470th Advisory Committee on Reactor Safeguards (ACRS) - March 1, 2000
UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS *** MEETING: 470TH ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS) U.S. Nuclear Regulatory Commission 11545 Rockville Pike Room T-2B3 White Flint Building 2 Rockville, Maryland Wednesday, March 1, 2000 The committee met, pursuant to notice, at 1:00 p.m. MEMBERS PRESENT: DANA A. POWERS, ACRS Chairman GEORGE APOSTOLAKIS, ACRS Vice-Chairman THOMAS S. KRESS, ACRS Member MARIO V. BONACA, ACRS Member JOHN J. BARTON, ACRS Member ROBERT E. UHRIG, ACRS Member WILLIAM J. SHACK, ACRS Member JOHN D. SIEBER, ACRS Member ROBERT L. SEALE, ACRS Member GRAHAM B. WALLIS, ACRS Member P R O C E E D I N G S [1:00 p.m.] CHAIRMAN POWERS: The meeting will now come to order. The is the first day of the 470th meeting of the Advisory Committee on Reactor Safeguards. During today's meeting the committee will consider the following. Development of Risk-Informed Revisions to 10 CFR Part 50, "Domestic Licensing of Production and Utilization Facilities." The committee will look at proposed reports and discuss topics for the meeting with the NRC Commissioners on Thursday, March 2nd. This meeting is being conducted in accordance with the provisions of the Federal Advisory Committee Act. Dr. John T. Larkins in the Designated Federal Official for the initial portion of the meeting. We have received no written statements from members of the public regarding today's session. We have received a request from Mr. Bob Christie of Performance Technology for time to make oral statements regarding the development of risk-informed revisions to 10 CFR Part 50. A transcript of portions of the meeting is being kept and it is requested that speakers use one of the microphones, identify themselves, and speak with sufficient clarify and volume so that you can be readily heard. I am going to begin by drawing the members' attention to the items of interest. You may want to pay particular attention to the alert at Indian Point 2 and to look at some of the civil penalties imposed in connection with misidentification of plant status. Think of those in terms of the performance indicators, which has a three strikes and you're out clause, versus one strike you're out clause. Also, members may be interested in an article that appeared in the Energy Daily on NRC Staff opinions concerning the Reactor Oversight Program. Are there any comments the members would like to make before we enter into today's discussion? [No response.] CHAIRMAN POWERS: Well, in that regard, our first topic for the meeting is a relatively simple subject. It is development of risk-informed revisions to 10 CFR Part 50, and George, you are going to give us a quick thumbnail tour of this? DR. APOSTOLAKIS: Yes. My problem is I don't see the Staff here. MR. MARKLEY: The Staff is not here. DR. APOSTOLAKIS: Well, there is a problem with the times, because here it says 1:20; this says 1:00. CHAIRMAN POWERS: Okay. Well, while we are waiting I will call the members' attention to the proposed letters, and we have several -- I guess a total of seven, seven letters that we are trying to do. [Discussion off the record.] CHAIRMAN POWERS: Are we in a position to go ahead? DR. APOSTOLAKIS: Mary, are we ready to start? MS. DROUIN: Absolutely. Do I have a choice? [Laughter.} DR. APOSTOLAKIS: Always, ask Mark. Is Mr. King coming as well? MS. DROUIN: He will be late. [Discussion off the record.] DR. APOSTOLAKIS: Okay, this session comes back to, as the Chairman said, an easy subject, so it should be a breeze. Risk-informing 10 CFR Part 50, Domestic Licensing of Production and Utilization Facilities. Today's session will be only a briefing session. I understand there is no request for a letter or anything. And you can focus this a little bit. And the discussion will also be focused, in addition to the projector, on Option 3, I understand, correct? MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: And you held the workshop last week with stakeholders. You plan to brief us on that one, I hope. So without further ado, the floor is yours. Introduce everyone at the table, first, please. MS. DROUIN: Yes. I'm Mary Drovin with the Office of Research. To my left is ... MR. KURITZKY: Alan Kuritzky. MR. CUNNINGHAM: Mark Cunningham from the Office of Research. CHAIRMAN POWERS: Do we know you, sir? MR. CUNNINGHAM: We've met somewhere in the past, vaguely, I believe, yes. MS. DROUIN: As was mentioned, we are just here to give a briefing of the status of where we are on Option 3 on risk-informing the technical requirements of Part 50. We aren't at this time requesting a letter from the ACRS on this. It's just a briefing to let you know where we are. DR. APOSTOLAKIS: You will tell us when you will request a letter, what your plan is for future activities? MS. DROUIN: Yes, we're going to go through future activities. DR. APOSTOLAKIS: Okay. MR. CUNNINGHAM: The short answer is, probably this Fall sometime. DR. APOSTOLAKIS: Okay. So I can start writing it. MS. DROUIN: As you mentioned, we did have a workshop last week. We're going to talk about what we felt or what we thought we heard was the feedback from the various stakeholders at the workshop. We will also talk about the scope, the approach, and what progress we have made to date over the last four months, and where we plan to go, particularly over the next three months, because we have identified a new milestone for the June timeframe; and then where we plan to be by the end of December. So are our future plans, but our future plans in terms of this calendar year. Just briefly, as you know SECY 99-264 was issued last Fall. That went through what our plan was for risk-informing the technical requirements. It had a schedule in there of what our major milestones were, and this is what went forward to the Commission. And we received an SRM this past February that gave us approval to move forward with our plan, and also if there was something we could identify in an expedited manner, to also do that. And we were, of course, encouraged to maintain communication with and input from stakeholders. We're doing that through various mechanisms. One of them is through workshops. We had a second workshop which was last week. We had our first workshop back in September, and we have also implemented a website which is up and running. If you want to access the website, you go to the NRC website and click on nuclear reactors, and there will be a line there that says risk-informed Part 50, Option 3. You can click on that. As we create things that we feel are ready to start sharing with the public, we have been putting in on, and a lot of what you see today has already been put on that website and has been on there for about a month. In looking at risk-informing Part 50, the technical requirements, when we talk about risk-informing it, there are three approaches or -- I'm not sure what the correct word is here to use -- but we aren't talking about just revising, necessarily. We certainly are talking about revising where that's appropriate. But it also might be considering adding new requirements or expanding where we think is necessary, and also deleting unnecessary requirements. So there are three aspects to it when we talk about revising. And the change might also entail a deletion or addition, depending on what is the most appropriate as we look at the risk significance of the different requirements. We aren't covering fire protection. There are already a lot of efforts going into that, and also out of the scope is emergency planning. CHAIRMAN POWERS: Could you explain that to me? You say there's a lot of effort going on in fire protection. It's proving to be a fairly significant potential initiator accidents, and certainly not negligible, certainly not outside of the cut sets of the kinds of things that you are worried about. There has been in an interest in the past in some quarters on risk-informing Appendix R, and a candidate Appendix S was actually generated by some people. I don't know that it is consistent with the kind of risk information that you're talking about here, but it certainly was a cut in that direction. Why wouldn't you address fire protection? MR. CUNNINGHAM: I think that the basic thing was that there were parallel activities already underway in NRR to risk-inform the fire protection requirements, so in a sense, they were one step ahead of us in this. They had already made the decision to start down that road and try to modify the fire protection requirements. So there wasn't a need for us to do it. It's not that it's not important; it's just that they were already working on it. MR. KURITZKY: I think also that the contribution to risk from fire sequences is being included in our evaluation. We're looking at full-scope PRAs. We're looking at shutdown also, and -- CHAIRMAN POWERS: When you say a full-scope PRA, what does that mean? MR. KURITZKY: We're looking at internal and external events. We're looking at full-power operation and low power and shutdown states also. I mean, ideally, we want to address the entire PRA model. CHAIRMAN POWERS: So you have a model for all of these things? MR. KURITZKY: Well, what we're doing is, when we make our risk-informed decisions, what we're going to do is look for the basis for what we're going to make our decision. It should hopefully not rely just on information on, for instance, internal events PRAs for Level I. Obviously, that's where we have the most information, and so that's going to be a major driving forces, but where available, we would also like to bring in insights from other modes of operation, and also other, external events. CHAIRMAN POWERS: I guess I'm perplexed. That happens a lot. It seems to me that Mr. Cunningham here was in a group that came to us and made us a very clear presentation at one time that said when you're making risk-informed decisions on ranking pieces of equipment and things like, that you ran into a problem. If there was a problem disparity in the level of conservatism in your PRA, that is, if you were realistic in one quarter and then you put in a bunch of conservative bounding things, that the kinds of predictions you got out of it that were useful for ranking were probably not reliable; they were questionable. And now you're telling me I'm going to do a full-scope PRA, but there are some things that are stronger and some things that are weaker, which I assume must be similar to some things are treated realistically and some things are treated very conservatively. And that goes into your decisionmaking process. Don't you run into the same kind of dubious input to the decision when -- in what Mr. Cunningham spoke of earlier? MR. KURITZKY: Yes, I would say that you obviously are going to come into those types of situations where we have inconsistency in the level of information. But what we're doing is, unlike maybe a ranking -- and I wasn't there during that discussion -- in a ranking where you want to have everything on the same level playing field. Here we're taking insights into the information. If we have more confidence in a certain type of information that we have available to us, we'll place more emphasis on it. But that doesn't mean we're going to ignore other areas of information, just because we don't have as much confidence in them. We may tailor the impact that has on our decisionmaking, based our confidence in that information, but it doesn't mean that we would want to exclude that. CHAIRMAN POWERS: After you're done with these decisionmaking processes, is there going to be a document that I can read that says, okay, we had this information and we had confidence level 10 on it, and we had this information over here and we had confidence level .2 on this, and therefore the weighting factors were roughly the reciprocals of those or something like that? MR. KURITZKY: To my knowledge, we're not attempting to quantify that type of information. CHAIRMAN POWERS: So it would be impossible for anyone to replicate your decisionmaking? MR. KURITZKY: Well, we hopefully supplied the basis, and maybe in qualitative form. The process you're discussing would be some type of actual quantifying, ranking the importance of different types of input information. What I'm speaking of is just in a qualitative sense. MR. CUNNINGHAM: As you may recall, we talked a number of times about the whole issue of expert panels being used by decisionmakers, mostly in the context of licensee expert panels. One of the things -- if I can go back to Reg Guide 1.174 space, I think we tried to say that there needs to be some sort of documentation of that expert panel to the point you can get some sense of how they made certain decisions. Again, it's not going to be quantitative, I suspect, but we had a goal that you could, if not replicate, at least try to get an understanding of why certain decisions were made. CHAIRMAN POWERS: Here's what I'm interested in: Suppose that I'm a member of the public, and I look around and, for instance, you say, gee, you can not worry too much about fire barrier penetration seals. Now, I understand you're not going to treat fire, but let me use that example, because it's particularly germane to the point I want to make. And I know from my own experience that fire barrier penetration seals sound like pretty important things. They keep fire from spreading. And these guys are saying that they're of low risk significance, and I need to understand more about this because it's contraintuitive. I think you can't preclude getting contraintuitive results coming out of risk assessments because that's been the great attraction; that they're better than our intuition. Am I going to be able to go back and say, yes, now I -- verily, I know my intuition about fire barrier penetration seals was wrong, and I agree with them, that, verily, they can go to low-risk significance? I don't know that they are, but it's just an example. MR. CUNNINGHAM: I guess that, again, in the context of licensees making decisions like that, presumably they ought to be developing that documentation. I think that what Alan was talking about earlier was how -- and what we started off on here was if we go in and decide that a certain regulation does or doesn't merit change, how do we make the decision process a little more transparent than it might otherwise be, and how do we decide how we consider shutdown risk and that sort of thing? That's a fair question. I don't think we've thought much about how we would lay out all those decisions and document those decisions. But I think it's an important element of making a convincing case. DR. SEALE: I have a question. Maybe you guys have hidden some pretty significant commitments in this slide. In particular, there is the recognition that you may be adding new requirements, and you may be deleting old requirements. Now, I personally concur with the point that it makes no sense to go through such an enormous effort like this clearly is, without exerting some hindsight-driven quality control on the relevance of some of the things that are in Part 50. Yet the other side of that is that you -- those processes of making those kinds of changes are, in my understanding, fairly formal and fairly detailed. Essentially, you're rulemaking. MS. DROUIN: Okay, we're going to get into some of that later. DR. SEALE: You're going to tell us how much of that you've bitten off in going into this; is that right? MS. DROUIN: We're going to have a whole discussion here on implementation issues. DR. SEALE: Okay, fine. MS. DROUIN: Which will address that. DR. APOSTOLAKIS: I have another question: We have seen Mary and Mark many times. Alan, you're new here. The standard question is, what qualifies you to sit over there? MR. KURITZKY: Because Mary told me to come here. [Laughter.] DR. APOSTOLAKIS: That's not a qualification; that's why you came. So can you give us a little bit of your background? MR. KURITZKY: Yes. I started in the PRA field out of college in 1981. And I have worked -- DR. APOSTOLAKIS: '81? MR. KURITZKY: '81. I worked on a lot of PRA, both in this country and overseas. And I have worked for a number of contracting companies. I worked as a contractor at Northeast Utilities, Mr. Banaca. And I have -- I worked for two years at the NRC, many, many years ago, and I have since come back in November. And since I've come back, I've been involved in this risk-informing technical requirements for Part 50 as the