves for the growth and
then there would be -- as Mike is indicating, what we ultimately get to
is through-wall cracking or not.
DR. WALLIS: That is geometry specific for the --
MR. HACKETT: It can, it is affected by the geometry, yes.
DR. SHACK: The crack geometry and the component geometry,
which, again, they have to sample in a kind of a probabilistic way. And
to come back to Tom's questions, I mean one of the things that you do
find, at least you have the reality check that when you predict aspect
ratios, you can go out and look in the real world and see if the aspect
ratios that you are -- you know, so you really don't have the kind of
test that you would like, where you do tests and, you know, you watch
the cracks link up. But you kind of have the end of the game thing
that, you know, okay, does the aspect ratio look anything like the real
world?
MR. HACKETT: Exactly, like Bill says, that is what you have
to deal with. And in terms of what you don't, the worst case for you is
when these things do link up and join into large aspect ratio cracks,
and you have a worst case from a fracture mechanics perspective.
DR. KRESS: But back to Dr. Wallis' questions, you don't
really end up with curves, you end up with will it fail or won't it fail
over some time period. It is sort of --
MR. HACKETT: You end up with a probability --
DR. KRESS: A probability.
MR. HACKETT: -- of whether you are going to get a
through-wall crack, basically. And then you need to go through that to
where that gets you to core damage.
DR. KRESS: But you don't really get curves, you get a
probability of it occurring.
MR. HACKETT: That's correct. Also, I mentioned sensitivity
study. These were some of the parameters. I guess we have already kind
of been discussing a lot of it. The issue of multiple crack initiation
is a factor, obviously.
DR. WALLIS: Why is wall thickness a sensitivity? You know
what it is.
MR. HACKETT: Just in terms of varying it to see what kind
of sensitivity you get to the overall outcome of the code. So these
were -- stress gradient, for instance, was not explicitly address, I
don't believe, in GSI-78. Multiple crack initiation certainly wasn't.
Correlation between crack initiation and growth, they are assumed to be
non-correlated, and there is good metallurgical reasons to assume that
they are non-correlated. However, if you were to assume they were, for
instance, things could get significantly worse, so there are
sensitivities involved with all of these. Oxygen content, sulfur
content, obviously, too.
Another linkage that needs to be made here before I get to
the bottom line is -- I will spend a little bit of time here on this
concept of the through-wall cracking versus the cumulative usage factor.
In terms of -- I am a metallurgist and I like to mostly think simply and
maybe less probabilistically sometimes. I need to do some learning in
that regard. But in simple terms, these things shouldn't be linked
metallurgically.
CUF is measuring, is a measure of what is going on in
initiation and damage accumulation. Through-wall cracking is that plus
crack propagation and other fracture mechanics issues that Dr. Shack was
talking about. So, you know, what kind of correlation should you expect
between these two things? An approximate one at best, and I think that
is what you get here. But what it shows you is that when you do get to
high usage factors, the probability of through-wall cracking can get way
up. You know, you are up at 100 percent for some of the points from
Simonen's evaluation here.
You know, conversely, when you are down pretty low, like
down between 1, you can get down to some pretty low probabilities of
through-wall cracking. But the bottom line is when you are up at high
CUF, you know, chances are you are getting a pretty indicator that these
are going to be areas that could cause you problems.
DR. WALLIS: Why is this statistically significant? I have
got one point on the right, that is sort of somewhere in the middle of
all the points at one. I am not sure that there is any obvious trend
with CUF.
MR. HACKETT: I would agree with you in general, I don't
think there is enough data to make any sort of a definitive correlation
here, by any stretch. I think we are just sort of looking at a trend.
And the trend, to me, just looking at the data, would say, if I got a
high CUF, particularly over 1, my chances of that component going to
some kind of through-wall cracking over a 40, this case is showing 40,
40-60 year life, it is going to start to get up there pretty high.
DR. WALLIS: Now, 1 means it must have broken before 40
years, is that what it means?
MR. HACKETT: Right. Right. It would have gone through the
wall. So, but that is an important concept.
DR. WALLIS: Not broken, there is a crack through the wall.
MR. HACKETT: Crack through the wall. That is an important
concept to keep in mind for the next two slides, and I will try and see
if I can make this linkage for you. I will jump immediately to the
bottom line. This goes -- I could say maybe this is out of order, but
we will try it this way and see how it goes.
To jump from, you know, the intermediary here is
through-wall cracking, and I will come back to that. But jumping way
ahead to core damage frequency, you know, here is what you see, a couple
of things to walk through here. First off, going from air 40 years to
water 40 years.
DR. WALLIS: What does air 40 years means, that means --
MR. HACKETT: That would be the prediction of the
probability core damage frequency.
DR. WALLIS: It makes no sense. I mean that is a reactor
filled with air.
MR. MAYFIELD: That would have been the original design
basis.
MR. HACKETT: That would have been the original design
basis.
DR. WALLIS: It makes no sense, it has no relevance to this.
MR. HACKETT: I would probably agree with you on that in
terms of the --
DR. SEALE: Except to the extent that the original design --
MR. HACKETT: That is the way it was designed.
DR. SEALE: -- was to mess up the air environment curve to
get a pseudo water environment curve.
MR. HACKETT: To go back to Dr. Powers' comment, I probably
have to be careful using the word "air" in the future. There is a lot
more that goes into this than just saying air, as Dr. Seale mentioned.
Anyway, that is what it is. That was the data that was --
data from tests that were performed in air, adjusted by the ASME process
for design. Basically, what you see, in going from that to water at 40
or water at 60, you get a significant delta. The other thing that you
see is that you don't see a whole lot of change between 40 and 60 years,
basically, leading you to say that the conclusion you reach for 40
years, this study is also supporting for 60 years.
DR. WALLIS: Is one of those components the reactor vessel?
MR. HACKETT: Yes. I couldn't tell you which one off the
top here, I have got a backup slide on that one. Probably the one that
is down much lower.
DR. WALLIS: That's all right.
MR. HACKETT: Okay. The RPV is the lowest one.
DR. WALLIS: One.
MR. HACKETT: Is the number -- the number 10.
DR. WALLIS: Oh, 10.
MR. HACKETT: It is down over here. So the bottom line is
that, the ultimate bottom line is then you can see that the highest this
is getting up to is an E minus 6 range, which leads us to the
conclusion, and you will hear more about this from Chris in a little
bit, we don't see the need to impose a generic requirement on plants for
fatigue for the 60 year life, even considering the environment. There
is no need, based on risk and core damage frequency, to impose a generic
requirement. That is the ultimate conclusion.
DR. WALLIS: Could we just recapitulate? The previous
picture you showed, there is a certainty of through-wall cracking of
some things.
MR. HACKETT: Yes.
DR. WALLIS: And yet when you look at CDF, it turns out to
be unimportant.
MR. HACKETT: That's right. And that gets back to Dr.
Seale's question earlier, is that when these do go through wall, what
happens catastrophically? And the answer is, generally, not much. As a
matter of fact, not anything that we have been aware of in terms of
design basis transients. So, you look at the probability that this
would extend to small break LOCA, or maybe large break LOCA, to give you
a large contribution to core damage, and you just don't get there is
what it is telling you.
DR. BONACA: I have a question. When I read the report, and
I read also -- well, we had a presentation at the Water Reactor
Conference on this issue. A statement was made that the frequency of
through-wall cracks will get up.
MR. HACKETT: Yes.
DR. BONACA: In 40 to 60 years.
MR. HACKETT: Yes.
DR. BONACA: If I understand, however, how I relate that
finding to this result is because for thinner wall components, then the
frequency of cracks is increased, or thicker wall components is not,
just because the propagation of the crack through a thicker wall --
MR. HACKETT: Less so for thicker wall, just because of what
you are saying.
DR. BONACA: Yeah. Is it what makes the -- is that
correlation the one that results with core damage frequency not being
increased?
MR. HACKETT: No. No. There is more that goes into that
there. Again, there are more assumptions that go into the analysis. In
terms of the likelihood, again, a small break LOCA, a large break LOCA,
the mitigative measures that would kick in, both in terms of the human
factor and the engineered safety systems that would go into mitigating,
for instance, a small break LOCA, all of those considerations go into
where you get to in core damage frequency.
DR. SEALE: There is a lot of padding between a leak and
core damage frequency.
DR. BONACA: Well, the reason why I am asking the question
is that, if there was that relationship that one could make and say
that, you know, this crack propagation is affecting particularly smaller
piping, for which I have more confidence in leak before break, and
things of that kind, okay, then, you know, there is a significant --
there is some mechanistic relationship that supports this core damage
frequency. Now, what you are saying, there are other considerations to
do with, what, operator actions, I don't know.
MR. HACKETT: Yes. Operator actions, and the engineered
safety systems in particular, and then the probability of getting to
either a large or small break LOCA from one of these types of
situations.
DR. BONACA: And are the uncertainties being increased?
MR. STROSNIDER: This is Jack Strosnider.
DR. BONACA: Just because there is so much -- what about the
uncertainty associated with these results, is it increased?
MR. STROSNIDER: I think, I would just make the comment with
regard to the core damage frequency that I don't think it is a big
surprise, because remember that the plants, one of the design bases was
a pipe break, a doubled ended rupture, and the plants were designed with
redundant and diverse systems to cope with those breaks. So I don't
think it is a big surprise that the core damage frequency would be low.
DR. BONACA: No, I am not saying it is a big surprise. I
would like to understand, however, what keeps the core damage frequency
the same, and if it is associated with some aspects, I believe the
uncertainties will now be changed. And if it is associated with human
actions, et cetera, the uncertainties are increased. That is what I am
trying to understand.
MR. HACKETT: Yeah, I think -- let me say several things in
that regard, and we touched on it earlier. When these types of cracks,
based on design basis transients, go through the wall in either -- I
don't think in this case that the thickness is irrelevant, assuming they
do go through the wall, they will tend in most or all cases to go
through the wall non-catastrophically. That would be with aspect ratios
that would lead to leakage, but not catastrophic failure of the
boundary.
As opposed to the kind of case you might get in a rapid
cycle thermal fatigue, like we saw at Oconee, like has been seen in
France, where if there were a transient thrown at one of those types of
situations, you could end up with a catastrophic failure. But I think
there is the nature of the fatigue process, the way it operates here on
the design basis versus the beyond design basis. That is working very
much in your favor. And then, as Jack mentioned, you have the fact that
the plants were designed to handle those in the first place, so you
don't see a contribution, a large contribution of core damage.
DR. WALLIS: That is a very important message for the
public, it seems to me.
MR. HACKETT: Yeah, absolutely.
DR. WALLIS: This figure and the next figure.
DR. SEALE: Yes.
DR. WALLIS: That the probability of through-wall cracks is
quite high, I mean it is one-tenth or a hundredth or something.
MR. HACKETT: Right. Let me go ahead and put that up.
DR. WALLIS: There will be sort of news items that a pipe
crack through the wall in nuclear plant, gee whiz, isn't that terrible.
But, in fact, there is a factor of about a million between that and real
damage.
MR. HACKETT: Absolutely. This, to me, as I sat thinking
about it, when we were putting some of these graphics together, this is
a real tribute, ultimately, when you sit down and think about it, to the
designers. They -- you know, you are showing a relative, as you said,
you are showing a relatively high frequency here of through the wall
cracking, in that case either for 40 or 60 years. But at the end of the
day, the impact on the safety of the plants, you know, from a risk
perspective to the public is not very much. Then, again, leading to the
conclusion that we don't see imposing any generic requirements. We are
basically supporting the conclusion for the previous GSI.
DR. KRESS: I am interested in the validity of this
technique for calculating through-wall cracks. It seems to me like
there ought to be ways to judge that based on experience. For example,
you could probably have some probability data on how often you get
through-wall cracks versus time in service. Or maybe you could even
use, it ought to be, it seems to me, related to LOCA initiating event
frequencies somehow. And have you made any attempt to validate this
process using each of those measures some way?
MR. HACKETT: Mike.
MR. MAYFIELD: This is Mike Mayfield from the staff. The
interesting thing you find is that the designer really make a mistake,
we shouldn't be seeing many fatigue failures at this point in plant
life. Where we do see the leakers is where transients, actual
operational events haven't been picked up in the design calculation.
That is where you see the leakers showing up.
DR. KRESS: Could you use those and go back and redo the
calculation?
MR. MAYFIELD: If you had good, could you, in principle,
yes. The practicalities of getting the stresses and the cyclic rates at
a level where it makes sense to backout, to do the calculation in
reverse, what you find is that the uncertainties begin to swamp what you
can really do. But, in principle, yes, you can do that. And there have
been attempts at that in other implications, but the uncertainties cloud
the answer to the point that you are not ever quite sure what you really
ended up with.
DR. SEALE: But when you do find a through-wall crack, isn't
it true that when you go back and look, you indeed find one of these
insults that are outside the original environment that was considered in
the design?
MR. MAYFIELD: Yes.
DR. SEALE: So it is not a random screw-up, if you will, you
know, the materials weren't done right or something like that.
MR. MAYFIELD: It is typically something other than an
underlying material problem. There was some change in plant operation,
some characteristic that wasn't anticipated, and it wasn't reflected in
the original design calculations.
DR. WALLIS: This would be -- this would characterize the
failures for thermal fatigue in Japan, for example?
MR. MAYFIELD: Yes, sir. And the Oconee leaks.
DR. WALLIS: So this is also important, there is something
else in this, the things which you didn't anticipate, which could quite
well make these leap up an order of magnitude.
MR. HACKETT: Yeah, I will come to that, too, because we
have a plan for addressing beyond this. But leads us to the -- we have
already hit the basic conclusion, but this --
DR. SEALE: Before you go to that, I would warn you, also,
when you compare those two results curves, notice that the probability
axis is not the same.
MR. HACKETT: Yes. Good point.
DR. WALLIS: Well, we noticed that right away.
MR. HACKETT: It kind of jumps out.
DR. SEALE: Yeah, well, I am glad you are --
MR. HACKETT: It is a good point, though, on different
scales.
DR. POWERS: The difficulty I keep coming back to on this
thing is that -- I mean the truth is we do have things that break
because of fatigue, and it is always at some place that we never thought
to apply the code. Okay. So now what is the probability that there are
places in the plant that we have forgotten to apply the code to?
