470TH Advisory Committee on Reactor Safeguards (ACRS) - March 3, 2000
> UNITED STATES OF AMERICA NUCLEAR REGULATORY COMMISSION ADVISORY COMMITTEE ON REACTOR SAFEGUARDS *** 470TH ADVISORY COMMITTEE ON REACTOR SAFEGUARDS (ACRS) U.S. Nuclear Regulatory Commission 11545 Rockville Pike Room T-2B3 White Flint Building 2 Rockville, Maryland Friday, March 3, 2000 The committee met, pursuant to notice, at 8:30 a.m. MEMBERS PRESENT: DANA A. POWERS, ACRS Chairman GEORGE APOSTOLAKIS, ACRS Vice-Chairman THOMAS S. KRESS, ACRS Member MARIO V. BONACA, ACRS Member JOHN J. BARTON, ACRS Member ROBERT E. UHRIG, ACRS Member WILLIAM J. SHACK, ACRS Member JOHN D. SIEBER, ACRS Member ROBERT L. SEALE, ACRS Member GRAHAM B. WALLIS, ACRS Member P R O C E E D I N G S [8:30 a.m.] CHAIRMAN POWERS: The meeting will now come to order. The is the third day of the 470th meeting of the Advisory Committee on Reactor Safeguards. During today's meeting the committee will consider the following: phenomenon identification and ranking table for the high burnup fuel; proposed resolution of Generic Safety Issue B-17, criteria for safety-related operator actions; report of the Planning and Procedures Subcommittee; future ACRS activities; reconciliation of ACRS comments and recommendations; proposed ACRS reports. A portion of today's meeting may be closed to discuss organizational and personnel matters that relate solely to the internal personnel rules and practices of this advisory committee and matters the release of which would constitute a clearly unwarranted invasion of personal privacy. The meeting is being conducted in accordance with the provisions of the Federal Advisory Committee Act. Mr. Sam Duraiswamy is the Designated Federal Official for the initial portion of the meeting. We have received no written statement or requests for time to make oral statements from members of the public regarding today's session. A transcript of portions of the meeting is being kept and it is requested that speakers use one of the microphones, identify themselves, and speak with sufficient clarity and volume so that you can be readily heard. Do any members have opening statements that they want to make for this session? I have been informed that Karen Faircloth will be leaving us for a promotion in the Chief Financial Officers' Office. Karen, you only got here. [Laughter.] CHAIRMAN POWERS: What, is it something we said? [Laughter.] CHAIRMAN POWERS: Well, congratulations, Karen. MS. FAIRCLOTH: Thank you very much. DR. SEALE: It's nice to know someone who works where they keep all the money. CHAIRMAN POWERS: Well, in that case we will move to our first presentation. I will remind members that the issues of high burnup fuel, the last time we heard about them I think was about a year ago, wasn't it, Ralph? This is this very interesting change in phenomena that occurs as fuel gets up to very high burnup that the trend in the industry is try to use fuel to ever higher burnups. The Staff has established a limit on how high a burnup they are willing to go pending additional information. They did this based on an engineering judgment, an examination of relevant phenomena, the results of tests that have been conducted in France and Japan, then they instituted a confirmatory research program with the Office of Research. In the course of discussing that research program it became obvious to us that the industry has every intention of trying to push to ever higher burnups, perhaps going beyond the current limit of 62 gigawatt days per ton to as high as 75 gigawatt days per ton, and the questions come up what kind of information do we have to present to show that using fuel to those very high levels of burnup are in fact safe, that it would be safe to do so. At the same time, the Office of Research is interested in what kinds of investigations it needs to carry out as part of its confirmatory work and Dr. Meyer has been busy designing a research program and a process for helping him direct that research work and so, Ralph, I will turn the floor over to you at this point. MR. MEYER: Okay. CHAIRMAN POWERS: I will interject that this is a presentation for information to the committee that we are not anticipating writing anything on this particular presentation, but pay close attention because this presentation constitutes background for subsequent presentations on this subject where there may well be a need to write. MR. MEYER: This morning I'll just briefly go over what the PIRT is and why we are doing it, because we had a lengthy discussion on this a year ago, and then spend a little time talking about the organization and the status of the PIRT because there have been some changes along the way and we are nearly finished with the first PIRT that we are going to do, the one on the rod ejection accident for the PWR, so I will give you some results from that and then comment on our application of the PIRT results. The application is going to be the key to solving the problems, and the application itself is not part of the PIRT process and I think this will unfold as we go through here. Just to refresh your memory, you will recall that the PIRT that we are doing is a structured way to get some technical information from a bunch of experts and PIRTs by their nature address a specific scenario and they identify phenomena that occur during that scenario and then you rank the importance of those phenomena with regard to some criteria that you define at the outset of all this. The scenarios that we have picked are listed herein the first bullet. The PWR rod ejection accident is -- DR. WALLIS: I'm sorry, I can't see because you are standing in front of the screen. MR. MEYER: I am in the way? Okay. Let me -- CHAIRMAN POWERS: I think if you just moved back to the screen -- DR. WALLIS: Or to the side or something. MR. MEYER: If I move back to the screen then I can't see my notes. [Laughter.] DR. WALLIS: Then you can speak the truth. MR. MEYER: But I want to say what is in my notes. [Laughter.] MR. MEYER: Okay. This one is a rod ejection accident in TMI-1. The second one is a BWR event which involves ATWS related power oscillations in the Lasalle plant. The loss of coolant accident PIRT will be a combination of the PWR and the BWR scenarios in the same PIRT meetings and we haven't yet defined the specific PWR and BWR scenario that we will be following, but that will be done. At a later time, not scheduled in the current round of PIRTs, we will come back and address the source term. Now what I want you to notice here is these three scenarios that we have picked are scenarios that have regulatory criteria associated with them, fuel damage limits in each case. The fuel damage limits are intended to ensure that core coolability is maintained and that damaging pressure pulses aren't generated during the event, so these are the events for which we have speed limits, so to speak, that keep us from getting into severe accident trouble, and so these are the design basis accidents which we are focusing on in the PIRT. DR. KRESS: Did you have a description of the scenario from previous work somewhere, you know, like the progression of the accident in time -- MR. MEYER: Yes. DR. KRESS: Did you take that out of what, some previous work? MR. MEYER: It's done largely from previous work and for example the first one that is the most complete, during the past two years we have been doing a lot of plant transient calculations on the TMI-1 rod ejection accident. We had a deck from an international standard problem and jointly with the French IPSN and the Russian Kurchatov Institute we have gone through a very extensive sort of round-robin calculation exercise, and we know a lot about that particular transient. DR. KRESS: That makes me feel a lot better. I was afraid you got it out of the FSAR. MR. MEYER: No, no, not at all. Okay, phenomena -- what did I want to say about phenomena? Nothing in particular. In the exercise you simply identify the phenomena and you try to rank them as high, medium or low importance. We are not trying to find out which is the most important phenomenon and what is the second and list them in that way. We just want to know which ones are really important and which ones don't matter so much, and you do that with regard to something that you have in mind. The something that we have in mind is that you don't go over this cliff and get into a severe accident. That is characterized by this long-term coolability and avoiding the pressure pulses that threaten structures, so at the outset we had this statement that the ranking criteria were going to be related to fuel integrity, fuel dispersal, long term coolability, and pressure pulses that threaten structures. DR. KRESS: Those don't seem to include anything about the source term. MR. MEYER: Not yet, no. DR. KRESS: That is for later? You'll have another criteria later. MR. MEYER: That's correct. DR. APOSTOLAKIS: So let me understand -- MR. MEYER: These events, these four events, really don't invoke challenges, big challenges to offsite doses. That is not really the thrust of analyzing these events. DR. KRESS: You are assuming ECCS works in these? MR. MEYER: Yes, right. The source term itself will be considered as a separate issue, because even when the source term is applied to the loss of coolant accident it is this hybrid analysis where you are analyzing an event that is successfully terminated and using a source term for a core melt to test the containment integrity and things like that. These three or four events, however you want to count them, we are going to look at them just from the point of view of the severity of the behavior of the fuel with regard to its long-term cooling and pressure pulse generation. DR. APOSTOLAKIS: Now let me understand a little bit the criteria there. You have a number of phenomena. MR. MEYER: Yes. DR. APOSTOLAKIS: Typically what number are we talking about? I mean it's not a fixed number or is it two or three -- MR. MEYER: No. DR. APOSTOLAKIS: No? MR. MADISON: The number of phenomena that we have considered is on the order of 100 and I can see where you are going with this question and I am going there. DR. APOSTOLAKIS: I don't know where I am going with it. [Laughter.] MR. MEYER: Well, then I think you are going to go with me. DR. APOSTOLAKIS: Okay. [Laughter.] MR. MEYER: And if you can bear with me a minute -- DR. APOSTOLAKIS: Sure. MR. MEYER: -- I believe I am going to come back in more detail to this area that you want to discuss. DR. APOSTOLAKIS: Okay. DR. WALLIS: The only thing that is different now is that the fuel has been in there a long time. MR. MEYER: Correct. DR. WALLIS: All the other phenomena are the same as when the fuel is young. MR. MEYER: They are not all the same. DR. WALLIS: They are not all the same. But they haven't changed much, have they? It's really the fuel that's changed. MR. MEYER: That is really the nub of the issue, I guess. Some of them have changed sufficiently that, for example, in the rod ejection accident we found rather early on -- early being in 1994 and -95 -- that the mechanism of failure is quite different from the one that we studied with fresh fuel. It is a brittle, cracking pellet cladding mechanical pushing interaction mechanism rather than a high temperature heatup oxidation. DR. WALLIS: It is the fuel that is different, but