Project Manager. DR. APOSTOLAKIS: Good. Thank you. MR. CUNNINGHAM: In his early days at NRC, many years ago, he was involved in providing -- helping develop the technical basis for the station blackout rule. So lest he be overly modest there -- DR. APOSTOLAKIS: Which college did you attend? MR. KURITZKY: Maryland, University of Maryland. DR. APOSTOLAKIS: Thank you very much. Let's go on. MS. DROUIN: Okay. DR. APOSTOLAKIS: You're going very slowly, Mary. You're still -- MS. DROUIN: Yes. I will try to make up for that. Probably the two points I want to make on this slide before we move on, is that we aren't just looking at the regulations themselves, but we are looking at the implementing documents that are associated with these regulations. So we would be looking at the Regulatory Guides, the Standard Review Plans, but also looking at how the regulations interact with each other. So we're going to be talking more on 50.44, but whatever regulation we may be looking at, we not only look down, but we also look across to see how it interfaces, interrelates with other regulations. The last point is that we do intend to keep the design basis concept. We might have a new set of design bases, but to maintain a design basis concept. Now, I'm trying to move on to the next one. CHAIRMAN POWERS: It perplexes me. Please go ahead, because it will come up on the next one as well, I think. I mean, it just strikes me as surprising to hear someone so clearly identified with probabilistic risk assessment methodologies, speak at all with complimentary words about design basis concepts. And it seems to me that the two have an orthogonality to them. Can you tell me why you're preserving the design basis concept? I mean, it doesn't show up. 1.174 says preserve the defense-in-depth, but it doesn't seem to mention anything about preserve the design basis concept. Why are you doing that? DR. SEALE: It's a robust subset. MS. DROUIN: I don't even know where to begin. CHAIRMAN POWERS: Well, begin by telling me why it's a useful concept. Because haven't -- isn't the whole point of the risk informed approach to take a holistic view of the vulnerabilities of a plant, rather than focusing on one hypothesized accident or a set of hypothesized accidents? MS. DROUIN: But I do think that it is fundamentally a good design concept to design something against something. I think you want those to be where you think your most likely accidents are going to occur. CHAIRMAN POWERS: Why can't I design against a risk metric? I can design against a hurricane and what I do is I go out and figure out what is the biggest hurricane that I can have and high velocity winds and I say, okay, that is what makes the difference. Why can't I equally say, gee, I want the risk to be 10 to the minus third or less. I mean that seems like a good design to objective. MS. DROUIN: I think you are now moving more into a design -- a risk-based more than a risk-informed concept here, when you start bringing in that kind of idea. CHAIRMAN POWERS: Okay, so you just didn't want to be accused of being risk-based. You wanted to have some defense that said I am only risk-informed so I will keep the design basis concept? MS. DROUIN: No. [Laughter.] CHAIRMAN POWERS: Okay. Can you un-perplex me? MS. DROUIN: I am going to let Mark un-perplex you because I don't think I am going to be successful. MR. CUNNINGHAM: I guess a couple of points. One is if we back up a little bit, you recall that our implementation of the modifications to the technical requirements of Part 50 is intended will likely end up in many cases being a voluntary initiative, so one of the reasons for not walking away from the design basis accident type of concept is that the more you walk away from that to go to a more, if you will, risk-based argument, the more you will see a differentiation or separation between the plants that choose not to be risk-informing and the plants that are, and that may complicate this whole process even more than it already is. CHAIRMAN POWERS: I would have thought the argument would go the other way. I mean a proponent of abandoning the concept would say yes, let's make a clear differentiation and not get a confusion by retaining this anachronistic concept of the design basis accident in these plants that are risk-informed. DR. APOSTOLAKIS: What exactly does it mean to retain the design basis concept? MR. CUNNINGHAM: What we are talking about again is that there are a set of design basis accidents on the books and then there is what has become a stylized implementation of those design basis accidents. I think at the conceptual level those provide some sort of measure of a way of implementing the concepts of defense-in-depth and margins and that sort of thing. Where people have had problems with them, one of the reasons people have problems with them is that the probabilities of some of the accidents are extremely low and they are stylized to the point that they convolute the single failure criterion into many, many different systems and things like that and it becomes a very artificial and improbable circumstance, so the idea of retaining the concept is you might be able to back off on this particular types of -- detail types of accident that you consider, but you want to still have some sort of a concept where you are having defenses against a broad spectrum of accidents, different types of initiators, if you will, and retaining margins and defense-in-depth and that sort of thing, but again perhaps developing a new set of accidents that might have more sense in the context of what we understand about risk. DR. APOSTOLAKIS: New sets in the sense that we have new initiators or a new way of doing this stylized analysis? MR. CUNNINGHAM: It could be -- I was thinking of new initiators perhaps. DR. APOSTOLAKIS: New initiators? MR. CUNNINGHAM: Well -- DR. APOSTOLAKIS: My first reaction to that would be what's wrong with the current initiators? I mean you still have to worry about the various LOCAs. MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: We have to worry about reactivity insertion, don't you? MR. CUNNINGHAM: Maybe we are just at semantics here. DR. APOSTOLAKIS: You may want to add or subtract or something a group -- MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: -- but it seems to me though the place where you can really make a difference is this stylized emphasis. MR. CUNNINGHAM: I guess that is what I meant -- DR. APOSTOLAKIS: Okay. MR. CUNNINGHAM: -- when I said you can have a large LOCA as initiator but compounded with that over years has become that you have to have this type of failure and this type of failure and loss of offsite power and that set of things put together creates an accident sequence, if you will, of extremely low probability or frequency. You may be able to redesign -- you may be able to keep the large LOCA but better design the requirements for the mitigating systems and things like that to be more balanced based on our knowledge of PRA. CHAIRMAN POWERS: Isn't it just -- I mean you don't end up in the same position -- you come back and say, okay, I am going to keep this large LOCA concept and most of the plants say, well, gee, our big pipes just don't break, but okay, he wants to analyze big pipes, and to be realistic he says do this and this, but my plant doesn't have that. My plant is different from the one that they had in mind when they did this. Now what do I do? Whereas if you gave me a risk criterion, then I could pick any accident I wanted to. MS. DROUIN: Well, I don't think you necessarily end up at the same place, because if you look at the large break LOCA, what we are talking about is maybe when you talk about a large break LOCA you are not talking a large double-ended guillotine type break LOCA. It is a different type LOCA. Now which it is I am not prepared to say at this point, but it is not this extreme case. CHAIRMAN POWERS: Whatever you write down about this, this new design concept, as soon as you write it down, some plant somewhere is going to say, ah, but my plant is different. Now you are back into -- I mean you have got to do something about this guy because he says my plant is not only different, it is better than the one you had in mind and this stuff is not applicable to me. Well, why don't you want a regulation that applies to anybody? The nice thing about a risk criterion is that it applies to anybody. Even if I come in with an LMFBR and natural enrichment fuel with heavy water as the secondary working fluid, I don't know why you would, but if you did, it would be just as easy for you. MR. CUNNINGHAM: You know, perhaps the classic example -- when we talked about having a criteria, a core damage frequency criteria and/or a risk criterion is the example that is always brought up is that there was a proposal at one time to have HDGRs, modular HDGRs -- I believe this was a DOE proposal -- that the reactor vessel, the concrete reactor vessel would act as the containment. They wanted to know whether that could be licensed by NRC standards and because of defense-in-depth arguments and things like that we basically said no, you have got to have a containment. I don't care what the probability of frequency of core damage is, you are going to have a containment. That is probably some of the underlying thought that went into if we want to keep this design basis concept. DR. APOSTOLAKIS: You may get a license application, say five years down the line, of the new South African design, the pebble bed reactor -- MR. CUNNINGHAM: Yes. CHAIRMAN POWERS: They claim that there is no need for a containment, so the question then for the Agency will be do we really demand it no matter what or do we look at what they have done and do the regulations that allow us to do something else? But I think the concept of design basis accidents is really an important one, so I don't know why you decided to say that you retained the concept, although concept of course can be many things. Mary's point earlier that you really need to give something to the designers to design against, which goes beyond I guess what you meant, it goes beyond what Dr. Powers said, just 10 to the minus 4 core damage frequency, for example, or some allocation to the accident sequences, that is not something we should abandon easily. MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: But how far we go I don't know. Mario? DR. BONACA: I still believe that somehow you have to at some point design equipment -- pumps, valves and so on and so forth. Now I do believe that if you look at, if you use risk informed concepts you are going to find that what you are going to design this equipment to is to a different kind of targets, objectives, because you are not going to have double-ended guillotine break as the one defining the size of your HPSIs and LPSIs. Most likely you are going to have a more probable range of conditions you are going to address, but you know I would expect that I can live with the concept of design basis. It may shift as a basis and it may include probabilistic targets which you are talking about, but still you would have to have some basis to design your equipment. CHAIRMAN POWERS: Regulators do not tell people how to design things in detail, and so maybe a designer does say okay, I have this risk criterion that I have to meet, but because I want to get on with the design and things like that I will conceive of some accidents that are possible at my facility and I will design against them and then I will get my PRA analysts and they will tell me if I meet the criterion or not, but in the meantime I can do some fairly traditional things against those. I mean I am not taking those away from the designer -- DR. BONACA: I understand now, because I didn't understand before, so what you are saying is rather than regulating the set of events that the designer is using to demonstrate that certain targets are met you simply impose certain targets. Oh, absolutely. That is a different concept, yes. DR. APOSTOLAKIS: But we have said many times that this is not the only thing the Agency cares about. We may not be designers but we do care about many more things than just the core damage frequency. CHAIRMAN POWERS: Yes, but is going to a design basis concept the way to get to that? These other things that we consider, that are concerned about besides core damage frequency, is the appropriate way to get to them via the design basis concept. I think that is a very convoluted -- DR. KRESS: Yes, I think you are right, Dana. I would define regulatory objectives, those other things, and make those as part of the criteria that have to be met, but they certainly wouldn't be specified because they are hard to meet by design basis accidents. DR. BONACA: But you would want to make sure that the licensee, for example, considers a set of events that is broad enough. DR. KRESS: Well, that is the PRA. That is the PRA. DR. APOSTOLAKIS: That's the defense-in-depth issues that come up and so on. DR. BONACA: With PRA again, yes -- DR. APOSTOLAKIS: I guess what we are telling them is that instead of saying we retained the design basis concept, which really is a concept of bottom-up, we are telling them to go top-down. CHAIRMAN POWERS: Well, I think I would just like to see a little more persuasive case. What I am afraid of is exactly what we have seen, that they have chosen to retain the design basis to meet objectives that are not articulated, and if they have, it may well be that that is the way to do them, but I would like to see what the objectives are and why this is the preferred way to handle it, because I see a lot of downside to retaining the concepts of design basis. The idea that you can use risk metrics as design to targets I think is open to question. I know that certainly the people at Oak Ridge have successfully done that and are very enthusiastic about using risk metrics as design targets. My own experience has been less successful in doing that, so it is open to debate. DR. APOSTOLAKIS: I think you will gain some insights into the weaknesses of this process of design basis if you look back the last 20 years and see what PRAs have found that have made the Agency or forced the Agency to actually issue new rules, for example, and ask yourself why did we have to do this, why didn't the original design basis accident envelope protect us from this. Why did we need an ATWS rule? Why did we need the station blackout rule? In my mind these are failures of the design basis accident concept because we came back afterwards doing a different analysis and we said, gee, we better do something about this. If our original envelope was good enough, we wouldn't have had to do that, so maybe you will gain some insights there as to whether the concept deserves to be retained or modified or abandoned. MS. DROUIN: I think there is a misunderstanding here. Maybe when we get into the framework it will clarify it more, because when we say we are going to retain the design basis concept that doesn't mean in the implementation of risk informing the requirements that we come from a starting point or a perspective of here is the DBA and we move forward. In fact, that is not how we are looking at risk informing the requirements, so I think this is a little bit misleading here. I think if we move on and we get into the framework I think some of your concerns will be alleviated. DR. APOSTOLAKIS: So maybe the word "retain" should be replaced? MS. DROUIN: I am not sure what we should replace it with, but perhaps it should be replaced with another word. DR. APOSTOLAKIS: "Revisit" the concept. MS. DROUIN: We will take that under advisement. DR. APOSTOLAKIS: Oh, I didn't expect you to agree right here. MS. DROUIN: I'll try and go through the next couple of slides very quickly. They are just background. When you looked at SECY 264, it talks about that the plan has a two-phased approach. Phase 1 deals with this year, whereas, come December, we plan to make recommendations to the Commission for approval on proposed changes to Part 50. And then in Phase 2, we would be performing the regulatory analysis on those recommendations that have been approved by the Commission, and move forward into rulemaking. DR. WALLIS: How do you approve without doing this technical basis first? Don't you have to make arguments for decisions? MS. DROUIN: We will be doing some analysis in terms of the feasibility of it, but the detailed regulatory analysis would be done after