MR. MAYFIELD: That is a tough question.
DR. POWERS: It is one. Okay.
MR. HACKETT: It is one. But a good example, you come back
to the Oconee case and it is a weird disconnection of things, but what
you go back to find is that all the code mandated for that location was
a surface exam. You were never going to find a 360 degree crack on the
ID with a surface exam. It is even debatable how well you are going to
find with a volumetric exam from the outside. So it is a tough thing to
deal with in the ISI program. First, you have got to identify an area
that you would go look at, and then you had better be looking at it
really hard. So it is a real good question.
MR. MAYFIELD: Dr. Powers, your question also goes to the
last chart in the package because it is something the staff has been
talking about with the industry.
MR. HACKETT: Yeah, I will jump to that in a minute. I
guess we didn't really demonstrate here, but it is the case that CUF,
for some components, during these life of these plants, 40 or 60 years,
is going to approach or exceed 1. However, the cumulative damage
frequency, as we try to make that jump for you here, is very low,
certainly not large enough to justify new generic requirements by the
NRC.
DR. WALLIS: It looks as if this is a case where
risk-informed regulation is essential in order to reach this conclusion.
MR. HACKETT: I think absolutely.
DR. WALLIS: Without CDF you wouldn't be able to reach,
without PRA you wouldn't be able to reach this conclusion.
MR. HACKETT: Very true.
DR. WALLIS: And so this depends on the paritability of PRA.
MR. HACKETT: To a large degree. Correct. But we did show
you, however, there is an increase in leak frequency, it is relatively
small going from 40 to 60 years, but there is an increase. The
proposal, and Chris will talk about this, is that we would propose that
for license renewal that this be addressed by the licensees in their
aging management programs maybe in a manner to be determined. But it
has already been addressed successfully for Oconee and Calvert Cliffs.
We will come to the last slide, but that relates -- we did
have Mike Mayfield and Kurt Cozens from NEI co-organize the public
meeting to talk about fatigue issues in general on November 17. I think
that was very successful.
DR. POWERS: Let me ask you a question. You guys had a
public meeting November the 17th. Where?
MR. HACKETT: That was down at the Pooks Hill Marriott here
in Bethesda.
DR. POWERS: Okay. Why? Why kind of a public meeting is it
there in the Pooks Hill when you could have had one at an ACE meeting or
something like that where there might have actually been public that was
not connected with the nuclear industry that might actually have a view?
MR. HACKETT: I believe we did, I can't honestly say, I
didn't check the tally. There may have been interested members of the
public there. What I think we were all pleased at is we had very large
utility representation, a lot of interest in this issue on the part of
the utilities, obviously, particularly the utilities looking at license
renewal. NEI, EPRI, the ASME code folks were represented. I can't
really, Mike, if there were members of the public there.
MR. MAYFIELD: I don't know. Let me --
DR. WALLIS: You said -- I'm sorry. You said you were very
pleased there were all these utilities there. Now, a member of the
public might say he would be much more pleased if there were some
independent observers there who had technical knowledge.
DR. POWERS: I mean there are professional societies that
deal with this kind of topic for people other than the nuclear industry.
MR. HACKETT: Yes.
DR. POWERS: I mean this is a big issue.
MR. HACKETT: Absolutely.
DR. POWERS: And far more money is spent on this issue in
these other areas, practically any one of them, than is spent in the
nuclear business.
MR. HACKETT: DOD spends far more money than anybody on this
issue.
MR. MAYFIELD: This, since I was one of the organizers of
this meeting, let me try and jump in. This particular meeting was to
talk about an application-specific question. The dialogue that we have
sought from professional societies, ASME and ASTM, in particular, has
gone to the underlying technologies. So the meeting on November 17th
was to discuss the application-specific question of fatigue in nuclear
power plant piping, to present the results from PNNL and to solicit any
interested comment on those results, and then to talk about the overall
issue of fatigue.
There has been, I believe continues to be some interest on
the part of the licensees about what GSI-190, what impact it would have
versus, overall, what impact fatigue is having on power plant operation.
So the meeting on the 17th was to be specific to this
application. The broader question of underlying technologies, we have
presented this work through the ASME meetings, where the technical
specialists do come to the table. I believe, Bill, this has also been
picked up as part of the international cooperative group on
environmentally -- whatever they are called today.
MR. HACKETT: Assisted cracking.
MR. MAYFIELD: Environmentally assisted cracking. So there
has been that level of peer review in the underlying technology. So it
is not a matter that the only place we have sought input is through
meetings with the regulated community. We publicly announced this
meeting on the 17th, but it was specific to this end application.
DR. SEALE: I think there is another point here. Implicit
in all of this discussion, and the comments, the observation that Dr.
Wallis made about the probabilistic aspect of these evaluations, is the
fact that when you get down to the application, it is largely
plant-specific, and that there is no end-all resolution of this issue on
a generic basis. And we are at a very crucial point at the beginning of
the evaluation of applications for license renewal and so on.
And I think the point of the November meeting was to alert
the license renewal community this previously thought to be generic
issue was actually going to be something that was going to have to be
addressed on a plant-specific basis as part of their aging management
programs in their license renewal packages. So it is not, it wasn't the
normal kind of public meeting.
DR. WALLIS: Does this have to have a PRA because CDF is the
key to resolving the issue.
DR. SEALE: You will have to ask Chris that.
MR. STROSNIDER: This is Jack Strosnider. I just wanted to
reemphasize what Dr. Seale indicated. The meeting that we had a few
weeks ago, in fact, the industry, at our license renewal steering
committee meetings, have repeatedly asked for a status report on
GSI-190. They are interested in understanding how it would be resolved
and what is resolution would mean with regard to license renewal, and,
in fact, whether it addressed all of the fatigue issues or not. And so
that was really the focus of that meeting, was to share the results of
the GSI-190 study with the industry and to discuss with them other
fatigue issues that needed to be addressed in the context of license
renewal.
MR. HACKETT: That is a good lead-in to this slide.
DR. WALLIS: Could I ask now Chris Grimes? It was suggested
by my neighbor I ask him. The assurance of safety comes from PRA to
CDF, because we know pipes are going to crack through, or it is likely
that they will, and, yet, the assurance of safety comes through risk
analysis. Now, does this mean that all plants that want to renew their
licenses must have PRAs?
MR. GRIMES: This is Chris Grimes, and my simple answer to
that is, no, we haven't found a basis for requiring a plant-specific PRA
as a predicate for license renewal. And I will try to explain the
relevance of this, the risk-informed insights from these studies in
relation to aging management for the purpose of fatigue, when I try to
summarize that I believe is our recommendation on how to proceed with
license renewal.
MR. HACKETT: I will let Chris get to that here pretty
shortly. But I just wanted to show you, this follows on Jack
Strosnider's comments, this is an outline of -- I guess like a first
cut, really, at an integrated plan, more than a first cut. What we have
been discussing with the committee here today is really this line right
here on the resolution of GSI-190.
We did start out by saying, though, there are other fatigue
problems that we in the industry are aware of that need to be addressed.
In particular, what do you do when you have CUF greater than 1, is one
issue. There are a lot of things that come to mind there.
Repair-replace is one of the first issues. Those are options that have
been and will continue to be available.
ASME has an initiative in the form of a non-mandatory
appendix to Section 11 of the ASME Code, Appendix L, which allows an
inspection fracture mechanics type approach to assessing, you know, what
you do with components that have CUF greater than 1, or at least that is
one element of Appendix L. Appendix L first cut is going to try and get
you to, as we say, like to sharpen the pencil on the fatigue cumulative
usage factor analysis to get it below 1. If you can't do that, then
what you do in Appendix L is you postulate a flaw on a fracture
mechanics basis, and it is a flaw that would be a high probability flaw
that you would find with an inspection capability, like an ultrasonic,
volumetric inspection capability. And then you would see where that
flaw would end up for subsequent cycles on a fracture mechanics
propagation type basis and to see if that could get to your next outage
or some number of years.
There are issues with that, obviously, the NRC has not
endorsed it yet, there are some issues with it. There is a task group
right now working on revising Appendix L in ASME 11 that is, as far as I
know, making pretty good progress. So that is going on.
There is also an issue I didn't mention on the last slide.
ASME, the task groups and working groups that have been involved, I
think it has been fair to say have been fairly slow in incorporating the
environmental effects on the design curves. That has not happened. It
has been an open issue for probably 10 or 12 years now.
So very recently, my Division Director, John Craig, wrote a
letter to the head of the ASME Board of Nuclear Codes and Standards
requesting that action be taken on an expedited basis by the ASME Code
to that. That will hopefully happen. The ASME Code, as it turns out,
meets next week, so I am sure the debate will be taken up or renewed.
We mentioned thermal fatigue. The NEI and the industry have
been proactive in this regard, and they have an initiative that they
talked to us about at this meeting that they are looking at trying to
address thermal fatigue problems. This is in a preliminary type
situation right now, but they are working on it.
So this kind of brings together what we know about in
fatigue. We think we have resolved this piece, or we have resolved most
of it. There are other pieces and we in the industry are working on
those. And they do impact, as the other side of the slide shows, the
license renewal process.
DR. WALLIS: That is the obvious question, I mean you have
got an hour to license renewal, and yet you have got dates in the box
which go to the year 2002. So you have got to do license renewal
because you resolve the column on the right there.
MR. HACKETT: This column here?
DR. WALLIS: Yes.
MR. HACKETT: Yeah, absolutely. License renewal issues, I
think, depending on -- Chris can maybe comment on this further, can be
resolved without having to resort to these things. This is another tool
that will be available to licensees, is the way I would characterize it.
MR. GRIMES: Dr. Wallis, you are stealing all my thunder.
[Laughter.]
MR. GRIMES: When Ed -- you know, as Ed has tried to
describe it, there is a lot of work that has gone into, you know,
developing a better understanding of what fatigue means for the period
of 40 to 60 years. And I think that my role today would be to start
there and then go into, what does it mean for license renewal? How can
decisions be made for license renewal applications? What standards
should be applied? And so I hope that I can address that when I try to
summarize.
DR. WALLIS: I expect you to. I just say when you see a box
with an arrow, the obvious question is, well, what comes first? You
know, what depends on what?
MR. GRIMES: Sure. That's right.
MR. HACKETT: I think with that --
MR. GRIMES: And, in fact, Ed, you can leave that slide up.
MR. HACKETT: Okay.
MR. GRIMES: Because I will speak from that. But you also
notice that there are arrows going out of that box in different
directions, and so there is a coherence issue, too.
MR. HACKETT: So, I guess at this point, if there are other
questions that we should get into at this point, or else we will just
have Chris come on up and talk about the license renewal? Okay.
MR. GRIMES: I will come up to the front. And I will sit
down. I don't want to have to always talk to the back of Dr. Wallis'
head.
I would like to start off by pointing out that, as the
Generic Safety Issue process goes, this is a very unique Generic Safety
Issue. We set up a Generic Safety Issue process that basically provided
a means for the NRC to take new knowledge, to take new experience and to
apply backfitting standards in order to decide whether or not licensed
facilities need to change their behavior, need to change the plant
design, need to change the way that they operate the facility, or
whatever. And that is the process that we set up with backfitting
standards to make decisions about whether or not to impose new
requirements on operating facilities, and to change the standard of
acceptability for any future plants.
For Mike's benefit, my title is Chief of the License Renewal
and Standardization Branch, so I also have a vision to the licensing
process of the future in the event that any of the utilities in the
United States should choose to apply the combined license process to
implement one of the approved standard designs.
Getting back to the uniqueness of this issue, the question
that was posed for the experts in the community of fatigue was, is there
something that should be imposed as a condition for license renewal
because of concerns about fatigue for the period of operation from 40 to
60 years? And as Ed has tried to explain, when you look at the core
damage frequency results, based on a spectrum, or even a bounding
consideration of core damage frequencies resulting from the insights of
this environmental effect on the facility's design for fatigue, that --
those results clearly demonstrate that we cannot impose, as a condition
for license renewal, that all of the fatigue calculations be revised to
account for this environmental effect.
However, you should also remember that the standard of
acceptability for license renewal that the Commission established, that
goes -- that works in conjunction with the regulatory process that GSIs
handle with an expanding knowledge base, the standard of acceptability
is that the aging management programs for the facility are demonstrably
effective.
Now, using that standard and these results, and particularly
getting to the point that Dr. Bonaca raised about how do we cope with
this expectation that there is going to be an increased leak frequency,
even though it doesn't have a substantial effect on core damage
frequency, for reasons that Dr. Wallis pointed out, should be more
clearly articulated to the public.
There is still the expectation that the process for managing
the plant design, for monitoring those plant locations that are
susceptible to the things that are important to these environmental
effects, that is, particular geometries, particular areas that are
subject to a large number of cycles, those critical locations in the
facility where the CUF is expected to approach or exceed 1, our
expectation is that each utility seeking license renewal will have a
decision standard by which, as they -- for those critical locations,
that they will be able to make decisions about how to take corrective
actions in a timely way in order to try and minimize the potential for
increasing leaks in the future.
And so what we are proposing is that, first of all, we make
it clear that we do not intend to impose a requirement to have all the
fatigue calculations updated for the purpose of license renewal.
However, we would expect licensees, on a plant-specific basis, to
present programmatic explanations of how they are going to establish
decision criteria for critical locations in the plant that are
susceptible to the important factors of the environmental effects, and
those decision criteria will be a part of their fatigue monitoring
programs for the extended period of operation. For both Calvert Cliffs
and Oconee, the applicants proposed such programmatic changes, and we
have found the fatigue monitoring programs acceptable on the basis of
that change in behavior.
We also point out the other arrows coming out of this box
are that we will have to do that on a plant-specific basis -- it
represents a process inefficiency, in my view -- until the industry as a
whole can establish programmatic consistencies, that is, Section 11 type
of standards for which there is an industry consensus that the process
will find and fix, so as to try and minimize the amount of through-wall
cracks and leakage that plants experience.
DR. WALLIS: Of course, I have to ask, you brought up
plant-specific, and I should have asked at the time. Core damage
frequency, we keep being told is very plant-specific.
MR. GRIMES: That's correct.