the actual sort of pressure temperature history and everything is still the same? MR. MEYER: Yes, yes. This is a list of the kinds of questions that we want to address with the PIRT. You are going to see as I go through here that the PIRT itself is not going to answer these questions directly but we believe that going through the exercise will put us in a lot better position to answer them. For example, we have now several different cladding alloys that are being used. We used to use only zircalloy, which is alloy principally of zirconium and tin, with some tin in it. Now Zirlo and M5 have niobium in them. M5 doesn't have any tin, so the question is do the criteria which were originally developed from experimental work done on zircalloy still apply to these other alloys. That is a big question. Can we perform expensive tests with one type of cladding and extrapolate the results to the other type with perhaps some information from less expensive tests? Some more detail questions that come up along the way -- pulse width, is it a critical parameter or not? We have seen some evidence of that, and what do we do for the BWR power oscillations. This is an event that we know very little about in terms of the fuel response at this point. I just want to emphasize as you look at these questions the fact that we view PIRT as just a tool. It is not going to answer them directly. CHAIRMAN POWERS: It seems to me when I look at this list of questions that there must be some background assumptions of things that don't need to be looked at. What I am thinking of, for example, there do not seem to be questions that relate to the propagation or damage from assembly to assembly or rod to rod? MR. MEYER: Well, those questions just aren't on this list. CHAIRMAN POWERS: Okay.a MR. MEYER: But I can assure you that those questions are discussed in PIRT panel. CHAIRMAN POWERS: And recriticality? MR. MEYER: Recriticality -- I can't recall that that has come up yet. Okay, let me go on now and talk about the organization and status of the PIRT and begin with a list of participants here. We have literally two dozen of the world's best experts in fuel behavior. DR. KRESS: Give or take one or two. MR. MEYER: Give or take one or two. You will recognize some of the names on the list, like Carl Alexander, who -- I have given him an extra A in his name; I'm sorry, Carl. But I want to talk just a minute about some of these. I have put in bold letters, four of them. These four resulted from the ACRS quadripartite interaction. So you had the Japanese, German, and French partners in your quadripartite group, and with your encouragement, we worked through those, and these are the people that we got back from Japan, Germany, and France. Now, I think most of you know by now that Franz Schmitz, who really was the dean of the group, and was responsible for a lot of progress in this area, passed away last November. And so, he has been replaced by Joell Papin from the same laboratory in Caderache, so she is working with us now regularly. DR. APOSTOLAKIS: These people are in one room and are doing this? MR. MEYER: Yes, yes. DR. APOSTOLAKIS: Wow. MR. MEYER: In fact, I will tell you that we do occasionally use two rooms. DR. APOSTOLAKIS: Scheduling those meetings must be a nightmare. MR. MEYER: Okay, we have done a little dedication of the report to Schmitz and put an inside-the-cover page to him, which I think was appropriate. Everybody was happy with that arrangement. Okay, a few more comments about the list. Half of the names on the list came from EPRI suggestions. So we have three names that came from NRC, ACRS-related; half of them that came from industry suggestions, and the rest of them, we also made arrangements for. Now, almost everyone on this list who participates, pays their own way; the companies pay their own way. There are a few exceptions, a couple of college professors and a retired guy, and we've got contracts to support those. But by and large, the industry people who come pay their own ways. There are no NRC contractors on this list. That was intentional. We thought there could be some appearance of conflict if we put NRC contractors on this list. I'm not sure how that thinks through clearly, but -- DR. WALLIS: Well, I know Hochreiter has a contract. I hate to -- that doesn't seem to be a true statement. MR. MEYER: Hochreiter? He does -- DR. WALLIS: He has a large project, yes. MR. MEYER: He doesn't have a contract from the high-burnup fuels project. DR. WALLIS: No, but he's still an NRC contractor. MR. MEYER: Okay. We tried to avoid putting the people that we worked directly with on this, but we used them -- we do use them as resource people. DR. KRESS: Did you try to get Dick Hobbins on this at all? MR. MEYER: no. DR. KRESS: Is he retired? MR. MEYER: Yes. DR. KRESS: Okay. MR. MEYER: And resource people, we've reached out to our own contractors plus some others. Typically, the way we use a resource person is, at the beginning of the activity, they will come in and make a large presentation about the scenario that we're talking about. So there's rod ejection accident, David Diamond from Brookhaven came in and made a big presentation about the analysis that had been done in the past couple of years. Phil McDonald from INEL came in and made a presentation and stayed with us through one of the sessions. Phil McDonald was the principal investigator on the PBF work and some of the SPIRT work in the other days. So he's the principal author on the classic paper on this subject in the early 80s. And more recently, when we switched to the BWR subject and had our first meeting on the BWR subject, we invited a fellow named Martin Zimmerman from the Paul Scherer Institute who had done some work on the BWR power oscillations, to come over. So, we've reached out everywhere that we thought we could benefit, and asked people to come in and provide information to this group. And that's worked out well for us. DR. POWERS: I think the Committee should really be excited about what they've done here, because this was our recommendation in this area, that they should reach out broadly. It just looks to me like they've gone a mile farther than we even anticipated they would, to reach out to get the breadth of opinion. MR. MEYER: Yes, it's hard to imagine reaching any further. I mean, we've got all the U.S. fuel manufacturers represented, universities, laboratories, foreign governments. DR. SHACK: Don't challenge us, Ralph. DR. POWERS: Come on, the astronomers are discovering these new planets all the time. You just really have a narrow focus here. [Laughter.] MR. MEYER: Okay, leave it alone. [Laughter.] DR. SEALE: And you have a fertile imagination. MR. MEYER: I think when we talked to you last Spring, we were committed to this, and we were beginning to make our plans, but we hadn't scheduled meetings, and certainly hadn't held any meetings. The first meeting was held at the end of August. And then two more meetings on the PWR were held in the Fall of the year, in October and December. We have a number of people who travel from overseas, and so we're trying real hard to schedule some of these meetings close to other events that they'll be traveling for anyway. And we've also reduced the number of meets per PIRT to two in our ambition to try and reduce the amount of travel. So the work activity is pretty intense, and you'll see that this is a four-day meeting. So they prefer to work hard for four days, rather than have to come back at another time. Now, that is a large group, and we found that it was difficult to work with everybody in the room at the same time. You're going to see in the organization of the work in just a minute, that we broke it into two types of technical activities, the experimental work and the analytical work. So we, in fact, have divided it into two groups that meet in parallel. This just kind of happened spontaneously in the PIRT effort. And the two group leaders, who, again, arose spontaneously, are Arthur Motta from Penn State in the Experimental Group, and Lee Peddicord from Texas A&M, in the Analytical Group. So now this is kind of a semipermanent, unofficial arrangement, that we break into these breakout groups and these guys take over and lead the group through its paces. Now, we have mentioned the fact that we have a website and there is the address for the website. On the website are several documents. The concept of the website originally was to hold the transcripts from the meetings. Because we had a large group, and we thought it would be difficult for the PIRT facilitator to keep detailed notes, we hired these court reporters to come in and keep a verbal transcript of the meetings. So they do that and we get them electronically and put them up on the Web. We also have background information, general background, the kind of thing that was on my one of my first slides, the list of participants, the agendas, and the schedules are put up there as soon as we have that information. And then we've also found a need to provide some more specific background information, almost guidance for the PIRT participants, prior to the meetings in the various areas. So there have been two of these background information papers put on the Web, one pertaining to the rod ejection accident and one for the BWR. DR. POWERS: Ralph, the concept of PIRT is heavily exercised in the thermal hydraulics field, and probably pretty well known by thermal hydraulics types. MR. MEYER: Yes. DR. POWERS: But you're really taking this in a very creative move and applying it to fuel behavior and perhaps even the source term issue. People are not so familiar with the ideas behind PIRT. Do you find that transition difficult? MR. MEYER: Yes. DR. POWERS: Are there lessons that you've learned out of that process? MR. MEYER: Yes. Let me just go ahead to the very next slide which addresses that, because it was difficult. It cost us one session. The August/September meeting, the three-day meeting that we had, I would describe as wandering in the desert. We were trying to work with these high-level criteria, and trying to list the phenomena that would occur. And we couldn't quite put it all together. How were we going to get anywhere with this monster? And we had to make some practical adjustments, which probably, for PIRT purists, makes some substantial changes to a PIRT activity. One of the first things that we had to do was to change the definition of phenomena, to broaden it. You could almost just put in the word, "stuff," and it would work. But we have phenomena processes, processes, conditions, properties, anything that's related to the subject that we're going to discuss, becomes a phenomenon for the purpose of the PIRT. DR. WALLIS: It's very interesting, the analysis not as a phenomenon. MR. MEYER: What? DR. WALLIS: Analysis may be a phenomenon. That puts it in a new category. MR. MEYER: Well, then in the category area, we had to break this down into some practical elements. We were struggling with these four areas, with the plant transient analysis, integral testing in big machines that cost a lot of money. Transient fuel rod codes were being used in this. Also, we're trying to measure mechanical properties to facilitate the use of transient codes to allow us to understand the experimental results to see how these fit with