ACRS/ACNW Joint Subcommittee - November 14, 2001
UNITED STATES OF AMERICA
NUCLEAR REGULATORY COMMISSION
+ + + + +
ADVISORY COMMITTEE ON REACTOR SAFEGUARDS
ADVISORY COMMITTEE ON NUCLEAR WASTE
(ACRS)
(ACNW)
MEETING OF THE ACRS/ACNW JOINT SUBCOMMITTEE
+ + + + +
WEDNESDAY
NOVEMBER 14, 2001
+ + + + +
ROCKVILLE, MARYLAND
+ + + + +
The ACRS/ACNW Joint Subcommittee met at
the Nuclear Regulatory Commission, Two White Flint
North, Room T2B3, 1545, Rockville Pike, at 8:30 a.m.,
Mr. B. John Garrick, Chairman, presiding.
Subcommittee Members Present:
Mr. B. John Garrick, Chairman, ACNW
Dr. Thomas S. Kress, Co-Chair, ACRS
Mr. Milton N. Levenson, Member, ACNW
Mr. Dana A. Powers, Member, ACRS
ACRS/ACNW Staff Present:
Mr. Howard Larson
Mr. Michael T. Markley, ACRS
Mr. Richard Savio
Mr. Sher Bahadur
Also Present:
Mr. Peter Hastings (via phone)
Mr. Ken Ashe (via phone)
Dr. Dennis Damon
Mr. Yawar Faraz
Mr. Carl Yates
Ms. Lydia Roche
Mr. Felix Killar
Ms. Marissa Bailey
Mr. Lawrence Kokaiko
Mr. Alan Rubin
Mr. Jack Guttman
Mr. Christopher Ryder
Mr. Brad Hardin
Mr. Moni Dey
Mr. Jason H. Schaperow
Mr. S. Khalid Shaukat
Mr. Ed Hacket
A-G-E-N-D-A
Introduction
Review goals and objectives for this meeting,
concerning risk assessment methods in NMSS, John
Garrick, ACNW. . . . . . . . . . . . . . . . . . . 5
NRC Staff Presentation
Standard Review Plan Chapter 3 (Draft NUREG-1520);
reconciliation of public comments; schedule for
completion
Y. Faraz, NMSS . . . . . . . . . . . . . . . 8
D. Damon, NMSS . . . . . . . . . . . . . . .36
Industry Presentation
Comments on proposed final version of SRP Chapter 3,
Felix Killar, NEI. . . . . . . . . . . . . . . . .75
NRC Staff Presentation
NMSS Task Group Activities
Marissa Bailey, NMSS. . . . . . . . . . . . .92
Dennis Damon, NMSS . . . . . . . . . . . . 103
NRC Staff Presentation
Probabilistic risk assessment for dry cask storage
J. Guttman, NMSS . . . . . . . . . . . . . 142
A. Rubin, RES. . . . . . . . . . . . . . . 147
Chris Ryder. . . . . . . . . . . . . . . . 156
Brad Hardin. . . . . . . . . . . . . . . . 171
Moni Dey . . . . . . . . . . . . . . . . . 186
Jason Schaperow. . . . . . . . . . . . . . 291
Khalid Shaukat . . . . . . . . . . . . . . 201
Ed Hackett . . . . . . . . . . . . . . . . 215
. P-R-O-C-E-E-D-I-N-G-S
8:30 a.m.
MR. GARRICK: Good morning. Our meeting
will now come to order. This is the meeting of the
Advisory Committee on Reactor Safeguards and the
Advisory Committee on Nuclear Wastes Joint
Subcommittee.
I am John Garrick, acting as chairman of
the Joint Subcommittee. Tom Kress, on my right, is
co-chairman. The committee members that are in
attendance are Milt Levenson of the Advisory Committee
on Nuclear Waste, and Dana Powers of the Advisory
Committee on Reactor Safeguards, a distinguished group
to be sure.
The Joint Subcommittee will continue its
discussion on risk informing activities of the Office
of Nuclear Materials Safety and Safeguards with
emphasis on the proposed final version to the Standard
Review Plan, Chapter 3, for integrated safety
analysis. We will discuss the use of risk informed
case studies and development of a probabilistic risk
assessment for dry cask storage.
The subcommittee will gather information,
will analyze relevant issues and facts, and formulate
positions and actions as appropriate for deliberation
by the ACNW full committee.
Mike Markley is the Cognizant ACRS/ACNW
Staff Engineer for this meeting.
The rules for today's meeting have been
announced as part of the notice of this meeting
previously published in the Federal Register on
November 2, 2001.
A transcript of the meeting is being kept
and will be made available as stated in the Federal
Register notice.
It is requested that if we have speakers
they identify themselves and speak clearly and loudly
so that we can hear them.
We haven't received any comments or
requests for time to make oral statements for members
of the public regarding today's meeting. However, we
do have a request from Mr. Peter Hastings of Duke-
Cogema to participate via telephone. I guess we are
accommodating that request.
One of the things the committee has to
decide and will be influenced by staff on this is
whether or not they wish to have a letter from us. It
seems as though one of the key issues associated with
at least the initial part of our meeting having to do
with the Standard Review Plan and having to do with
integrated safety analysis in particular is the issue
of scope. What actually should be in the summary.
As a kind of aside and a curiosity, I find
it very interesting, and maybe the folks that present
to us today can answer this, that an institution like
the Army Chemical Corps who definitely has a chemical
culture, the culture that developed the process hazard
analysis methodology.
The Chemical Corps has chosen to use
probabalistic risk assessment, or PRA, on their
chemical waste disposal facilities, while the NRC, the
culture that developed probabalistic risk assessment,
seems to be choosing process hazard analysis as the
cornerstone of their integrated safety assessment.
Maybe that will all be -- the reasons for all of that
paradox will become clearer to us as we get more
deeply involved.
The committee has been discussing for its
last two or three meetings the risk informing
activities of NMSS and other matters. Maybe what
we're seeing here is a little difference between
subcultures, namely, something like the differences
between the NRR and their philosophy about methods and
techniques and the NMSS, but I'm not sure.
Okay. Unless the members have some
preliminary comments they would like to make, Dana,
Milt, Tom, I think we'll turn the time over to Mr.
Faraz for the initial presentation.
MR. FARAZ: Good morning. Can everyone
hear me?
MR. GARRICK: You want to tell us a little
bit about yourself and your involvement in this?
MR. FARAZ: Yes. I'll do that. My name
is Yawar Faraz. I'm a senior project manager in the
fuel cycle licensing branch in the Division of Fuel
Cycle Safety and Safeguards in NMSS.
Within the next 30 or 40 minutes I'll be
providing you a very brief overview of Subpart H of 10
CFR Part 70. That's what the Chapter 3 of the SRP is
really based on.
I'll also provide you very briefly a
status of where the fuel cycle licensing branch stands
in terms of ISAs for fuel cycle facilities.
I've kept my presentation to a minimum.
I have a total of 10 slides. That's to allow a good
discussion on this topic. Anytime you have any
questions, please feel free to ask.
Immediately following my presentation, Dr.
Dennis Damon will provide a roughly 60 to 70 minute
briefing on how to conduct ISAs and how we would be
reviewing ISAs.
The question is why did we devise 10 CFR
Part 70 and why did we include Subpart H in Part 70?
As you know, Subpart H was included in CFR Part 70.
The required fuel cycle licensees, as the name
implies, to integrate all the safety disciplines.
Subpart H requires the use of systematic
methods to (a) identify all potential accident
sequences, (b) determine the likelihoods, and (c)
estimate the consequences.
Another very important aspect of Subpart
H that it requires the licensees to identify items
relied on for safety, or IROFS. As you know, this can
both be hardware as well as administrative
requirements.
Who is required to comply with Subpart H?
It is those whose cycle facilities are authorized to
possess greater than a critical mass of SNM, or
special nuclear material. And who processed enriched
uranium and mix oxide fuel?
Currently there are six operating fuel
fabrication facilities in the U.S. that are required
to comply with Subpart H. Those are the six that I've
listed. In addition, there is also the MOX
application that we're currently reviewing. The MOX
facility would also have to comply with Subpart H.
In addition to this, if there are any
future enrichment facilities that need to be licensed,
they would have to comply with Subpart H as well.
MR. GARRICK: How many of these facilities
already have something like an ISA?
MR. FARAZ: I would say most of the
facilities are already doing an ISA type -- they have
ISAs established in their systems. There are some
that are fairly forward and fairly advanced in their
application of ISAs and some that are not as advanced.
The rule requires that for a site-wide ISA
to be completed, it requires that it be done by
October of 2004. I would say that it appears that the
facilities are going to comply with that requirement.
What does Subpart H require in terms of
ISAs? One of the primary requirements that I just
mentioned is to have licensees conduct ISAs for their
facilities.
By conducting an ISA a licensee can ensure
for themselves and demonstrate to the NRC that the
facility that they operate would comply with the
performance requirements of Subpart H. These are
listed in 70.61.
Another very important aspect of ISAs is
the identification of items relied on for safety, or
IROFS. To ensure that these IROFS are available and
reliable, Subpart H requires the licensees to
establish management measures. Some examples of
management measures I'll show you in just a minute.
On this slide and the next slide I'll just
briefly go over what the performance requirements of
Subpart H are. I'm sure most of you are already aware
of this. First of all, the licensees are required to
identify all credible accidents that can occur at
their facility.
Once they have done that, the licensees
need to ensure that certain accident sequences are
highly unlikely. These would be the ones that result
in the following consequences. For the worker, a dose
greater than 100 rem or a chemically caused fatality.
For a member of the public located outside
the controlled area which you don't think of as the
site boundary, the limits are 25 rem. A soluble
uranium intake of greater than 30 milirems or
irreversible chemical injury. This is for a member of
the public outside the site boundaries.
MR. POWERS: Since this is an intention to
integrate together a number of safety disciplines
including environmental safety discipline, whey are
there no environmental contamination constraints in
this definition?
MR. FARAZ: There are and I'll get to that
in the next slide.
MR. LEVENSON: I have a question. Under
the worker you say chemical caused fatality. Is that
intended to exclude OSHA type physical mechanical
fatalities?
MR. FARAZ: Yes. There are certain
accident sequences that are required to be unlikely.
We just talked about the highly unlikely ones. Now
I'll talk about the ones that need to be unlikely.
For a worker this would be a dose between
25 rem and 100 rem or irreversible chemical injury.
A member of the public would be between 5 and 25 rem
or a chemically induced transient illness.
For the environment it would be 24 hour
average air concentration outside the restricted area
which you can think of as the fence line which may or
may not be within the site boundary. The air
concentration there if it's greater than 5,000 times,
Table 2 of Appendix B of 10 CFR Part 20.
Incidentally, if you can word that the 24-
hour air concentration to a dose, it ends up being
about 1 rem. If you compare this to the member of the
public residing outside the controlled area it's less
and you're talking about a dose at the fence line or
the restricted area which is within the site boundary.
MR. GARRICK: Is that 1 rem due to
inhalation?
MR. FARAZ: Yes. It's a 24-hour dose.
Really this would be the controlling mechanism.
MR. GARRICK: But you don't get a
contribution from any ground shine or any other
source?
MR. FARAZ: No.
MR. POWERS: Could you explain to me how
these things come up? Why 5,000 times and not 3,000
times?
MR. FARAZ: We went through a fairly
lengthy process of coming up with Part 70. It was a
participatory rulemaking process. This was something
that all the stakeholders, including in our city,
agreed upon as being a reasonable level.
Now, I was involved in that process but
this is something that was already included in the
rule. I think there might have been something in the
statement considerations that might shed some light on
that. These are levels that all the stakeholders
including NRC thought were reasonable. That's why
they were established in the rule.
MR. POWERS: I guess what I'm trying to
understand is what leads one to conclude that these
are reasonable? I mean, there must be some thought
process.
MR. FARAZ: Right. I'm sure that went
into the rulemaking process which is, as you know, a
very lengthy process.
DR. KRESS: This air concentration outside
the restricted area, is that meant to be a maximum in
case atmospheric conditions make it jump over
locations?
MR. FARAZ: It's a 24-hour average.
DR. KRESS: It's a 24-hour average where?
Right at the --
MR. FARAZ: At the fence line.
DR. KRESS: At the fence line.
MR. FARAZ: Right. But you're right,
somebody can argue that theoretically there could be
an elevated release or buoyant release --
DR. KRESS: That's what I had in mind.
MR. FARAZ: -- that might go with the
fence line and come down on the site boundary. In
that exceptional case, it would not be the controlling
factor.
DR. KRESS: Does this performance
requirement come with a specification on what
analytical models are to be used?
MR. FARAZ: No.
DR. KRESS: Does it talk about means or
uncertainties in the calculation?
MR. FARAZ: No.
DR. KRESS: It just specifies a number?
MR. FARAZ: Right. Right.
MR. GARRICK: So when you say average, are
these average atmospheric stability conditions or are
these for a special set of atmospheric conditions such
as F?
MR. FARAZ: Yes. I think when the
licensees look at their accident sequences and try and
estimate the consequences, I'm sure they would build
in the conservationist that is reasonably required for
coming up with air concentrations.
I think generally what the licensees do
and what the NRC accepts, the staff accepts, is a
conservative estimate at the fence line. We would
look at whether they are using annual average type
meteorology or are they using fairly conservative
data.
MR. LEVENSON: Is there a rationale for
why one of those is outside the controlled area and
the other is outside the restricted area because they
are both public.