DR. WALLIS: And yet we saw one graph of CDF, although there
were seven plant types investigated. So, really, you ought to show
seven results of CDF because we have learned that they vary quite a lot
between plants. And it may be that there are certain kinds of plants
for which the conclusion that CDF is much below some acceptable range is
no longer valid.
MR. GRIMES: Well, but as Dr. Apostolakis pointed out when
we described the Calvert Cliffs license renewal review, Calvert Cliffs
has a relatively large CDF. But my response to that is that it is --
the critical locations in the plant design are modeled in their PRAs.
And even if they don't have a good PRA, we still have knowledge about
what the critical locations are that are susceptible to fatigue that
need to be managed. And that is why I previously said that our
understanding of the critical locations in the plant does not constitute
-- or constitutes a basis to say that we still can't require a PRA as a
prerequisite to license renewal.
DR. WALLIS: But if we were to look at, say, Calvert Cliffs'
CDF, like this figure that we saw here, it wouldn't be the same, would
it?
MR. GRIMES: No, they would be different components.
DR. WALLIS: It would be higher?
MR. GRIMES: My expectation is no, because my recollection
is that the high CDF from Calvert Cliffs comes from an accumulation of
things rather than a particular vulnerability. If we were to come
across a plant that had a particular vulnerability to leaks propagating
to pipe breaks, then my expectation is that we would see their fatigue
monitoring program has more work to do.
DR. WALLIS: There might even be special circumstances where
they or you might have to do a PRA.
MR. GRIMES: That's correct. It might be that we would have
to look harder at the sensitivity of the PRA to some of the assumptions
concerning pipe break -- excuse me -- fatigue critical locations.
DR. WALLIS: Thank you.
MR. GRIMES: But that would -- that is another reason why,
until the -- your left, the lefthand side of that chart represents
something we want to continue to pursue. We would like to see the ASME
take a more aggressive role in establishing a standard of acceptability
that would cover all plants and all of their risk profiles in terms of
the process by which plants would manage fatigue, given the data on the
impact of environmental effects. And that's why Mr. Craig was kind
enough to send letter to the ASME and stimulate them in that regard,
because until we have an industry standard that deals with environmental
effects in a way that accounts for how to manage critical locations, we
are going to have to continue to review this on a plant-specific basis.
Now, I will tell you that the industry is probably going to
not like that. They were -- the acceptability of the programs for both
Calvert Cliffs and Oconee was, well, we will make these changes to our
program unless GSI -- the resolution of GSI-190 gets a better deal.
And, obviously, the better deal that they were hoping for was that we
would say that these CDF results constitute a basis for 60 years, like
it did for 40 years, for taking no action in the fatigue design and
maintenance of the plant.
But, as I said, when we look at this from the point of view
of the standard of acceptability being a demonstrably effective aging
management program, we just find it difficult to say that the fatigue
monitoring programs that are in place today are demonstrably effective,
given this experience and the potential for approaching CUFs, or
approaching fatigue damage, depending on whatever ends up being the
decision point.
But I do believe that even though they will say that that
constitutes a regulatory burden that they will question. I also expect
that it is one that they aren't going to fight a whole light about,
because, as a practical economic matter, the utilities are not going to
want their plant susceptible to unscheduled shutdowns to fix water on
the floor.
DR. WALLIS: But whether it is a necessary burden is
something you guys will decide.
MR. GRIMES: Well, we have determined that it is a necessary
burden that they should have an adequate economic motive to make
commitments to programmatic changes. And I think that at this point we
think that the continuing work that is going on with the ASME, and all
of the work that will eventually go down to the bottom of that chart,
which is an eventual generic resolution, and a systematic way to manage
plants, that that will ultimately be the solution, but that until then,
we are going to continue to evaluate it on a plant-specific basis, and
that is our proposed resolution.
DR. BONACA: One consideration that can be highlighted with
the licensees is the fact that this data shows that the initiator
frequency is going to increase for leaks and breaks, as simple as that.
MR. GRIMES: Yes.
DR. BONACA: So the CDF is maintained at that level because
of mitigation capability of the plant and other considerations. But the
fact is that the frequency of initiators is going to be increased unless
certain programmatic initiatives are made of the type we saw for BG&E.
That is an important insight, I believe, because, again, you know, to
me, to know that you have a category of initiators that increases raises
questions regarding the uncertainty associated with the results of the
PRA.
MR. GRIMES: That's correct. But, you know, to take the
counterpoint, to take the industry's perspective, you know, when we
originally entered into this dialogue with the industry, the point that
they raised is that, well, leak before break is a design feature, and we
have processes for finding and fixing. And so, from the standpoint of
trying to minimize the amount of commitment that they would make, the
original arguments went along the lines of, well, we know that there are
other things that are going to cause cracks to propagate and for leaks
to occur, and there are margins in the plant design more associated with
CDF than the individual fatigue calculations, that those margins are
sufficient and that we will, as knowledge grows in the future, that they
have their process for changing their programs, and they would prefer to
put those off, obviously, because that doesn't represent as much of a
financial commitment at this point in time.
When we make a license renewal finding, we are basically
binding the commitments in terms of how the plant design is going to be
managed, and that represents a financial commitment that they are now
projecting for the next 35 years. So if I spend an extra $100 a year,
you know, to do something on license renewal, or, better yet, how about
if I am going to spend another $100,000 a year for this particular
program, and then run that out 35 years, all of a sudden they are
getting dicey in a deregulated environment. So, you know, the
trepidation and the concern of the industry are understandable.
But, as I said before, there is a lot to be said for simply
pointing out that we don't see the need to impose a requirement that all
the fatigue calculations be redone. We are focusing on the critical
plant locations where we know fatigue is susceptible, and we are looking
for a decision standard that is going to find and fix those things
before they turn into leaks, and we think that there is adequate
justification to do so.
DR. SEALE: At the risk of stirring the ant bed back up,
though, and this is a question that I should ask everyone, not just you,
Chris, with this issue, we shouldn't be enthralled to just the license
renewal question. If you go through the ASME process and get
environmental assisted cracking data put into the code case, since the
indication is, as I understand it, that these things show up
significantly different at 30 years, presumably, this could have some
impact on the aging management programs for existing plants, whether
they go for plant -- for license extension or not. So, is that correct?
MR. STROSNIDER: This is Jack Strosnider, and let me take a
shot at answering that question.
DR. SEALE: Okay.
MR. STROSNIDER: It is a good question. If you go back to
the bar chart that showed the leak frequencies in air versus water,
using air versus water curves, you see that there is really not that
much difference between 40 years and 60 years, for some of the
components.
DR. SEALE: Yes, yes.
MR. STROSNIDER: For some of the components. Right. So we
saw that result and said, well, what does that mean in terms of 40
years? And I think -- so we went back, actually, and took a look at
what we told this committee and the world when we closed out the earlier
GSIs. And there is a very interesting point that comes out there, and I
want to preface it by saying that these probabilistic assessments are
intended to be realistic, all right, and I think that is the right way
to do probabilistic risk assessments.
However, there is a conservatism in what we are looking at
here in that the cumulative usage factors are design calculations,
analyses of record. When we looked at this under the earlier GSIs, and
went in and actually -- and John Fair mentioned -- got specific data on
what the actual loads were at the plant, how many cycles, what their
magnitude were, and actually calculated usage factors based on the real
history of the plant, it turned out that there is a lot of conservatism
in those design basis calculations.
So that when we are talking here at 40 years, there is an
assumption that you are at a certain cumulative usage factor, when, in
reality, the plant could be much less than that.
DR. SEALE: It hasn't been banged that hard.
MR. STROSNIDER: Right. That is exactly right. And, in
fact, there was also some monitoring, some of the plants have fatigue
monitoring systems in-place, and a look at that confirmed that also. So
there is a -- when you are tieing these probabilities of leak to usage
factor, there is a conservatism in indexing yourself to where am I
really at with regard to usage factor. And our expectation is that the
usage factors are not -- they are not nearly as high as what you would
get from the design basis calculations. So that was one of the major
observations from the earlier GSIs.
However, you need to ask yourself the question, well, what
if I am wrong, all right, and what if there are some locations where the
usage factor is high and the leak frequency goes up? And, first of all,
you have the risk input then, which indicates that from a core damage
frequency perspective, it doesn't contribute significantly. And then
you also have to consider that there are programs in place for leakage
monitoring. There are corrective action programs.
Mention was made earlier of the Oconee leak a few years ago.
And if you look at what happened in response to that sort of thing, all
of the B&W owners got together, those locations were being inspected.
The thermal sleeve, which was contributing to part of the thermal loads
there, were being inspected. So you rely to some extent on our
monitoring and corrective action programs. The oversight process is
being put in place. You know, this is one of the things that would be
monitored. So we have to acknowledge we rely on that also.
When you go, though, from 40 to 60 years, and it is just,
you know, common sense, the usage factors are getting higher, all right,
so the likelihood that these sort of analyses will become more realistic
certainly become greater as you go in 40 to 60 years. And so I think
from a technical perspective it makes sense that we ought to be looking
harder when we go past that 40 year mark, and just again from a license
renewal perspective.
From a regulatory perspective, Part 54 already has in it a
requirement to show that actions have been or will be taken to manage
defects of aging. If through-wall cracking is an effect of aging, the
rule would say you need to do that. And, so, in terms of backfitting,
we are not suggesting changing the rule, it is already in the rule.
In terms of a realistic approach to this, as Chris pointed
out, not suggesting that people need to redo all their fatigue
calculations. And, in fact, I think that we have seen some in from the
two plants so far is a fairly reasonable approach in which they monitor
the critical locations in the plant, those that have the highest usage
factors, considering environmental effects, right. And they use -- they
monitor those, they will do inspections appropriately, and if something,
you know, shows up there, then that will go into the corrective action
program to see what you do for the rest of the plant.
And, finally, as was indicated, there is an financial
incentive, and Dr. Seale mentioned earlier, too, the concerns about
contamination and you don't want leaks. So licensees clearly don't want
leaks, they don't want an unscheduled outage. They don't want to have
to deal with contamination, and so there is a motivation there. And I
think, again, that supports the solution that we are recommending. So,
hopefully, that is helpful.
MR. GRIMES: I also want to go back to a related point in
Dr. Seal's comment, and that is I want to remind you that the license
renewal process is founded on the basis that the current licensing basis
carries forward through the period of extended operation.
DR. SEALE: Yes.
MR. GRIMES: The reliance on the regulatory process to have
an associated -- find problems and fix them, we see a wide variability
in the licensing basis for each plant. Some plants have experienced
events and they have changed their design. They have -- some plants
have more burdensome fatigue monitoring programs simply because they
have had to cope with a particular problem, some others may not. But
that is a part of the regulatory process that has led to maintaining
those license bases with those requirements. Some plants have imposed
it on themselves to go above and beyond their licensing basis because of
an interest in maintaining their plants.
So to the extent that there is an impact of this activity on
plants, regardless of license renewal, that is very true, regardless of
whether or not we take any regulatory action.
DR. SEALE: Okay.
MR. GRIMES: So, but what it boils down to is we are
proposing to you that the resolution of GSI-190 will be that we will
continue to seek plant-specific ways to address the environmental effect
in changes in the fatigue monitoring program until such time as we are
in position to endorse a consensus standard that will achieve that end.
Thank you.
DR. SEALE: Are there any other comments from the staff?
Any questions of the members?
[No response.]
DR. SEALE: Mr. Chairman, I pass it back to you.
DR. POWERS: Yes, I just --
DR. SEALE: I would appreciate an opportunity to get any
inputs from the members as to what they would like to see in a letter at
some point today.
DR. POWERS: We will try to have some discussion of that
probably later in the day.
DR. SEALE: All right.
DR. POWERS: I will reiterate my interest in understanding
and having some guidance on how I can better understand the PRAISE code
and its level of validation and verification, simply because I know you
will be down here with other issues in the future that make reliance on
that.
With that, I will recess for 15 minutes. We will have until
25 after the hour, I guess.
[Recess.]
DR. POWERS: Let's come back into session. Our next topic
deals with the ATHEANA program, and I will bet you that somehow,
someplace, I must have a conflict with something to do with this code,
but I will be darned if I know what it is.
With that introduction, and a warning to the members to be
cautious about anything I happen to say for or against this effort, I
turn it over to you, Dr. Apostolakis.
DR. APOSTOLAKIS: Thank you. We have a subcommittee
meeting, the Human Factors Subcommittee meeting almost a couple of weeks
ago, where we had a presentation by the staff and its contractors on
ATHEANA. And there were several issues that the members present raised,
and we are hoping that today's presentation will address some of those.
Everyone was concerned that the methodology appears to be
too complex, and to the point where it may discourage potential
practitioners from even trying to learn what it is all about, leave
alone using it.
DR. POWERS: Well, I think saying everybody was concerned,
it certainly was not my response to it. The level of complexity
involved in ATHEANA surprised me, but then I said, gee, in the
phenomenological area, we frequently create computational vehicles that
are complicated, not intended for general use, but they are very useful
for us to understand how to simplify things down to address the hard
questions that the simpler, more routine tools just aren't any good for.
DR. APOSTOLAKIS: Yeah, I didn't want to imply that there
aren't any situations where the full ATHEANA should not be used. I
think the concern was that there didn't seem to be a screening process
identifying the human actions that really deserve this treatment and
something smaller for other actions that perhaps can be handled
satisfactorily using simpler methods, or a simplified version of ATHEANA
itself, I mean it is not -- but, certainly, you are right. I mean there
are certain situations where you really have to do this, and the idea
that human reliability analysis should be done quickly and simple
methods is certainly not one that I would espouse.
MR. BARTON: Well, also, George, I think that licensees have
some process or system in place for analyzing human performance issues.
And if you come out with something that is going to be, you know, if
they consider -- I hate using this, or a burden, I am getting tired of
it.
DR. APOSTOLAKIS: Yes.
MR. BARTON: But something that is going to require a lot of
effort, that they are going to be discouraged by it, that is my issue.