the plant transient. So at that point, after the first meeting, we regrouped, we decided that we would list this generalized definition of phenomena in these four categories, and we made one other major change. That was, we backed down a notch on our criteria. After discussing -- trying to discuss coolability and pressure pulse generation, we realized that we really didn't have a database, and didn't want to get into those areas with design basis accidents. So nobody wants to try and talk about debris coolability or the efficiency of a fuel/coolant interaction in a design basis accident. So we decided, as a practical matter, that we would roll this back to the fuel dispersal and flow blockage, where flow blockage here, in our minds, is like in a loca, ballooning and reduction of the flow channel area. So, these became the criteria. Now you look at the plant transient analysis and the experiments, and you rank the phenomena with regard to the outcome of the analysis or the experiment in relation to dispersing fuel or ballooning fuel rods. DR. KRESS: I think that was a good move, Ralph. That probably focused a whole lot of attention on that. DR. POWERS: I think the whole enterprise of taking this technology that's been so useful in one field and applying it in another is, Ralph deserves all the credit in the world for making that, and he also deserves credit for recognizing that a direct transfer is just never going to be possible. You have to make some accommodations to the vicissitudes of the field. So I'm not surprised at all, and I think you made some good changes. MR. MEYER: It became very apparent after the first meeting. The first meeting was uncomfortable. I mean, you're trying for three days to get somewhere, and you're frustrated, and you wander off into these deep areas that you can't handle. So, we made these adjustments, we wrote the first background paper prior to the second meeting. We put it out on the Web, we communicated with e-mail and we came back and engaged the group in this revised way of treating a, quote, PIRT. DR. WALLIS: Are you going to cover all eventualities about the fuel result without blocking and still be awkward to deal with, without necessarily dispersing? MR. MEYER: Could you say that again? I just didn't hear it. DR. WALLIS: Well, if it distorts efficiency, it may be hard to handle, or it may prevent some mechanical motion of self or rods or whatever. But it won't necessarily disperse or block flow; it just changes its geometry sufficiently so that it would be awkward to deal with. MR. MEYER: That's considered, swelling, in particular, but also bending, getting in the way of control rods. DR. WALLIS: That's included. MR. MEYER: Yes. Now, let me give you just a few sample results. I don't want to go into a lot of detail on this. In the plant transient analysis category, there were probably 25 phenomenon that were ranked. I just looked through the table and picked out a half dozen that had really, you know, like -- we voted. Let me digress here a second: With a smaller group, you might come to a consensus rather quickly on high, medium, or low. But in a huge group like this, we decided that we would vote and record the tally of votes on high, medium, and low. And we asked the PIRT members only to vote if they felt that they really had some knowledge and opinion on this subject, so that we expected that the plant transient analysis experts might not vote when you came to a question about the experimental measurement of a mechanical property. And so you don't have total votes that total up to 24. And, in fact, after doing this for awhile, it became clear that half of the room would vote on the analysis activities, and half of the room would vote on the experimental activities, and so we just got another room for them and did the work in parallel. But what I did then was to look through the table with the final vote tally, and pick out the lopsided votes for high-ranked phenomena. And here are six of them that I have on the screen here. They're not too surprising, in themselves, but you try and get from this, as much as you can. These last three, fuel temperature feedback; delayed neutron fraction; and heat capacities of the fuel and cladding, are basic properties. You can't do much about those, except get them right in your codes. But the first three, the control rod worth, the fuel cycle design, and the pin-peaking factors, you can actually change those in the core design. So I think of these three together as core design. Now, this has some practical implications. Now I'm wandering into the application part of this. So after this is done, we're sitting back and we're looking at this and saying, if you get some limiting value that is a little difficult to live with, you can alter the control rod worths and bring the deposited energy down. Or, conversely, if you have some target fuel enthalpy that you want to stay below, we began to see in the presentations, that you couldn't get up to that value if the control rod worth was not greater than such a value. It then suggested that somehow we can use control rod worth in combination with some other factors about the core design, and perhaps make some equivalence to the peak fuel enthalpy and thereby avoid doing a 3-D plant calculation for each and every core, and simply look at the core design and the control rod worths that you're going to have, and reach some judgment about whether or not this is going to exceed the fuel design criteria. DR. UHRIG: So your fuel cycle design is -- you're talking about 24 months, 18 months, or are you talking about the leakage configuration, of all of the above? MR. MEYER: All of the above. So, here is an idea, a new idea that has come out of these discussions, which we haven't completely ironed out yet. And this is one of the reasons that we're not quite ready to present the application. But this is one result of this PIRT activity that I think is going to be valuable. DR. POWERS: It looks like it's crucial, because this is the kind of information that line organizations would want to have when somebody proposed to go to high burnup. MR. MEYER: Yes. And I also want to mention that the insights that we're going to get from the PIRT activity are not all going to come from just looking at the ranking scores. But you've got two dozen people engaging in discussions for three-day periods, and during those discussions, a lot happens, and you sit there and you get ideas. So, the activity itself is part of the equation. DR. KRESS: Ralph, the delayed neutron fraction, it strikes me as a strange one to be in here, because I would have thought, number one, it has a one-to-one relationship with burnup. And it seems to me, like there is very little uncertainty in what you know about it. So that even thought it may have a real impact on what you do with the transient, how the transient goes, it seems like you know enough about it, and it's only related to burnup itself, that I don't know where I'm going, but I was surprised to see it ranked as high. I guess -- MR. MEYER: Which one was that? DR. KRESS: The delayed neutron fraction. MR. MEYER: Oh, the delayed neutron fraction, yes. DR. WALLIS: I'm really surprised that cooling of the cladding doesn't come into it. DR. KRESS: Well, I think that fuel temperature feedback implies something about how you calculate the temperature, too. But these things go so fast, that -- DR. WALLIS: But it's still pretty rapid cooling as well. DR. KRESS: I know, but I think these things are almost adiabatic, aren't they? MR. MEYER: It is nearly adiabatic. The transient is -- the pulse has a half width of about 30-50 milliseconds. And the fuel has a time constant of three to five seconds. So, you don't get a lot of heat transfer but you do get some. DR. WALLIS: If you heat up the cladding, then you probably heat up some water as well. MR. MEYER: Yes. DR. POWERS: I think that on the delayed neutron fraction, I think you're right that if you ask me about a specific piece of fuel, that I probably can calculate the delayed neutron fraction with a fair degree of accuracy. When I use these codes, I don't use that number; I use a fudge factor to give me an average. And at least one of the NRC contractors has written on this subject, saying that we need to look at it. And my recollection is that Dave Diamond was doing some uncertainty analyses on that aspect of the calculation. MR. MEYER: Yes. I think it was his presentation that led to this ranking. There are also some interesting things that don't make the high list, and one of them was rate of reactivity insertion. I think a lot of us who weren't specialists in that area thought at the outset that rate of reactivity insertion was going to be a big actor. And it wasn't. As long as you can get the reactivity inserted in about a couple hundred milliseconds, it doesn't matter. DR. POWERS: I recall lots of questions in this room, exactly about transients in the experiments being too short. And people complained that the experiment were prototypic. I think what you're saying is that as long as they're about right, it doesn't make a lot of difference. MR. MEYER: Yes. Now, the next group of phenomena are the integral experiments. These are the experiments like at Cabris or at NSRR. And, you know, at first, these don't look very surprising, but burnup of the test rod, there was a lot of discussion about burnup of the test rod. After you understand a little bit about the failure mechanism for these high burnup rods, and realize that the hydrogen embrittlement of the cladding is a major factor, you can begin thinking that, well, the actual burnup of the test rod may not be so important, as long as I've got the right amount of hydrogen in the test rod. And you might get that in -- you know there may not be a one-to-one coupling between burnup and oxidation, which leads to the hydrogen, because the oxidation is also affected by how high the temperature is in the plant, and the water chemistry. But n further probings the group realized that the burnup itself is going to lead to fission gas distributions on the grain boundaries in the pellet, and these are going to perhaps have a big effect on the implied loading on the cladding. DR. KRESS: I was going to ask you about that particular thing. Now that you are on it, I will. I would have thought somewhere in there you might have been -- the amount of time the fuel sits around after burnup, before you put it in, would be an important consideration just because you change that distribution of fission gases on the grain boundaries and you age the grains themselves and change that grain structure a little bit. Was that one of the considerations? Usually you don't just have the fuel right there after burnup -- it sits around. MR. MEYER: I don't think we talked about the time that it would sit around at room temperature, but we talked about the preconditioning that might take place in the test reactor when you are warming up and getting ready for the test. DR. KRESS: Yes. MR. MEYER: There the discussion focused more on what you might do to the distribution and orientation of hydrides in the cladding rather than on the fission products, but nevertheless the fission product issue promoted the burnup of the test rod to a high ranking and what this means in a practical way in our