the Commission approval. So there is some analysis done up front, just to show the feasibility. In looking at Phase 1, just where were are right now, this is what we're doing to talk about today. There have been three main things that have been done? I apologize, but ignore that last bullet, because we haven't made really any advancements on that fourth bullet. But we're going to talk about the framework for risk-informing the regulations. And this really is probably the most important thing. We put a lot of thinking into the process because it sets the foundation of how we plan on moving forward on any regulation that we undertake. And we want to really get -- to try and give you a good understanding of what we mean by this framework. CHAIRMAN POWERS: I'm going to apologize for my own ignorance or poor memory, but 50.44 is the hydrogen? MS. DROUIN: The hydrogen. CHAIRMAN POWERS: Okay, my memory isn't as bad. I just don't remember them by numbers. MS. DROUIN: Later on, I start using words instead of numbers to try to help out. CHAIRMAN POWERS: Good. I want you to be quantitative, but not in all things. MS. DROUIN: Yes. Also, we're going to talk about the selection of the candidate regulations and the DBAs, and we also talked about in SECY 264 that we wanted to do a trial implementation, and the regulation that was selected for trial implementation was 50.44, which is the hydrogen rule, the gas control. DR. WALLIS: Can you say what you mean by a framework? I looked through the documents you sent us, and I wasn't sure I saw a framework. MS. DROUIN: Well, that's what I'm going to get into next. DR. WALLIS: Is that something else? MS. DROUIN: That's what I'm going to talk about next. That is the framework. We thought that how we approach these regulations, how we implement, you know, risk insights, that we needed a framework or a structure under which that we would be proceeding forward. And that's what we have tried to put together and what we're going to try to walk you through and explain what we mean by this framework. So, starting off, in the development of it, there were certain approach concepts. I'm not sure what is the right word, that we wanted to inherently build into the framework. And so we wanted to identify a goal. We wanted to identify an approach, strategies. CHAIRMAN POWERS: Let me ask you this question, Mary: How quibbling are people going to be over this? You say maintain the goal of protecting public health and safety. If I were a quibbling sort -- and you know I'm not -- I would say, gee, I didn't think that was the objective at all. I thought the objective was to provide adequate protection to the public health and safety. Protect the public health and safety could be interpreted by quarrelsome people as being an absolute that's probably unattainable. MS. DROUIN: At one version of the slide we had adequate protection, but we're getting into a legal ground now, and I was told that I couldn't use those words. MR. CUNNINGHAM: Obviously there is a shorthand here of we want to provide reasonable assurance of the adequate protection. CHAIRMAN POWERS: I'm just concerned on perceptions and the fact that words actually count at this stage of formulating a regulatory process. And we need to be careful because -- DR. APOSTOLAKIS: Actually this is very important. Late on, I understand you're talking about goals. And goals are not the same as adequate protection. So, I mean, I peaked. MS. DROUIN: You peaked, you snuck ahead. DR. APOSTOLAKIS: And also we had a presentation, I believe, on the slide -- MS. DROUIN: Right, you've seen some of these slides before. DR. APOSTOLAKIS: And those were goals. So I don't think the word, adequate protection, is really your goal. You want to achieve a certain goal of public protection that the Commission has said are the safety goals. But you're not dealing with adequate protection in this analysis. Is that correct? Because we don't have anything quantitative defining or contributing to the definition of adequate protection. MR. CUNNINGHAM: That might be better to come back to when we get to the figure. DR. APOSTOLAKIS: I think the word, goal, belongs there. And you have to modify the rest to say -- or maybe meet the goals of the Commission. CHAIRMAN POWERS: When you look at the Atomic Energy Act, it has implicit in it, a requirement to -- or at least various articulated incarnations that the Commission has interpreted as having a requirement that they define what they mean by adequate protection. Are you going to create a risk-informed definition? MS. DROUIN: No. In looking at the development, starting at the high level, as I was saying, we want to maintain the goal of protecting the public health and safety, and then underneath that, to develop an approach that builds upon the defense-in-depth concept or philosophy or principle. I'm trying to remember all the different words that are used. DR. APOSTOLAKIS: Philosophy and principle are different things. CHAIRMAN POWERS: Don't try to mix them up. MR. CUNNINGHAM: We have a principle to maintain the defense-in-depth philosophy. DR. WALLIS: My impression is that you invoke defense-in-depth but not in a meaningful way. So let's see if you actually do something else. MS. DROUIN: We're going to get -- DR. WALLIS: I think if you could abolish the words, defense-in-depth entirely, it wouldn't change anything in your framework. MR. BARTON: Yes, it would MS. DROUIN: I would disagree. We build upon -- I mean, I feel very strongly that we do build upon the concept of defense-in-depth in what we're trying to do, and are developing strategies that would implement that. DR. WALLIS: Show me why it helped you make a decision between A and B. They had more defense-in-depth or something. MR. KURITZKY: Show him an example in 50.44 ice condensers, for example. MR. SIEBER: Well, it seems like you're trying to maintain the concept of defense-in-depth while applying this kind of a regulatory framework, the risk-informed regulatory framework. So you aren't really building on it, it's there, built into the regulations already. You just don't want to lose it. DR. APOSTOLAKIS: And there is the practical limitation that you already have a body of regulations. MR. SIEBER: That's right. DR. APOSTOLAKIS: They're not static. You're not starting with a blank piece of paper, right? MR. CUNNINGHAM: That's correct. DR. APOSTOLAKIS: Is that the idea you are conveying here, that you have certain natural constraints, and that you're not going to start writing new regulations that perhaps differ too much from what we have now; is that right? MR. CUNNINGHAM: Yes, I think that's correct. MS. DROUIN: That is true, and what we're trying to say is that, you now, whatever options we propose, we're going to build upon this defense-in-depth concept. DR. APOSTOLAKIS: But building upon is the expression, because you start -- that implies that you start with defense-in-depth and then you apply risk information to the best extent possible. And as you know, there are conflicting viewpoints regarding -- or opposing viewpoints regarding the meaning of defense-in-depth. In the rationalist point of view, subordinate to PRA and risk information, and the structuralist is the supreme principle. MS. DROUIN: Exactly, and you'll see that on the next slide. DR. BONACA: But it seems to me that here you're committed to maintaining the philosophy unnecessarily the implemented condition defense-in-depth today. You may find through the PRA that you have better ways of implementing it, the intent of defense-in-depth. Still, you're not committing to maintain all the implemented, existing implemented defense-in-depth commitments. MS. DROUIN: Not today, necessarily. And that's why we get down to our last one, and we felt that we needed for our purposes to say what we meant by defense-in-depth, and to create a working definition. And that we were going to try and stay consistent with this definition. DR. APOSTOLAKIS: Now this third bullet, you say that you want to be consistent with a safety goals and with the cornerstones. These are the cornerstones of the new oversight process. MS. DROUIN: Yes. DR. APOSTOLAKIS: And that clearly you're talking about all modes of operation, right, not just power operations? MS. DROUIN: Correct. DR. APOSTOLAKIS: So then the cornerstones, the idea of the cornerstones applies to low power and shutdown. That confuses me a little bit. On the one hand, I hear arguments that the risks from low power and shutdown, you know, may be comparable to power operations or an amount of control and so on. On the other hand, we have this principle of cornerstones, and we know that during those operations, at least three of the cornerstones are compromised to some extent, right? You have initiating events, you have mitigating system availability. Clearly, that one is compromised, deliberately. And then the primary system pressure boundary. Am I allowed to use the concept of the cornerstone and say, gee, even though the public risk is very low from these operations, the mere fact I compromise so many of my cornerstones, you know, would demand that I understand this better and maybe do a more quantitative analysis. In other words, why are we using the cornerstones in certain areas and giving them a lot of importance, and then we completely ignore them in other areas? Either they are important or they are not. MR. CUNNINGHAM: I don't think in the context of the Oversight Program that they are ignoring shutdown operations. DR. APOSTOLAKIS: They are not. MR. CUNNINGHAM: They are not, and so the cornerstones I think as you said that would apply, full power operations, shutdown operations or whatever, the question then becomes okay, given that you are going to compromise some of these barriers what do you have to do to counter-balance that compromising to make sure that we continue to maintain safety, adequate safety or adequate protection. DR. APOSTOLAKIS: Well, it is not just to manage it, because, you know, the oversight process has clear numerical criteria for some of these things. In other words, for the unavailability of systems it gives me criteria, right? MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: It says -- okay. MR. CUNNINGHAM: Yes. DR. APOSTOLAKIS: Shouldn't I apply the same criteria to low power and shutdown? Just because I do it deliberately it doesn't count anymore? MR. CUNNINGHAM: I have to admit I haven't thought much about this, how you would deal with some of the performance indicators and things like that, how you would use them in shutdown operations -- I guess I haven't thought much about that. I don't know. DR. APOSTOLAKIS: Okay. DR. KRESS: I still wanted to ask a question about the same bullet. I thought you were through though. I wanted to know what they mean by consistent with the safety goals in terms of prevention and mitigation. I am reading into that 10 to the minus 4 CDF and 10 to the minus 5 LERF, but I don't know what "consistent with" means in that concept. Could you maybe expand on that a little? MS. DROUIN: Can you hold on? I think -- DR. KRESS: Oh, you are going to get into that later? MS. DROUIN: We are going to get into that. DR. APOSTOLAKIS: So I guess what I questioned was the consistency with the cornerstones and you questioned the consistency with the safety goals. DR. KRESS: Yes. DR. APOSTOLAKIS: It seems to me that the cornerstones are not used the same way in all regulations. They are important for certain things but then we go to other things and somehow they disappear. MR. CUNNINGHAM: Again I am not sure that they really disappear but how they are handled -- DR. APOSTOLAKIS: Oh, they may be there but again I don't know that there is any serious effort to really try to see whether we are below the goals that are given in the new oversight process document. MR. CUNNINGHAM: Yes. There is not somebody here from the new oversight process to really get at that, but clearly there should be an answer to that question of how they deal with the cornerstones during shutdown operations. DR. APOSTOLAKIS: Let me change the flavor of the question a little bit to make it more relevant to your presentation. I full agree with you that the oversight people will have to do that, but the question is when you develop a framework like this, what role are you going to give to the cornerstones? Is it a tool only for the inspection and enforcement part of the Agency or also part of the development of a new framework for risk informing 10 CFR Part 50? MS. DROUIN: It's your latter. DR. APOSTOLAKIS: So then I will expect to see them taken seriously, right? I mean you will have something that will refer to the cornerstones in the framework? MS. DROUIN: Yes. We are going to get to that. DR. APOSTOLAKIS: Okay. MS. DROUIN: Before I actually show the picture of the framework -- DR. APOSTOLAKIS: Yes, in the interests of saving time, Mary, unless you have something important to say on this one, I think we are familiar. MS. DROUIN: Let me skip -- DR. KRESS: I would like to correct the risk -- rationalist view a little bit. I think they have read something into what we have said that's not quite true. MS. DROUIN: Then please correct us. DR. KRESS: Well, the regulations on risk information with defense-in-depth employed to validate the risk information and to assure the proper balance between prevention and mitigation is not to compensate for uncertainty or incompleteness in knowledge here. DR. APOSTOLAKIS: I think on that point there is a third view that is missing here. There is a structuralist and the rationalist, which I think are described well. The third view is the one you are describing, which we call the pragmatic approach in the paper. DR. KRESS: Well, I think that is the rationalist view though. DR. APOSTOLAKIS: I mean the pragmatic approach we said, you know, defense-in-depth at a high level and then -- DR. KRESS: I think that is a third view, you're right. DR. APOSTOLAKIS: There is a third view, the pragmatic -- DR. KRESS: I think in the rationalist view defense-in-depth is not employed to compensate for uncertainty or incompleteness of knowledge. I don't think that is a correct statement for the rationalist view. CHAIRMAN POWERS: If they had access to the letter that we sent to the Commission I think it is a fair interpretation within that letter. I think things have evolved some to bring out those concepts of balance a little more strongly. DR. APOSTOLAKIS: But again I think that that issue of balance becoming more important is really what we call a preliminary proposal, which is a pragmatic compromise between the two and for some reason people tend to ignore that. They focus on the structuralist and rationalist. There is a third bullet there that is missing that is really the pragmatic approach, if you follow the terminology of that paper, which is sort of a mix of the two. CHAIRMAN POWERS: I think you're right, that people do tend to look at the holes in that, but I also think that that pragmatic view has grown within the clique of authors in ways that they probably couldn't have anticipated. DR. KRESS: You may be right. CHAIRMAN POWERS: I think today we would write three. MS. DROUIN: Point taken. I think the big thing though is the recommendation and we tried to, when we developed our working definition -- DR. APOSTOLAKIS: Actually what we call a recommendation is a variation of the pragmatic view, actually. MS. DROUIN: Okay, good, because that's what we have tried to take into account, and as we go through these next sets of slides to take that into account in our development of our working definition. DR. WALLIS: This is where I have some problem because it seems to me that the four things you list are simply obvious. You have got to have an initiating event. You could have core damage. You could have release and you have got to have a target to the public. This is just physics. It has nothing to do with defense-in-depth. It's just what happens. DR. KRESS: It is something to do with defense-in-depth. If you -- DR. WALLIS: If you choose to intervene -- DR. KRESS: If you allocate between those four things -- DR. WALLIS: Defense-in-depth is something above all this which tells you how to allocate among all those things. DR. KRESS: That is what I was saying the rationalist view is, but the key word in those four things to me is the word "limit" -- DR. APOSTOLAKIS: Yes. CHAIRMAN POWERS: But I think it is the wrong word. DR. KRESS: Well, I am interested in what their view of limit