MR. FARAZ: Yes. That's a good point. As
I said, I wasn't really involved in the development of
the rulemaking process. I would tend to think that
with member of public maybe thinking about the nearest
resident.
The question may have come up is that
members of the public can come into the controlled
area because sometimes these facilities have roads and
there is really nothing restricting anyone coming up
to the fence line.
In that case, they could be exposed to the
environmental contamination while they are in that
area. That's why maybe the environmental requirement
came in. That's why I said the restricted area and
not the control area.
MR. YATES: I have a question. My name is
Carl Yates. I'm with BWXT in Lynchburg. A comment
really. We have been using the restricted area in our
analyses of our accident scenarios to mean the
radiological restricted area which is much closer than
the site boundary or the controlled area boundary.
MR. FARAZ: Right.
MR. YATES: So we have been looking at air
concentration levels on site to the restricted area
fence line.
MR. FARAZ: Right.
MR. YATES: Also, I had a question. We
were also wondering does it say air in the regulation?
We were wondering if it also included liquid releases
because Table 2 gets both air and liquid
concentrations. We were looking at some accident
scenarios involving liquid releases and whether or not
we needed to apply that 5,000-times limit to that.
MR. FARAZ: I'm not absolutely sure if it
specifies air or not.
MR. YATES: Okay.
MR. FARAZ: That's a good point. That's
something I'll need to look into.
DR. DAMON: My name is Dennis Damon. I
was involved in the process by which the Part 70
evolved. My memory of why the distinction between
controlled area and restricted areas is there were
some facilities that we had been looking at.
It turns out not to be the facilities that
are being regulated under this but facilities that
might come under it where they had very large
controlled areas. They control the whole Hanford
Reservation.
The idea was we didn't think it was
appropriate to contaminate a very, very large area of
the landscape to these kind of levels. That's why it
was made the less restrictive definition. I mean, the
air concentration gives you one rem and the one above
gives you 5 rem so it's kind of backwards from what
you've just said is the ratio.
DR. DAMON: I think all I'm saying is that
we didn't want our licensee to simply be able to use
the fact that they controlled an area to permit them
to contaminate it to these levels. In other words,
you see what I'm saying? They move the control area
out and inside that they don't need to -- they can
exceed this limit. The point was to deny -- to
prevent that.
The other factor that I would point out
about these is that these are all fairly high levels
of consequences. They are not low levels like you
would normally talk about in the context of
environmental contamination and so on.
There was, I believe, a consideration to
make that environmental requirement more comparable to
those other requirements for workers and the public.
These are very substantial accidents. These are not
insignificant ones.
I think the rationale there is it was
desired that the requirement not be applied to very
low levels of accidents because they are sort of like
a cost benefit consideration there. The licensees had
enough to do to just consider the more severe things.
I think that concept comes in here.
DR. KRESS: That brings to mind another
question. These do look like high-level -- could I
call them safety goals? They relate to the safety
goals for operating reactors, or do they? Do they
have any relationship at all to those?
MR. FARAZ: I'm not sure how they would
relate to the reactor safety. Dennis, are you
familiar with --
DR. DAMON: I mean, there's no discussion
that I can remember in the evolution of the rule that
related them to the reactor safety goals. One other
thing. These are not goals. These are requirements
in the sense that they are required to make them a
certain likelihood level.
DR. KRESS: I understand. I understand
that.
DR. DAMON: So they are not at a goal
level.
DR. KRESS: The rationale I was thinking
of is if the safety goals were to be requirements,
which they are sort of ambiguous right now whether
they are or not and, therefore, a summation of
sequences.
You could view fuel fabrication plants as
an essential part of nuclear power so it seems to me
like an essential part of nuclear power the cost
benefit type of assessment would tell you the safety
goals ought to be about the same because it's the same
benefit so you ought to be able to accept the same
risk.
Since these are for individual sequences,
they must be some fraction of that safety goal. I
don't know what fraction it is. It depends on how
many essential sequences you have in the unlikely
category and in the other category.
My question was to see if there was some
rationale process it went through to show that these
are indeed of the nature that might be equivalent to
the safety goals.
MR. GARRICK: I think it's obvious they
did not go through an apportionment process or an
allocation process.
DR. KRESS: That would be an allocation.
MR. GARRICK: I wanted to ask who decides
the restricted area and can it be a variable? Is that
the licensee?
MR. FARAZ: The licensee would decide
where the restricted area is and they would present
that to the analyses staff. Then the analyses staff
would determine whether it's okay or not. They would
establish the area and that would be part of their
submittal to the NRC.
MR. GARRICK: And that's something that
probably wouldn't change. I guess the licensing
process allows for a change if they have a sufficient
justification for it?
MR. FARAZ: Yes.
MR. GARRICK: There are still a lot of
questions on that. Go ahead, Milt.
MR. LEVENSON: An incidental question is
how do these definitions of likely and unlikely
compare with those in the proposed Part 63?
MR. FARAZ: I'm not very familiar with
Part 63. Go ahead, Dennis.
DR. DAMON: They really have nothing to do
with it. We had a discussion with Tim McCartin and
the Division of Waste Management about the issue of
whether there needed to be consistency and we saw no
need for there to be a consistency.
The term unlikely and other qualitative
likelihood terms appear many different places in the
regulation. I was going to point out some of them in
a presentation later today.
They certainly are not used in any
consistent manner except to the extent the English
language meaning of the word. They are used in that
sense consistently but there's no definite numerical
probability or anything associated with them.
MR. LEVENSON: Of course, it explains part
of the problems we have communicating with the public
when we use different definitions for the identical
words in different regulations.
MR. GARRICK: But you do have guidelines
that indicate what those mean.
DR. DAMON: Certainly in the case of Part
63 that's what they are going to do. They are going
to tell the public exactly what the staff thinks it
means. In the context of Part 70 here it was not
stated in the rule but the Standard Review Plan
indicated what the staff thought.
MR. GARRICK: Yes, this was 10 to the
minus 5 and 10 to the minus 4 for unlikely and highly
unlikely.
MR. FARAZ: What I'll do is we'll hear
some of the management measures that I talked about,
some examples of management measures that are needed
to ensure that the IROFS have really been reliable.
You have the configuration management
program, training, QA, procurement, maintenance,
functional testing, surveillance calibration
procedures, signs, tags, shipping, storage, human
factors. The list goes on and on.
What I'll do next is I'll try and give you
a brief overview of where --
MR. POWERS: Let me ask you a question
about it. You've listed down a host of things with no
indication that this is complete. What am I supposed
to drive from this list?
MR. FARAZ: Let me just get to it. Okay,
yes.
MR. POWERS: There are 10,000 things here
and there are probably 10,000 that are not listed on
it. Are these the things that NRC proposes to control
and regulate?
MR. FARAZ: These are management measures
that the licensees are required to establish and that
they will provide to the NRC when they complete their
ISAs. The NRC would look at them and review them and
determine if they are okay or not. What I want to do
is give some examples of management measures that will
be included in their ISAs.
MR. POWERS: I guess I'm a little --
suppose they have a written policy and procedure for
tags? I supposed NRC could review it. How do they
decide that is a good one or a bad one?
MR. FARAZ: There's no definite criteria
for what is okay or not. I think the NRC would look
at the entire management program as a whole and then
determine if they are good management measures or not.
If they determine that additional management measures
are required or needed to assure safety, then the NRC
would ask licensees to revise or change those
management measures.
MR. POWERS: So if the NRC did not like
the workload that the management was imposing on an
individual, they would say don't do that?
MR. FARAZ: If the licensee says that
overtime is authorized up to $100 a week for an
individual that is relied on for safety, then clearly
that is something the NRC staff would question. There
are things like if the NRC staff sees there's some out
of the ordinary management measurement being proposed,
then we would look into it and question it.
MR. MARKLEY: How is this being links to
the risk-informed oversight process, or is it?
MR. FARAZ: You mean the whole ISA
process?
MR. MARKLEY: Well, the oversight process
which is your inspection and verification process and
what they've done in looking at cornerstones of safety
with the reactor program. I understand they are doing
some of that with the fuel cycle programs as well. It
seems to me like most of these types of verifications
would fall within an oversight process of some sort.
MR. FARAZ: Right. They would be included
in their license application all the ISA. That's
something that the licensing group would be reviewing.
Then once the licensing group feels that they are
fairly good management measures in place, then the
inspection process would confirm whether they are okay
or not.
DR. DAMON: This is Dennis Damon again.
The key thing to focus on in this slide is that first
top bullet, "Measure to assure that IROFS are
available and reliable and needed." There is actually
a requirement. If you read the rule language, the
requirement statement in the rule language, this is
actually almost a quote from it.
It says, "The licensee must establish
these measures to assure that IROFS are available and
reliable when needed in the context of the 70.61
performance requirements."
What the staff intended that to mean was
you had to do these things that are on this list to
whatever extent was sufficient to achieve highly
unlikely for high consequence accidents and so on.
That's the direct requirement statement.
If the accident is highly unlikely given
the whole ensemble of all the things that they do in
this thing with respect to that one accident, then
that is sufficient so the staff cannot make them do a
better maintenance program just because they like
better maintenance programs. It has to be tied
directly to the highly unlikely issued.
Then the other thing is it says "when
needed." It's obvious that was to preclude the idea
that you have to have these programs in place and
everything has to be done all the time. Like I say,
this whole thing is tied -- the whole idea of the rule
was to tie these programs to the items relied on for
safety that come out of the ISA analysis. It's that
linkage that is the key thing that the staff had.
The reason was because some of these
programs that some licensees had not been part of
their formal license commitments. Some licenses did
not have configuration management program descriptions
in their licenses with commitments as to what they
would or would not do and the same with maintenance.
This is an attempt to compel that be done
uniformly across the industry that licenses will
contain descriptions of these various programs. Then
the content of those programs should be tied to the
results of the ISA and should be done in a manner
sufficient to achieve the highly unlikely by
performance requirements.
MR. GARRICK: So these are more in the
context of examples of measures that could be taken?
MR. FARAZ: Exactly.
MR. GARRICK: Rather than necessarily
prescriptive.
MR. FARAZ: Exactly.
MR. GARRICK: It would be very facility
dependent and serve the systems that do surveillance,
dependent, and so on.
MR. FARAZ: Exactly.
MR. LEVENSON: I have a question. You
said that basically the metric is to make sure that
the accident is highly unlikely. Does that mean that
if there are accidents by their inherent nature are
highly unlikely you don't need to identify IROFS
related to those accidents because you're already at
the cutoff put?
MR. FARAZ: Yes, that's true. What the
licensees would do is they would look at all the
accidents that can occur that are credible for their
facility. If an accident is not credible, then it
won't require IROFS.
MR. LEVENSON: Are you using the word
credible and highly unlikely to be identical?
MR. FARAZ: It's very hard to exactly
quantify credible and highly unlikely.
MR. LEVENSON: My whole point was if I'm
trying to do this, how do I know where my cutoff is
for preparing IROFS? That should be fairly clear.
DR. DAMON: It's described in Chapter 3,
the one that we'll get to, the chapter on ISA. The
issue of credibility is discussed there. The language
in the rule is the licensee is required to identify
all credible accidents and to make them -- if they are
high consequence make them highly unlikely. It's that
kind of language.
The way it was understood by the staff and
which is explained fairly carefully in chapter 3 is
that to be credible means not to be included in the
ISA at all in a sense. This certainly doesn't have to
show up in the summary or whatever. The staff's
interpretation is that credibility must be obvious.
It must be obviously something that
doesn't need to be considered. Things that do need to
be considered because you maybe need to estimate their
frequency or make some judgement about them, they
ought to be -- they would be considered in the ISA and
documented in the process of doing them.
Credibility, in other words, is a
criterion for whether it's considered and documented,
whereas highly unlikely is a criterion for once you've
considered it, you've made it sufficiently unlikely.
In other words, what I'm saying is in
doing an ISA you would consider accidents that would
be far more unlikely than highly unlikely because of
natural reasons like an extreme earthquake or
something. You should have thought about that in
doing the ISA. It's part of the process.
It's just that you don't need to do
anything about it so you don't need to write down an
item relied on for safety on your list so there's
nothing for the facility to do. I think it should be
included in the process that you went through when you
considered all the accidents.
MR. LEVENSON: So you're saying we require
analysis and regardless of the outcome of that
analysis, you don't do anything with the results so
why do it?
DR. DAMON: Well, it shows completeness.
What I'm saying is if something is obvious that it
does need to be considered, yeah, they don't need to
put it in there. But if you're talking about
communicating with like, say, future people at your
own plant or with the NRC staff, it's important, I
think, for a licensee to document what they did
consider in doing their ISAs.
If they thought about earthquakes and they
said, "Okay, this earthquake is one sufficient to do
the damage we're worried about here," but is too
infrequent to worry about because of the specifics of
that site, they should write that down in their
documentation so that the next time somebody does this
type of analysis, they don't have to replicate that
whole process over again. It's that kind of thing.
In other words, how does the staff know
that you've considered all accidents unless you have
considered all accidents because that's what the rule
requires, that you identify all so the staff needs to
understand that the licensee did try to look for
everything.
Then there's a subset of that that they
found. I think the language is stated they don't have
to tell us in the ISA summary about ones that they
found that didn't meet the credibility criterion or
whatever, or didn't even meet the highly unlikely
criterion.
They only have to tell us about ones that
did meet that threshold. But in their own process
that they went through at their plants, I don't see
how you can do that process without documenting
everything you've thought about.
DR. KRESS: Are sabotage events excluded
from this and put into some other category?
MR. FARAZ: Yes, sabotage is not something
that is typically included.