interpretation is that if you are going to go from 62 to 75 gigawatt days per ton burnup that you need to test rods with burnups up to 75 gigawatt days per ton and not just stop with rods that have 62 gigawatt days per ton but a lot of oxide on them, which we have in our test programs. DR. KRESS: I think that is a real good insight there. MR. MEYER: The coolant heat transfer conditions during the tests obviously have implications with regard to whether you can be satisfied with tests in a sodium loop or whether you need to test in a water environment. That one is pretty transparent. Pulse width during the test was also discussed a lot and thought to be important. There are, however, two aspects of the pulse that were not high ranked. They were only medium ranked and maybe one of them was low. I have forgotten, but there have been two concerns expressed about the pulse and the power histories. One was about the shape of the pulse. In Cabri we had one test with a big double humped pulse. They were trying to get a broad pulse and it is very difficult to operate the valves in the Helium 3 system fast, and they didn't get a good operation of the valves and they got two pulses sort of merged together with a clear dip in the middle. I thought that that was bad news, but I was probably the only one who thought that was bad news. Everybody who discussed it thought no, it doesn't matter so much as long as you get the enthalpy in the fuel, right, is the integral of that thing more than the shape of it that matters. The other related parameter that was discussed was the power history during burnup accumulation in the power plant before the rod is tested. DR. KRESS: I would have thought on the pulse width that you were right. If it is broad pulse width or humped like that you have a problem, but I would have thought that as you come down in the pulse width you will reach a place, a width, beyond which it doesn't matter anymore, and that would have been -- so as long as you stay within the given pulse width that you'll be all right. Did that come out? MR. MEYER: Well, there is a feeling that for the very narrow pulses that there is some -- I don't know if I am going to get this right -- coherency in the expansion of the gas on the grain boundaries and pushing out fragments, grain size fragments of the pellet, into the cladding, which might if given a little more time to spread out not contribute so significantly to the mechanical -- DR. KRESS: That's why I thought it would be maximum pulse width beyond which you wouldn't want to go, but if you are within that narrow range, it doesn't matter. MR. MEYER: Well, but the thinking is the other way around. If you get too small you get an extra kick from the fission gas and as long as you get above a certain amount you don't get that kick and then it's just the thermal expansion of the pellet which is related to the enthalpy that you get into the U02. DR. WALLIS: Well, if it is rapid enough, you have to worry about sort of wave-like transient propagation of things. It's more like an explosion than the swelling -- very short transients. MR. SIEBER: I presume that when you are talking about agglomerates in the test run you are talking about plutonium particle size? MR. MEYER: Yes. MR. SIEBER: Did you go to the extent to figure the effect of the particle being hot enough to burst through the cladding during the pulse? MR. MEYER: What we had presented to us was some metallagraphic examination from the Cabri test with mixed oxide fuel. Now these have the minus MOX fabrication route, which does result in plutonium-rich agglomerates. I think it's 50 percent UPU mixed oxide in those agglomerates. It's not pure PUO2, and from those results they did not see melting or gross microstructure change in the vicinity of the particles so there was the feeling that the extreme high temperature wasn't the main actor in the MOX effect which was seen prominently in these Cabri tests but rather that the MOX effect was related to a high burnup rim around each particulate. Sort of like the rim that we talk about around the outside of a UO2 fuel pellet at high burnup, you have these ultrahigh burnup islands with their own rim around them, so this is the current thinking on this, and it is not the high temperature part, so I think the melt-through of the cladding would not be thought to be an important process at the moment based on what they have seen. MR. SIEBER: There were a number of experiments in a test program called the Plutonium Utilization Program in the '70s. MR. MEYER: Yes. MR. SIEBER: Done by the Battelle at Hanford. Are you familiar with that? MR. MEYER: Yes. MR. SIEBER: Okay. They did get clad perforation on those tests. MR. MEYER: Yes. Well, when we looked at the transient fuel rod codes, and for us the transient fuel rod code is FRAPTRAN, you find some conclusions, some high ranked phenomena that seem pretty obvious, but they may have some not so obvious implications. For example, the gap size is obviously going to be a high ranked thing because you have the pellet expanding and pushing on the cladding to generate the stress that leads to the fracture. If there is a gap between the pellet and the cladding, the pellet has some free movement before it starts applying the stress, so getting the gap size is obviously going to be important. It strikes me from just sitting and listening to the discussions and putting two and two together that in our code the gap size is based largely on temperature validation of the code rather than the mechanical part. Now we do have some, because we do look at axial elongation of the cladding, which is a result of gap closure and lockup, so we have some indirect ways of measuring the interaction between the pellet and the cladding which then gives you information about the gap closure, but I would want to look back at our code and to see if there is any need to tune up the gap size modeling such that it not only hits the temperatures right but it also hits the mechanical interactions right. Now I am not sure that it doesn't do that, but I am just saying when you go through this you get these kinds of implications that cause you to go back and look at some of your models. DR. KRESS: Did you say your code was FRAPTRAN? MR. MEYER: FRAPTRAN is the new incarnation of FRAP-T. DR. KRESS: FRAP-T, okay. I hadn't heard of FRAPTRAN. Are we going to see that code sometime? MR. MEYER: Yes. FRAPTRAN is going through its validation assessment now, and we are planning a peer review this summer and so we will have the assessment and the documentation, the peer review, then revisions and then the publication of the documentation. That is taking place this year. DR. WALLIS: Does this code assume things like cylindrical symmetry to make things simple but maybe miss some real phenomena that way? MR. MEYER: Yes. It does. One other thing -- here is one that was not ranked high and that was the mechanical properties of the pellet, because in the equations you have got a pellet that can give and the cladding that can give, and you have got the model on both. Well, pellets are a lot stiffer than the cladding is and so getting the pellet model accurately is not as important as getting the cladding model accurately. We currently have a rigid pellet model in our code and we are not sure yet that that is not sufficient. DR. WALLIS: As long as it is intact. MR. MEYER: As long as what? DR. WALLIS: As long as it is intact. MR. MEYER: Yes. And then finally we looked at things important in making mechanical property measurements. There is really not a whole lot that jumps out here that would be of interest to talk about. We were looking at such things as the way you select specimens and design specimens, and it was clear to everyone that the detailed shape of these ring tensile specimens, for example, is extremely important. And we have been working on this for a couple of years now, and this work has spread around to other laboratories. We've been working with cooperating with them. So it's really not a surprise when you reach out and get the experts, and you've been working with them already on this subject, that you find out that you're on the right track and you really need to do those things. DR. WALLIS: The thing that concerns me about PIRTs is when there is a lot of extrapolation of experience. It seems to me that the actual base of knowledge for really high burnups is very skimpy. MR. MEYER: Yes. DR. WALLIS: So all of these experts are extrapolating their experience. MR. MEYER: Yes. DR. WALLIS: And it becomes more and more guesswork, the further out they get. MR. MEYER: Yes. But we don't have an empty slate. We do have a lot of data for the reactivity transient, but much of that was obtained under conditions that weren't ideal. But you still learn from those things. And also in the loca transient, there is preliminary information in France, and we're on the verge of getting these data ourselves now in our program at Argonne. So the one where we really have the least to go on is the BWR transient. DR. POWERS: I noticed that on your previous slide, you had a MOX callout on that. How much is MOX figuring into these PIRT activities? MR. MEYER: Not a lot, but let me tell you the way that we do this, and you can see exactly how it's done. We look at the specific sequence, and it's specific right down to the fuel type. So, in the case of TMI-1, it's a 15 x 15; it's zircalloy four; it's UO2 pellets. And it's got a certain enrichment and oxide thickness, and everything is assumed. And then we go through the exercise. At the end of the exercise, we ask ourselves several extra questions. And we go back through each phenomenon, and the question is, would the ranking, high, medium and low, change if you now went from a UO2 fuel to a mixed oxide fuel? And you can go through large lists of phenomena and say, no change; and then you find one that would change. And we do the same -- if you change the cladding type from zircalloy to zirlo or M-5, would the high, medium, and low ranking change? Was there another one that we did, Harold? MR. SCOTT: Burnup. MR. MEYER: Yes, burnup. We did this for 62 gigawatt days per ton, because 62 gigawatt days per ton is the burnup limit for which the NRC has said we will provide the confirmatory work. Going from 62 to 75 is the industry's responsibility. So we did the basic exercise at 62, and then we asked the question, if you went from 62 to 75, would the ranking change. And you go through each and every one of them. And those are tabulated in the report. This is what the report looks like in paper. The report is on the website in its entirety, and it's kept up to date. We use it as a working draft, and it's in a near-final condition, but there will be some more changes on this one, even though we've moved on now to the ATWS PIRT. DR. POWERS: So by the time you're done with this particular item, you'll have a pretty good idea? I mean, somebody could look at this and have a pretty good idea that it says if I want to go to 75 gigawatt days per ton, the kind of information I need to have available for the NRC with respect to rod ejection accidents is here. I mean, it's listed down for you. I would really like to just say, yes, to your question, but I think there is an interpretive step in between. DR. POWERS: Okay. MR. MEYER: I can't