is. CHAIRMAN POWERS: I think that now we would have encouraged them to say something like balance among the measures taken to limit -- limit frequency, limit probability. DR. WALLIS: Unless your defense-in-depth tells you how to balance, you haven't used it. MS. DROUIN: We are still walking through this whole thing. We are walking through it here, but can't put it all on one slide, I'm sorry. DR. WALLIS: Well, I am telling you, defense-in-depth you are simply invoking it without using it in any way. These are simply four physical events which are going to happen, and listing them doesn't tell me anything about what you mean by defense-in-depth. MS. DROUIN: We are going to get to the figure that brings it all together. We were just trying to walk you through. If it is easier for me to jump right to that figure, I will do that. I mean if you want me to skip over these next slides. DR. WALLIS: I will still have the same question. MS. DROUIN: Let's go to the figure. DR. APOSTOLAKIS: Okay. DR. WALLIS: I think in your big framework you could simply remove the defense-in-depth box altogether. It wouldn't change anything. MS. DROUIN: There's two figures that bring all of this together. What we are trying to show here is to go through these different concepts that we have a goal. We are going to achieve this goal by trying to maintain defense-in-depth and we have four strategies for maintaining the defense-in-depth. We have two prevention strategies and we have two mitigation strategies, and then we have tactics that we are going to implement. DR. WALLIS: These would be strategies if you didn't use defense-in-depth at all. MS. DROUIN: It is defense-in-depth in that we are doing both. We aren't just doing mitigation. We are doing prevention and mitigation. DR. KRESS: I would agree that it is defense-in-depth. MR. CUNNINGHAM: But it is implicit in this picture that each of the four legs of this -- there is a balance between the four legs. DR. WALLIS: The obvious thing to do is to prevent and mitigate. It just makes common sense, and to say you are doing something wonderful like defense-in-depth is really misleading people. DR. KRESS: It is not obvious because some people say all you need to do is limit the public health effects, that's it, and not have those other things. DR. WALLIS: Well, how do you do that? You do it by preventing and mitigating. DR. KRESS: Or you may do it by just mitigating or just preventing. MR. SIEBER: It's the degree to which you do each of these things that encompasses or embodies the concept of defense-in-depth. DR. BONACA: That's right. DR. WALLIS: Then give me a rationale for balancing. Then you are getting somewhere. MR. SIEBER: That is what risk informed is. MS. DROUIN: That is what we are going to get to. I want to answer a question that Dr. Powers brought up was the use of the word "limit" because we did deliberately put the word "limit" there because when we get to the next slide we are trying to identify "limits." What we are not trying to do here is doing an ALARA type approach where we are just going to keep pushing down and pushing down and pushing down with no goal in mind, that we want to identify a limit and once we're there, that's good enough. Now maybe "limit" is the wrong word but that is the idea we are trying to get across. CHAIRMAN POWERS: You are telling me that you are going to create maybe a -- what is it? -- how do I articulate it? -- a fuzzy line akin to the fuzzy lines that you have in 1.174 that relate to initiator frequency. MS. DROUIN: I hate to say yes, Mark, but like you -- MR. CUNNINGHAM: I'm sorry. I'm just not sure I understood the question. CHAIRMAN POWERS: Well, she says that they're not going to push down and push down. There is clearly some point at which you've done enough in eliminating initiator frequency. And recognizing the speaker's abhorrence of bright lines, I suggested, was there going to be a fuzzy line akin to fuzzy lines I find in Reg Guide 1.174 that speaks to the issue not of CDF, but of initiator frequency? MR. CUNNINGHAM: There will be shadings of gray, yes. DR. KRESS: I don't see how you can do that, Mark. We're writing a set of regulations. When you put them down on paper, they are there, and some people are going to do something to their plant based on those regulations. And they're going to end up with some initiating frequency and some core damage probability. I don't see where the fuzziness enters into this picture. I don't see how you have any -- I mean, the fuzziness before was related to what further things NRC would do, but now you're putting down a set of regulations beforehand. DR. APOSTOLAKIS: But if they are frequencies, you can't really have bright lines. I mean, if they say as a guidance -- DR. KRESS: I can't -- DR. APOSTOLAKIS: If they say the mean frequency of medium loca should be 10 to the minus 3 or less, and somebody comes up with 1.5, ten to the minus three, what do you do? You see, there is some distribution there. DR. KRESS: I would support your earlier proposal some time ago that a three-Region is a great way to get without bright lines and not have them at the same time. But -- CHAIRMAN POWERS: You still run into the problem on the -- DR. APOSTOLAKIS: Decreasing the fuzziness. CHAIRMAN POWERS: On the limits that you put on either one of them. You would never write something that he says. You wouldn't say mean probability of ten to the minus third. You would say that there should be a 95-percent confidence that the mean probability -- DR. KRESS: That, to me, is a bright line. I'm sorry. DR. APOSTOLAKIS: Yes, it is a bright line. CHAIRMAN POWERS: What you get out of the problem that he's talking about, which is what do you do when it's 1.1. DR. APOSTOLAKIS: But your 95th percentile, again, could be one point something. I think there has to be some allowance for this fuzziness. It can't be bright. DR. KRESS: What you do with the fuzziness is, you make two bright lines. You're in a finite different type situation. DR. APOSTOLAKIS: I understand. DR. KRESS: You can't have an infinite number of lines. That's my point. DR. APOSTOLAKIS: The three-region, I think, addresses really different issues, which is goal versus adequate protection. DR. KRESS: No, because it tells you -- it does have a way to have a fuzziness in there because within certain region, you do something that's different than in other regions. DR. APOSTOLAKIS: I depends on how you define the limits, yes, I agree. I mean, I look those words they used in 1.174, increased management attention. That was really nice. It was a stroke of brilliance. CHAIRMAN POWERS: You're in a different realm now. DR. APOSTOLAKIS: I know, I know. I still think you will have some problem with a numerical thing, but I wanted to offer another suggestion here. I think there will be instances where it will not be possible to have this nice separation between mitigation and prevention, or at least not having the four boxes. You may have mitigation/prevention, but not the four boxes inside. For example, bypass sequences. DR. KRESS: This is on the average and related to all -- I mean, you have a different set of these for each sequence. DR. APOSTOLAKIS: Let me finish. DR. KRESS: I'm sorry. DR. APOSTOLAKIS: For external events, you can have an earthquake. So perhaps what we need to do here is have another super box that includes prevention and mitigation. So now you have big box, prevention and mitigation inside it, two boxes you have and then the two boxes within the each within prevention and mitigation. And somewhere in the text, or if there is a way to show that graphically, that would be great, to indicate that the nature of the accident sequence you are regulating -- DR. KRESS: I think this is a good slide here. MS. DROUIN: I think this one, because it gets to the two different implementation strategies, where here in this one -- I mean, our preferred one is this one here where we can address each one of the four individually. But there are those cases, as you pointed out, where you can't. So then we come up here to just prevention and mitigation. DR. APOSTOLAKIS: But what if, for example, for some sequences, you may want to just say because of the nature of the sequence, that the frequency of -- oh, you're going all the way to the fatality. MS. DROUIN: No, no. The two strategies are these two here. DR. APOSTOLAKIS: But look at this, you say that prevention is core damage frequency, mitigation is conditional -- individual fatality. DR. KRESS: That's a number that they can use as a pragmatic number to multiply the other two by to get to that metric. It's not a design -- it's not one of the limits; it's just a number they can use. DR. APOSTOLAKIS: Wait a minute. If I multiply ten to the minus four by ten to the minus two, I get ten to the minus six. DR. KRESS: Right. DR. APOSTOLAKIS: Which is close to the -- it's higher than the early fatality, though. MR. CUNNINGHAM: It's less than or equal, presumably. DR. APOSTOLAKIS: My point is that -- and maybe it's already there. That's what I'm trying to understand. If I have a very strong earthquake that demolishes the containment and the core and everything, should I use as a criterion for that sequence -- DR. KRESS: Look at the title called infrequent initiatives. MS. DROUIN: You've got your anticipated, your infrequent, and your rare. DR. APOSTOLAKIS: Right. No, but my point is that I cannot implement -- I mean, I can't say anything about the conditional core damage probability. Do I care? What I care about is the whole sequence now. MR. CUNNINGHAM: Right, there's a set of accidents or initiators that are going to be so extreme so that you're not going to design the containment for the ultimate earthquake. You can't. DR. APOSTOLAKIS: But my point is that -- DR. KRESS: Is that what you mean by retain the design basis concept? MR. CUNNINGHAM: There is a set of numbers that you just have to maintain the frequency of those challenges somehow, so long. I was thinking of vessel rupture or something as well. DR. APOSTOLAKIS: I understand. Let me tell you what I was trying to say: I think -- and maybe it's already there; I don't see it -- that there will be certain situations, classes of accidents, for which the only thing I can do is worry about the very top box, try to meet the early fatality safety goal criteria, because I cannot break it up into other things. Then there is another class for which the second tier applies, prevention/mitigation. And then there are all these internal events, really, for which the last tier applies. Is that the idea here? It doesn't have to be. All I am saying is that I think you're going to have that problem. MR. CUNNINGHAM: Yes, that's right. MS. DROUIN: Yes. MR. CUNNINGHAM: We'll have that problem to face, and you'll have to -- DR. APOSTOLAKIS: Okay, because, in other words, you cannot always demand the four boxes at the bottom. For certain accident sequences, it's just not practical. It doesn't make sense. MS. DROUIN: That's exactly right. DR. APOSTOLAKIS: Okay, fine. DR. KRESS: Now, let me ask another question. I'm sorry, I thought you were through, George. Go ahead. DR. APOSTOLAKIS: For mitigate, for the second tier, why did you put individual fatality there. I thought you were going to put something related to releases of radioactivity or -- I mean, you are going all the way to the health consequences. MS. DROUIN: Yes. DR. APOSTOLAKIS: Why? Why not LERF or something else? DR. KRESS: That is almost a LERF, George. MS. DROUIN: Because staying in consistency back with this, our mitigation. DR. APOSTOLAKIS: Oh, you are focusing on that. Okay, fine, fine. MS. DROUIN: But it is a combination, the number is trying to take into account, you know, both of these. DR. WALLIS: When you put these numbers in this table, is this where you apply defense-in-depth, when you choose to distribute numbers this particular way? MS. DROUIN: Yes. DR. APOSTOLAKIS: Yes. DR. WALLIS: When you're using defense-in-depth? MS. DROUIN: Yes. DR. WALLIS: You're saying we won't put all of our numbers in one box? MS. DROUIN: That's correct. DR. WALLIS: And who chose these numbers and on what basis? MR. SIEBER: Distribution. MR. CUNNINGHAM: At this point, those numbers are out there for debate and discussion. DR. WALLIS: Someone could easily have a reactor which has a completely different distribution of numbers? DR. APOSTOLAKIS: Sure. DR. WALLIS: You can justify it? Someone could come in and say we have such very good numbers in Box No. 3 at the bottom here, they're so small that we don't really need them to be so big in the other boxes? MR. CUNNINGHAM: Then the question that you're getting to is, does that provide sufficient defense-in-depth. DR. APOSTOLAKIS: No, actually the way it's going to work at some point -- you see, defense-in-depth is an issue for the Commission. It's a policy issue. DR. WALLIS: But ten to the minus six is the product of all these numbers. DR. APOSTOLAKIS: So the Commission has already stated the top box. The Commission in its safety goal policy statement gave us the top box. MS. DROUIN: Right. DR. APOSTOLAKIS: At some point, after the debate that Mark mentioned and so on, the scrutiny and everything, some form of this will have to go to the Commission for approval, because it's a policy issue. MS. DROUIN: That's exactly right. DR. APOSTOLAKIS: In which case then, a licensee cannot come back here and claim that they have such a good condition on early containment failure probability that they can afford to have a higher core damage frequency. DR. WALLIS: So this is where you have exercised some kind of defense-in-depth by saying we're more sure about one of these boxes than another; therefore, we've given this box more importance than another? MS. DROUIN: Exactly. DR. KRESS: It's not necessarily more sure. It could be one of the criteria. DR. WALLIS: Less uncertain then? DR. KRESS: Well, that could be one of the criteria. The other criteria could be we value not having that thing a lot more than the other. DR. WALLIS: So this is where you've actually used defense-in-depth consciously? MS. DROUIN: Very consciously. DR. APOSTOLAKIS: In fact, the agency, de facto, has declared that preventing core damage is roughly 1,000 times more important than the condition of early containment failure. DR. WALLIS: That would seem to be putting your eggs in one basket. MR. SIEBER: On the other hand, these numbers are already there because the plants are already built, and that's the way they will come out. MS. DROUIN: And these are also guidelines for us. These numbers are not going to show up in any regulation. DR. KRESS: That's the part I was going to ask. They're not going to show up -- MS. DROUIN: Not in any regulation. DR. KRESS: That, I think -- MS. DROUIN: As we go and risk-inform something -- DR. KRESS: Those might be in a Reg Guide, though? DR. APOSTOLAKIS: Have to be somewhere. DR. BONACA: Let me just say that there is a lot of striking similarity between the bottom line and the ANSI standards that were used to design the current plants. They didn't talk about core damage frequency; they talked about something very similar. Infrequent means that you can have some fuel damage. Very frequent, you can have defined fuel damage. Clearly, in absence of core damage frequency, they had to use some surrogate. But there are similarities there, so in that case you had ANSI standards that the NRC endorsed the regulation. Now you don't have that, but somewhere, these had to be, because it really replaces those standards. That's what this is, the whole structure. MS. DROUIN: And there are issues that we're still grappling with in the implementation, you know, of this framework. I mean, for example, you know, do you this by a whole group of initiators, or do you do it by a class? I mean, say that you have a class of initiators such as loss of offsite power. It fails a particular criteria, but can you meet if the whole aggregate of your set of initiators meet it? There are issues embedded in here that we're still working our way through. CHAIRMAN POWERS: I guess one of the surprising things about this, especially the bottom row, very important document that this agency's produced that I personally am very fond of, and derive a great deal of information from on the insights from the AIPE exercise. In there they show on some nice plots that, gosh, the containment, conditional containment failure probabilities for BWRs exceed all but perhaps the bottom-most limit you have written