MR. GARRICK: Maybe you had better
proceed.
MR. FARAZ: Okay. What I'll do now is
I'll kind of give an overview of where the fuel cycle
licensing branch stands in terms of ISAs.
As of April 18, 2001, all the licensees
had submitted ISA plans. These are plans that will
give the ISA approach that the licensees are going to
follow. The processes at their facilities will be
analyzed and a schedule.
DR. KRESS: Each process that the licensee
decides to analyze has to meet these performance
measures?
MR. FARAZ: Exactly.
DR. KRESS: So a lot may depend on what
the licensee selects as a process.
MR. FARAZ: Well, they have to look at all
their processes. In the ISA plan there may be a
chemical process that's away from their license
material.
DR. KRESS: Is there a firm definition of
what the process is?
MR. FARAZ: No, there's not.
DR. KRESS: So the licensee just decides
this is a separate process and this is a separate
process and I'll do the ISA for each of these?
MR. FARAZ: Right. Right. I would think
of the process as, for instance, if they do
decontamination activities, there might be a building
and all the decontamination activities would come
under the decontamination process. They would look at
all the various processes and integrate them all
together as part of the ISAs.
MR. GARRICK: So when you say approach,
you must be looking for something different than the
guide or the Standard Review Plan?
MR. FARAZ: That's right. As the name
implies, it says to guide. If they want to follow it,
fine. If they want to propose something different,
that's fine, too.
MR. GARRICK: Okay. Thank you.
MR. FARAZ: We've already reviewed and
approved BWXT's ISA plan as well as NSF's. The other
reviews are ongoing,
As far as Subpart H is concerned, one of
the submittals that are required to be made, as I
mentioned before, by October 18, 2004, all the
currently operating licensees are required to have
their site-wide ISAs completed and submit to the NRC
their ISA summaries.
In addition to that, by the same date the
rule requires all the licensees to identify and
correct any deficiencies that may have been identified
as part of doing the ISAs.
However, Subpart H also allows an
extension to that date as long as sufficient
justification is provided to the NRC, acceptable
sufficient justification.
I will just mention that we anticipate
submittals to begin as early as spring of next year
because, as I mentioned before, some of the licensees
are ahead of the ballgame. That will give a good
opportunity for both the licensees and the staff
because this really hasn't been done before to this
extent.
This will give the licensees and the staff
a good opportunity to actually get into the thick of
things and conduct and review an actual ISA. None of
the licensees appear to be behind and don't appear to
be in danger of exceeding the enroll date.
Some of the challenges that we are
currently facing and that we expect to face are listed
in the slide. The first one that I've listed is the
SRP itself. Last month we finally reached an
agreement on the contents of the entire SRP by
reaching agreement on what is required to be or what
is needed to be in Chapter 3.
We're in the final stages. We hope to
finalize an issue of the SRP within the next couple of
months. This was a very lengthy process. It was a
multi-year process. The stakeholders were very
heavily involved; NEI, the licensees, the public.
Finally we have come to a point where we think that we
can finalize the SRP.
Another challenge that I've listed is
guidance on failure rates. This is something that we
intend to work with again the stakeholders on and it
is information that would be helpful in determining
what's unlikely and what's highly unlikely.
These would be failure rates of hardware
systems. We really haven't begun this process but
once we issue the SRP and finalize the SRP, we hope to
get into that as well.
MR. POWERS: It seems to me that it would
be very complex guidance to give because you have over
here a fairly lengthy list and any failure rate that
is high can be compensated for by a lot of other
things. It looks like it's very challenging to set up
guidance.
MR. FARAZ: It will be challenging. We
will go through pretty much the same process that we
followed for the SRP. In other words, we would engage
the stakeholders on this. It's at its infancy and the
picture is not very clear right now.
Another challenge would be for the
licensees to conduct the ISAs and for the NRC to do
the reviews of the ISA summaries as well as the ISAs.
As I had mentioned before, it could be as early as
April 2002 that the NRC staff begins reviewing some of
these ISA summaries and ISAs.
A very important challenge that I see is
to risk inform the staff's licensing reviews and
inspections and enforcement actions once the site-wide
ISAs are approved.
MR. GARRICK: Are you comfortable that the
ISA process will achieve that last bullet?
MR. FARAZ: I'm not sure if we will reach
100 percent but clearly it will be a major, major
improvement and a major step forward. Clearly in risk
informing our licensing reviews and inspections and
enforcement, the ISA process is a great help and a
necessity.
MR. GARRICK: Okay. Thank you.
MR. FARAZ: Are there any other questions?
MR. GARRICK: Questions from the
committee?
MR. FARAZ: I'll ask Dr. Dennis Damon to
provide his presentation.
MR. GARRICK: Thank you.
Dennis, I trust, our questions
notwithstanding, you will organize your presentation
to meet our schedule of 10:15. We are very pressed
today to stay right on our schedule. I guess we have
a break scheduled at 10:15.
DR. DAMON: Yes. My intention was not to
present everything that's in the big thick handout
there. That material is something you have already
seen.
It was presented back in January but I
included the whole thing because I'm going to proceed
to talk about one of the examples near the end and
then proceed on to other things. I don't think we're
in any danger of running too long.
MR. GARRICK: Thank you.
DR. DAMON: Maybe I can start talking and
when he gets the slides going, I can proceed with the
stuff that's on the slides. My intention was there's
two parts to the presentation. One of them is based
on what's in the Standard Review Plan, Chapter 3,
which is the ISA chapter.
More specifically it's Appendix A to that
chapter which I wrote. Appendix A is an example of
one method that the staff would consider an acceptable
way of documenting and presenting an ISA and ISA
results. That's what Appendix A is all about.
Appendix A, as you remember, basically
describes a method where each accident sequence if it
is identified is laid out as such just basically with
the same exact meaning of the term accident sequence
as you would have in a PRA which is a sequence of
events, an initiating event followed by subsequent
events, and ending in consequences.
The licensee will identify these accident
sequences and lay them out. In the example in
Appendix A they are displayed in a tabular form with
each accident sequence and one row on the table. Then
it uses a scoring method that basically is a log
rhythm of the failure rates, outage times,
unavailability.
Whatever probabalistic information appears
in that sequence is converted into order of magnitude
index that reflects either the frequency of the
initiating event or the probability of failure or the
probability of occurrence of some subsequent event.
It's an index method. The indices are
added up and that's your metric of whether you are
highly unlikely or unlikely in the language of the
rule.
That's what the Appendix A method is. Since that
presentation in January BWXT and NSF have both
submitted ISA plans in which they describe their
approach to doing ISA.
In my second handout, the short one, what
I've done is put some information related to the BWXT
method which also is an index scoring method for
evaluating systems.
What I would like to do in the
presentation is point out some subtle differences
between the two index methods to show you what these
methods are like and what they do for you and what
they don't do for you and so on.
Then one other thing I intended to present
was to discuss the last example that's in the large
handout which is -- there are three examples in there
and the last one is an example of something I chose
because it's very characteristic of a large number of
processes in these facilities.
It's kind of a situation where you can, in
fact, imagine the accident but what is very difficult
to do is to quantify it. It's an example of an
accident where I believe that the reason why having
the accident is highly unlikely is because of a subtle
interaction between having a very large safety margin
and an absence of a reason for why you would exceed
such a large safety margin.
It's a very difficult thing to quantify.
I wanted to show the members of the committee why it
is that there's reluctance to mandate across the board
quantification for its own sake, but rather to focus
on qualitative characteristics of processes because a
very large fraction of the processes of the facilities
are kind of like this one that I describe in the
example, and that is they have qualities about them
that will convince you that it is highly unlikely to
have an accident but it's very difficult to put a
number on them.
That's not to say I'm against using an
index method to categorize these things. I think
that's a useful thing to do is to identify qualities
that would convince you that something is sufficiently
unlikely and then when it has those qualities you put
it in that category of being something you think is
highly unlikely. What I'm trying to communicate is
how difficult it can be to actually come up with
numbers for some of these things.
On the other side of the coin, there are
processes that are no different from reactor
subsystems. They are automatic hardware safety
controls.
On the other side of the coin there's many
situations in these facilities that involve human
actions that are also no different from things that
are very characteristically analyzed in human
liability engineering.
There are things very clearly you could do
a good job quantifying things, and there are other
things that are very -- that need work. They need I
don't know what, standardization or something.
MR. GARRICK: Of course, the concept that
allows quantification of the reactor scenarios is the
notion of uncertainty and the characterizing of those
uncertainties in some form such as a probability of
density function if it's for a fixed variable or
something like a frequency of exceedence curve if it's
for a variable measure of risk such as fatalities or
injuries or what have you.
Has there been any consideration for the
accidents that are really important to carry it a
little further than, say, the index method?
DR. DAMON: You mean something further
like --
MR. GARRICK: Like actually doing an
uncertainty analysis.
DR. DAMON: I think that's a good idea for
the staff to consider when they are developing this
guidance document. In fact, if I remember, the early
drafts -- Yawar is working on this thing, this
guidance. He characterizes it as guidance on failure
rates.
What I would sort of characterize it is
more guidance to the staff in general about how to
review the quantitative likelihood aspect of these
ISAs. In that context, yes, uncertainty is something
he's considering.
The issue, I think, is to communicate to
the staff member to give him guidance how to identify
things that he perhaps ought to take a more careful
look at.
Something that triggers his -- you know,
if the staff reviews to serve any function at all, I
think one of the functions it can do is an independent
technical review of whether, in fact, these systems
are adequately safe. Do they meet highly unlikely or
not?
Now, I don't think the staff has the
resources nor the information to do that for every
single process. I would envision it considering the
uncertainties involved.
I mean, as a simple example, my own view
is if the licensee comes in and claims that a given
piece of hardware, whether it's passive or active
safety hardware, has an extremely low failure rate, 10
to the minus 3 per year or something like that, the
challenge there is that if they are wrong, they can be
wrong by -- let's take 10 to the minus 4 per year.
If they are relying on that for safety and
you're saying it's a once in 10,000 year type failure
rate, you're basically placing a very heavy reliance
on that item.
Yet, there is no way to verify whether
that assignment is correct or not based on subsequent
events at the facility because you don't expect to see
any events at the facility if the facility won't have
events occurring.
Whereas the licensee says, "I expect this
type of failure once every 10 years," or says
something equivalent to that, and the uncertainty in
that is a lot less.
The staff should take that into account
that there are certain things where they need to focus
on where they need to review what the licensee has
done and other places where you can rely on the fact
that the licensee has a corrective action program and
if they're wrong, those failures will occur more often
and they will be picked up in the system.
MR. GARRICK: Dennis, are you satisfied
that the ISA process is a building block towards a
PRA?
DR. DAMON: Well, I think it's a building
block towards using the thought processes, the
conceptual structure that is used in PRA. And to
using PRA, I think eventually -- there are licensees
who have used quantitative risk analysis.
It comes up in some context where they
feel it's to their benefit to do so but not
comprehensive across the plan, every single process
basis, when they have one particular thing.
I can think of two examples. One of them
was a license amendment and they thought because of
the complexity of the hardware involved it would be
more convincing to submit quantified fault tree model.
The other case was a case where a
violation was being proposed and the licensee felt
that this was such a low risk situation that it
shouldn't be a serious violation so they presented a
quantitative risk analysis argument that the risk of
what happened was very low. They do this sort of
thing.
What I think is interesting about Part 70
is in developing the language of the regulation
itself. What was abused the architecture of a risk
based argument. That's what held the whole structure
together. The conceptual structure is there.
What I would hope would happen in the
future is that we would all learn to talk the same
language between the licensees and us. As of now it's
not fully there but over time that's what I would hope
to see happen is that you evolve to a point where you
are talking the same language.
MR. LEVENSON: You mentioned that some
thoughts or guidelines on when the staff might decide
to go a little father, etc., based on things like
probability. Would it make sense instead of things
like that to use as guidance when to go farther only
those accidents that have potentially significant
consequences?
DR. DAMON: Yes, that's the kind of
thought process I'm talking about. I see a big
difference in the thought process between someone who
has become fluent with risk concepts like you
mentioned. You know, think about the severity of the
consequences of what you're talking about and people
who don't.
There's a tendency on the part of the staff
sometimes to get concerned about issues that don't
relate to risk. They've just lost sight. They've
lost the bubble there. I think that's the point here.
I mean, later today when we talk about the Risk Task
Group's charter and so on and SECY-99-100 that's what
that's all about.
Both the NMSS staff and the licensees in
this process we would like to encourage people to all
start understanding the conceptual logic of risk so
that they can start talking about the things that are
being required to be done in a way that directly
addresses consequences and likelihood and
identification of all accident scenarios, risk
concepts like that.
This is just the presentation that you
have seen before that Yawar has talked about. There's
one thing that is important to keep in mind. The
chemical acts and consequences are obviously very
carefully restricted to the things that are -- those
chemical accidents that relate to the license
material, not to chemical accidents in general.
MR. GARRICK: Of the chemical accidents
that relate to licensing material, is there any tie
between that and EPA standards on chemicals such as
come up in the RCRA process?
DR. DAMON: There are -- what do they call
those? AEGLs. The language that was put into the
regulation mimicked the qualitative language that
described the emergency action guidelines that EPA
uses.
The intent was -- it was a one-time
thought that those guidelines would be prescribed in
the rule. It would say in there, "This is what you
use a threshold for defining what is a high
consequence event, one that is life threatening," and
use the exact language of EPA. Then it was decided
that had disadvantages in that these guidelines don't
exist. For example, you have six so that is one
disadvantage.