DR. APOSTOLAKIS: Now, the -- and, by the way, the same
issue arose several years ago in another context. There was a very
elaborate methodology that was developed for the utilization of expert
opinions in probabilistic seismic hazard analysis, and a major criticism
was exactly the same thing, that you expect us to do this for every
building, every -- you know, DOE was involved and, you know, they have
lots of buildings that are not reactor related. And there was an
attempt to develop a scheme that says, you know, under these conditions,
perhaps having, you know, one guy calling up people and getting views
and putting it together himself is going enough. In other situations,
you have to go to a more complex situation.
So I think there are analogies, and the issue has been
raised in other contexts, and maybe it will benefit by looking at what
happened there, because not every issue deserves this full blown
treatment.
The other area where there was concern, especially by the
former utility members, was the example, the fire initiated example, and
I am glad you said that you have more detail today, where Mr. Barton and
Mr. Sieber expressed the view that the didn't see the results of ATHEANA
being much better than what one would have gotten by using simpler,
presumably simpler methodologies. So perhaps it was just the
presentation that didn't do justice to the work, I don't know, but we
certainly would like to see more examples, not today necessarily.
I would these were the two major issues that were raised,
and maybe you can address them today, and we can address them as we go
along. The staff told us that they were not requesting a letter,
however, the subcommittee felt that the issues were important enough
that writing a letter is something that the committee may want to
consider. And on that happy note, I will turn it over to Mr.
Cunningham.
MR. CUNNINGHAM: Thank you, sir. I am Mark Cunningham from
the PRA Branch in the Office of Research. With me today is Dennis Bley,
Buttonwood.
MR. BLEY: Buttonwood.
MR. CUNNINGHAM: Buttonwood, Incorporated, one of the
contractors involved with the development of ATHEANA. Catherine
Thompson, who made some of the presentation at the subcommittee meeting,
is unavailable, unfortunately, for today, at least unfortunately for me.
And there are four parts to the presentation today. I have
some introductory slides on why we did this, and that sort of thing. I
will talk a while about the structure of ATHEANA, what is in this method
for human reliability analysis. We will talk a bit about the fire
application. There was one demonstration analysis using ATHEANA. And
then come back and say where we think we are and where we think we need
to go with one ATHEANA.
At the subcommittee meeting we discussed a number of things
that were of concern to the subcommittee, which I think were of concern
to us as well, quantification, you know, the issue of how -- what is the
role of this approach for human reliability analysis in the broader
context of PRA and HRA, and that sort of thing. And we will touch on
those at the end, I guess.
By way of introduction, I guess I wanted to talk about a
couple of the issues that relate to some of the heritage, I guess, or
mythology that has come along with ATHEANA over the last five years or
so. One of the questions that comes up is, well, why do we need a new
HRA method?
And what inspired us to begin what became the ATHEANA
program was that there is an inconsistency between what we see happening
in serious accidents in complex technologies, not just nuclear plants,
and how we see human performance occurring in that complex -- in those
complex technologies, and what we see coming out of PRAs and HRAs,
current -- the present generation or the first generation or HRAs.
It concerned us that the types of human performance and
human errors that were coming out of -- or that we saw from bad
accidents were not being treated. So that was, if you will, the
fundamental reason for beginning this work, that we think we needed to
get HRA closer to the real world, if you will, that we see in serious
accidents.
The question then becomes, okay, well, now that we have done
a fair amount of work on ATHEANA, how does it fit it or what can it
contribute? This was the subject of some confusion in the subcommittee
meeting, I believe. Again, there is some -- over time there has been
the idea or perception that ATHEANA was the answer to every HRA question
that came up, and we have heard that back to us. Well, why, you know,
why do you need to use ATHEANA for all kinds of things?
In this we tried to at least start the dialogue and saying
that it is not the tool for every HRA application in PRA. There are a
class of human errors, pre-initiators. There are lots of way to do that
today that are probably perfectly adequate.
DR. WALLIS: That goes back an awful long way,
pre-initiators. I mean it could be some fault traceable to an NRC
regulation or to some designer's decision 40 years ago. If you really
look back, everything pre-initiating, that is an issue, an error pretty
well.
DR. APOSTOLAKIS: No, this is -- Graham, this is the jargon
of the experts. Pre-initiating --
DR. WALLIS: Yeah, that is what is bothering me. Yeah.
DR. APOSTOLAKIS: Pre-initiating, they mean before an
initiating event, and they specifically refer things like routine
maintenance, testing, and people forgetting to reclose valves or open
valves.
DR. WALLIS: These are in the short-term, the short-term.
DR. APOSTOLAKIS: Yeah, they are routine operations. Yeah.
Now, if there is an error that is latent somewhere there because of some
action by the NRC of 20 years ago, no, that is not what --
DR. WALLIS: But human errors, I mean eventually they blame
the parents of the person who made the error.
DR. SEALE: Well, this is more like this Waterford thing,
where you left a valve unclosed.
MR. CUNNINGHAM: Yes.
DR. SEALE: And then later when you wanted RHR, you opened
up a valve and lost, what was it, 7500 or whatever the number was,
gallons of water.
DR. APOSTOLAKIS: Well, at Three Mile Island the auxiliary
feedwater system drains, the valves were closed for a few minutes as a
result of, you know, negligence after the test. But these are the kinds
of things they are referring to.
MR. CUNNINGHAM: Yes, that's right. In HRAs, you are right,
there is a jargon that we are applying here that we tend to block the
types of human errors that can occur in three different types. One,
things happened before the event, as we were talking about.
MR. SIEBER: Set up.
MR. CUNNINGHAM: There are human actions that can be taken
that can cause events. Typically, you know, somebody can, in the case
of the Waterford event, it may be, well, somebody decided to open this
valve and it may have been the right valve to open or not, but under the
circumstance, it wasn't the right thing to do. That caused an event to
occur.
And then you have got the post-accident, or post-initiating
event human actions, to either recover from the accident or from the
event, or to exacerbate the event and make it worse.
DR. SEALE: Yeah, but, Mark, there has to be a distinction
on that second event. If the operator had every expectation that
opening that valve would do what he was sent to do, namely, to initiate
RHR, the fact that he opened the valve and got sandbagged is not an
operator error.
MR. CUNNINGHAM: This is a key point within the context of
ATHEANA.
DR. SEALE: Yeah.
MR. CUNNINGHAM: Is exactly this. That one of the things
that ATHEANA does is bring the circumstances of the moment into play in
terms of assessing how the human performance. And you are right, you
can call that a -- we don't, we try to get away from calling it a human
error.
MR. BLEY: Yeah.
MR. CUNNINGHAM: Because the operator in that circumstance
did what he thought was the right thing to do, it just turned out to be
unsafe. So we get -- and we will see some of the lingo in here we
talked about.
DR. APOSTOLAKIS: Why didn't you change this slide 2,
pre-initiating unsafe acts, post-initiating unsafe acts? Would that be
better, or human failure events?
MR. CUNNINGHAM: Human failure.
DR. APOSTOLAKIS: I really don't -- I must say I still am
confused what the difference between an unsafe act and human failure
event, but --
MR. CUNNINGHAM: One of the issues at the subcommittee that
human -- differentiation between human errors, human failure events,
unsafe acts and that sort of thing.
DR. APOSTOLAKIS: Now, the human error, I agree with you, I
mean we should drop it. But maybe here also --
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: -- we should start talking about
post-initiating unsafe acts -- initiating event, unsafe --
MR. CUNNINGHAM: Yes. This, the presentation really doesn't
help explain those three terms very well in retrospect.
DR. APOSTOLAKIS: Now -- I'm sorry, go ahead. The human
induced initiating events, this is something you added since the
meeting.
MR. CUNNINGHAM: That's correct. This was based on the
discussion that we wanted to do two things. We wanted to clarify some
of the roles of ATHEANA. That we could see that ATHEANA -- we were
thinking of it and talking about it in terms of mostly in the post event
recovery actions.
DR. APOSTOLAKIS: That's correct. Now, you say ATHEANA can
be used, what does that mean? It can be extended probably, because you
would probably need to do a little more than just what you have now,
don't you think?
MR. BLEY: I am Dennis Bley. Maybe in some cases, but if
you look in detail at the first search that we have, and Mark hasn't
gotten to that yet, after we identify the functions that, if they go
wrong, will cause us troubles, one of the things we ask, is there some
way the operator could have caused these? And in that sense, we do
search for human induced initiating events or set-ups to the initiating
event.
DR. APOSTOLAKIS: No, but what bothers me -- not bothers me,
what I think will be an issue, a technical issue, is that you do now,
the post-initiator analysis, as you will tell us later, you do have a
base case scenario and then you look for deviations.
For the second bullet, I am not sure that you will have a
base case scenario. In other words, you are looking now all over the
place, I mean look --
MR. BLEY: If I could?
DR. APOSTOLAKIS: Yeah, sure.
MR. BLEY: The way we tried to structure the base cases is
that those are situations that occur that are functional things that
happen to the plant. And then we look for deviations from those, and
then we look how the operator interacts. Given it is some functional
occurrence, the fact that we then ask, could an operator have caused
this functional occurrence, is a structured way to cover this second
bullet. Now, there might be others beyond that, but I think you still
have to enter through some functional problem or it is not really an
initiating event.
DR. APOSTOLAKIS: That's where I think the challenge will
be, you know, what you have been doing, and everybody else has been
doing up until now, project ATHEANA, there is this functional
disturbance of something, so you know where you start.
MR. BLEY: That's right.
DR. APOSTOLAKIS: If you are looking for something like what
happened at Wolf Creek, where they postponed some action from Friday to
Monday, and then it just so happened that the combination of two
processes, you know, led to the path, it seems to me that is something
that comes out of the blue. I mean you don't have anything that will
lead you to think about this kind of context.
DR. KRESS: In fact, you have an infinite number of
scenarios.
DR. APOSTOLAKIS: You have an infinite number. So in that
sense I think ATHEANA will need to be extended in some way, because this
is a fundamental assumption, that, you know, there is something has
happened already and then we look at base case.
MR. BLEY: I guess one last thing I would say on that, and I
won't claim we have covered it completely, is when we look for context
for a human unsafe act, and if turning this valve was the unsafe act,
unsafe not on purpose, but it turned out that way, we look for
conditions that might have set that up.
DR. APOSTOLAKIS: Yes.
MR. BLEY: Could valves have been mispositioned? And in
that way, as elements of context, we do look back at pre-initiating
human errors. Is there something the operator could have done to set up
the context for this? Will it be complete? Probably not. But at least
there is an effort to look for that in the context.
DR. APOSTOLAKIS: No, I know, I recognize that. All I am
saying is it is going to be much harder for the second bullet than it is
for the third, because of this openness.
DR. WALLIS: If you look at -- I don't know how far back,
you look at something like TMI, there is all kinds of things that
happened before the event. There were other events they had failed to
learn from. Is that a human error? There were valves allowed to leak
progressively over a period of time. All kinds of things happened over
many months before the real accident. Do you include them as human
errors, initiating?
MR. BLEY: I would say that when we do the search George was
talking about, from the initial functional disturbance, and then we look
-- well, when we lay out the base case scenario, look for variations in
that, these deviations, and look for the context. We are, and we say
you really need to do this in the plant, with the plant people, with the
operators there who know their training, they know their set-up. They
know if there is a certain set of equipment that is often, you know,
having problems with, this whole background, so we try to look for that
in the context search part of this process, and that is the way it does
come in.
And sometimes it goes fairly far back, all the way back to
training and what we expect the operators to know. There are good
reasons for the way it is set up. But if the right situation occurs,
something is going on they really know about or no one has analyzed
before, that is the sort of thing we are looking for, for ways the
scenario can take them to places we never expected them to go, so we
didn't train them, or we didn't do the analysis already to be able to
tell them what to expect. So there is an effort to find those kinds of
things.
I think the four examples that are in the report we gave you
give some of those kinds of cases worked out, especially the small LOCA
one, I believe. I don't think that showed up in the fire case that we
presented at the subcommittee. I'm sorry, Mark.
MR. CUNNINGHAM: That's all right. Again, part of the
context, part of the point of this slide is to follow up on what -- some
of the subcommittee comments, that we need to better define the role of
ATHEANA, ATHEANA-type analyses in the broader context of HRA, and I
think this is a first piece of it, but there are other pieces as well.
I think we do that. And I think we acknowledge that there is lots of
areas where ATHEANA is not the right tool to use.
DR. APOSTOLAKIS: You know, it wouldn't hurt at some point,
when you have time that you don't know what to do with, to go back to
THERP. You are referring to the handbook, right?
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: I think that in the handbook there is much
more emphasis on the performance shaping factors than on context,
although some of the elements that they call PSFs, perhaps we would call
now elements of a context.
It wouldn't -- although I think most people are happy to use
THERP and so on, it wouldn't at some point to go back with the ATHEANA
perspective and see whether there are any major issues there that may be
lying dormant, although that is not something that I think is urgent
compared to the other two bullets.
MR. CUNNINGHAM: Okay.
DR. APOSTOLAKIS: I think most people are really happy. I
haven't heard anybody really objecting to using THERP in routine kinds
of actions, unless you know something that I don't know.
Can we go on to 6?
MR. CUNNINGHAM: Certainly.
DR. APOSTOLAKIS: Slide 6.
MR. CUNNINGHAM: Anywhere you like.
DR. APOSTOLAKIS: Finish my noon, Mr. Chairman?
DR. POWERS: Well, you are supposed to finish by 11:45, but
I will you go to noon.
DR. APOSTOLAKIS: We started late.
DR. POWERS: That is your problem, not mine.
[Laughter.]
MR. CUNNINGHAM: Three objectives of ATHEANA we have got,
are on this slide. Basically, again, we want to try and capture a tool
for -- or develop a tool that reflects or builds into human reliability
analysis, our understanding of the human performance that we see in
serious accidents. As a fundamental, that is what it is.
We can do that in a qualitative way and in a quantitative
way, and there are qualitative applications of ATHEANA that go well
beyond the traditional PRA, and we will touch on some of those later.
DR. KRESS: Now, if I were to rephrase that first bullet and
said develop the probability that the operator will make the wrong
action when directed to make an action or -- is that what you mean by
quantitative tool?
MR. CUNNINGHAM: Yes, quantitative in the probabilistic
sense, that sense. I am not sure I understood --
DR. APOSTOLAKIS: It depends what you are after, Tom.