down there, whereas many PWRs would not exceed any of the limits that you put down there. Then it goes on -- but not to worry because the conditional core damage probabilities of these BWRs is so much lower, so there is approximately equivalent safety. I rather suspect you are familiar with that document. MS. DROUIN: No, I am not at all. [Laughter.] CHAIRMAN POWERS: I mean it looks like it. Why are those two things, in the face of all this evidence we got from the IPEs it says we ought not separate conditional core damage probability into one set of cases and conditional early containment probability into another set because our existing plants don't separate nicely that way, did you go ahead and create two columns there? MS. DROUIN: I guess I didn't view it that way, that these were contradicting each other. CHAIRMAN POWERS: What I am saying is it is contradictory to your experience with the existing set of reactors and I think as Jack Sieber pointed out we have got plants that are built now and one would think that at the very minimum you would want to write this risk informed set of regulations so that they were applicable to the plants now. As I read this, it would be suitable only for the PWRs. I mean it is a PWR-biased categorization here. DR. KRESS: I agree with you, Dana, and the question I was going to ask is if we had a quantification of what we call adequate protection, that is what you are talking about. That is a quantification of it in the IPEs and it seems to me like if our goal with risk informing the regulations is to maintain the same level of adequate protection the numbers we would have under "prevent" and "mitigate" would be different than those numbers that we have up there. Those are the goals. They are not adequate protection, and that is what concerns me a little about the whole thing. I think we need things in there that are different numbers than those just because of the reason you said. CHAIRMAN POWERS: I mean the alternative, it seems to me, based on experience, based on this wonderful document produced by an incredibly insightful senior author -- [Laughter.] CHAIRMAN POWERS: -- that comes back and says now do not create two columns here because that is not the way -- the risk insight we got from the IPEs says that you really shouldn't do that. DR. KRESS: I think you could create two columns but they would be different numbers than what they have up there. DR. APOSTOLAKIS: Have you read that report, Ms. Druin? CHAIRMAN POWERS: Let the record show Ms. Druin is in fact the senior author of this very, very good document. DR. KRESS: My point is that two columns are fine. That is a manifestation of defense-in-depth. It's just that the numbers are not compatible with adequate protection. CHAIRMAN POWERS: Tom, I still think that the compatibility with defense-in-depth is achieved with three columns. The violation of what I think the lessons learned from IPE is -- it should be one column. I mean it could be one column. That is one way to get around it. The other way to get around it is to change the numbers. MR. CUNNINGHAM: Another way to get around it is differentiate, have different numbers for PWRs and BWRs or different design containment classes. DR. KRESS: Yes, but that doesn't make any sense at all -- I think that would be a real mistake. CHAIRMAN POWERS: I think you take the ground rules and I think the implicit ground rules and it may in fact be even explicit, it says let's risk inform these regulations pursuing what reactors are going to have to deal with, and that is a fairly finite set. I mean it's certainly ones we have got now, very much it's the ones we have got now. It might even be the evolutionary reactors and the advanced reactors that we have certified I still think you're compatible. Do you get to a reactor like the pebble bed? Maybe the designers come in and say that they are persuaded that it doesn't need a containment. I think they have got -- the burden of proof is on their shoulders. DR. APOSTOLAKIS: But shouldn't this regulation be written in a way that provides sufficient flexibility to accommodate all these various cases? CHAIRMAN POWERS: I think it would be very desirable to do that. I think that is asking an awful lot. DR. BONACA: I think there is only one accommodation. What I mean is that for a BWR really what we are doing for a BWR really what we are doing right now, we are cashing in some extra prevention capability we have for less mitigation that we have because of containment. I don't think the opposite would be allowed by the goals we have because 10 to the minus 4 is a goal that we have in place for plants and I don't think you would say, all right, 10 to the minus 3 core damage frequency is acceptable because I have a containment that has a 10 to the minus 3 mitigation capability. DR. KRESS: Well, there is a rationale, Mario, to say that sort of stuff, and I wish -- I want to get it on the table eventually, and it is a rationale for having perhaps different numbers for BWRs and PWRs and that is what you want to do is have an acceptable uncertainty in the final answer. Now if you make that, if you can get that -- that's an undefined number, that acceptable uncertainty, but if we had a number for it, if you could meet that acceptable uncertainty better by doing it one way versus the other, then that ought to be the way to do it, as long as the uncertainty is acceptable. That is the key that is missing here. DR. APOSTOLAKIS: You know what? This is beautiful. This conception -- those guys have to implement it. I don't know how beautiful it is for them. You are going down the list here, having as guidance the uncertainty in the numbers that the assessment gives you -- that is another way of saying what Dr. Kress just said. If you can demonstrate with reasonable assurance that you meet the early fatality safety goal and the latent cancer fatality safety goal you don't have to do anything else. Now in practice of course it is doubtful you are going to do that, so you go to the next level. Are you demonstrating with good -- I don't want to use reasonable assurance, but, you know, with sufficient confidence that you have met the core damage frequency goal and the conditional containment. If you have, then stop there. You don't have to go below. DR. KRESS: If you haven't, you do something else. You go more. DR. APOSTOLAKIS: But if you don't then you better give us additional assurance. Go to the four columns you have there. This brings me to another question. Where are the cornerstones? DR. KRESS: Actually those four columns could be viewed as cornerstones. DR. APOSTOLAKIS: But they are not "the" cornerstones. No, I think we should take that list very seriously. We can't just say this is only for enforcement and inspection. Either we worry about these things or we don't. DR. KRESS: Those pretty well parallel the cornerstones. DR. APOSTOLAKIS: But they are not the same. DR. KRESS: They have left out things like security -- CHAIRMAN POWERS: Let me interject and ask the subcommittee chairman where we stand on getting through this. I do have some time constraints today. DR. APOSTOLAKIS: I understand that. CHAIRMAN POWERS: Should we perhaps let the speaker get through the next 10 viewgraphs, just to find out what she has to say? DR. APOSTOLAKIS: I would propose something else -- MS. DROUIN: Money. DR. WALLIS: I would like you to do something for me. My colleagues are far too complicated. They get into all these details. In principle, what you are saying I think is that if you have some sort of template like this you could take all the existing regulations, LOCA and stuff, and you could see how it fits into this framework of stuff, and you could see whether or not they are overly conservative or overly liberal of whatever they are, and then you could then decide whether to change them. MS. DROUIN: Right. DR. WALLIS: In principle it should be possible to apply this to the whole body of regulations as they now stand. MS. DROUIN: Correct. MR. SIEBER: Actually, you are going a step further than that in trying to regulate to a set of numbers that is something like this in these different boxes, is that not true? MS. DROUIN: Well, if I go back to our other figure, in getting to Dr. Wallis's point, when we look at -- this is just an example here -- DR. WALLIS: Go to PTS and say what does it buy you in terms of these 10 to the minus whatevers. MS. DROUIN: And see where do the regulations map into here and how well do they map and have they done it the best way, the best risk informed way. MR. SIEBER: But it is a mistake to think that all the body of regulations that you have cover all the elements of risk and uncertainty in the plant. MS. DROUIN: That's correct. MR. CUNNINGHAM: Right. MR. SIEBER: It's probably one small fraction of that. MS. DROUIN: Right. What we don't have a viewgraph on here is that this is looking at the regulations in a sense from a bottom-up -- or, you know, people call it different things -- but one of the things that we are doing is taking the insights from that wonderful document and seeing where there are risk significant concerns and then mapping those to how have they been covered in the regulations or if they have been covered in the regulations, and if not, should they be covered in the regulations, so that is another process that as we look at this framework -- to see if there's potential holes. DR. WALLIS: This is where I was looking for a different sort of framework. I would sort of I guess be willing to start off with this figure at the beginning of your discussion without any discussion whatsoever and then give me a framework for how you are actually going to apply it. That is what I didn't see. MS. DROUIN: That's correct. You haven't seen that. DR. WALLIS: Because I could have taken this, I think, with about five minutes of discussion. I don't know why we spent all this time. DR. APOSTOLAKIS: Well, we are trying to give some help to the guys. I mean we are not just criticizing -- I'm sorry, had you finished, Graham? DR. WALLIS: Yes, I think so. DR. APOSTOLAKIS: I have to intervene. You can't through all your viewgraphs -- you use your judgment and hit the important points and wrap it up by 2:55 -- MS. DROUIN: I think so. DR. APOSTOLAKIS: 2:55 you are out, right? MS. DROUIN: Okay. DR. APOSTOLAKIS: In the middle of a sentence. MS. DROUIN: All right. DR. APOSTOLAKIS: Because we have to give some time to Mr. Christie. MR. BARTON: You are taking away her time, George. DR. APOSTOLAKIS: She can actually leave now. [Laughter.] MR. CUNNINGHAM: Just to be clear, you want Mary to keep talking until 2:55 and then you will talk or -- DR. APOSTOLAKIS: No. MR. CUNNINGHAM: -- or we will have the complete, the Staff's presentation will end at 2:55? DR. APOSTOLAKIS: Yes, because Mr. Christie has requested time. MS. DROUIN: I understood that is what you meant. MR. MARKLEY: And NEI. DR. APOSTOLAKIS: And NEI? MS. DROUIN: I am not going to spend a lot of time on this -- DR. APOSTOLAKIS: Wait, that changes it. The total is 15 minutes? Okay, 2:55. MS. DROUIN: 2:55? Now if I finish earlier, do I get a bonus? DR. APOSTOLAKIS: Yes. Buy you a cup of coffee. Why don't you go to what you consider are the key issues that you would like to bring to the attention of the committee and maybe get some feedback. MS. DROUIN: One of them is where Dr. Wallis left off, where we are just now starting. You know, we have gotten this framework but now how do we implement it? That is, you know, the $80,000 question and this is not meant to list all the issues. Here are just some of the issues that we are coming across. I'm sure that as we get into it, there are going to be more issues that we are going to unravel. But here, we're just -- DR. APOSTOLAKIS: And as you talk to this Committee. MS. DROUIN: Excuse me? DR. APOSTOLAKIS: And as you come to this Committee. MS. DROUIN: And as we come to this Committee, absolutely. But the application of the single-failure criterion, whether you should do it, how you implement it, is an issue. How we -- CHAIRMAN POWERS: Why does it even exist in a risk-informed regulation? MS. DROUIN: That's one of the issues. MR. CUNNINGHAM: That's a fair question. MS. DROUIN: A very fair question; does it make sense in a risk-informed environment to have the single failure criterion? CHAIRMAN POWERS: Is there any convolution of the logic that would lead to it? MR. CUNNINGHAM: Yes, there is. Again, the question of single-failure criterion as a concept or as it has been applied, the application has evolved considerably with time to be perhaps more constraining than the original intent. The original intent may still make sense, but -- DR. APOSTOLAKIS: Well, you know, as a general principle, I mean, there is such a thing as the principle of conservation of requirements, perhaps, or knowledge. I mean, you are creating new requirements at a higher level. Something has to give at the lower level. I mean, we can't preserve everything we've been doing for 40 years and on top of it say, now we want this frequency for core damage. I mean, that would argue against the single-failure criterion, in my view. So, bear that in mind, that we are not here just to add to the regulations. I mean, the fact that you put those big requirements up there has to have some impact on what you put -- DR. KRESS: You may be able to meet them only with the single-failure criterion. DR. APOSTOLAKIS: But that's a separate issue. MR. CUNNINGHAM: In this environment, the question is, is it a practical concept to use, to continue to use, given this framework and application? DR. APOSTOLAKIS: It's the whole issue of practicality, and conceptually also. MR. CUNNINGHAM: Conceptually, also, yes. Is it -- DR. WALLIS: Now, these numbers in your boxes are plant-specific. So how do you do this mapping without looking at the particular plant? DR. KRESS: They weren't intended to -- DR. WALLIS: How do you map generic regulations into PRA. DR. KRESS: They weren't intended to be plant-specific. DR. WALLIS: But they are. These probabilities, when you calculate them, are plant-specific, aren't they? DR. KRESS: Well, the idea is to -- DR. WALLIS: So isn't that one of the biggest problems with mapping general regulations into PRA. MS. DROUIN: But you can see where the group of plants have fallen in a particular area, and one of the things I'm going to get to after this slide is walk you through 50.44, because that's our trial implementation. And where you might have it on a plant-specific basis, you still have here's what the industry as a whole has told you, so it's not really applied on a plant-specific basis in that regard. We've had a lot f discussion on that second main bullet, on how we're going to use these quantitative goals. And all of that, we're still thrashing out, and as we move forward, hopefully -- I'm sorry? DR. APOSTOLAKIS: The cornerstones. DR. KRESS: No, George, don't keep bringing up these cornerstones. DR. WALLIS: I just want to say, what happens if you try and do it? DR. APOSTOLAKIS: These are issues, these are implementation issues. MS. DROUIN: Real quick, to your cornerstone thing, George, it might not be the exact words, but here are four of the cornerstones right here, and the other ones are up here in this box. So we are not ignoring the other cornerstones. DR. APOSTOLAKIS: What I'm saying is that there is an explicit cornerstone regarding the unavailability of mitigating systems. And you have put it inside the core damage probability, which is combined now with other things. And my question is, why doesn't it stand alone? Why do I care about it when I inspect and enforce, and I don't care about it when I write new frameworks? MR. CUNNINGHAM: As you said, this is an issue we have to deal with. DR. APOSTOLAKIS: I understand that. MR. CUNNINGHAM: And that's fair. DR. APOSTOLAKIS: That's all I'm saying; that it's much more explicit. I agree with Mary that everything that is the limit core damage frequency box, but in the other document, it's spelled out, the four of them. If you multiply them, you get the core damage probability. So why do I have four there and two here? DR. BONACA: There is some issue, too, about -- MS. DROUIN: You have the same four. DR. BONACA: -- here, the separation and mitigation is typically by core damage. And the others were not. I mean, clearly the mitigation was intended in the old fashioned way of the old analysis whereby mitigating equipment wasn't just to mitigate core damage; it was to