Also it's a little too prescriptive so it was
left at the qualitative language level, life
threatening as high consequence and permanent or
serious injury, I think, is the language that goes
with the other one. The intent was to point directly
at the AEGLs and say, "This is really what we mean by
this."
MR. LEVENSON: The second triangle you
have up there defines that only HF that comes from UF6
is involved. If I've got a plant I'm using HF. Some
of it is maybe recycled from UF6 and some is what I
buy for makeup. Do I have to differentiate and keep
track by inventory and records as to which is what.
DR. DAMON: Well, there's not a
requirement to track it. The point is when you do the
ISA analysis and identify accidents that can happen,
the material that is perhaps in a storage location is
not intimately connected with the process that the NRC
staff has responsibility for. That would not be
included in this even though it's used in the process
eventually.
MR. LEVENSON: No, no. But if the source
of the -- way that reads is even if this is in a
warehouse a mile away, if the HF came from
decomposition of UF6, I have to consider it quite
differently and independently of purchased HF. Is
that correct?
DR. DAMON: That's right. In other words,
anything that's connected with the UF6 since the
enriched uranium is the license material, anywhere
that licensed material, whatever chemical form it's
in, that's fair game. That has to be considered in
the ISA analysis, any accidents in UF6 storage. Not
just the processing of it, the storage of it. Any UF6
on site would be --
MR. LEVENSON: I understand that but I'm
talking about the HF separated from UF6.
DR. DAMON: Once it's separated and not
actually intimately involved in some process, then
it's not within the -- then it doesn't need to be
considered in the ISA.
MR. LEVENSON: But that's not what this
says. It says "chemicals produced from licensed
material." If I'm decomposing UF6 then HF is a by-
product that's produced from licensed material.
MS. ROCHE: Dennis, may I?
DR. DAMON: Yes.
MS. ROCHE: I'm Lydia Roche, Section Chief
for Licensing. In response to your question, January
1986 there was an accident at Sequoia Fuels in which
a UF6 cylinder ruptured and killed a worker. What
killed the worker primary was the HF. If it is
licensed material, yes, it's part of the ISA. It's
part of the process that we regulate.
MR. LEVENSON: I understand and I am
familiar with that accident. This is very ambiguous
because what you're talking about is a chemical
produced during an accident and that is quite
different than what is produced in a processing plant.
MR. FARAZ: What I would say in response
to that the language may be a little misleading. You
are correct that if it's part of the accident and --
MR. LEVENSON: Part of the accident I
understand but one of the routine processes sometimes
used from UF6 to decompose it down to UF4 is to make
by-product HF. If HF is produced from licensed
material, it seems to me that should not be covered.
MR. FARAZ: It's not covered. If a
licensee has a process to extract HF from licensed
material and then stores the HF a mile away from the
site and then there's an accident there, that would
not be included.
MR. LEVENSON: This wording does not make
that clear.
DR. DAMON: Right. I mean, certainly the
words you can fit on a view graph are very few. This
is like a succinct statement. The MOU has extensive
guidance and there's guidance in the chemical section
of the Standard Review Plan as to what things should
be considered and what shouldn't.
That doesn't mean that all issues have
been resolved. I mean, there probably are some cases
where that issue will have to be discussed in the
context of what's done. I think between the staff and
the licensees I think we have a reasonably close
common understanding of which ones should be in and
which ones are out.
It's mostly the idea that, like you say,
HF evolved from UF6 during the course of an accident
or MOX or something. We don't want you saying,
"That's not your licensed material that's causing the
fatality." Then items relied on for safety, this is
just to point out how broad this is. Activity of
personnel is underlined up there. That will come up
as I get further in here.
This is just to point out that if you read
the Standard Review Plan chapter on ISA, the Appendix
A that has this index method in it and so on and so
forth, that is an appendix.
What is stated in the body of the chapter
as acceptance criteria is much more qualitative and
it's really stated in terms of getting down to the
fundamentals of whether an adequate job is done.
There's many more aspects to it than just
whether you use a scoring method and what exactly the
scoring method is and so on. It's really important
that there be completeness of accident identification
because that was really one of the major reasons for
asking that ISAs be done.
That's just to point out that's what is
dealt with in the body of the chapter is completeness
of accident identification, correctness of consequence
evaluations, and then finally you do get to the
adequacy of likelihood evaluations.
Again, Appendix A is just an example. It
was really not intended as "use this method." It was
intended as an example of something that had the
structure of something that you might use. The reason
it was stated that way is because the NRC staff could
not, nor could a licensee, I think, anticipate how any
given scoring method would end up being applied as
they went through all the diverse processes in their
plant.
It was envisioned that a licensee would
establish a qualitative method defining what is
adequately unlikely and what isn't, but that process
would evolve as they went through their facility and
identified different types of situations that needed
to be dealt with.
This just is talking about doing an ISA.
NUREG-1513 has been published. That was the ISA
guidance document. It focuses primarily on process
hazard analysis and on the sort of project management
level of what is involved in an ISA. That has been
published.
It has in it one key thing, I think. It
has a flow chart for selecting an appropriate method
for identifying accidents. I think that is probably
the most important single thing in that guidance
document. If you use a "what if" method for a very
complex process, that's just not appropriate. I think
you need a method that is appropriate to the
complexity of the process.
There is also NUREG/CR-6410 is the
Accident Analysis Handbook. It's about this thick.
It gives a lot of guidance on doing the kind of
consequence evaluations that come up in the context of
the fuel cycle facility.
It's actually fairly rare that one would
actually need to do very many quantitative
calculations of off-site consequences for a number of
reasons. In an uranium facility it's very difficult
to cause a release of material.
The material has such a low specific
activity and such a non-volatile form most of the time
that it's very difficult to give off-site radiological
consequences that reach the thresholds we were talking
about because we're talking about 5 rem off site to
the public.
For chemical consequences likewise it
usually is not that necessary to actually do
quantitative evaluations. If you did need to do one,
it can get -- these chemical transport models can get
quite involved because UF6 is a very heavy gas so the
6410 has some guidance on that kind of thing.
MR. GARRICK: You might be a little
generous in saying that you have defined some of these
thresholds quantitatively because I think in the risk
world when we think of something -- when we think of
a quantitative result, we don't think of a number.
We think of a probability distribution
because it tells much more of the story than is told
by the number. I'm just saying that because one of
the issues we're always dealing with in the risk
informed world is the consistency of the language.
DR. DAMON: Well, this reminds me -- the
issue of consequences reminds me of something that
came up in Yawar's presentation. The question was --
he was talking about off-site consequences and whether
those had to be calculated for average conditions or
whatever, that issue.
The point is actually they have to be
calculated for the most extreme possible condition
that could ever occur. In other words, all we're
saying is if there is a spectrum of possibilities and
if one of those in that spectrum, even if it's a far
outlier exceeds the thresholds of the rule, then to
that segment of the spectrum of everything that can
happen must be addressed.
The fact that it would take extreme -- it
might take extreme weather conditions or whatever to
cause a 5 rem dose or whatever, they would have to
consider that.
MR. GARRICK: Then, again, there's an
inconsistency in the jargon of what we mean by risk
because what you're suggesting here is that your
basing your risk-informed results on the basis of
bounding analysis and extremely conservative
assumptions.
Again, that is kind of a contradiction of
the whole concept of risk assessment which was
invented in order to have a mechanism by which we
could have what is our best shot at what the risk is.
We want that because that gives us a
baseline against which to know how conservative, for
example, we should regulate it. It's a philosophical
point but it's one that both the ACRS and the ACNW is
constantly working on.
DR. DAMON: What I was meaning to say
about that, and it actually says this in the Standard
Review Plan ISA chapter, when it talks about
consequences I recognize in writing that that you have
this question. You have a release.
Well, a release could be large ones, some
small ones, the weather conditions could be different,
the wind could blow in one direction or the other.
The question is what do you need to consider. What it
says in there is that if there is any scenario that
would exceed the threshold of the rule, then that
needs to be considered.
The unlikeliness of that can then be
credited in evaluating whether it is highly unlikely
or not. All I'm saying is there's a spectrum of
things. I don't think it's appropriate to say I get
to select the average thing that could happen and if
that average thing doesn't trip the threshold, I get
to throw away and I don't need to consider or limit
that or regulate that risk at all.
No, you look at the tail and you have to
go all the way out. Could you ever exceed these
threshold and then you can credit yourself. We all
know stability class F and so on doesn't occur very
often and they can credit that in their likelihood
evaluation.
Like I say, it doesn't come up very often
that they have to worry about these things. This is
getting into what I said earlier, is that the Appendix
A method talks about -- uses this index scoring
method. It's a tradition, a standard, an industry
consensus standard within the criticality community to
try to achieve whenever possible a thing called double
contingency.
This is the statement of double
contingency. You can see the community in the
criticality safety, which is one of the predominant
things that could cause a fatality among all the
accidents identified, the community already is using
what I call risk-based language.
They are talking about independence and
unlikely and redundancy and these characteristics.
Usually their understanding of these things is not
exactly the same as someone who comes from a
quantitative background. That's what I say, I would
like to start talking the same language.
This is an example of what I mean by the
fact the index method in Appendix A really just lays
out an accident sequence. This is for a system of two
active redundant controls. The equation for the
frequency of the accident, namely the accident being
the two things happen, is expressed this way where the
lambda's are the failure rates and the U's are the
unavailabilities.
You have two controls, control 1, control
2. There's two different ways you can have an
accident. Control 1 can fail first and then while
it's out, while it is unavailable the control 1 can
fail or vice versa. You have this equation and that's
what the method of Appendix A does. It explains that
is what these indices mean, that they refer to these
concepts.
MR. POWERS: Does it deal with common mode
failures?
DR. DAMON: Common mode failures? It
alludes to them in the thing. If the common mode
failure is something explicit that they can identify,
it should be a separate item.
MR. POWERS: We usually have trouble
identifying common mode failures.
DR. DAMON: That's certainly true.
MR. POWERS: I don't know that you can
excuse them by saying we can't identify it so it's not
there.
DR. DAMON: There's a whole discussion in
Appendix A on the question of independence which
involves common cause. I think it is one of the most
important things and it is discussed in there that you
can't treat this cost of independence lightly.
It comes up even more strongly when you
start talking about the fact that many of these
processes are operated by human operators. If you've
got requirements on the operator as to the correct way
of operating a process, when can you count on mistakes
being independent of one another?
That's a serious question. We might get
into that in the guidance document that Yawar is
talking about. There are certain standardized ways of
looking at that issue as to what is sufficiently -- I
mean, for example, one of the criteria would be that
human errors are independent if they are committed by
people on two separate watches, two separate shifts.
In other words, you don't ever count human
errors as being independent if they are committed by
two people who are communicating with one another
because they are standing the same shift together.
It's like the incident that happened with
the submarine off Hawaii. They had a redundant system
there. The captain is supposed to look through the
periscope and look for ships on the surface and the
sonar watch is supposed to be looking for them, too.
But the guy who was plotting the sonar
watch heard the captain look around with his periscope
and said there was nothing there. He said, "Gee, I
think there is something there," but I'm not going to
say anything. He's the captain. That's not
independent. It's not an independent failure. That
kind of thing I think is extremely important in the
way these --
DR. KRESS: On that particular side is T2
something that is knowable ahead of time because of
frequency of inspection or test or something like
that?
DR. DAMON: Right. That's what I'm trying
to point out here. We are expanding the
unavailability number out here, the U2, into lambda 2
times T2. That's done deliberately in the method in
Appendix A to point out to people exactly what you
just said, which is you should often know what that
outage time is because you will have a surveillance
interval or you will know something about the process.
It will tell you it's not as indefinite as a failure
rate is.
DR. KRESS: The lambda 2 is a failure rate
that -- does it count things like the fact that they
did maintenance on it and the maintenance caused it
not to be operable for some reason the next time? Is
that included in the failure rate?
DR. DAMON: They should.
DR. KRESS: Count all failures.
DR. DAMON: Yes.
DR. KRESS: So it needs a database ahead
of time for this failure rate.
DR. DAMON: Well, the kind of facilities
we're talking about people don't usually have anything
that would amount to a database but they have to rely
on their own memory. They do keep track of things
that have happened at their facility.
In fact, in the PHA methods for how you do
a PHA, one of the things that is mentioned is you
should go back -- when you're doing the PHA on a
particular process, you go back and retrieve whatever
performance history you have on this thing, what have
been the maintenance failures.
Has somebody done maintenance and failed
to restore the system or do a post maintenance test
and that kind of thing. That guidance is given to
them so that is something they should consider.
I can remember going to BWXT and that's
one of the first things they showed me. They marched
through their methodology and that is a standardized
part of it, you know, Chapter 1.6 or something and
that's it. That's what they do.
DR. KRESS: In a PRA they would have used
lambda 2 times T2 over 2. I guess in this kind of --
DR. DAMON: Yeah.
DR. KRESS: It's such a small difference
that --
DR. DAMON: That's why the approximation
sign is in there.
DR. KRESS: It's probably not worth
worrying about.
DR. DAMON: All I'm saying this is what
was laid out in the Appendix. It's just a direct
translation of how you quantify an accident sequence
approximately.
DR. KRESS: Why is it felt that inviting
up these things like frequency of occurrence into
units of a factor of 10, why is it thought that is a
sufficiently small unit to divide it up?
DR. DAMON: I would say -- I mean, in
retrospect I would say it's probably -- I mean, I
could be easily convinced that you would use half
orders of magnitude would be a little better. At the
time --
DR. KRESS: It's sort of a finite
difference in approximation of sorts.