tell you for sure that our conclusions and our applications of the PIRT will match up with what the industry does with it. I hope so, but -- DR. POWERS: I wouldn't presume to say that the industry would follow it blindly, but with the purposes -- a hypothetical industry guy comes in and asks, what do I need to bring, that you're happy with my arguments on 75 and has something to point to. MR. MEYER: Yes, yes. DR. POWERS: What he actually brings may be up to him. MR. MEYER: Yes. Okay, this is my last slide and there's not much on it. It just say that we're now working on an application for the PWR rod ejection case. I think we cannot only see light at the end of the tunnel; I think we can see the tunnel clearly enough that we can get out without bruising ourselves too much. There will be some additional work required, in my opinion, to get there, but it's not endless; it's finite. And we have a draft document with this written down. It simply hasn't been reviewed. It will be changed and adjusted, and that's the document that I would have really liked to have discussed with the Committee, but it was clearly not ready for discussion. But I do want to leave the impression that we think we know what to do with this, with regard to the first event type, the PWR rod ejection accident. And when we work out the details of our plan for resolution, then we'll be able to discuss that with you. MR. SIEBER: When do you think the report will be ready in paper form as a final, not necessarily approved? MR. MEYER: Well, we're probably not going to make a large paper distribution of this report. The whole agency is moving towards a paperless existence. DR. SEALE: Well, will it be on the Web? MR. MEYER: It's no the Web right now; it's there right now. MR. SIEBER: Reading a couple hundred pages off the screen is tough. MR. MEYER: Well, you need to get Matt to print it for you. He's got a good printer. DR. POWERS: We've got at least a draft of the document. MR. EL-ZEFTAWY: Yes, I'll print it from the Web and distribute it to all the members. MR. MEYER: We have made one decision relevant to this question, though, and that is, we're not going to finalize the first PIRT report until we finish all of them. DR. POWERS: All right. MR. MEYER: As we move into the subject of the BWR ATWS, we remember, oh, we forgot something on the PWR. And we have to go back and make that adjustment. They're all sitting on the Web. They're available to anyone. I don't expect the changes to be major, but we're not going to issue them with publication dates until we're finished with the last one. DR. POWERS: Okay. MR. MEYER: That's all. DR. KRESS: Ralph, what I heard so far and see so far just validates my original impression that this was a stroke of genius to go this route for this particular issue. I think you're on the right track, and it looks very exciting. MR. SIEBER: Yes, it is. MR. MEYER: I really have to give credit for Farouk Eltawila for the idea of pushing us into the PIRT activity. DR. KRESS: It certainly is an application that has a lot of excitement. DR. POWERS: I think it makes us seriously think about lessons learned. DR. KRESS: Yes. I agree, that that might be a really good addition to this, lessons learned from applying a PIRT to this particular application. It might be a real good little thing to put out, some sort of document on that. DR. POWERS: For your brethren who are going to have similar problems of reaching out. When the Committee has written before that we think especially in these areas where you're going into something new, it's useful to reach out and try to find out what the world knows about these things. But it would stun and appall me if we could take what the thermal hydraulicists have said is and use it exactly. MR. MEYER: Yes. DR. POWERS: I think what you found is, no, you can't do that. MR. MEYER: It's just very different. I mean, with a thermal hydraulic code, you're modeling the phenomenon, so you go down the phenomena one-by-one, but here we're trying to resolve a regulatory issue. And it involves more than just a code with phenomena. DR. BONACA: I have a question regarding the scenario where you discuss the PWR for the ejection accident. You're looking at a classic reactivity insertion resulting from the ejection. MR. MEYER: Yes. DR. BONACA: And are looking at how likely the event is going to happen. I mean, one issue that was debated for a long time was, typically what you postulated is the extreme event, which is rod ejection at zero power with all the rods inserted, et cetera. MR. MEYER: Yes. DR. BONACA: It's an extremely unlikely event because of what you have to assume, I mean, including the rupture of a nozzle and the ejection. And then you have, of course, hardware up there that will prevent the ejection. MR. MEYER: Right. DR. BONACA: So you're not looking at all to the risk-informed credibility? MR. MEYER: No. I would say, to the contrary. We did, and you have to go back two years to the time when we were developing the agency's high burnup program plan. At that time, we did an explicit, albeit very simple, risk assessment of each of the issues in the program plan. And there was no question that all of the design basis accidents have low frequencies of occurrence. But when you're talking risk, you obviously have to have consequence, so you can't just hone in on a higher probability even that can't lead to a consequence. And consequence means essentially melting fuel and getting big fission product releases. So, the PWR rod ejection accident that had been the traditional design basis accident, stayed on the plate after that little examination. But the corresponding rod-drop accident for the boiling water reactor didn't, because what we found is that there is this other reactivity-related event, the power oscillations related to an ATWS, that are higher probability and probably -- although we're unable to do a real risk analysis, we can see that the type of damage to the fuel could be serious enough to lead you into consequences. And so our conclusion was that the power oscillation for the BWR was a higher risk event than the rod-drop for the BWR, and so we have turned our attention to that. DR. BONACA: Okay. DR. KRESS: There is in the plans, you said, some time to repeat this exercise for the source term? MR. MEYER: Yes. We don't have it schedule. DR. KRESS: That's down the road some time? MR. MEYER: The reactivity-related events and the loss of coolant accidents will be finished up this year. And I would expect that we would try and schedule the source term one in 2001, but it is not scheduled at this time. DR. KRESS: It will probably concentrate on locas for that? MR. MEYER: I would think you would have to take several severe accident sequences. DR. KRESS: Okay, you may want to take some. MR. MEYER: For the source term, you're probably going to have to take three or four sequences. DR. KRESS: It's probably sufficient to just take a low-pressure accident these days. MR. MEYER: Okay, it might be. DR. KRESS: You can look into it. DR. POWERS: Well, good. Do members have any further questions? [No response.] DR. POWERS: Dr. Meyer, that was just an excellent background briefing. That was very helpful to the Committee. DR. SEALE: Yes, super. DR. POWERS: And we look forward to a presentation on final interpretations and whatnot. Just keep us informed on your progress. MR. MEYER: Okay. DR. POWERS: Thank you a lot. I am going to recess till 10:30. [Recess.] CHAIRMAN POWERS: Okay, let's come back into session. We turn now to the topic of the proposed resolution of Generic Safety Issue B-17, criteria for safely-related operator actions. I think this is a subject that has been before this committee a couple times in the past. Professor Seale, I think you will lead us on this process. DR. SEALE: Okay. As you all know, we have been trying to encourage our way through the resolution, disposition of all the -- as many of the generic issues as possible. We have two of them here, closely related -- B-17, which is old enough to drink -- [Laughter.] DR. SEALE: -- and B-27, which is old enough to vote. [Laughter.] DR. SEALE: And hopefully we will hear from the Staff to dispose of these. Now there is a record of prior committee consideration of these two issues. Back in November of '95 we had a proposal from the Staff to close this issue out on the basis of the endorsement of an proposed ANSI ANS Standard 58-8, 1994, time response design criteria for safety-related operator actions. The committee reviewed this proposal and took sharp exception to it on the basis primarily that the times that were identified for operator action in the standard were based on information which was not readily available to either the -- well, to the public -- and that there were proprietary restrictions on the availability of that data that made it inappropriate for a standard of this type. So as a result of that, why that proposal was withdrawn and now the Staff is coming forward with an alternative approach to this, a different tack. We also understand that there is a possibility of reconsideration action on the standard, and basically what we want to do today is to, first of all, look at the proposal from the Staff as to how they propose to resolve these issues, and then secondly to hear a little bit about any plans they have for this standard to see whether or not there is going to be any effort to address the concerns we had earlier when we looked at that. Jay Persensky is going to be giving us our presentation and you have a couple of your colleagues, Rossi and -- MR. ROSSI: I am Ernie Rossi. I am the Director of the Division of Systems Analysis and Regulatory Effectiveness and we have Jack Rosenthal, who is the Branch Chief of the Regulatory Effectiveness and Human Factors Branch here with us, and we have Harold Vandermolen, who is the person who is basically in charging of closing out and prioritizing and all the other actions associated with generic safety issues in the Office of Research, but Jay Persensky is going to be the person who gives the presentation today and -- DR. SEALE: -- the guy in the barrel. MR. ROSSI: -- and Harold Vandermolen will pull him out of the barrel if necessary, and I'll watch, okay? DR. SEALE: Very good. MR. ROSSI: Thank you. DR. SEALE: All right, well, Jay, why don't you go ahead? MR. PERSENSKY: Good morning. Actually Bob stole a lot of the first couple of slides here by going over a very detailed history of where we were a while ago. As indicated, I will be making the bulk of the presentation. Harold is here particularly to answer any questions on the cost benefit issue, and Paul Lewis is also here, who helped to develop this approach and gather the information for it. We did send a memo on February 17th with our approach described in that, which would close out both Generic Issue B-17 and GI-27 with no new or revised regulatory activities. As Bob indicated, there is a long history -- B-17 was first identified, the best we can make out, in about 1978, which is pre-TMI, which is an important element in our approach to closing this out. B-17 basically says that in some cases plants required operator action and that in fact operators may not be able to take the appropriate action in time, therefore they have to do a study and determine whether or not it should be