470th Advisory Committee on Reactor Safeguards (ACRS) - March 1, 2000

                       UNITED STATES OF AMERICA
                              U.S. Nuclear Regulatory Commission
                              11545 Rockville Pike
                                                       Room T-2B3
                              White Flint Building 2
                              Rockville, Maryland
                              Wednesday, March 1, 2000
               The committee met, pursuant to notice, at 1:00
               DANA A. POWERS, ACRS Chairman
               GEORGE APOSTOLAKIS, ACRS Vice-Chairman
               THOMAS S. KRESS, ACRS Member
               MARIO V. BONACA, ACRS Member
               JOHN J. BARTON, ACRS Member
               ROBERT E. UHRIG, ACRS Member
               WILLIAM J. SHACK, ACRS Member
               JOHN D. SIEBER, ACRS Member
               ROBERT L. SEALE, ACRS Member
               GRAHAM B. WALLIS, ACRS Member
                         P R O C E E D I N G S
                                                      [1:00 p.m.]
               CHAIRMAN POWERS:  The meeting will now come to
               The is the first day of the 470th meeting of the
     Advisory Committee on Reactor Safeguards.  During today's
     meeting the committee will consider the following.
     Development of Risk-Informed Revisions to 10 CFR Part 50,
     "Domestic Licensing of Production and Utilization
     Facilities."  The committee will look at proposed reports
     and discuss topics for the meeting with the NRC
     Commissioners on Thursday, March 2nd.
               This meeting is being conducted in accordance with
     the provisions of the Federal Advisory Committee Act.  Dr.
     John T. Larkins in the Designated Federal Official for the
     initial portion of the meeting.
               We have received no written statements from
     members of the public regarding today's session.  We have
     received a request from Mr. Bob Christie of Performance
     Technology for time to make oral statements regarding the
     development of risk-informed revisions to 10 CFR Part 50.
               A transcript of portions of the meeting is being
     kept and it is requested that speakers use one of the
     microphones, identify themselves, and speak with sufficient
     clarify and volume so that you can be readily heard.
               I am going to begin by drawing the members'
     attention to the items of interest.  You may want to pay
     particular attention to the alert at Indian Point 2 and to
     look at some of the civil penalties imposed in connection
     with misidentification of plant status.  Think of those in
     terms of the performance indicators, which has a three
     strikes and you're out clause, versus one strike you're out
               Also, members may be interested in an article that
     appeared in the Energy Daily on NRC Staff opinions
     concerning the Reactor Oversight Program.
               Are there any comments the members would like to
     make before we enter into today's discussion?
               [No response.]
               CHAIRMAN POWERS:  Well, in that regard, our first
     topic for the meeting is a relatively simple subject.  It is
     development of risk-informed revisions to 10 CFR Part 50,
     and George, you are going to give us a quick thumbnail tour
     of this?
               DR. APOSTOLAKIS:  Yes.  My problem is I don't see
     the Staff here.
               MR. MARKLEY:  The Staff is not here.
               DR. APOSTOLAKIS:  Well, there is a problem with
     the times, because here it says 1:20; this says 1:00.
               CHAIRMAN POWERS:  Okay.  Well, while we are
     waiting I will call the members' attention to the proposed
     letters, and we have several -- I guess a total of seven,
     seven letters that we are trying to do.
               [Discussion off the record.]
               CHAIRMAN POWERS:  Are we in a position to go
               DR. APOSTOLAKIS:  Mary, are we ready to start?
               MS. DROUIN:  Absolutely.  Do I have a choice?
               DR. APOSTOLAKIS:  Always, ask Mark.  Is Mr. King
     coming as well?
               MS. DROUIN:  He will be late.
               [Discussion off the record.]
               DR. APOSTOLAKIS:  Okay, this session comes back
     to, as the Chairman said, an easy subject, so it should be a
     breeze.  Risk-informing 10 CFR Part 50, Domestic Licensing
     of Production and Utilization Facilities.
               Today's session will be only a briefing session.
     I understand there is no request for a letter or anything.
               And you can focus this a little bit.  And the
     discussion will also be focused, in addition to the
     projector, on Option 3, I understand, correct?
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  And you held the workshop last
     week with stakeholders.  You plan to brief us on that one, I
     hope.  So without further ado, the floor is yours.
     Introduce everyone at the table, first, please.
               MS. DROUIN:  Yes.  I'm Mary Drovin with the Office
     of Research.  To my left is ...
               MR. KURITZKY:  Alan Kuritzky.
               MR. CUNNINGHAM:  Mark Cunningham from the Office
     of Research.
               CHAIRMAN POWERS:  Do we know you, sir?
               MR. CUNNINGHAM:  We've met somewhere in the past,
     vaguely, I believe, yes.
               MS. DROUIN:  As was mentioned, we are just here to
     give a briefing of the status of where we are on Option 3 on
     risk-informing the technical requirements of Part 50.  We
     aren't at this time requesting a letter from the ACRS on
     this.  It's just a briefing to let you know where we are.
               DR. APOSTOLAKIS:  You will tell us when you will
     request a letter, what your plan is for future activities?
               MS. DROUIN:  Yes, we're going to go through future
               DR. APOSTOLAKIS:  Okay.
               MR. CUNNINGHAM:  The short answer is, probably
     this Fall sometime.
               DR. APOSTOLAKIS:  Okay.  So I can start writing
               MS. DROUIN:  As you mentioned, we did have a
     workshop last week.  We're going to talk about what we felt
     or what we thought we heard was the feedback from the
     various stakeholders at the workshop.
               We will also talk about the scope, the approach,
     and what progress we have made to date over the last four
     months, and where we plan to go, particularly over the next
     three months, because we have identified a new milestone for
     the June timeframe; and then where we plan to be by the end
     of December.
               So are our future plans, but our future plans in
     terms of this calendar year.
               Just briefly, as you know SECY 99-264 was issued
     last Fall.  That went through what our plan was for
     risk-informing the technical requirements.  It had a
     schedule in there of what our major milestones were, and
     this is what went forward to the Commission.
               And we received an SRM this past February that
     gave us approval to move forward with our plan, and also if
     there was something we could identify in an expedited
     manner, to also do that.  And we were, of course, encouraged
     to maintain communication with and input from stakeholders.
               We're doing that through various mechanisms.  One
     of them is through workshops.  We had a second workshop
     which was last week.  We had our first workshop back in
     September, and we have also implemented a website which is
     up and running.
               If you want to access the website, you go to the
     NRC website and click on nuclear reactors, and there will be
     a line there that says risk-informed Part 50, Option 3.  You
     can click on that.
               As we create things that we feel are ready to
     start sharing with the public, we have been putting in on,
     and a lot of what you see today has already been put on that
     website and has been on there for about a month.
               In looking at risk-informing Part 50, the
     technical requirements, when we talk about risk-informing
     it, there are three approaches or -- I'm not sure what the
     correct word is here to use -- but we aren't talking about
     just revising, necessarily.
               We certainly are talking about revising where
     that's appropriate.  But it also might be considering adding
     new requirements or expanding where we think is necessary,
     and also deleting unnecessary requirements.
               So there are three aspects to it when we talk
     about revising.  And the change might also entail a deletion
     or addition, depending on what is the most appropriate as we
     look at the risk significance of the different requirements.
               We aren't covering fire protection.  There are
     already a lot of efforts going into that, and also out of
     the scope is emergency planning.
               CHAIRMAN POWERS:  Could you explain that to me?
     You say there's a lot of effort going on in fire protection.
     It's proving to be a fairly significant potential initiator
     accidents, and certainly not negligible, certainly not
     outside of the cut sets of the kinds of things that you are
     worried about.
               There has been in an interest in the past in some
     quarters on risk-informing Appendix R, and a candidate
     Appendix S was actually generated by some people.  I don't
     know that it is consistent with the kind of risk information
     that you're talking about here, but it certainly was a cut
     in that direction.
               Why wouldn't you address fire protection?
               MR. CUNNINGHAM:  I think that the basic thing was
     that there were parallel activities already underway in NRR
     to risk-inform the fire protection requirements, so in a
     sense, they were one step ahead of us in this.  They had
     already made the decision to start down that road and try to
     modify the fire protection requirements.
               So there wasn't a need for us to do it.  It's not
     that it's not important; it's just that they were already
     working on it.
               MR. KURITZKY:  I think also that the contribution
     to risk from fire sequences is being included in our
     evaluation.  We're looking at full-scope PRAs.
               We're looking at shutdown also, and --
               CHAIRMAN POWERS:  When you say a full-scope PRA,
     what does that mean?
               MR. KURITZKY:  We're looking at internal and
     external events.  We're looking at full-power operation and
     low power and shutdown states also.  I mean, ideally, we
     want to address the entire PRA model.
               CHAIRMAN POWERS:  So you have a model for all of
     these things?
               MR. KURITZKY:  Well, what we're doing is, when we
     make our risk-informed decisions, what we're going to do is
     look for the basis for what we're going to make our
     decision.  It should hopefully not rely just on information
     on, for instance, internal events PRAs for Level I.
               Obviously, that's where we have the most
     information, and so that's going to be a major driving
     forces, but where available, we would also like to bring in
     insights from other modes of operation, and also other,
     external events.
               CHAIRMAN POWERS:  I guess I'm perplexed.  That
     happens a lot.  It seems to me that Mr. Cunningham here was
     in a group that came to us and made us a very clear
     presentation at one time that said when you're making
     risk-informed decisions on ranking pieces of equipment and
     things like, that you ran into a problem.
               If there was a problem disparity in the level of
     conservatism in your PRA, that is, if you were realistic in
     one quarter and then you put in a bunch of conservative
     bounding things, that the kinds of predictions you got out
     of it that were useful for ranking were probably not
     reliable; they were questionable.
               And now you're telling me I'm going to do a
     full-scope PRA, but there are some things that are stronger
     and some things that are weaker, which I assume must be
     similar to some things are treated realistically and some
     things are treated very conservatively.
               And that goes into your decisionmaking process.
     Don't you run into the same kind of dubious input to the
     decision when -- in what Mr. Cunningham spoke of earlier?
               MR. KURITZKY:  Yes, I would say that you obviously
     are going to come into those types of situations where we
     have inconsistency in the level of information.
               But what we're doing is, unlike maybe a ranking --
     and I wasn't there during that discussion -- in a ranking
     where you want to have everything on the same level playing
               Here we're taking insights into the information.
     If we have more confidence in a certain type of information
     that we have available to us, we'll place more emphasis on
               But that doesn't mean we're going to ignore other
     areas of information, just because we don't have as much
     confidence in them.
               We may tailor the impact that has on our
     decisionmaking, based our confidence in that information,
     but it doesn't mean that we would want to exclude that.
               CHAIRMAN POWERS:  After you're done with these
     decisionmaking processes, is there going to be a document
     that I can read that says, okay, we had this information and
     we had confidence level 10 on it, and we had this
     information over here and we had confidence level .2 on
     this, and therefore the weighting factors were roughly the
     reciprocals of those or something like that?
               MR. KURITZKY:  To my knowledge, we're not
     attempting to quantify that type of information.
               CHAIRMAN POWERS:  So it would be impossible for
     anyone to replicate your decisionmaking?
               MR. KURITZKY:  Well, we hopefully supplied the
     basis, and maybe in qualitative form.  The process you're
     discussing would be some type of actual quantifying, ranking
     the importance of different types of input information.
               What I'm speaking of is just in a qualitative
               MR. CUNNINGHAM:  As you may recall, we talked a
     number of times about the whole issue of expert panels being
     used by decisionmakers, mostly in the context of licensee
     expert panels.
               One of the things -- if I can go back to Reg Guide
     1.174 space, I think we tried to say that there needs to be
     some sort of documentation of that expert panel to the point
     you can get some sense of how they made certain decisions.
               Again, it's not going to be quantitative, I
     suspect, but we had a goal that you could, if not replicate,
     at least try to get an understanding of why certain
     decisions were made.
               CHAIRMAN POWERS:  Here's what I'm interested in:
     Suppose that I'm a member of the public, and I look around
     and, for instance, you say, gee, you can not worry too much
     about fire barrier penetration seals.  Now, I understand
     you're not going to treat fire, but let me use that example,
     because it's particularly germane to the point I want to
               And I know from my own experience that fire
     barrier penetration seals sound like pretty important
     things.  They keep fire from spreading.
               And these guys are saying that they're of low risk
     significance, and I need to understand more about this
     because it's contraintuitive.  I think you can't preclude
     getting contraintuitive results coming out of risk
     assessments because that's been the great attraction; that
     they're better than our intuition.
               Am I going to be able to go back and say, yes, now
     I -- verily, I know my intuition about fire barrier
     penetration seals was wrong, and I agree with them, that,
     verily, they can go to low-risk significance?  I don't know
     that they are, but it's just an example.
               MR. CUNNINGHAM:  I guess that, again, in the
     context of licensees making decisions like that, presumably
     they ought to be developing that documentation.
               I think that what Alan was talking about earlier
     was how -- and what we started off on here was if we go in
     and decide that a certain regulation does or doesn't merit
     change, how do we make the decision process a little more
     transparent than it might otherwise be, and how do we decide
     how we consider shutdown risk and that sort of thing?
               That's a fair question.  I don't think we've
     thought much about how we would lay out all those decisions
     and document those decisions.
               But I think it's an important element of making a
     convincing case.
               DR. SEALE:  I have a question.  Maybe you guys
     have hidden some pretty significant commitments in this
     slide.  In particular, there is the recognition that you may
     be adding new requirements, and you may be deleting old
               Now, I personally concur with the point that it
     makes no sense to go through such an enormous effort like
     this clearly is, without exerting some hindsight-driven
     quality control on the relevance of some of the things that
     are in Part 50.
               Yet the other side of that is that you -- those
     processes of making those kinds of changes are, in my
     understanding, fairly formal and fairly detailed.
     Essentially, you're rulemaking.
               MS. DROUIN:  Okay, we're going to get into some of
     that later.
               DR. SEALE:  You're going to tell us how much of
     that you've bitten off in going into this; is that right?
               MS. DROUIN:  We're going to have a whole
     discussion here on implementation issues.
               DR. SEALE:  Okay, fine.
               MS. DROUIN:  Which will address that.
               DR. APOSTOLAKIS:  I have another question:  We
     have seen Mary and Mark many times.  Alan, you're new here.
               The standard question is, what qualifies you to
     sit over there?
               MR. KURITZKY:  Because Mary told me to come here.
               DR. APOSTOLAKIS:  That's not a qualification;
     that's why you came.  So can you give us a little bit of
     your background?
               MR. KURITZKY:  Yes.  I started in the PRA field
     out of college in 1981.  And I have worked --
               DR. APOSTOLAKIS:  '81?
               MR. KURITZKY:  '81.  I worked on a lot of PRA,
     both in this country and overseas.  And I have worked for a
     number of contracting companies.  I worked as a contractor
     at Northeast Utilities, Mr. Banaca.  And I have -- I worked
     for two years at the NRC, many, many years ago, and I have
     since come back in November.  And since I've come back, I've
     been involved in this risk-informing technical requirements
     for Part 50 as the Project Manager.
               DR. APOSTOLAKIS:  Good.  Thank you.
               MR. CUNNINGHAM:  In his early days at NRC, many
     years ago, he was involved in providing -- helping develop
     the technical basis for the station blackout rule.  So lest
     he be overly modest there --
               DR. APOSTOLAKIS:  Which college did you attend?