DR. DAMON: Yeah. I hadn't had much
experience in actually doing quantitative analysis of
fuel cycle type systems at that point so I put it as
single integers.
In retrospect after having done a little
bit of this as an exercise to see how things work, I
am convinced it would be worth going to half orders of
magnitude but not much beyond that because of the way
things are being treated here these are --
DR. KRESS: Maybe about as close as you
can get them.
DR. DAMON: Yeah. Considering the range,
the uncertainties involved in these things, there's
not much point in going further than that.
DR. KRESS: If you had a set of identified
accident sequences and most of them fail up near the
10 to minus 4 if your range was minus 4 to minus 5,
would you treat that differently than a case where
most of them fell down near the 10 to the minus 5?
DR. DAMON: I'm not sure what you're
saying.
DR. KRESS: Would you give it more of a
regulatory look at it? Would you consider it more
problematic if you were very near -- most of them were
very near the one edge or the other so the summation
of all of them might look differently.
DR. DAMON: There was some discussion of
that in the Standard Review Plan as to how to deal
with that. It's somewhat -- how do I put it? It
would be somewhat problematic as to the regulatory
status of trying to pursue that argument because of
the way the darn rule was written.
It's written as per accident sequence. It
was understood at the time that it was written that's
a problem to state it that way. Given that you're not
going to require quantification, then you can't
require accumulating risks from different accident
sequences together in some other way. It was a
dilemma you're stuck with with this kind of
intermediate --
MR. GARRICK: So what you're end up with
is a -- the word integration needs an asterisk because
you're integrating horizontally but nor vertically.
MR. LEVENSON: I have a question.
Appendix A provides guidance and examples for
determining likelihood. Is there somewhere else
guidance as to how to estimate consequences?
DR. DAMON: There's discussion in the main
body of the appendix. There's a consequence section
that talks about evaluating consequences and some of
the issues that will come up in the process of doing
it. But it doesn't get into the technical details of
what constitutes a realistic model that the staff
would find acceptable or not acceptable.
That's discussed in this NUREG/CR 64-10,
that accident analysis handbook gets into what the
staff thinks about the adequacy of the current state
of models as of about three or four years ago when
that thing was published.
MR. LEVENSON: Since that is published
three or four years ago means it was written maybe
five years ago. Is there any risk-based significance
in that guidance or is it pretty much all historical
empirical?
DR. DAMON: I'm not sure. I mean, mostly
what it talks about is methods for calculating or
estimating the consequences of accidents whether
chemical or radiological so it's standard atmospheric
dispersion, wake effects.
MR. LEVENSON: Yeah, yeah, yeah, but a lot
of the stuff done five or six years ago had somewhere
from two to four orders of magnitude of over
estimation in the methods which is not exactly
compatible with risk-based analysis.
DR. DAMON: This method here -- I mean,
the Part 70 structure again, like I say, is pretty
rigidly risk-based. It's not encouraging people to do
anything that's what I would call bounding analysis or
conservative.
It really is one that is focused on
managing the risk by identifying what are the
consequences that could happen really and really
identifying what you think of the likelihood. None of
the language in here is -- there is a use for bounding
consequence evaluations in doing an ISA which is if
you can -- it can be used as a screening method but
it's not embedded in the regulation as a screening
method. What I mean by that is you can
think of very extreme case release of material if you
show that even the most extreme case does not exceed
the threshold specified in the rule for off-site
consequences.
Then you just can wave your arms and say
I don't need to consider off-site consequences for any
releases of that type in the plant because I bounded
it by this one evaluation. You can use screening
analyses like that. That also is described in the
Chapter 3 how that's to be done.
It is actually I think in the consequence
section the idea of using screening analysis, but it's
also explained that if it comes out the other way,
namely an extreme case does exceed the threshold of
the rule, then you need to have considered that.
I would like to kind of get on to --
MR. GARRICK: Yeah, you've got about five
minutes.
DR. DAMON: Let's see if I can get to the
end of this thing. I've got here -- I just wanted to
talk a little bit about BMXT is one of the two
licensees that have submitted an ISA plan and
described their approach and it has been approved by
the staff. I thought I would briefly go over what
they did so you can see how that relates to what this
Appendix A thing.
BMXT uses various hazard identification
methods, PHA type methods. The hazard office uses it
very frequently which, if you are familiar with it, is
a very structured rigorous way of going through a
piping system that has things about it like flow,
temperature, pressure and marching through these
various parameters and asking yourself what happens if
this parameter is on the high side or the low side and
so on. It's a nice structured method for dealing with
certain types of systems that frequently occur in the
plant so they use it a lot.
The BWXT method does use -- has used
integer indices for consequence very unlikely
evaluations. They categorize consequences in various
bins. Two of those bins are highly unlikely and
unlikely, but their system is actually more -- goes
beyond that on both sides. They consider less severe
events which they have reasons why they want to
consider that in managing their plant.
They also consider ones that are more
severe than the ones that are in the rule but it
includes the two that are in the rule. Like I way,
they have a consequence index and they have a
likelihood index or score.
Then the combination of the two defines
which -- that matrix of consequence indices one way
and likelihood indices the other way defines a matrix
full of squares and they define which of those are
acceptable risk.
Basically, for example, one of the ones
that concerned us was high consequences in their
system requires a score of minus 4 in likelihood.
That's basically the method they use. Of course, it
facilitates a direct translation for us into whether
that's compliance with the rule.
The likelihood index that they use, the
one that I described to you in Appendix A, the number
of factors or number of indices that could be added
together would depend -- it would be situation
dependent. It would depend on how many events in
sequence had to happen, how many outage times, and so
on.
The BWXT method is simplified down to
really only two indices, an initiator index and a
protection factor index. The initiator index is --
again there are tables of qualitative criteria. Here
is one of the tables for the frequency of initiating
events. There are qualitative criteria.
You can call them qualitative or quantitative or
whatever you want to call it but there are criteria to
get a score for the initiating event part of the
score. Like I said, it's used --
MR. GARRICK: Dennis, I know there's quite
a bit of effort given and some of it is certainly
quite creative given to establishing these indices and
what I might call utility functions or scores or what
have you.
Mathematically often what we are trying to
do here is scalerize a vector, something that
describes a system in terms of specific elements
because people sometimes have trouble grasping and
making decisions on the basis of multiple elements try
to transfer that into some functional form or a
utility function such that it accommodates a simple
ranking system.
I believe in our business, in the safety
business, it's very important for us not to obscure,
if you wish, what is really happening in terms of the
accident sequence.
Whenever I'm involved in reviewing an
accident analysis of any kind whether it's a HAZOP
based on or a PRA based one, I'm not comfortable until
I really see what's going on phenomenologically and
how you get from the initial condition or the
initiating event to the end state or the consequence.
I trust that the NRC is not getting too
wrapped up in what I would call this tail end exercise
of casting these results into pretty much a
dimensionalist unitless form. I'm basically against
those in this business but I can understand and
appreciate why that's being done. It has a nice clean
structure to it.
If you read the Harvard Business School or
the Stanford Business School reviews you'll find that
a lot of the papers in there are on just this, on how
to establish utility functions for decision making.
That's not, in my opinion, something we want to give
too much emphasis to.
We really don't want to allow ourselves to
get into the position of not asking what's behind this
and the kind of physical terms and physical processes
and calculations that really give us a firm grasp on
what's happening. That's a long comment and speech
but I think it does represent sort of something that
we want to be very much on guard for in licensing
these facilities.
DR. DAMON: I certain concur with that.
I think the licensee's professional safety staff, the
people that do this stuff and the ones that use it,
they also have that concern.
I think it's actually, to tell the truth,
my belief -- which I don't know how credible this is
but my belief is it's at the root of their concern
about using PRA is that they are afraid it will be
used in this sufficial way.
I think they don't realize that in general
people who have been using PRA long enough, they have
learned that lesson that you have to -- this is not
just a game of putting numbers on things. It's a game
of focusing on the reality of what's going on. I know
I learned that lesson. I spent a lot of years doing
maintenance on hardware and one of my beliefs is that
failure rates
-- how do I put it? Failure rates are made, they are
not born. They are made by the staff of the facility.
In other words, there is no inherent failure rate to
a piece of equipment. It's how you operate it and
maintain it.
MR. GARRICK: All right. We've got to
wrap this up. Dana, since I overtook my time on
questioning, I'll allow the committee, of course, to
ask whatever questions they want.
MR. POWERS: The most striking thing about
this, giving an example, a redundant system not to
include the concepts of common mode failure is
striking.
MR. GARRICK: Yes.
MR. POWERS: I'm not sure how illuminating
it is to tell people to multiply two small numbers
together to get a much smaller number. That won't be
very helpful in understanding how the system avails
itself.
The general difficulties of uncertainties
and these numbers seem to be handled better by the
scale than I had anticipated. I mean, if we're only
working in decade scales whether you've quantified the
distributions of a particular parameter accurately or
not may be less consequential than perhaps I'm used
to.
The common mode failure, I just don't
think you can ignore that. It's just misleading to
multiply 10 to the minus 2 times 10 to the minus 4 and
get 10 to the minus 6 and then walk away happy.
Milt.
MR. LEVENSON: Well, I just am not at all
sure that the very significant part of this whole
issue which is consequences has had anywhere near as
much attention as the probability.
For instance, if I look at the example in
Appendix A in Table A-12, I think there's probably
orders of magnitude of conservatism. Nobody is
studying the probability of the consequence. In
essence, now likely is the proposed consequences?
For instance, if you drop U02 on the floor
and there's some water, the model says it stays
critical for an hour. I don't think there is any
place in the physical world where that kind of
critical mass doesn't disassemble itself in fractions
of minutes.
I just think that the whole area of
consequence -- maybe I'm wrong but my perception at
this point is that the issue of consequence has not
been addressed nearly as adequately as the matter of
probability.
MR. GARRICK: Tom.
DR. KRESS: Well, I agree with what I've
heard so far. One thought is this is an overall risk
allocation process of accident sequences. I've yet to
see a real over-arching philosophy on how you go about
doing that.
Include things like uncertainty, risk
contribution of each accident sequence and how those
uncertainties, contribution, and defense in depth in
general add up to an overall risk acceptance criteria.
That over-arching philosophy to me is not transparent
anyway. It may be there.
The indexing process, while it is clever
and doesn't look to me like it has any technical
problems with it other than this common cause thing
that Dana brought up, does in my mind tend to do what
you said. It obsticates the real issue to some
extent. I worry about that, although I think you
could deconvolute the numbers and treat it like
individual parts.
MR. GARRICK: You only read two-thirds of
the report.
DR. KRESS: Yeah, that bothers me. A
third thought I had is I think in terms of
quantitative risk with uncertainties, pretty much like
you do, and here we have a process that is some sort
of approximation of that. I wonder if any thought has
been given to taking the natural ISA out of some
facility and doing both an ISA and a quantitative risk
analysis as a sort of validation of the process.
I'm sure the ISA is intended to
approximate the PRA in a sense that it is a
conservative approximation. It would be nice to know
what the margins are and how conservative is it. The
only way I know to do that is to compare it to a real
PRA.
In that sense, I think there is still a
need for overall summation risk acceptance criteria as
contracted to the individual sequence risk acceptance
criteria. I see those as not exactly being there.
That is the only way I know how to make a
correspondence with the PRA type of analysis.
I worry about selection of accident
sequences and selections of processes as being a way
to manipulate the system.
MR. GARRICK: It's a selection in
partitioning of sequences.
DR. KRESS: I worry about that to some
extent, too. Basically that's the thoughts I had.
MR. GARRICK: Okay. Dennis, thank you
very much. I think we'll take a 15-minute break and
that will put us about 13 minutes behind.
(Whereupon, at 10:28 a.m. off the record
until 10:40 a.m.)
MR. GARRICK: Can we come to order? Our
next talk is going to be given by Felix Killar. He'll
introduce himself and tell us what he's up to, as well
as make a presentation.
MR. KILLAR: Thank you. As John said, I'm
Felix Killar. I'm with Nuclear Energy Institute.
I've been involved in this process and, as I go back
and talk in my presentation with the history of it,
I'm part of the history of it I've been involved with
it for so long.
What I'll do this morning is give you a
history of the rulemaking, how we got to Chapter 3
which is the focus of today's meeting. What are some
of the future actions which, from this morning's
presentation, it's a little bit of repeat.
And the integration of the safety program
which is important because there's some aspect here I
think they haven't touched on and I want to talk about
that. Then specifics on Chapter 3.
The history goes back to 1986, the Sequoia
Fuels event, which you touched on this morning.
MR. GARRICK: It just seems like it was in
the 1800's.
MR. KILLAR: I know. In fact, I was
looking at some of this the other day and I said it
seemed like it was just the other day that this
happened and it was that long ago.
Anyway, as was touched on this morning,
that was actually a chemical event. There was a
subsequent event there at Sequoia Fuels about 1987,
'88, where they had another chemical event.
There was a lot of issues raised as far as
the NRC's responsibilities and authority in relation
to EPAs and OSHAs. There was a lot of work done to
try and help clarify the responsibilities and make
sure that there isn't either an overlap or a gap.
Part of this came out in 1990 with the
update of the OSHA memorandum of understanding with
the NRC as part as chemical events and clarification
with EPA as far as responsibility on site and off site
and what have you. That was sort of the basis for
where we started on the rulemaking and changed the
Part 70.
Then in 1991 there was an event at the
General Electric facility. This was viewed from two
sides, very different perspective. From the NRC staff
perspective this was a near criticality and major
event.