DR. KRESS: The probability he will not carry out the action
or that he will do the wrong action.
MR. CUNNINGHAM: Yeah, we don't --
DR. APOSTOLAKIS: That he will do something that will turn
out to be unsafe.
DR. KRESS: That he will do something --
DR. APOSTOLAKIS: Maybe an omission.
MR. CUNNINGHAM: Or not do something that would be --
DR. APOSTOLAKIS: Yeah.
DR. KRESS: It is not restricted to just saying you have an
emergency operating procedure, that what is the probability he will do
an action that is directed there? What is the probability that he won't
do it? Is that what --
MR. CUNNINGHAM: Correct. It is broader than that.
DR. APOSTOLAKIS: They are doing both.
DR. KRESS: Both of them.
MR. CUNNINGHAM: Yes.
DR. KRESS: Both of them.
DR. APOSTOLAKIS: That is they refer to them as unsafe acts.
DR. WALLIS: When you say reflected, in your world of
accidents, you mean is verified by a base of experience, observation and
why you might even call data?
MR. CUNNINGHAM: You might have called it data, yes, sir.
Yes, that's right. Yes, that's right.
DR. APOSTOLAKIS: Okay.
DR. KRESS: That last bullet on there, it is sort -- so
general, I am not sure what it means either.
DR. WALLIS: That is the philosopher's stone.
DR. KRESS: Yes.
DR. WALLIS: That is the universal --
MR. CUNNINGHAM: Yeah, okay. There was a context here of
you are applying ATHEANA to issues, narrowly defined issues, if you
will, as opposed to applying it broadly across a PRA.
DR. KRESS: I see.
MR. CUNNINGHAM: That was the distinction we were trying to
get at there.
DR. KRESS: If you had an accident evaluation team, and they
had some issue, you might just function on one action or something like
that?
MR. BLEY: Exactly. And we are not saying -- maybe you
don't have to go back and redo your whole HRA with ATHEANA, but if some
issues come up where you are really worried about these contextual
things, you can apply it right to those.
DR. KRESS: I see. I understand now.
MR. CUNNINGHAM: We will turn now to more of the description
of what ATHEANA is. Again, we come back to the point that, when you
look at serious accidents in complex technologies, you can see a pattern
of unsafe acts occurring. Operators in these facilities get into
situations or conditions that they don't fully understand, and it
compromises their ability to make safe decisions, if you will. So the
goal here is -- one of the goals is to be able to deal with that
prospectively, in a PRA context, to be able to say, okay, how can we can
kind of see, ahead of time, what would seem to be the more likely
circumstances that can lead to this, and the likely causes of this
confusion, if you will?
DR. APOSTOLAKIS: Now, Mark, this statement of scenarios and
conditions not understood by the crew, I wonder whether instead of not
understood, it would be better to say that these are scenarios and
conditions that mislead the crew. Not understood is like human error,
it carries with a little bit of blame.
MR. CUNNINGHAM: Okay, yeah.
DR. APOSTOLAKIS: Misleading is, you know, again,
contextual.
DR. KRESS: Not as expected by the crew.
DR. APOSTOLAKIS: In other words, are they expected to
understand these and they don't understand them, or are they really
misled to think that something else is happening?
MR. BARTON: That is a good distinction.
MR. BLEY: Yeah.
DR. APOSTOLAKIS: And I think that is what you mean, Dennis,
don't you?
MR. BLEY: Well, yes, but there is also some of both in
there.
DR. APOSTOLAKIS: There is some of both.
MR. BLEY: When you look at the really bad accidents, you
know, in the nuclear business, TMI and Chernobyl, really bad ones, when
you look at accidents in the aircraft industry and shipboard, you find
in these really bad accidents, either people get themselves in a spot,
or the machine gets them in a spot that they haven't studied before. So
that they get in a spot where they are misled, thinking what they
already know applies, when it doesn't, and that has come up a good many
times.
And I think when we have described those to operators from
nuke plants and from other industries, real examples and walk through
the example, what almost always happens is they say, yeah, and let me
tell you two other ones that I know about that are just like that. So
it seems to be a little of both.
DR. APOSTOLAKIS: i agree when it comes to retrospective
analysis, and you guys have --
MR. BLEY: That is what this was talking about.
DR. APOSTOLAKIS: Yes.
MR. BLEY: Since we find that in retrospective analysis, we
want to focus on those kind of things.
DR. APOSTOLAKIS: But what -- my point is that when you
switch to a prospective analysis, and you do what the second bullet
says, --
MR. BLEY: Okay.
DR. APOSTOLAKIS: -- you are really looking more for context
that may be misleading. Because how can you try to find things that,
you know, you have claimed that they will not understand them?
MR. CUNNINGHAM: No, that is fair. You're right.
DR. APOSTOLAKIS: I mean you look at the procedures.
MR. BLEY: But we also do that deviation. We say, given
this basic plain scenario, how am I to move faster, slower, all these
things? And sometimes when you do that, out of that pops one of these
cases that, for reasonably good reasons, we have never studied. So you
do find some of those. And that is why we like that search, because,
finally, even though, you know, in the past we saw those in real events,
we had trouble guessing them ahead of time. That HAZOP sort of search
seems to develop some.
There are reasons why you might not thing they are
important, but they come out of it.
DR. APOSTOLAKIS: And I agree. But maybe then, how about if
we say when the plant enters in areas and conditions, either not
understood by the crew or --
MR. BLEY: Or anybody.
DR. APOSTOLAKIS: No, no. Or maybe misleading the crew.
MR. CUNNINGHAM: Yes, that is better.
DR. APOSTOLAKIS: I think that would be a fair description.
MR. CUNNINGHAM: So, at any rate, basically, in order to try
to deal with this, we identified a set of search schemes, if you will,
to work and identify how these deviations may develop. We will talk
about those.
Now, basically, the next two slides cover the three parts of
our search schemes, if you will. One is you develop a base case
scenario, and, as we talked before, it is kind of a functional -- a
description of the events that would occur based on a functional
understanding of the progression of the operations at the plant at that
time.
You then look for what we call vulnerabilities, and on the
next slide on deviations, there are places where you can go off-track,
if you will, either be misunderstood, misunderstanding something, being
misled, that sort of thing.
I won't spend much time on these. It is basically a process
for identifying places where you can go awry.
There is four search schemes that we have built into the
ATHEANA model as in the report that you have got. Basically, Dennis
talked about one already in the sense of deviations from the base case
using HAZOP types of methods to search for keys that would identify
different types of -- that may introduce new scenarios or different
scenarios.
You look for things like informal rules in the plants that
guide how the operators perform under certain circumstances. You look
for deviations caused by subtle failures. You have issues such as
instrumentation concerns and that sort of thing.
And then the last one is you can get into -- identify
deviations where the operator tendencies and things like that come into
play.
DR. APOSTOLAKIS: Isn't this now the major contribution of
ATHEANA literature? I mean this is really where you guys differ from
others.
MR. CUNNINGHAM: I think clearly --
DR. APOSTOLAKIS: Not in the sense that you introduced the
idea of context, but I mean you are making it a systematic --
MR. BLEY: I think so.
DR. APOSTOLAKIS: Developing a systematic approach to
identify it.
MR. CUNNINGHAM: That's right. I think the idea down in the
heart of ATHEANA of having to reflect the situations in the plant and
how they impact human performance, and then how to search for the
difficult parts of that are the big --
DR. APOSTOLAKIS: So for those members that are not very
familiar with human reliability analysis, this is a significant step
forward.
Now, it can also be -- I mean if this is not well, that
ATHEANA doesn't produce good results, this is really the heart of it.
We were not doing this before. Now, these guys are telling us we have
to do it very carefully.
But my point is that composition of the team that does this
is critical here, right?
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: And who will decide whether something can
occur at a slower pace, therefore, it may lead to problems? Because
what I am reminded of now is the heuristics, as you know, have been
published by Connerman and Verski, and other people, where you have
problems with perceptions. In fact, there was a very interesting paper
a long time ago where there was a survey of operators to see what their
perception was for the available time to act under certain conditions,
and as I recall, they overestimated the time by about a factor of three.
So, you know, the perceptions really drive the whole thing.
So what, if you have an operator in your team and he says,
well, now, nobody is going to consider this as being too quick or too
slow, how do you handle that?
MR. BLEY: I would refer back to -- in our earlier version
of ATHEANA we had an example run up at Seabrook, and we spent several
months with them, and the Seabrook staff was involved. To make it work,
you really need someone who is a very good integrator, who knows a fair
amount about operations, who knows a bit of thermal hydraulics, who
knows a lot of the PRA.
And we had two operator trainers in that session at
Seabrook, and I looked back through our notes and transcripts on what
went on there, and what you usually would see happen is exactly what you
would say. Is one of them would say, we don't have to worry about that,
that can't happen here. And then we would just keep pushing and ask a
few questions. And eventually the other one would say, you know,
remember that scenario we ran the simulator last year, and Charlie, do
you remember what he did? And all of a sudden, they would start working
from there. I would say, yeah, and then we did something else, you
know, it is similar to this.
And you have to keep them at it for a while, because there
is a tendency to stick with what you already have conditioned yourself
to believe. But we have found that if you do stick with them a little
bit, that they will work through that. And especially, your question,
how you get the right people. You need the ones who are fairly creative
involved there, who are willing to think and push. But you have those
tendencies, that is for sure.
DR. APOSTOLAKIS: So what you are saying is the lead person,
the leader of the team should be very knowledgeable.
MR. BLEY: In several areas.
DR. APOSTOLAKIS: In several areas, which I think is
correct, of course.
MR. BLEY: You need somebody, for this case where you are
dealing with the operators, who the operators won't dismiss, you know,
who knows a bit about their game and their procedures.
DR. APOSTOLAKIS: That's right.
MR. BLEY: And can push them into spots that get them
thinking and accept -- or at least thinking about what that person is
saying.
MR. SIEBER: I think there is an advantage, too, when, in
the ordinary course of simulator training, you do not give the classic
accidents all the time, you vary break sizes, you vary support system
capabilities. And if you systematically, in the process of doing that,
year after year, with every crew, you will be able to get at least the
trainers' judgment of the timing of the sequence, what actually fails,
what does not, and how the operators react to it. And so the
opportunity to pick up the data is there as long as people realize that
one of the purposes of simulator training is to actually acquire that
data. So, really, it is not as hard as it could be.
DR. POWERS: Let me ask a question about the informal rules.
How do they ever get discovered? Either that somebody from a particular
plant on a team would be loathe to admit that they are there, people
from the outside will never discover them.
MR. BLEY: I think they are not as loathe as you think. If
you spend some time talking with people about what their practice is,
when you ask -- you know, you have a catalogue already of things you
know people do at various plays from your own experience and others you
have talked to, and you start telling the kinds of things you are
thinking about, and some of these are -- almost all of them are pretty
legitimate. They have come about for a reason and a lot of them cover
areas that aren't really specified in detail in procedures. Some do,
but some of these old ones stick around. So it is, again, a process of
having people from that facility involved who know what their practice
is and who --
DR. POWERS: It seems to me if I was at a facility and
somebody asked me are there any informal rules for doing things, stuff
like that, I would say there is no upside on this for me to answer that
in the affirmative, and there are some severe downsides.
MR. BLEY: I think if one comes into a utility as an outside
and says I want to know how you are doing things that aren't -- you
know, you are not supposed to do, which is kind of what it sounds like,
the way you said it, they will say we don't ever do that. And, you
know, when you explain what you are doing, and you are working with them
and you say, well, you know, when I was in the plant, we used to do
these things, that is kind of what I am talking about, and here is the
reasons why.
If they see you as an antagonist, they will probably never
talk to you, but if they see you as someone who is working with them
trying to help, I haven't found that to be a problem. And I know they
have those, you know, so once you start talking to them, you give
examples and they start talking about why they do. And like I say,
generally, there is good reasons for these things, these aren't
clandestine hidden things. But because they are not codified and all
worked out, there are situations where they might not be appropriate.
So I haven't run into that problem, and the rest of our team has had
pretty good success, I think.
DR. POWERS: I guess what I am sitting here saying, okay, he
says he hasn't run into -- I wonder how he knows.
MR. BLEY: Well, if you just said, what are your informal
rules, he won't. But if you start saying, you know, when a pump starts
making this kind of sound, you know, what do you do about that? You
have to take it down to reality for that person, that individual.
DR. POWERS: Maybe what they reveal to you are what they
think -- they say, okay, yeah, it is true, every organization has
informal rules. We know that from a lot of writers about business
organizations and things like that. So I will give him these that are
kind of innocuous and have good reasons for them. I am not going to
give him the ones that don't have real good reasons for them.
MR. BLEY: I guess there is always that danger. When we did
the exercise with Seabrook, the PRA folks there really invited the team
because they had stuck with the methods they were using and were hoping
to find something useful, so that they were pretty forward about that.
And before we even came, they read through the examples we had in the
NUREG and they said, look, we have gone around and we already know some
of these, and we have worked with the operators, we have got a revised
set that we think are pretty true here at Seabrook.
And, you know, they had done that ahead of time, and they
weren't -- when you looked at them, they weren't, you know, some kind of
polished, let's hide things kind of set, they were pretty reasonable
things that you would expect them to have in the plant. So it is a
legitimate worry, but you have the same kind of problems I think with
anything you are trying to ask a facility. You have the same problems
with getting data.
DR. APOSTOLAKIS: In this kind of scheme, because I see you
are not going to come back to this, you are using also -- well, first of
all, I must say this is the first presentation on ATHEANA that I have
seen in a very long time that doesn't have that diagram, the defining
context and so on.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: I mean this is a milestone. Is there any
reason why the diagram is not used today, or is it just that things
evolve naturally? That is okay, Mark, you don't have to answer. I am
not complaining for the lack of the diagram, but it might have helped
members less familiar with the methodology.
But my point is this, I know that there are other approaches
that are being developed internationally, as you know, MERMOS, for
example, in France and some interesting work that is happening in
Finland, where they emphasize a lot the decision-making processes. Now,
in your case, the way I understand, these decisions that the crew must
make are really here, this is where you are thinking about what they are
going to do and so on in identifying possible deviations.
MR. BLEY: Primarily the first two searches.
