468th Meeting - December 3, 1999

                       UNITED STATES OF AMERICA
                        Nuclear Regulatory Commission
                        Conference Room 2B3
                        Two White Flint North
                        11545 Rockville Pike
                        Rockville, Maryland
                                           Friday, December 3, 1999
         The Committee met, pursuant to notice, at 8:30 a.m.
         DANA A. POWERS, Chairman
         GEORGE APOSTOLAKIS, Vice Chairman
         THOMAS S. KRESS, ACRS Member
         GRAHAM B. WALLIS, ACRS Member
         ROBERT L. SEALE, ACRS Member
         JOHN D. SIEBER, ACRS Member
         MARIO V. BONACA, ACRS Member
         JOHN J. BARTON, ACRS Member
         ROBERT E. UHRIG, ACRS Member
         WILLIAM J. SHACK, ACRS Member
                         P R O C E E D I N G S
                                                      [8:30 a.m.]
         DR. POWERS:  The meeting will now come to order.  This is
     the second day of the 468th meeting of the Advisory Committee on Reactor
     Safeguards.  During today's meeting, the committee will consider one of
     my favorite subjects, fatigue, and the proposed resolution of Generic
     Safety Issue 190 and 166.  We also look at a technique for human event
     analysis, the ATHEANA.  We will have a report from the Thermal-Hydraulic
     Phenomena Subcommittee.
         Our attentions then will be looking at the report on the NRC
     Safety Research Program.  We do intend to elect officers during this
     day's meeting, and we will be looking at our other reports.
         The meeting is being conducted in accordance with the
     provisions of the Federal Advisory Committee Act.  Mr. Sam Duraiswamy is
     the Designated Federal Official for the initial portion of the meeting.
         We have received no written statements or requests for time
     to make oral statements from members of the public regarding today's
     session.  A transcript of portions of the meeting is being kept and it
     is requested that the speakers use one of the microphones, identify
     themselves, and speak with sufficient clarity and volume so they can be
     readily heard.
         A point of interest, there is a get well card being
     circulated around for Jay Carroll, and the members will recall that we
     will be taking a lengthy lunch break today to celebrate the season's
         I now ask if there are any opening comments other members
     would care to make.
         [No response.]
         DR. POWERS:  Not seeing any, then I will move to the agenda
     items.  Our first agenda is, I say, one of my favorite topics, fatigue. 
     Fatigue, the people that have been working on it.  Bob, I guess you are
     going to take us through this.
         DR. SEALE:  Yes.  Yes, Mr. Chairman.  Actually, this is a
     trifecta on this particular one, because there is GSI-78, which is
     "Monitoring of Fatigue Transient Limits for Reactor Coolant Systems,"
     GSI-166, "Adequacy of Fatigue Life of Metal Components," and GSI-190,
     which -- on "Fatigue Evaluation of Metal Components for the 60-Year
     Plant Life."
         This is an issue, a GSI that has been hanging out there for
     quite a while.  I think the last time the ACRS really went into any of
     this in detail was back in about '96, and at that time one of the
     recommendations of the committee was that the work that had been done up
     to that point on 78 and 166 for the 40-year plant life be extended to
     cover the environmental effects of fatigue on pressure boundary
     components for 60 years of plant operation.
         That has been, of course, the thrust of 190 and the staff is
     here now to report on that to us.  There are several things I would like
     to call to the attention of the members and to the presenters, because
     they are things I think we want to be aware of and be sure that we
         For the members, I would urge you to take note that the
     environmental effects are extremely important in this particular issue. 
     Crack frequency goes up with extended lifetime.  I think we have here a
     very real example of an age-dependent phenomenon that will influence the
     operation of these systems.
         The staff position, and I want them to try to bring this out
     as clearly as we can get it, is that, while the frequency of cracks go
     up, a management program should address monitoring those cases such that
     you continue to control the amount of leakage, the total leakage that
     you get from the system.  And I point out to you that the consequences
     of enhanced leakage, if that is the consequence of enhanced crack
     frequency, is a contamination problem which has all kinds of ugly
     consequences on the competence of maintenance, ALARA considerations, and
     the cost of maintenance for the plant.
         I would also appreciate some comments from the staff on the
     effect of these increased crack frequencies on catastrophic failure
     probabilities, because that is still a problem that you worry about in
     some cases.
         And, finally, I think this is an example of a case where the
     research activities of the Commission have been an example of an on-time
     product which is, in fact, having a significant impact on the response
     to the life extension requests that are coming from -- that we are
     beginning to process.
         Dr. Bonaca, yesterday, as we went over the letter on the
     Baltimore Gas & Electric application for Seabrook -- I mean for Calvert
     Cliffs, pointed out that there were some considerations of these fatigue
     effects that were in their aging management program.  This is, if you
     will, an on-time product as it so happens.
         I think we probably ought to try to make note of this in any
     communication we have to the Commission because we have perhaps been
     remiss in the past in highlighting those cases where the research has
     made a direct impact, contribution on what is going on.
         DR. POWERS:  That is a good thought, Bob.
         DR. SEALE:  So, with those pleas and highlights and so on, I
     am going to turn it over to Mike Mayfield, and let's go from there.
         MR. MAYFIELD:  Thank you, Dr. Seale.
         DR. POWERS:  I wonder if I could ask a couple of open
     questions as topics maybe you can touch on as the presentations go
     through.  I wonder if you would give us some idea of where the state of
     the art, the technical community lies relative to the resolution of this
     issue.  I ask the question because I see lots of new books coming out on
     issues of fatigue now, and I wonder where we stand with it as a nuclear
     community within the state of the art of the larger materials community
     on fatigue issues.
         And the other question that has always perplexed me a little
     bit on this is that fatigue tests are done by cycling specimens in an
     apparatus, in an environment, at some frequency, and oftentimes that
     frequency is an important issue, whereas, the fatiguing of actual
     components in a plant doesn't go through regular cycles.  There is a
     transient, then a hold, then a transient, then a hold.  They look rather
     different than the testing.  And why is it we have any confidence in the
     testing process as being indicative of what goes on in the materials of
         MR. MAYFIELD:  We will try and pick up on both of those
         DR. POWERS:  To the extent you can tutor me a little on
     these, I would appreciate it.
         MR. MAYFIELD:  I am Mike Mayfield from the Division of
     Engineering Technology.  We appreciate the opportunity to come to the
     committee today and present to you our rationale and basis for the
     proposed closure of Generic Safety Issue 190.  I have with me today
     Chris Grimes from the License Renewal Group, -- I don't quite remember
     the name of his new organization -- and Jack Strosnider, who is the
     Director of the Division of Engineering in NRR.
         DR. POWERS:  Chris is spending enough time down here, we are
     thinking of giving him an office.
         MR. MAYFIELD:  The presentation this morning will be made by
     Ed Hackett from the Materials Engineering Branch in the Division of
     Engineering Technology.  He is going to talk -- touch on the basis for
     closing GSI-190, and then give you a look at the integrating plan for
     handling fatigue issues which go beyond GSI-190.  And then Chris will
     have some observations on the impact on license renewal.  And along the
     way, we will try and pick up the points that both Dr. Seale and Dr.
     Powers have raised.
         So with that, Ed.
         MR. HACKETT:  Thanks, Mike.  I will start by saying good
     morning, and I will apologize in advance for the voice.
         DR. UHRIG:  Microphone.
         MR. HACKETT:  How is that working?  Can everyone hear okay? 
     Does everyone also have a copy of the handouts?  So they have made it
         Again, I was going to start by apologizing for the voice, I
     have gotten another one of these annual sinus infections, I have got a
     good nasal quality going here.
         I think I can also start by saying I have got a good deal
     less history with this particular issue than a lot of my colleagues in
     the room, but I think, hopefully, between myself and the experts we have
     arrayed here, including Dr. Simonen from the Pacific Northwest National
     Lab, and the benefit of having Dr. Shack here, of course, whose work was
     key to a lot of this issue, we should be able to answer any questions, I
         Dr. Seale did such a good job of summarizing this, I may be
     able to skip a lot of the background.  But at any rate, the objective is
     obvious, to present the closure, actually, of GSI-190, which is "Fatigue
     Evaluation of Metal Components for 60-Year Plant Life," and Dr. Seale
     mentioned the importance of the environmental influence, which hadn't
     been explicitly addressed prior to this.  So those are the two key
     components extending to the license renewal term and the environment
     effect, and, obviously, to seek your endorsement for closure of the
         In terms of some of the background, I think a lot of this is
     pretty widely known.  But the ASME Boiler and Pressure Vessel Code,
     Section III, has had design fatigue curves for many years, that the
     design of the plants were based on from quite a ways back now.  They
     were based specifically on fir environment tests.  There were safety
     factors built into those to account for a variety of things, including
     what they hoped at any rate at the time would be the environment,
     surface finish, geometry effects with the specimens and other factors.
         However, recent, and I guess you could put "recent" in
     quotes, we have known this for quite some time, recent fatigue strain
     versus life data indicate a very significant effect to the coolant
     environment on fatigue crack initiation in nuclear plant materials.
         And I am not sure this curve exactly shows that, but I can
     try and walk you through it, in terms of a standard S-N type approach,
     stress versus number of cycles type fatigue.  What is not shown on here
     is that the air curve would be off way up here somewhere.  And as I
     said, for the ASME design approach, what was done is they took the air
     curve and they adjusted that down by a factor of 2 on stress or 20 on
     cycles, and that curve is what you see here in terms of the dotted line.
         What you do see here, though, is this is an example of some
     of the work that came out of Argonne National Lab.  This is a carbon
     steel in water at PWR type conditions, 550F with a low strain rate, high
     oxygen content.  The median curve for the water for the environment is
     actually down here.  So now you have come basically from off the chart
     down to here, pretty close to this ASME design curve.  And then you can
     see, as you start getting down here to these curves that are 10, 1
     percent, you are about there, you have about chewed up your margin.
         DR. WALLIS:  I don't understand your off the chart bit.  A
     factor of 2 on stress is not very much in that picture.
         MR. HACKETT:  Yeah, it is either 2 on stress or 20 on
     cycles, so it would be --
         DR. WALLIS:  Which is not much either.
         MR. HACKETT:  It would be off the chart, but not much off
     the chart.  We just didn't show it.
         DR. WALLIS:  It doesn't make sese.
         DR. SHACK:  No, no, he is talking about the air curve.  This
     is in water.  It is a factor of 50 to 100, depending on which --
         DR. POWERS:  You are going to have to be careful, because
     error and a-i-r, air, are too easily confused and what is off the curve
     -- chart here is cycling a sample --
         MR. HACKETT:  In air, laboratory --
         DR. POWERS:  -- in an atmosphere like that we breathe.
         MR. HACKETT:  Exactly.  Exactly.  And this one is now coming
     down to -- now you are picking up the LWR environment, so that is what
     is going on.
         DR. POWERS:  And, again, a factor of 2 on stress and a
     factor of 20 on cycles on a log-log plot like this is not going to be
     readily visible, is it?  I mean that is the question.
         DR. WALLIS:  It certainly doesn't pull something that is off
     the chart onto the chart like that.
         DR. POWERS:  That's right.
         DR. APOSTOLAKIS:  But can we -- could you explain to me how
     I should read this figure?  How do I enter, I enter with a stress sample
         MR. HACKETT:  Yeah, the basic --
         DR. APOSTOLAKIS:  Let's say, 100, okay.
         MR. HACKETT:  Basically, what you are doing, if you are
     looking at tests like this, which this is obviously generated from a lot
     of test data, you are going to be cycling, and this gets back also to
     one of Dr. Powers questions, you are going to be cycling at a constant
     stress amplitude.  Basically, a lot of these tests are done either in
     axial or in rotating type fashion.  And then you are going to look for
     cycles to crack initiation.  And, usually, what you are going to be
     looking at there in the specimen is some type of load drop and increase
     in the compliance of the specimen.  So at that point you have got some
     kind of an engineering crack going on in the specimen, but don't have
     two pieces.
         DR. APOSTOLAKIS:  So if I draw a horizontal line at 100, I
     hit a bunch of curves there.
         MR. HACKETT:  Right.
         DR. APOSTOLAKIS:  So I can find a 90 percent interval within
     which the cycles for crack initiation will be.  Now, why am I uncertain?
         MR. HACKETT:  A whole lot of reasons, but, basically, what
     you are going to be seeing, especially in the environment, and I guess
     we wanted to get into some elaboration on this.  One of the big
     influences of the LWR environment is to cause like a micro-pitting on
     the surface fatigue.  As most of you probably know, it is very sensitive
     to surface conditions.  That will exist to a variety of degrees,
     depending on the material type, the temperature, dissolved oxygen
     content, other factors that relate to the environment.  So you have got
     an enormous range of scatter just due to those types of things.
         DR. APOSTOLAKIS:  If you knew the environment, you wouldn't
     have this.
         MR. HACKETT:  No, that is not true either, because then you
     are going to get into, also, other ones I didn't mention, the surface
     preparation of the specimens, geometry effects, things like that.  And
     the process itself is inherently scattered metallurgically.  That
     underlies the whole thing, and then you add scatter on with these other
     factors would be the way I would explain it.
         Well, that moves us on from that one.  Again, Dr. Seale gave
     us the background.  This is just a perspective.  We are going to be
     coming from the perspective of having previously visited this issue in
     two other GSIs, 78 and 166.  This was for the 40-year lifetime.  In both
     cases, the risk from fatigue failures, in the case of 78, was evaluated
     using the PC-PRAISE code, I will come again to pc-PRAISE as we go
     through this presentation, because we also used it for GSI-190.
         Basically, the risk was low, and the ACRS wrote a letter, I
     think it was Dr. Kress wrote a letter in 1996, basically agreeing with
     the outcome.  GSI-166 also basically working in tandem with John Fair's
     fatigue action plan, evaluated adequacy of fatigue life of selected
     metal components, in I believe it was seven plants, and there was no
     significant safety concern that was identified that licensing basis
     fatigue criteria were exceeded.  Both issues were resolved.
         DR. WALLIS:  Excuse me.  You showed us this curve, this S-N
         MR. HACKETT:  Yes.
         DR. WALLIS:  For some purpose.  Okay.  Are you going to show
     us how this relates to the reality of what is happening in the plants?
         MR. HACKETT:  It was really just to illustrate what is going
     on in S-N fatigue.  And what I was going to --
         DR. WALLIS:  But unless it is related in some way to the
     problem we are considering, I don't know what to make of it.
         MR. HACKETT:  Let me try and pick that back up then.
         DR. WALLIS:  Where are we in terms of plants on this curve?
         MR. HACKETT:  The way I would --
         DR. WALLIS:  Where will be in 60 years?
         MR. HACKETT:  Yeah, the way I would address that is -- what
     I was going to come to, and I will get to this in a later slide.  What I
     didn't address on this slide was the concept of a cumulative usage
     factor.  This is, again, I think something Dr. Seale asked us to
     address.  It is not a perfect thing.  Again, Dr. Powers' comments on
     fatigue being, you know, a nonlinear process necessarily.  Cumulative
     usage, basically, is a linear damage rule that goes all the way back to
     1924, I think, with Palmgren and Minor.  In 1945 they put together a
     rule called the Palmgren-Minor Rule or -- Palmgren did later on, or
     Minor did, and, basically, it is just an N where your N is the number of
     cycles that you are accumulating over a large N, which is the number of
     cycles you would predict to failure.
         And then what you want to do is you want to keep this number
     less than 1.  That is the way ASME used these data to design the plants,
     on the basis of a cumulative usage factor approach.
         DR. WALLIS:  Well, again, these are generalities.  Are you
     going to show us how they apply to the plant?
         MR. HACKETT:  I am not sure I am tracking.
         DR. WALLIS:  I don't see the purpose of introducing this
     unless you are going to relate it to the problem we are discussing, the
     reality of what is happening in the plant.
         MR. MAYFIELD:  Let me try and see if I can pick up on where
     Dr. Wallis is going.  In the design stage for the nuclear power plants,
     for the plants that were designed with a fatigue analysis, they started
     with a design -- the design specification where a series of transients
     were identified from that.  They determined stress ranges and then
     stress amplitudes for each of those design transients.  They them went
     to the ASME fatigue design curve, which is similar to this one, it is
     just for the air environment, and determined the allowable --
         DR. WALLIS:  And it is off the chart, we were told.
         MR. MAYFIELD:  The one that would be characterized as off
     the chart.  They determined an allowable number of cycles for each of
     those transients, and then used the Minor Rule to determine whether that
     aggregate was an acceptable design.  If not, they either revised the
     design or sharpened the stress analysis so that the cumulative usage
     factor for each of those locations was less than 1.
         What we have subsequently found, and the issue being
     addressed here is that the air environment fatigue design curve did not
     adequately account, including -- when you consider the margin that was
     imposed, did not adequately account for the environmental effects on the
     fatigue life of the metal components.
         So the issue that we are trying to -- or that was being
     addressed under this Generic Safety Issue is whether that
     non-conservatism was a sufficient concern to require generic -- some
     generic action for the plants, and, specifically, looking at 40 to 60
     years on GSI-190.  GSI-78 and 166 looked -- going for the first 40
     years, the committee then asked the question, well, what would this mean
     for license renewal specifically going from 40 to 60?
         But what it means to the plants is that -- and Ed will come
     to this later in the presentation, is that there would be an expectation
     of an increased leak frequency during the extended period of operation.
         Does that get to what you were asking?
         DR. WALLIS:  No.  I just want to know, what is the design
     curve or the curve that represents the sort of -- the materials in the
     plant and their behavior?  Is it this dashed curve here, or it something
     off the chart?
         MR. HACKETT:  John Fair looks like he wants to take a crack
     at this one.  John.
         MR. FAIR:  Yes, I am John Fair with NRR.  What they have for
     this study is some real plant stress calculations that we used in the
     original study that we presented several years ago.  And the purpose of
     these curves is we have these actual stress amplitudes, so they use
     those to go in and get a probability of crack initiation.
         DR. WALLIS:  The question is, where are they on the chart? 
     Where are those points on this chart?
         MR. FAIR:  Well, there are a number of points, and they are
     various.  There is not point on that chart.  There is a number --
         DR. POWERS:  That is his point, is there is not one single
     point on that.  Could you give an idea where one of them is?
         DR. WALLIS:  If you showed us the points you know about,
     where would they be?
         DR. SHACK:  Let's try it this way.  Every location in the
     plant has a point on that chart.
         DR. WALLIS:  That's right.  There is a fog, there is a mist
     of points, but where are they?
         DR. SHACK:  Well, most of them are well below the design
     curve, that is, there are very few locations where the fatigue usage is
     anywhere near the point where you are going to initiate.
         DR. WALLIS:  You know that, but I don't know that.  No one
     has said that yet.
         DR. SHACK:  Well, they will present calculations where they
     have gone to what they think are the most critical locations.
         DR. WALLIS:  And they will show -- then they will refer them
     to this chart?
         MR. HACKETT:  Not to this chart, to the concept.
         DR. SHACK:  Well, the problem with this chart, of course, is
     that no plant sits there and operates with cycles of 100 KSI.  That is
     this whole notion of this cumulative damage, as Mike and Ed tried to
     explain, there are ways to account for the fact that in the real world
     you don't sit there as you do in a laboratory, neatly cycling at a
     constant load, that you have a load.
         DR. WALLIS:  It is interesting that the number of cycles
     goes from a tenth of a cycle on this chart.  That is a very interesting
     concept of a tenth of a cycle.
         DR. SHACK:  Well, that is -- you know, that is known as not
     putting your lower limit on your log curve at the right place.  But, you
     know, I have explained that, you know, in the real world you have a
     cycle at a certain stress amplitude and cycles at another stress
     amplitude, and there is a way of accumulating that.