               MR. KURITZKY:  Maryland, University of Maryland.
               DR. APOSTOLAKIS:  Thank you very much.  Let's go
               MS. DROUIN:  Okay.
               DR. APOSTOLAKIS:  You're going very slowly, Mary.
     You're still --
               MS. DROUIN:  Yes.  I will try to make up for that.
     Probably the two points I want to make on this slide before
     we move on, is that we aren't just looking at the
     regulations themselves, but we are looking at the
     implementing documents that are associated with these
               So we would be looking at the Regulatory Guides,
     the Standard Review Plans, but also looking at how the
     regulations interact with each other.  So we're going to be
     talking more on 50.44, but whatever regulation we may be
     looking at, we not only look down, but we also look across
     to see how it interfaces, interrelates with other
               The last point is that we do intend to keep the
     design basis concept.  We might have a new set of design
     bases, but to maintain a design basis concept.    Now, I'm
     trying to move on to the next one.
               CHAIRMAN POWERS:  It perplexes me.  Please go
     ahead, because it will come up on the next one as well, I
     think.  I mean, it just strikes me as surprising to hear
     someone so clearly identified with probabilistic risk
     assessment methodologies, speak at all with complimentary
     words about design basis concepts.
               And it seems to me that the two have an
     orthogonality to them.  Can you tell me why you're
     preserving the design basis concept?  I mean, it doesn't
     show up.  1.174 says preserve the defense-in-depth, but it
     doesn't seem to mention anything about preserve the design
     basis concept.  Why are you doing that?
               DR. SEALE:  It's a robust subset.
               MS. DROUIN:  I don't even know where to begin.
               CHAIRMAN POWERS:  Well, begin by telling me why
     it's a useful concept.  Because haven't -- isn't the whole
     point of the risk informed approach to take a holistic view
     of the vulnerabilities of a plant, rather than focusing on
     one hypothesized accident or a set of hypothesized
               MS. DROUIN:  But I do think that it is
     fundamentally a good design concept to design something
     against something.  I think you want those to be where you
     think your most likely accidents are going to occur.
               CHAIRMAN POWERS:  Why can't I design against a
     risk metric?  I can design against a hurricane and what I do
     is I go out and figure out what is the biggest hurricane
     that I can have and high velocity winds and I say, okay,
     that is what makes the difference.
               Why can't I equally say, gee, I want the risk to
     be 10 to the minus third or less.  I mean that seems like a
     good design to objective.
               MS. DROUIN:  I think you are now moving more into
     a design -- a risk-based more than a risk-informed concept
     here, when you start bringing in that kind of idea.
               CHAIRMAN POWERS:  Okay, so you just didn't want to
     be accused of being risk-based.  You wanted to have some
     defense that said I am only risk-informed so I will keep the
     design basis concept?
               MS. DROUIN:  No.
               CHAIRMAN POWERS:  Okay.  Can you un-perplex me?
               MS. DROUIN:  I am going to let Mark un-perplex you
     because I don't think I am going to be successful.
               MR. CUNNINGHAM:  I guess a couple of points.  One
     is if we back up a little bit, you recall that our
     implementation of the modifications to the technical
     requirements of Part 50 is intended will likely end up in
     many cases being a voluntary initiative, so one of the
     reasons for not walking away from the design basis accident
     type of concept is that the more you walk away from that to
     go to a more, if you will, risk-based argument, the more you
     will see a differentiation or separation between the plants
     that choose not to be risk-informing and the plants that
     are, and that may complicate this whole process even more
     than it already is.
               CHAIRMAN POWERS:  I would have thought the
     argument would go the other way.  I mean a proponent of
     abandoning the concept would say yes, let's make a clear
     differentiation and not get a confusion by retaining this
     anachronistic concept of the design basis accident in these
     plants that are risk-informed.
               DR. APOSTOLAKIS:  What exactly does it mean to
     retain the design basis concept?
               MR. CUNNINGHAM:  What we are talking about again
     is that there are a set of design basis accidents on the
     books and then there is what has become a stylized
     implementation of those design basis accidents.  I think at
     the conceptual level those provide some sort of measure of a
     way of implementing the concepts of defense-in-depth and
     margins and that sort of thing.
               Where people have had problems with them, one of
     the reasons people have problems with them is that the
     probabilities of some of the accidents are extremely low and
     they are stylized to the point that they convolute the
     single failure criterion into many, many different systems
     and things like that and it becomes a very artificial and
     improbable circumstance, so the idea of retaining the
     concept is you might be able to back off on this particular
     types of -- detail types of accident that you consider, but
     you want to still have some sort of a concept where you are
     having defenses against a broad spectrum of accidents,
     different types of initiators, if you will, and retaining
     margins and defense-in-depth and that sort of thing, but
     again perhaps developing a new set of accidents that might
     have more sense in the context of what we understand about
               DR. APOSTOLAKIS:  New sets in the sense that we
     have new initiators or a new way of doing this stylized
               MR. CUNNINGHAM:  It could be -- I was thinking of
     new initiators perhaps.
               DR. APOSTOLAKIS:  New initiators?
               MR. CUNNINGHAM:  Well --
               DR. APOSTOLAKIS:  My first reaction to that would
     be what's wrong with the current initiators?  I mean you
     still have to worry about the various LOCAs.
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  We have to worry about
     reactivity insertion, don't you?
               MR. CUNNINGHAM:  Maybe we are just at semantics
               DR. APOSTOLAKIS:  You may want to add or subtract
     or something a group --
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  -- but it seems to me though the
     place where you can really make a difference is this
     stylized emphasis.
               MR. CUNNINGHAM:  I guess that is what I meant --
               DR. APOSTOLAKIS:  Okay.
               MR. CUNNINGHAM:  -- when I said you can have a
     large LOCA as initiator but compounded with that over years
     has become that you have to have this type of failure and
     this type of failure and loss of offsite power and that set
     of things put together creates an accident sequence, if you
     will, of extremely low probability or frequency.  You may be
     able to redesign -- you may be able to keep the large LOCA
     but better design the requirements for the mitigating
     systems and things like that to be more balanced based on
     our knowledge of PRA.
               CHAIRMAN POWERS:  Isn't it just -- I mean you
     don't end up in the same position -- you come back and say,
     okay, I am going to keep this large LOCA concept and most of
     the plants say, well, gee, our big pipes just don't break,
     but okay, he wants to analyze big pipes, and to be realistic
     he says do this and this, but my plant doesn't have that.
     My plant is different from the one that they had in mind
     when they did this.  Now what do I do?  Whereas if you gave
     me a risk criterion, then I could pick any accident I wanted
               MS. DROUIN:  Well, I don't think you necessarily
     end up at the same place, because if you look at the large
     break LOCA, what we are talking about is maybe when you talk
     about a large break LOCA you are not talking a large
     double-ended guillotine type break LOCA.  It is a different
     type LOCA.  Now which it is I am not prepared to say at this
     point, but it is not this extreme case.
               CHAIRMAN POWERS:  Whatever you write down about
     this, this new design concept, as soon as you write it down,
     some plant somewhere is going to say, ah, but my plant is
     different.  Now you are back into -- I mean you have got to
     do something about this guy because he says my plant is not
     only different, it is better than the one you had in mind
     and this stuff is not applicable to me.
               Well, why don't you want a regulation that applies
     to anybody?  The nice thing about a risk criterion is that
     it applies to anybody.  Even if I come in with an LMFBR and
     natural enrichment fuel with heavy water as the secondary
     working fluid, I don't know why you would, but if you did,
     it would be just as easy for you.
               MR. CUNNINGHAM:  You know, perhaps the classic
     example -- when we talked about having a criteria, a core
     damage frequency criteria and/or a risk criterion is the
     example that is always brought up is that there was a
     proposal at one time to have HDGRs, modular HDGRs -- I
     believe this was a DOE proposal -- that the reactor vessel,
     the concrete reactor vessel would act as the containment.
     They wanted to know whether that could be licensed by NRC
     standards and because of defense-in-depth arguments and
     things like that we basically said no, you have got to have
     a containment.  I don't care what the probability of
     frequency of core damage is, you are going to have a
               That is probably some of the underlying thought
     that went into if we want to keep this design basis concept.
               DR. APOSTOLAKIS:  You may get a license
     application, say five years down the line, of the new South
     African design, the pebble bed reactor --
               MR. CUNNINGHAM:  Yes.
               CHAIRMAN POWERS:  They claim that there is no need
     for a containment, so the question then for the Agency will
     be do we really demand it no matter what or do we look at
     what they have done and do the regulations that allow us to
     do something else?
               But I think the concept of design basis accidents
     is really an important one, so I don't know why you decided
     to say that you retained the concept, although concept of
     course can be many things.
               Mary's point earlier that you really need to give
     something to the designers to design against, which goes
     beyond I guess what you meant, it goes beyond what Dr.
     Powers said, just 10 to the minus 4 core damage frequency,
     for example, or some allocation to the accident sequences,
     that is not something we should abandon easily.
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  But how far we go I don't know.
               DR. BONACA:  I still believe that somehow you have
     to at some point design equipment -- pumps, valves and so on
     and so forth.  Now I do believe that if you look at, if you
     use risk informed concepts you are going to find that what
     you are going to design this equipment to is to a different
     kind of targets, objectives, because you are not going to
     have double-ended guillotine break as the one defining the
     size of your HPSIs and LPSIs.  Most likely you are going to
     have a more probable range of conditions you are going to
     address, but you know I would expect that I can live with
     the concept of design basis.  It may shift as a basis and it
     may include probabilistic targets which you are talking
     about, but still you would have to have some basis to design
     your equipment.
               CHAIRMAN POWERS:  Regulators do not tell people
     how to design things in detail, and so maybe a designer does
     say okay, I have this risk criterion that I have to meet,
     but because I want to get on with the design and things like
     that I will conceive of some accidents that are possible at
     my facility and I will design against them and then I will
     get my PRA analysts and they will tell me if I meet the
     criterion or not, but in the meantime I can do some fairly
     traditional things against those.
               I mean I am not taking those away from the
     designer --
               DR. BONACA:  I understand now, because I didn't
     understand before, so what you are saying is rather than
     regulating the set of events that the designer is using to
     demonstrate that certain targets are met you simply impose
     certain targets.  Oh, absolutely.  That is a different
     concept, yes.
               DR. APOSTOLAKIS:  But we have said many times that
     this is not the only thing the Agency cares about.  We may
     not be designers but we do care about many more things than
     just the core damage frequency.
               CHAIRMAN POWERS:  Yes, but is going to a design
     basis concept the way to get to that?  These other things
     that we consider, that are concerned about besides core
     damage frequency, is the appropriate way to get to them via
     the design basis concept.  I think that is a very
     convoluted --
               DR. KRESS:  Yes, I think you are right, Dana.  I
     would define regulatory objectives, those other things, and
     make those as part of the criteria that have to be met, but
     they certainly wouldn't be specified because they are hard
     to meet by design basis accidents.
               DR. BONACA:  But you would want to make sure that
     the licensee, for example, considers a set of events that is
     broad enough.
               DR. KRESS:  Well, that is the PRA.  That is the
               DR. APOSTOLAKIS:  That's the defense-in-depth
     issues that come up and so on.
               DR. BONACA:  With PRA again, yes --
               DR. APOSTOLAKIS:  I guess what we are telling them
     is that instead of saying we retained the design basis
     concept, which really is a concept of bottom-up, we are
     telling them to go top-down.
               CHAIRMAN POWERS:  Well, I think I would just like
     to see a little more persuasive case.  What I am afraid of
     is exactly what we have seen, that they have chosen to
     retain the design basis to meet objectives that are not
     articulated, and if they have, it may well be that that is
     the way to do them, but I would like to see what the
     objectives are and why this is the preferred way to handle
     it, because I see a lot of downside to retaining the
     concepts of design basis.
               The idea that you can use risk metrics as design
     to targets I think is open to question.  I know that
     certainly the people at Oak Ridge have successfully done
     that and are very enthusiastic about using risk metrics as
     design targets.
               My own experience has been less successful in
     doing that, so it is open to debate.
               DR. APOSTOLAKIS:  I think you will gain some
     insights into the weaknesses of this process of design basis
     if you look back the last 20 years and see what PRAs have
     found that have made the Agency or forced the Agency to
     actually issue new rules, for example, and ask yourself why
     did we have to do this, why didn't the original design basis
     accident envelope protect us from this.  Why did we need an
     ATWS rule?  Why did we need the station blackout rule?
               In my mind these are failures of the design basis
     accident concept because we came back afterwards doing a
     different analysis and we said, gee, we better do something
     about this.  If our original envelope was good enough, we
     wouldn't have had to do that, so maybe you will gain some
     insights there as to whether the concept deserves to be
     retained or modified or abandoned.
               MS. DROUIN:  I think there is a misunderstanding
     here.  Maybe when we get into the framework it will clarify
     it more, because when we say we are going to retain the
     design basis concept that doesn't mean in the implementation
     of risk informing the requirements that we come from a
     starting point or a perspective of here is the DBA and we
     move forward.  In fact, that is not how we are looking at
     risk informing the requirements, so I think this is a little
     bit misleading here.
               I think if we move on and we get into the
     framework I think some of your concerns will be alleviated.
               DR. APOSTOLAKIS:  So maybe the word "retain"
     should be replaced?
               MS. DROUIN:  I am not sure what we should replace
     it with, but perhaps it should be replaced with another
               DR. APOSTOLAKIS:  "Revisit" the concept.
               MS. DROUIN:  We will take that under advisement.
               DR. APOSTOLAKIS:  Oh, I didn't expect you to agree
     right here.
               MS. DROUIN:  I'll try and go through the next
     couple of slides very quickly.  They are just background.
               When you looked at SECY 264, it talks about that
     the plan has a two-phased approach.  Phase 1 deals with this
     year, whereas, come December, we plan to make
     recommendations to the Commission for approval on proposed
     changes to Part 50.
               And then in Phase 2, we would be performing the
     regulatory analysis on those recommendations that have been
     approved by the Commission, and move forward into
               DR. WALLIS:  How do you approve without doing this
     technical basis first?  Don't you have to make arguments for
               MS. DROUIN:  We will be doing some analysis in
     terms of the feasibility of it, but the detailed regulatory
     analysis would be done after the Commission approval.  So
     there is some analysis done up front, just to show the
               In looking at Phase 1, just where were are right
     now, this is what we're doing to talk about today.  There
     have been three main things that have been done?  I
     apologize, but ignore that last bullet, because we haven't
     made really any advancements on that fourth bullet.
               But we're going to talk about the framework for
     risk-informing the regulations. And this really is probably
     the most important thing.  We put a lot of thinking into the
     process because it sets the foundation of how we plan on
     moving forward on any regulation that we undertake.
               And we want to really get -- to try and give you a
     good understanding of what we mean by this framework.
               CHAIRMAN POWERS:  I'm going to apologize for my
     own ignorance or poor memory, but 50.44 is the hydrogen?
               MS. DROUIN:  The hydrogen.
               CHAIRMAN POWERS:  Okay, my memory isn't as bad.  I
     just don't remember them by numbers.
               MS. DROUIN:  Later on, I start using words instead
     of numbers to try to help out.
               CHAIRMAN POWERS:  Good.  I want you to be
     quantitative, but not in all things.