automated. That was the basic intent -- should we automate something or should we leave it as an operator action, and they have to take credit in their FSAR for that. GI-27 is very similar. It came up later on, but I will get into that in a minute. The proposed solution was set up some time in the mid-'80s and we are not even sure who came up with the issue or the idea of closing it out using 58.8. It just seemed because of the title and everything else that it would be an appropriate way of closing out this issue, since it was to set up criteria for operator action. We monitored the development of that standard. We had either contractors whom we were involved with actually in the development of that standard through about 1994, when it was published. In 1995 the Staff proposed to endorse it with Reg Guide 1.164 and at that point we felt that we could close out the issue. ACRS did not support the endorsement and they had very strong words and very strong opinions with regard to the use of the information in 58.8. I won't go into that again. So we were sent back to the drawing boards and it probably was a good thing. DR. WALLIS: I'd like to ask that the emphasis seems to be here on time rather than the operator's taking the wrong action. MR. PERSENSKY: The emphasis was that it could be done correctly in the amount of time available. That was assumed and that was the basis of a lot of the data collection. DR. WALLIS: After TMI was there a concern with inappropriate action? MR. PERSENSKY: There was concern with inappropriate action all the way along as far as I know. I mean that was always there was time to do it correctly. CHAIRMAN POWERS: I think it is fair to say that the standard in the Staff thinking was a pretty disciplined examination of the kinds of things that you take into account on operator action -- does the operator diagnose the problem, does it accurately diagnose it -- MR. PERSENSKY: Yes, and there were, if you go back to 58.8 there was essentially a timeline formula that would get into questions of diagnosis action time. The action time was important. There was the whole series of things within that and it was based on collection of simulator data. In any event, after your clear statements, we went back and took off our blinders. We said we have been following this one path for a long time but we took off our blinders and said, okay, what other ways can we look at this? How can we look at this differently? Again, remember this was written pre-TMI, the GI. After TMI there were a lot of things that happened, particularly with regard to operators. There was improved training. Simulators were now -- well, every plant has its own simulator now a site-specific simulator. EOPs were changed. In fact, that was part of the problem with the original data for ANS 58.8 was that there was a change in procedures during that time, so there were a lot of other activities that were going on that we feel now actually meet the intent of B-17 and that is why we think we don't need anything else to do the same thing that is already been done. We feel it can be closed with no new or revised regulatory activities. MR. ROSSI: Let me just follow up with what he just said about closing it with no new or revised regulatory activities. I think as we go through this we need to keep in mind that the major purpose of the effort on this Generic Safety Issue is to make a decision on whether we need to impose new actions on the part of licensees as a result of this issue and in order to close it out. In order to impose new requirements on licensees we have to have a disciplined and good reason for doing that, and so we have to keep that in mind as we are doing it. That is the real question. Do we have a basis and need for imposing new criteria on licensees or do we have a need to ask the Staff to do additional things in this area to ensure that where manual actions are required by the operators that there is a reasonable assurance that they will perform them within the time limits allowed and they are available and that they will do it accurately, so I just want to have you keep that in mind. MR. PERSENSKY: Okay. As I said, B-17 was based on the fact that plants did require certain actions. In some cases they could be done manually. If they could not be done accurately in the time, then the plant was to make a decision to automate that action. In 0933, which the Generic Issue Management System, there was some work done -- again this would have been in the mid-'80s -- indicating that it would include requiring plants to perform task analysis, simulator studies, analysis and evaluation of operational data, and it was the approach that proposed and because 58.8 has some of that already built into it, that was one of the reasons they suggested at that time to move in that direction. Around 1993 Issue 27 came up, and that was just titled manual versus automated actions. It was based on the fact that they had been doing some reviews of plant design and emergency procedure reviews and said maybe we should look at this again. In that issue, though, it was said to be subsumed under B-17 -- if we dealt with B-17, we dealt then with Generic Issue 27 as well. I think formerly if it is stated to be subsumed, it's already closed or listed on the closed list, but we put it in here just so you are clear that we are addressing it as well. DR. WALLIS: But it's not closed until B-17 is closed. MR. PERSENSKY: Right -- well, no. It is listed on our list of things as closed. Once it is subsumed under something else we count it in terms of our bean count, but the scope is still covered. The intent of it is not covered until B-17 is closed. The justification that we are proposing for the closeout again is really a series of other regulatory actions that have taken place since B-17 was identified and primarily those things that happened after TMI. There are a number of requirements, training, simulators, operator licensing, EOPs, increased staff that are all basically thing things that have changed. As you might remember, I just mentioned that they talked about task analysis, simulator studies, review of operational experience. If you look at the training rule which is in 10 CFR 51.20 and for the operators in Part 55 they both indicate that training programs are supposed to be based on systems approach to training. Well, a systems approach to training specifically talks about doing task analyses to identify what are learning objectives and performance objectives. From those then developing tests to make sure that people have accommodated through the training to be able to do the tasks that are called for in task analysis. So here is part of it that has already been identified through that process and if they can't perform the objectives then there is a problem. If they can't perform it because there just isn't enough time, then the plant would have already made the decision to go ahead and automate -- DR. APOSTOLAKIS: Yes. I had a question on this, as I looked at the slide. This, if I just read the slide without listening to you, it looks like the emphasis is on how to make sure the operators will actually be able to perform a function within a given amount of time -- training and so on -- but this amount of time comes from physics, thermal hydraulic calculations and so on. I mean this is the timed window you have, right -- MR. PERSENSKY: Correct. DR. APOSTOLAKIS: -- on the system. So my question was, and I guess you answered it partly, is there may be some situations where it is nearly impossible for the operators to actually or with reasonable assurance to perform that function because the time is simply too short. I mean you can't train people to do the impossible, but you just said that if that's the case we take care of it somewhere else? MR. PERSENSKY: Yes -- well, it would have to be taken -- if they cannot meet the performance objectives, and this is also true if we take the issue of operator licensing, that is where we really get into the picture, because with operator action operator licensing we have them using plant-specific simulators that have all those physics in them and thermal hydraulics in them. If they can't pass their operator licensing examination, so they can't perform the operations necessary to pass a licensing examination, then there is evidence there that something has to be fixed and it can't be trained in, it can't proceduralized in, then we have a reasonable assurance that they can do it, that the plant would have done something else in order for us to license their operators. It's sort of an indirect approach to it, but nonetheless it's what we consider a performance based approach, because we are looking at it in terms of the performance of the operators -- can they perform the tasks within the time required based on the simulator examinations and that builds in those thermal hydraulics and physics. DR. APOSTOLAKIS: There is a mechanism, formal mechanism, for handling these things, these situations? MR. PERSENSKY: Yes. DR. WALLIS: Now if I applied defense-in-depth, I would say, well, I have to look at the contingency that the operator doesn't do the right thing and therefore I put in some other thing to back up in case the operator screws up. MR. PERSENSKY: Correct. DR. WALLIS: And you are saying we don't need anything like that? MR. PERSENSKY: That is part of the analysis that they have to do in their FSAR in terms of do they have defense-in-depth. That is all part of building up -- DR. WALLIS: Yes, but this wonderful defense-in-depth that we invoke is there because you are uncertain whether something will really happen the way you thought it would. DR. APOSTOLAKIS: Well, if you are a structuralist, you don't need any analysis. DR. WALLIS: I am not an anything. I am just an independent thinker on defense-in-depth. I have been told it's a good thing to think about. DR. BONACA: Many of these transients are -- DR. WALLIS: So you are going to tell us that you have enough assurance that the operators will do the right thing, you don't need a backup system of any sort? MR. PERSENSKY: No. This is not addressing a backup system. This is addressing the system that would replace operator action. DR. WALLIS: Well, you could have a backup -- MR. PERSENSKY: And in the backup systems -- DR. WALLIS: -- if they haven't done it by a certain time it happens by itself, sort of. MR. ROSSI: Let me just try something here and see if this helps. The nuclear power plant is designed and in the design they automate some things and they make some things require operator action when they do the initial design, so the design is done and then they have to do a series of analyses of that design to show what happens during various transients and accidents. We have a deterministic way now which we are going to change to a risk informed way of doing that, but we go through the analyses and we take single failures and we assume various things and we assume that the operator will do the actions that are required to be done by operators in the analyses and we show that given all of that the plant is safe. The next thing that happens is the plant gets built. They build a simulator that is very, very similar and there are requirements on how similar and good the simulator has to be that simulates the actual operation of the