         DR. WALLIS:  Yeah, but these are --
         DR. SHACK:  Each of those locations would end up with a
     so-called usage factor.
         DR. WALLIS:  Which would give us a point on this chart. 
     See, this is the key point of the presentation is -- where are things on
     this chart?  And that is what we need to see.
         MR. HACKETT:  No, sorry.
         DR. WALLIS:  If it is not, it is just invoking something
     from a book in order to show you have read the book.
         MR. HACKETT:  This really was, at least in my view, this was
     an illustrative slide for S-N fatigue, it really wasn't meant to be any
     more than that.  Sorry if I have confused the issue with that.  Maybe it
     is a good time to take this one down.
         DR. SEALE:  Well, the message, though, too, is that -- and
     part of the message, if you will, I guess you would call it faith, to
     wit, the S-N curve for the air environment is up here, out essentially
     off the chart.
         DR. SHACK:  Well, let's not get too carried away.
         DR. SEALE:  And you put -- yeah.  Right, yeah.  Right.  But
     when you put the water environment, and not only, as I understand it,
     for the exposure, but for the test as well, when you use the water
     environment, you have a much more significant accumulation of --
         DR. SHACK:  All the curves shift to the right.  So the
     plants were designed on a curve that was moved substantially to the
         DR. SEALE:  Right.  The air curve was the design basis and
     it turns out the correction that was put on that number to account for
     environmental effects is perhaps not as conservative as we thought it
         MR. HACKETT:  That is exactly the point that we get across.
         DR. WALLIS:  And if that is the case, then you need to get
     definite and quantitative about it and not waffle about it.  And I
     wanted to see what -- how some number compares with some other number,
     or how some curve compares with some other curve so I can make a
         MR. HACKETT:  Okay.  We will come to that, but that wasn't
     the point of the slide.  Sorry to confuse the issue here.
         A little bit more background, then we will move on to
     exactly what we did do with GSI-190.  John Fair was the lead in NRR for
     the fatigue action plan which paralleled, the resolution was obviously
     involved with GSI-78 and 166.  This was completed, and the SECY
     reference here, 95, concluded no immediate staff actions or licensee
     actions necessary for design basis fatigue issues, again, for the
     40-year life.  The ACRS letter I referred to earlier agreed with that
     conclusion in 1996.
         GSI-190 basically came out of the resolution of GSI-166 and
     78 because by the process that we use to resolve GSIs, it is incumbent
     on us to address the 20-year extension period.  So there were some
     letters that were transmitted between the offices and around '96 - '97
     timeframe, they transmitted this responsibility to the Research Office
     from NRR.  It was designated a new GSI, GSI-190, instead of continuing
     166, and, again, we had been there, but it is to evaluate fatigue for
     the 60-year plant life with explicit consideration of the environmental
     effects this time.
         The approach, and we will go into some more detail on this,
     is to evaluate high fatigue usage, the concept of the cumulative usage
     factor.  Plants do monitor transients.  And maybe some of this will get
     to answering some of Dr. Wallis' questions.  So the idea was to target
     components that were going to be high CUF, use design basis transients,
     that is important because that links to the final point.  We are not
     solving all fatigue problems with this resolution of this GSI by any
     means.  I don't want to mislead the committee on that.
         DR. KRESS:  Could you elaborate a little more on that.  What
     were the design basis transients that were used?
         MR. HACKETT:  Again, I would probably defer to John.
         DR. KRESS:  These are not the Chapter 15 stuff, these are a
     separate set of --
         MR. MAYFIELD:  The startup shutdown, 10 percent power
     increase, decrease.
         DR. KRESS:  The normal operational.
         MR. MAYFIELD:  The normal operational transients, that's
         DR. KRESS:  The normal ones you would expect.
         MR. MAYFIELD:  Right.
         DR. KRESS:  Okay.
         MR. HACKETT:  Just to differentiate, they are not -- you are
     familiar, and I can touch briefly on the Oconee type failure --
     unexpected thermal excursions and HPSI makeup line that ended in a very
     extreme case of cracking.  That is not what this is addressing
         DR. WALLIS:  But to go back to your curve that didn't mean
     anything, the frequencies we are talking about here are small.
         MR. HACKETT:  Generally.
         DR. WALLIS:  There are 10 or 20, maybe 100 over the life of
     the plant.
         MR. HACKETT:  Generally.
         DR. WALLIS:  They are not in the 10 to the 6 or something.
         DR. SEALE:  No.
         DR. WALLIS:  We are only looking at a very small part of
     this picture, if we look at it at all.
         MR. HACKETT:  That is correct.  When you get into thermal
     fatigue, obviously, you can get into much higher cycles.
         DR. WALLIS:  But there may be some places where, you know,
     thermal fatigue where there are some natural thermal hydraulics going on
     which actually produces cyclic behavior daily maybe.
         MR. HACKETT:  Yes, absolutely.
         DR. WALLIS:  So there are perhaps some situations where you
     get into high cyclic.
         MR. HACKETT:  Absolutely.  And I guess vibration also, we
     are saying the majority of those are -- what we found are beyond the
     design basis, the designers did not consider those.  This was also done
     probabilistically.  I mentioned the PRAISE code, we will go into further
     detail on that, which, again, is maybe part of an answer, I will stop
     for a second, to Dr. Powers' question.
         One of the advances in fatigue is to be able, of course, to
     do this on a modeling basis, with some of the more advanced computer
     codes and the computer capabilities we have now that we didn't have even
     five and 10 years ago.  So PRAISE is a major advance and a tool for us
     to use in this type of evaluation.  I think the basic science of fatigue
     hasn't change a whole lot in terms of, you know, where -- I don't want
     to offend Bill, there's -- fatigue has been what it is for quite some
     time, and there are refinements.
         DR. WALLIS:  Since Bill became a manager there has been no
     fundamental advance in the field.
         MR. HACKETT:  I will leave that alone.  We also estimated in
     addition to through-wall cracking frequencies, core damage frequency
     contributions and that is what is going to go to the bottom line here
     pretty quick.
         I mentioned earlier, again, the latest environmental fatigue
     data was used in this evaluation.  That is from Argonne National Lab. 
     The probabilistic fatigue calculations were performed on sample
     components following what was done in the fatigue action plan.  Six
     locations, in this case, five BWR or five PWR and two BWR plants.
         DR. WALLIS:  Six locations?
         MR. HACKETT:  Six, I will show you those on the next slide. 
     There were six different --
         DR. WALLIS:  Is that enough?  Why six?
         MR. HACKETT:  We considered that was enough of a sample,
     both for the fatigue action plan and we saw no reason to think we needed
     to change the sample for this evaluation.
         DR. WALLIS:  But you picked particular locations that were
     likely to be more severe?
         MR. HACKETT:  High CUF locations, right.  The core damage
     frequency was estimated from the pc-PRAISE through-wall crack
     probabilities, and then published PRA information, you know, for the
         DR. WALLIS:  I mean these calculations are not very
     complicated, are they?  You could easily have done 60 locations.
         MR. HACKETT:  The CDF computations.
         DR. WALLIS:  You said probabilistic fatigue calculations. 
     Is that -- are they complicated things, by the way?
         MR. HACKETT:  It is an interesting question.  There are a
     lot of assumptions that go into that.  So I wouldn't say the framework
     is necessarily complicated, but there are assumptions that go into those
     that, you know, people might consider complex.
         John, comment.
         MR. FAIR:  Yeah, this is John Fair again from NRR.  The
     reason they picked those locations, it was from our previous study, and
     the amount of effort required was, in the previous study, we took the
     existing design basis calculations and tried to remove the conservatisms
     we could identify in them, and that is what took a bit of time.  So if
     we were to -- had 10, a factor of 10 more locations, we would have had
     to do a lot of work getting the data from the plant, trying to remove
     the conservatisms we could identify.
         MR. HACKETT:  The reason for my answer being what it was is,
     I guess I would say, yeah, it is complicated, because there is a
     sensitivity in these calculations for several of the key parameters, and
     I will come to that.  It was one of the criticisms in the ACRS letter
     when we first went through this for 78, that we didn't address those
     appropriately.  We tried to go back and do that on a more rigorous basis
     this time.
         DR. WALLIS:  So you have some uncertainties and assumptions,
     when you are in a world of higher uncertainty, you sometimes compensate
     by taking more points.
         MR. HACKETT:  We tried, in this case it is done on a
     modeling basis.  We tried where we could to go off of, you know, actual
     plant data in the design transients.  So, yeah, I mean to the extent we
     can, we are trying to use as much of the real data as is available.
         DR. WALLIS:  Are you going to show us that these six
     locations were consistent, or they give mixed messages or are you going
     to show us that?
         MR. HACKETT:  I will show it to you now.  I will come to
     that in terms of through-wall crack frequency and CDF, but let me show
     you the locations first.  These were the locations that were used for
     the fatigue action plan, and, again, for this study.  You can see they
     cover a fairly good range here and some pretty critical components where
     you get high CUF.
         Plant types, again, the three primary vendors and newer and
     older vintages in the case of CE, GE and Westinghouse were addressed in
     this evaluation.
         DR. WALLIS:  So RPV is a big thing.
         MR. HACKETT:  Yes, sir.
         DR. WALLIS:  You are looking at what is in the RPV or some
     location in the RPV?  They are a monolithic thing.
         MR. HACKETT:  Yeah, the RPV in this case, it was the shell
     and the lower head, I believe, John, is that correct?
         MR. FAIR:  Yeah, we -- although the usage factors are
     generally low in the RPV, we picked that because it was the most safety
     significant location.
         MR. HACKETT:  We talked about pc-PRAISE.  One of the things
     we had going into this study is we had some problems with pc-PRAISE,
     some things we needed to modify.  In working together with NRR, John
     Fair raised some of these concerns.  The previous version of pc-PRAISE
     that was used for GSI-78-166, for instance, wasn't really capable of
     properly modeling fatigue cracks with large aspect ratios.
         DR. POWERS:  I have to confess an ignorance.  I am not at
     all familiar with pc-PRAISE aside from the fact it gets cited very
     often.  Can you give me some understanding on what the level of
     validation and verification, peer review of pc-PRAISE is?
         MR. HACKETT:  Yeah, that has come up before, and others may
     want to chime in here, because, again, my history with this is
     relatively recent.  My understanding is that it was benchmarked
     previously when it was developed, and that was at PNNL for the work that
     was done on 78 and 166.
         DR. POWERS:  So PNNL developed it and benchmarked it?
         MR. HACKETT:  It was benchmarked independently.
         MR. MAYFIELD:  Ed, let me jump in here because I have got
     history that goes back on this thing since it was originally written. 
     It was originally part of the -- was it SSMRP, the original seismic
     study, and the code was originally written under subcontract to Lawrence
     Livermore National Laboratories, it was running the SSMRP.  It was
     written for mainframe applications at that point in time.
         At that time it was written under QA program and did receive
     some peer review and benchmarking within the U.S.  It subsequently was
     reviewed and has seen a lot of review and benchmarking by the Germans,
     some other sporadic benchmarked.  It has been used, the PC version of it
     has been used by the staff and some contractors, and some international
     standard problems through CSNI.
         The review of the code and its QA has been something that,
     as PNNL took on this project for us, they picked back up and have
     reviewed subsequently, going back to the work that was done for GSI-166.
         So there has been periodic reviews and QA of the code to
     assure that at least -- to assure that it is doing what we intended it
     to do, that the modeling has been implemented correctly.  The underlying
     modeling has been reviewed and discussed in the international community
     through a series of the standard problems and other meetings.  So in
     these kind of codes, you can always find fault with the modeling, but
     the computer code itself is, we believe, functioning as we intended it
     to function.
         DR. POWERS:  If I wanted to understand the strengths and
     weaknesses of the code, what would I read?
         MR. MAYFIELD:  I need to think about that one a bit.  Can we
     -- I mean it is a reasonable question, but I need to think about what to
     steer you to as the best example for it.
         DR. POWERS:  I see this code cited in enough things that
     come to us, it would be a good idea for me to understand it a little
         MR. MAYFIELD:  Can we take it as an action to get back to
     you through the staff?
         DR. POWERS:  Sure.
         MR. MAYFIELD:  As to what would be some good examples to
     take a look at.
         DR. POWERS:  Sure.  That would be great.
         MR. MAYFIELD:  All right, sir.
         MR. HACKETT:  We probably, for that reason, in need of
     starting to deal with versions of this code.  The latest version was
     done under subcontract to PNNL by Harris, and there was further
     evaluation and separate benchmarking done of this revised version by
     PNNL separately on that.
         But the main things we were after here were, previously
     initiation was assumed to start at basically year zero and then proceed
     through the code that way.  Now, initiation is basically left as one of
     the random variables, that it will start when it is appropriate that the
     probabilistic analysis says it should start.
         The growth is going to be from initiation to failure.  And
     failure is going to be through wall cracking.  And that leads to, again,
     another question I think Dr. Seale raised at the beginning. 
     Catastrophic or not, most of the time, if you are talking design basis
     transients, you would not be talking something catastrophic, you would
     be talking a leak before break type of situation.  Not like what you saw
     with Oconee, for instance, which was beyond the design basis, to address
     that question.
         Another really hard problem, and a lot of credit goes to Dr.
     Simonen and his colleagues at PNNL, is what if you initiate cracks at
     several places around a circumference, and they are growing, and how do
     they link and what influence do they have on each other.  A very
     probabilistic problem inherently by its nature.  That was not addressed
     in the previous version, it was addressed explicitly in this version,
     thanks to the work they put in on this.
         I think, you know, Dr. Simonen and others would say it is
     also not perfect.  I mean there are assumptions that go into that that
     you have to make to be able to do this in terms of aspect ratios, in
     terms of how close does a crack have to get to another crack before it
     is influencing it.  But we at least basically had a decent shot at that
     in this one, and that was the weakness.
         DR. WALLIS:  Doesn't the growth of a crack depend on how it
     starts and what sort of orientation it has?
         MR. HACKETT:  Sure.
         DR. WALLIS:  So there is a lot of uncertainty in this model.
         MR. HACKETT:  Absolutely.  Absolutely.  There is uncertainty
     with regard to those factors.
         DR. WALLIS:  So if there is uncertainty, we ought to be
     careful to have a suitable safety factor or something in our plan?
         MR. HACKETT:  Yes.  Yes, absolutely.
         DR. WALLIS:  Or evaluation.
         MR. HACKETT:  Absolutely.  Yeah, this was done, of course,
     like appropriate probabilistic analyses.  All these were done, I
     believe, Fred, on a best estimate basis, to the degree possible, but
     there are conservatisms inherent in some of the things that were done.
         DR. KRESS:  Is there a natural database on this linking?
         MR. HACKETT:  A database?
         DR. KRESS:  Yeah, like tests that you take the thing off and
     look and see how many cracks there were and what the orientation is.
         MR. HACKETT:  I think the only thing we have in that regard
     is kind of the reality check with what we see in service, and how this
     can simulate that.
         DR. KRESS:  Just talking as a hypothetical model.
         MR. HACKETT:  It is how things grow in reality, but in terms
     of a database, I think we are short.  If anyone wants to talk about
     that, I am not --
         MR. MAYFIELD:  This is Mike Mayfield from staff.  There are
     a number of, in the literature, a number of compilations of component
     fatigue tests.  The problem that we run into for this particular
     application is they are typically not run in typical lightwater reactor
     environments.  You will see air tests, tests in oil, occasionally they
     will have room temperature water just as either a pressuring medium or
     something so they can identify a leak.  But the problem, and you can, I
     am sure, imagine that it would get fairly complicated and something of a
     laboratory safety concern to run fatigue tests on components at typical
     LWR conditions.
         So, database, per se, no.  Compilations of fatigue data and
     test results, yes, not specific to LWR conditions.
         DR. WALLIS:  This PRAISE code could produce curves like
     these S-N curves for a particular piece?
         MR. HACKETT:  Those, the confidence bands you see in there
     did come from PRAISE, I believe.
         MR. MAYFIELD:  Those curves you have, Dr. Wallis, are input
     to the pc-PRAISE code.
         DR. WALLIS:  Input to.
         MR. MAYFIELD:  Yes.
         DR. WALLIS:  It seems very strange.  If I want to grab a
     component, I want to know, if I stress it at a certain level, and I
     cycle it a certain amount, does it break?
         MR. MAYFIELD:  Yes.
         DR. WALLIS:  That is an output, that is not an input.
         MR. MAYFIELD:  That curve is the curve that tells you
     whether or not it will break based on laboratory test data.  So, if you
     have a component that you are cycling at a particular stress level, and
     you want to know how many cycles it can withstand, it is that curve that
     tells you.
         DR. WALLIS:  Why do you need PRAISE at all then?
         MR. MAYFIELD:  Because the complicate -- the analyses are
     more complicated than the simplistic example I just used.
         MR. HACKETT:  You need PRAISE to go from the laboratory to
     the real world.
         MR. MAYFIELD:  The other thing is that those curves get you
     cycles to some engineering definition of a crack.  The pc-PRAISE code
     takes that defined crack size and propagates it on through the component
     of the wall, the wall of the component, that is where the growth and
     linking come in.
         DR. WALLIS:  These curves are just for the initiation of it.
         MR. MAYFIELD:  That's correct.
         MR. HACKETT:  Yes, sir, that's correct.  This part uses
     fraction mechanics.
         DR. WALLIS:  So there might be other curves for the actual
     failure which would --
         MR. HACKETT:  There would be other curves for the growth and
     then there would be -- as Mike is indicating, what we ultimately get to
     is through-wall cracking or not.
         DR. WALLIS:  That is geometry specific for the --
         MR. HACKETT:  It can, it is affected by the geometry, yes.
         DR. SHACK:  The crack geometry and the component geometry,
     which, again, they have to sample in a kind of a probabilistic way.  And
     to come back to Tom's questions, I mean one of the things that you do
     find, at least you have the reality check that when you predict aspect
     ratios, you can go out and look in the real world and see if the aspect
     ratios that you are -- you know, so you really don't have the kind of
     test that you would like, where you do tests and, you know, you watch
     the cracks link up.  But you kind of have the end of the game thing
     that, you know, okay, does the aspect ratio look anything like the real
         MR. HACKETT:  Exactly, like Bill says, that is what you have
     to deal with.  And in terms of what you don't, the worst case for you is
     when these things do link up and join into large aspect ratio cracks,
     and you have a worst case from a fracture mechanics perspective.
         DR. KRESS:  But back to Dr. Wallis' questions, you don't
     really end up with curves, you end up with will it fail or won't it fail
     over some time period.  It is sort of --
         MR. HACKETT:  You end up with a probability --
         DR. KRESS:  A probability.
         MR. HACKETT:  -- of whether you are going to get a
     through-wall crack, basically.  And then you need to go through that to
     where that gets you to core damage.
         DR. KRESS:  But you don't really get curves, you get a
     probability of it occurring.
         MR. HACKETT:  That's correct.  Also, I mentioned sensitivity
     study.  These were some of the parameters.  I guess we have already kind
     of been discussing a lot of it.  The issue of multiple crack initiation
     is a factor, obviously.
         DR. WALLIS:  Why is wall thickness a sensitivity?  You know
     what it is.
         MR. HACKETT:  Just in terms of varying it to see what kind
     of sensitivity you get to the overall outcome of the code.  So these
     were -- stress gradient, for instance, was not explicitly address, I
     don't believe, in GSI-78.  Multiple crack initiation certainly wasn't. 
     Correlation between crack initiation and growth, they are assumed to be
     non-correlated, and there is good metallurgical reasons to assume that
     they are non-correlated.  However, if you were to assume they were, for
     instance, things could get significantly worse, so there are
     sensitivities involved with all of these.  Oxygen content, sulfur
     content, obviously, too.