               MS. DROUIN:  Yes.  Also, we're going to talk about
     the selection of the candidate regulations and the DBAs, and
     we also talked about in SECY 264 that we wanted to do a
     trial implementation, and the regulation that was selected
     for trial implementation was 50.44, which is the hydrogen
     rule, the gas control.
               DR. WALLIS:  Can you say what you mean by a
     framework?  I looked through the documents you sent us, and
     I wasn't sure I saw a framework.
               MS. DROUIN:  Well, that's what I'm going to get
     into next.
               DR. WALLIS:  Is that something else?
               MS. DROUIN:  That's what I'm going to talk about
     next.  That is the framework.
               We thought that how we approach these regulations,
     how we implement, you know, risk insights, that we needed a
     framework or a structure under which that we would be
     proceeding forward.
               And that's what we have tried to put together and
     what we're going to try to walk you through and explain what
     we mean by this framework.
               So, starting off, in the development of it, there
     were certain approach concepts.  I'm not sure what is the
     right word, that we wanted to inherently build into the
               And so we wanted to identify a goal.  We wanted to
     identify an approach, strategies.
               CHAIRMAN POWERS:  Let me ask you this question,
     Mary:  How quibbling are people going to be over this?  You
     say maintain the goal of protecting public health and
               If I were a quibbling sort -- and you know I'm not
     -- I would say, gee, I didn't think that was the objective
     at all.  I thought the objective was to provide adequate
     protection to the public health and safety.
               Protect the public health and safety could be
     interpreted by quarrelsome people as being an absolute
     that's probably unattainable.
               MS. DROUIN:  At one version of the slide we had
     adequate protection, but we're getting into a legal ground
     now, and I was told that I couldn't use those words.
               MR. CUNNINGHAM:  Obviously there is a shorthand
     here of we want to provide reasonable assurance of the
     adequate protection.
               CHAIRMAN POWERS:  I'm just concerned on
     perceptions and the fact that words actually count at this
     stage of formulating a regulatory process.
               And we need to be careful because --
               DR. APOSTOLAKIS:  Actually this is very important.
     Late on, I understand you're talking about goals.  And goals
     are not the same as adequate protection.
               So, I mean, I peaked.
               MS. DROUIN:  You peaked, you snuck ahead.
               DR. APOSTOLAKIS:  And also we had a presentation,
     I believe, on the slide --
               MS. DROUIN:  Right, you've seen some of these
     slides before.
               DR. APOSTOLAKIS:  And those were goals.  So I
     don't think the word, adequate protection, is really your
     goal.  You want to achieve a certain goal of public
     protection that the Commission has said are the safety
               But you're not dealing with adequate protection in
     this analysis.  Is that correct?
               Because we don't have anything quantitative
     defining or contributing to the definition of adequate
               MR. CUNNINGHAM:  That might be better to come back
     to when we get to the figure.
               DR. APOSTOLAKIS:  I think the word, goal, belongs
     there.  And you have to modify the rest to say -- or maybe
     meet the goals of the Commission.
               CHAIRMAN POWERS:  When you look at the Atomic
     Energy Act, it has implicit in it, a requirement to -- or at
     least various articulated incarnations that the Commission
     has interpreted as having a requirement that they define
     what they mean by adequate protection.
               Are you going to create a risk-informed
               MS. DROUIN:  No.  In looking at the development,
     starting at the high level, as I was saying, we want to
     maintain the goal of protecting the public health and
     safety, and then underneath that, to develop an approach
     that builds upon the defense-in-depth concept or philosophy
     or principle.  I'm trying to remember all the different
     words that are used.
               DR. APOSTOLAKIS:  Philosophy and principle are
     different things.
               CHAIRMAN POWERS:  Don't try to mix them up.
               MR. CUNNINGHAM:  We have a principle to maintain
     the defense-in-depth philosophy.
               DR. WALLIS:  My impression is that you invoke
     defense-in-depth but not in a meaningful way.  So let's see
     if you actually do something else.
               MS. DROUIN:  We're going to get --
               DR. WALLIS:  I think if you could abolish the
     words, defense-in-depth entirely, it wouldn't change
     anything in your framework.
               MR. BARTON:  Yes, it would
               MS. DROUIN:  I would disagree.  We build upon -- I
     mean, I feel very strongly that we do build upon the concept
     of defense-in-depth in what we're trying to do, and are
     developing strategies that would implement that.
               DR. WALLIS:  Show me why it helped you make a
     decision between A and B.  They had more defense-in-depth or
               MR. KURITZKY:  Show him an example in 50.44 ice
     condensers, for example.
               MR. SIEBER:  Well, it seems like you're trying to
     maintain the concept of defense-in-depth while applying this
     kind of a regulatory framework, the risk-informed regulatory
     framework.  So you aren't really building on it, it's there,
     built into the regulations already.
               You just don't want to lose it.
               DR. APOSTOLAKIS:  And there is the practical
     limitation that you already have a body of regulations.
               MR. SIEBER:  That's right.
               DR. APOSTOLAKIS:  They're not static.  You're not
     starting with a blank piece of paper, right?
               MR. CUNNINGHAM:  That's correct.
               DR. APOSTOLAKIS:  Is that the idea you are
     conveying here, that you have certain natural constraints,
     and that you're not going to start writing new regulations
     that perhaps differ too much from what we have now; is that
               MR. CUNNINGHAM:  Yes, I think that's correct.
               MS. DROUIN:  That is true, and what we're trying
     to say is that, you now, whatever options we propose, we're
     going to build upon this defense-in-depth concept.
               DR. APOSTOLAKIS:  But building upon is the
     expression, because you start -- that implies that you start
     with defense-in-depth and then you apply risk information to
     the best extent possible.
               And as you know, there are conflicting viewpoints
     regarding -- or opposing viewpoints regarding the meaning of
     defense-in-depth.  In the rationalist point of view,
     subordinate to PRA and risk information, and the
     structuralist is the supreme principle.
               MS. DROUIN:  Exactly, and you'll see that on the
     next slide.
               DR. BONACA:  But it seems to me that here you're
     committed to maintaining the philosophy unnecessarily the
     implemented condition defense-in-depth today.
               You may find through the PRA that you have better
     ways of implementing it, the intent of defense-in-depth.
     Still, you're not committing to maintain all the
     implemented, existing implemented defense-in-depth
               MS. DROUIN:  Not today, necessarily.  And that's
     why we get down to our last one, and we felt that we needed
     for our purposes to say what we meant by defense-in-depth,
     and to create a working definition.
               And that we were going to try and stay consistent
     with this definition.
               DR. APOSTOLAKIS:  Now this third bullet, you say
     that you want to be consistent with a safety goals and with
     the cornerstones.  These are the cornerstones of the new
     oversight process.
               MS. DROUIN:  Yes.
               DR. APOSTOLAKIS:  And that clearly you're talking
     about all modes of operation, right, not just power
               MS. DROUIN:  Correct.
               DR. APOSTOLAKIS:  So then the cornerstones, the
     idea of the cornerstones applies to low power and shutdown.
     That confuses me a little bit.
               On the one hand, I hear arguments that the risks
     from low power and shutdown, you know, may be comparable to
     power operations or an amount of control and so on.
               On the other hand, we have this principle of
     cornerstones, and we know that during those operations, at
     least three of the cornerstones are compromised to some
     extent, right?
               You have initiating events, you have mitigating
     system availability.  Clearly, that one is compromised,
               And then the primary system pressure boundary.  Am
     I allowed to use the concept of the cornerstone and say,
     gee, even though the public risk is very low from these
     operations, the mere fact I compromise so many of my
     cornerstones, you know, would demand that I understand this
     better and maybe do a more quantitative analysis.
               In other words, why are we using the cornerstones
     in certain areas and giving them a lot of importance, and
     then we completely ignore them in other areas?
               Either they are important or they are not.
               MR. CUNNINGHAM:  I don't think in the context of
     the Oversight Program that they are ignoring shutdown
               DR. APOSTOLAKIS:  They are not.
               MR. CUNNINGHAM:  They are not, and so the
     cornerstones I think as you said that would apply, full
     power operations, shutdown operations or whatever, the
     question then becomes okay, given that you are going to
     compromise some of these barriers what do you have to do to
     counter-balance that compromising to make sure that we
     continue to maintain safety, adequate safety or adequate
               DR. APOSTOLAKIS:  Well, it is not just to manage
     it, because, you know, the oversight process has clear
     numerical criteria for some of these things.  In other
     words, for the unavailability of systems it gives me
     criteria, right?
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  It says -- okay.
               MR. CUNNINGHAM:  Yes.
               DR. APOSTOLAKIS:  Shouldn't I apply the same
     criteria to low power and shutdown?  Just because I do it
     deliberately it doesn't count anymore?
               MR. CUNNINGHAM:  I have to admit I haven't thought
     much about this, how you would deal with some of the
     performance indicators and things like that, how you would
     use them in shutdown operations -- I guess I haven't thought
     much about that.  I don't know.
               DR. APOSTOLAKIS:  Okay.
               DR. KRESS:  I still wanted to ask a question about
     the same bullet.  I thought you were through though.
               I wanted to know what they mean by consistent with
     the safety goals in terms of prevention and mitigation.  I
     am reading into that 10 to the minus 4 CDF and 10 to the
     minus 5 LERF, but I don't know what "consistent with" means
     in that concept.  Could you maybe expand on that a little?
               MS. DROUIN:  Can you hold on?  I think --
               DR. KRESS:  Oh, you are going to get into that
               MS. DROUIN:  We are going to get into that.
               DR. APOSTOLAKIS:  So I guess what I questioned was
     the consistency with the cornerstones and you questioned the
     consistency with the safety goals.
               DR. KRESS:  Yes.
               DR. APOSTOLAKIS:  It seems to me that the
     cornerstones are not used the same way in all regulations.
     They are important for certain things but then we go to
     other things and somehow they disappear.
               MR. CUNNINGHAM:  Again I am not sure that they
     really disappear but how they are handled --
               DR. APOSTOLAKIS:  Oh, they may be there but again
     I don't know that there is any serious effort to really try
     to see whether we are below the goals that are given in the
     new oversight process document.
               MR. CUNNINGHAM:  Yes.  There is not somebody here
     from the new oversight process to really get at that, but
     clearly there should be an answer to that question of how
     they deal with the cornerstones during shutdown operations.
               DR. APOSTOLAKIS:  Let me change the flavor of the
     question a little bit to make it more relevant to your
               I full agree with you that the oversight people
     will have to do that, but the question is when you develop a
     framework like this, what role are you going to give to the
     cornerstones?  Is it a tool only for the inspection and
     enforcement part of the Agency or also part of the
     development of a new framework for risk informing 10 CFR
     Part 50?
               MS. DROUIN:  It's your latter.
               DR. APOSTOLAKIS:  So then I will expect to see
     them taken seriously, right?  I mean you will have something
     that will refer to the cornerstones in the framework?
               MS. DROUIN:  Yes.  We are going to get to that.
               DR. APOSTOLAKIS:  Okay.
               MS. DROUIN:  Before I actually show the picture of
     the framework --
               DR. APOSTOLAKIS:  Yes, in the interests of saving
     time, Mary, unless you have something important to say on
     this one, I think we are familiar.
               MS. DROUIN:  Let me skip --
               DR. KRESS:  I would like to correct the risk --
     rationalist view a little bit.  I think they have read
     something into what we have said that's not quite true.
               MS. DROUIN:  Then please correct us.
               DR. KRESS:  Well, the regulations on risk
     information with defense-in-depth employed to validate the
     risk information and to assure the proper balance between
     prevention and mitigation is not to compensate for
     uncertainty or incompleteness in knowledge here.
               DR. APOSTOLAKIS:  I think on that point there is a
     third view that is missing here.  There is a structuralist
     and the rationalist, which I think are described well.  The
     third view is the one you are describing, which we call the
     pragmatic approach in the paper.
               DR. KRESS:  Well, I think that is the rationalist
     view though.
               DR. APOSTOLAKIS:  I mean the pragmatic approach we
     said, you know, defense-in-depth at a high level and then --
               DR. KRESS:  I think that is a third view, you're
               DR. APOSTOLAKIS:  There is a third view, the
     pragmatic --
               DR. KRESS:  I think in the rationalist view
     defense-in-depth is not employed to compensate for
     uncertainty or incompleteness of knowledge.
               I don't think that is a correct statement for the
     rationalist view.
               CHAIRMAN POWERS:  If they had access to the letter
     that we sent to the Commission I think it is a fair
     interpretation within that letter.  I think things have
     evolved some to bring out those concepts of balance a little
     more strongly.
               DR. APOSTOLAKIS:  But again I think that that
     issue of balance becoming more important is really what we
     call a preliminary proposal, which is a pragmatic compromise
     between the two and for some reason people tend to ignore
     that.  They focus on the structuralist and rationalist.
               There is a third bullet there that is missing that
     is really the pragmatic approach, if you follow the
     terminology of that paper, which is sort of a mix of the
               CHAIRMAN POWERS:  I think you're right, that
     people do tend to look at the holes in that, but I also
     think that that pragmatic view has grown within the clique
     of authors in ways that they probably couldn't have
               DR. KRESS:  You may be right.
               CHAIRMAN POWERS:  I think today we would write
               MS. DROUIN:  Point taken.  I think the big thing
     though is the recommendation and we tried to, when we
     developed our working definition --
               DR. APOSTOLAKIS:  Actually what we call a
     recommendation is a variation of the pragmatic view,
               MS. DROUIN:  Okay, good, because that's what we
     have tried to take into account, and as we go through these
     next sets of slides to take that into account in our
     development of our working definition.
               DR. WALLIS:  This is where I have some problem
     because it seems to me that the four things you list are
     simply obvious.  You have got to have an initiating event.
     You could have core damage.  You could have release and you
     have got to have a target to the public.  This is just
     physics.  It has nothing to do with defense-in-depth.  It's
     just what happens.
               DR. KRESS:  It is something to do with
     defense-in-depth.  If you --
               DR. WALLIS:  If you choose to intervene --
               DR. KRESS:  If you allocate between those four
     things --
               DR. WALLIS:  Defense-in-depth is something above
     all this which tells you how to allocate among all those
               DR. KRESS:  That is what I was saying the
     rationalist view is, but the key word in those four things
     to me is the word "limit" --
               DR. APOSTOLAKIS:  Yes.
               CHAIRMAN POWERS:  But I think it is the wrong
               DR. KRESS:  Well, I am interested in what their
     view of limit is.
               CHAIRMAN POWERS:  I think that now we would have
     encouraged them to say something like balance among the
     measures taken to limit -- limit frequency, limit
               DR. WALLIS:  Unless your defense-in-depth tells
     you how to balance, you haven't used it.
               MS. DROUIN:  We are still walking through this
     whole thing.  We are walking through it here, but can't put
     it all on one slide, I'm sorry.
               DR. WALLIS:  Well, I am telling you,
     defense-in-depth you are simply invoking it without using it
     in any way.  These are simply four physical events which are
     going to happen, and listing them doesn't tell me anything
     about what you mean by defense-in-depth.
               MS. DROUIN:  We are going to get to the figure
     that brings it all together.  We were just trying to walk
     you through.
               If it is easier for me to jump right to that
     figure, I will do that.  I mean if you want me to skip over
     these next slides.