mitigate events. So there is some other issue that has to be dealt with to reconcile. DR. APOSTOLAKIS: I think your major -- one of the biggest issues you will have here is what of the -- which ones of the existing regulations you want to eliminate. MS. DROUIN: I'm sorry, I couldn't hear you? DR. APOSTOLAKIS: Eliminate. The fact that you are putting these multilevel requirements now, how far can you go in eliminating existing requirements. The single-failure criterion, for example, is one we discussed, and I'm sure there are others. This is a key implementation issue, in my view. MR. CUNNINGHAM: Again, the single-failure criterion is not a requirement; it's an implementation mechanism or something like that, embedded in requirements. DR. APOSTOLAKIS: It's essentially a requirement. The licensee has got to meet it. No? MR. CUNNINGHAM: Anyway, we're just -- that's semantics, I think. DR. APOSTOLAKIS: In the engineer's office, many, many years ago, doing some drawings because we were coming before the NRC, well, the single-failure criterion was very prominent there. MS. DROUIN: Okay, for time purposes, I'm going to skip the whole next section and jump all the way over to Slide No. 25. As I said, 50.44, the combustible gas control regulation, is the one that we have done for trial implementation. And, in fact, we went into the workshop with another recommendation on 50.44, and the stakeholder feedback supported that recommendation. We're going to try to move in 50.44 on a much more expedited basis, looking at the timeframe of June of this year to go to the Commission with preliminary recommendations, and not wait till December. We're going to try and really expedite 50.44. So I want to quickly walk through what we're doing on 50.44 and give you an idea of where we're at. Just quickly, in terms of our framework, remembering that the framework is looking at both prevention and mitigation, what you see with 50.44 is that it addresses the third strategy, of limiting our radionuclide releases. As we look at 50.44 there's three things here that I want to focus in on that as we risk inform the regulation and start examining the requirements we are going to determine if we can eliminate any non-risk significant elements. Can we simplify it to make it more effectively meet the objective? -- but also when we look at it to see if there are any missing risk elements that might warrant that unforgivable word of "adding" to it. When you look at 50.44 there's six basic parts to the regulation, six requirements there. The top three here -- I don't think that my pen will work -- there's a demarcation here, because there was two parts to 50.44, pre-TMI and post-TMI, and this was the original rule and then the rule was amended after TMI, which added on these three other requirements, so prior to TMI what you are seeing there is that the regulation was impacting all containment types and then when you got into the amendments post-TMI you were not necessarily impacting all the different containments. The other thing I want to point out, when we talk about large Drys, that also includes the sub-atmospherics, and that is an important point. What I am going to do is take those six requirements and walk through them and talk about the requirements and get into how the licensee has implemented the requirement, look at that implementation and the requirement itself and evaluate the safety significance and then some very early preliminary thoughts that we have right now for options for consideration in terms of potential recommendations. DR. WALLIS: Evaluate safety significance means some kind of a contribution to LERF? MS. DROUIN: Yes. MR. KURITZKY: CDF and LERF. DR. WALLIS: CDFs already have -- MS. DROUIN: Yes. No, that would be LERF. If I take our first requirement, which is measuring the hydrogen in containment, that is what the requirement states. The implementation of it has been to put in safety grade instrumentation for hydrogen or oxygen measurement. The fact that it is safety grade instrumentation, that is not the actual requirement. The requirement is what you always see here in bold and underlined. When you look at it, the hydrogen measurement certainly has the capability of safety value for tracking and managing the accidents and here is one that also gets tied into Option 2, because some relaxation of the special treatment requirement is imposed on the equipment also. In looking at this particular requirement, what our first thoughts are is to perhaps allow some grab sampling instead of having a constant monitoring. You can just go out and do some random sampling, and also what we are starting to look at is trying to determine where has the safety grade instrumentation been imposed. It certainly hasn't been imposed by the regulation. DR. WALLIS: How about not measuring it at all? MS. DROUIN: Or not measuring it at all. DR. WALLIS: How would you assess whether that is valid? I mean you can look at the effect on LERF and it is going to be very small. How small does it have to be before you say you don't need any measurement at all? MS. DROUIN: What I see to recall in going back and looking at the results from the IPEs and looking at NUREG-1150 is that the hydrogen -- I am trying to remember those numbers -- DR. WALLIS: Just measuring it though -- well, are you going to apply some criterion? MS. DROUIN: In looking at what was the contribution to your early containment failure from a hydrogen combustion, and then therefore what is the need to measure it. MR. KURITZKY: And it varies from plant type to plant type and containment type to containment type. DR. WALLIS: You don't necessarily need to measure it. You just need to prevent it burning. I think it gets very complicated when you look into the details of what you actually buy from each one of these requirements. MS. DROUIN: But when you get into some, you know, hydrogen combustion in some particular accidents is a relative contributor so there is some value in knowing what your hydrogen concentration is for being able to measure it, but whether or not you need your safety grade -- DR. WALLIS: There's a .1 probability of containment failure in the box that you showed us. That is much too crude to evaluate whether or not you need to measure hydrogen in containment, so you need some other -- MR. CUNNINGHAM: Yes, that's right. MS. DROUIN: Right. MR. CUNNINGHAM: You need something more -- DR. WALLIS: Much more. MR. CUNNINGHAM: Yes. DR. WALLIS: That is what I was looking for was more a framework for how you are going to actually make these decisions, but may not have got that far yet. MR. CUNNINGHAM: The framework that we talked about before might give you an idea that this is an issue to tackle. What it doesn't do is give you an idea of how you really design what the requirements would look like. DR. WALLIS: I was looking for your framework for deciding whether or not a regulation was necessary or needed to be modified. Maybe you haven't got that far yet. MS. DROUIN: Would you state that again? DR. WALLIS: When you make these comparisons, how do you make a decision about whether or not we need to keep measuring H2 in containment? That is the sort of framework I was looking at, for your intellectual framework for how you are going to start making decisions on the basis of risk informing. Maybe you haven't gotten that far yet. MR. CUNNINGHAM: We haven't gotten that far yet. MS. DROUIN: That's correct. Going on to the next requirement in terms of mixing, in looking at it from a risk perspective, keeping a well mixed containment atmosphere without hydrogen stratification we felt is important to safety, so often when you look at this particular requirement the systems that are used for mixing are also generally used for other functions, so on this particular requirement our preliminary thinking was we weren't proposing any changes on this particular requirement. CHAIRMAN POWERS: When we took a look at 50.59, using the language that we have available to us now with modern capabilities at risk we ran into all kinds of problems with the quantitative adjectives that appeared in there. There was language to the effect of don't have any increase in risk. At that time that language was put in there they meant no increase in risk to the limits that you could detect whether there was any increasing risk and the detection capability was very crude at the time. Now it is much better, and the lawyers have said that poses a problem -- when it said none it meant none. Now you can detect better and you can say that just about everything does have some changes in the accidents that are possible, so when you come in here and you have a requirement, "a well-mixed atmosphere" there is nothing quantitative about it. It just says a well-mixed atmosphere. Aren't you going to run into the same problems that I can run a CFD code -- I'm sure Professor Wallis could lend me one that would be superb -- DR. WALLIS: Sell you one. [Laughter.] CHAIRMAN POWERS: I should have known that. [Laughter.] CHAIRMAN POWERS: And I could come in and say, aha! -- look right here, in this corner it is not well-mixed in that corner and therefore it is an unacceptable containment. Aren't you inviting that kind of difficulty when you don't address those adjectives? MS. DROUIN: I don't disagree with that. CHAIRMAN POWERS: Not going to change the regulation anyway, right? MS. DROUIN: I didn't say that. DR. WALLIS: This is where you really come up against the nitty-gritty. MS. DROUIN: Yes. DR. KRESS: That's right. DR. WALLIS: Find out if it is possible to do the job you are trying to do. MR. CUNNINGHAM: That's right. DR. APOSTOLAKIS: Remember, this is a work in progress. MS. DROUIN: Very much in progress. DR. WALLIS: But the interesting part to me is whether you can make it work on any one of these things. MS. DROUIN: Absolutely. MR. CUNNINGHAM: And 50.44 -- DR. WALLIS: Even a part of 50.44. MR. CUNNINGHAM: Even a part of 50.44 is relatively simple compared to some of the other regulations. It is a good test but it is a fairly simple test at this point. MS. DROUIN: And the other part of 50.44 -- because what you see here in terms of the work in progress is looking at 50.44 the way it is written today and how it is implemented today. The other thing that you don't see here, which we are just right now starting -- we don't have anything to present to you yet -- is saying let's not even look at what is written. Let's look at the objective of what the rule was and starting with a blank piece of paper, one, do we even need a regulation that gets to controlling -- whatever the title of our regulations are -- combustible gas. You know, do we need such a regulation and if we were to write that regulation with a blank piece of paper, how would it be written from a risk informed manner, and so we are also attacking it from that perspective and coming from looking it this way, which we started by looking at the separate requirements, now starting on a blank piece of paper it will be interesting to see if the two converge whether we end up at the same place. At this point I can't tell you where we are going to end up. DR. WALLIS: Can you imagine a regulation which is a one-liner which says "Thou shalt design an H2 control system or combustible gas control system so that some probability is less than 10 to the minus X" and that's just the regulation, one line. MR. SIEBER: I can't imagine that. DR. WALLIS: Then it is up to the designer to do it or the licensee to show that it meets that criteria -- a one-line regulation. MS. DROUIN: I don't know. DR. WALLIS: Is that sort of thing feasible, do you think? MR. CUNNINGHAM: Again, you can go into some of the regulations that we have got on the books today, the regulations themselves are very simple and they are not quite that simple but they are very simple, but then they will add on either an appendix to Part 50 or something that complicates things or a Reg Guide or something, but in many cases -- we have said this before in a different context -- sometimes the regulations themselves are not the issue here. It is the implementing documents that complicate things greatly. DR. BONACA: I just would like to make a comment. I made it before, but I don't think it was picked up. We spoke before about correlating cornerstones with this approach, and you are still working on it. I'd point out again that there is an inconsistency in the definitions of prevention and mitigations that you use here versus the cornerstone. In the cornerstone you use the traditional approach whereby a diesel generator unavailability falls into the mitigating systems. Here you are referring to core damage. MR. CUNNINGHAM: Yes. DR. BONACA: And you are looking at a mitigation as a condition of failure -- it's almost impossible to relate -- DR. APOSTOLAKIS: Oh, but -- DR. BONACA: -- and I am pointing it out because the new Oversight Program is supposed to be risk informed, but you have to make sure at some point the two things correlate. DR. APOSTOLAKIS: Consistency. There has to be consistency. DR. BONACA: It's very important that you look at it and I think it is a work in progress so therefore you have the opportunity to either adjust one or the other. DR. APOSTOLAKIS: Yes, that's point of view. The other point, which is related to what Graham just said and we said earlier, is how do you decide in the diagram you showed us earlier to go one step down? How do you decide to go one step down, and the guidance has to be the confidence you have in your results. In other words, you could in some ideal world have a one-line regulation, design a reactor so that the core damage frequency is less than 10 to the minus 4 per year, nothing else. If you could do that with high confidence, you wouldn't need anything else, so I think that is something that I believe you should pay some attention to and see how it would guide us to do everything else because, yes, why do I have to worry as a regulator about measuring hydrogen? There must be a reason, and the reason has to be the uncertainty in the final result. DR. WALLIS: If you're sure it won't burn -- sure you don't have enough to burn, you don't need to measure it. DR. APOSTOLAKIS: I mean this contributes to some accident sequences. MR. BARTON: Yes. DR. WALLIS: With a humongous containment, fine. DR. APOSTOLAKIS: So it is really the final number that should count, so it is not just the point values we are using and then incidentally we are saying these are mean values and we think we're okay. I think that uncertainty in the distribution itself is a key element here because it dictates how far down you will go. This is your last slide? MS. DROUIN: Yes. DR. APOSTOLAKIS: You are happy to tell us. MS. DROUIN: Yes. DR. APOSTOLAKIS: And you have to do it in seconds. Okay, I'll give you a minute. MS. DROUIN: Thank you. As we said, we are in the midst of preparing a status report that will go to the Commission, that will address a lot of the policy issues that we're going to need to go back on. As I said, we had planned to move it on an expedited basis on 50.44. We're planning on holding some kind of public meeting in the April-May timeframe, as we get more of these ideas more solidified to go back and get some feedback from stakeholders, and go with the recommendation to the Commission. I say that is approximately the June timeframe; that is our target date. We're looking at, in terms of other regulations, DBAs, and preliminary recommendations on those to have some ideas in the August 2000 timeframe. This would go beyond the 50.44, and to hold a public workshop in September, and hopefully come back and meet with you all in October. DR. APOSTOLAKIS: So that would be the next time we see you? MS. DROUIN: Unless you wanted to meet beforehand, but that was the next time we were intending on coming back. DR. APOSTOLAKIS: This is really important for us. MR. CUNNINGHAM: You asked at the beginning of the meeting, when we were looking for a letter. I volunteered that we were looking for a letter late this year. That was not in the particular context of, for example, 50.44. So I tend to agree. I'm not sure we should be waiting until this Fall to be talking to you again. DR. APOSTOLAKIS: We should have a supplementary meeting first. So I will leave it up to you to judge when it would be convenient and appropriate to have a Subcommittee meeting, so you will have something more to say, but it will not be near the end, so that additional advice will really