         Another linkage that needs to be made here before I get to
     the bottom line is -- I will spend a little bit of time here on this
     concept of the through-wall cracking versus the cumulative usage factor. 
     In terms of -- I am a metallurgist and I like to mostly think simply and
     maybe less probabilistically sometimes.  I need to do some learning in
     that regard.  But in simple terms, these things shouldn't be linked
         CUF is measuring, is a measure of what is going on in
     initiation and damage accumulation.  Through-wall cracking is that plus
     crack propagation and other fracture mechanics issues that Dr. Shack was
     talking about.  So, you know, what kind of correlation should you expect
     between these two things?  An approximate one at best, and I think that
     is what you get here.  But what it shows you is that when you do get to
     high usage factors, the probability of through-wall cracking can get way
     up.  You know, you are up at 100 percent for some of the points from
     Simonen's evaluation here.
         You know, conversely, when you are down pretty low, like
     down between 1, you can get down to some pretty low probabilities of
     through-wall cracking.  But the bottom line is when you are up at high
     CUF, you know, chances are you are getting a pretty indicator that these
     are going to be areas that could cause you problems.
         DR. WALLIS:  Why is this statistically significant?  I have
     got one point on the right, that is sort of somewhere in the middle of
     all the points at one.  I am not sure that there is any obvious trend
     with CUF.
         MR. HACKETT:  I would agree with you in general, I don't
     think there is enough data to make any sort of a definitive correlation
     here, by any stretch.  I think we are just sort of looking at a trend. 
     And the trend, to me, just looking at the data, would say, if I got a
     high CUF, particularly over 1, my chances of that component going to
     some kind of through-wall cracking over a 40, this case is showing 40,
     40-60 year life, it is going to start to get up there pretty high.
         DR. WALLIS:  Now, 1 means it must have broken before 40
     years, is that what it means?
         MR. HACKETT:  Right.  Right.  It would have gone through the
     wall.  So, but that is an important concept.
         DR. WALLIS:  Not broken, there is a crack through the wall.
         MR. HACKETT:  Crack through the wall.  That is an important
     concept to keep in mind for the next two slides, and I will try and see
     if I can make this linkage for you.  I will jump immediately to the
     bottom line.  This goes -- I could say maybe this is out of order, but
     we will try it this way and see how it goes.
         To jump from, you know, the intermediary here is
     through-wall cracking, and I will come back to that.  But jumping way
     ahead to core damage frequency, you know, here is what you see, a couple
     of things to walk through here.  First off, going from air 40 years to
     water 40 years.
         DR. WALLIS:  What does air 40 years means, that means --
         MR. HACKETT:  That would be the prediction of the
     probability core damage frequency.
         DR. WALLIS:  It makes no sense.  I mean that is a reactor
     filled with air.
         MR. MAYFIELD:  That would have been the original design
         MR. HACKETT:  That would have been the original design
         DR. WALLIS:  It makes no sense, it has no relevance to this.
         MR. HACKETT:  I would probably agree with you on that in
     terms of the --
         DR. SEALE:  Except to the extent that the original design --
         MR. HACKETT:  That is the way it was designed.
         DR. SEALE:  -- was to mess up the air environment curve to
     get a pseudo water environment curve.
         MR. HACKETT:  To go back to Dr. Powers' comment, I probably
     have to be careful using the word "air" in the future.  There is a lot
     more that goes into this than just saying air, as Dr. Seale mentioned.
         Anyway, that is what it is.  That was the data that was --
     data from tests that were performed in air, adjusted by the ASME process
     for design.  Basically, what you see, in going from that to water at 40
     or water at 60, you get a significant delta.  The other thing that you
     see is that you don't see a whole lot of change between 40 and 60 years,
     basically, leading you to say that the conclusion you reach for 40
     years, this study is also supporting for 60 years.
         DR. WALLIS:  Is one of those components the reactor vessel?
         MR. HACKETT:  Yes.  I couldn't tell you which one off the
     top here, I have got a backup slide on that one.  Probably the one that
     is down much lower.
         DR. WALLIS:  That's all right.
         MR. HACKETT:  Okay.  The RPV is the lowest one.
         DR. WALLIS:  One.
         MR. HACKETT:  Is the number -- the number 10.
         DR. WALLIS:  Oh, 10.
         MR. HACKETT:  It is down over here.  So the bottom line is
     that, the ultimate bottom line is then you can see that the highest this
     is getting up to is an E minus 6 range, which leads us to the
     conclusion, and you will hear more about this from Chris in a little
     bit, we don't see the need to impose a generic requirement on plants for
     fatigue for the 60 year life, even considering the environment.  There
     is no need, based on risk and core damage frequency, to impose a generic
     requirement.  That is the ultimate conclusion.
         DR. WALLIS:  Could we just recapitulate?  The previous
     picture you showed, there is a certainty of through-wall cracking of
     some things.
         MR. HACKETT:  Yes.
         DR. WALLIS:  And yet when you look at CDF, it turns out to
     be unimportant.
         MR. HACKETT:  That's right.  And that gets back to Dr.
     Seale's question earlier, is that when these do go through wall, what
     happens catastrophically?  And the answer is, generally, not much.  As a
     matter of fact, not anything that we have been aware of in terms of
     design basis transients.  So, you look at the probability that this
     would extend to small break LOCA, or maybe large break LOCA, to give you
     a large contribution to core damage, and you just don't get there is
     what it is telling you.
         DR. BONACA:  I have a question.  When I read the report, and
     I read also -- well, we had a presentation at the Water Reactor
     Conference on this issue.  A statement was made that the frequency of
     through-wall cracks will get up.
         MR. HACKETT:  Yes.
         DR. BONACA:  In 40 to 60 years.
         MR. HACKETT:  Yes.
         DR. BONACA:  If I understand, however, how I relate that
     finding to this result is because for thinner wall components, then the
     frequency of cracks is increased, or thicker wall components is not,
     just because the propagation of the crack through a thicker wall --
         MR. HACKETT:  Less so for thicker wall, just because of what
     you are saying.
         DR. BONACA:  Yeah.  Is it what makes the -- is that
     correlation the one that results with core damage frequency not being
         MR. HACKETT:  No.  No.  There is more that goes into that
     there.  Again, there are more assumptions that go into the analysis.  In
     terms of the likelihood, again, a small break LOCA, a large break LOCA,
     the mitigative measures that would kick in, both in terms of the human
     factor and the engineered safety systems that would go into mitigating,
     for instance, a small break LOCA, all of those considerations go into
     where you get to in core damage frequency.
         DR. SEALE:  There is a lot of padding between a leak and
     core damage frequency.
         DR. BONACA:  Well, the reason why I am asking the question
     is that, if there was that relationship that one could make and say
     that, you know, this crack propagation is affecting particularly smaller
     piping, for which I have more confidence in leak before break, and
     things of that kind, okay, then, you know, there is a significant --
     there is some mechanistic relationship that supports this core damage
     frequency.  Now, what you are saying, there are other considerations to
     do with, what, operator actions, I don't know.
         MR. HACKETT:  Yes.  Operator actions, and the engineered
     safety systems in particular, and then the probability of getting to
     either a large or small break LOCA from one of these types of
         DR. BONACA:  And are the uncertainties being increased?
         MR. STROSNIDER:  This is Jack Strosnider.
         DR. BONACA:  Just because there is so much -- what about the
     uncertainty associated with these results, is it increased?
         MR. STROSNIDER:  I think, I would just make the comment with
     regard to the core damage frequency that I don't think it is a big
     surprise, because remember that the plants, one of the design bases was
     a pipe break, a doubled ended rupture, and the plants were designed with
     redundant and diverse systems to cope with those breaks.  So I don't
     think it is a big surprise that the core damage frequency would be low.
         DR. BONACA:  No, I am not saying it is a big surprise.  I
     would like to understand, however, what keeps the core damage frequency
     the same, and if it is associated with some aspects, I believe the
     uncertainties will now be changed.  And if it is associated with human
     actions, et cetera, the uncertainties are increased.  That is what I am
     trying to understand.
         MR. HACKETT:  Yeah, I think -- let me say several things in
     that regard, and we touched on it earlier.  When these types of cracks,
     based on design basis transients, go through the wall in either -- I
     don't think in this case that the thickness is irrelevant, assuming they
     do go through the wall, they will tend in most or all cases to go
     through the wall non-catastrophically.  That would be with aspect ratios
     that would lead to leakage, but not catastrophic failure of the
         As opposed to the kind of case you might get in a rapid
     cycle thermal fatigue, like we saw at Oconee, like has been seen in
     France, where if there were a transient thrown at one of those types of
     situations, you could end up with a catastrophic failure.  But I think
     there is the nature of the fatigue process, the way it operates here on
     the design basis versus the beyond design basis.  That is working very
     much in your favor.  And then, as Jack mentioned, you have the fact that
     the plants were designed to handle those in the first place, so you
     don't see a contribution, a large contribution of core damage.
         DR. WALLIS:  That is a very important message for the
     public, it seems to me.
         MR. HACKETT:  Yeah, absolutely.
         DR. WALLIS:  This figure and the next figure.
         DR. SEALE:  Yes.
         DR. WALLIS:  That the probability of through-wall cracks is
     quite high, I mean it is one-tenth or a hundredth or something.
         MR. HACKETT:  Right.  Let me go ahead and put that up.
         DR. WALLIS:  There will be sort of news items that a pipe
     crack through the wall in nuclear plant, gee whiz, isn't that terrible. 
     But, in fact, there is a factor of about a million between that and real
         MR. HACKETT:  Absolutely.  This, to me, as I sat thinking
     about it, when we were putting some of these graphics together, this is
     a real tribute, ultimately, when you sit down and think about it, to the
     designers.  They -- you know, you are showing a relative, as you said,
     you are showing a relatively high frequency here of through the wall
     cracking, in that case either for 40 or 60 years.  But at the end of the
     day, the impact on the safety of the plants, you know, from a risk
     perspective to the public is not very much.  Then, again, leading to the
     conclusion that we don't see imposing any generic requirements.  We are
     basically supporting the conclusion for the previous GSI.
         DR. KRESS:  I am interested in the validity of this
     technique for calculating through-wall cracks.  It seems to me like
     there ought to be ways to judge that based on experience.  For example,
     you could probably have some probability data on how often you get
     through-wall cracks versus time in service.  Or maybe you could even
     use, it ought to be, it seems to me, related to LOCA initiating event
     frequencies somehow.  And have you made any attempt to validate this
     process using each of those measures some way?
         MR. HACKETT:  Mike.
         MR. MAYFIELD:  This is Mike Mayfield from the staff.  The
     interesting thing you find is that the designer really make a mistake,
     we shouldn't be seeing many fatigue failures at this point in plant
     life.  Where we do see the leakers is where transients, actual
     operational events haven't been picked up in the design calculation. 
     That is where you see the leakers showing up.
         DR. KRESS:  Could you use those and go back and redo the
         MR. MAYFIELD:  If you had good, could you, in principle,
     yes.  The practicalities of getting the stresses and the cyclic rates at
     a level where it makes sense to backout, to do the calculation in
     reverse, what you find is that the uncertainties begin to swamp what you
     can really do.  But, in principle, yes, you can do that.  And there have
     been attempts at that in other implications, but the uncertainties cloud
     the answer to the point that you are not ever quite sure what you really
     ended up with.
         DR. SEALE:  But when you do find a through-wall crack, isn't
     it true that when you go back and look, you indeed find one of these
     insults that are outside the original environment that was considered in
     the design?
         MR. MAYFIELD:  Yes.
         DR. SEALE:  So it is not a random screw-up, if you will, you
     know, the materials weren't done right or something like that.
         MR. MAYFIELD:  It is typically something other than an
     underlying material problem.  There was some change in plant operation,
     some characteristic that wasn't anticipated, and it wasn't reflected in
     the original design calculations.
         DR. WALLIS:  This would be -- this would characterize the
     failures for thermal fatigue in Japan, for example?
         MR. MAYFIELD:  Yes, sir.  And the Oconee leaks.
         DR. WALLIS:  So this is also important, there is something
     else in this, the things which you didn't anticipate, which could quite
     well make these leap up an order of magnitude.
         MR. HACKETT:  Yeah, I will come to that, too, because we
     have a plan for addressing beyond this.  But leads us to the -- we have
     already hit the basic conclusion, but this --
         DR. SEALE:  Before you go to that, I would warn you, also,
     when you compare those two results curves, notice that the probability
     axis is not the same.
         MR. HACKETT:  Yes.  Good point.
         DR. WALLIS:  Well, we noticed that right away.
         MR. HACKETT:  It kind of jumps out.
         DR. SEALE:  Yeah, well, I am glad you are --
         MR. HACKETT:  It is a good point, though, on different
         DR. POWERS:  The difficulty I keep coming back to on this
     thing is that -- I mean the truth is we do have things that break
     because of fatigue, and it is always at some place that we never thought
     to apply the code.  Okay.  So now what is the probability that there are
     places in the plant that we have forgotten to apply the code to?
         MR. MAYFIELD:  That is a tough question.
         DR. POWERS:  It is one.  Okay.
         MR. HACKETT:  It is one.  But a good example, you come back
     to the Oconee case and it is a weird disconnection of things, but what
     you go back to find is that all the code mandated for that location was
     a surface exam.  You were never going to find a 360 degree crack on the
     ID with a surface exam.  It is even debatable how well you are going to
     find with a volumetric exam from the outside.  So it is a tough thing to
     deal with in the ISI program.  First, you have got to identify an area
     that you would go look at, and then you had better be looking at it
     really hard.  So it is a real good question.
         MR. MAYFIELD:  Dr. Powers, your question also goes to the
     last chart in the package because it is something the staff has been
     talking about with the industry.
         MR. HACKETT:  Yeah, I will jump to that in a minute.  I
     guess we didn't really demonstrate here, but it is the case that CUF,
     for some components, during these life of these plants, 40 or 60 years,
     is going to approach or exceed 1.  However, the cumulative damage
     frequency, as we try to make that jump for you here, is very low,
     certainly not large enough to justify new generic requirements by the
         DR. WALLIS:  It looks as if this is a case where
     risk-informed regulation is essential in order to reach this conclusion.
         MR. HACKETT:  I think absolutely.
         DR. WALLIS:  Without CDF you wouldn't be able to reach,
     without PRA you wouldn't be able to reach this conclusion.
         MR. HACKETT:  Very true.
         DR. WALLIS:  And so this depends on the paritability of PRA.
         MR. HACKETT:  To a large degree.  Correct.  But we did show
     you, however, there is an increase in leak frequency, it is relatively
     small going from 40 to 60 years, but there is an increase.  The
     proposal, and Chris will talk about this, is that we would propose that
     for license renewal that this be addressed by the licensees in their
     aging management programs maybe in a manner to be determined.  But it
     has already been addressed successfully for Oconee and Calvert Cliffs.
         We will come to the last slide, but that relates -- we did
     have Mike Mayfield and Kurt Cozens from NEI co-organize the public
     meeting to talk about fatigue issues in general on November 17.  I think
     that was very successful.
         DR. POWERS:  Let me ask you a question.  You guys had a
     public meeting November the 17th.  Where?
         MR. HACKETT:  That was down at the Pooks Hill Marriott here
     in Bethesda.
         DR. POWERS:  Okay.  Why?  Why kind of a public meeting is it
     there in the Pooks Hill when you could have had one at an ACE meeting or
     something like that where there might have actually been public that was
     not connected with the nuclear industry that might actually have a view?
         MR. HACKETT:  I believe we did, I can't honestly say, I
     didn't check the tally.  There may have been interested members of the
     public there.  What I think we were all pleased at is we had very large
     utility representation, a lot of interest in this issue on the part of
     the utilities, obviously, particularly the utilities looking at license
     renewal.  NEI, EPRI, the ASME code folks were represented.  I can't
     really, Mike, if there were members of the public there.
         MR. MAYFIELD:  I don't know.  Let me --
         DR. WALLIS:  You said -- I'm sorry.  You said you were very
     pleased there were all these utilities there.  Now, a member of the
     public might say he would be much more pleased if there were some
     independent observers there who had technical knowledge.
         DR. POWERS:  I mean there are professional societies that
     deal with this kind of topic for people other than the nuclear industry.
         MR. HACKETT:  Yes.
         DR. POWERS:  I mean this is a big issue.
         MR. HACKETT:  Absolutely.
         DR. POWERS:  And far more money is spent on this issue in
     these other areas, practically any one of them, than is spent in the
     nuclear business.
         MR. HACKETT:  DOD spends far more money than anybody on this
         MR. MAYFIELD:  This, since I was one of the organizers of
     this meeting, let me try and jump in.  This particular meeting was to
     talk about an application-specific question.  The dialogue that we have
     sought from professional societies, ASME and ASTM, in particular, has
     gone to the underlying technologies.  So the meeting on November 17th
     was to discuss the application-specific question of fatigue in nuclear
     power plant piping, to present the results from PNNL and to solicit any
     interested comment on those results, and then to talk about the overall
     issue of fatigue.
         There has been, I believe continues to be some interest on
     the part of the licensees about what GSI-190, what impact it would have
     versus, overall, what impact fatigue is having on power plant operation.
         So the meeting on the 17th was to be specific to this
     application.  The broader question of underlying technologies, we have
     presented this work through the ASME meetings, where the technical
     specialists do come to the table.  I believe, Bill, this has also been
     picked up as part of the international cooperative group on
     environmentally -- whatever they are called today.
         MR. HACKETT:  Assisted cracking.
         MR. MAYFIELD:  Environmentally assisted cracking.  So there
     has been that level of peer review in the underlying technology.  So it
     is not a matter that the only place we have sought input is through
     meetings with the regulated community.  We publicly announced this
     meeting on the 17th, but it was specific to this end application.
         DR. SEALE:  I think there is another point here.  Implicit
     in all of this discussion, and the comments, the observation that Dr.
     Wallis made about the probabilistic aspect of these evaluations, is the
     fact that when you get down to the application, it is largely
     plant-specific, and that there is no end-all resolution of this issue on
     a generic basis.  And we are at a very crucial point at the beginning of
     the evaluation of applications for license renewal and so on.
         And I think the point of the November meeting was to alert
     the license renewal community this previously thought to be generic
     issue was actually going to be something that was going to have to be
     addressed on a plant-specific basis as part of their aging management
     programs in their license renewal packages.  So it is not, it wasn't the
     normal kind of public meeting.
         DR. WALLIS:  Does this have to have a PRA because CDF is the
     key to resolving the issue.
         DR. SEALE:  You will have to ask Chris that.
         MR. STROSNIDER:  This is Jack Strosnider.  I just wanted to
     reemphasize what Dr. Seale indicated.  The meeting that we had a few
     weeks ago, in fact, the industry, at our license renewal steering
     committee meetings, have repeatedly asked for a status report on
     GSI-190.  They are interested in understanding how it would be resolved
     and what is resolution would mean with regard to license renewal, and,
     in fact, whether it addressed all of the fatigue issues or not.  And so
     that was really the focus of that meeting, was to share the results of
     the GSI-190 study with the industry and to discuss with them other
     fatigue issues that needed to be addressed in the context of license
         MR. HACKETT:  That is a good lead-in to this slide.
         DR. WALLIS:  Could I ask now Chris Grimes?  It was suggested
     by my neighbor I ask him.  The assurance of safety comes from PRA to
     CDF, because we know pipes are going to crack through, or it is likely
     that they will, and, yet, the assurance of safety comes through risk
     analysis.  Now, does this mean that all plants that want to renew their
     licenses must have PRAs?
         MR. GRIMES:  This is Chris Grimes, and my simple answer to
     that is, no, we haven't found a basis for requiring a plant-specific PRA
     as a predicate for license renewal.  And I will try to explain the
     relevance of this, the risk-informed insights from these studies in
     relation to aging management for the purpose of fatigue, when I try to
     summarize that I believe is our recommendation on how to proceed with
     license renewal.