               DR. WALLIS:  I will still have the same question.
               MS. DROUIN:  Let's go to the figure.
               DR. APOSTOLAKIS:  Okay.
               DR. WALLIS:  I think in your big framework you
     could simply remove the defense-in-depth box altogether.  It
     wouldn't change anything.
               MS. DROUIN:  There's two figures that bring all of
     this together.  What we are trying to show here is to go
     through these different concepts that we have a goal. We are
     going to achieve this goal by trying to maintain
     defense-in-depth and we have four strategies for maintaining
     the defense-in-depth.  We have two prevention strategies and
     we have two mitigation strategies, and then we have tactics
     that we are going to implement.
               DR. WALLIS:  These would be strategies if you
     didn't use defense-in-depth at all.
               MS. DROUIN:  It is defense-in-depth in that we are
     doing both.  We aren't just doing mitigation.  We are doing
     prevention and mitigation.
               DR. KRESS:  I would agree that it is
               MR. CUNNINGHAM:  But it is implicit in this
     picture that each of the four legs of this -- there is a
     balance between the four legs.
               DR. WALLIS:  The obvious thing to do is to prevent
     and mitigate.  It just makes common sense, and to say you
     are doing something wonderful like defense-in-depth is
     really misleading people.
               DR. KRESS:  It is not obvious because some people
     say all you need to do is limit the public health effects,
     that's it, and not have those other things.
               DR. WALLIS:  Well, how do you do that?  You do it
     by preventing and mitigating.
               DR. KRESS:  Or you may do it by just mitigating or
     just preventing.
               MR. SIEBER:  It's the degree to which you do each
     of these things that encompasses or embodies the concept of
               DR. BONACA:  That's right.
               DR. WALLIS:  Then give me a rationale for
     balancing.  Then you are getting somewhere.
               MR. SIEBER:  That is what risk informed is.
               MS. DROUIN:  That is what we are going to get to.
               I want to answer a question that Dr. Powers
     brought up was the use of the word "limit" because we did
     deliberately put the word "limit" there because when we get
     to the next slide we are trying to identify "limits."  What
     we are not trying to do here is doing an ALARA type approach
     where we are just going to keep pushing down and pushing
     down and pushing down with no goal in mind, that we want to
     identify a limit and once we're there, that's good enough.
               Now maybe "limit" is the wrong word but that is
     the idea we are trying to get across.
               CHAIRMAN POWERS:  You are telling me that you are
     going to create maybe a -- what is it? -- how do I
     articulate it? -- a fuzzy line akin to the fuzzy lines that
     you have in 1.174 that relate to initiator frequency.
               MS. DROUIN:  I hate to say yes, Mark, but like you
               MR. CUNNINGHAM:  I'm sorry.  I'm just not sure I
     understood the question.
               CHAIRMAN POWERS:  Well, she says that they're not
     going to push down and push down.  There is clearly some
     point at which you've done enough in eliminating initiator
               And recognizing the speaker's abhorrence of bright
     lines, I suggested, was there going to be a fuzzy line akin
     to fuzzy lines I find in Reg Guide 1.174 that speaks to the
     issue not of CDF, but of initiator frequency?
               MR. CUNNINGHAM:  There will be shadings of gray,
               DR. KRESS:  I don't see how you can do that, Mark.
     We're writing a set of regulations.
               When you put them down on paper, they are there,
     and some people are going to do something to their plant
     based on those regulations.  And they're going to end up
     with some initiating frequency and some core damage
               I don't see where the fuzziness enters into this
     picture.  I don't see how you have any -- I mean, the
     fuzziness before was related to what further things NRC
     would do, but now you're putting down a set of regulations
               DR. APOSTOLAKIS:  But if they are frequencies, you
     can't really have bright lines.  I mean, if they say as a
     guidance --
               DR. KRESS:  I can't --
               DR. APOSTOLAKIS:  If they say the mean frequency
     of medium loca should be 10 to the minus 3 or less, and
     somebody comes up with 1.5, ten to the minus three, what do
     you do?
               You see, there is some distribution there.
               DR. KRESS:  I would support your earlier proposal
     some time ago that a three-Region is a great way to get
     without bright lines and not have them at the same time.
               But --
               CHAIRMAN POWERS:  You still run into the problem
     on the --
               DR. APOSTOLAKIS:  Decreasing the fuzziness.
               CHAIRMAN POWERS:  On the limits that you put on
     either one of them.  You would never write something that he
     says.  You wouldn't say mean probability of ten to the minus
               You would say that there should be a 95-percent
     confidence that the mean probability --
               DR. KRESS:  That, to me, is a bright line.  I'm
               DR. APOSTOLAKIS:  Yes, it is a bright line.
               CHAIRMAN POWERS:  What you get out of the problem
     that he's talking about, which is what do you do when it's
               DR. APOSTOLAKIS:  But your 95th percentile, again,
     could be one point something.
               I think there has to be some allowance for this
     fuzziness.  It can't be bright.
               DR. KRESS:  What you do with the fuzziness is, you
     make two bright lines.  You're in a finite different type
               DR. APOSTOLAKIS:  I understand.
               DR. KRESS:  You can't have an infinite number of
     lines.  That's my point.
               DR. APOSTOLAKIS:  The three-region, I think,
     addresses really different issues, which is goal versus
     adequate protection.
               DR. KRESS:  No, because it tells you -- it does
     have a way to have a fuzziness in there because within
     certain region, you do something that's different than in
     other regions.
               DR. APOSTOLAKIS:  I depends on how you define the
     limits, yes, I agree.  I mean, I look those words they used
     in 1.174, increased management attention.  That was really
     nice.  It was a stroke of brilliance.
               CHAIRMAN POWERS:  You're in a different realm now.
               DR. APOSTOLAKIS:  I know, I know.  I still think
     you will have some problem with a numerical thing, but I
     wanted to offer another suggestion here.
               I think there will be instances where it will not
     be possible to have this nice separation between mitigation
     and prevention, or at least not having the four boxes.
               You may have mitigation/prevention, but not the
     four boxes inside.  For example, bypass sequences.
               DR. KRESS:  This is on the average and related to
     all -- I mean, you have a different set of these for each
               DR. APOSTOLAKIS:  Let me finish.
               DR. KRESS:  I'm sorry.
               DR. APOSTOLAKIS:  For external events, you can
     have an earthquake.  So perhaps what we need to do here is
     have another super box that includes prevention and
     mitigation.  So now you have big box, prevention and
     mitigation inside it, two boxes you have and then the two
     boxes within the each within prevention and mitigation.
               And somewhere in the text, or if there is a way to
     show that graphically, that would be great, to indicate that
     the nature of the accident sequence you are regulating --
               DR. KRESS:  I think this is a good slide here.
               MS. DROUIN:  I think this one, because it gets to
     the two different implementation strategies, where here in
     this one -- I mean, our preferred one is this one here where
     we can address each one of the four individually.
               But there are those cases, as you pointed out,
     where you can't.  So then we come up here to just prevention
     and mitigation.
               DR. APOSTOLAKIS:  But what if, for example, for
     some sequences, you may want to just say because of the
     nature of the sequence, that the frequency of -- oh, you're
     going all the way to the fatality.
               MS. DROUIN:  No, no.  The two strategies are these
     two here.
               DR. APOSTOLAKIS:  But look at this, you say that
     prevention is core damage frequency, mitigation is
     conditional -- individual fatality.
               DR. KRESS:  That's a number that they can use as a
     pragmatic number to multiply the other two by to get to that
     metric.  It's not a design -- it's not one of the limits;
     it's just a number they can use.
               DR. APOSTOLAKIS:  Wait a minute.  If I multiply
     ten to the minus four by ten to the minus two, I get ten to
     the minus six.
               DR. KRESS:  Right.
               DR. APOSTOLAKIS:  Which is close to the -- it's
     higher than the early fatality, though.
               MR. CUNNINGHAM:  It's less than or equal,
               DR. APOSTOLAKIS:  My point is that -- and maybe
     it's already there.  That's what I'm trying to understand.
               If I have a very strong earthquake that demolishes
     the containment and the core and everything, should I use as
     a criterion for that sequence --
               DR. KRESS:  Look at the title called infrequent
               MS. DROUIN:  You've got your anticipated, your
     infrequent, and your rare.
               DR. APOSTOLAKIS:  Right.  No, but my point is that
     I cannot implement -- I mean, I can't say anything about the
     conditional core damage probability.  Do I care?
               What I care about is the whole sequence now.
               MR. CUNNINGHAM:  Right, there's a set of accidents
     or initiators that are going to be so extreme so that you're
     not going to design the containment for the ultimate
     earthquake.  You can't.
               DR. APOSTOLAKIS:  But my point is that --
               DR. KRESS:  Is that what you mean by retain the
     design basis concept?
               MR. CUNNINGHAM:  There is a set of numbers that
     you just have to maintain the frequency of those challenges
     somehow, so long.  I was thinking of vessel rupture or
     something as well.
               DR. APOSTOLAKIS:  I understand.  Let me tell you
     what I was trying to say:
               I think -- and maybe it's already there; I don't
     see it -- that there will be certain situations, classes of
     accidents, for which the only thing I can do is worry about
     the very top box, try to meet the early fatality safety goal
     criteria, because I cannot break it up into other things.
               Then there is another class for which the second
     tier applies, prevention/mitigation.  And then there are all
     these internal events, really, for which the last tier
     applies.  Is that the idea here?
               It doesn't have to be.  All I am saying is that I
     think you're going to have that problem.
               MR. CUNNINGHAM:  Yes, that's right.
               MS. DROUIN:  Yes.
               MR. CUNNINGHAM:  We'll have that problem to face,
     and you'll have to --
               DR. APOSTOLAKIS:  Okay, because, in other words,
     you cannot always demand the four boxes at the bottom.  For
     certain accident sequences, it's just not practical.
               It doesn't make sense.
               MS. DROUIN:  That's exactly right.
               DR. APOSTOLAKIS:  Okay, fine.
               DR. KRESS:  Now, let me ask another question.  I'm
     sorry, I thought you were through, George.  Go ahead.
               DR. APOSTOLAKIS:  For mitigate, for the second
     tier, why did you put individual fatality there.  I thought
     you were going to put something related to releases of
     radioactivity or -- I mean, you are going all the way to the
     health consequences.
               MS. DROUIN:  Yes.
               DR. APOSTOLAKIS:  Why?  Why not LERF or something
               DR. KRESS:  That is almost a LERF, George.
               MS. DROUIN:  Because staying in consistency back
     with this, our mitigation.
               DR. APOSTOLAKIS:  Oh, you are focusing on that.
     Okay, fine, fine.
               MS. DROUIN:  But it is a combination, the number
     is trying to take into account, you know, both of these.
               DR. WALLIS:  When you put these numbers in this
     table, is this where you apply defense-in-depth, when you
     choose to distribute numbers this particular way?
               MS. DROUIN:  Yes.
               DR. APOSTOLAKIS:  Yes.
               DR. WALLIS:  When you're using defense-in-depth?
               MS. DROUIN:  Yes.
               DR. WALLIS:  You're saying we won't put all of our
     numbers in one box?
               MS. DROUIN:  That's correct.
               DR. WALLIS:  And who chose these numbers and on
     what basis?
               MR. SIEBER:  Distribution.
               MR. CUNNINGHAM:  At this point, those numbers are
     out there for debate and discussion.
               DR. WALLIS:  Someone could easily have a reactor
     which has a completely different distribution of numbers?
               DR. APOSTOLAKIS:  Sure.
               DR. WALLIS:  You can justify it?  Someone could
     come in and say we have such very good numbers in Box No. 3
     at the bottom here, they're so small that we don't really
     need them to be so big in the other boxes?
               MR. CUNNINGHAM:  Then the question that you're
     getting to is, does that provide sufficient
               DR. APOSTOLAKIS:  No, actually the way it's going
     to work at some point -- you see, defense-in-depth is an
     issue for the Commission.  It's a policy issue.
               DR. WALLIS:  But ten to the minus six is the
     product of all these numbers.
               DR. APOSTOLAKIS:  So the Commission has already
     stated the top box.  The Commission in its safety goal
     policy statement gave us the top box.
               MS. DROUIN:  Right.
               DR. APOSTOLAKIS:  At some point, after the debate
     that Mark mentioned and so on, the scrutiny and everything,
     some form of this will have to go to the Commission for
     approval, because it's a policy issue.
               MS. DROUIN:  That's exactly right.
               DR. APOSTOLAKIS:  In which case then, a licensee
     cannot come back here and claim that they have such a good
     condition on early containment failure probability that they
     can afford to have a higher core damage frequency.
               DR. WALLIS:  So this is where you have exercised
     some kind of defense-in-depth by saying we're more sure
     about one of these boxes than another; therefore, we've
     given this box more importance than another?
               MS. DROUIN:  Exactly.
               DR. KRESS:  It's not necessarily more sure.  It
     could be one of the criteria.
               DR. WALLIS:  Less uncertain then?
               DR. KRESS:  Well, that could be one of the
     criteria.  The other criteria could be we value not having
     that thing a lot more than the other.
               DR. WALLIS:  So this is where you've actually used
     defense-in-depth consciously?
               MS. DROUIN:  Very consciously.
               DR. APOSTOLAKIS:  In fact, the agency, de facto,
     has declared that preventing core damage is roughly 1,000
     times more important than the condition of early containment
               DR. WALLIS:  That would seem to be putting your
     eggs in one basket.
               MR. SIEBER:  On the other hand, these numbers are
     already there because the plants are already built, and
     that's the way they will come out.
               MS. DROUIN:  And these are also guidelines for us.
     These numbers are not going to show up in any regulation.
               DR. KRESS:  That's the part I was going to ask.
     They're not going to show up --
               MS. DROUIN:  Not in any regulation.
               DR. KRESS:  That, I think --
               MS. DROUIN:  As we go and risk-inform something --
               DR. KRESS:  Those might be in a Reg Guide, though?
               DR. APOSTOLAKIS:  Have to be somewhere.
               DR. BONACA:  Let me just say that there is a lot
     of striking similarity between the bottom line and the ANSI
     standards that were used to design the current plants.  They
     didn't talk about core damage frequency; they talked about
     something very similar.
               Infrequent means that you can have some fuel
     damage.  Very frequent, you can have defined fuel damage.
               Clearly, in absence of core damage frequency, they
     had to use some surrogate.  But there are similarities
     there, so in that case you had ANSI standards that the NRC
     endorsed the regulation.
               Now you don't have that, but somewhere, these had
     to be, because it really replaces those standards.  That's
     what this is, the whole structure.
               MS. DROUIN:  And there are issues that we're still
     grappling with in the implementation, you know, of this
               I mean, for example, you know, do you this by a
     whole group of initiators, or do you do it by a class?
               I mean, say that you have a class of initiators
     such as loss of offsite power.  It fails a particular
     criteria, but can you meet if the whole aggregate of your
     set of initiators meet it?
               There are issues embedded in here that we're still
     working our way through.
               CHAIRMAN POWERS:  I guess one of the surprising
     things about this, especially the bottom row, very important
     document that this agency's produced that I personally am
     very fond of, and derive a great deal of information from on
     the insights from the AIPE exercise.