DR. APOSTOLAKIS: Exactly. But you don't seem to really
emphasize the decision-making process investigated. I mean you are, of
course, taking into account possible deviations, but not in the sense
that you think it deserves a section or a chapter. And we had the
comment last time from Mr. Barton that he was disappointed that the
safety culture of the facility did not seem to be reflected anywhere.
And I think the safety culture, for example, will become important when
you have to prioritize things like the Davis-Bessie incident. You know,
is it economics that will drive the decision or safety?
And perhaps by looking at the decision-making processes a
little bit more formally, you can expand this part of the analysis,
because it certainly belongs here. I mean it is not that it is an
entirely new idea. And maybe bring some of the cultural issues and
other things that may apply which brings up another issue, the timing
issue. I think these things will be different if the operators have to
respond in 15 minutes, than if they have -- if you are talking about
actions take place an hour-and-a-half later, but I am sure you have that
somewhere, the timing.
MR. BLEY: Yes. I don't want to throw numbers at you, but
step 5 in the ATHEANA process is the one where you identify, you know,
kind of the set-up in the plant. You identify what is going on in the
culture. How do they normally handle this? There is a section just on
the timing of the base case, and we talk about how deviations affect
that.
DR. APOSTOLAKIS: The timing.
MR. BLEY: So those kind of things are covered in that sort
of set-up stage before you do the searches. And the way I have talked
about, I think we did in the report, what we have found doing the
analysis is you get notes on all of that and you kind of stick them up
all around you, while you are doing the search, you are checking these,
including those tendency things we talked about. You know, what if
parameters go one way, what does training and all these things maybe
tell you to do about that? So all of that set-up material is organized
in a pre-search step.
DR. APOSTOLAKIS: All I am saying is that in some situations
where you really have a decision-making situation, because most of the
time, really, the decisions are either trivial or people do it because
they are trained to react in a certain way. But there may be instances
where you have, you know, a major decision, again, go to bleed and feed
or not.
A more formal look at that might help you structure this a
little better. It is not that you are not using any of that in here.
You are already using a lot of it. But I think a more formal approach
might reveal things that -- or may make life easier in identifying
things, that's all.
MR. BLEY: That might be. In fact, you know, what we call
response planning is, in fact, --
DR. APOSTOLAKIS: That is where most --
MR. BLEY: They are making the decision.
DR. APOSTOLAKIS: Exactly.
MR. BLEY: And thinking through what you are going to do
over the next step. So it is there. And we have certainly studied what
MERMOS is doing, and the others, and they are paying close attention to
that. In fact, we are communicating with them very closely.
MR. CUNNINGHAM: Yeah, I was going to say a couple of
points. One is when we get back to the back on where we go from here, I
think the issue of -- you can safety culture or work processes, or all
those sorts of things, I think is something we understand could be a
valuable addition to what we are doing here, so it is on our list of "we
would like to do" type of things, again, part of our understanding of
that and bringing that in, because we have interactions, a good bit of
interactions with the people developing the other methods around the
world.
DR. APOSTOLAKIS: Finland is doing some pretty interesting
stuff. I mean I saw some papers, there is some very nice stuff going on
there.
MR. CUNNINGHAM: And we talked about it at the subcommittee
meeting, excuse me, that we have an international, we have a couple of
international activities underway to help us in this area. One is
through CSNI, principle working group 5 on risk assessment, where they
are looking -- there is a report to come out in the next few months on
errors of commission and methods for treating that. Another is our
CUPRA working group on organizational influences, where we are trying to
cooperate internationally with half a dozen countries or so on what they
are doing to try to model the impact of organization on risk analysis.
DR. APOSTOLAKIS: These things, Mark, are not done by
committee. Let's go on, since you mentioned it. Committees are helpful
in disseminating information, but that is all they can do.
So, the effective of the deviation on operators.
MR. CUNNINGHAM: Again, this is kind of a detail on how we
developed the deviation scenarios we have here. We look at the effect
on the operators themselves. We look at how these scenarios and things
develop. One of the issues that came up in the subcommittee meeting was
how do we model additional human actions in this. Is it kind of one
human action and then we stop? And the point in this scenario
development work, we kind of take these new scenarios along and include
additional recovery actions and additional actions along the way. So it
is not just one break point in an event tree or something like that, and
going off into -- and then we stop, stop considering other human
actions.
On then to the quantification process. Basically, -- well,
two points. One is, as we discussed in the subcommittee, in some
circumstances, the quantification is not necessarily a requirement of
the analysis, that qualitative analyses can be beneficial in some
circumstances as well. We try in -- we have got an example in the fire
example of how we quantify the information on these scenarios and
quantify the probabilities of the different scenarios. I think we
acknowledge that this is one of the stronger points of ATHEANA at this
point.
The Chapter 10 was discussed I think at length at the
subcommittee meeting and we recognize this is a place where we have got
some work to do yet. But it does bring it back, the point of this is to
bring it back into the context of a PRA, estimate the likelihoods of
core damage given these different types of scenarios that we are going
through.
MR. BLEY: One thing in this area that is on this viewgraph,
there is one area of the quantification that I think we have made a
great stride ahead, and that is recognizing that the human error is not
just a thing that happens randomly out there, that it is set up by both
conditions in the plant and these other performance-shaping factors.
Breaking it apart that way and then quantifying, which we can do
reasonably well, the frequency of the plant conditions that set up this
scenario, and those go beyond what is typically modeled in the PRA,
covers, you know, maybe more than half of the quantification issue.
What is left is, in the cases where that context isn't
terribly strong, we are left with not much help beyond what was already
there. In the cases where that context is very strong, where your
likelihood of error or unsafe action becomes very high, then the fact
that there isn't a real detailed quantification tool may be so important
because we have got ourselves into a spot where most all people looking
at it, and looking at the full context, agree that it is pretty likely
that things will go in the wrong direction.
It is also an area to say, yes, indeed, it is an area that
is not well done, where the group working on it is still playing with
three or four or five different ways to improve it and hasn't, you know,
become of one mind yet, but there is a lot of efforts going on to nail
down that second part of it in a better way.
But I think breaking into those two pieces certainly makes
the second half not as important as it is in standard methods.
DR. APOSTOLAKIS: Two comments. I mean I can't object to
Slide 13, but the truth of the matter is that Chapter 10, as it is now,
does not do these things. It does not try to quantify the context which
was advertised in Chapter 2, but since you agreed that this was going to
be taken of later, that's fine, we don't need to pursue that.
Now, coming back to what Dennis said, I agree that this is,
you know, this is part of what you proposed earlier, I mean the whole
contextual approach, but isn't it true, though, that quantifying the
frequency of plant conditions is easier and, as you say, can be done,
than the probability of the PSFs existing? And I don't know how much of
that you guys have done.
MR. BLEY: Well, half and half on that. Yeah, it has become
the easy part, but on some PSFs, it is, you know, when you talk at the
PSF level, on some of those, given a context, it is one or zero. The
condition is either there at the plant or it is not. And when you are
in the plant, that becomes obvious. So for some of that, it is real
clear and it is not an issue. For the other part, yeah, I agree with
you.
DR. APOSTOLAKIS: Now, the last bullet, Mark, again, I see
what you mean, qualitative evaluations are simplified. But what issue
are we trying to resolve? I mean if I am doing a PRA, am I going to
stop and say, gee, I can't quantify this, but if I call up the people,
they are going to change the way they do business and this is a
non-issue. I mean -- you understand what I am saying?
MR. CUNNINGHAM: No, I am not sure I do.
DR. APOSTOLAKIS: Okay. We said earlier that ATHEANA can be
helpful in actually improving the way things get done at the facility,
right?
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: Without doing any quantification or any
PRA. I mean you can just look at, you know, the front part of your
report. But when I do a PRA, I think we have to be clear, I don't have
that option, do I, of saying, you know, I am going to change things,
therefore, my quantification now will be different. Either I quantify
the way things are, or I don't.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: Unless I am doing a plant-specific PRA
where people have found -- like even the, you know, the U.S. Army found
things and they changed the design. Of course, a PRA has to reflect
that.
MR. BLEY: But there is a point here I think, you have got
-- you are at a plant, you have a PSA, you have an HRA, you haven't yet
tried to do this. Maybe you don't know if you will do all of ATHEANA.
But the issue comes up with your fire protection people that, gee, we
are not sure the way we have got our fire procedure written, and we are
a self-induced station blackout kind of plant, we are not sure that
procedure doesn't have some knots in it that could get us into trouble.
That is an issue that maybe you could go through using ATHEANA, and gain
some qualitative insights from that based on the things you find and the
error mechanisms, the error types you see, that might lead you to be
able to revise that in a way to avoid situations that get the operator
tied in a bit of a knot. So you might -- and that is what this bullet I
think was trying to say.
DR. APOSTOLAKIS: I know.
MR. BLEY: There might be an issue like that for which you
don't need the full power of the PRA, it would be nice to have it, but
if you don't have the full power of the PRA and quantification, you
could still gain some very useful insight.
DR. APOSTOLAKIS: What I am saying, Dennis, is I understand
that, and that is a useful thing to do. What I am saying is I don't
want people to play games in the future -- not you -- if this ever
becomes, you know, practical for the average Joe to use it.
MR. BLEY: I understand.
DR. APOSTOLAKIS: Where he comes back and says the human
unreliability contribution to my PRA is 10 to the minus 100, why is
that? Oh, I applied ATHEANA, everywhere I found a problem, I fixed it.
MR. BLEY: Yeah.
DR. APOSTOLAKIS: I went back, and we are not going to do it
that way, I fixed everything. So let's keep them separate, right.
MR. BLEY: Okay. Certainly, --
DR. APOSTOLAKIS: Now, we are running out of time. So shall
we go to the fire scenario? Although, actually, that is next, right?
MR. CUNNINGHAM: Yes. That's next.
DR. APOSTOLAKIS: Let's go to the fire scenario. Now, this
is quite long.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: So if you can use judgment as we go along.
MR. CUNNINGHAM: Well, we can --
DR. APOSTOLAKIS: Because it is an important thing. I know
that several members are really interested in seeing how ATHEANA
produces here results that are better than other methods. So I really
want to give you all the time you need to do it, but have in mind that,
you know, that time is unlimited.
MR. CUNNINGHAM: Yes. I guess we can do this one of a
couple of ways. One way is to jump right to the quantification and
things and skip kind of the detail. That might --
DR. APOSTOLAKIS: I don't think so. I don't think so.
MR. CUNNINGHAM: I think it might be better to kind of go
through the steps as we have applied it.
DR. APOSTOLAKIS: So why don't you go to 16 and start with
that.
MR. CUNNINGHAM: Okay.
DR. APOSTOLAKIS: These are suggestions, you can disagree if
you want. Say, no, I really want 15. But I am trying to be helpful.
MR. CUNNINGHAM: Thank you.
DR. APOSTOLAKIS: Okay.
MR. CUNNINGHAM: Okay. What we have, about half a dozen
examples of applications of ATHEANA. Four of them I guess are in the
NUREG that you have gotten. There is the Seabrook example that Dennis
has talked about earlier. This is another one that will be published as
a separate document in the next few months.
Basically, for a variety of reasons, we wanted to test out
ATHEANA in the context of a fire scenario. What we chose was a couple
of scenarios in a SISBO plant, where a plant -- this ia plant that, in
certain fire conditions, consciously creates a station blackout in the
plant so that they can get control of the fire and then reintroduce
safely the power that they need in the right places and, in some
respects, reducing the risk of having core damage because of the fire.
So there is a couple of scenarios, and we worked off of an
existing PRA to try to see, well, where would we apply ATHEANA in these
circumstances in a different way, and what do you think -- what will we
get out of it? And what you will see is we got some quantitative
differences and we got some qualitative differences from the base PRA,
if you will. Two scenarios here --
DR. APOSTOLAKIS: Can you tell us about PRA, that was?
MR. CUNNINGHAM: I'm sorry?
DR. APOSTOLAKIS: Can you name the plant and the PRA?
MR. BLEY: I guess, there is a couple of reasons we would
rather not.
DR. APOSTOLAKIS: Okay.
MR. BLEY: You know, we didn't work with the plant. We
don't have any of their inputs. Some of the things, you know, there
might be real plant information. We didn't have all the information on
the plant, we had to make some assumptions based on what we know about
other plants. So it is not truly a plant-specific analysis and the
plant had no input.
DR. APOSTOLAKIS: Would you declare that PRA is a decent
PRA? Was it a good PRA, in your judgment?
MR. BLEY: It was picked because we were advised that it was
one of the better ones on the fire side and with the kinds of issues we
were looking for. In fact, it had a human reliability analysis, which
not all of them have, and that had tried to consider what was going on
in the fire where some of them just use the --
DR. APOSTOLAKIS: But you looked at it, I mean?
MR. BLEY: Oh, we read it entirely, the fire PRA, yeah.
Yeah.
DR. APOSTOLAKIS: And you formed an opinion that it was a
decent state of the art analysis?
MR. BLEY: Yeah, and from the people who have looked at a
number of the fire IPEEEs, it is one of the better ones from what people
told us.
MR. CUNNINGHAM: So we have got two scenarios here
basically. A fire starts in the auxiliary feedwater rooms, or a fire in
a room with 480 volt buses and the remote shutdown panel. We worked
through and tried to identify -- well, next slide. I think we are just,
for the purpose of today, we are going to stick with fire, the first
example, the first starting in the auxiliary feedwater pump room.
Basically, we have got a base case, as we have talked about
before. This is, if you will, the expected or the nominal case of what
will happen when this plant finds a fire in this room. You get a set of
detection, you get alarms going off. You have -- they go to certain
procedures, they have to search for certain things in the procedures,
and what is going on in the plant. Again, this kind of lays out what
they would nominally expect to happen.
DR. POWERS: When you say that the equipment begins
operating erratically, is it equipment or does that include diagnostic
instrumentation?
MR. CUNNINGHAM: It would include that as well, I think.
Absolutely.
DR. POWERS: They usually say it takes a pretty fierce fire
to cause equipment to run erratically, but it doesn't take much of a
fire at all to cause instrumentation.
MR. CUNNINGHAM: Instrumentation, yeah.
DR. POWERS: To be funny.