         MR. HACKETT:  I will let Chris get to that here pretty
     shortly.  But I just wanted to show you, this follows on Jack
     Strosnider's comments, this is an outline of -- I guess like a first
     cut, really, at an integrated plan, more than a first cut.  What we have
     been discussing with the committee here today is really this line right
     here on the resolution of GSI-190.
         We did start out by saying, though, there are other fatigue
     problems that we in the industry are aware of that need to be addressed. 
     In particular, what do you do when you have CUF greater than 1, is one
     issue.  There are a lot of things that come to mind there. 
     Repair-replace is one of the first issues.  Those are options that have
     been and will continue to be available.
         ASME has an initiative in the form of a non-mandatory
     appendix to Section 11 of the ASME Code, Appendix L, which allows an
     inspection fracture mechanics type approach to assessing, you know, what
     you do with components that have CUF greater than 1, or at least that is
     one element of Appendix L.  Appendix L first cut is going to try and get
     you to, as we say, like to sharpen the pencil on the fatigue cumulative
     usage factor analysis to get it below 1.  If you can't do that, then
     what you do in Appendix L is you postulate a flaw on a fracture
     mechanics basis, and it is a flaw that would be a high probability flaw
     that you would find with an inspection capability, like an ultrasonic,
     volumetric inspection capability.  And then you would see where that
     flaw would end up for subsequent cycles on a fracture mechanics
     propagation type basis and to see if that could get to your next outage
     or some number of years.
         There are issues with that, obviously, the NRC has not
     endorsed it yet, there are some issues with it.  There is a task group
     right now working on revising Appendix L in ASME 11 that is, as far as I
     know, making pretty good progress.  So that is going on.
         There is also an issue I didn't mention on the last slide. 
     ASME, the task groups and working groups that have been involved, I
     think it has been fair to say have been fairly slow in incorporating the
     environmental effects on the design curves.  That has not happened.  It
     has been an open issue for probably 10 or 12 years now.
         So very recently, my Division Director, John Craig, wrote a
     letter to the head of the ASME Board of Nuclear Codes and Standards
     requesting that action be taken on an expedited basis by the ASME Code
     to that.  That will hopefully happen.  The ASME Code, as it turns out,
     meets next week, so I am sure the debate will be taken up or renewed.
         We mentioned thermal fatigue.  The NEI and the industry have
     been proactive in this regard, and they have an initiative that they
     talked to us about at this meeting that they are looking at trying to
     address thermal fatigue problems.  This is in a preliminary type
     situation right now, but they are working on it.
         So this kind of brings together what we know about in
     fatigue.  We think we have resolved this piece, or we have resolved most
     of it.  There are other pieces and we in the industry are working on
     those.  And they do impact, as the other side of the slide shows, the
     license renewal process.
         DR. WALLIS:  That is the obvious question, I mean you have
     got an hour to license renewal, and yet you have got dates in the box
     which go to the year 2002.  So you have got to do license renewal
     because you resolve the column on the right there.
         MR. HACKETT:  This column here?
         DR. WALLIS:  Yes.
         MR. HACKETT:  Yeah, absolutely.  License renewal issues, I
     think, depending on -- Chris can maybe comment on this further, can be
     resolved without having to resort to these things.  This is another tool
     that will be available to licensees, is the way I would characterize it.
         MR. GRIMES:  Dr. Wallis, you are stealing all my thunder.
         MR. GRIMES:  When Ed -- you know, as Ed has tried to
     describe it, there is a lot of work that has gone into, you know,
     developing a better understanding of what fatigue means for the period
     of 40 to 60 years.  And I think that my role today would be to start
     there and then go into, what does it mean for license renewal?  How can
     decisions be made for license renewal applications?  What standards
     should be applied?  And so I hope that I can address that when I try to
         DR. WALLIS:  I expect you to.  I just say when you see a box
     with an arrow, the obvious question is, well, what comes first?  You
     know, what depends on what?
         MR. GRIMES:  Sure.  That's right.
         MR. HACKETT:  I think with that --
         MR. GRIMES:  And, in fact, Ed, you can leave that slide up.
         MR. HACKETT:  Okay.
         MR. GRIMES:  Because I will speak from that.  But you also
     notice that there are arrows going out of that box in different
     directions, and so there is a coherence issue, too.
         MR. HACKETT:  So, I guess at this point, if there are other
     questions that we should get into at this point, or else we will just
     have Chris come on up and talk about the license renewal?  Okay.
         MR. GRIMES:  I will come up to the front.  And I will sit
     down.  I don't want to have to always talk to the back of Dr. Wallis'
         I would like to start off by pointing out that, as the
     Generic Safety Issue process goes, this is a very unique Generic Safety
     Issue.  We set up a Generic Safety Issue process that basically provided
     a means for the NRC to take new knowledge, to take new experience and to
     apply backfitting standards in order to decide whether or not licensed
     facilities need to change their behavior, need to change the plant
     design, need to change the way that they operate the facility, or
     whatever.  And that is the process that we set up with backfitting
     standards to make decisions about whether or not to impose new
     requirements on operating facilities, and to change the standard of
     acceptability for any future plants.
         For Mike's benefit, my title is Chief of the License Renewal
     and Standardization Branch, so I also have a vision to the licensing
     process of the future in the event that any of the utilities in the
     United States should choose to apply the combined license process to
     implement one of the approved standard designs.  
         Getting back to the uniqueness of this issue, the question
     that was posed for the experts in the community of fatigue was, is there
     something that should be imposed as a condition for license renewal
     because of concerns about fatigue for the period of operation from 40 to
     60 years?  And as Ed has tried to explain, when you look at the core
     damage frequency results, based on a spectrum, or even a bounding
     consideration of core damage frequencies resulting from the insights of
     this environmental effect on the facility's design for fatigue, that --
     those results clearly demonstrate that we cannot impose, as a condition
     for license renewal, that all of the fatigue calculations be revised to
     account for this environmental effect.
         However, you should also remember that the standard of
     acceptability for license renewal that the Commission established, that
     goes -- that works in conjunction with the regulatory process that GSIs
     handle with an expanding knowledge base, the standard of acceptability
     is that the aging management programs for the facility are demonstrably
         Now, using that standard and these results, and particularly
     getting to the point that Dr. Bonaca raised about how do we cope with
     this expectation that there is going to be an increased leak frequency,
     even though it doesn't have a substantial effect on core damage
     frequency, for reasons that Dr. Wallis pointed out, should be more
     clearly articulated to the public.
         There is still the expectation that the process for managing
     the plant design, for monitoring those plant locations that are
     susceptible to the things that are important to these environmental
     effects, that is, particular geometries, particular areas that are
     subject to a large number of cycles, those critical locations in the
     facility where the CUF is expected to approach or exceed 1, our
     expectation is that each utility seeking license renewal will have a
     decision standard by which, as they -- for those critical locations,
     that they will be able to make decisions about how to take corrective
     actions in a timely way in order to try and minimize the potential for
     increasing leaks in the future.
         And so what we are proposing is that, first of all, we make
     it clear that we do not intend to impose a requirement to have all the
     fatigue calculations updated for the purpose of license renewal. 
     However, we would expect licensees, on a plant-specific basis, to
     present programmatic explanations of how they are going to establish
     decision criteria for critical locations in the plant that are
     susceptible to the important factors of the environmental effects, and
     those decision criteria will be a part of their fatigue monitoring
     programs for the extended period of operation.  For both Calvert Cliffs
     and Oconee, the applicants proposed such programmatic changes, and we
     have found the fatigue monitoring programs acceptable on the basis of
     that change in behavior.
         We also point out the other arrows coming out of this box
     are that we will have to do that on a plant-specific basis -- it
     represents a process inefficiency, in my view -- until the industry as a
     whole can establish programmatic consistencies, that is, Section 11 type
     of standards for which there is an industry consensus that the process
     will find and fix, so as to try and minimize the amount of through-wall
     cracks and leakage that plants experience.
         DR. WALLIS:  Of course, I have to ask, you brought up
     plant-specific, and I should have asked at the time.  Core damage
     frequency, we keep being told is very plant-specific.
         MR. GRIMES:  That's correct.
         DR. WALLIS:  And yet we saw one graph of CDF, although there
     were seven plant types investigated.  So, really, you ought to show
     seven results of CDF because we have learned that they vary quite a lot
     between plants.  And it may be that there are certain kinds of plants
     for which the conclusion that CDF is much below some acceptable range is
     no longer valid.
         MR. GRIMES:  Well, but as Dr. Apostolakis pointed out when
     we described the Calvert Cliffs license renewal review, Calvert Cliffs
     has a relatively large CDF.  But my response to that is that it is --
     the critical locations in the plant design are modeled in their PRAs. 
     And even if they don't have a good PRA, we still have knowledge about
     what the critical locations are that are susceptible to fatigue that
     need to be managed.  And that is why I previously said that our
     understanding of the critical locations in the plant does not constitute
     -- or constitutes a basis to say that we still can't require a PRA as a
     prerequisite to license renewal.
         DR. WALLIS:  But if we were to look at, say, Calvert Cliffs'
     CDF, like this figure that we saw here, it wouldn't be the same, would
         MR. GRIMES:  No, they would be different components.
         DR. WALLIS:  It would be higher?
         MR. GRIMES:  My expectation is no, because my recollection
     is that the high CDF from Calvert Cliffs comes from an accumulation of
     things rather than a particular vulnerability.  If we were to come
     across a plant that had a particular vulnerability to leaks propagating
     to pipe breaks, then my expectation is that we would see their fatigue
     monitoring program has more work to do.
         DR. WALLIS:  There might even be special circumstances where
     they or you might have to do a PRA.
         MR. GRIMES:  That's correct.  It might be that we would have
     to look harder at the sensitivity of the PRA to some of the assumptions
     concerning pipe break -- excuse me -- fatigue critical locations.
         DR. WALLIS:  Thank you.
         MR. GRIMES:  But that would -- that is another reason why,
     until the -- your left, the lefthand side of that chart represents
     something we want to continue to pursue.  We would like to see the ASME
     take a more aggressive role in establishing a standard of acceptability
     that would cover all plants and all of their risk profiles in terms of
     the process by which plants would manage fatigue, given the data on the
     impact of environmental effects.  And that's why Mr. Craig was kind
     enough to send letter to the ASME and stimulate them in that regard,
     because until we have an industry standard that deals with environmental
     effects in a way that accounts for how to manage critical locations, we
     are going to have to continue to review this on a plant-specific basis.
         Now, I will tell you that the industry is probably going to
     not like that.  They were -- the acceptability of the programs for both
     Calvert Cliffs and Oconee was, well, we will make these changes to our
     program unless GSI -- the resolution of GSI-190 gets a better deal. 
     And, obviously, the better deal that they were hoping for was that we
     would say that these CDF results constitute a basis for 60 years, like
     it did for 40 years, for taking no action in the fatigue design and
     maintenance of the plant.
         But, as I said, when we look at this from the point of view
     of the standard of acceptability being a demonstrably effective aging
     management program, we just find it difficult to say that the fatigue
     monitoring programs that are in place today are demonstrably effective,
     given this experience and the potential for approaching CUFs, or
     approaching fatigue damage, depending on whatever ends up being the
     decision point.
         But I do believe that even though they will say that that
     constitutes a regulatory burden that they will question.  I also expect
     that it is one that they aren't going to fight a whole light about,
     because, as a practical economic matter, the utilities are not going to
     want their plant susceptible to unscheduled shutdowns to fix water on
     the floor.
         DR. WALLIS:  But whether it is a necessary burden is
     something you guys will decide.
         MR. GRIMES:  Well, we have determined that it is a necessary
     burden that they should have an adequate economic motive to make
     commitments to programmatic changes.  And I think that at this point we
     think that the continuing work that is going on with the ASME, and all
     of the work that will eventually go down to the bottom of that chart,
     which is an eventual generic resolution, and a systematic way to manage
     plants, that that will ultimately be the solution, but that until then,
     we are going to continue to evaluate it on a plant-specific basis, and
     that is our proposed resolution.
         DR. BONACA:  One consideration that can be highlighted with
     the licensees is the fact that this data shows that the initiator
     frequency is going to increase for leaks and breaks, as simple as that.
         MR. GRIMES:  Yes.
         DR. BONACA:  So the CDF is maintained at that level because
     of mitigation capability of the plant and other considerations.  But the
     fact is that the frequency of initiators is going to be increased unless
     certain programmatic initiatives are made of the type we saw for BG&E. 
     That is an important insight, I believe, because, again, you know, to
     me, to know that you have a category of initiators that increases raises
     questions regarding the uncertainty associated with the results of the
         MR. GRIMES:  That's correct.  But, you know, to take the
     counterpoint, to take the industry's perspective, you know, when we
     originally entered into this dialogue with the industry, the point that
     they raised is that, well, leak before break is a design feature, and we
     have processes for finding and fixing.  And so, from the standpoint of
     trying to minimize the amount of commitment that they would make, the
     original arguments went along the lines of, well, we know that there are
     other things that are going to cause cracks to propagate and for leaks
     to occur, and there are margins in the plant design more associated with
     CDF than the individual fatigue calculations, that those margins are
     sufficient and that we will, as knowledge grows in the future, that they
     have their process for changing their programs, and they would prefer to
     put those off, obviously, because that doesn't represent as much of a
     financial commitment at this point in time.
         When we make a license renewal finding, we are basically
     binding the commitments in terms of how the plant design is going to be
     managed, and that represents a financial commitment that they are now
     projecting for the next 35 years.  So if I spend an extra $100 a year,
     you know, to do something on license renewal, or, better yet, how about
     if I am going to spend another $100,000 a year for this particular
     program, and then run that out 35 years, all of a sudden they are
     getting dicey in a deregulated environment.  So, you know, the
     trepidation and the concern of the industry are understandable.
         But, as I said before, there is a lot to be said for simply
     pointing out that we don't see the need to impose a requirement that all
     the fatigue calculations be redone.  We are focusing on the critical
     plant locations where we know fatigue is susceptible, and we are looking
     for a decision standard that is going to find and fix those things
     before they turn into leaks, and we think that there is adequate
     justification to do so.
         DR. SEALE:  At the risk of stirring the ant bed back up,
     though, and this is a question that I should ask everyone, not just you,
     Chris, with this issue, we shouldn't be enthralled to just the license
     renewal question.  If you go through the ASME process and get
     environmental assisted cracking data put into the code case, since the
     indication is, as I understand it, that these things show up
     significantly different at 30 years, presumably, this could have some
     impact on the aging management programs for existing plants, whether
     they go for plant -- for license extension or not.  So, is that correct?
         MR. STROSNIDER:  This is Jack Strosnider, and let me take a
     shot at answering that question.
         DR. SEALE:  Okay.
         MR. STROSNIDER:  It is a good question.  If you go back to
     the bar chart that showed the leak frequencies in air versus water,
     using air versus water curves, you see that there is really not that
     much difference between 40 years and 60 years, for some of the
         DR. SEALE:  Yes, yes.
         MR. STROSNIDER:  For some of the components.  Right.  So we
     saw that result and said, well, what does that mean in terms of 40
     years?  And I think -- so we went back, actually, and took a look at
     what we told this committee and the world when we closed out the earlier
     GSIs.  And there is a very interesting point that comes out there, and I
     want to preface it by saying that these probabilistic assessments are
     intended to be realistic, all right, and I think that is the right way
     to do probabilistic risk assessments.
         However, there is a conservatism in what we are looking at
     here in that the cumulative usage factors are design calculations,
     analyses of record.  When we looked at this under the earlier GSIs, and
     went in and actually -- and John Fair mentioned -- got specific data on
     what the actual loads were at the plant, how many cycles, what their
     magnitude were, and actually calculated usage factors based on the real
     history of the plant, it turned out that there is a lot of conservatism
     in those design basis calculations.
         So that when we are talking here at 40 years, there is an
     assumption that you are at a certain cumulative usage factor, when, in
     reality, the plant could be much less than that.
         DR. SEALE:  It hasn't been banged that hard.
         MR. STROSNIDER:  Right.  That is exactly right.  And, in
     fact, there was also some monitoring, some of the plants have fatigue
     monitoring systems in-place, and a look at that confirmed that also.  So
     there is a -- when you are tieing these probabilities of leak to usage
     factor, there is a conservatism in indexing yourself to where am I
     really at with regard to usage factor.  And our expectation is that the
     usage factors are not -- they are not nearly as high as what you would
     get from the design basis calculations.  So that was one of the major
     observations from the earlier GSIs.
         However, you need to ask yourself the question, well, what
     if I am wrong, all right, and what if there are some locations where the
     usage factor is high and the leak frequency goes up?  And, first of all,
     you have the risk input then, which indicates that from a core damage
     frequency perspective, it doesn't contribute significantly.  And then
     you also have to consider that there are programs in place for leakage
     monitoring.  There are corrective action programs.
         Mention was made earlier of the Oconee leak a few years ago. 
     And if you look at what happened in response to that sort of thing, all
     of the B&W owners got together, those locations were being inspected. 
     The thermal sleeve, which was contributing to part of the thermal loads
     there, were being inspected.  So you rely to some extent on our
     monitoring and corrective action programs.  The oversight process is
     being put in place.  You know, this is one of the things that would be
     monitored.  So we have to acknowledge we rely on that also.
         When you go, though, from 40 to 60 years, and it is just,
     you know, common sense, the usage factors are getting higher, all right,
     so the likelihood that these sort of analyses will become more realistic
     certainly become greater as you go in 40 to 60 years.  And so I think
     from a technical perspective it makes sense that we ought to be looking
     harder when we go past that 40 year mark, and just again from a license
     renewal perspective.
         From a regulatory perspective, Part 54 already has in it a
     requirement to show that actions have been or will be taken to manage
     defects of aging.  If through-wall cracking is an effect of aging, the
     rule would say you need to do that.  And, so, in terms of backfitting,
     we are not suggesting changing the rule, it is already in the rule.
         In terms of a realistic approach to this, as Chris pointed
     out, not suggesting that people need to redo all their fatigue
     calculations.  And, in fact, I think that we have seen some in from the
     two plants so far is a fairly reasonable approach in which they monitor
     the critical locations in the plant, those that have the highest usage
     factors, considering environmental effects, right.  And they use -- they
     monitor those, they will do inspections appropriately, and if something,
     you know, shows up there, then that will go into the corrective action
     program to see what you do for the rest of the plant.
         And, finally, as was indicated, there is an financial
     incentive, and Dr. Seale mentioned earlier, too, the concerns about
     contamination and you don't want leaks.  So licensees clearly don't want
     leaks, they don't want an unscheduled outage.  They don't want to have
     to deal with contamination, and so there is a motivation there.  And I
     think, again, that supports the solution that we are recommending.  So,
     hopefully, that is helpful.
         MR. GRIMES:  I also want to go back to a related point in
     Dr. Seal's comment, and that is I want to remind you that the license
     renewal process is founded on the basis that the current licensing basis
     carries forward through the period of extended operation.
         DR. SEALE:  Yes.
         MR. GRIMES:  The reliance on the regulatory process to have
     an associated -- find problems and fix them, we see a wide variability
     in the licensing basis for each plant.  Some plants have experienced
     events and they have changed their design.  They have -- some plants
     have more burdensome fatigue monitoring programs simply because they
     have had to cope with a particular problem, some others may not.  But
     that is a part of the regulatory process that has led to maintaining
     those license bases with those requirements.  Some plants have imposed
     it on themselves to go above and beyond their licensing basis because of
     an interest in maintaining their plants.
         So to the extent that there is an impact of this activity on
     plants, regardless of license renewal, that is very true, regardless of
     whether or not we take any regulatory action.