               In there they show on some nice plots that, gosh,
     the containment, conditional containment failure
     probabilities for BWRs exceed all but perhaps the
     bottom-most limit you have written down there, whereas many
     PWRs would not exceed any of the limits that you put down
     there.  Then it goes on -- but not to worry because the
     conditional core damage probabilities of these BWRs is so
     much lower, so there is approximately equivalent safety.
               I rather suspect you are familiar with that
               MS. DROUIN:  No, I am not at all.
               CHAIRMAN POWERS:  I mean it looks like it.  Why
     are those two things, in the face of all this evidence we
     got from the IPEs it says we ought not separate conditional
     core damage probability into one set of cases and
     conditional early containment probability into another set
     because our existing plants don't separate nicely that way,
     did you go ahead and create two columns there?
               MS. DROUIN:  I guess I didn't view it that way,
     that these were contradicting each other.
               CHAIRMAN POWERS:  What I am saying is it is
     contradictory to your experience with the existing set of
     reactors and I think as Jack Sieber pointed out we have got
     plants that are built now and one would think that at the
     very minimum you would want to write this risk informed set
     of regulations so that they were applicable to the plants
               As I read this, it would be suitable only for the
     PWRs.  I mean it is a PWR-biased categorization here.
               DR. KRESS:  I agree with you, Dana, and the
     question I was going to ask is if we had a quantification of
     what we call adequate protection, that is what you are
     talking about.  That is a quantification of it in the IPEs
     and it seems to me like if our goal with risk informing the
     regulations is to maintain the same level of adequate
     protection the numbers we would have under "prevent" and
     "mitigate" would be different than those numbers that we
     have up there.
               Those are the goals.  They are not adequate
     protection, and that is what concerns me a little about the
     whole thing.  I think we need things in there that are
     different numbers than those just because of the reason you
               CHAIRMAN POWERS:  I mean the alternative, it seems
     to me, based on experience, based on this wonderful document
     produced by an incredibly insightful senior author --
               CHAIRMAN POWERS:  -- that comes back and says now
     do not create two columns here because that is not the
     way -- the risk insight we got from the IPEs says that you
     really shouldn't do that.
               DR. KRESS:  I think you could create two columns
     but they would be different numbers than what they have up
               DR. APOSTOLAKIS:  Have you read that report, Ms.
               CHAIRMAN POWERS:  Let the record show Ms. Druin is
     in fact the senior author of this very, very good document.
               DR. KRESS:  My point is that two columns are fine.
     That is a manifestation of defense-in-depth.  It's just that
     the numbers are not compatible with adequate protection.
               CHAIRMAN POWERS:  Tom, I still think that the
     compatibility with defense-in-depth is achieved with three
     columns.  The violation of what I think the lessons learned
     from IPE is -- it should be one column.  I mean it could be
     one column.  That is one way to get around it.
               The other way to get around it is to change the
               MR. CUNNINGHAM:  Another way to get around it is
     differentiate, have different numbers for PWRs and BWRs or
     different design containment classes.
               DR. KRESS:  Yes, but that doesn't make any sense
     at all -- I think that would be a real mistake.
               CHAIRMAN POWERS:  I think you take the ground
     rules and I think the implicit ground rules and it may in
     fact be even explicit, it says let's risk inform these
     regulations pursuing what reactors are going to have to deal
     with, and that is a fairly finite set.  I mean it's
     certainly ones we have got now, very much it's the ones we
     have got now.  It might even be the evolutionary reactors
     and the advanced reactors that we have certified I still
     think you're compatible.
               Do you get to a reactor like the pebble bed?
     Maybe the designers come in and say that they are persuaded
     that it doesn't need a containment.  I think they have
     got -- the burden of proof is on their shoulders.
               DR. APOSTOLAKIS:  But shouldn't this regulation be
     written in a way that provides sufficient flexibility to
     accommodate all these various cases?
               CHAIRMAN POWERS:  I think it would be very
     desirable to do that.  I think that is asking an awful lot.
               DR. BONACA:  I think there is only one
     accommodation.  What I mean is that for a BWR really what we
     are doing for a BWR really what we are doing right now, we
     are cashing in some extra prevention capability we have for
     less mitigation that we have because of containment.
               I don't think the opposite would be allowed by the
     goals we have because 10 to the minus 4 is a goal that we
     have in place for plants and I don't think you would say,
     all right, 10 to the minus 3 core damage frequency is
     acceptable because I have a containment that has a 10 to the
     minus 3 mitigation capability.
               DR. KRESS:  Well, there is a rationale, Mario, to
     say that sort of stuff, and I wish -- I want to get it on
     the table eventually, and it is a rationale for having
     perhaps different numbers for BWRs and PWRs and that is what
     you want to do is have an acceptable uncertainty in the
     final answer.
               Now if you make that, if you can get that --
     that's an undefined number, that acceptable uncertainty, but
     if we had a number for it, if you could meet that acceptable
     uncertainty better by doing it one way versus the other,
     then that ought to be the way to do it, as long as the
     uncertainty is acceptable.  That is the key that is missing
               DR. APOSTOLAKIS:  You know what?  This is
     beautiful.  This conception -- those guys have to implement
     it.  I don't know how beautiful it is for them.
               You are going down the list here, having as
     guidance the uncertainty in the numbers that the assessment
     gives you -- that is another way of saying what Dr. Kress
     just said.  If you can demonstrate with reasonable assurance
     that you meet the early fatality safety goal and the latent
     cancer fatality safety goal you don't have to do anything
     else.  Now in practice of course it is doubtful you are
     going to do that, so you go to the next level.
               Are you demonstrating with good -- I don't want to
     use reasonable assurance, but, you know, with sufficient
     confidence that you have met the core damage frequency goal
     and the conditional containment.  If you have, then stop
     there.  You don't have to go below.
               DR. KRESS:  If you haven't, you do something else.
     You go more.
               DR. APOSTOLAKIS:  But if you don't then you better
     give us additional assurance.  Go to the four columns you
     have there.
               This brings me to another question.  Where are the
               DR. KRESS:  Actually those four columns could be
     viewed as cornerstones.
               DR. APOSTOLAKIS:  But they are not "the"
     cornerstones.  No, I think we should take that list very
     seriously.  We can't just say this is only for enforcement
     and inspection.  Either we worry about these things or we
               DR. KRESS:  Those pretty well parallel the
               DR. APOSTOLAKIS:  But they are not the same.
               DR. KRESS:  They have left out things like
     security --
               CHAIRMAN POWERS:  Let me interject and ask the
     subcommittee chairman where we stand on getting through
     this.  I do have some time constraints today.
               DR. APOSTOLAKIS:  I understand that.
               CHAIRMAN POWERS:  Should we perhaps let the
     speaker get through the next 10 viewgraphs, just to find out
     what she has to say?
               DR. APOSTOLAKIS:  I would propose something
     else --
               MS. DROUIN:  Money.
               DR. WALLIS:  I would like you to do something for
     me.  My colleagues are far too complicated.  They get into
     all these details.  In principle, what you are saying I
     think is that if you have some sort of template like this
     you could take all the existing regulations, LOCA and stuff,
     and you could see how it fits into this framework of stuff,
     and you could see whether or not they are overly
     conservative or overly liberal of whatever they are, and
     then you could then decide whether to change them.
               MS. DROUIN:  Right.
               DR. WALLIS:  In principle it should be possible to
     apply this to the whole body of regulations as they now
               MS. DROUIN:  Correct.
               MR. SIEBER:  Actually, you are going a step
     further than that in trying to regulate to a set of numbers
     that is something like this in these different boxes, is
     that not true?
               MS. DROUIN:  Well, if I go back to our other
     figure, in getting to Dr. Wallis's point, when we look at --
     this is just an example here --
               DR. WALLIS:  Go to PTS and say what does it buy
     you in terms of these 10 to the minus whatevers.
               MS. DROUIN:  And see where do the regulations map
     into here and how well do they map and have they done it the
     best way, the best risk informed way.
               MR. SIEBER:  But it is a mistake to think that all
     the body of regulations that you have cover all the elements
     of risk and uncertainty in the plant.
               MS. DROUIN:  That's correct.
               MR. CUNNINGHAM:  Right.
               MR. SIEBER:  It's probably one small fraction of
               MS. DROUIN:  Right.  What we don't have a
     viewgraph on here is that this is looking at the regulations
     in a sense from a bottom-up -- or, you know, people call it
     different things -- but one of the things that we are doing
     is taking the insights from that wonderful document and
     seeing where there are risk significant concerns and then
     mapping those to how have they been covered in the
     regulations or if they have been covered in the regulations,
     and if not, should they be covered in the regulations, so
     that is another process that as we look at this framework --
     to see if there's potential holes.
               DR. WALLIS:  This is where I was looking for a
     different sort of framework.  I would sort of I guess be
     willing to start off with this figure at the beginning of
     your discussion without any discussion whatsoever and then
     give me a framework for how you are actually going to apply
     it.  That is what I didn't see.
               MS. DROUIN:  That's correct.  You haven't seen
               DR. WALLIS:  Because I could have taken this, I
     think, with about five minutes of discussion.  I don't know
     why we spent all this time.
               DR. APOSTOLAKIS:  Well, we are trying to give some
     help to the guys.  I mean we are not just criticizing -- I'm
     sorry, had you finished, Graham?
               DR. WALLIS:  Yes, I think so.
               DR. APOSTOLAKIS:  I have to intervene.  You can't
     through all your viewgraphs -- you use your judgment and hit
     the important points and wrap it up by 2:55 --
               MS. DROUIN:  I think so.
               DR. APOSTOLAKIS:  2:55 you are out, right?
               MS. DROUIN:  Okay.
               DR. APOSTOLAKIS:  In the middle of a sentence.
               MS. DROUIN:  All right.
               DR. APOSTOLAKIS:  Because we have to give some
     time to Mr. Christie.
               MR. BARTON:  You are taking away her time, George.
               DR. APOSTOLAKIS:  She can actually leave now.
               MR. CUNNINGHAM:  Just to be clear, you want Mary
     to keep talking until 2:55 and then you will talk or --
               DR. APOSTOLAKIS:  No.
               MR. CUNNINGHAM:  -- or we will have the complete,
     the Staff's presentation will end at 2:55?
               DR. APOSTOLAKIS:  Yes, because Mr. Christie has
     requested time.
               MS. DROUIN:  I understood that is what you meant.
               MR. MARKLEY:  And NEI.
               DR. APOSTOLAKIS:  And NEI?
               MS. DROUIN:  I am not going to spend a lot of time
     on this --
               DR. APOSTOLAKIS:  Wait, that changes it.  The
     total is 15 minutes?  Okay, 2:55.
               MS. DROUIN:  2:55?  Now if I finish earlier, do I
     get a bonus?
               DR. APOSTOLAKIS:  Yes.  Buy you a cup of coffee.
     Why don't you go to what you consider are the key issues
     that you would like to bring to the attention of the
     committee and maybe get some feedback.
               MS. DROUIN:  One of them is where Dr. Wallis left
     off, where we are just now starting.  You know, we have
     gotten this framework but now how do we implement it?  That
     is, you know, the $80,000 question and this is not meant to
     list all the issues.
               Here are just some of the issues that we are
     coming across.
               I'm sure that as we get into it, there are going
     to be more issues that we are going to unravel.
               But here, we're just --
               DR. APOSTOLAKIS:  And as you talk to this
               MS. DROUIN:  Excuse me?
               DR. APOSTOLAKIS:  And as you come to this
               MS. DROUIN:  And as we come to this Committee,
               But the application of the single-failure
     criterion, whether you should do it, how you implement it,
     is an issue.
               How we --
               CHAIRMAN POWERS:  Why does it even exist in a
     risk-informed regulation?
               MS. DROUIN:  That's one of the issues.
               MR. CUNNINGHAM:  That's a fair question.
               MS. DROUIN:  A very fair question; does it make
     sense in a risk-informed environment to have the single
     failure criterion?
               CHAIRMAN POWERS:  Is there any convolution of the
     logic that would lead to it?
               MR. CUNNINGHAM:  Yes, there is.  Again, the
     question of single-failure criterion as a concept or as it
     has been applied, the application has evolved considerably
     with time to be perhaps more constraining than the original
               The original intent may still make sense, but --
               DR. APOSTOLAKIS:  Well, you know, as a general
     principle, I mean, there is such a thing as the principle of
     conservation of requirements, perhaps, or knowledge.  I
     mean, you are creating new requirements at a higher level.
               Something has to give at the lower level.  I mean,
     we can't preserve everything we've been doing for 40 years
     and on top of it say, now we want this frequency for core
     damage.  I mean, that would argue against the single-failure
     criterion, in my view.
               So, bear that in mind, that we are not here just
     to add to the regulations.  I mean, the fact that you put
     those big requirements up there has to have some impact on
     what you put --
               DR. KRESS:  You may be able to meet them only with
     the single-failure criterion.
               DR. APOSTOLAKIS:  But that's a separate issue.
               MR. CUNNINGHAM:  In this environment, the question
     is, is it a practical concept to use, to continue to use,
     given this framework and application?
               DR. APOSTOLAKIS:  It's the whole issue of
     practicality, and conceptually also.
               MR. CUNNINGHAM:  Conceptually, also, yes.  Is it
               DR. WALLIS:  Now, these numbers in your boxes are
     plant-specific.  So how do you do this mapping without
     looking at the particular plant?
               DR. KRESS:  They weren't intended to --
               DR. WALLIS:  How do you map generic regulations
     into PRA.
               DR. KRESS:  They weren't intended to be
               DR. WALLIS:  But they are.  These probabilities,
     when you calculate them, are plant-specific, aren't they?
               DR. KRESS:  Well, the idea is to --
               DR. WALLIS:  So isn't that one of the biggest
     problems with mapping general regulations into PRA.
               MS. DROUIN:  But you can see where the group of
     plants have fallen in a particular area, and one of the
     things I'm going to get to after this slide is walk you
     through 50.44, because that's our trial implementation.
               And where you might have it on a plant-specific
     basis, you still have here's what the industry as a whole
     has told you, so it's not really applied on a plant-specific
     basis in that regard.
               We've had a lot f discussion on that second main
     bullet, on how we're going to use these quantitative goals.
     And all of that, we're still thrashing out, and as we move
     forward, hopefully -- I'm sorry?
               DR. APOSTOLAKIS:  The cornerstones.
               DR. KRESS:  No, George, don't keep bringing up
     these cornerstones.
               DR. WALLIS:  I just want to say, what happens if
     you try and do it?
               DR. APOSTOLAKIS:  These are issues, these are
     implementation issues.
               MS. DROUIN:  Real quick, to your cornerstone
     thing, George, it might not be the exact words, but here are
     four of the cornerstones right here, and the other ones are
     up here in this box.  So we are not ignoring the other
               DR. APOSTOLAKIS:  What I'm saying is that there is
     an explicit cornerstone regarding the unavailability of
     mitigating systems.  And you have put it inside the core
     damage probability, which is combined now with other things.
               And my question is, why doesn't it stand alone?
     Why do I care about it when I inspect and enforce, and I
     don't care about it when I write new frameworks?
               MR. CUNNINGHAM:  As you said, this is an issue we
     have to deal with.
               DR. APOSTOLAKIS:  I understand that.
               MR. CUNNINGHAM:  And that's fair.
               DR. APOSTOLAKIS:  That's all I'm saying; that it's
     much more explicit.  I agree with Mary that everything that
     is the limit core damage frequency box, but in the other
     document, it's spelled out, the four of them.  If you
     multiply them, you get the core damage probability.