plant, and then we have the operators who are going to run this plant and they get run through the simulator, they get run through the testing program. Well, first they get trained on what they are supposed to do, and then they get tested on the simulator and they have to pass that test in order to get their license. As a matter of fact, I guess we take other actions if we find that a large number of the operators can't pass the test during a period of time -- then the utility is on the spot for looking at their training program, so the point is that they get tested and then they get retested and retrained from time to time. MR. PERSENSKY: It is a continuous process. MR. ROSSI: Right. MR. PERSENSKY: The requalification process, especially for the operators, requires that they go through certain testing -- training and testing continuously, most of them on a six week basis, and each one of those includes some time in the simulator, and at each -- they may not get tested on every one of the scenarios every time, but there is a sample of scenarios that they go through so that there is -- again, what we are looking at is are we confident, reasonably assured, that the operators can handle the tasks. That, the plant requires of them. And if they can't, if none of the operators can, the we're going to shut down the plant until they can make that happen. MR. ROSSI: Or even a large percentage or a moderate percentage. If they are having difficulty getting their -- MR. PERSENSKY: If they don't have enough people to staff the plant because they can't accomplish the task. Let's face it, this happened in 1978, and we have yet to shut down plants because of that. DR. WALLIS: I understand all of that. It just seems to me that one could still realize that human mistakes are one of the major causes of a screwup at a plant. Do you have any backup system if they do this? And that would be the idea of defense-in-depth. You're saying that they're so well trained, nothing is going to go wrong. MR. PERSENSKY: No, there are things, and I'm not saying that. MR. ROSSI: I was going to say one other thing, and that is that along the road, the emergency operating procedures have been designed. We've got a philosophy on how they ought to be designed, and that philosophy is basically symptom-based emergency operating procedures. And they have a lot of the things that you're talking about, built into them. The operators are supposed to look for the symptoms, and they're supposed to do certain things. And those are basically built into the emergency operating procedures, including, I believe, the use of backup systems where something doesn't work. And they get trained on those, again, and they get tested on them. MR. SIEBER: I think it's important to think a little bit about what happens during an accident scenario in the control room, you know. The plant is designed to respond automatically to the Chapter 15 design basis accidents. And the operator does very little except verify that all these functions have taken place. And if they don't, then they try to restore that function. And the backup systems, however, come into play in a PWR, all the way down to the switch from ejection to recirc, which should -- at times can take an hour or so. And so the job of the operator is to monitor what's going on by looking at his control board, analyze and diagnose the accidents and know which branch he is on, depending on what his instruments tell us. So, if everything works in the plant, the operator's job is little more than reading instruments, verifying settings, flows, temperatures, pressures, and so forth. If you try to go beyond that and automate the backups when a failure occurs, that process becomes very complex. And somebody would have to be knowledgeable, be there to intervene in case the actuation of some backup would interfere with the primary recovery of the plant. So I don't think that automation to a second, third, or fourth level is totally advisable, given the kind of training and the way the plants are automated now. Perhaps you can comment on that, but that's my experience, anyway. MR. PERSENSKY: Well, generally that's the case, and that's where we get into some things that are happening now, though, in a sense, that some automated systems are being turned off. MR. SIEBER: Okay. MR. PERSENSKY: That's just not the purpose of this generic issue. It's another step. MR. SIEBER: Okay. MR. PERSENSKY: But, again, the whole purpose of this generic issue was for the plant in the design process, to make a decision as to whether or not something should be automated. MR. SIEBER: Right. MR. PERSENSKY: And a basis for it was time, but it was time to do the work correctly. MR. SIEBER: Right. MR. PERSENSKY: And all we're trying to say here is that we have regulations or regulatory actions in place that allow us to know whether or not the plant and the operators are doing that, performing the job properly. It's really, like I said, a performance-based approach. DR. WALLIS: And you have a measure of those? All you've said so far is qualitative, but you have a measure which is through some PRA technique that the system now in place -- MR. PERSENSKY: Can I get to that? We're going to look at that in a minute. DR. WALLIS: You need some quantitative criteria, I think, eventually. MR. PERSENSKY: Well, we have a quantitative criterion in the sense, as we said, that operators have to be able to accomplish the tasks that come out of the task analysis. It's a one or a zero from that standpoint. And that task analysis is a function-based, based on the functions of the entire system. DR. WALLIS: But will they do it? That's the real question. MR. PERSENSKY: That's the basis of HRA, you know, what people will do when they're faced with different situations. And that may be -- that's a topic, I think, of some other discussions where you have coming up next month. DR. BONACA: But I am interested, however, in this criteria, in part because, although a lot of things have happened since TMI -- and I totally agree with your point here -- still at other plants, you have conditions occasionally where you have a new situation, and you're evaluating whether or not you can dedicate an operator to go somewhere, do something in 20 minutes, and would it be enough? Decisions are being made and criteria being used for licensing those, so I would be interested in hearing how you go about doing that. MR. PERSENSKY: I think we covered a lot of things already. What I've got on here is operator licensing, the licensing program, plant-specific simulators. These are all things that have happened, again, since TMI, since this thing was initiated. Before B-17 was initiated, there may have been four or five simulators in the country, if that. Now, every plant has its own simulator, people are trained on it, people are examined on it. It includes the functions that the operators have to deal with. And we are involved with that process. If they don't have enough people to do the exams or to carry out operations after exams, they may not operate. Ernie mentioned emergency operating procedures. Prior to TMI, we did not have the symptom-based emergency operating procedures; the symptom-based operating procedures were put into place after TMI. Back in the late 80s and early 90s, the agency actually went through and did a detailed inspection of emergency operating procedures at every plant. I know in some cases, not all of them, this included -- well, it always included actions outside the control room, not just actions inside the control room. So it's not just the things that are in the simulator. But we walked-down the procedures with them to make sure that, again, those actions could be accomplished in accordance with the procedures. The procedures, again, are based on task and function analysis. These are the same kinds of things that we've talked about before: The function task analysis, operating experience; these are all things that are built into the development of those procedures. And the staffing rule was put into effect in the early 80s, which, in fact increased the number of people in the control room so that you have more people to do the task, so that it increased the minimum requirements of people, if necessary. With regard to the PRA aspect of it, the IPE program, part of the IPE program was to go out and to identify vulnerabilities through the use of PRA techniques. Are there vulnerabilities out there that have to be dealt with? Licensees did identify and considered the time-critical safety-related operator actions as part of that process. If, in that process, they found that there were problems, again, they were to go out and fix those problems. And they could fix it with automation or some other way that would satisfy the Agency. There's a list of important human actions in NUREG 1560, which is the lessons-learned report, so those are things that we are particularly concerned with. The primary scenarios are the switchover, which was mentioned in B-17; feed and bleed, and depressurization and cooldown. These are the more important of the human actions with regard to the PWRs. DR. POWERS: There is a lot of controversy about switchover of suction from the flow into the core. MR. PERSENSKY: Yes. DR. POWERS: Some of them are automatic and some of them are -- MR. PERSENSKY: Yes, in fact, I think all the CE plants are automated. And there's a certain amount of other plants that are. The issue -- and if we can step on to the next slide, really -- as you know, the burden is on the staff to demonstrate that the implementation of the generic issue meets the requirements of the backfit rule. We feel that, in fact, through this deterministic or performance-based process, we already have done that by saying we've got things in place; we don't need new regulations to deal with it. So we did not initially do our own cost/benefit analysis for B-17, and this was one that was specific to B-17. But we did find that there was a cost/benefit analysis done for automatic ECCS switchover to recirculation, which was Generic Issue 24. DR. POWERS: ACRS signed off on it. MR. PERSENSKY: ACRS reviewed and signed of on that document, and it essentially said that backfitting from manual to semiautomatic system or fully automatic system is not justified under cost/benefit basis. So we're using that, since -- in fact, it's probably the most risk-significant of the scenarios that we talked about. Now, Harold is here if you have any questions on that particular issue. Finally, on our conclusion slide, we find that there is both a technical and regulatory basis, because these are already regulations or requirements in place that we can close the issue. Most of these things have taken place since the promulgation of -- all of them have taken place since the promulgation of the GIs. Plant-specific vulnerabilities have been identified in the IPEs, and part of that whole program was to then, based on those PRAs and IPEs, to address those vulnerabilities. I think this is a more performance-based approach rather than a deterministic approach to closing the issue and therefore we request a letter from the ACRS supporting closure of B-17. Questions? DR. WALLIS: You sounded to me pretty persuasive. The thing that gives me a little uncertainty is the human error part of it, of course. Human