         DR. SEALE:  Okay.
         MR. GRIMES:  So, but what it boils down to is we are
     proposing to you that the resolution of GSI-190 will be that we will
     continue to seek plant-specific ways to address the environmental effect
     in changes in the fatigue monitoring program until such time as we are
     in position to endorse a consensus standard that will achieve that end. 
     Thank you.
         DR. SEALE:  Are there any other comments from the staff? 
     Any questions of the members?
         [No response.]
         DR. SEALE:  Mr. Chairman, I pass it back to you.
         DR. POWERS:  Yes, I just --
         DR. SEALE:  I would appreciate an opportunity to get any
     inputs from the members as to what they would like to see in a letter at
     some point today.
         DR. POWERS:  We will try to have some discussion of that
     probably later in the day.
         DR. SEALE:  All right.
         DR. POWERS:  I will reiterate my interest in understanding
     and having some guidance on how I can better understand the PRAISE code
     and its level of validation and verification, simply because I know you
     will be down here with other issues in the future that make reliance on
         With that, I will recess for 15 minutes.  We will have until
     25 after the hour, I guess.
         DR. POWERS:  Let's come back into session.  Our next topic
     deals with the ATHEANA program, and I will bet you that somehow,
     someplace, I must have a conflict with something to do with this code,
     but I will be darned if I know what it is.
         With that introduction, and a warning to the members to be
     cautious about anything I happen to say for or against this effort, I
     turn it over to you, Dr. Apostolakis.
         DR. APOSTOLAKIS:  Thank you.  We have a subcommittee
     meeting, the Human Factors Subcommittee meeting almost a couple of weeks
     ago, where we had a presentation by the staff and its contractors on
     ATHEANA.  And there were several issues that the members present raised,
     and we are hoping that today's presentation will address some of those.
         Everyone was concerned that the methodology appears to be
     too complex, and to the point where it may discourage potential
     practitioners from even trying to learn what it is all about, leave
     alone using it.
         DR. POWERS:  Well, I think saying everybody was concerned,
     it certainly was not my response to it.  The level of complexity
     involved in ATHEANA surprised me, but then I said, gee, in the
     phenomenological area, we frequently create computational vehicles that
     are complicated, not intended for general use, but they are very useful
     for us to understand how to simplify things down to address the hard
     questions that the simpler, more routine tools just aren't any good for.
         DR. APOSTOLAKIS:  Yeah, I didn't want to imply that there
     aren't any situations where the full ATHEANA should not be used.  I
     think the concern was that there didn't seem to be a screening process
     identifying the human actions that really deserve this treatment and
     something smaller for other actions that perhaps can be handled
     satisfactorily using simpler methods, or a simplified version of ATHEANA
     itself, I mean it is not -- but, certainly, you are right.  I mean there
     are certain situations where you really have to do this, and the idea
     that human reliability analysis should be done quickly and simple
     methods is certainly not one that I would espouse.
         MR. BARTON:  Well, also, George, I think that licensees have
     some process or system in place for analyzing human performance issues. 
     And if you come out with something that is going to be, you know, if
     they consider -- I hate using this, or a burden, I am getting tired of
         DR. APOSTOLAKIS:  Yes.
         MR. BARTON:  But something that is going to require a lot of
     effort, that they are going to be discouraged by it, that is my issue.
         DR. APOSTOLAKIS:  Now, the -- and, by the way, the same
     issue arose several years ago in another context.  There was a very
     elaborate methodology that was developed for the utilization of expert
     opinions in probabilistic seismic hazard analysis, and a major criticism
     was exactly the same thing, that you expect us to do this for every
     building, every -- you know, DOE was involved and, you know, they have
     lots of buildings that are not reactor related.  And there was an
     attempt to develop a scheme that says, you know, under these conditions,
     perhaps having, you know, one guy calling up people and getting views
     and putting it together himself is going enough.  In other situations,
     you have to go to a more complex situation.
         So I think there are analogies, and the issue has been
     raised in other contexts, and maybe it will benefit by looking at what
     happened there, because not every issue deserves this full blown
         The other area where there was concern, especially by the
     former utility members, was the example, the fire initiated example, and
     I am glad you said that you have more detail today, where Mr. Barton and
     Mr. Sieber expressed the view that the didn't see the results of ATHEANA
     being much better than what one would have gotten by using simpler,
     presumably simpler methodologies.  So perhaps it was just the
     presentation that didn't do justice to the work, I don't know, but we
     certainly would like to see more examples, not today necessarily.
         I would these were the two major issues that were raised,
     and maybe you can address them today, and we can address them as we go
     along.  The staff told us that they were not requesting a letter,
     however, the subcommittee felt that the issues were important enough
     that writing a letter is something that the committee may want to
     consider.  And on that happy note, I will turn it over to Mr.
         MR. CUNNINGHAM:  Thank you, sir.  I am Mark Cunningham from
     the PRA Branch in the Office of Research.  With me today is Dennis Bley,
         MR. BLEY:  Buttonwood.
         MR. CUNNINGHAM:  Buttonwood, Incorporated, one of the
     contractors involved with the development of ATHEANA.  Catherine
     Thompson, who made some of the presentation at the subcommittee meeting,
     is unavailable, unfortunately, for today, at least unfortunately for me.
         And there are four parts to the presentation today.  I have
     some introductory slides on why we did this, and that sort of thing.  I
     will talk a while about the structure of ATHEANA, what is in this method
     for human reliability analysis.  We will talk a bit about the fire
     application.  There was one demonstration analysis using ATHEANA.  And
     then come back and say where we think we are and where we think we need
     to go with one ATHEANA.
         At the subcommittee meeting we discussed a number of things
     that were of concern to the subcommittee, which I think were of concern
     to us as well, quantification, you know, the issue of how -- what is the
     role of this approach for human reliability analysis in the broader
     context of PRA and HRA, and that sort of thing.  And we will touch on
     those at the end, I guess.
         By way of introduction, I guess I wanted to talk about a
     couple of the issues that relate to some of the heritage, I guess, or
     mythology that has come along with ATHEANA over the last five years or
     so.  One of the questions that comes up is, well, why do we need a new
     HRA method?
         And what inspired us to begin what became the ATHEANA
     program was that there is an inconsistency between what we see happening
     in serious accidents in complex technologies, not just nuclear plants,
     and how we see human performance occurring in that complex -- in those
     complex technologies, and what we see coming out of PRAs and HRAs,
     current -- the present generation or the first generation or HRAs.
         It concerned us that the types of human performance and
     human errors that were coming out of -- or that we saw from bad
     accidents were not being treated.  So that was, if you will, the
     fundamental reason for beginning this work, that we think we needed to
     get HRA closer to the real world, if you will, that we see in serious
         The question then becomes, okay, well, now that we have done
     a fair amount of work on ATHEANA, how does it fit it or what can it
     contribute?  This was the subject of some confusion in the subcommittee
     meeting, I believe.  Again, there is some -- over time there has been
     the idea or perception that ATHEANA was the answer to every HRA question
     that came up, and we have heard that back to us.  Well, why, you know,
     why do you need to use ATHEANA for all kinds of things?
         In this we tried to at least start the dialogue and saying
     that it is not the tool for every HRA application in PRA.  There are a
     class of human errors, pre-initiators.  There are lots of way to do that
     today that are probably perfectly adequate.
         DR. WALLIS:  That goes back an awful long way,
     pre-initiators.  I mean it could be some fault traceable to an NRC
     regulation or to some designer's decision 40 years ago.  If you really
     look back, everything pre-initiating, that is an issue, an error pretty
         DR. APOSTOLAKIS:  No, this is -- Graham, this is the jargon
     of the experts.  Pre-initiating --
         DR. WALLIS:  Yeah, that is what is bothering me.  Yeah.
         DR. APOSTOLAKIS:  Pre-initiating, they mean before an
     initiating event, and they specifically refer things like routine
     maintenance, testing, and people forgetting to reclose valves or open
         DR. WALLIS:  These are in the short-term, the short-term.
         DR. APOSTOLAKIS:  Yeah, they are routine operations.  Yeah. 
     Now, if there is an error that is latent somewhere there because of some
     action by the NRC of 20 years ago, no, that is not what --
         DR. WALLIS:  But human errors, I mean eventually they blame
     the parents of the person who made the error.
         DR. SEALE:  Well, this is more like this Waterford thing,
     where you left a valve unclosed.
         MR. CUNNINGHAM:  Yes.
         DR. SEALE:  And then later when you wanted RHR, you opened
     up a valve and lost, what was it, 7500 or whatever the number was,
     gallons of water.
         DR. APOSTOLAKIS:  Well, at Three Mile Island the auxiliary
     feedwater system drains, the valves were closed for a few minutes as a
     result of, you know, negligence after the test.  But these are the kinds
     of things they are referring to.
         MR. CUNNINGHAM:  Yes, that's right.  In HRAs, you are right,
     there is a jargon that we are applying here that we tend to block the
     types of human errors that can occur in three different types.  One,
     things happened before the event, as we were talking about.
         MR. SIEBER:  Set up.
         MR. CUNNINGHAM:  There are human actions that can be taken
     that can cause events.  Typically, you know, somebody can, in the case
     of the Waterford event, it may be, well, somebody decided to open this
     valve and it may have been the right valve to open or not, but under the
     circumstance, it wasn't the right thing to do.  That caused an event to
         And then you have got the post-accident, or post-initiating
     event human actions, to either recover from the accident or from the
     event, or to exacerbate the event and make it worse.
         DR. SEALE:  Yeah, but, Mark, there has to be a distinction
     on that second event.  If the operator had every expectation that
     opening that valve would do what he was sent to do, namely, to initiate
     RHR, the fact that he opened the valve and got sandbagged is not an
     operator error.
         MR. CUNNINGHAM:  This is a key point within the context of
         DR. SEALE:  Yeah.
         MR. CUNNINGHAM:  Is exactly this.  That one of the things
     that ATHEANA does is bring the circumstances of the moment into play in
     terms of assessing how the human performance.  And you are right, you
     can call that a -- we don't, we try to get away from calling it a human
         MR. BLEY:  Yeah.
         MR. CUNNINGHAM:  Because the operator in that circumstance
     did what he thought was the right thing to do, it just turned out to be
     unsafe.  So we get -- and we will see some of the lingo in here we
     talked about.
         DR. APOSTOLAKIS:  Why didn't you change this slide 2,
     pre-initiating unsafe acts, post-initiating unsafe acts?  Would that be
     better, or human failure events?
         MR. CUNNINGHAM:  Human failure.
         DR. APOSTOLAKIS:  I really don't -- I must say I still am
     confused what the difference between an unsafe act and human failure
     event, but --
         MR. CUNNINGHAM:  One of the issues at the subcommittee that
     human -- differentiation between human errors, human failure events,
     unsafe acts and that sort of thing.
         DR. APOSTOLAKIS:  Now, the human error, I agree with you, I
     mean we should drop it.  But maybe here also --
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  -- we should start talking about
     post-initiating unsafe acts -- initiating event, unsafe --
         MR. CUNNINGHAM:  Yes.  This, the presentation really doesn't
     help explain those three terms very well in retrospect.
         DR. APOSTOLAKIS:  Now -- I'm sorry, go ahead.  The human
     induced initiating events, this is something you added since the
         MR. CUNNINGHAM:  That's correct.  This was based on the
     discussion that we wanted to do two things.  We wanted to clarify some
     of the roles of ATHEANA.  That we could see that ATHEANA -- we were
     thinking of it and talking about it in terms of mostly in the post event
     recovery actions.
         DR. APOSTOLAKIS:  That's correct.  Now, you say ATHEANA can
     be used, what does that mean?  It can be extended probably, because you
     would probably need to do a little more than just what you have now,
     don't you think?
         MR. BLEY:  I am Dennis Bley.  Maybe in some cases, but if
     you look in detail at the first search that we have, and Mark hasn't
     gotten to that yet, after we identify the functions that, if they go
     wrong, will cause us troubles, one of the things we ask, is there some
     way the operator could have caused these?  And in that sense, we do
     search for human induced initiating events or set-ups to the initiating
         DR. APOSTOLAKIS:  No, but what bothers me -- not bothers me,
     what I think will be an issue, a technical issue, is that you do now,
     the post-initiator analysis, as you will tell us later, you do have a
     base case scenario and then you look for deviations.
         For the second bullet, I am not sure that you will have a
     base case scenario.  In other words, you are looking now all over the
     place, I mean look --
         MR. BLEY:  If I could?
         DR. APOSTOLAKIS:  Yeah, sure.
         MR. BLEY:  The way we tried to structure the base cases is
     that those are situations that occur that are functional things that
     happen to the plant.  And then we look for deviations from those, and
     then we look how the operator interacts.  Given it is some functional
     occurrence, the fact that we then ask, could an operator have caused
     this functional occurrence, is a structured way to cover this second
     bullet.  Now, there might be others beyond that, but I think you still
     have to enter through some functional problem or it is not really an
     initiating event.
         DR. APOSTOLAKIS:  That's where I think the challenge will
     be, you know, what you have been doing, and everybody else has been
     doing up until now, project ATHEANA, there is this functional
     disturbance of something, so you know where you start.
         MR. BLEY:  That's right.
         DR. APOSTOLAKIS:  If you are looking for something like what
     happened at Wolf Creek, where they postponed some action from Friday to
     Monday, and then it just so happened that the combination of two
     processes, you know, led to the path, it seems to me that is something
     that comes out of the blue.  I mean you don't have anything that will
     lead you to think about this kind of context.
         DR. KRESS:  In fact, you have an infinite number of
         DR. APOSTOLAKIS:  You have an infinite number.  So in that
     sense I think ATHEANA will need to be extended in some way, because this
     is a fundamental assumption, that, you know, there is something has
     happened already and then we look at base case.
         MR. BLEY:  I guess one last thing I would say on that, and I
     won't claim we have covered it completely, is when we look for context
     for a human unsafe act, and if turning this valve was the unsafe act,
     unsafe not on purpose, but it turned out that way, we look for
     conditions that might have set that up.
         DR. APOSTOLAKIS:  Yes.
         MR. BLEY:  Could valves have been mispositioned?  And in
     that way, as elements of context, we do look back at pre-initiating
     human errors.  Is there something the operator could have done to set up
     the context for this?  Will it be complete?  Probably not.  But at least
     there is an effort to look for that in the context.
         DR. APOSTOLAKIS:  No, I know, I recognize that.  All I am
     saying is it is going to be much harder for the second bullet than it is
     for the third, because of this openness.
         DR. WALLIS:  If you look at -- I don't know how far back,
     you look at something like TMI, there is all kinds of things that
     happened before the event.  There were other events they had failed to
     learn from.  Is that a human error?  There were valves allowed to leak
     progressively over a period of time.  All kinds of things happened over
     many months before the real accident.  Do you include them as human
     errors, initiating?
         MR. BLEY:  I would say that when we do the search George was
     talking about, from the initial functional disturbance, and then we look
     -- well, when we lay out the base case scenario, look for variations in
     that, these deviations, and look for the context.  We are, and we say
     you really need to do this in the plant, with the plant people, with the
     operators there who know their training, they know their set-up.  They
     know if there is a certain set of equipment that is often, you know,
     having problems with, this whole background, so we try to look for that
     in the context search part of this process, and that is the way it does
     come in.
         And sometimes it goes fairly far back, all the way back to
     training and what we expect the operators to know.  There are good
     reasons for the way it is set up.  But if the right situation occurs,
     something is going on they really know about or no one has analyzed
     before, that is the sort of thing we are looking for, for ways the
     scenario can take them to places we never expected them to go, so we
     didn't train them, or we didn't do the analysis already to be able to
     tell them what to expect.  So there is an effort to find those kinds of
         I think the four examples that are in the report we gave you
     give some of those kinds of cases worked out, especially the small LOCA
     one, I believe.  I don't think that showed up in the fire case that we
     presented at the subcommittee.  I'm sorry, Mark.
         MR. CUNNINGHAM:  That's all right.  Again, part of the
     context, part of the point of this slide is to follow up on what -- some
     of the subcommittee comments, that we need to better define the role of
     ATHEANA, ATHEANA-type analyses in the broader context of HRA, and I
     think this is a first piece of it, but there are other pieces as well. 
     I think we do that.  And I think we acknowledge that there is lots of
     areas where ATHEANA is not the right tool to use.
         DR. APOSTOLAKIS:  You know, it wouldn't hurt at some point,
     when you have time that you don't know what to do with, to go back to
     THERP.  You are referring to the handbook, right?
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  I think that in the handbook there is much
     more emphasis on the performance shaping factors than on context,
     although some of the elements that they call PSFs, perhaps we would call
     now elements of a context.
         It wouldn't -- although I think most people are happy to use
     THERP and so on, it wouldn't at some point to go back with the ATHEANA
     perspective and see whether there are any major issues there that may be
     lying dormant, although that is not something that I think is urgent
     compared to the other two bullets.
         MR. CUNNINGHAM:  Okay.
         DR. APOSTOLAKIS:  I think most people are really happy.  I
     haven't heard anybody really objecting to using THERP in routine kinds
     of actions, unless you know something that I don't know.
         Can we go on to 6?
         MR. CUNNINGHAM:  Certainly.
         DR. APOSTOLAKIS:  Slide 6.
         MR. CUNNINGHAM:  Anywhere you like.
         DR. APOSTOLAKIS:  Finish my noon, Mr. Chairman?
         DR. POWERS:  Well, you are supposed to finish by 11:45, but
     I will you go to noon.
         DR. APOSTOLAKIS:  We started late.
         DR. POWERS:  That is your problem, not mine.
         MR. CUNNINGHAM:  Three objectives of ATHEANA we have got,
     are on this slide.  Basically, again, we want to try and capture a tool
     for -- or develop a tool that reflects or builds into human reliability
     analysis, our understanding of the human performance that we see in
     serious accidents.  As a fundamental, that is what it is.
         We can do that in a qualitative way and in a quantitative
     way, and there are qualitative applications of ATHEANA that go well
     beyond the traditional PRA, and we will touch on some of those later.
         DR. KRESS:  Now, if I were to rephrase that first bullet and
     said develop the probability that the operator will make the wrong
     action when directed to make an action or -- is that what you mean by
     quantitative tool?
         MR. CUNNINGHAM:  Yes, quantitative in the probabilistic
     sense, that sense.  I am not sure I understood --
         DR. APOSTOLAKIS:  It depends what you are after, Tom.
         DR. KRESS:  The probability he will not carry out the action
     or that he will do the wrong action.
         MR. CUNNINGHAM:  Yeah, we don't --
         DR. APOSTOLAKIS:  That he will do something that will turn
     out to be unsafe.
         DR. KRESS:  That he will do something --
         DR. APOSTOLAKIS:  Maybe an omission.
         MR. CUNNINGHAM:  Or not do something that would be --
         DR. APOSTOLAKIS:  Yeah.
         DR. KRESS:  It is not restricted to just saying you have an
     emergency operating procedure, that what is the probability he will do
     an action that is directed there?  What is the probability that he won't
     do it?  Is that what --
         MR. CUNNINGHAM:  Correct.  It is broader than that.
         DR. APOSTOLAKIS:  They are doing both.
         DR. KRESS:  Both of them.
         MR. CUNNINGHAM:  Yes.
         DR. KRESS:  Both of them.
         DR. APOSTOLAKIS:  That is they refer to them as unsafe acts.
         DR. WALLIS:  When you say reflected, in your world of
     accidents, you mean is verified by a base of experience, observation and
     why you might even call data?
         MR. CUNNINGHAM:  You might have called it data, yes, sir. 
     Yes, that's right.  Yes, that's right.
         DR. APOSTOLAKIS:  Okay.
         DR. KRESS:  That last bullet on there, it is sort  -- so
     general, I am not sure what it means either.