               So why do I have four there and two here?
               DR. BONACA:  There is some issue, too, about --
               MS. DROUIN:  You have the same four.
               DR. BONACA:  -- here, the separation and
     mitigation is typically by core damage.  And the others were
     not.  I mean, clearly the mitigation was intended in the old
     fashioned way of the old analysis whereby mitigating
     equipment wasn't just to mitigate core damage; it was to
     mitigate events.
               So there is some other issue that has to be dealt
     with to reconcile.
               DR. APOSTOLAKIS:  I think your major -- one of the
     biggest issues you will have here is what of the -- which
     ones of the existing regulations you want to eliminate.
               MS. DROUIN:  I'm sorry, I couldn't hear you?
               DR. APOSTOLAKIS:  Eliminate.  The fact that you
     are putting these multilevel requirements now, how far can
     you go in eliminating existing requirements.  The
     single-failure criterion, for example, is one we discussed,
     and I'm sure there are others.
               This is a key implementation issue, in my view.
               MR. CUNNINGHAM:  Again, the single-failure
     criterion is not a requirement; it's an implementation
     mechanism or something like that, embedded in requirements.
               DR. APOSTOLAKIS:  It's essentially a requirement.
     The licensee has got to meet it.  No?
               MR. CUNNINGHAM:  Anyway, we're just -- that's
     semantics, I think.
               DR. APOSTOLAKIS:  In the engineer's office, many,
     many years ago, doing some drawings because we were coming
     before the NRC, well, the single-failure criterion was very
     prominent there.
               MS. DROUIN:  Okay, for time purposes, I'm going to
     skip the whole next section and jump all the way over to
     Slide No. 25.  As I said, 50.44, the combustible gas control
     regulation, is the one that we have done for trial
               And, in fact, we went into the workshop with
     another recommendation on 50.44, and the stakeholder
     feedback supported that recommendation.  We're going to try
     to move in 50.44 on a much more expedited basis, looking at
     the timeframe of June of this year to go to the Commission
     with preliminary recommendations, and not wait till
               We're going to try and really expedite 50.44.  So
     I want to quickly walk through what we're doing on 50.44 and
     give you an idea of where we're at.
               Just quickly, in terms of our framework,
     remembering that the framework is looking at both prevention
     and mitigation, what you see with 50.44 is that it addresses
     the third strategy, of limiting our radionuclide releases.
               As we look at 50.44 there's three things here that
     I want to focus in on that as we risk inform the regulation
     and start examining the requirements we are going to
     determine if we can eliminate any non-risk significant
     elements.  Can we simplify it to make it more effectively
     meet the objective? -- but also when we look at it to see if
     there are any missing risk elements that might warrant that
     unforgivable word of "adding" to it.
               When you look at 50.44 there's six basic parts to
     the regulation, six requirements there.  The top three
     here -- I don't think that my pen will work -- there's a
     demarcation here, because there was two parts to 50.44,
     pre-TMI and post-TMI, and this was the original rule and
     then the rule was amended after TMI, which added on these
     three other requirements, so prior to TMI what you are
     seeing there is that the regulation was impacting all
     containment types and then when you got into the amendments
     post-TMI you were not necessarily impacting all the
     different containments.
               The other thing I want to point out, when we talk
     about large Drys, that also includes the sub-atmospherics,
     and that is an important point.
               What I am going to do is take those six
     requirements and walk through them and talk about the
     requirements and get into how the licensee has implemented
     the requirement, look at that implementation and the
     requirement itself and evaluate the safety significance and
     then some very early preliminary thoughts that we have right
     now for options for consideration in terms of potential
               DR. WALLIS:  Evaluate safety significance means
     some kind of a contribution to LERF?
               MS. DROUIN:  Yes.
               MR. KURITZKY:  CDF and LERF.
               DR. WALLIS:  CDFs already have --
               MS. DROUIN:  Yes.  No, that would be LERF.
               If I take our first requirement, which is
     measuring the hydrogen in containment, that is what the
     requirement states.  The implementation of it has been to
     put in safety grade instrumentation for hydrogen or oxygen
     measurement.  The fact that it is safety grade
     instrumentation, that is not the actual requirement.  The
     requirement is what you always see here in bold and
               When you look at it, the hydrogen measurement
     certainly has the capability of safety value for tracking
     and managing the accidents and here is one that also gets
     tied into Option 2, because some relaxation of the special
     treatment requirement is imposed on the equipment also.
               In looking at this particular requirement, what
     our first thoughts are is to perhaps allow some grab
     sampling instead of having a constant monitoring.  You can
     just go out and do some random sampling, and also what we
     are starting to look at is trying to determine where has the
     safety grade instrumentation been imposed.  It certainly
     hasn't been imposed by the regulation.
               DR. WALLIS:  How about not measuring it at all?
               MS. DROUIN:  Or not measuring it at all.
               DR. WALLIS:  How would you assess whether that is
     valid?  I mean you can look at the effect on LERF and it is
     going to be very small.
               How small does it have to be before you say you
     don't need any measurement at all?
               MS. DROUIN:  What I see to recall in going back
     and looking at the results from the IPEs and looking at
     NUREG-1150 is that the hydrogen -- I am trying to remember
     those numbers --
               DR. WALLIS:  Just measuring it though -- well, are
     you going to apply some criterion?
               MS. DROUIN:  In looking at what was the
     contribution to your early containment failure from a
     hydrogen combustion, and then therefore what is the need to
     measure it.
               MR. KURITZKY:  And it varies from plant type to
     plant type and containment type to containment type.
               DR. WALLIS:  You don't necessarily need to measure
     it.  You just need to prevent it burning.  I think it gets
     very complicated when you look into the details of what you
     actually buy from each one of these requirements.
               MS. DROUIN:  But when you get into some, you know,
     hydrogen combustion in some particular accidents is a
     relative contributor so there is some value in knowing what
     your hydrogen concentration is for being able to measure it,
     but whether or not you need your safety grade --
               DR. WALLIS:  There's a .1 probability of
     containment failure in the box that you showed us.  That is
     much too crude to evaluate whether or not you need to
     measure hydrogen in containment, so you need some other --
               MR. CUNNINGHAM:  Yes, that's right.
               MS. DROUIN:  Right.
               MR. CUNNINGHAM:  You need something more --
               DR. WALLIS:  Much more.
               MR. CUNNINGHAM:  Yes.
               DR. WALLIS:  That is what I was looking for was
     more a framework for how you are going to actually make
     these decisions, but may not have got that far yet.
               MR. CUNNINGHAM:  The framework that we talked
     about before might give you an idea that this is an issue to
     tackle.  What it doesn't do is give you an idea of how you
     really design what the requirements would look like.
               DR. WALLIS:  I was looking for your framework for
     deciding whether or not a regulation was necessary or needed
     to be modified.  Maybe you haven't got that far yet.
               MS. DROUIN:  Would you state that again?
               DR. WALLIS:  When you make these comparisons, how
     do you make a decision about whether or not we need to keep
     measuring H2 in containment?  That is the sort of framework
     I was looking at, for your intellectual framework for how
     you are going to start making decisions on the basis of risk
     informing.  Maybe you haven't gotten that far yet.
               MR. CUNNINGHAM:  We haven't gotten that far yet.
               MS. DROUIN:  That's correct.  Going on to the next
     requirement in terms of mixing, in looking at it from a risk
     perspective, keeping a well mixed containment atmosphere
     without hydrogen stratification we felt is important to
     safety, so often when you look at this particular
     requirement the systems that are used for mixing are also
     generally used for other functions, so on this particular
     requirement our preliminary thinking was we weren't
     proposing any changes on this particular requirement.
               CHAIRMAN POWERS:  When we took a look at 50.59,
     using the language that we have available to us now with
     modern capabilities at risk we ran into all kinds of
     problems with the quantitative adjectives that appeared in
               There was language to the effect of don't have any
     increase in risk.  At that time that language was put in
     there they meant no increase in risk to the limits that you
     could detect whether there was any increasing risk and the
     detection capability was very crude at the time.  Now it is
     much better, and the lawyers have said that poses a
     problem -- when it said none it meant none.  Now you can
     detect better and you can say that just about everything
     does have some changes in the accidents that are possible,
     so when you come in here and you have a requirement, "a
     well-mixed atmosphere" there is nothing quantitative about
     it.  It just says a well-mixed atmosphere.  Aren't you going
     to run into the same problems that I can run a CFD code --
     I'm sure Professor Wallis could lend me one that would be
     superb --
               DR. WALLIS:  Sell you one.
               CHAIRMAN POWERS:  I should have known that.
               CHAIRMAN POWERS:  And I could come in and say,
     aha! -- look right here, in this corner it is not well-mixed
     in that corner and therefore it is an unacceptable
               Aren't you inviting that kind of difficulty when
     you don't address those adjectives?
               MS. DROUIN:  I don't disagree with that.
               CHAIRMAN POWERS:  Not going to change the
     regulation anyway, right?
               MS. DROUIN:  I didn't say that.
               DR. WALLIS:  This is where you really come up
     against the nitty-gritty.
               MS. DROUIN:  Yes.
               DR. KRESS:  That's right.
               DR. WALLIS:  Find out if it is possible to do the
     job you are trying to do.
               MR. CUNNINGHAM:  That's right.
               DR. APOSTOLAKIS:  Remember, this is a work in
               MS. DROUIN:  Very much in progress.
               DR. WALLIS:  But the interesting part to me is
     whether you can make it work on any one of these things.
               MS. DROUIN:  Absolutely.
               MR. CUNNINGHAM:  And 50.44 --
               DR. WALLIS:  Even a part of 50.44.
               MR. CUNNINGHAM:  Even a part of 50.44 is
     relatively simple compared to some of the other regulations.
     It is a good test but it is a fairly simple test at this
               MS. DROUIN:  And the other part of 50.44 --
     because what you see here in terms of the work in progress
     is looking at 50.44 the way it is written today and how it
     is implemented today.
               The other thing that you don't see here, which we
     are just right now starting -- we don't have anything to
     present to you yet -- is saying let's not even look at what
     is written.  Let's look at the objective of what the rule
     was and starting with a blank piece of paper, one, do we
     even need a regulation that gets to controlling -- whatever
     the title of our regulations are -- combustible gas.
               You know, do we need such a regulation and if we
     were to write that regulation with a blank piece of paper,
     how would it be written from a risk informed manner, and so
     we are also attacking it from that perspective and coming
     from looking it this way, which we started by looking at the
     separate requirements, now starting on a blank piece of
     paper it will be interesting to see if the two converge
     whether we end up at the same place.  At this point I can't
     tell you where we are going to end up.
               DR. WALLIS:  Can you imagine a regulation which is
     a one-liner which says "Thou shalt design an H2 control
     system or combustible gas control system so that some
     probability is less than 10 to the minus X" and that's just
     the regulation, one line.
               MR. SIEBER:  I can't imagine that.
               DR. WALLIS:  Then it is up to the designer to do
     it or the licensee to show that it meets that criteria -- a
     one-line regulation.
               MS. DROUIN:  I don't know.
               DR. WALLIS:  Is that sort of thing feasible, do
     you think?
               MR. CUNNINGHAM:  Again, you can go into some of
     the regulations that we have got on the books today, the
     regulations themselves are very simple and they are not
     quite that simple but they are very simple, but then they
     will add on either an appendix to Part 50 or something that
     complicates things or a Reg Guide or something, but in many
     cases -- we have said this before in a different context --
     sometimes the regulations themselves are not the issue here.
     It is the implementing documents that complicate things
               DR. BONACA:  I just would like to make a comment.
     I made it before, but I don't think it was picked up.  We
     spoke before about correlating cornerstones with this
     approach, and you are still working on it.  I'd point out
     again that there is an inconsistency in the definitions of
     prevention and mitigations that you use here versus the
               In the cornerstone you use the traditional
     approach whereby a diesel generator unavailability falls
     into the mitigating systems.  Here you are referring to core
               MR. CUNNINGHAM:  Yes.
               DR. BONACA:  And you are looking at a mitigation
     as a condition of failure -- it's almost impossible to
     relate --
               DR. APOSTOLAKIS:  Oh, but --
               DR. BONACA:  -- and I am pointing it out because
     the new Oversight Program is supposed to be risk informed,
     but you have to make sure at some point the two things
               DR. APOSTOLAKIS:  Consistency.  There has to be
               DR. BONACA:  It's very important that you look at
     it and I think it is a work in progress so therefore you
     have the opportunity to either adjust one or the other.
               DR. APOSTOLAKIS:  Yes, that's point of view.  The
     other point, which is related to what Graham just said and
     we said earlier, is how do you decide in the diagram you
     showed us earlier to go one step down?  How do you decide to
     go one step down, and the guidance has to be the confidence
     you have in your results.
               In other words, you could in some ideal world have
     a one-line regulation, design a reactor so that the core
     damage frequency is less than 10 to the minus 4 per year,
     nothing else.  If you could do that with high confidence,
     you wouldn't need anything else, so I think that is
     something that I believe you should pay some attention to
     and see how it would guide us to do everything else because,
     yes, why do I have to worry as a regulator about measuring
     hydrogen?  There must be a reason, and the reason has to be
     the uncertainty in the final result.
               DR. WALLIS:  If you're sure it won't burn -- sure
     you don't have enough to burn, you don't need to measure it.
               DR. APOSTOLAKIS:  I mean this contributes to some
     accident sequences.
               MR. BARTON:  Yes.
               DR. WALLIS:  With a humongous containment, fine.
               DR. APOSTOLAKIS:  So it is really the final number
     that should count, so it is not just the point values we are
     using and then incidentally we are saying these are mean
     values and we think we're okay.  I think that uncertainty in
     the distribution itself is a key element here because it
     dictates how far down you will go.
               This is your last slide?
               MS. DROUIN:  Yes.
               DR. APOSTOLAKIS:  You are happy to tell us.
               MS. DROUIN:  Yes.
               DR. APOSTOLAKIS:  And you have to do it in
               Okay, I'll give you a minute.
               MS. DROUIN:  Thank you.  As we said, we are in the
     midst of preparing a status report that will go to the
     Commission, that will address a lot of the policy issues
     that we're going to need to go back on.
               As I said, we had planned to move it on an
     expedited basis on 50.44.  We're planning on holding some
     kind of public meeting in the April-May timeframe, as we get
     more of these ideas more solidified to go back and get some
     feedback from stakeholders, and go with the recommendation
     to the Commission.  I say that is approximately the June
     timeframe; that is our target date.
               We're looking at, in terms of other regulations,
     DBAs, and preliminary recommendations on those to have some
     ideas in the August 2000 timeframe.  This would go beyond
     the 50.44, and to hold a public workshop in September, and
     hopefully come back and meet with you all in October.
               DR. APOSTOLAKIS:  So that would be the next time
     we see you?
               MS. DROUIN:  Unless you wanted to meet beforehand,
     but that was the next time we were intending on coming back.
               DR. APOSTOLAKIS:  This is really important for us.
               MR. CUNNINGHAM:  You asked at the beginning of the
     meeting, when we were looking for a letter.  I volunteered
     that we were looking for a letter late this year.
               That was not in the particular context of, for
     example, 50.44.  So I tend to agree.  I'm not sure we should
     be waiting until this Fall to be talking to you again.