irritate you. DR. WALLIS: I'm really puzzled because I don't think you're anywhere near a recommendation yet. DR. SEALE: That's right. DR. WALLIS: You haven't even started to make any decisions about anything. You have to decide how you're going to make decisions. So what are you going to recommend by June? MS. DROUIN: In June we're just dealing with 50.44. DR. WALLIS: But you haven't come near resolving any of the issues on 50.44 yet. DR. SEALE: You're right. DR. APOSTOLAKIS: Well, it's March 1st. DR. WALLIS: I don't think there's any hope at the present speed. MR. BARTON: It's a work in progress. MS. DROUIN: Can I have 15 more seconds? DR. APOSTOLAKIS: Okay. MS. DROUIN: This will make you feel better, George. MR. BARTON: I doubt it. MS. DROUIN: Jus real quick, we did have a workshop -- DR. APOSTOLAKIS: We didn't talk about that, did we? MS. DROUIN: I just wanted to give you some highlights from it. There was general agreement with our approaching guidelines at a high level, but the thing was that consistency with the plant oversights, with the cornerstones, impact on workers, for us to keep and maintain a good communication with the different owners groups and the industry programs, because there's a lot happening in these areas. One of the things that came out is that if you remember, at the very beginning, we said that out-of-scope was emergency planning. We've got some feedback that we shouldn't necessarily make that kind of statement. There was a lot of agreement that we should try to move ahead on an expedited basis on 50.44. DR. WALLIS: But you don't have a plan yet. MS. DROUIN: That doesn't necessarily mean that it's on all of 50.44. Maybe there is a particular aspect of 50.44 that we can move quickly on, and that's what we will be determining over the next three months. And that's all I have. DR. APOSTOLAKIS: Any other comments from the members? [No response.] DR. APOSTOLAKIS: Thank you very much. DR. WALLIS: I think you might be in trouble if you didn't come back to us several times. You might come back and we might say you haven't got there yet. It's still a long way. I'm concerned about progress. DR. APOSTOLAKIS: Late May, perhaps? Would that be all right with you? We'll leave it up to the staff. DR. WALLIS: You're too high level with all this discussion. You don't really get down to how you're going to do the job. MR. CUNNINGHAM: I would think maybe the best way to proceed would be using 50.44 as an example to get at just what Dr. Wallis is saying, how do you take this from the conceptual level to what is this requirement going to look like level, and May is probably too late for that. DR. APOSTOLAKIS: For reliability on PRA, but Dr. Wallis will have to be there. You're not a member of that. DR. KRESS: That's all right, we'll make him be there. DR. APOSTOLAKIS: Okay, thank you very much. I appreciate it. NEI and Mr. Christie? You can both come and sit there. If you're going to stand, we'll give you the other microphone. Okay, it's up to you. If you want to stand, we give you the other microphone. MR. CHRISTIE: Adrian has only got one slide. I see new members. Do I have to introduce myself? DR. APOSTOLAKIS: Yes, tell us who you are. MR. CHRISTIE: My name is Bob Christie. I am the owner of a firm in Knoxville, Tennessee that does consulting work for nuclear power plants and railroads and anything that has to do with risk and reliability evaluations. My background is, I started with the Tennessee Valley Authority in 1974. I did four years in hell doing regular safety analysis, and then got the light, and I've now done about 20 some odd years of PRA. So, I was one of the utility representatives on the PRA procedures guide. I have been involved in the efforts over the years. Presently, we've got in the industry, a lot of things to risk-inform, to move towards some more effective regulatory scheme by using risk-informed, performance-based regulations. Good enough, George? DR. APOSTOLAKIS: Yes. MR. CHRISTIE: Today we would like to talk a little bit about the meeting that happened, the workshop that happened last Friday. And you have a detailed comment, so I'll try and make this short. There were two documents handed out. One is called the Framework for Risk-Informed Regulation. Another is called Risk-Informing 10 CFR 44. Okay, they're both pretty thick documents. They were handed out at the beginning of the meeting. I believe that I was probably the only person crazy enough to read the documents at night and come back on Friday having read the documents. Most of the other utility people were smarter than I was and had not read them, and so what can we say? Okay, let's take the general approach. In the first place -- and we said this in the meeting -- there's no general agreement on the general approach. I, particularly, am unclear on what it is. I really don't understand it. It appears to me to be some combination of risk-informed space regulation, which is great for my part. But clearly they have statements in there that, you know, we're picking things and going to be consistent with the quantitative health objectives. Then the first thing they do is use minus four core damage frequency, which is inconsistent with the quantitative health objectives, more conservative, et cetera, et cetera. You cannot use quantitative health objectives to set regulations, because we all know that with quantitative health objectives, safe is safe enough, but they're not adequate protection. The regulations are adequate protection, the safety goals are how safe enough, and therefore you can't set regulations on the quantitative health objectives or the safety goals. So, you know, there's no -- there is definitely no general agreement on the approach. DR. KRESS: Bob, do you think it would be possible to have numbers like the ten to minus four and point one containment, although not those particular numbers, but numbers like that that would represent adequate protection? MR. CHRISTIE: Again, Tom, you've got to recall that years ago when I proposed what has become to be called the whole plant program, I said we ought to know the whole -- the numbers from top to bottom. We ought to start at the top with the quantitative health objectives. Well, I wanted to start at the top with defining adequate protection. And you know I tried a delphi process to define adequate protection. I have a definition of adequate protection. DR. KRESS: Well, would you like to share it with us? MR. CHRISTIE: Well, it's approximately three percent of background, three to five percent of background. That's what came out of the delphi process. DR. APOSTOLAKIS: What background? MR. CHRISTIE: Background, for immediate fatalities and latent cancers. DR. WALLIS: You mean the average background, not the background in Denver or New England? DR. APOSTOLAKIS: No, he's talking about risk, background risk. MR. CHRISTIE: The quantitative health objectives are based upon .1 percent of the background for individual fatalities and .1 percent of background for latent cancers. And so when I asked people to go out and do a delphi as to -- well, if -- and it was convoluted, but all of you got a copy of what I sent out. I asked them, if we define adequate protection as what is the level of risk reached by the present regulations, what did you think the present regulations were? And I said -- and I provided a chart of my own and thought I might influence people, but I put my chart in an envelope, closed, so that they didn't too much to them and so on and so forth. Again, I have a definition in my own mind of what adequate protection is on the risk curve. I now have a definition of what the safety goals are on the risk curve, and I want to know where every plant in the United States stands with respect to what I consider adequate protection, with respect to what I consider quantitative health objectives, with what I consider to be emergency planning, what I consider to be what we call, you know, release categories; the plant damage states; the conditional probability of systems working, and the initiating events. I just want plants to have a PRA and to know where they stand from top to bottom. And each plant is going to be absolutely unique. DR. KRESS: Let me ask you another question: How much faith do you have in a delphi-arrived at definition of adequate protection, and don't you think that could have been done by just going to the IPEs, for example? MR. CHRISTIE: No. I wanted to define adequate protection. IPE has got nothing to do with adequate protection. IPEs were risk evaluations. DR. KRESS: Well, the plants that IPEs refer to are the result of -- MR. CHRISTIE: Not of regulations. DR. KRESS: -- of having met adequate protection. MR. CHRISTIE: No, they're not the result of regulations. All the plants that are a result of regulations plus all the other things we do to make the plant run well -- and adequate protection is, if you had a plant and it was done just to the regulations, what would the level of it be? Okay, the plants are probably an order of magnitude -- DR. KRESS: It's the worst plant you could build and meet the regulations; that's what you're saying. MR. CHRISTIE: Not the worst plant; just a plant built to the regulations. If you had to just sit down and go to through the regulations and you took out all the other things we do that aren't in the regulations, and make the plant run better, et cetera, et cetera -- DR. KRESS: That's what your delphi says. DR. WALLIS: What would the level of protection be? MR. CHRISTIE: Right, what would the level of protection be? DR. WALLIS: Adequate is superfluous. MR. CHRISTIE: If we define adequate protection -- DR. WALLIS: Real protection, is what you're saying. MR. CHRISTIE: It's not the real. The real protection consists of the piece that comes from regulation and the piece that come from without the regulations. And the piece without the regulations is what has driven us down to probably an order or two magnitude below the safety goals, not the regulations. DR. APOSTOLAKIS: So what you're saying is that what you found was that the adequate protection level was a factor of 20 to 30 higher than the goal? MR. CHRISTIE: Give or take. DR. APOSTOLAKIS: Twenty to 30. MR. CHRISTIE: Somewhere in there. DR. APOSTOLAKIS: Do you have a document where you describe this? MR. CHRISTIE: No. DR. APOSTOLAKIS: Do you plan to have one? MR. CHRISTIE: I'm not sure why I would. DR. WALLIS: Because it makes your conclusion more believable. MR. CHRISTIE: Again, we'll talk to you later. DR. APOSTOLAKIS: We'll talk later. MR. CHRISTIE: Okay, so the first place is -- and over the weekend, the comments that you see have been reviewed. The comments that you see are my comments, but they have been reviewed by the other people in the meeting that were vocal enough to get up and speak. They've changed my comments, not substantially, but in many cases, they are people better with words than I am, and so it represents a composite of a lot of people that were there. Okay, let me emphasize, beyond a shadow of a doubt -- and we told everybody in the meeting that the absolute emphasis we saw in the meeting on adding requirements was unacceptable to us, because that's what we saw in the meeting. The framework, and especially the 50.44, just added requirements to us. And if you want to get me mad again, you can make me bring up the examples of why I thought that. But I don't think you want to do this. We did it in one public meeting, and that was bad enough. Two would be a little bit more. But the staff is well aware of what we were thinking. Now, Nick Grantom brought up absolutely that this thing is critical to everything, not just to Option 3. If you look at what's happening to the South Texas Project, what you're seeing there, especially if you look at the request for additional information, that the South Texas people are now responding to, you will see clearly in there that the intent of many of those questions is to preserve the design basis, control to the design basis, and if you identify anything in the PRA that is safety significant in our terminology, then what you will do is, you will control it just like if it were in the design basis space. And that is completely unacceptable to us. If there are no elimination requirements, then why are we doing all this? DR. WALLIS: You see this as an additional requirement then? MR. CHRISTIE: If you will read the request for additional information in South Texas, you will find that there are add-ons, lots of them. And the way that they want to treat the add-ons is that they want to treat them just like the things. Now, we've been assured by the staff, some of the staff, that that is not the intent of those questions, and that we are getting a little bit bent out of shape because we're reading them incorrectly. But when I read the words, just like I read the words in 50.44 last Thursday night, coming from the staff, I read words and I work off of those words. And I know that the staff, especially in Option 2, is really seriously trying to help and not create extra burden for us. But that's not what's coming across. And it didn't come across last Thursday or Friday, either. So, eliminating requirements is very crucial to us. Rick gave a couple of options to the staff, probably in the wrong meeting, as to what we're expecting on the Option 2 part. There's a PRA uncertainty issue, and, ladies and gentlemen, you can read my comments. My comments are the same comments that you heard from Dr. John Garrick when you had the joint ACNW/ACRS meeting. To treat uncertainty, what you do is, you know the factors that lead to the uncertainty, you know the magnitude of the uncertainty, and you know how much impact it has on the decision process. If you know all that, then you can treat and handle uncertainty. CHAIRMAN POWERS: We have colleagues here that have a variety of definitions of uncertainty. And they distinguish between aleatory uncertainty and epistemic uncertainty. When we interrogate them on the epistemic uncertainty, they say, oh, yes, but that also includes the things that you have not modeled. And so how do I know that uncertainty? MR. CHRISTIE: Again, I have been doing risk assessments now for 20 years. Almost every risk assessment I have ever done includes uncertainty. How well we have included that uncertainty and that risk assessment, again, is in the eyes of the beholder. We've spent enough money, we thought, to make the decisions that were necessary to improve the plants and make sure that the plants were working well. I can't answer that. We'd spend days trying to work on that question. DR. SEALE: But it doesn't do us any good to spend our time arguing that it's therefore an inappropriate question to ask. MR. CHRISTIE: Oh, I think the question of what is the uncertainty in your probabilistic risk assessment is one of the key questions that you have to answer, and you do the best job you can to go through the facts, identify the factors, try and quantify the magnitude of the uncertainty, and then see how it hits the -- influences the decision process. But the key is the decision process, not spending millions and millions of dollars reducing uncertainty. Once you get those factors down, if you can, and -- again, it will be in the eyes of the beholder, how well you get it down -- but it's the guys who've got the money that basically have to make the decision. DR. KRESS: But there has to be some guidance then to the decisionmakers on how to use uncertainty in their decisionmaking process. MR. CHRISTIE: Again, I was a participant in the PRA Procedures Guide. We put guidance in there on how to treat uncertainty. If we did a bad job, I haven't heard about it. You know, what we would add to it today, I don't know. Probably we would add some things to it, because we're theoretically 20 years smarter. But if you want to go back and say in the PRA Procedures Guide, let's change the guidance on uncertainty, then, fine, you know, put together another ASME, ANS, and RC program and we can go do it. DR. KRESS: I'm interested in guidance to the NRC staff on how they should use the uncertainty, assuming they had relatively good numbers for it. MR. CHRISTIE: Oh, okay. DR. KRESS: This is a different subject. MR. CHRISTIE: Could be. I'm not sure we -- George, I think we did. DR. APOSTOLAKIS: You answered the question. DR. KRESS: You answered it pretty good. DR. APOSTOLAKIS: And we are running out of time. MR. CHRISTIE: Single-failure, hey, we don't need