         DR. WALLIS:  That is the philosopher's stone.
         DR. KRESS:  Yes.
         DR. WALLIS:  That is the universal --
         MR. CUNNINGHAM:  Yeah, okay.  There was a context here of
     you are applying ATHEANA to issues, narrowly defined issues, if you
     will, as opposed to applying it broadly across a PRA.
         DR. KRESS:  I see.
         MR. CUNNINGHAM:  That was the distinction we were trying to
     get at there.
         DR. KRESS:  If you had an accident evaluation team, and they
     had some issue, you might just function on one action or something like
         MR. BLEY:  Exactly.  And we are not saying -- maybe you
     don't have to go back and redo your whole HRA with ATHEANA, but if some
     issues come up where you are really worried about these contextual
     things, you can apply it right to those.
         DR. KRESS:  I see.  I understand now.
         MR. CUNNINGHAM:  We will turn now to more of the description
     of what ATHEANA is.  Again, we come back to the point that, when you
     look at serious accidents in complex technologies, you can see a pattern
     of unsafe acts occurring.  Operators in these facilities get into
     situations or conditions that they don't fully understand, and it
     compromises their ability to make safe decisions, if you will.  So the
     goal here is -- one of the goals is to be able to deal with that
     prospectively, in a PRA context, to be able to say, okay, how can we can
     kind of see, ahead of time, what would seem to be the more likely
     circumstances that can lead to this, and the likely causes of this
     confusion, if you will?
         DR. APOSTOLAKIS:  Now, Mark, this statement of scenarios and
     conditions not understood by the crew, I wonder whether instead of not
     understood, it would be better to say that these are scenarios and
     conditions that mislead the crew.  Not understood is like human error,
     it carries with a little bit of blame.
         MR. CUNNINGHAM:  Okay, yeah.
         DR. APOSTOLAKIS:  Misleading is, you know, again,
         DR. KRESS:  Not as expected by the crew.
         DR. APOSTOLAKIS:  In other words, are they expected to
     understand these and they don't understand them, or are they really
     misled to think that something else is happening?
         MR. BARTON:  That is a good distinction.
         MR. BLEY:  Yeah.
         DR. APOSTOLAKIS:  And I think that is what you mean, Dennis,
     don't you?
         MR. BLEY:  Well, yes, but there is also some of both in
         DR. APOSTOLAKIS:  There is some of both.
         MR. BLEY:  When you look at the really bad accidents, you
     know, in the nuclear business, TMI and Chernobyl, really bad ones, when
     you look at accidents in the aircraft industry and shipboard, you find
     in these really bad accidents, either people get themselves in a spot,
     or the machine gets them in a spot that they haven't studied before.  So
     that they get in a spot where they are misled, thinking what they
     already know applies, when it doesn't, and that has come up a good many
         And I think when we have described those to operators from
     nuke plants and from other industries, real examples and walk through
     the example, what almost always happens is they say, yeah, and let me
     tell you two other ones that I know about that are just like that.  So
     it seems to be a little of both.
         DR. APOSTOLAKIS:  i agree when it comes to retrospective
     analysis, and you guys have --
         MR. BLEY:  That is what this was talking about.
         DR. APOSTOLAKIS:  Yes.
         MR. BLEY:  Since we find that in retrospective analysis, we
     want to focus on those kind of things.
         DR. APOSTOLAKIS:  But what -- my point is that when you
     switch to a prospective analysis, and you do what the second bullet
     says, --
         MR. BLEY:  Okay.
         DR. APOSTOLAKIS:  -- you are really looking more for context
     that may be misleading.  Because how can you try to find things that,
     you know, you have claimed that they will not understand them?
         MR. CUNNINGHAM:  No, that is fair.  You're right.
         DR. APOSTOLAKIS:  I mean you look at the procedures.
         MR. BLEY:  But we also do that deviation.  We say, given
     this basic plain scenario, how am I to move faster, slower, all these
     things?  And sometimes when you do that, out of that pops one of these
     cases that, for reasonably good reasons, we have never studied.  So you
     do find some of those.  And that is why we like that search, because,
     finally, even though, you know, in the past we saw those in real events,
     we had trouble guessing them ahead of time.  That HAZOP sort of search
     seems to develop some.
         There are reasons why you might not thing they are
     important, but they come out of it.
         DR. APOSTOLAKIS:  And I agree.  But maybe then, how about if
     we say when the plant enters in areas and conditions, either not
     understood by the crew or --
         MR. BLEY:  Or anybody.
         DR. APOSTOLAKIS:  No, no.  Or maybe misleading the crew.
         MR. CUNNINGHAM:  Yes, that is better.
         DR. APOSTOLAKIS:  I think that would be a fair description.
         MR. CUNNINGHAM:  So, at any rate, basically, in order to try
     to deal with this, we identified a set of search schemes, if you will,
     to work and identify how these deviations may develop.  We will talk
     about those.
         Now, basically, the next two slides cover the three parts of
     our search schemes, if you will.  One is you develop a base case
     scenario, and, as we talked before, it is kind of a functional -- a
     description of the events that would occur based on a functional
     understanding of the progression of the operations at the plant at that
         You then look for what we call vulnerabilities, and on the
     next slide on deviations, there are places where you can go off-track,
     if you will, either be misunderstood, misunderstanding something, being
     misled, that sort of thing.
         I won't spend much time on these.  It is basically a process
     for identifying places where you can go awry.
         There is four search schemes that we have built into the
     ATHEANA model as in the report that you have got.  Basically, Dennis
     talked about one already in the sense of deviations from the base case
     using HAZOP types of methods to search for keys that would identify
     different types of -- that may introduce new scenarios or different
         You look for things like informal rules in the plants that
     guide how the operators perform under certain circumstances.  You look
     for deviations caused by subtle failures.  You have issues such as
     instrumentation concerns and that sort of thing.
         And then the last one is you can get into -- identify
     deviations where the operator tendencies and things like that come into
         DR. APOSTOLAKIS:  Isn't this now the major contribution of
     ATHEANA literature?  I mean this is really where you guys differ from
         MR. CUNNINGHAM:  I think clearly --
         DR. APOSTOLAKIS:  Not in the sense that you introduced the
     idea of context, but I mean you are making it a systematic --
         MR. BLEY:  I think so.
         DR. APOSTOLAKIS:  Developing a systematic approach to
     identify it.
         MR. CUNNINGHAM:  That's right.  I think the idea down in the
     heart of ATHEANA of having to reflect the situations in the plant and
     how they impact human performance, and then how to search for the
     difficult parts of that are the big --
         DR. APOSTOLAKIS:  So for those members that are not very
     familiar with human reliability analysis, this is a significant step
         Now, it can also be -- I mean if this is not well, that
     ATHEANA doesn't produce good results, this is really the heart of it. 
     We were not doing this before.  Now, these guys are telling us we have
     to do it very carefully.
         But my point is that composition of the team that does this
     is critical here, right?
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  And who will decide whether something can
     occur at a slower pace, therefore, it may lead to problems?  Because
     what I am reminded of now is the heuristics, as you know, have been
     published by Connerman and Verski, and other people, where you have
     problems with perceptions.  In fact, there was a very interesting paper
     a long time ago where there was a survey of operators to see what their
     perception was for the available time to act under certain conditions,
     and as I recall, they overestimated the time by about a factor of three. 
     So, you know, the perceptions really drive the whole thing.
         So what, if you have an operator in your team and he says,
     well, now, nobody is going to consider this as being too quick or too
     slow, how do you handle that?
         MR. BLEY:  I would refer back to -- in our earlier version
     of ATHEANA we had an example run up at Seabrook, and we spent several
     months with them, and the Seabrook staff was involved.  To make it work,
     you really need someone who is a very good integrator, who knows a fair
     amount about operations, who knows a bit of thermal hydraulics, who
     knows a lot of the PRA.
         And we had two operator trainers in that session at
     Seabrook, and I looked back through our notes and transcripts on what
     went on there, and what you usually would see happen is exactly what you
     would say.  Is one of them would say, we don't have to worry about that,
     that can't happen here.  And then we would just keep pushing and ask a
     few questions.  And eventually the other one would say, you know,
     remember that scenario we ran the simulator last year, and Charlie, do
     you remember what he did?  And all of a sudden, they would start working
     from there.  I would say, yeah, and then we did something else, you
     know, it is similar to this.
         And you have to keep them at it for a while, because there
     is a tendency to stick with what you already have conditioned yourself
     to believe.  But we have found that if you do stick with them a little
     bit, that they will work through that.  And especially, your question,
     how you get the right people.  You need the ones who are fairly creative
     involved there, who are willing to think and push.  But you have those
     tendencies, that is for sure.
         DR. APOSTOLAKIS:  So what you are saying is the lead person,
     the leader of the team should be very knowledgeable.
         MR. BLEY:  In several areas.
         DR. APOSTOLAKIS:  In several areas, which I think is
     correct, of course.
         MR. BLEY:  You need somebody, for this case where you are
     dealing with the operators, who the operators won't dismiss, you know,
     who knows a bit about their game and their procedures.
         DR. APOSTOLAKIS:  That's right.
         MR. BLEY:  And can push them into spots that get them
     thinking and accept -- or at least thinking about what that person is
         MR. SIEBER:  I think there is an advantage, too, when, in
     the ordinary course of simulator training, you do not give the classic
     accidents all the time, you vary break sizes, you vary support system
     capabilities.  And if you systematically, in the process of doing that,
     year after year, with every crew, you will be able to get at least the
     trainers' judgment of the timing of the sequence, what actually fails,
     what does not, and how the operators react to it.  And so the
     opportunity to pick up the data is there as long as people realize that
     one of the purposes of simulator training is to actually acquire that
     data.  So, really, it is not as hard as it could be.
         DR. POWERS:  Let me ask a question about the informal rules. 
     How do they ever get discovered?  Either that somebody from a particular
     plant on a team would be loathe to admit that they are there, people
     from the outside will never discover them.
         MR. BLEY:  I think they are not as loathe as you think.  If
     you spend some time talking with people about what their practice is,
     when you ask -- you know, you have a catalogue already of things you
     know people do at various plays from your own experience and others you
     have talked to, and you start telling the kinds of things you are
     thinking about, and some of these are -- almost all of them are pretty
     legitimate.  They have come about for a reason and a lot of them cover
     areas that aren't really specified in detail in procedures.  Some do,
     but some of these old ones stick around.  So it is, again, a process of
     having people from that facility involved who know what their practice
     is and who --
         DR. POWERS:  It seems to me if I was at a facility and
     somebody asked me are there any informal rules for doing things, stuff
     like that, I would say there is no upside on this for me to answer that
     in the affirmative, and there are some severe downsides.
         MR. BLEY:  I think if one comes into a utility as an outside
     and says I want to know how you are doing things that aren't -- you
     know, you are not supposed to do, which is kind of what it sounds like,
     the way you said it, they will say we don't ever do that.  And, you
     know, when you explain what you are doing, and you are working with them
     and you say, well, you know, when I was in the plant, we used to do
     these things, that is kind of what I am talking about, and here is the
     reasons why.
         If they see you as an antagonist, they will probably never
     talk to you, but if they see you as someone who is working with them
     trying to help, I haven't found that to be a problem.  And I know they
     have those, you know, so once you start talking to them, you give
     examples and they start talking about why they do.  And like I say,
     generally, there is good reasons for these things, these aren't
     clandestine hidden things.  But because they are not codified and all
     worked out, there are situations where they might not be appropriate. 
     So I haven't run into that problem, and the rest of our team has had
     pretty good success, I think.
         DR. POWERS:  I guess what I am sitting here saying, okay, he
     says he hasn't run into -- I wonder how he knows.
         MR. BLEY:  Well, if you just said, what are your informal
     rules, he won't.  But if you start saying, you know, when a pump starts
     making this kind of sound, you know, what do you do about that?  You
     have to take it down to reality for that person, that individual.
         DR. POWERS:  Maybe what they reveal to you are what they
     think -- they say, okay, yeah, it is true, every organization has
     informal rules.  We know that from a lot of writers about business
     organizations and things like that.  So I will give him these that are
     kind of innocuous and have good reasons for them.  I am not going to
     give him the ones that don't have real good reasons for them.
         MR. BLEY:  I guess there is always that danger.  When we did
     the exercise with Seabrook, the PRA folks there really invited the team
     because they had stuck with the methods they were using and were hoping
     to find something useful, so that they were pretty forward about that. 
     And before we even came, they read through the examples we had in the
     NUREG and they said, look, we have gone around and we already know some
     of these, and we have worked with the operators, we have got a revised
     set that we think are pretty true here at Seabrook.
         And, you know, they had done that ahead of time, and they
     weren't -- when you looked at them, they weren't, you know, some kind of
     polished, let's hide things kind of set, they were pretty reasonable
     things that you would expect them to have in the plant.  So it is a
     legitimate worry, but you have the same kind of problems I think with
     anything you are trying to ask a facility.  You have the same problems
     with getting data.
         DR. APOSTOLAKIS:  In this kind of scheme, because I see you
     are not going to come back to this, you are using also -- well, first of
     all, I must say this is the first presentation on ATHEANA that I have
     seen in a very long time that doesn't have that diagram, the defining
     context and so on.
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  I mean this is a milestone.  Is there any
     reason why the diagram is not used today, or is it just that things
     evolve naturally?  That is okay, Mark, you don't have to answer.  I am
     not complaining for the lack of the diagram, but it might have helped
     members less familiar with the methodology.
         But my point is this, I know that there are other approaches
     that are being developed internationally, as you know, MERMOS, for
     example, in France and some interesting work that is happening in
     Finland, where they emphasize a lot the decision-making processes.  Now,
     in your case, the way I understand, these decisions that the crew must
     make are really here, this is where you are thinking about what they are
     going to do and so on in identifying possible deviations.
         MR. BLEY:  Primarily the first two searches.
         DR. APOSTOLAKIS:  Exactly.  But you don't seem to really
     emphasize the decision-making process investigated.  I mean you are, of
     course, taking into account possible deviations, but not in the sense
     that you think it deserves a section or a chapter.  And we had the
     comment last time from Mr. Barton that he was disappointed that the
     safety culture of the facility did not seem to be reflected anywhere. 
     And I think the safety culture, for example, will become important when
     you have to prioritize things like the Davis-Bessie incident.  You know,
     is it economics that will drive the decision or safety?
         And perhaps by looking at the decision-making processes a
     little bit more formally, you can expand this part of the analysis,
     because it certainly belongs here.  I mean it is not that it is an
     entirely new idea.  And maybe bring some of the cultural issues and
     other things that may apply which brings up another issue, the timing
     issue.  I think these things will be different if the operators have to
     respond in 15 minutes, than if they have -- if you are talking about
     actions take place an hour-and-a-half later, but I am sure you have that
     somewhere, the timing.
         MR. BLEY:  Yes.  I don't want to throw numbers at you, but
     step 5 in the ATHEANA process is the one where you identify, you know,
     kind of the set-up in the plant.  You identify what is going on in the
     culture.  How do they normally handle this?  There is a section just on
     the timing of the base case, and we talk about how deviations affect
         DR. APOSTOLAKIS:  The timing.
         MR. BLEY:  So those kind of things are covered in that sort
     of set-up stage before you do the searches.  And the way I have talked
     about, I think we did in the report, what we have found doing the
     analysis is you get notes on all of that and you kind of stick them up
     all around you, while you are doing the search, you are checking these,
     including those tendency things we talked about.  You know, what if
     parameters go one way, what does training and all these things maybe
     tell you to do about that?  So all of that set-up material is organized
     in a pre-search step.
         DR. APOSTOLAKIS:  All I am saying is that in some situations
     where you really have a decision-making situation, because most of the
     time, really, the decisions are either trivial or people do it because
     they are trained to react in a certain way.  But there may be instances
     where you have, you know, a major decision, again, go to bleed and feed
     or not.
         A more formal look at that might help you structure this a
     little better.  It is not that you are not using any of that in here. 
     You are already using a lot of it.  But I think a more formal approach
     might reveal things that -- or may make life easier in identifying
     things, that's all.
         MR. BLEY:  That might be.  In fact, you know, what we call
     response planning is, in fact, --
         DR. APOSTOLAKIS:  That is where most --
         MR. BLEY:  They are making the decision.
         DR. APOSTOLAKIS:  Exactly.
         MR. BLEY:  And thinking through what you are going to do
     over the next step.  So it is there.  And we have certainly studied what
     MERMOS is doing, and the others, and they are paying close attention to
     that.  In fact, we are communicating with them very closely.
         MR. CUNNINGHAM:  Yeah, I was going to say a couple of
     points.  One is when we get back to the back on where we go from here, I
     think the issue of -- you can safety culture or work processes, or all
     those sorts of things, I think is something we understand could be a
     valuable addition to what we are doing here, so it is on our list of "we
     would like to do" type of things, again, part of our understanding of
     that and bringing that in, because we have interactions, a good bit of
     interactions with the people developing the other methods around the
         DR. APOSTOLAKIS:  Finland is doing some pretty interesting
     stuff.  I mean I saw some papers, there is some very nice stuff going on
         MR. CUNNINGHAM:  And we talked about it at the subcommittee
     meeting, excuse me, that we have an international, we have a couple of
     international activities underway to help us in this area.  One is
     through CSNI, principle working group 5 on risk assessment, where they
     are looking -- there is a report to come out in the next few months on
     errors of commission and methods for treating that.  Another is our
     CUPRA working group on organizational influences, where we are trying to
     cooperate internationally with half a dozen countries or so on what they
     are doing to try to model the impact of organization on risk analysis.
         DR. APOSTOLAKIS:  These things, Mark, are not done by
     committee.  Let's go on, since you mentioned it.  Committees are helpful
     in disseminating information, but that is all they can do.
         So, the effective of the deviation on operators.
         MR. CUNNINGHAM:  Again, this is kind of a detail on how we
     developed the deviation scenarios we have here.  We look at the effect
     on the operators themselves.  We look at how these scenarios and things
     develop.  One of the issues that came up in the subcommittee meeting was
     how do we model additional human actions in this.  Is it kind of one
     human action and then we stop?  And the point in this scenario
     development work, we kind of take these new scenarios along and include
     additional recovery actions and additional actions along the way.  So it
     is not just one break point in an event tree or something like that, and
     going off into -- and then we stop, stop considering other human
         On then to the quantification process.  Basically, -- well,
     two points.  One is, as we discussed in the subcommittee, in some
     circumstances, the quantification is not necessarily a requirement of
     the analysis, that qualitative analyses can be beneficial in some
     circumstances as well.  We try in -- we have got an example in the fire
     example of how we quantify the information on these scenarios and
     quantify the probabilities of the different scenarios.  I think we
     acknowledge that this is one of the stronger points of ATHEANA at this
         The Chapter 10 was discussed I think at length at the
     subcommittee meeting and we recognize this is a place where we have got
     some work to do yet.  But it does bring it back, the point of this is to
     bring it back into the context of a PRA, estimate the likelihoods of
     core damage given these different types of scenarios that we are going
         MR. BLEY:  One thing in this area that is on this viewgraph,
     there is one area of the quantification that I think we have made a
     great stride ahead, and that is recognizing that the human error is not
     just a thing that happens randomly out there, that it is set up by both
     conditions in the plant and these other performance-shaping factors. 
     Breaking it apart that way and then quantifying, which we can do
     reasonably well, the frequency of the plant conditions that set up this
     scenario, and those go beyond what is typically modeled in the PRA,
     covers, you know, maybe more than half of the quantification issue.
         What is left is, in the cases where that context isn't
     terribly strong, we are left with not much help beyond what was already
     there.  In the cases where that context is very strong, where your
     likelihood of error or unsafe action becomes very high, then the fact
     that there isn't a real detailed quantification tool may be so important
     because we have got ourselves into a spot where most all people looking
     at it, and looking at the full context, agree that it is pretty likely
     that things will go in the wrong direction.