               DR. APOSTOLAKIS:  We should have a supplementary
     meeting first.  So I will leave it up to you to judge when
     it would be convenient and appropriate to have a
     Subcommittee meeting, so you will have something more to
     say, but it will not be near the end, so that additional
     advice will really irritate you.
               DR. WALLIS:  I'm really puzzled because I don't
     think you're anywhere near a recommendation yet.
               DR. SEALE:  That's right.
               DR. WALLIS:  You haven't even started to make any
     decisions about anything.  You have to decide how you're
     going to make decisions.  So what are you going to recommend
     by June?
               MS. DROUIN:  In June we're just dealing with
               DR. WALLIS:  But you haven't come near resolving
     any of the issues on 50.44 yet.
               DR. SEALE:  You're right.
               DR. APOSTOLAKIS:  Well, it's March 1st.
               DR. WALLIS:  I don't think there's any hope at the
     present speed.
               MR. BARTON:  It's a work in progress.
               MS. DROUIN:  Can I have 15 more seconds?
               DR. APOSTOLAKIS:  Okay.
               MS. DROUIN:  This will make you feel better,
               MR. BARTON:  I doubt it.
               MS. DROUIN:  Jus real quick, we did have a
     workshop --
               DR. APOSTOLAKIS:  We didn't talk about that, did
               MS. DROUIN:  I just wanted to give you some
     highlights from it.  There was general agreement with our
     approaching guidelines at a high level, but the thing was
     that consistency with the plant oversights, with the
     cornerstones, impact on workers, for us to keep and maintain
     a good communication with the different owners groups and
     the industry programs, because there's a lot happening in
     these areas.
               One of the things that came out is that if you
     remember, at the very beginning, we said that out-of-scope
     was emergency planning.  We've got some feedback that we
     shouldn't necessarily make that kind of statement.
               There was a lot of agreement that we should try to
     move ahead on an expedited basis on 50.44.
               DR. WALLIS:  But you don't have a plan yet.
               MS. DROUIN:  That doesn't necessarily mean that
     it's on all of 50.44.  Maybe there is a particular aspect of
     50.44 that we can move quickly on, and that's what we will
     be determining over the next three months.
               And that's all I have.
               DR. APOSTOLAKIS:  Any other comments from the
               [No response.]
               DR. APOSTOLAKIS:  Thank you very much.
               DR. WALLIS:  I think you might be in trouble if
     you didn't come back to us several times.  You might come
     back and we might say you haven't got there yet.  It's still
     a long way.  I'm concerned about progress.
               DR. APOSTOLAKIS:  Late May, perhaps?  Would that
     be all right with you?  We'll leave it up to the staff.
               DR. WALLIS:  You're too high level with all this
     discussion.  You don't really get down to how you're going
     to do the job.
               MR. CUNNINGHAM:  I would think maybe the best way
     to proceed would be using 50.44 as an example to get at just
     what Dr. Wallis is saying, how do you take this from the
     conceptual level to what is this requirement going to look
     like level, and May is probably too late for that.
               DR. APOSTOLAKIS:  For reliability on PRA, but Dr.
     Wallis will have to be there.  You're not a member of that.
               DR. KRESS:  That's all right, we'll make him be
               DR. APOSTOLAKIS:  Okay, thank you very much.  I
     appreciate it.  NEI and Mr. Christie?  You can both come and
     sit there.
               If you're going to stand, we'll give you the other
     microphone.  Okay, it's up to you.  If you want to stand, we
     give you the other microphone.
               MR. CHRISTIE:  Adrian has only got one slide.  I
     see new members.  Do I have to introduce myself?
               DR. APOSTOLAKIS:  Yes, tell us who you are.
               MR. CHRISTIE:  My name is Bob Christie.  I am the
     owner of a firm in Knoxville, Tennessee that does consulting
     work for nuclear power plants and railroads and anything
     that has to do with risk and reliability evaluations.
               My background is, I started with the Tennessee
     Valley Authority in 1974.  I did four years in hell doing
     regular safety analysis, and then got the light, and I've
     now done about 20 some odd years of PRA.
               So, I was one of the utility representatives on
     the PRA procedures guide.  I have been involved in the
     efforts over the years.
               Presently, we've got in the industry, a lot of
     things to risk-inform, to move towards some more effective
     regulatory scheme by using risk-informed, performance-based
               Good enough, George?
               DR. APOSTOLAKIS:  Yes.
               MR. CHRISTIE:  Today we would like to talk a
     little bit about the meeting that happened, the workshop
     that happened last Friday.  And you have a detailed comment,
     so I'll try and make this short.
               There were two documents handed out.  One is
     called the Framework for Risk-Informed Regulation.  Another
     is called Risk-Informing 10 CFR 44.  Okay, they're both
     pretty thick documents.
               They were handed out at the beginning of the
     meeting.  I believe that I was probably the only person
     crazy enough to read the documents at night and come back on
     Friday having read the documents.  Most of the other utility
     people were smarter than I was and had not read them, and so
     what can we say?
               Okay, let's take the general approach.  In the
     first place -- and we said this in the meeting -- there's no
     general agreement on the general approach.
               I, particularly, am unclear on what it is.  I
     really don't understand it.  It appears to me to be some
     combination of risk-informed space regulation, which is
     great for my part.  But clearly they have statements in
     there that, you know, we're picking things and going to be
     consistent with the quantitative health objectives.
               Then the first thing they do is use minus four
     core damage frequency, which is inconsistent with the
     quantitative health objectives, more conservative, et
     cetera, et cetera.
               You cannot use quantitative health objectives to
     set regulations, because we all know that with quantitative
     health objectives, safe is safe enough, but they're not
     adequate protection.
               The regulations are adequate protection, the
     safety goals are how safe enough, and therefore you can't
     set regulations on the quantitative health objectives or the
     safety goals.
               So, you know, there's no -- there is definitely no
     general agreement on the approach.
               DR. KRESS:  Bob, do you think it would be possible
     to have numbers like the ten to minus four and point one
     containment, although not those particular numbers, but
     numbers like that that would represent adequate protection?
               MR. CHRISTIE:  Again, Tom, you've got to recall
     that years ago when I proposed what has become to be called
     the whole plant program, I said we ought to know the whole
     -- the numbers from top to bottom.  We ought to start at the
     top with the quantitative health objectives.
               Well, I wanted to start at the top with defining
     adequate protection.  And you know I tried a delphi process
     to define adequate protection.  I have a definition of
     adequate protection.
               DR. KRESS:  Well, would you like to share it with
               MR. CHRISTIE:  Well, it's approximately three
     percent of background, three to five percent of background.
     That's what came out of the delphi process.
               DR. APOSTOLAKIS:  What background?
               MR. CHRISTIE:  Background, for immediate
     fatalities and latent cancers.
               DR. WALLIS:  You mean the average background, not
     the background in Denver or New England?
               DR. APOSTOLAKIS:  No, he's talking about risk,
     background risk.
               MR. CHRISTIE:  The quantitative health objectives
     are based upon .1 percent of the background for individual
     fatalities and .1 percent of background for latent cancers.
               And so when I asked people to go out and do a
     delphi as to -- well, if -- and it was convoluted, but all
     of you got a copy of what I sent out.  I asked them, if we
     define adequate protection as what is the level of risk
     reached by the present regulations, what did you think the
     present regulations were?
               And I said -- and I provided a chart of my own and
     thought I might influence people, but I put my chart in an
     envelope, closed, so that they didn't too much to them and
     so on and so forth.
               Again, I have a definition in my own mind of what
     adequate protection is on the risk curve.  I now have a
     definition of what the safety goals are on the risk curve,
     and I want to know where every plant in the United States
     stands with respect to what I consider adequate protection,
     with respect to what I consider quantitative health
     objectives, with what I consider to be emergency planning,
     what I consider to be what we call, you know, release
     categories; the plant damage states; the conditional
     probability of systems working, and the initiating events.
               I just want plants to have a PRA and to know where
     they stand from top to bottom.  And each plant is going to
     be absolutely unique.
               DR. KRESS:  Let me ask you another question:  How
     much faith do you have in a delphi-arrived at definition of
     adequate protection, and don't you think that could have
     been done by just going to the IPEs, for example?
               MR. CHRISTIE:  No.  I wanted to define adequate
     protection.  IPE has got nothing to do with adequate
     protection.  IPEs were risk evaluations.
               DR. KRESS:  Well, the plants that IPEs refer to
     are the result of --
               MR. CHRISTIE:  Not of regulations.
               DR. KRESS:  -- of having met adequate protection.
               MR. CHRISTIE:  No, they're not the result of
     regulations.  All the plants that are a result of
     regulations plus all the other things we do to make the
     plant run well -- and adequate protection is, if you had a
     plant and it was done just to the regulations, what would
     the level of it be?
               Okay, the plants are probably an order of
     magnitude --
               DR. KRESS:  It's the worst plant you could build
     and meet the regulations; that's what you're saying.
               MR. CHRISTIE:  Not the worst plant; just a plant
     built to the regulations.  If you had to just sit down and
     go to through the regulations and you took out all the other
     things we do that aren't in the regulations, and make the
     plant run better, et cetera, et cetera --
               DR. KRESS:  That's what your delphi says.
               DR. WALLIS:  What would the level of protection
               MR. CHRISTIE:  Right, what would the level of
     protection be?
               DR. WALLIS:  Adequate is superfluous.
               MR. CHRISTIE:  If we define adequate protection --
               DR. WALLIS:  Real protection, is what you're
               MR. CHRISTIE:  It's not the real.  The real
     protection consists of the piece that comes from regulation
     and the piece that come from without the regulations.
               And the piece without the regulations is what has
     driven us down to probably an order or two magnitude below
     the safety goals, not the regulations.
               DR. APOSTOLAKIS:  So what you're saying is that
     what you found was that the adequate protection level was a
     factor of 20 to 30 higher than the goal?
               MR. CHRISTIE:  Give or take.
               DR. APOSTOLAKIS:  Twenty to 30.
               MR. CHRISTIE:  Somewhere in there.
               DR. APOSTOLAKIS:  Do you have a document where you
     describe this?
               MR. CHRISTIE:  No.
               DR. APOSTOLAKIS:  Do you plan to have one?
               MR. CHRISTIE:  I'm not sure why I would.
               DR. WALLIS:  Because it makes your conclusion more
               MR. CHRISTIE:  Again, we'll talk to you later.
               DR. APOSTOLAKIS:  We'll talk later.
               MR. CHRISTIE:  Okay, so the first place is -- and
     over the weekend, the comments that you see have been
     reviewed.  The comments that you see are my comments, but
     they have been reviewed by the other people in the meeting
     that were vocal enough to get up and speak.
               They've changed my comments, not substantially,
     but in many cases, they are people better with words than I
     am, and so it represents a composite of a lot of people that
     were there.
               Okay, let me emphasize, beyond a shadow of a doubt
     -- and we told everybody in the meeting that the absolute
     emphasis we saw in the meeting on adding requirements was
     unacceptable to us, because that's what we saw in the
     meeting.       The framework, and especially the 50.44, just
     added requirements to us.  And if you want to get me mad
     again, you can make me bring up the examples of why I
     thought that.
               But I don't think you want to do this.  We did it
     in one public meeting, and that was bad enough.  Two would
     be a little bit more.
               But the staff is well aware of what we were
     thinking.  Now, Nick Grantom brought up absolutely that this
     thing is critical to everything, not just to Option 3.
               If you look at what's happening to the South Texas
     Project, what you're seeing there, especially if you look at
     the request for additional information, that the South Texas
     people are now responding to, you will see clearly in there
     that the intent of many of those questions is to preserve
     the design basis, control to the design basis, and if you
     identify anything in the PRA that is safety significant in
     our terminology, then what you will do is, you will control
     it just like if it were in the design basis space.
               And that is completely unacceptable to us.  If
     there are no elimination requirements, then why are we doing
     all this?
               DR. WALLIS:  You see this as an additional
     requirement then?
               MR. CHRISTIE:  If you will read the request for
     additional information in South Texas, you will find that
     there are add-ons, lots of them.  And the way that they want
     to treat the add-ons is that they want to treat them just
     like the things.
               Now, we've been assured by the staff, some of the
     staff, that that is not the intent of those questions, and
     that we are getting a little bit bent out of shape because
     we're reading them incorrectly.
               But when I read the words, just like I read the
     words in 50.44 last Thursday night, coming from the staff, I
     read words and I work off of those words.  And I know that
     the staff, especially in Option 2, is really seriously
     trying to help and not create extra burden for us.
               But that's not what's coming across.  And it
     didn't come across last Thursday or Friday, either.  So,
     eliminating requirements is very crucial to us.  Rick gave a
     couple of options to the staff, probably in the wrong
     meeting, as to what we're expecting on the Option 2 part.
               There's a PRA uncertainty issue, and, ladies and
     gentlemen, you can read my comments.  My comments are the
     same comments that you heard from Dr. John Garrick when you
     had the joint ACNW/ACRS meeting.
               To treat uncertainty, what you do is, you know the
     factors that lead to the uncertainty, you know the magnitude
     of the uncertainty, and you know how much impact it has on
     the decision process.
               If you know all that, then you can treat and
     handle uncertainty.
               CHAIRMAN POWERS:  We have colleagues here that
     have a variety of definitions of uncertainty.  And they
     distinguish between aleatory uncertainty and epistemic
               When we interrogate them on the epistemic
     uncertainty, they say, oh, yes, but that also includes the
     things that you have not modeled.
               And so how do I know that uncertainty?
               MR. CHRISTIE:  Again, I have been doing risk
     assessments now for 20 years.  Almost every risk assessment
     I have ever done includes uncertainty.  How well we have
     included that uncertainty and that risk assessment, again,
     is in the eyes of the beholder.
               We've spent enough money, we thought, to make the
     decisions that were necessary to improve the plants and make
     sure that the plants were working well.
               I can't answer that.  We'd spend days trying to
     work on that question.
               DR. SEALE:  But it doesn't do us any good to spend
     our time arguing that it's therefore an inappropriate
     question to ask.
               MR. CHRISTIE:  Oh, I think the question of what is
     the uncertainty in your probabilistic risk assessment is one
     of the key questions that you have to answer, and you do the
     best job you can to go through the facts, identify the
     factors, try and quantify the magnitude of the uncertainty,
     and then see how it hits the -- influences the decision
               But the key is the decision process, not spending
     millions and millions of dollars reducing uncertainty.
               Once you get those factors down, if you can, and
     -- again, it will be in the eyes of the beholder, how well
     you get it down -- but it's the guys who've got the money
     that basically have to make the decision.
               DR. KRESS:  But there has to be some guidance then
     to the decisionmakers on how to use uncertainty in their
     decisionmaking process.
               MR. CHRISTIE:  Again, I was a participant in the
     PRA Procedures Guide.  We put guidance in there on how to
     treat uncertainty.  If we did a bad job, I haven't heard
     about it.
               You know, what we would add to it today, I don't
     know.  Probably we would add some things to it, because
     we're theoretically 20 years smarter.
               But if you want to go back and say in the PRA
     Procedures Guide, let's change the guidance on uncertainty,
     then, fine, you know, put together another ASME, ANS, and RC
     program and we can go do it.
               DR. KRESS:  I'm interested in guidance to the NRC
     staff on how they should use the uncertainty, assuming they
     had relatively good numbers for it.