From the industry's perspective this was
an upset condition which they understood and they knew
what was going on and they knew how to control it, but
the information was not clear to the two sides and
they were never able to really connect and understand
that.
As a result of that, they needed to come
up with a better way of understanding how the licensee
runs their facilities and is comfortable with the
safety of their facilities.
They started a process back then of taking
a group, a task force, that went out to the
facilities, all the major licensees including some of
the radio pharmaceuticals and things on that line and
said, "If we had to regulate these guys from scratch
with a blank piece of paper, how would we do it? How
would we change our existing systems? How do we go
out to make sure that we're looking at the right
things?" And what have you.
In 1992 they came out with NUREG-1324 and
that was a synopsis of this study that they did on how
to regulate the facilities. There are a number of
findings. The principal findings were, first of, the
NRC staff needed better training and understanding of
the facilities.
Secondly they felt there needed to be an
integration of the various safety programs. There
were reports done back in the '70s and '80s on the
risk of these facilities. The primary risk of these
facilities is a fire. Nuclear criticality risk is
further down the road. Radio protection for the
workers is down the road and things on that line.
Looking at the risk of these facilities
and when you're focusing primarily on the nuclear
safety, nuclear criticality, and radiation protection
second, you weren't really focusing on maybe what was
the major risk of the facilities.
We wanted to determine a process for
integrating the various forms of risk whether it's a
chemical risk, a fire risk, a nuclear safety risk,
radiation protection risk, things on that line.
When we started a process of talking about
integration and the ISA, this is what we were talking
about is the integration of those various programs.
We had a number of go-arounds back and forth with the
staff in the mid-'90s to try and explain that and why
it needed to be done even tough the 1324 kind of
pointed that out.
Finally in 1996 we petitioned for a
rulemaking to explain specifically what we wanted to
have in these integrated safety assessments and why we
needed this integration. Our rulemaking was accepted
with some modifications and then we began working on
and revising the Part 70 rule to reflect this. The
rule was finally released in October of 2000 after a
number of iterations.
The staff proposed several different forms
of the rule which we found were not meeting the intent
of what we felt we needed and was not meeting the
intent of what we felt was the initiating events back
in '86 and '92. We went back to the commissioners and
various people and got the staff to kind of focus down
on the issue that we were really trying to resolve.
Finally after going through several
iterations October of 2000 we came up with the NRC
finalized rule initiative. They issue it without the
SRP which is the thing that's been kind of ongoing
since then.
As alluded to this morning, April of 2001
the licensees had to provide their plans for
submitting the ISAs to the NRC and all the existing
licensees have done that.
What are the future actions? By March of
2002 the NRC needs to approve the ISA plans submitted
by licensees. As mentioned this morning, they have
already approved two of them, NSFs and BWXTs.
There is a total -- I'm trying to remember
the number off the top of my head. I think there are
like eight facilities that have submitted these plans
so they've got about six to go. That's changing
because of consolidations and shutdowns at some of
these facilities.
The NRC is currently working on some
industry guidance or some guidance on facility change
process which is 70.72 and a backup provisional which
was also in 70.76. We've are kind of indifferent on
those.
We felt that there's value in those but,
at the same time, for the most part the licensees have
already gone through and implemented their change
processes to 70.72 so additional guidance may help but
we really don't see a whole lot of need for it.
Similar in the backup provision. The back
fit provision comes in once you have your ISA
approved. We don't feel that there's a big need for
the guidance for the backup provision but it may be
helpful having it there.
Come October of 2004 all existing
licensees must have completed their ISAs and submit
the ISA summaries to the NRC for approval of the ISA
summaries. We're working on that schedule. As the
staff mentioned this morning, some of those will be
submitted prior to that so the NRC will be working on
those.
Also in 2004 anything that is identified
as an unacceptable performance deficiency must be
either corrected or a plan for correcting that
deficiency must be completed.
These are the various chapters of the
Standard Review Plan. I left out Chapter 1 and 2.
Chapter 1 is just a general description of the site.
Chapter 2 is a description of your organization.
These make up what I would call the meat
of the licensing application with Chapter 3 being the
new chapter on Integrated Safety Assessment, and
Chapter 11 being the new chapter on Management
Measures. Those two came out of the two events as I
mentioned.
How do you integrate the various safety
aspects of it and how do you manage those safety
aspects to assure they will be performed when they
need to?
The other things, radiation protection,
nuclear criticality safety, chemical safety, fire
safety, emergency management, protection
decommissioning, they have not substantially changed
in years. We've done tweaks and modifications and
stuff but they have not substantially changed in
years. These two chapters, 3 and 11, are the two
chapters that came out of the events in this time to
process it.
What are the issues that we have with
Chapter 3? We have very few issues with Chapter 3.
Because of this process that we went through to get to
the rulemaking and as we've gone through with the
staff working on the Standard Review Plan, we do not
have any problems at all with the Standard Review Plan
and with the rulemaking at this point in time.
Our issues now are what we call
implementation issues and the implementation issues
are what is acceptable. We've only had two ISA plans
submitted so far. We have not had a full ISA summary
submitted and approved by the staff so we are out
there trying to make sure the package we are putting
together is acceptable to the staff.
Some of the issues we have is how detailed
does the ISA summary need to be? That has been the
biggest stumbling block that we've had in this whole
process.
In fact, a number of times we threw up our
hands and said, "Hey, look. If the staff isn't happy
with our ISA summary, come and look at the whole ISA
or we will put the ISA, the full ISA, on a CD-ROM and
ship it to you and you can sit there and look at it
all you want because we cannot come to terms on what
the level of detail needs to be in the ISA summary."
I think we have come to terms but now it's a matter of
do we really understand the terms we've come to.
How quantitative does it need to be? I
think Dennis gave you some of that this morning. The
industry is basically a chemical industry. Part 70
facilities are basically chemical industry that
handles radioactive material.
As Dennis alluded to also, a lot of the
work is done on HAZOP because HAZOP is what the
chemical industry typically has used for years and
what this industry has used for years for doing their
typical safety analysis for the chemical safety of the
facilities and they've taken that and expanded that to
look at nuclear safety radiation protection.
We don't do a whole lot of quantitative
type analysis. Ours is more qualitative type analysis
so we have a question about where the -- how
quantitative it needs to be. There are certain areas
in the plant where a quantitative analysis will make
sense.
It's a unique situation, a very integral
component or operation where you have to go through
and look at it. For a lot of the operations at the
plant a very basic type analysis, even what-if type
analysis, will be adequate for evaluating those
processes.
I might allude, too, I talk about
evaluating processes. One of the things I want to
point out is that when we talk about a process, that
process can be defined as just changing it from this
table to that table or the complete process from
beginning to end to get it from one form to another
form.
It's a function of the detailness or
sensitivity of that process in the analysis that we
do. When we look at processes, it can be chopped up
in individual steps in the process it we can look at
the whole nine yards.
DR. KRESS: I'm trying to decide on the
reasoning behind NRC thinking an ISA summary is
sufficient. Is that just to save time in their
review? You have the full ISA. How big is it? Is it
huge?
MR. KILLAR: They are fairly huge. BWXTs,
I think they're probably in the order of about eight
to 10 three-ring binders so they are similar to back
at the FSAR stages.
DR. KRESS: Back in FSAR.
MR. KILLAR: Back in those days. And they
are rather detailed. One of the concerns and reason
why we went to the submittal of the ISA summary rather
than the ISA. What we found with our facilities is
that they are very consistent but they change every
day.
The basic process stays very much the
same. We make U02 to F2 routinely every day. For
today we may tweak this parameter or we may tweak that
parameter and tomorrow or next week we may go a
different direction.
The process still has changed but we've
tweaked these things in here and we need to have the
ability to look in and say as we change or tweak this
thing, what impact does that have on safety without
having to go back through and do a complete ISA and
submit a complete ISA to the staff for their review
and consideration.
The other thing that we want to get out of
all this program is that one of the biggest issues the
NRC and the licensees have is timely license renewal.
Part 70 licenses run anywhere from five to 10 years.
Under the Part 70 rule when we submit a
license application for our license renewal
application, we can continue to operate under existing
license until that renewal application is finalized.
In some cases that renewal application has lingered in
the organization in getting it completed for four to
five years.
We felt, and the NRC probably felt, that
this was not the way to do business, so one of the
things we want to do with this process with the new
Part 70 and with the ISA process is keep a living
license. When our nine or 10 years are up, five years
are up, whatever the time period is, they have kept
abreast of the changes in the facility.
We will keep them abreast of the changes
with the ISA summary. There should not be any major
program changes so we would think that the
programmatic programs such as radiation protection,
nuclear criticality will not substantially change. It
should be a fairly simple license renewal at that time
period. That's one of the major benefits we see in
going through this program.
And just to touch on a last point here,
how do all safety programs together. That's the issue
that we have is that we want to make sure the
understanding is how the safety programs work
together.
If we want to put more emphasis in this
area because we feel it's more important to spend more
time and resources on fire safety than it is on
nuclear safety or radiation protection, we should be
able to demonstrate the balancing of those between
themselves as far as safety to the facility and to the
public.
That's my quick pitch here this morning
because, like I say, we don't really have any major
issues with Chapter 3 right now.
MR. GARRICK: Questions? Is this issue of
the scope of the ISA summary resolved now in your
opinion?
MR. KILLAR: Yes and no. It's resolved in
our understanding of what the expectations are. Until
we actually have an IGA summary submitted and approved
by the staff it's still an open issue. We do not have
an ISA summary that has been submitted and approved by
the staff according to the new rule.
We have had some ISAs that were done for
parts of facilities prior to the rule that have been
approved so we have an idea, but now the rule has
changed a little bit of the basis and things on that
line.
One of the things that we did with the
April notifications is identify what changes had to be
done from what the previous ISAs we submitted in order
to meet the new rules but we have not had an ISA
summary that has been submitted and approved under the
new rule yet. Until we get through that process, we
still have that question in our minds.
DR. KRESS: My interpretation of what you
said earlier is that the licensee is more or less
committed to the summary as its licensing basis as
opposed to the full ISA. Is that an interpretation
that is correct?
MR. KILLAR: That's borderline. The way
the rule reads is the NRC does not approve the ISA.
They approve the ISA summary. But the way they
approve the ISA summary is that they look at the ISA
summary, look to see if there are any questions in
there about what they've done based on their knowledge
of the facility or knowledge of operations and things
on that line.
If there are questions, they have the ability to
go down and do a vertical cut of the ISA itself at the
facility to see how part of that is reflected in the
ISA summary. They quasi approve the ISA by approving
the ISA summary. Per the rule, they are only
approving the ISA summary.
MR. GARRICK: One of the problems I've
observed in the application of the PHA technology in
some plants is it's not always easy to make the
connection between the individual contributors and the
end results or the end state results of the sequences.
What some of the people that are heavily
engaged in using this kind of technology are doing is
beginning to look at specific contributors that pop up
as important in more detail and, in fact,
probabalistically building a little PRA model of those
contributors.
In a sense, that is proven to be very
constructive. It provides some of the things that Tom
was talking about earlier of baselining the difference
in results you might get from an ISA and a PRA but at
a level that is not quite the commitment that you
would have if you would try to do it for the whole
report.
MR. KILLAR: Let me address a couple of
points. That reminded me of a point that was brought
up earlier this morning. One of the things that the
industry was concerned about is that our facilities
are not connected and interconnected similar to a
reactor facility.
Like I talked about earlier, when we
review a process we can either chop it up in pieces or
we can do the whole process because if this piece
fails it has zero impact on the rest of the operation
up there. It has zero impact on it as far as
radiation protection, criticality safety or anything
along that line.
We can look at these as individual pieces
or we can look at the whole process because they are
not interdependent as far as the safety is concerned.
Now, there certainly could be some interdependence.
If this causes a fire, it may impact those
operations down there. As an independent device, as
an independent operation, the operation safety does
not necessarily require this operation here as well.
Secondly, in some of the facilities I've
gone through and did the ISAs, they've put together
ISA teams and they felt that -- they found a lot of
value of putting these ISA teams together because of
some of the issues you just brought up.
Some of the things that the nuclear
criticality guy is sitting there working on and
thinking about, he may not have thought about in
radiation protection.
I said, "Hey, did you think about this?"
He said, "No, I need to put that in there because of
what ifs or whatever and stuff." The teams have help
provide more depth and more understanding of their
facilities, a better handle of the safety of their
facilities.
To the other extent, one of the things one
of our members found is that they got into doing a lot
of the analytical type analysis and things on that
line and they found that they got distracted because
they were focusing on the numbers and not the real
life.
They said, "Oh, gee. Is this 10 to the
minus 4th or 1.3 times to the minus 4th?" In the crux
of things it didn't make any difference but they were
focusing so much on that they were kind of getting the
picture.
MR. GARRICK: But PRA is not to do that.
MR. KILLAR: Right.
MR. GARRICK: You are supposed to focus on
what can go wrong and keep the attention on the
scenarios if you wish. People that tend to get hung
up on the numbers, they themselves are not practicing
the art the way it was intended.
MR. KILLAR: And that is exactly the point
I was trying to make. There was a concern when some
of the members said they saw the ISA team getting
involved in the numbers and not really looking at the
understanding of what they were doing and stuff and
they corrected that.
There was another point I was going to
mention but I can't recall off the top of my head what
it was.
MR. GARRICK: Any other questions? Okay.
Thank you. Thank you very much.
I guess we are now going to hear from the
NRC staff. We'll ask each member to introduce
themselves and tell us a little bit about their job
and proceed with their presentation.
MS. BAILEY: Good morning.