         It is also an area to say, yes, indeed, it is an area that
     is not well done, where the group working on it is still playing with
     three or four or five different ways to improve it and hasn't, you know,
     become of one mind yet, but there is a lot of efforts going on to nail
     down that second part of it in a better way.
         But I think breaking into those two pieces certainly makes
     the second half not as important as it is in standard methods.
         DR. APOSTOLAKIS:  Two comments.  I mean I can't object to
     Slide 13, but the truth of the matter is that Chapter 10, as it is now,
     does not do these things.  It does not try to quantify the context which
     was advertised in Chapter 2, but since you agreed that this was going to
     be taken of later, that's fine, we don't need to pursue that.
         Now, coming back to what Dennis said, I agree that this is,
     you know, this is part of what you proposed earlier, I mean the whole
     contextual approach, but isn't it true, though, that quantifying the
     frequency of plant conditions is easier and, as you say, can be done,
     than the probability of the PSFs existing?  And I don't know how much of
     that you guys have done.
         MR. BLEY:  Well, half and half on that.  Yeah, it has become
     the easy part, but on some PSFs, it is, you know, when you talk at the
     PSF level, on some of those, given a context, it is one or zero.  The
     condition is either there at the plant or it is not.  And when you are
     in the plant, that becomes obvious.  So for some of that, it is real
     clear and it is not an issue.  For the other part, yeah, I agree with
         DR. APOSTOLAKIS:  Now, the last bullet, Mark, again, I see
     what you mean, qualitative evaluations are simplified.  But what issue
     are we trying to resolve?  I mean if I am doing a PRA, am I going to
     stop and say, gee, I can't quantify this, but if I call up the people,
     they are going to change the way they do business and this is a
     non-issue.  I mean -- you understand what I am saying?
         MR. CUNNINGHAM:  No, I am not sure I do.
         DR. APOSTOLAKIS:  Okay.  We said earlier that ATHEANA can be
     helpful in actually improving the way things get done at the facility,
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  Without doing any quantification or any
     PRA.  I mean you can just look at, you know, the front part of your
     report.  But when I do a PRA, I think we have to be clear, I don't have
     that option, do I, of saying, you know, I am going to change things,
     therefore, my quantification now will be different.  Either I quantify
     the way things are, or I don't.
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  Unless I am doing a plant-specific PRA
     where people have found -- like even the, you know, the U.S. Army found
     things and they changed the design.  Of course, a PRA has to reflect
         MR. BLEY:  But there is a point here I think, you have got
     -- you are at a plant, you have a PSA, you have an HRA, you haven't yet
     tried to do this.  Maybe you don't know if you will do all of ATHEANA. 
     But the issue comes up with your fire protection people that, gee, we
     are not sure the way we have got our fire procedure written, and we are
     a self-induced station blackout kind of plant, we are not sure that
     procedure doesn't have some knots in it that could get us into trouble. 
     That is an issue that maybe you could go through using ATHEANA, and gain
     some qualitative insights from that based on the things you find and the
     error mechanisms, the error types you see, that might lead you to be
     able to revise that in a way to avoid situations that get the operator
     tied in a bit of a knot.  So you might -- and that is what this bullet I
     think was trying to say.
         DR. APOSTOLAKIS:  I know.
         MR. BLEY:  There might be an issue like that for which you
     don't need the full power of the PRA, it would be nice to have it, but
     if you don't have the full power of the PRA and quantification, you
     could still gain some very useful insight.
         DR. APOSTOLAKIS:  What I am saying, Dennis, is I understand
     that, and that is a useful thing to do.  What I am saying is I don't
     want people to play games in the future -- not you -- if this ever
     becomes, you know, practical for the average Joe to use it.
         MR. BLEY:  I understand.
         DR. APOSTOLAKIS:  Where he comes back and says the human
     unreliability contribution to my PRA is 10 to the minus 100, why is
     that?  Oh, I applied ATHEANA, everywhere I found a problem, I fixed it.
         MR. BLEY:  Yeah.
         DR. APOSTOLAKIS:  I went back, and we are not going to do it
     that way, I fixed everything.  So let's keep them separate, right.
         MR. BLEY:  Okay.  Certainly, --
         DR. APOSTOLAKIS:  Now, we are running out of time.  So shall
     we go to the fire scenario?  Although, actually, that is next, right?
         MR. CUNNINGHAM:  Yes.  That's next.
         DR. APOSTOLAKIS:  Let's go to the fire scenario.  Now, this
     is quite long.
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  So if you can use judgment as we go along.
         MR. CUNNINGHAM:  Well, we can --
         DR. APOSTOLAKIS:  Because it is an important thing.  I know
     that several members are really interested in seeing how ATHEANA
     produces here results that are better than other methods.  So I really
     want to give you all the time you need to do it, but have in mind that,
     you know, that time is unlimited.
         MR. CUNNINGHAM:  Yes.  I guess we can do this one of a
     couple of ways.  One way is to jump right to the quantification and
     things and skip kind of the detail.  That might --
         DR. APOSTOLAKIS:  I don't think so.  I don't think so.
         MR. CUNNINGHAM:  I think it might be better to kind of go
     through the steps as we have applied it.
         DR. APOSTOLAKIS:  So why don't you go to 16 and start with
         MR. CUNNINGHAM:  Okay.
         DR. APOSTOLAKIS:  These are suggestions, you can disagree if
     you want.  Say, no, I really want 15.  But I am trying to be helpful.
         MR. CUNNINGHAM:  Thank you.
         DR. APOSTOLAKIS:  Okay.
         MR. CUNNINGHAM:  Okay.  What we have, about half a dozen
     examples of applications of ATHEANA.  Four of them I guess are in the
     NUREG that you have gotten.  There is the Seabrook example that Dennis
     has talked about earlier.  This is another one that will be published as
     a separate document in the next few months.
         Basically, for a variety of reasons, we wanted to test out
     ATHEANA in the context of a fire scenario.  What we chose was a couple
     of scenarios in a SISBO plant, where a plant -- this ia plant that, in
     certain fire conditions, consciously creates a station blackout in the
     plant so that they can get control of the fire and then reintroduce
     safely the power that they need in the right places and, in some
     respects, reducing the risk of having core damage because of the fire.
         So there is a couple of scenarios, and we worked off of an
     existing PRA to try to see, well, where would we apply ATHEANA in these
     circumstances in a different way, and what do you think -- what will we
     get out of it?  And what you will see is we got some quantitative
     differences and we got some qualitative differences from the base PRA,
     if you will.  Two scenarios here --
         DR. APOSTOLAKIS:  Can you tell us about PRA, that was?
         MR. CUNNINGHAM:  I'm sorry?
         DR. APOSTOLAKIS:  Can you name the plant and the PRA?
         MR. BLEY:  I guess, there is a couple of reasons we would
     rather not.
         DR. APOSTOLAKIS:  Okay.
         MR. BLEY:  You know, we didn't work with the plant.  We
     don't have any of their inputs.  Some of the things, you know, there
     might be real plant information.  We didn't have all the information on
     the plant, we had to make some assumptions based on what we know about
     other plants.  So it is not truly a plant-specific analysis and the
     plant had no input.
         DR. APOSTOLAKIS:  Would you declare that PRA is a decent
     PRA?  Was it a good PRA, in your judgment?
         MR. BLEY:  It was picked because we were advised that it was
     one of the better ones on the fire side and with the kinds of issues we
     were looking for.  In fact, it had a human reliability analysis, which
     not all of them have, and that had tried to consider what was going on
     in the fire where some of them just use the --
         DR. APOSTOLAKIS:  But you looked at it, I mean?
         MR. BLEY:  Oh, we read it entirely, the fire PRA, yeah. 
         DR. APOSTOLAKIS:  And you formed an opinion that it was a
     decent state of the art analysis?
         MR. BLEY:  Yeah, and from the people who have looked at a
     number of the fire IPEEEs, it is one of the better ones from what people
     told us.
         MR. CUNNINGHAM:  So we have got two scenarios here
     basically.  A fire starts in the auxiliary feedwater rooms, or a fire in
     a room with 480 volt buses and the remote shutdown panel.  We worked
     through and tried to identify -- well, next slide.  I think we are just,
     for the purpose of today, we are going to stick with fire, the first
     example, the first starting in the auxiliary feedwater pump room.
         Basically, we have got a base case, as we have talked about
     before.  This is, if you will, the expected or the nominal case of what
     will happen when this plant finds a fire in this room.  You get a set of
     detection, you get alarms going off.  You have -- they go to certain
     procedures, they have to search for certain things in the procedures,
     and what is going on in the plant.  Again, this kind of lays out what
     they would nominally expect to happen.
         DR. POWERS:  When you say that the equipment begins
     operating erratically, is it equipment or does that include diagnostic
         MR. CUNNINGHAM:  It would include that as well, I think. 
         DR. POWERS:  They usually say it takes a pretty fierce fire
     to cause equipment to run erratically, but it doesn't take much of a
     fire at all to cause instrumentation.
         MR. CUNNINGHAM:  Instrumentation, yeah.
         DR. POWERS:  To be funny.
         MR. CUNNINGHAM:  That's right.  So, basically, in this
     context and in the ATHEANA context, we have a human failure event and an
     unsafe act.  The human failure event, in our terminology, is we are
     failing to accomplish heat removal from the core because of this fire,
     while dealing with this fire.
         There is three unsafe acts that are tied into this set of
     scenarios.  One is the operators fail to enter the procedures, either
     they don't go into the procedures, or they wait too long to go into the
     right procedure, such that the fire has, in effect, gotten out of
     control before they can cope with it.
         The second one was a failure to carry out certain actions in
     the procedures.  The third was to fail to respond if the scenario goes
     down a path that additional failures occur that were unexpected.  It
     puts the operator in a situation where, for example, equipment that he
     expected to be operating is not operating, independent of the fire. 
     They have just -- the equipment fails.
         MR. BLEY:  And we did have their actual procedures, there
     are three procedures that deal with fires.
         MR. CUNNINGHAM:  We looked at a set of vulnerabilities here,
     operational vulnerabilities.  We looked at the training.  What in the
     training programs could cause them to not respond in the correct way? 
     What is it about some of the timing of the events that could cause
     problems?  Again, like, say, is the action postponed because -- or the
     action to enter the EOP postponed because of some information they have
     gotten or some informal rule that they have and that sort of thing?
         Informal rules are the next one, you know, it is going to
     be, despite the plant -- you know, the fact that they have EOPs that say
     we want you to deenergize, in effect, the whole plant, you would expect
     that operators, one, don't do that very often and would be reluctant to
     do that.  That is a very serious change to the condition of that plant. 
     So there is probably going to be some reluctance.  Again, --
         DR. POWERS:  I man do you think that -- he has opened up a
     procedure.  The procedure tells him to deenergize the buses,
         MR. BLEY:  May I interrupt you there?  The procedure doesn't
     quite do that, and we have talked -- we didn't talk to this plant, but
     we have talked to operators at some other plants and they have pretty
     much said we wouldn't do that.  What the procedure says, almost
     verbatim, is when you decide that you have lost the ability to control
     the plant from the control room, then if the plant is in the alternate
     zone, go to that procedure.  If it is in the dedicated zone, go to that
     procedure.  When you make that decision, then the next procedure tells
     you to deenergize things and it is that first step of deciding, you
     know, I have really lost control that is the one that is hard.
         DR. POWERS:  It is a horribly difficult thing for an
     operator to --
         MR. BLEY:  To give you where you can see the whole plant and
     take that little piece of down at the alternate shutdown panel.  And
     almost every operator we talked to said, you know, you would have to
     drag me out of that place.  It would be real hard to make that decision.
         DR. POWERS:  In our serious accident investigation, the last
     people in the world who are making, drawing judgments like that are the
     people involved in an accident.  They always underestimate how big they
         MR. CUNNINGHAM:  Oh, yeah.
         DR. POWERS:  I mean it is just a universal.
         MR. BLEY:  And if you are in the control room and you call
     out and say, how long is it going to take you to get that?  Oh, five
     minutes.  I got it, I got it, it is all --
         DR. POWERS:  I didn't actually believe it until I was -- I
     had an accident at one of my facilities and our facility response people
     came in and took over.  And at that point I could then go around and
     assess how bad the accident was.  I vastly underestimated how bad it
         MR. CUNNINGHAM:  So that is exactly the type of thing that
     we are concerned about here.
         DR. POWERS:  I insist it is always, it is foxhole syndrome. 
     I survived, it can't be too bad.
         MR. CUNNINGHAM:  The next couple of slides cover deviation
     development.  We search for a variety of things here, missing
     information.  This is the type of things that we would look for as try
     to investigate these scenarios and this nominal set of events.  We have
     talked about some of them before, communications, misleading information
     that the fire is almost out.  You have impacts on equipment that you
     hadn't anticipate, that putting out the fire caused other equipment to
     fail, that sort of thing.  We tried to consider such things.
         MR. BLEY:  This viewgraph is really dense.  When you read
     the report and you have seen some of the other examples, this is spread
     over several different tables.  The first part is what is happening in
     the scenario, the others are what is going on in the error mechanisms,
     in the error types and all of that is kind of brought together in this
     one place emphasizing the ones that appear to be strongest.  So there is
     this little summary at the bottom is flagging those things that seem to
     be the strongest factors affecting this scenario.
         DR. APOSTOLAKIS:  I am a little bit confused now.  I think
     we discussed this at the subcommittee meeting.  Triggered error
     mechanisms include delayed entry.  But that seems to me to be an unsafe
         MR. BLEY:  We agreed with you at the committee that, yeah,
     the cataloging wasn't precise here.
         DR. APOSTOLAKIS:  Okay.
         MR. CUNNINGHAM:  Development of the scenario here, again, he
     have -- the deviation that we are going into here, the alternate
     scenario, if you will, is that the detection is delayed and that the
     fire brigade has a more difficult time in putting out the fire than they
     expected.  So you are starting to get away from the nominal performance
     of the fire brigade.
         You also get into situations like certain pieces of
     equipment fail by independent causes that put you into a different type
     of sequence.
         DR. APOSTOLAKIS:  Tom, this is in the previous slide, I
     think answered your earlier question.  So if you look at the last
     paragraph, they are not talking about errors of commission and omission
     at that level anymore, they are talking about delayed action,
     inappropriate action.  It is a very different view of human reliability.
         Now, one question that was raised at the subcommittee, and
     you agree, was that you make such a big deal about context, and then you
     present an example and you don't identify the context.
         MR. CUNNINGHAM:  Yeah.
         DR. APOSTOLAKIS:  You identify all the deviations but not
     the context.  Now, maybe -- this is a lesson here that maybe the idea of
     concept is good conceptually, but practically, now, how do you identify
     the context?  You take all these deviations and create all possible
     combinations?  I mean you have how many contexts that way?
         MR. BLEY:  We will never, I think I can say -- I don't like
     to say never.  We will never come up with an algorithm for taking six
     error mechanisms and two error types and, you know, depending on what
     they are, picking numbers out of a table and multiplying them all
         DR. APOSTOLAKIS:  Sure.
         MR. BLEY:  What we hope to do and what that last slide did
     down at the bottom was to summarize the key elements of context so you
     can see it in one gestalt and you can evaluate it all at once.  Now,
     right now, it has been done at a judgment level, looking at that and
     saying, given all of this context, what is the likelihood?  We have been
     playing with a number of methods, variants on SLIM, building, you know,
     some kind of reference set that covers a wide range of these, but trying
     to get those organized so you can make sense of them has been difficult,
     and we are still working at that.
         But, yeah, I think it will always be, though, in this kind
     of -- the context as a full set, trying to look at that against other
         DR. APOSTOLAKIS:  Why wasn't the context identified in the
         MR. BLEY:  In the presentation.  Well, part of it was
     identified on that slide, you know, we thought those summaries at the
     bottom covered a great deal of it.  But you make a good point.  We have
     gone back and talked, and in our final slide where we compared things,
     you know, I think we were colored by what we knew, and reading things
     into it that somebody not having that same background would read very
     differently.  And when we went back and looked, we said, yeah, I see how
     you can read things that way.  We are working on that even as we speak
     here, trying to make that clearer in the presentation.
         DR. APOSTOLAKIS:  But it would be nice, I mean, that is all.
         MR. BLEY:  We thought we had done it, but, clearly, we
     didn't do it.
         DR. APOSTOLAKIS:  Define the context.  And, of course, these
     contexts now are going to share a lot of elements, right?
         MR. BLEY:  Yes.
         DR. APOSTOLAKIS:  So in the quantification, you have to be
     careful to account for those.
         MR. CUNNINGHAM:  I am going to skip to 23 I think, the
     others don't add very much here.
         DR. APOSTOLAKIS:  Now, 22, just quickly.
         MR. CUNNINGHAM:  Going back to 22.
         DR. APOSTOLAKIS:  Yes.  Is that something that ATHEANA had
     anything to do with?
         MR. BLEY:  The idea of an event tree, certainly not.  This
     event tree was constructed, given what we had seen in that scenario, to
     lay it out in a way, and organize it in a way, as part of ATHEANA, so we
     could look at where the human accidents were we wanted to consider and
     how the context might change as different things happened in the plant. 
     So it was laid out to be a tool to help carry out the ATHEANA analysis.
         DR. APOSTOLAKIS:  Okay.
         DR. POWERS:  I just hate these things.  The second question
     is, fire does not jump separation, so the answer is, yes, it did not
     jump --
         MR. BLEY:  Me, too, I used to do it other way, and then we
         DR. APOSTOLAKIS:  That means the event is true.  But my
     question --
         MR. BLEY:  We can work on the word to make that clearer.  In
     fact, if we wrote words on each branch, maybe that is the way to do it,
     instead of the logician's.
         DR. APOSTOLAKIS:  I set up the context of my question, now,
     I have to go to the question.  The context was, yes, you guys developed
     this.  Did the baseline PRA that you used have anything like this?
         MR. BLEY:  Oh, boy.
         DR. APOSTOLAKIS:  I mean I am trying to see --
         MR. BLEY:  I don't think so, but I can't say for sure
     because --
         DR. APOSTOLAKIS:  Wait a minute.  John, don't say no,
     because when people develop scenarios, you know, they don't necessarily
     have to put it in the form of a tree, of course, but in the text.  They
     may have had --
         MR. BLEY:  They had an event tree for this scenario.  It
     had, if I remember correctly, it had more plant things on it and fewer
     of the kinds of groupings we made here, where we are trying to focus on
     the ATHEANA question.  So they didn't have a real one developed just for
     the human reliability.
         DR. APOSTOLAKIS:  But, for example, if we look there,
     recovery, non-recovery UA3 and so on, I mean isn't there something
     similar that they worried about, or they missed it completely?
         MR. BLEY:  Something similar that they worried about, could
     they recover?
         DR. APOSTOLAKIS:  There was something similar they worried
         MR. BLEY:  Well, actually, on this one, no.  When they
     didn't make the move to the control room, that was it.  They just quit,
     that was the end of it.  That was failure.
         DR. APOSTOLAKIS:  I think, the reason why I am asking these
     questions is because later on, or at least last time you made the
     comparison between the previous study.
         MR. CUNNINGHAM:  Yes.
         DR. APOSTOLAKIS:  If you could come here and say, look,
     these guys, using their own methods, missed these major issues, then
     that would go a long way towards convincing people that, yes, ATHEANA
     develops.  If you say, well, you know, there were some differences, all
     that this says is that they did a good job, too.
         MR. BLEY:  Okay.  Yes.
         DR. APOSTOLAKIS:  That's fine, too.  But I think this is
     critical because I know that the application is the yardstick that a lot
     of the members are using to decide whether ATHEANA is worthwhile.