               MR. CHRISTIE:  Oh, okay.
               DR. KRESS:  This is a different subject.
               MR. CHRISTIE:  Could be.  I'm not sure we --
     George, I think we did.
               DR. APOSTOLAKIS:  You answered the question.
               DR. KRESS:  You answered it pretty good.
               DR. APOSTOLAKIS:  And we are running out of time.
               MR. CHRISTIE:  Single-failure, hey, we don't need
     single-failure in this framework document.  You know, I
     mean, we've got PRAs.  They do single-failure,
     double-failure, triple-failure, they do common cause, they
     do dependent failures, they do anything you want them to do,
     and they do it better than anything I've ever seen before,
     and I have done them both.
               So, to try and add single-failure into some
     framework for writing regulations today is, to me -- we're
     wasting our time, in my opinion.
               The same thing would go for design basis.  There
     are some pieces of the design basis stuff that works, and
     we'll keep, but let's go to risk-informing 50.44.
               As you probably know, there is a petition for
     rulemaking that went into the Federal Register January 12th
     on 50.44.  It completely stripped all the design basis stuff
     out of the proposed rule.
               It was not relevant to public health risk, and we
     just stripped it out.
               DR. WALLIS:  It just seems to me, the biggest
     difficulty to risk-informing 50.44 or any other regulation
     is that the objective of the regulation is not cast in risk
     language.  So you don't know what goal you have in terms of
     the language you're trying to use.
               MR. CHRISTIE:  Dr. Wallis, I recommend that you
     read the petition for rulemaking, and see if we did the job
     of phrasing it in risk.  This is our attempt.
               DR. WALLIS:  You did it?
               MR. CHRISTIE:  Yes, well, myself and a bunch of
     other people.  It come from us, comes from people that have
     done risk assessment.
               DR. WALLIS:  You don't find in 10 CFR, blah, blah,
               MR. CHRISTIE:  You do find in 10 CFR, some, 50.63
     station blackout, risk, right; 64 is risk.  Oh, yes, it's
     got elements of risk in 50.63.
               DR. WALLIS:  But it's not quantified.
               MR. CHRISTIE:  No, not quantified numbers, but it
     has elements of risk to it.  So, you know, we've done that,
     put in the 10 CFR, elements of risk.  Have we done it
     successfully and well?  Again, it's in the eyes of the
               Big issue in the meeting last Friday -- and you
     can talk to some other people about it, because I don't like
     talking about it anymore -- we did simplify the procedures
     at Arkansas and San Onofre.  It was a risk-positive move.
               It was approved by the Nuclear Regulatory
     Commission in the safety evaluation report, and if you read
     the document, you will see that that may not have been true
     to the people that wrote this document on 50.44, which
     caused quite a bit of tempest.
               I would have t say, and I haven't been to all NRC
     meetings, but the meetings on Thursday and Friday and the
     workshop were the most contentious meetings I have been in a
     long time.  We had people way past the bounds, myself
     included, okay?  It's one point in time I sat down and shut
     up because all I was doing was adding to the gasoline, and I
     will say it to the NRC people that are here today -- I got a
     letter -- Tom King -- I meant no disrespect to you people or
     to you national lab people by my silence.
               DR. APOSTOLAKIS:  So where can we find all this
               MR. CHRISTIE:  It is in the framework document and
     in the 10 CFR document, the things that they handed.  It
     came in a package.
               DR. APOSTOLAKIS:  But you are summarizing this
     contentious meeting?
               MR. CHRISTIE:  Right, I am summarizing some of the
     issues in the contentious meeting and my words that
     accompany these slides.
               DR. APOSTOLAKIS:  And you are trying to be fair,
     presenting both sides?
               MR. CHRISTIE:  I am never fair.
               DR. APOSTOLAKIS:  Okay.  But you are very honest.
               MR. CHRISTIE:  I hope so.  Okay.  It became clear
     to us that some part of the NRC was to put all plug igniters
     for the large dry containments.  That's already been through
     the process, the 1509.  It shouldn't even enter in at all to
     any criteria or anything with respect to rewriting 50.44.
               The hydrogen monitoring issue, again we find no
     safety reason for hydrogen monitoring in any of the plants,
     period.  Okay?  There's a lot of operational concerns for
     hydrogen monitoring but they are operational concerns and
     they have nothing to do with what we call adequate
     protection of public health and safety.  They have to do
     with operational concerns.  They are not the primary
     parameter for any action that we know of taken in the
               DR. KRESS:  You are defining adequate protection
     in terms of the QHOs in this case?
               MR. CHRISTIE:  No.  I am defining adequate
     protection in terms of is this a primary parameter that I
     would have to have to guarantee that things work the way
     they should work, and hydrogen monitoring is not one of
     them, to the best of our knowledge.
               We do lots of things in the emergency operating
     instructions or some people call them emergency operating
     procedures.  We have lots of accident management guidelines,
     et cetera, et cetera, but it is not a key ingredient that
     would cause us to do anything different.
               If Dr. Wallis is correct, if we removed all
     hydrogen monitoring from the plant, the plants would do the
     things that they are doing and probably without it -- the
     same actions would be taken.  Okay?
               The last one is long-term hydrogen.  Again, some
     of the people in this room were involved in San Onofre.  It
     was a concern that was brought up.  The Safety Evaluation
     Report was written for San Onofre on the basis that the
     hydrogen monitoring and the long-term hydrogen recombiner
     issues were put to bed except when the SER was issued the
     recombiners were declared non-safety and hydrogen monitors
     were not.
               We still have hydrogen monitors safety-related at
     San Onofre.  In the petition for rulemaking we would no
     longer have that if that petition for rulemaking were to go
               DR. WALLIS:  Well, if you are right that having
     hydrogen measurements has no effect, then you don't need to
     be risk-informed to decide you don't need it.
               MR. CHRISTIE:  No, the basis that we got to to
     decide on what the primary measures were was a risk informed
     affair.  You could not do that decision -- we would not have
     made the decisions we made, for instance to basically depend
     on reactor vessel level, thermocouples in the core,
     radiation monitors around the core, radiation monitors in
     the containment, pressure and temperature in the
     containment, et cetera, et cetera, if we hadn't done all the
     risk assessments and ran that kind of thinking process
     through well, what is it that we really want to do.
               For instance, on hydrogen monitoring, we can have
     sequences where we will completely wipe out the core or put
     it on the floor and the amount of hydrogen won't be much at
     all.  Your design basis LOCA without any safety injection,
     for instance, is probably the classic example.  We melt the
     core with no water on it.  We won't have any zirc water
     reaction and we won't have any hydrogen but that core will
     be on the floor.
               DR. WALLIS:  You'll be making hydrogen from the
     concrete -- but we are getting into too many details.
               MR. CHRISTIE:  Yes, but when we, by the time we
     get to hydrogen -- the corium on the floor -- is there
     anything that the operators haven't done already to retain
     the containment capability such as the sprays, et cetera, et
     cetera?  Would they do anything different?  They have
     buttoned it up.  They have turned on all the active heat
     removal systems, et cetera, and Adrian -- where is Adrian?
               DR. APOSTOLAKIS:  Yes, Adrian --
               MR. CHRISTIE:  I'm sorry, Adrian, I, as always in
     these ACRS meetings, I went over.
               DR. APOSTOLAKIS:  Are you finished?
               MR. CHRISTIE:  Yes, I am finished.
               DR. APOSTOLAKIS:  Thank you very much, Bob.
               MR. HEYMER:  My name is Adrian Heymer.  I am from
     NEI.  I am a Project Manager.  I have been working on and
     off on risk informed activities at NEI since about 1993 and
     I guess I first used PRA in the field in about 1977 in a
     different country at a different time and a different place.
               I just want to say a few words to clarify some
     issues.  It may have been a boisterous workshop last week,
     but I think it was very beneficial and this meeting today
     has been -- the more you discussed this, the more I learned.
     I think when you look at the framework and you look at the
     slide that the NRC put up with the framework, the one that
     had the defense-in-depth box, I think that is a very good
               I think it may not be perfect but it is a good
     start from which we can build.  I think it is true the
     industry were confused by some of the statements -- like the
     defense-in-depth box.  We struggled with that a bit.
               We are sending a document out to get some formal
     industry feedback and we will be passing that on to the NRC.
               I think the term "single failure" that is also put
     in there we also found a little confusing.
               As to is there a general agreement on the
     approach, the guidelines and the framework, I am not quite
     sure what that entails.  It seems to be a big box of things
     to say there is a general agreement on.  I think we have got
     a good starting point.  I think the NRC Staff have done a
     very creditable job in getting to where they have got to
     today.  They have set themselves a very aggressive schedule
     on 50.44 and they have gone through this process and they
     have come to the conclusion, very much the same conclusion
     as the industry reached when it sent a letter to -- and we
     sent a letter to Chairman Meserve January the 19th, and I
     can make a copy of that available if you don't have one,
     which summarized the results of the survey the industry did
     at the back end of last year on where should we focus our
     efforts, from the benefits side, on risk informed
     regulation, the technical aspects.
               We came up with a conclusion that it is 50.44
     because we have already done a fair bit of work on that.
     That is work that went as an example to see how far we can
     get, set a timeline, reach a decision, and move forward, and
     the next one, which is a lot more complex, is 50.46, which
     really -- it's been said here before -- the regulations are
     like a carpet.  They interweave and they are all dependent
     upon each other, but if you don't look at what you can do
     with 50.46 first when you look at the other regulations, you
     tend to get locked back into 50.46.
               MR. BARTON:  What is 50.46, Adrian?
               MR. HEYMER:  The ECCS performance.
               MR. BARTON:  Okay.
               CHAIRMAN POWERS:  Let me ask you a question.
     Because the plants have been built, so many of them have
     been built, and they have been built to comply with 50.46,
     suppose I changed that regulation radically.  Would I really
     have any impact on the industry at all?
               MR. HEYMER:  Yes, I think you do as regards some
     of the day-to-day activities, as regards to the ability to
     reassess where you stand as regards -- as it cascades down,
     perhaps not just from 50.46 but as it cascades down to some
     of the other regulations.
               CHAIRMAN POWERS:  I think I might concede to you
     the point on cascading down.
               MR. HEYMER:  Yes.
               CHAIRMAN POWERS:  But the regulation itself I
     don't think gets you very much.
               MR. HEYMER:  But the issue I am trying to drive at
     and we are trying to drive at from an industry perspective
     is that unless you find out what you can do with 50.46, when
     you go to these other areas and try and determine what you
     can do with that, you get locked back up into 50.46 -- it's,
     if you like, a central regulation.
               CHAIRMAN POWERS:  I think that's true.  I can
     imagine it's true.  I haven't shown that for myself, but it
     seems to me that if I were going to do something like that
     that I would start with the GDCs.
               MR. HEYMER:  Well, you can start there.  It's just
     the fact that the GDCs are -- there's not too much in the
     GDCs that you have to change.  It's in the implementing
     documents that you would have to change, but they are linked
     back to 50.46 in itself.
               CHAIRMAN POWERS:  I think the GDCs link back to a
     good deal more than 50.46.
               MR. HEYMER:  They do, but a lot of what you might
     want to change or end up changing can be linked into 50.46
     and it provides what the industry believes is a significant
     stepping stone to moving on, not only in the other
     regulations but to reassess the plant and make improvements
     in the plant.
               I think once you have sorted 50.46 out, then you
     have got a clear path to where you need to put your
     priorities for the other regulations.
               CHAIRMAN POWERS:  Okay.  I'll think about that a
     lot, but I have always kind of looked at 50.46 not so much
     as having an impact but rather being a demonstration of
     commitment rather than having any impact simply because
     plants are already built and already has an ECCS system that
     obviously meets the requirements of 50.46 and they probably
     are not going to change that very much.  The problem is it's
     already fixed.
               Now you may be right -- they back off on a lot of
     things they maintain about it and there are other things
     they do that are hooked to it, but it wasn't first on my
               MR. HEYMER:  Okay.  I think the point has been
     made fairly forcibly a few moments ago and also in the
     workshop there are some items that are in the guideline
     documents and the material that was handed out that we will
     comment on as an industry and I think that is expected and
     we will provide those comments.
               I think it is important not to revisit issues past
     unless there is really good reason to.
               I would like to say a word about an additional
     activity that is being progressed, which I think some people
     in this room are aware of associated with Generation 4
     plants, and that is really starting off with a clean sheet
     of paper and saying where do we go with the regulations.
               There was a debate at senior levels within the
     industry on should we try that approach, and the feeling was
     no, because we want to have, if you like, two sides.  We
     want one side that can benefit existing plants and it was
     just felt that starting off with a clean sheet of paper,
     one, it might take us some time to get there, and two, it
     might be difficult to translate those into the current
     fleet, but that is going on and I see that as being another
     activity which helps to improve the regulations and focus on
     the right stuff.
               I do think we have made a reasonable start.  I
     think we are impressed with the schedule that the Staff has
     put down and placed and we hope they keep to that schedule
     and it is good they have broken down 50.44 and 50.46 into
     chunks to look at, and that is probably a good thing to do,
     but we are looking for some good management to drive itself
     to a conclusion so that we don't continue to evaluate and
     evaluate and evaluate.  There comes a time when you have to
     draw a line.
               Finally, we do need a success in risk informed
     regulation and we would go for a small success rather than a
     big success.  At the workshop I said we would take a field
     goal over a touchdown, taking the liberty to put it in
     American football terms, but there --
               DR. WALLIS:  What's a field goal?
               MR. HEYMER:  There are a lot of skeptics out there
     on risk informed regulation and I think we need to get a
     success on the board, and I think the NRC Staff is trying to
     work towards that.
               DR. APOSTOLAKIS:  So are you implying that there
     have been no successes yet?
               MR. HEYMER:  I think from where the industry
     stands at the moment they look at risk informed regulation
     and they say, well, what is risk informed regulation?  Some
     people think, well, I might consider ISI and IST as a
     partial success but I think I could go a lot further than
     what we have done in the past.
               If you mention the maintenance rules, executives
     tend to rise out of their chair very much like other people
     do on some issues associated with 50.44, and so that is not
     considered a success from the industry perspective, and
     there was a flavor -- I don't think it was meant or intended
     at the workshop -- that was mentioned before about adding
     on, and it was suggested there is also elimination, and I
     think that point was taken by the NRC as improving is
     eliminating as well as improving -- adding on -- if there is
     need to add on at all.
               I guess the other point that was made at the
     workshop and hasn't been brought up here, if you are going
     to add on, you must be careful not just to add on but you
     mustn't pile on, and there is a temptation to sometimes do
     that on voluntary efforts.  I think that has been kept in
     check in the past and it will be in the future.
               DR. APOSTOLAKIS:  You think this is voluntary, eh?
               DR. APOSTOLAKIS:  This is a personal view.  It
     does not reflect anybody else's view.
               Mr. Heymer, do you have anything else to say that
     you think is extremely important?
               MR. HEYMER:  That's it.
               DR. APOSTOLAKIS:  Okay.  Thank you very much for
     coming here.  Back to you, Mr. Chairman.
               CHAIRMAN POWERS:  I will recess the committee
     for -- till ten minutes of the hour and that will conclude
     the transcription service.
               [Whereupon, at 3:35 p.m., the transcribed portion
     of the meeting was concluded.]


Page Last Reviewed/Updated Tuesday, July 12, 2016