MR. CUNNINGHAM: That's right. So, basically, in this
context and in the ATHEANA context, we have a human failure event and an
unsafe act. The human failure event, in our terminology, is we are
failing to accomplish heat removal from the core because of this fire,
while dealing with this fire.
There is three unsafe acts that are tied into this set of
scenarios. One is the operators fail to enter the procedures, either
they don't go into the procedures, or they wait too long to go into the
right procedure, such that the fire has, in effect, gotten out of
control before they can cope with it.
The second one was a failure to carry out certain actions in
the procedures. The third was to fail to respond if the scenario goes
down a path that additional failures occur that were unexpected. It
puts the operator in a situation where, for example, equipment that he
expected to be operating is not operating, independent of the fire.
They have just -- the equipment fails.
MR. BLEY: And we did have their actual procedures, there
are three procedures that deal with fires.
MR. CUNNINGHAM: We looked at a set of vulnerabilities here,
operational vulnerabilities. We looked at the training. What in the
training programs could cause them to not respond in the correct way?
What is it about some of the timing of the events that could cause
problems? Again, like, say, is the action postponed because -- or the
action to enter the EOP postponed because of some information they have
gotten or some informal rule that they have and that sort of thing?
Informal rules are the next one, you know, it is going to
be, despite the plant -- you know, the fact that they have EOPs that say
we want you to deenergize, in effect, the whole plant, you would expect
that operators, one, don't do that very often and would be reluctant to
do that. That is a very serious change to the condition of that plant.
So there is probably going to be some reluctance. Again, --
DR. POWERS: I man do you think that -- he has opened up a
procedure. The procedure tells him to deenergize the buses,
MR. BLEY: May I interrupt you there? The procedure doesn't
quite do that, and we have talked -- we didn't talk to this plant, but
we have talked to operators at some other plants and they have pretty
much said we wouldn't do that. What the procedure says, almost
verbatim, is when you decide that you have lost the ability to control
the plant from the control room, then if the plant is in the alternate
zone, go to that procedure. If it is in the dedicated zone, go to that
procedure. When you make that decision, then the next procedure tells
you to deenergize things and it is that first step of deciding, you
know, I have really lost control that is the one that is hard.
DR. POWERS: It is a horribly difficult thing for an
operator to --
MR. BLEY: To give you where you can see the whole plant and
take that little piece of down at the alternate shutdown panel. And
almost every operator we talked to said, you know, you would have to
drag me out of that place. It would be real hard to make that decision.
DR. POWERS: In our serious accident investigation, the last
people in the world who are making, drawing judgments like that are the
people involved in an accident. They always underestimate how big they
are.
MR. CUNNINGHAM: Oh, yeah.
DR. POWERS: I mean it is just a universal.
MR. BLEY: And if you are in the control room and you call
out and say, how long is it going to take you to get that? Oh, five
minutes. I got it, I got it, it is all --
DR. POWERS: I didn't actually believe it until I was -- I
had an accident at one of my facilities and our facility response people
came in and took over. And at that point I could then go around and
assess how bad the accident was. I vastly underestimated how bad it
was.
MR. CUNNINGHAM: So that is exactly the type of thing that
we are concerned about here.
DR. POWERS: I insist it is always, it is foxhole syndrome.
I survived, it can't be too bad.
MR. CUNNINGHAM: The next couple of slides cover deviation
development. We search for a variety of things here, missing
information. This is the type of things that we would look for as try
to investigate these scenarios and this nominal set of events. We have
talked about some of them before, communications, misleading information
that the fire is almost out. You have impacts on equipment that you
hadn't anticipate, that putting out the fire caused other equipment to
fail, that sort of thing. We tried to consider such things.
MR. BLEY: This viewgraph is really dense. When you read
the report and you have seen some of the other examples, this is spread
over several different tables. The first part is what is happening in
the scenario, the others are what is going on in the error mechanisms,
in the error types and all of that is kind of brought together in this
one place emphasizing the ones that appear to be strongest. So there is
this little summary at the bottom is flagging those things that seem to
be the strongest factors affecting this scenario.
DR. APOSTOLAKIS: I am a little bit confused now. I think
we discussed this at the subcommittee meeting. Triggered error
mechanisms include delayed entry. But that seems to me to be an unsafe
act.
MR. BLEY: We agreed with you at the committee that, yeah,
the cataloging wasn't precise here.
DR. APOSTOLAKIS: Okay.
MR. CUNNINGHAM: Development of the scenario here, again, he
have -- the deviation that we are going into here, the alternate
scenario, if you will, is that the detection is delayed and that the
fire brigade has a more difficult time in putting out the fire than they
expected. So you are starting to get away from the nominal performance
of the fire brigade.
You also get into situations like certain pieces of
equipment fail by independent causes that put you into a different type
of sequence.
DR. APOSTOLAKIS: Tom, this is in the previous slide, I
think answered your earlier question. So if you look at the last
paragraph, they are not talking about errors of commission and omission
at that level anymore, they are talking about delayed action,
inappropriate action. It is a very different view of human reliability.
Now, one question that was raised at the subcommittee, and
you agree, was that you make such a big deal about context, and then you
present an example and you don't identify the context.
MR. CUNNINGHAM: Yeah.
DR. APOSTOLAKIS: You identify all the deviations but not
the context. Now, maybe -- this is a lesson here that maybe the idea of
concept is good conceptually, but practically, now, how do you identify
the context? You take all these deviations and create all possible
combinations? I mean you have how many contexts that way?
MR. BLEY: We will never, I think I can say -- I don't like
to say never. We will never come up with an algorithm for taking six
error mechanisms and two error types and, you know, depending on what
they are, picking numbers out of a table and multiplying them all
together.
DR. APOSTOLAKIS: Sure.
MR. BLEY: What we hope to do and what that last slide did
down at the bottom was to summarize the key elements of context so you
can see it in one gestalt and you can evaluate it all at once. Now,
right now, it has been done at a judgment level, looking at that and
saying, given all of this context, what is the likelihood? We have been
playing with a number of methods, variants on SLIM, building, you know,
some kind of reference set that covers a wide range of these, but trying
to get those organized so you can make sense of them has been difficult,
and we are still working at that.
But, yeah, I think it will always be, though, in this kind
of -- the context as a full set, trying to look at that against other
types.
DR. APOSTOLAKIS: Why wasn't the context identified in the
scenario?
MR. BLEY: In the presentation. Well, part of it was
identified on that slide, you know, we thought those summaries at the
bottom covered a great deal of it. But you make a good point. We have
gone back and talked, and in our final slide where we compared things,
you know, I think we were colored by what we knew, and reading things
into it that somebody not having that same background would read very
differently. And when we went back and looked, we said, yeah, I see how
you can read things that way. We are working on that even as we speak
here, trying to make that clearer in the presentation.
DR. APOSTOLAKIS: But it would be nice, I mean, that is all.
MR. BLEY: We thought we had done it, but, clearly, we
didn't do it.
DR. APOSTOLAKIS: Define the context. And, of course, these
contexts now are going to share a lot of elements, right?
MR. BLEY: Yes.
DR. APOSTOLAKIS: So in the quantification, you have to be
careful to account for those.
MR. CUNNINGHAM: I am going to skip to 23 I think, the
others don't add very much here.
DR. APOSTOLAKIS: Now, 22, just quickly.
MR. CUNNINGHAM: Going back to 22.
DR. APOSTOLAKIS: Yes. Is that something that ATHEANA had
anything to do with?
MR. BLEY: The idea of an event tree, certainly not. This
event tree was constructed, given what we had seen in that scenario, to
lay it out in a way, and organize it in a way, as part of ATHEANA, so we
could look at where the human accidents were we wanted to consider and
how the context might change as different things happened in the plant.
So it was laid out to be a tool to help carry out the ATHEANA analysis.
DR. APOSTOLAKIS: Okay.
DR. POWERS: I just hate these things. The second question
is, fire does not jump separation, so the answer is, yes, it did not
jump --
MR. BLEY: Me, too, I used to do it other way, and then we
--
DR. APOSTOLAKIS: That means the event is true. But my
question --
MR. BLEY: We can work on the word to make that clearer. In
fact, if we wrote words on each branch, maybe that is the way to do it,
instead of the logician's.
DR. APOSTOLAKIS: I set up the context of my question, now,
I have to go to the question. The context was, yes, you guys developed
this. Did the baseline PRA that you used have anything like this?
MR. BLEY: Oh, boy.
DR. APOSTOLAKIS: I mean I am trying to see --
MR. BLEY: I don't think so, but I can't say for sure
because --
DR. APOSTOLAKIS: Wait a minute. John, don't say no,
because when people develop scenarios, you know, they don't necessarily
have to put it in the form of a tree, of course, but in the text. They
may have had --
MR. BLEY: They had an event tree for this scenario. It
had, if I remember correctly, it had more plant things on it and fewer
of the kinds of groupings we made here, where we are trying to focus on
the ATHEANA question. So they didn't have a real one developed just for
the human reliability.
DR. APOSTOLAKIS: But, for example, if we look there,
recovery, non-recovery UA3 and so on, I mean isn't there something
similar that they worried about, or they missed it completely?
MR. BLEY: Something similar that they worried about, could
they recover?
DR. APOSTOLAKIS: There was something similar they worried
about.
MR. BLEY: Well, actually, on this one, no. When they
didn't make the move to the control room, that was it. They just quit,
that was the end of it. That was failure.
DR. APOSTOLAKIS: I think, the reason why I am asking these
questions is because later on, or at least last time you made the
comparison between the previous study.
MR. CUNNINGHAM: Yes.
DR. APOSTOLAKIS: If you could come here and say, look,
these guys, using their own methods, missed these major issues, then
that would go a long way towards convincing people that, yes, ATHEANA
develops. If you say, well, you know, there were some differences, all
that this says is that they did a good job, too.
MR. BLEY: Okay. Yes.
DR. APOSTOLAKIS: That's fine, too. But I think this is
critical because I know that the application is the yardstick that a lot
of the members are using to decide whether ATHEANA is worthwhile.
MR. BLEY: If they had done this tree, given the way they
did the analysis, it ended after the first branch.
DR. APOSTOLAKIS: After the first branch.
MR. BLEY: Yeah.
DR. APOSTOLAKIS: What do you mean?
MR. BLEY: Well, that is not quite true.
DR. APOSTOLAKIS: Can you show on the transparency what --
MR. BLEY: No, I can't say that, that is not right. That is
not a good answer to you.
DR. APOSTOLAKIS: I suspect that you have this --
MR. BLEY: But they had nothing near this kind of thinking.
If you look at our other examples in the NUREG, you will find that we
did not do these in all of the examples, although we have got the
arguments written out in words. We would include a drawing like this I
think now, just because it clarifies for us what is going on, and maybe
if we put the wording on it in a more conversational, it would other
people looking at it, too, to see what is happening.
DR. APOSTOLAKIS: But, anyway, you understand my, the spirit
of my comment.
MR. BLEY: Yes.
MR. CUNNINGHAM: Certainly.
DR. APOSTOLAKIS: I mean what we would like to see in the
future perhaps is, when you talk about differences and improvements,
what kind of differences? They are missing major sequences or you are
just stating certain things in a big way, or a little better? What is
it that we are achieving? And you don't always have to prove that the
other guys were wrong.
MR. CUNNINGHAM: Yes, that's right.
DR. APOSTOLAKIS: There are good people out there who are
doing good work without ATHEANA.
MR. CUNNINGHAM: Part of the way we are trying to run the
ATHEANA program is to do a series of demonstrations and part of what --
some of those demonstrations you will find, well, you don't learn much
more than what you did from the beginning. But you are going to find
both. And the question is --
You know, Mark, that exercise also may help you when you go
back to the original comment of identifying situations where a simpler
analysis might be more appropriate than other one. Exactly.
DR. APOSTOLAKIS: And have a graded approach.
MR. CUNNINGHAM: That's right. The demonstration --
DR. APOSTOLAKIS: These kinds of exercises help with that.
MR. CUNNINGHAM: Yeah, they help you find where you should
apply it and help you find where you shouldn't apply it.
DR. APOSTOLAKIS: Exactly.
MR. CUNNINGHAM: And we are kind of feeling our way through
that right now.
DR. APOSTOLAKIS: You do the whole thing and then you say,
gee, they found it, too, 95 percent they found the same thing, so maybe
this belongs to a different category.
MR. BLEY: In one way, just on the detail, they did a more
conservative analysis in one sense. Where we had the fire -- they did
some of each.
DR. APOSTOLAKIS: Can you use the transparency, Dennis,
because we can follow when you point to your own figure. Or on the
projector if you want.
MR. BLEY: Well, I am having trouble, I forgot my reading
glasses.
DR. APOSTOLAKIS: Oh, I am sorry. Is the court reporter
following that?
MR. BLEY: Fire. That is what I was trying to do. Fire
does not jump separation and affects both. They didn't consider that,
so that is a non-conservatism.
Good equipment works, they ran it through their PRA model,
so that was in there.
Operators try recovery. Here, if the good equipment does
not work, they did not try recovery on the opposite train, you know, the
train that has been isolated, where we have said, well, if the stuff
that you have set up to use dedicated equipment fails, you have got to
go back and not keep everything isolated and use the other equipment.
So they didn't look at that. So there is a little bit of both in there.
I believe ours is a little more realistic in trying to cover
what they did, but it has simplifications, too.
DR. APOSTOLAKIS: Right.
MR. CUNNINGHAM: I am going to slip over to Slide 24 which
was in the subcommittee. This is one we discussed I think at some
length in the subcommittee meeting. This gets into the question of,
well, is there something -- you know, given the old method and given the
new method, is there some profound difference? I don't know that there
is anything in here that is profound.
MR. BLEY: Well, yeah, I think there is a little bit, and
this slide doesn't show it very well.
DR. APOSTOLAKIS: We are a little bit profound, or there is
a little bit there that is profound?
MR. BLEY: There is a little bit that is profound, and it is
really hard to see here. This slide is the one where I said, you know,
we knew what was going on and it talked to us, but I don't think it
talks to anyone else.