         MR. BLEY:  If they had done this tree, given the way they
     did the analysis, it ended after the first branch.
         DR. APOSTOLAKIS:  After the first branch.
         MR. BLEY:  Yeah.
         DR. APOSTOLAKIS:  What do you mean?
         MR. BLEY:  Well, that is not quite true.
         DR. APOSTOLAKIS:  Can you show on the transparency what --
         MR. BLEY:  No, I can't say that, that is not right.  That is
     not a good answer to you.
         DR. APOSTOLAKIS:  I suspect that you have this --
         MR. BLEY:  But they had nothing near this kind of thinking. 
     If you look at our other examples in the NUREG, you will find that we
     did not do these in all of the examples, although we have got the
     arguments written out in words.  We would include a drawing like this I
     think now, just because it clarifies for us what is going on, and maybe
     if we put the wording on it in a more conversational, it would other
     people looking at it, too, to see what is happening.
         DR. APOSTOLAKIS:  But, anyway, you understand my, the spirit
     of my comment.
         MR. BLEY:  Yes.
         MR. CUNNINGHAM:  Certainly.
         DR. APOSTOLAKIS:  I mean what we would like to see in the
     future perhaps is, when you talk about differences and improvements,
     what kind of differences?  They are missing major sequences or you are
     just stating certain things in a big way, or a little better?  What is
     it that we are achieving?  And you don't always have to prove that the
     other guys were wrong.
         MR. CUNNINGHAM:  Yes, that's right.
         DR. APOSTOLAKIS:  There are good people out there who are
     doing good work without ATHEANA.
         MR. CUNNINGHAM:  Part of the way we are trying to run the
     ATHEANA program is to do a series of demonstrations and part of what --
     some of those demonstrations you will find, well, you don't learn much
     more than what you did from the beginning.  But you are going to find
     both.  And the question is --
         You know, Mark, that exercise also may help you when you go
     back to the original comment of identifying situations where a simpler
     analysis might be more appropriate than other one.    Exactly.
         DR. APOSTOLAKIS:  And have a graded approach.
         MR. CUNNINGHAM:  That's right.  The demonstration --
         DR. APOSTOLAKIS:  These kinds of exercises help with that.
         MR. CUNNINGHAM:  Yeah, they help you find where you should
     apply it and help you find where you shouldn't apply it.
         DR. APOSTOLAKIS:  Exactly.
         MR. CUNNINGHAM:  And we are kind of feeling our way through
     that right now.
         DR. APOSTOLAKIS:  You do the whole thing and then you say,
     gee, they found it, too, 95 percent they found the same thing, so maybe
     this belongs to a different category.
         MR. BLEY:  In one way, just on the detail, they did a more
     conservative analysis in one sense.  Where we had the fire -- they did
     some of each.
         DR. APOSTOLAKIS:  Can you use the transparency, Dennis,
     because we can follow when you point to your own figure.  Or on the
     projector if you want.
         MR. BLEY:  Well, I am having trouble, I forgot my reading
         DR. APOSTOLAKIS:  Oh, I am sorry.  Is the court reporter
     following that?
         MR. BLEY:  Fire.  That is what I was trying to do.  Fire
     does not jump separation and affects both.  They didn't consider that,
     so that is a non-conservatism.
         Good equipment works, they ran it through their PRA model,
     so that was in there.
         Operators try recovery.  Here, if the good equipment does
     not work, they did not try recovery on the opposite train, you know, the
     train that has been isolated, where we have said, well, if the stuff
     that you have set up to use dedicated equipment fails, you have got to
     go back and not keep everything isolated and use the other equipment. 
     So they didn't look at that.  So there is a little bit of both in there.
         I believe ours is a little more realistic in trying to cover
     what they did, but it has simplifications, too.
         DR. APOSTOLAKIS:  Right.
         MR. CUNNINGHAM:  I am going to slip over to Slide 24 which
     was in the subcommittee.  This is one we discussed I think at some
     length in the subcommittee meeting.  This gets into the question of,
     well, is there something -- you know, given the old method and given the
     new method, is there some profound difference?  I don't know that there
     is anything in here that is profound.
         MR. BLEY:  Well, yeah, I think there is a little bit, and
     this slide doesn't show it very well.
         DR. APOSTOLAKIS:  We are a little bit profound, or there is
     a little bit there that is profound?
         MR. BLEY:  There is a little bit that is profound, and it is
     really hard to see here.  This slide is the one where I said, you know,
     we knew what was going on and it talked to us, but I don't think it
     talks to anyone else.
         In the old analysis, it was kind of cut and dried, things
     worked or didn't, and not much reason why.  In the ATHEANA analysis,
     there is a lot of the reasons why things don't work.  And when you get
     down to the final questions of the human actions, the probability of
     them, in their analysis, the probability of error was quite low.  In
     ours, given the context, it was very high.  If you got yourself all the
     way into this situation, boy, you wouldn't -- it is very unlikely you
     would make the, quote, "right" choice.
         So the conclusions were kind of different.  And at a deeper
     level, there was much more understanding, explanation of why these
     events happen.  So if you wanted to do something about it, you would
     have a basis for thinking about what you could do either in training or
     guidelines, or some kind of backup preparation to help people deal with
     the situation.  So, if you think risk management, there was very little
     in the original analysis.  There was quite a bit of basis for doing it
     in the ATHEANA analysis.  So we think those are really different.
         DR. POWERS:  They are different, but don't you have to at
     some point make a decision on which one is right?
         MR. BLEY:  Do you want to?  Yeah, I think the ATHEANA
     analysis is realistic and gives you information at a level that you
     could do something about it.  The other one, you know, if you are
     talking the number, the total number isn't all that different.  So from
     that point of view, gee, they are the same.  But if you talk about what
     you learn, about what the problems are, and what you could do about it,
     I think there is that kind of information in the ATHEANA analysis, and
     there is a void of it in the more standard analysis of this thing.
         You know, they also focus that, you know, not carrying out
     -- getting out of the control room is a contribution, but they don't
     talk about why at all.  What are the reasons people wouldn't leave the
     control room?  What else might be happening that could cause them later
     troubles if they delay a long time in getting out of the control room? 
     None of that has any light shined on it by the other analysis and that
     is exactly where the light shines from the ATHEANA analysis.
         DR. APOSTOLAKIS:  But, again, though, in all fairness to
     them, maybe they are just doing a PRA and they were not thinking in
     terms of, you know, why and try to fix things.  But as you guys have got
     this dual track here, so we have to be a little bit --
         MR. BLEY:  Absolutely.  We are not saying that analysis is
     no good.  Given the reasons they did it, if you look at the guidance for
     doing a fire IPEEE, there was very little on what to do with human
     reliability.  In the EPRI guidance, there was a little, but not much.
         DR. APOSTOLAKIS:  Yes.
         MR. BLEY:  And there was not much focus on it in the review. 
     So, yeah, they may have done quite well for what they were doing.  And I
     will offer one other, there is a report that struck me a lot by Alan
     Swain a few years ago, where Alan did a summary of HRA methods for the
     Germans.  You probably have it, George, a little green book.  In the
     back -- he did five or six methods.  In the back of that book, the
     contacted the authors of those various methods and said, please comment
     on your own method and the others.
         When I first read their comments, I thought them
     disingenuous.  What the comments essentially said was my method will
     solve all the problems, the other four methods won't.  And all of them
     were of this mind.  When I am more fair about that, they were probably
     honest answers, because within one of those methods, especially if it is
     mine and I know how it works, I can include lots of things that I don't
     tell you how to do in the documentation.  I can consider lots of things
     that aren't there, and I can convince myself I have done a pretty good
     job.  And I think that was probably true for all of those methods.
         I think in ATHEANA the method is telling you you have got to
     consider those things, so it is wiring it in.  And certainly some of the
     things we think are important, some people have picked up in their own
     analyses, but there is no formalism to ensure that the third party user
     has a chance of picking up that kind of information.
         I am sure Alan Swain does a bang-up job when he considers
     these things, and he considers a lot that others don't.  And if you go
     back to his THERP manual, if you read that whole manual, there is a lot
     of information in there that very few practitioners use, and he probably
         DR. APOSTOLAKIS:  For the members who are not familiar with
     it, Alan Swain was the guy who developed THERP and the human
     reliability.  An engineering psychologist who has retired now for a
     number of years, but is one of the most familiar names in the HRA
         MR. BLEY:  And according to Norm Rasmussen, at the time he
     was the only one willing to take a shot at this back when WASH-1400 was
         DR. APOSTOLAKIS:  Well, yeah, Alan is a pioneer, clearly, a
         What else do you want to tell us, Mark?
         MR. CUNNINGHAM:  I want to go to the last slide, if I could.
         DR. APOSTOLAKIS:  Twenty-what?  Seven.
         MR. CUNNINGHAM:  Twenty-seven.  Basically, a couple of
     points.  One if we have talked here and at the subcommittee meeting
     about some of the strengths of ATHEANA.  We think it is taking a step
     forward with ATHEANA by bringing operations and the context of events
     and situations in plants, together with human performance, I think that
     is a step forward.  We think that trying to work on the systematic
     searches for identifying places where they can go wrong and wrong with
     bad consequences is a step forward.
         Given that, there are some things we still need to do.  The
     parts that we still need to work on are quantification, the Chapter 10,
     if you will, in shorthand.  We also need to better define how -- the
     role of ATHEANA in the context of a PRA and HRA.  That is --
         DR. APOSTOLAKIS:  Would you be surprised if someone told me
     that you should do this in the next three months and forget about
     everything else?
         MR. CUNNINGHAM:  Would I be surprised if --
         DR. APOSTOLAKIS:  Or disappointed?
         MR. CUNNINGHAM:  I'm sorry, I didn't understand.
         DR. APOSTOLAKIS:  What you just mentioned, you didn't use
     the word "screening," but that is where you where.
         MR. CUNNINGHAM:  That is where I was.
         DR. APOSTOLAKIS:  Identify the role of ATHEANA in the bigger
     scheme of things, of quantifying and analyzing human reliability, human
     acts.  Isn't that something that you guys ought to be doing in the next
     four, five months, and make sure that it is done well and start your
     future presentations with that?
         MR. CUNNINGHAM:  I think that would be good advice, yes.
         DR. APOSTOLAKIS:  That would be good -- it would not.  Okay.
         MR. CUNNINGHAM:  I wouldn't discount it, I think that is an
     important aspect of it.
         DR. APOSTOLAKIS:  So I wonder who might give you that
         MR. CUNNINGHAM:  I don't know who would be around to give
     advice on these things, but, at any rate.
         MR. BARTON:  Maybe we ought to write a letter.
         DR. APOSTOLAKIS:  Do you think?
         DR. WALLIS:  I have a question and Mark has been waiting a
     long time.  When we do sort of physical and modeling, we always try to
     validate what we have done so it is not a fantasy, but it is somehow
     tied to data and experience in a quantitative way.  Is there some way to
     validate so that this then becomes believable as something you can rely
     on, not just someone's imaginative way of approaching a problem?  Are
     there steps you can take to really get confidence in the methods?
         MR. CUNNINGHAM:  I think you can deal with it, at a high
     level, we want to continue and we are continuing to look at what we call
     real world accidents in complex technologies.  We didn't talk about
     here, but we have a program.
         DR. WALLIS:  Not just nuclear?
         MR. CUNNINGHAM:  Not just nuclear.  Complex technologies. 
     Because there are just not many serious accidents in nuclear plants, so
     we look at the aircraft industry and the chemical industry, and that
     sort of thing to look for accidents, one, that are well documented, to
     be able to -- so we can understand the human aspects of those accidents. 
     NTSB is a good source for that type of thing.  We try to collect that
     information and see how well the concept, the model, if you will, in
     ATHEANA matches with what is going on.
         That is going to be a continuing, I hate to use the word
     "validation," but I think it will be that.  I think there is also a
     lower level or more detailed level.  Again, do the types of scenarios we
     develop make sense to the people?  Are they reasonably intuitive?  I am
     not sure I would call that validation.  But, fundamentally, I think we
     have to continue to look at real accidents and complex technologies.
         DR. APOSTOLAKIS:  Did you want to sa something, Dennis?
         MR. BLEY:  One other, it is related to the ones Mark said. 
     But I would say if this method is generating scenarios that, when
     operators see them, they say, yeah, that is a troublesome scenario, we
     think that, to that extent, is verification.  And, in fact, the scenario
     that the Seabrook folks developed, they decided to run on all their
     crews, so they must have found it somewhat interesting.
         DR. WALLIS:  So you would look at, say, mixing up British
     and European units in a Mars lander, would that come out of ATHEANA?
         MR. BLEY:  You bet.
         DR. APOSTOLAKIS:  Any other comments you would like to make,
     Mark or Dennis?  Or is this the end of the presentation?
         MR. CUNNINGHAM:  That is the end of the presentations.
         DR. APOSTOLAKIS:  Any comments or questions from the
         DR. POWERS:  I just wondered if there wasn't some indication
     that what came out of the peer review that you had on ATHEANA, and did
     you learn anything from that, or was that just a pain in the neck to do? 
     You did invite a cast of luminaries, fairly impressive.
         MR. CUNNINGHAM:  We had a peer review, yes, and there were
         DR. POWERS:  You invited a cast of people that I thought
     were luminaries in the field.
         MR. CUNNINGHAM:  Okay.  And, yes, we left that out of this
     presentation today.  We included it in the subcommittee.  I don't think
     we -- I don't remember, I don't think we discussed it at the
     subcommittee, but we discussed --
         DR. APOSTOLAKIS:  Yeah, perhaps it was unfair to you, but
     they do have the transparencies.
         MR. CUNNINGHAM:  That's right.  And I think it is fair to
     say that the peer review we received I think was very constructive, and
     it led us, the version of ATHEANA that we have today, I think has been
     significantly impacted by it.
         DR. APOSTOLAKIS:  I am curious now, since Dana raised the
     point, I read those four reviews and if there is one issue where they
     all agreed, because one of them was engineer, the other three were --
         MR. BLEY:  Two were engineers.
         DR. APOSTOLAKIS:  Two.  Who was the second one?
         MR. BLEY:  Carlo is an engineer, believe it or not, and if
     you read his new book, it has got more engineering than psychology in
         DR. APOSTOLAKIS:  Carlo is an engineer.  So there were two
     engineers and two psychologists, although Carlo tends to be more on the
     psychology side.  They all agree that this approach is too complex.  And
     as I recall, at the end there were people from France and Germany and so
     on who also made that comment.  Now, the review took place when, in June
     or May of '98?
         MR. CUNNINGHAM:  Ninety-eight.
         MR. BLEY:  Yes, that's right.
         DR. APOSTOLAKIS:  And, yet, your new report does not show --
         MR. BLEY:  Can I address that?
         DR. APOSTOLAKIS:  Sure.
         MR. BLEY:  Somehow, to us, you missed it.  In fact that was
     one of the driving forces.  And when you say complex, the problem with
     the old approach that we took to Seabrook, and they used, was that there
     were two things that were difficult about it.  And one was it was a very
     tedious, slow process.  It took many, many days of these people working
     together to get to a scenario, and once you had defined the plant
     conditions, the way you used the material from the psychologist and the
     behavioral sciences, the error mechanisms, the error types, was, in
     fact, quite vague.  We gave lots of example and said, think about that
     and use it.
         Okay.  The new process with these four searches, especially
     the first two, cuts through a lot of that time we spent.  And, in fact,
     what Alan Kolazkoski and myself, who are the ones who worked primarily
     on the examples, found was where it took lots of just playing with these
     things to get scenarios before, you go right to them with this search
         When you read our examples, they are very long because we
     were driven by the comments from Carlo Cacciabui, who said I am worried
     about the fellow who doesn't have you here, and we tried to put in the
     thinking.  So it is more a narrative, I am thinking about this and that. 
     If you wrote just a production analysis, it would be much shorter.  And
     you get through those pretty quickly, in fact, very quickly.  The
     Seabrook scenario falls out almost for free, originally, and we have now
     tables that, given you get that first deviation scenario set up, the
     tables guide you through how to use the material from the behavioral
         So even though it is a thick book, I think -- my belief,
     having used it, is it takes 10 percent of the time it used to take to go
     through it.  It is much more efficient.  We have not had a third party
     try it yet.  No, we haven't, we have not had a third party try it yet.
         DR. APOSTOLAKIS:  No, but you -- I guess there are two
     issues related to complexity.  You are addressing the issue of the
     ATHEANA approach itself being complex and reducing complexity.
         MR. BARTON:  Right.
         MR. BLEY:  And difficult to do.  Yeah, that is the one we
         DR. APOSTOLAKIS:  And you interpreted the reviewers'
     comments as addressing that issue, and properly so.
         MR. BLEY:  We did.
         DR. APOSTOLAKIS:  You did.  This committee is raising an
     additional concern which is what Mark very properly stated earlier, what
     should be the role of ATHEANA-like approach in the bigger scheme of
         MR. BARTON:  Right.
         DR. APOSTOLAKIS:  So there are two different kinds.  And I
     think you were responsive, I agree, to the comments from the reviewers
     when it came to the process itself.  But I believe, what was his name,
         MR. BLEY:  Stuart Lewis.
         DR. APOSTOLAKIS:  Stuart Lewis raised the issues that come
     closer to the concerns of this committee.  I mean he used words like the
     plant people, are they going to use this?
         MR. BARTON:  Right.
         DR. APOSTOLAKIS:  So I believe there is more work to be done
     in that area.  Perhaps the other, too.
         MR. BLEY:  We won't disagree, but we will say the issue of
     setting priorities is spelled out for us.  It must not have come across,
     we will have to work on that in the early chapters.  And the approach of
     using it on issues we think is one of the first steps to getting it
     useful in a plant that isn't ready to go out and say I am going to apply
     this across the board.
         DR. APOSTOLAKIS:  Let me give an opportunity to other
     members.  John, do you want to say anything today?
         MR. BARTON:  No, I continue to try to understand ATHEANA and
     how it can be, you know, applied at the plants, and what is the benefit
     going to be without -- you know, people have got to see a real benefit
     before they go use this.  It has to be a lot better than the process
     they are now using.
         DR. APOSTOLAKIS:  Okay.  Mario.
         DR. BONACA:  No, I just appreciated the example provided,
     gained some better insights.  Certainly, I am trying to understand how
     much internal analysis it should get going through your event tree, how
     much of that is going to the results.
         DR. APOSTOLAKIS:  Okay.  Jack, do you have any comments,
     because you were pretty vocal last night?
         MR. SIEBER:  Yeah, I have none beyond that except that I
     thought the presentation helped clear up a few points in my own mind, so
     I appreciate that.
         MR. BARTON:  You guys are getting better, Mark.  A couple of
     more times and you will --
         DR. APOSTOLAKIS:  I must say I was very impressed that Mark
     decided to carry the whole load today.  It doesn't happen too often
         MR. BARTON:  Well, he is a manager, not a worker.
         DR. APOSTOLAKIS:  You don't have to comment unless you say
     thank you.
         MR. CUNNINGHAM:  Thank you.
         DR. APOSTOLAKIS:  Graham.  You don't have to speak out, I
     mean we are just coming back to -- it is up to you.
         DR. WALLIS:  You are not letting me get on with the next
     topic, you want me to comment on this one?  I have no comments.  Thank
     you very much.
         DR. APOSTOLAKIS:  Okay.  Bob.
         DR. SEALE:  No, thank you.
         DR. APOSTOLAKIS:  Okay.  Back to you, Mr. Chairman.
         DR. POWERS:  Okay.  I think at this point we can close off
     the transcription.
         [Whereupon, at 12:00 p.m., the meeting was concluded.]

Page Last Reviewed/Updated Tuesday, July 12, 2016