MR. GARRICK: Good morning.
MS. BAILEY: I'm Marissa Bailey. I'm a
Senior Project Manager in the Risk Task Group. I'm
here this morning to basically -- turn on the mic --
give you an overview of our activities, our risk
informing activities in the Risk Task Group.
I and Dennis Damon will be doing this
presentation because our section chief Lawrence
Kokaiko doesn't have a voice today.
MR. GARRICK: Sounds like an excuse to me.
MS. BAILEY: Basically our activities in
the Risk Task Group fall into three categories;
supporting the risk initiatives and risk related
activities in the different NMSS divisions, developing
and implementing risk related training, and then
developing and implementing a framework for risk
informed regulation in the materials and waste arenas.
What I want to do is just go very briefly
over the first two bullets. I and Dennis Damon will
then spend most of the time going over the status of
the third bullet as far as where we are in
implementing risk informed regulations and conducting
the case studies, and also developing safety goals.
As far as assistance to the divisions in
NMSS goes, this is a list of some of the activities
that we have been involved in or that we expect to be
involved in during the next year.
I think most of you have heard this
before, but basically our goal here in our assistance
and peer review activities is to ensure that risk
methodologies are applied consistently, to basically
make sure that the staff's regulatory positions are
consistent with their risk significance, and also to
just provide general guidance and assistance on the
use of risk information and risk assessment methods.
In regard to training, we have implemented
several training courses or we are developing or they
are in the development phase. At this point there are
three introductory courses in risk assessment that's
being offered. There's one for the technical staff,
one for the technical manager, and then one for the
administrative staff.
We are offering a course on quantitative
frequency analysis for fuel cycle. We are in the
process of developing a training course on the use of
the by-product material risk study, and also
developing a handbook for that. And we are assessing
other risk-related training with the technical
training center.
DR. KRESS: Are those courses held here in
White Flint?
MS. BAILEY: Yes. Or in the region.
DR. KRESS: Or in the region.
MS. BAILEY: Now I want to basically get
into what's been I would characterize the major
activity in the Risk Task Group over this last year.
Basically that is implementing and developing a
framework for risk-informed regulation in the
materials and waste arena.
SECY-99-100 and the SRM for that has
really provided the basis and guidance for what we've
been doing in the Risk Task Group for the last year.
The first phase of that has involved conducting case
studies. Just very briefly, let me go over Secy-99-
100.
This was issued by the staff back in March
of 1999. In this commission paper we proposed a
framework for risk informed regulation in the
materials and waste arenas. That framework also
involved a five-step process for moving forward with
risk-informed regulation.
In that five-step process the first step
was to identify candidate applications that would be
amenable to risk-informed regulation. Although in
NMSS we are probably -- there are areas that are
further along in this five-step process, in general we
are in step one of this five-step process. In other
words, we are still pretty early in the process of
trying to identify candidate regulatory applications.
IN the SRM SECY-99-100 which was issued
back in June 1999 the commission approved the proposed
framework. They also directed the staff to develop
materials and waste safety goals that would be
analogous to the reactor safety goal.
DR. KRESS: Did they give you any guidance
on what the word analogous meant?
MS. BAILEY: No.
DR. KRESS: You have to do that yourself?
MS. BAILEY: I think we're feeling our way
through it. Dennis will be talking about where we are
in this process as far as development safety goes as
soon as I'm finished here.
So basically what we've done is we have
developed draft screening criteria to help us identify
those candidate regulatory applications that are
amenable to risk informed regulation which, again, was
step one of that five-step process.
We also adopted a case study approach to
help us test the draft screening criteria and also
help us begin to process and develop safety goals.
The case studies would be retrospective looks at a
spectrum of activities in the materials and waste
arenas.
Individual and cumulatively they should
tell us or illustrate for us what has been done in the
materials and waste arenas with respect to using risk
information. To what extent have our activities been
risk informed or not risk informed.
The objectives of the case studies were to
test the draft screening criteria and produce a final
version, to examine the feasibility of safety goals.
If they are feasible, develop a first draft.
Then the subsidiary objectives of the case
studies were to gain insights on how we could risk
inform our regulatory processes and also gain insights
on what tools, data, methods, guidance we would need
to implement the risk-informed approach.
MR. GARRICK: Now, the Risk Task Group
came into being after the ISA process was pretty well
developed. Is that not correct?
MS. BAILEY: Lawrence, can you answer
that?
MR. KOKAIKO: I have a little voice. Just
not a sustained one. The ISA process had already
started before the Risk Task Group had come together.
With Dennis Damon we followed the activities of it.
We revisited BWXT and Global Nuclear Fuel and were
aware of what's going on. We have not been in charge
of development of the SRP Chapter 3.
MR. GARRICK: Okay. I'm just trying to
get focused on what the Risk Task Group really is
doing to risk inform the office given that the ISA is
kind of the driver of the analysis effort and that it
has already been pretty well established.
MR. KOKAIKO: The ISA is the driver in
fuel cycle for fuel fabrication facilities.
MR. GARRICK: I see.
MR. KOKAIKO: But in other areas of NMSS
other things will have to be utilized. NMSS is a
broad regulatory spectrum from moisture density
gauges, gamma knives, all the way to the repository.
MR. GARRICK: Thank you.
MS. BAILEY: These are the AK study areas,
the areas that we conducted the case studies on, gas
chromatographs, static eliminators, fixed gauges,
uranium recovery, the decommissioning of the Trojan
Nuclear Plant, transportation to the Trojan reactor
vessel, the seismic exemption for the dry cast storage
facility for the TMI defuel debris and INEL, and the
seismic upgrades for the Paducah gaseous diffusion
plants.
Now, these areas or activities were chosen
as case studies because we felt that they had elements
of risk informed decision making in them, or because
it was felt that these were activities that could
benefit from risk-informed decision making.
I guess I would like to point out that at
this point in time we have completed our case studies.
In fact, last month we held the last of the series of
stakeholder meetings on the case studies.
During that meeting we presented the
insights that we gained from the case studies and also
tried to get some feedback on how we could integrate
the individual results of the case studies and move
forward with risk informing our regulatory processes.
Now, at this point I would just like to
summarize for you some of the general insights that
we've learned or that we've gained from the case
studies.
With respect to the screening criteria, we
basically found that they did encompass the relevant
considerations for what we ought to be thinking about
or what we ought to be considering as we try to decide
whether an activity can be risk informed.
We did find that there should be
considerations rather than criteria. That's really
just to reflect the fact that the screening
considerations is a decision-making tool. It's not to
be a check list that gives you a black and white
answer and that forces you to go down a certain path
if the answer happens to be yes or no.
MR. GARRICK: It's kind of in the spirit
of being more risk informed and less prescriptive, I
would say.
MS. BAILEY: Okay. Yeah. Basically the
outcome of the screening considerations is just
another factor you ought to be taking into account
when you try to make your decision.
Let me just go back to that slide. The
other thing I did want to point out was that we did
find that the screening considerations is a useful
decision-making tool and we're pretty much ready to
finalize it.
However, we did find that the application
of it can be very subjective and guidance on how it
should be applied needed to be developed. We are also
in the process now of trying to develop guidance for
how to use the screening considerations.
Screening considerations themselves are a
series of seven questions that we would ask. The
first four questions basically addresses the agency's
strategic goals of maintaining or improving safety,
improving efficiency or effectiveness, reducing
unnecessary burden, helping or enhancing public
communications.
The fifth criterion addresses the
availability of sufficient information to risk inform.
The sixth criterion basically asks whether a risk-
informed approach could be implemented for a
reasonable cost.
Then the seventh addresses other
precluding factors. Given that an activity meets the
first six, is there anything else that would or should
stop us from risk informing a process.
This next slide just gives you the exact
wording of the screening considerations.
As far as safety goals go, which is the
second objective in the case studies, the case studies
showed us that it is feasible to develop safety goals
and that a multi-tiered structure, similar to the
reactor safety goals, is more possible approach, and
if we did take that approach, we would have to develop
subsidiary objectives for each program area.
We also found some implicit and explicit
safety goals in the case studies. We also found some
examples where decision making could have been
facilitated if a clear set of safety goals existed.
Dennis will go into the safety goals in more detail as
soon as I'm finished.
As far as the value of using risk
information, the case studies showed us that the use
of risk information, at least in those eight
activities, did help the staff to make decisions that
were in retrospect consistent with the agency's
current strategic goals. They also found that the
risk information can be useful in helping us identify
shortcomings in our regulations or regulatory
processes.
However, for us to fully realize the
benefits of a risk-informed approach. there are
probably several things that we need to do in the
future. One, we need to continue with staff training.
We probably need to introduce or develop
risk-informed guidance on rulemaking and licensing and
inspection and enforcement. We have to develop safety
goals. We probably need to recognize that zero or
zero risk is not possible, that it's impossible in the
real world. And we need to address human reliability.
With regard to tools and information and
methods and guidance, the case study showed us that it
exist in varying degrees. In some cases there are
tools and methods that would support a risk-informed
decision making. But, in some areas, some would have
to be developed or some would have to be further
developed. Whatever tools and methods are out there,
they all shared a common weakness of the human factor.
As far as where we go from here, we've
completed our eight case studies so now we're on that
yellow block. We're in the process of trying to
integrate the results of the case studies.
By December we hope to put out an
integration report that would have the final screening
considerations, have a first draft of safety goals,
and could address some of the process improvements
that we could make in the materials and waste arenas.
Also by December we hope to have developed
guidance for how screening considerations should be
applied. Early next year what we want to do is start
applying those screening considerations systematically
to the program areas within NMSS and start trying to
identify what areas could be risk informed. In
parallel with that, we also want to further develop
and refine the safety goals with the help of the
Office of Research.
I think that pretty much concludes my
part.
MR. GARRICK: Questions? Thank you.
DR. DAMON: Good morning. I guess I
didn't introduce myself before. My name is Dennis
Damon and up until two years ago I had been working in
the Division of Fuel Cycle Safety and Safeguards. One
of the things I worked on was the Part 70 rulemaking
and the ISA chapter, the Standard Review Plan.
Then about two years ago I became part of
the Risk Task Group which at that time was under John
Black. Currently now it's under Lawrence Kokaiko.
I've been now involved in this broader spectrum of all
the different risk-informed activities in NMSS since
that time.
What I wanted to do here was to try to get
fairly quickly to some of the interesting issues that
come up when you talk about safety goals on the
nuclear material side.
I don't want to de-emphasize the
importance of having done these eight case studies
because if you go off and you try to develop safety
goals in the abstract without looking at very specific
cases, there's a danger that what you develop just
doesn't apply to the real world of what these people
are dealing with.
That was the purpose of the eight case
studies was to look at risk information in the context
of eight very specific cases and see does this all
make sense. The idea would safety goals be useful to
anybody in this NMSS area.
One of the conclusions from looking at
case studies was, yes, it is sometimes. It's not
always a useful thing to have but quantitative
measures of what is safe enough which would be a
safety goal, a quantitative measure that would be a
useful thing in certain specific situations that come
up.
Then I just want to make it clear that I'm
sure you gentlemen haven't been probably involved in
the reactor safety goal side understand what is meant
by a safety goal but I wanted to communicate that what
the Risk Task Group's understanding of it is and this
addresses that.
It is a level that is safe enough but, as
you notice in the third bullet, it's a level of risk
that is low enough without explicit consideration of
whether it's possible to achieve that value. This is
our understanding of it. It's a level of safety that
is inherently safe enough, not one that's conditional
on whether you can achieve it or what it would cost to
do that.
The purpose of these safety goals is to
facilitate risk management. It is important to
remember, and this is often forgotten once you start
to get right into this risk management.
When you start using risk information to
manage safety, it very quickly assumes this flavor
that these goals you're setting for yourself are
requirements. Like I say, by the definition of what
I think they are supposed to mean, they are not
requirements.
MR. POWERS: Can we go back over this?
Define how safe is safe enough without any economic
considerations? Why did you conclude that?
DR. DAMON: Oh.
MR. POWERS: I'm not sure what you're
driving at here.
DR. DAMON: What I'm driving at is that
there are different concepts for what is safe enough.
One concept is in one aspect of being safe enough,
it's the thing I should be. I should be this safe.
When you say you should be that safe, that
implies it's possible to achieve it, it's reasonable
to achieve it. It's that kind of thing. There are
requirements in the regulations like ALARA that that
is the concept. It's a level of safety that is a
reasonable level to require that you achieve.
A safety goal is not -- my understanding
of a safety goal is not based on reasonableness. It
is based upon an inherent look at the risk itself and
a consideration that level of risk is in some sense --
in some higher sense it's safe enough. It's not
conditional on whether you can achieve it or not.
MR. POWERS: Let me explore a little bit
because I'm not really sure what you're driving at.
When we think about adequate protection, we do not
take into account economic consideration.
When we think of a ALARA, we do because
there's a point at which we say, well, it's not
reasonable to achieve because it cost too much money.
Then we put a specific number on that, a dollar
figure.
When we think about safety goals, we've
said once you achieve this level of safety, the public
interest has no -- the public has no interest and you
would be safer to go to expenses to which you have a
greater level of safety. They don't say you can't but
you can. I'm not absolutely sure what you're driving
at here.
DR. DAMON: I think you're saying the same
thing as what I'm getting at.
MR. POWERS: Okay.
MR. GARRICK: So you are saying that the
ALARA principle applies here? At least the principle.
If you can make something safer with very little cost,
and even though you have met the safety goal, why not
do it?