error has been assessed. I just don't know with what sort of certainty it can really be assessed in a quantitative way. DR. UHRIG: But isn't there some evidence that training has sort of reached a saturation point where the error rate doesn't go down any further? MR. PERSENSKY: There is some evidence of that. I think there is also a question of what to focus on in the training. I mean we have been looking at that through the accreditation program with the industry, but there is some baseline human error probability. What that is -- DR. UHRIG: So you may be getting there with your training. MR. PERSENSKY: The contribution of training to that. There may be other ways of reducing error or reducing the probability of error that aren't covered, depending on how effective is the -- DR. UHRIG: That is the question, yes. MR. PERSENSKY: Yes, how effective are they, but human error is considered as part of the IPEs. It was considered in the cost benefit analysis that was done for Generic Issue 24. There are techniques out there that we are looking as an agency at improving techniques, coming up with better techniques -- as well as the industry as a whole, both internationally and here in the U.S. as to how to address that kind of problem. DR. BONACA: I'm sorry, go ahead. MR. SIEBER: That's specifically why the STA was put on shift. MR. PERSENSKY: I forgot to add that one. STA isn't on there. MR. SIEBER: The shift supervisor or the SRO in charge is telling operators what to do following EOPs and the STA is supposed to be standing back to say is the diagnosis right, did they fail to do something that they should have done, or did they do something that they shouldn't have done, and so that becomes the second view or the defense-in-depth or the human error portion of the operating curve and, you know, what else can you do? DR. BONACA: My question was to do with irrespective of the GSI and the closure, and I personally believe that the situation has changed today and you have a good position there, but there are still circumstances where people are dealing with having to make a decision on whether or not an operator action is adequate. If I can think about it, a recent example concerned with inadvertent actuation of safety-injection on PWRs where people have tried to resolve the issue of bleeding PORVs by isolating block valves, and now the issue is how do you deal with inadvertent actuation. Do you have enough time to deal with it should you resolve the issue that way, and I know some utilities have proposed, in fact, that you have -- you can keep your block valve closed and with inadvertent actuation they are trying to demonstrate they have enough time. You are talking about maybe eight minutes or five minutes or whatever, and there is an issue of what information do the licensees and the Staff use to propose in fact a solution of that type and to accept on the part of the Staff a solution of that type. I would like to know what kind of information and I will tell you where I am going. In absence of other information, they are going to still rely on this ANSI standard irrespective of the GSI closure, okay? I just am interested in knowing what do they rely on, because they have to make these tough decisions. MR. PERSENSKY: There are some NRR Staff here that may be able to address it more fully than I can at this point. There is a Generic Letter 97-78 that went out that talked about just that kind of issue -- MR. GALLETTI: Information Notice. MR. PERSENSKY: I'm sorry, Information Notice -- the author is here, Greg Galletti -- and in that there were options, ways of doing it, in terms of describing it and in that document they in fact refer to ANS 58.8. What we are doing in addition to that -- this is the backup slide -- is that since we do have to review license amendments for this type of issue -- we have the Information Notice. NRR has also asked RES to develop risk informed guidance for review of these license amendments. We have a draft inhouse. It is under review at this point for that guidance, and it addresses a number of ways to approach it. It essentially requires a site-specific as opposed to a generic analysis. MR. BOEHNERT: Jay, can you move the slide over a little bit? We can't see the whole thing. Thank you. MR. PERSENSKY: I'm sorry -- what are the actions, what is it that has to be done and it goes into various steps of how you would make a presentation or make a decision on that and how we would make a decision. For your information, because I know there's some concern about 58.8, at this point it cites 58.8 as a source for checking your plant-specific information, that you have to go through a process of determining the appropriate times. The appropriate actions and to test them out on the simulator -- 58.8 is in this document, only as a way of looking at it as a sanity check or something like that or possible check, so that is the current status. Again, this is still in review. We have not necessarily agreed with that guidance. When it comes to the point where I think it is ready for review we would be glad to bring it down to the ACRS for you review, but that is where we are on it. CHAIRMAN POWERS: Okay. I think it is unavoidable to not be interested in this because the history of ANS 58.8, I mean in 1995 the database, the proprietary database that underlay 58.8 was old then -- DR. SEALE: Yes. CHAIRMAN POWERS: -- has not gotten younger since. It was developed with older simulators. It was developed with older sets -- I wonder how useful it is, though I guess I agree with you, Jay, it provides a pretty good framework for looking and saying how I did it and how other people did it, did I do it -- is there any validity. MR. PERSENSKY: Well, it's how you do it and as far as the actual numbers -- I think the important part of 58.8 was the formula or that timeline type of formula they established in there. Here are the different parts of the -- CHAIRMAN POWERS: Breaking it down into cognition and action and things like that. DR. SEALE: Yes, there is the question of the specifics of 58.8 and then there is also the question of what pedigree do we expect of something that has the status of a standard. CHAIRMAN POWERS: They are two different things. DR. SEALE: Yes, they are two different issues and we are interested in both. MR. PERSENSKY: And it may be that ANS needs to go back and look at -- CHAIRMAN POWERS: Yes, ANS definition needs to go back. MR. PERSENSKY: -- at anything new that has come up that we can use and improve the actual criteria that are in that standard. DR. SEALE: Well, the thing before us now is even a third issue, and that is the resolution of B-17. You have given us your presentation. CHAIRMAN POWERS: In summary, it seems to me what they have said is it's taken care of by all the other things that have gone on and if there is a plant out there that has some deficiencies in it, it is a plant-specific issue now and not a generic issue. DR. SEALE: More than that, I think it is noteworthy that we have here an example of an issue that is now resolved on the basis of a legitimately made claim. That it's a performance-based resolution, and it's interesting, really, interesting, as opposed to a formula like AMS 58.8 suggested. Are there any other questions from any of the members of the Committee? DR. POWERS: I guess the question that comes up immediately mind, though it doesn't have anything to do with this question, but it does have to do with operator action times and databases for those: I assume those things still exist, and the issues still exist and questions and things like the ATHEANA code and like that. Are we doing anything to gather data in that area, or is that still a troublesome point? MR. PERSENSKY: Well, we don't have a dedicated program to go out and gather that data. We have been talking, for instance, with Halden about a lot of the data that they have from their simulator studies, and that they will be collecting in the future from their simulator studies, as to how we can best mine that data. DR. POWERS: Yes. MR. PERSENSKY: So that is one place. As we get submittals for changes, if people are providing simulator data in those submittals that we can review, that can start building up further information. DR. POWERS: I have always wondered, especially on the identification of a problem, how transferable data are from one culture to another. The actual physical act of carrying something out, I bet is very transferable. But the problem diagnostic process, cognitive part of the process, it's not obvious to me that information from Finland is transferable to Japan. MR. PERSENSKY: I think some of that data is. Whether it's all or not, we have not done a study in that way. With the -- you mentioned bringing up Halden is the fact that they have been doing everything in the past on the Finnish simulator with the Finnish operators, but they now have a PWR that's based on the Fessenheim plant in France, and they have access to French operators. They will soon have a BWR simulator that will be based on the -- I think it's Barsebeck. It's one of the -- DR. UHRIG: Forsmarc. MR. PERSENSKY: Forsmarc, yes, in Sweden, which is very similar to a lot of other BWRs in Sweden. They would have a lot of access then to Swedish operators. We have been making a concentrated effort to get more involvement of our U.S. utilities. In that last EPRI meeting in Charlotte, the Halden people came to make some presentations, and there was a lot of interest in more participation from the utilities in that effort. But that is, again, one source of data. It's one that we have probably more control over or more access to than the utility simulators. DR. UHRIG: There have been some attempts to make this type of thing independent of cultures. Specifically there is the EPRI work with the BWR in Formosa. The essence of what they did was to put in an expert system. They found that the use of that really didn't help their best operators very much, but it did take the new operators and the average operators and bring their performance up to the best level. So, I think that type of thing is almost independent of a culture. MR. PERSENSKY: The other aspect of it is that there are certain things that we can look at in other applications. If we got data from FAA, though it may be a different situation, that there are still some things in terms of time to do something, whatever that action might be. And we are looking at cooperation with other agencies in those areas. DR. POWERS: I would think that issues of complexity and things like that might have some transferability there. MR. PERSENSKY: Yes, and it's interesting. DR. SEALE: Okay, any other comments or questions? [No response.] DR. SEALE: Does staff have anything else they'd like to ask? MR. ROSSI: I don't think so, thank you. DR. SEALE: Well, thank you. I guess we'll have a draft of a letter here for folks to comment on shortly. MR. BORCHERT: Jay, I need that last slide for the record, if you could give me a copy. Thank you. MR. PERSENSKY: Yes. DR. SEALE: Mr. Chairman, I give it back to you. DR. POWERS: We will recess till 11:30, and we can dispense with the transcript. [Whereupon, at 11:18, the recorded portion of the meeting was concluded.]
Page Last Reviewed/Updated Tuesday, July 12, 2016
Page Last Reviewed/Updated Tuesday, July 12, 2016