In the old analysis, it was kind of cut and dried, things
worked or didn't, and not much reason why. In the ATHEANA analysis,
there is a lot of the reasons why things don't work. And when you get
down to the final questions of the human actions, the probability of
them, in their analysis, the probability of error was quite low. In
ours, given the context, it was very high. If you got yourself all the
way into this situation, boy, you wouldn't -- it is very unlikely you
would make the, quote, "right" choice.
So the conclusions were kind of different. And at a deeper
level, there was much more understanding, explanation of why these
events happen. So if you wanted to do something about it, you would
have a basis for thinking about what you could do either in training or
guidelines, or some kind of backup preparation to help people deal with
the situation. So, if you think risk management, there was very little
in the original analysis. There was quite a bit of basis for doing it
in the ATHEANA analysis. So we think those are really different.
DR. POWERS: They are different, but don't you have to at
some point make a decision on which one is right?
MR. BLEY: Do you want to? Yeah, I think the ATHEANA
analysis is realistic and gives you information at a level that you
could do something about it. The other one, you know, if you are
talking the number, the total number isn't all that different. So from
that point of view, gee, they are the same. But if you talk about what
you learn, about what the problems are, and what you could do about it,
I think there is that kind of information in the ATHEANA analysis, and
there is a void of it in the more standard analysis of this thing.
You know, they also focus that, you know, not carrying out
-- getting out of the control room is a contribution, but they don't
talk about why at all. What are the reasons people wouldn't leave the
control room? What else might be happening that could cause them later
troubles if they delay a long time in getting out of the control room?
None of that has any light shined on it by the other analysis and that
is exactly where the light shines from the ATHEANA analysis.
DR. APOSTOLAKIS: But, again, though, in all fairness to
them, maybe they are just doing a PRA and they were not thinking in
terms of, you know, why and try to fix things. But as you guys have got
this dual track here, so we have to be a little bit --
MR. BLEY: Absolutely. We are not saying that analysis is
no good. Given the reasons they did it, if you look at the guidance for
doing a fire IPEEE, there was very little on what to do with human
reliability. In the EPRI guidance, there was a little, but not much.
DR. APOSTOLAKIS: Yes.
MR. BLEY: And there was not much focus on it in the review.
So, yeah, they may have done quite well for what they were doing. And I
will offer one other, there is a report that struck me a lot by Alan
Swain a few years ago, where Alan did a summary of HRA methods for the
Germans. You probably have it, George, a little green book. In the
back -- he did five or six methods. In the back of that book, the
contacted the authors of those various methods and said, please comment
on your own method and the others.
When I first read their comments, I thought them
disingenuous. What the comments essentially said was my method will
solve all the problems, the other four methods won't. And all of them
were of this mind. When I am more fair about that, they were probably
honest answers, because within one of those methods, especially if it is
mine and I know how it works, I can include lots of things that I don't
tell you how to do in the documentation. I can consider lots of things
that aren't there, and I can convince myself I have done a pretty good
job. And I think that was probably true for all of those methods.
I think in ATHEANA the method is telling you you have got to
consider those things, so it is wiring it in. And certainly some of the
things we think are important, some people have picked up in their own
analyses, but there is no formalism to ensure that the third party user
has a chance of picking up that kind of information.
I am sure Alan Swain does a bang-up job when he considers
these things, and he considers a lot that others don't. And if you go
back to his THERP manual, if you read that whole manual, there is a lot
of information in there that very few practitioners use, and he probably
does.
DR. APOSTOLAKIS: For the members who are not familiar with
it, Alan Swain was the guy who developed THERP and the human
reliability. An engineering psychologist who has retired now for a
number of years, but is one of the most familiar names in the HRA
business.
MR. BLEY: And according to Norm Rasmussen, at the time he
was the only one willing to take a shot at this back when WASH-1400 was
done.
DR. APOSTOLAKIS: Well, yeah, Alan is a pioneer, clearly, a
pioneer.
What else do you want to tell us, Mark?
MR. CUNNINGHAM: I want to go to the last slide, if I could.
DR. APOSTOLAKIS: Twenty-what? Seven.
MR. CUNNINGHAM: Twenty-seven. Basically, a couple of
points. One if we have talked here and at the subcommittee meeting
about some of the strengths of ATHEANA. We think it is taking a step
forward with ATHEANA by bringing operations and the context of events
and situations in plants, together with human performance, I think that
is a step forward. We think that trying to work on the systematic
searches for identifying places where they can go wrong and wrong with
bad consequences is a step forward.
Given that, there are some things we still need to do. The
parts that we still need to work on are quantification, the Chapter 10,
if you will, in shorthand. We also need to better define how -- the
role of ATHEANA in the context of a PRA and HRA. That is --
DR. APOSTOLAKIS: Would you be surprised if someone told me
that you should do this in the next three months and forget about
everything else?
MR. CUNNINGHAM: Would I be surprised if --
DR. APOSTOLAKIS: Or disappointed?
MR. CUNNINGHAM: I'm sorry, I didn't understand.
DR. APOSTOLAKIS: What you just mentioned, you didn't use
the word "screening," but that is where you where.
MR. CUNNINGHAM: That is where I was.
DR. APOSTOLAKIS: Identify the role of ATHEANA in the bigger
scheme of things, of quantifying and analyzing human reliability, human
acts. Isn't that something that you guys ought to be doing in the next
four, five months, and make sure that it is done well and start your
future presentations with that?
MR. CUNNINGHAM: I think that would be good advice, yes.
DR. APOSTOLAKIS: That would be good -- it would not. Okay.
MR. CUNNINGHAM: I wouldn't discount it, I think that is an
important aspect of it.
DR. APOSTOLAKIS: So I wonder who might give you that
advice?
MR. CUNNINGHAM: I don't know who would be around to give
advice on these things, but, at any rate.
MR. BARTON: Maybe we ought to write a letter.
DR. APOSTOLAKIS: Do you think?
DR. WALLIS: I have a question and Mark has been waiting a
long time. When we do sort of physical and modeling, we always try to
validate what we have done so it is not a fantasy, but it is somehow
tied to data and experience in a quantitative way. Is there some way to
validate so that this then becomes believable as something you can rely
on, not just someone's imaginative way of approaching a problem? Are
there steps you can take to really get confidence in the methods?
MR. CUNNINGHAM: I think you can deal with it, at a high
level, we want to continue and we are continuing to look at what we call
real world accidents in complex technologies. We didn't talk about
here, but we have a program.
DR. WALLIS: Not just nuclear?
MR. CUNNINGHAM: Not just nuclear. Complex technologies.
Because there are just not many serious accidents in nuclear plants, so
we look at the aircraft industry and the chemical industry, and that
sort of thing to look for accidents, one, that are well documented, to
be able to -- so we can understand the human aspects of those accidents.
NTSB is a good source for that type of thing. We try to collect that
information and see how well the concept, the model, if you will, in
ATHEANA matches with what is going on.
That is going to be a continuing, I hate to use the word
"validation," but I think it will be that. I think there is also a
lower level or more detailed level. Again, do the types of scenarios we
develop make sense to the people? Are they reasonably intuitive? I am
not sure I would call that validation. But, fundamentally, I think we
have to continue to look at real accidents and complex technologies.
DR. APOSTOLAKIS: Did you want to sa something, Dennis?
MR. BLEY: One other, it is related to the ones Mark said.
But I would say if this method is generating scenarios that, when
operators see them, they say, yeah, that is a troublesome scenario, we
think that, to that extent, is verification. And, in fact, the scenario
that the Seabrook folks developed, they decided to run on all their
crews, so they must have found it somewhat interesting.
DR. WALLIS: So you would look at, say, mixing up British
and European units in a Mars lander, would that come out of ATHEANA?
MR. BLEY: You bet.
[Laughter.]
DR. APOSTOLAKIS: Any other comments you would like to make,
Mark or Dennis? Or is this the end of the presentation?
MR. CUNNINGHAM: That is the end of the presentations.
DR. APOSTOLAKIS: Any comments or questions from the
members?
DR. POWERS: I just wondered if there wasn't some indication
that what came out of the peer review that you had on ATHEANA, and did
you learn anything from that, or was that just a pain in the neck to do?
You did invite a cast of luminaries, fairly impressive.
MR. CUNNINGHAM: We had a peer review, yes, and there were
--
DR. POWERS: You invited a cast of people that I thought
were luminaries in the field.
MR. CUNNINGHAM: Okay. And, yes, we left that out of this
presentation today. We included it in the subcommittee. I don't think
we -- I don't remember, I don't think we discussed it at the
subcommittee, but we discussed --
DR. APOSTOLAKIS: Yeah, perhaps it was unfair to you, but
they do have the transparencies.
MR. CUNNINGHAM: That's right. And I think it is fair to
say that the peer review we received I think was very constructive, and
it led us, the version of ATHEANA that we have today, I think has been
significantly impacted by it.
DR. APOSTOLAKIS: I am curious now, since Dana raised the
point, I read those four reviews and if there is one issue where they
all agreed, because one of them was engineer, the other three were --
MR. BLEY: Two were engineers.
DR. APOSTOLAKIS: Two. Who was the second one?
MR. BLEY: Carlo is an engineer, believe it or not, and if
you read his new book, it has got more engineering than psychology in
it.
DR. APOSTOLAKIS: Carlo is an engineer. So there were two
engineers and two psychologists, although Carlo tends to be more on the
psychology side. They all agree that this approach is too complex. And
as I recall, at the end there were people from France and Germany and so
on who also made that comment. Now, the review took place when, in June
or May of '98?
MR. CUNNINGHAM: Ninety-eight.
MR. BLEY: Yes, that's right.
DR. APOSTOLAKIS: And, yet, your new report does not show --
MR. BLEY: Can I address that?
DR. APOSTOLAKIS: Sure.
MR. BLEY: Somehow, to us, you missed it. In fact that was
one of the driving forces. And when you say complex, the problem with
the old approach that we took to Seabrook, and they used, was that there
were two things that were difficult about it. And one was it was a very
tedious, slow process. It took many, many days of these people working
together to get to a scenario, and once you had defined the plant
conditions, the way you used the material from the psychologist and the
behavioral sciences, the error mechanisms, the error types, was, in
fact, quite vague. We gave lots of example and said, think about that
and use it.
Okay. The new process with these four searches, especially
the first two, cuts through a lot of that time we spent. And, in fact,
what Alan Kolazkoski and myself, who are the ones who worked primarily
on the examples, found was where it took lots of just playing with these
things to get scenarios before, you go right to them with this search
process.
When you read our examples, they are very long because we
were driven by the comments from Carlo Cacciabui, who said I am worried
about the fellow who doesn't have you here, and we tried to put in the
thinking. So it is more a narrative, I am thinking about this and that.
If you wrote just a production analysis, it would be much shorter. And
you get through those pretty quickly, in fact, very quickly. The
Seabrook scenario falls out almost for free, originally, and we have now
tables that, given you get that first deviation scenario set up, the
tables guide you through how to use the material from the behavioral
sciences.
So even though it is a thick book, I think -- my belief,
having used it, is it takes 10 percent of the time it used to take to go
through it. It is much more efficient. We have not had a third party
try it yet. No, we haven't, we have not had a third party try it yet.
DR. APOSTOLAKIS: No, but you -- I guess there are two
issues related to complexity. You are addressing the issue of the
ATHEANA approach itself being complex and reducing complexity.
MR. BARTON: Right.
MR. BLEY: And difficult to do. Yeah, that is the one we
addressed.
DR. APOSTOLAKIS: And you interpreted the reviewers'
comments as addressing that issue, and properly so.
MR. BLEY: We did.
DR. APOSTOLAKIS: You did. This committee is raising an
additional concern which is what Mark very properly stated earlier, what
should be the role of ATHEANA-like approach in the bigger scheme of
things?
MR. BARTON: Right.
DR. APOSTOLAKIS: So there are two different kinds. And I
think you were responsive, I agree, to the comments from the reviewers
when it came to the process itself. But I believe, what was his name,
Stuart?
MR. BLEY: Stuart Lewis.
DR. APOSTOLAKIS: Stuart Lewis raised the issues that come
closer to the concerns of this committee. I mean he used words like the
plant people, are they going to use this?
MR. BARTON: Right.
DR. APOSTOLAKIS: So I believe there is more work to be done
in that area. Perhaps the other, too.
MR. BLEY: We won't disagree, but we will say the issue of
setting priorities is spelled out for us. It must not have come across,
we will have to work on that in the early chapters. And the approach of
using it on issues we think is one of the first steps to getting it
useful in a plant that isn't ready to go out and say I am going to apply
this across the board.
DR. APOSTOLAKIS: Let me give an opportunity to other
members. John, do you want to say anything today?
MR. BARTON: No, I continue to try to understand ATHEANA and
how it can be, you know, applied at the plants, and what is the benefit
going to be without -- you know, people have got to see a real benefit
before they go use this. It has to be a lot better than the process
they are now using.
DR. APOSTOLAKIS: Okay. Mario.
DR. BONACA: No, I just appreciated the example provided,
gained some better insights. Certainly, I am trying to understand how
much internal analysis it should get going through your event tree, how
much of that is going to the results.
DR. APOSTOLAKIS: Okay. Jack, do you have any comments,
because you were pretty vocal last night?
MR. SIEBER: Yeah, I have none beyond that except that I
thought the presentation helped clear up a few points in my own mind, so
I appreciate that.
MR. BARTON: You guys are getting better, Mark. A couple of
more times and you will --
DR. APOSTOLAKIS: I must say I was very impressed that Mark
decided to carry the whole load today. It doesn't happen too often
here.
MR. BARTON: Well, he is a manager, not a worker.
DR. APOSTOLAKIS: You don't have to comment unless you say
thank you.
MR. CUNNINGHAM: Thank you.
[Laughter.]
DR. APOSTOLAKIS: Graham. You don't have to speak out, I
mean we are just coming back to -- it is up to you.
DR. WALLIS: You are not letting me get on with the next
topic, you want me to comment on this one? I have no comments. Thank
you very much.
DR. APOSTOLAKIS: Okay. Bob.
DR. SEALE: No, thank you.
DR. APOSTOLAKIS: Okay. Back to you, Mr. Chairman.
DR. POWERS: Okay. I think at this point we can close off
the transcription.
[Whereupon, at 12:00 p.m., the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016
Page Last Reviewed/Updated Tuesday, July 12, 2016