single-failure in this framework document. You know, I mean, we've got PRAs. They do single-failure, double-failure, triple-failure, they do common cause, they do dependent failures, they do anything you want them to do, and they do it better than anything I've ever seen before, and I have done them both. So, to try and add single-failure into some framework for writing regulations today is, to me -- we're wasting our time, in my opinion. The same thing would go for design basis. There are some pieces of the design basis stuff that works, and we'll keep, but let's go to risk-informing 50.44. As you probably know, there is a petition for rulemaking that went into the Federal Register January 12th on 50.44. It completely stripped all the design basis stuff out of the proposed rule. It was not relevant to public health risk, and we just stripped it out. DR. WALLIS: It just seems to me, the biggest difficulty to risk-informing 50.44 or any other regulation is that the objective of the regulation is not cast in risk language. So you don't know what goal you have in terms of the language you're trying to use. MR. CHRISTIE: Dr. Wallis, I recommend that you read the petition for rulemaking, and see if we did the job of phrasing it in risk. This is our attempt. DR. WALLIS: You did it? MR. CHRISTIE: Yes, well, myself and a bunch of other people. It come from us, comes from people that have done risk assessment. DR. WALLIS: You don't find in 10 CFR, blah, blah, blah. MR. CHRISTIE: You do find in 10 CFR, some, 50.63 station blackout, risk, right; 64 is risk. Oh, yes, it's got elements of risk in 50.63. DR. WALLIS: But it's not quantified. MR. CHRISTIE: No, not quantified numbers, but it has elements of risk to it. So, you know, we've done that, put in the 10 CFR, elements of risk. Have we done it successfully and well? Again, it's in the eyes of the beholder. Big issue in the meeting last Friday -- and you can talk to some other people about it, because I don't like talking about it anymore -- we did simplify the procedures at Arkansas and San Onofre. It was a risk-positive move. It was approved by the Nuclear Regulatory Commission in the safety evaluation report, and if you read the document, you will see that that may not have been true to the people that wrote this document on 50.44, which caused quite a bit of tempest. I would have t say, and I haven't been to all NRC meetings, but the meetings on Thursday and Friday and the workshop were the most contentious meetings I have been in a long time. We had people way past the bounds, myself included, okay? It's one point in time I sat down and shut up because all I was doing was adding to the gasoline, and I will say it to the NRC people that are here today -- I got a letter -- Tom King -- I meant no disrespect to you people or to you national lab people by my silence. DR. APOSTOLAKIS: So where can we find all this information? MR. CHRISTIE: It is in the framework document and in the 10 CFR document, the things that they handed. It came in a package. DR. APOSTOLAKIS: But you are summarizing this contentious meeting? MR. CHRISTIE: Right, I am summarizing some of the issues in the contentious meeting and my words that accompany these slides. DR. APOSTOLAKIS: And you are trying to be fair, presenting both sides? MR. CHRISTIE: I am never fair. DR. APOSTOLAKIS: Okay. But you are very honest. MR. CHRISTIE: I hope so. Okay. It became clear to us that some part of the NRC was to put all plug igniters for the large dry containments. That's already been through the process, the 1509. It shouldn't even enter in at all to any criteria or anything with respect to rewriting 50.44. The hydrogen monitoring issue, again we find no safety reason for hydrogen monitoring in any of the plants, period. Okay? There's a lot of operational concerns for hydrogen monitoring but they are operational concerns and they have nothing to do with what we call adequate protection of public health and safety. They have to do with operational concerns. They are not the primary parameter for any action that we know of taken in the plants. DR. KRESS: You are defining adequate protection in terms of the QHOs in this case? MR. CHRISTIE: No. I am defining adequate protection in terms of is this a primary parameter that I would have to have to guarantee that things work the way they should work, and hydrogen monitoring is not one of them, to the best of our knowledge. We do lots of things in the emergency operating instructions or some people call them emergency operating procedures. We have lots of accident management guidelines, et cetera, et cetera, but it is not a key ingredient that would cause us to do anything different. If Dr. Wallis is correct, if we removed all hydrogen monitoring from the plant, the plants would do the things that they are doing and probably without it -- the same actions would be taken. Okay? The last one is long-term hydrogen. Again, some of the people in this room were involved in San Onofre. It was a concern that was brought up. The Safety Evaluation Report was written for San Onofre on the basis that the hydrogen monitoring and the long-term hydrogen recombiner issues were put to bed except when the SER was issued the recombiners were declared non-safety and hydrogen monitors were not. We still have hydrogen monitors safety-related at San Onofre. In the petition for rulemaking we would no longer have that if that petition for rulemaking were to go through. DR. WALLIS: Well, if you are right that having hydrogen measurements has no effect, then you don't need to be risk-informed to decide you don't need it. MR. CHRISTIE: No, the basis that we got to to decide on what the primary measures were was a risk informed affair. You could not do that decision -- we would not have made the decisions we made, for instance to basically depend on reactor vessel level, thermocouples in the core, radiation monitors around the core, radiation monitors in the containment, pressure and temperature in the containment, et cetera, et cetera, if we hadn't done all the risk assessments and ran that kind of thinking process through well, what is it that we really want to do. For instance, on hydrogen monitoring, we can have sequences where we will completely wipe out the core or put it on the floor and the amount of hydrogen won't be much at all. Your design basis LOCA without any safety injection, for instance, is probably the classic example. We melt the core with no water on it. We won't have any zirc water reaction and we won't have any hydrogen but that core will be on the floor. DR. WALLIS: You'll be making hydrogen from the concrete -- but we are getting into too many details. MR. CHRISTIE: Yes, but when we, by the time we get to hydrogen -- the corium on the floor -- is there anything that the operators haven't done already to retain the containment capability such as the sprays, et cetera, et cetera? Would they do anything different? They have buttoned it up. They have turned on all the active heat removal systems, et cetera, and Adrian -- where is Adrian? DR. APOSTOLAKIS: Yes, Adrian -- MR. CHRISTIE: I'm sorry, Adrian, I, as always in these ACRS meetings, I went over. DR. APOSTOLAKIS: Are you finished? MR. CHRISTIE: Yes, I am finished. DR. APOSTOLAKIS: Thank you very much, Bob. MR. HEYMER: My name is Adrian Heymer. I am from NEI. I am a Project Manager. I have been working on and off on risk informed activities at NEI since about 1993 and I guess I first used PRA in the field in about 1977 in a different country at a different time and a different place. I just want to say a few words to clarify some issues. It may have been a boisterous workshop last week, but I think it was very beneficial and this meeting today has been -- the more you discussed this, the more I learned. I think when you look at the framework and you look at the slide that the NRC put up with the framework, the one that had the defense-in-depth box, I think that is a very good start. I think it may not be perfect but it is a good start from which we can build. I think it is true the industry were confused by some of the statements -- like the defense-in-depth box. We struggled with that a bit. We are sending a document out to get some formal industry feedback and we will be passing that on to the NRC. I think the term "single failure" that is also put in there we also found a little confusing. As to is there a general agreement on the approach, the guidelines and the framework, I am not quite sure what that entails. It seems to be a big box of things to say there is a general agreement on. I think we have got a good starting point. I think the NRC Staff have done a very creditable job in getting to where they have got to today. They have set themselves a very aggressive schedule on 50.44 and they have gone through this process and they have come to the conclusion, very much the same conclusion as the industry reached when it sent a letter to -- and we sent a letter to Chairman Meserve January the 19th, and I can make a copy of that available if you don't have one, which summarized the results of the survey the industry did at the back end of last year on where should we focus our efforts, from the benefits side, on risk informed regulation, the technical aspects. We came up with a conclusion that it is 50.44 because we have already done a fair bit of work on that. That is work that went as an example to see how far we can get, set a timeline, reach a decision, and move forward, and the next one, which is a lot more complex, is 50.46, which really -- it's been said here before -- the regulations are like a carpet. They interweave and they are all dependent upon each other, but if you don't look at what you can do with 50.46 first when you look at the other regulations, you tend to get locked back into 50.46. MR. BARTON: What is 50.46, Adrian? MR. HEYMER: The ECCS performance. MR. BARTON: Okay. CHAIRMAN POWERS: Let me ask you a question. Because the plants have been built, so many of them have been built, and they have been built to comply with 50.46, suppose I changed that regulation radically. Would I really have any impact on the industry at all? MR. HEYMER: Yes, I think you do as regards some of the day-to-day activities, as regards to the ability to reassess where you stand as regards -- as it cascades down, perhaps not just from 50.46 but as it cascades down to some of the other regulations. CHAIRMAN POWERS: I think I might concede to you the point on cascading down. MR. HEYMER: Yes. CHAIRMAN POWERS: But the regulation itself I don't think gets you very much. MR. HEYMER: But the issue I am trying to drive at and we are trying to drive at from an industry perspective is that unless you find out what you can do with 50.46, when you go to these other areas and try and determine what you can do with that, you get locked back up into 50.46 -- it's, if you like, a central regulation. CHAIRMAN POWERS: I think that's true. I can imagine it's true. I haven't shown that for myself, but it seems to me that if I were going to do something like that that I would start with the GDCs. MR. HEYMER: Well, you can start there. It's just the fact that the GDCs are -- there's not too much in the GDCs that you have to change. It's in the implementing documents that you would have to change, but they are linked back to 50.46 in itself. CHAIRMAN POWERS: I think the GDCs link back to a good deal more than 50.46. MR. HEYMER: They do, but a lot of what you might want to change or end up changing can be linked into 50.46 and it provides what the industry believes is a significant stepping stone to moving on, not only in the other regulations but to reassess the plant and make improvements in the plant. I think once you have sorted 50.46 out, then you have got a clear path to where you need to put your priorities for the other regulations. CHAIRMAN POWERS: Okay. I'll think about that a lot, but I have always kind of looked at 50.46 not so much as having an impact but rather being a demonstration of commitment rather than having any impact simply because plants are already built and already has an ECCS system that obviously meets the requirements of 50.46 and they probably are not going to change that very much. The problem is it's already fixed. Now you may be right -- they back off on a lot of things they maintain about it and there are other things they do that are hooked to it, but it wasn't first on my list. MR. HEYMER: Okay. I think the point has been made fairly forcibly a few moments ago and also in the workshop there are some items that are in the guideline documents and the material that was handed out that we will comment on as an industry and I think that is expected and we will provide those comments. I think it is important not to revisit issues past unless there is really good reason to. I would like to say a word about an additional activity that is being progressed, which I think some people in this room are aware of associated with Generation 4 plants, and that is really starting off with a clean sheet of paper and saying where do we go with the regulations. There was a debate at senior levels within the industry on should we try that approach, and the feeling was no, because we want to have, if you like, two sides. We want one side that can benefit existing plants and it was just felt that starting off with a clean sheet of paper, one, it might take us some time to get there, and two, it might be difficult to translate those into the current fleet, but that is going on and I see that as being another activity which helps to improve the regulations and focus on the right stuff. I do think we have made a reasonable start. I think we are impressed with the schedule that the Staff has put down and placed and we hope they keep to that schedule and it is good they have broken down 50.44 and 50.46 into chunks to look at, and that is probably a good thing to do, but we are looking for some good management to drive itself to a conclusion so that we don't continue to evaluate and evaluate and evaluate. There comes a time when you have to draw a line. Finally, we do need a success in risk informed regulation and we would go for a small success rather than a big success. At the workshop I said we would take a field goal over a touchdown, taking the liberty to put it in American football terms, but there -- DR. WALLIS: What's a field goal? [Laughter.] MR. HEYMER: There are a lot of skeptics out there on risk informed regulation and I think we need to get a success on the board, and I think the NRC Staff is trying to work towards that. DR. APOSTOLAKIS: So are you implying that there have been no successes yet? MR. HEYMER: I think from where the industry stands at the moment they look at risk informed regulation and they say, well, what is risk informed regulation? Some people think, well, I might consider ISI and IST as a partial success but I think I could go a lot further than what we have done in the past. If you mention the maintenance rules, executives tend to rise out of their chair very much like other people do on some issues associated with 50.44, and so that is not considered a success from the industry perspective, and there was a flavor -- I don't think it was meant or intended at the workshop -- that was mentioned before about adding on, and it was suggested there is also elimination, and I think that point was taken by the NRC as improving is eliminating as well as improving -- adding on -- if there is need to add on at all. I guess the other point that was made at the workshop and hasn't been brought up here, if you are going to add on, you must be careful not just to add on but you mustn't pile on, and there is a temptation to sometimes do that on voluntary efforts. I think that has been kept in check in the past and it will be in the future. DR. APOSTOLAKIS: You think this is voluntary, eh? [Laughter.] DR. APOSTOLAKIS: This is a personal view. It does not reflect anybody else's view. Mr. Heymer, do you have anything else to say that you think is extremely important? MR. HEYMER: That's it. DR. APOSTOLAKIS: Okay. Thank you very much for coming here. Back to you, Mr. Chairman. CHAIRMAN POWERS: I will recess the committee for -- till ten minutes of the hour and that will conclude the transcription service. [Whereupon, at 3:35 p.m., the transcribed portion of the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016
Page Last Reviewed/Updated Tuesday, July 12, 2016