DR. DAMON: That's one of the interesting
questions. That's the kind of stuff I think is useful
to talk about because --
MR. POWERS: Because I thought he was
capping the ALARA.
DR. DAMON: That's what I'm saying. Some
people will say this consummate of safety goes a four
to ALARA and other people say no, it's not. That's
what I'm saying. It's a very interesting point to
bring up.
MR. POWERS: Let me encourage you very
much to cap ALARA because otherwise it just hamstrings
you because I can always consider a way to do things
with less radiation dose. No matter what you come up
with, I can always think of another way to do that.
What you want to say is there's a point regardless of
whether it be done at zero cost that you quit thinking
about those things.
DR. DAMON: Well, that's what I say.
We're early on in the stages of analyzing and talking
about safety goals, but some of the people involved,
like myself and Bob Bari and Viuod Mubayi at
Brookhaven, have been doing this a long time so they
know there are these issues out there.
What we're trying to do is elevate this
stuff, put it out in public and start reexposing
people to it and clarifying these things. Some of the
things seen in reactor safety goals, a reactor is just
one particular kind of device and situation. Because
of that, it's possible to simply the consideration of
safety goals.
When you get to NMSS with the broad
spectrum of things they deal with, one of my views is
you have to be sure that the set of safety goals
you're coming up with are covering everything that you
want to and that you need to deal with.
Like the second bullet up here, "To
identify proper safety roles, to identify risk metrics
to manage," is kind of getting to this. We've got to
make sure that we were addressing the things that they
really have to worry about in NMSS. That means it has
to be -- what I would like it to be is a complete set.
What this slide is intended to call out,
and maybe it doesn't do it quite well enough, is that
safety goals, as I've said before, they are
aspirations, not limits. But there are risk-based
requirements in the regulations right now and they
come in in two different ways is the way I look at.
One way they come in is really as an
explicit risk-based requirement. The performance
requirements of 7061 that we were just talking about,
the highly unlikely for high consequence, that's what
I mean by that. It's an explicit risk-based
requirement. It's a requirements that something about
the licensee has to meet.
10 CFR 32.23 and 24 also have such a risk-
based requirement so that's one type, a risk-based
requirement statement. It's a requirement stated in
terms of risk, likelihood and consequences.
The other type of what I would call a
risk-related requirement statement is something like
ALARA. The way I think of this is as a conditional
risk-related requirement. It's a requirement that you
continue to lower risk conditional on what it cost and
whether it's feasible and other considerations.
Safety goal is, like I say, something
different from that. That's why I'm trying to draw
this distinction that we understand. This is just to
emphasize the fact that the statement I made before
about the fact that the case study showed that
quantitative risk information be useful.
The first one up there, transportation,
has to do with the Trojan reactor vessel shipment. In
that study a quantitative risk analysis was done.
What they calculated -- one of the things they
calculated -- they calculated two interesting things.
One of them was the probability of an
accident that would exceed the design conditions of
the transport vessel and shipment package. In other
words, a collision that you could not be sure that the
reactor vessel would not be breached.
They calculated probability of these very
severe accidents and they got a number about 10 to the
minus 6. Well, the only trouble with that is they
calculated it but nobody was telling them 10 to the
minus 6 was acceptably low. They made that decision
on their own.
It would have been useful if they had
quantitative guides telling them, "Yes, this is an
acceptable value." The only problem is they didn't
calculate consequences. They just calculated
probability of whether the accident would be severe
enough that it would possibly lead to consequences.
That's one thing they did.
Another thing they did in the context of
that study is they calculated -- that's a probability.
Basically since a shipment is a one-time only thing,
this is a one-time only probability of a one-time only
consequence.
The other interesting thing they
calculated was they calculated the cumulative person
rem to both the workers who were preparing this
shipment package and also to the public incident to
making the transport. The transport package was a
reactor vessel in its internals in a shipment package
so there is some shielding. There is some dose
involved in preparing that package for shipment.
The interesting thing that came out of the
study was is that this cumulative total person rem
figure was actually lower for shipping it by the barge
method which is what they proposed.
To me what was an interesting example of
is why I said before it's useful to have all the risk
metrics identified that you're trying to manage so
that when you tell somebody to do a risk analysis that
they analyze -- they calculate the risk with respect
to all those metrics because otherwise you get this
biased picture if you only calculate one risk metric
and you don't look at the other ones.
That's one of the things I think we learn
from this is look at all the different risks involved.
This is pointing out that the gas chromatographs,
which is one of the other case studies, the regulation
that applies to them is 10 CFR 32.23 through 27.
I'm going to show you what that looks
like. This is what it looks like. This is what I
call a risk-based requirement. This is what they are
required to do. If you look down at not the last row
but the row that says "whole body" there. This row
here, "whole body."
This applies to gas chromatographs which
are a device which is a typical thing that NMSS
regulates. Devices or pieces of equipment that are
used by certain persons in the public. This is normal
use and disposal. This is normal storage.
This is really intended to address the
manufacturing facility and the warehousing and the
distribution of the things where they might be present
in large numbers. This is the case where a user has
got one of these things out in a lab somewhere using
it.
There's 1 millirem. It must be unlikely
in one year for that person. For this person who
works at the facility where they are manufacturing or
storing these in a warehouse, 10 millirem must be
unlikely in one year. These are requirements, not
safety goals.
Out here one unit in one location. As we
march what we're doing is marching out in consequences
along this whole body dose thing. Half a rem, 15 rem.
Half a rem probability is low. 15 rem probability is
negligible.
What I see here is a risk-based
requirement statement. It raises all kind of
interesting questions when you're trying to formulate
safety goals. Why should this be different from this.
This guy gets -- it's the same unlikeliness and this
guy gets 10 times more.
I think the reason is because they are
treating this guy as a worker, a radiation worker. He
works for a manufacturer of radioactive material and
this person is being regarded as a member of the
general public. That would be the way I would
interpret that. That's why they did the difference.
All I'm saying is there's a lot of risk-
related requirements and reasoning that is already
embedded in the regulations and that's why we're
having to go through these case studies, to tease this
stuff out and then try to figure out how that relates
to safety goals.
On the previous slide it said right down
here, "15 rem probability must be negligible." They
have interpreted this right in the regulation. This
is a direct quote, "Negligible is defined to be not
more than one such failure per million units
distributed."
There's a flaw in this reasoning. They
say negligible probability. Well, what if you got a
million units in your warehouse. There is sort of
inherent logic flaw in the way they stated this.
That's why I say there's a virtue to going through
this safe goal stuff to try to explain to people how
to formulate these safety requirements.
It was also identified that safety goals
might have helped in some of the other case study
areas that they worked on. Safety goals might be
useful in these areas. There's dry cask storage which
you'll hear about later.
This is really a much more interesting
slide. One of the things we did was we -- one of the
issues to consider in formulating safety goals is why
should there be more than one. What is it that makes
you have more than one safety goal.
In the reactor site they identified
individual societal. What we did was we went around
and looked and tried to figure out what are all the
other factors that would cause you to have more than
one safety goal.
Certainly individual versus societal is
one of them and I'll talk about what I think it means.
Maybe you can tell me what you think it means.
Anyway, that is one parameter that causes you to have
two different kind of safety goals.
Then there are all the different factors
that influence the population at risk. In other
words, you might need to have a different safety goal
for different populations. One rationale for that
being voluntary versus involuntary.
One example of voluntary versus
involuntary is worker versus public. With the outside
public person the facility is plunked down next to
them and they derive only a general benefit from it.
Nothing specific, yet they are inflicted with all the
risks. Whereas the worker, in a certain
sense, it's voluntary that he assumes the risk of
working in a facility that handles radioactive
material. Since there's a difference in -- and that's
embedded in our 10 CFR 20.
That concept that there should be a
difference is embedded in 10 CFR 20 which is a
requirement statement, 5 rem for a worker, 100
millirem for a member of the public. As a unit would
that be reflected in a safety goal, that difference.
MR. POWERS: I have frequently questioned
whether the workers are voluntarily assuming risks
when they go to work at a radiation facility. The
reason I question that is if we compare the education,
we provide the workers on the radiation risk to the
kinds of statements that doctors ask you to assign
when you have an operation or some medical process
operated on you, there's no comparison.
The education on risk can consist of
telling you there's no problem, whereas the doctors
tells you, "You're going to die on this operation that
I'm going to perform on you and it's horrible beyond
belief and nobody in his right mind would ever do
that. Do you want to do this?" So it's always been
an open question to me whether one ought to make this
distinction or not.
DR. DAMON: Well, that's the kind of
questions and comments we're looking for. We're just
in the early stages. We haven't even really -- we
haven't fully aired this in public. We did present
this slide in a public meeting but that's the kind of
issue that -- I mean, I wrote a little paper talking
about this.
Voluntary is, like you say, yeah, it's
voluntary but if he doesn't go to work there, he
doesn't get paid either. It's not like 100 percent
voluntary.
Then there's another reason why it might
be appropriate to allow him to be exposed to higher
risk and that is he gets a benefit out of it. He does
get that salary. In fact, that's not on this slide
but what I was going to say is individuals/societal
and voluntary/involuntary are just two parameters. We
consider 13 parameters -- no, 15.
There's 15 different parameters that could
influence whether you give somebody higher or lower.
One of them is benefit. In the case, like you said,
the guy who is getting an operation, the reason he is
willing to take that risk is he's going to get a
benefit from it. It's a risk benefit trade off.
It points out what the real difference
here is between worker and public where one of the
other differences is a different difference, and that
is the worker gets a benefit; namely, he gets the pay.
The public guy's benefit is at a very remote level
from that thing.
When you do a risk benefit trade off kind
of thinking about these things, the worker might say,
"Oh, yeah. I get more morasses. That's too bad but
I get paid." The interesting thing is all this risk
benefit trade off thing comes up at two other ends of
the spectrum.
It comes up at the end of the medical
spectrum, of course, where there's a risk that if you
undergo a procedure that involves radioactive
materials, you might get -- you are subject to the
risk of misadministration, not of the dose that you
are supposed to get but that they would screw up and
actually kill you with the radiation.
There's a risk there but there's a big
benefit to trade off. A huge benefit and a
substantial risk. At the other end of the spectrum,
there's risk benefit trade off in that there are
safety devices that have radioactive material in them
like smoke alarms.
An infinitesimal radiological risk traded
off against the benefit of having smoke alarms that
work according to that principle. All these 13
factors come into as issues to consider in formulating
safety goals. We have gone through and thought some
of this through but, like I say, we're still in the
early stages.
This is an interesting one. There are
chemical risks, nonradiological risks. Also it's
interesting to think bout long-term risk which comes
up, of course, in waste disposal sites. It induces
difficulties in how do you deal with this.
MR. GARRICK: I know there's an
environmental impact statement, but have you
considered at all bringing environmental impact into
the safety goal domain?
DR. DAMON: We have considered doing
environmental and property damage. These are some of
the risk things we are considering here. We are
considering a tiered structure like they used in
reactor safety goals where the top level is
qualitative and then is quantitative down here.
Environmental and property damage are two
things. In addition to risk to individuals and
societal risks, there is environmental and property
damage being considered. Like I say, we're very early
stages in trying to think about what the heck can you
do with this thing.
MR. GARRICK: Yeah, I was curious
particularly about the quantitative part, what you
might be thinking about there.
DR. DAMON: The individual versus societal
one, I would like to make a statement in case somebody
wants to object to what I say. In my mind there's a
very dramatic difference between individual and
societal risk the way I think of them.
Individual is a question of justice that
derives from the idea that -- it really, I think,
derives from the other end of the spectrum; namely, a
case where a facility would say -- local a facility
which would subject someone to a risk of 50 percent of
being killed due to them locating there.
Just a gross risk imposed on some innocent
bystander would be intolerable. Since that is
obviously unjust, they are driving the benefit, that
person is driving the risk and there's an injustice.
It's a goal to lower that down to some level.
When you reach a lower level that's low
enough, that's okay. If you lower it to zero you lose
all flexibility in society. You can't do anything
because everything you do imposes a risk on somebody.
Somewhere in between is a concept that that level of
injustice is something we have to live with in order
to allow society to function.
The other one, societal risk, in my mind
is a total grand integral of all risk associated with
something and it comes into the process of thinking
whether that process is being conducted in a way where
there's a net -- how do I put it? It's a net benefit
kind of a reasoning.
In other words, risk is one of the
disbenefits you get when you do something and you
would like to keep it down. Since you are getting
this benefit from doing the thing, you are probably
going to continue to do it and the question is how low
a value is this total risk impact going to be.
It's not an issue of justice because
you're already -- if you've complied with an
individual safety goal, then this thing is already --
it's not a question of justice to the individual.
It's simply a societal question of whether we are
willing to incur this level of risk associated with
this type of activity.
MR. POWERS: You might want to think also
in terms of general uncertainty. When we tried to
formulate a worker protection goal for some of the DOE
facilities, we quickly ran into the problem we don't
where the guy is.
In most of your individual risk things you
can say he's at the site boundary or somewhere beyond
there so you can kind of locate him. You really can't
locate him when you are trying to do a worker sort of
thing.
You could in that scenario gravitate
toward a societal goal for the society of workers
because of the uncertainties of where they are
located. You can integrate over the population but
you just can't do one individual.
There is some of that built into larger
societal goals in that you don't know which members of
society might be particularly receptacle to radio or
chemistry or something like that. You create societal
goals to compensate for that uncertainty.
You quickly find that societal goals
suffer from extrapolation to the limit because you
start getting things like one gram of plutonium
dispersed in the atmosphere will kill three people
when you integrate over a million population and
things like that.
You might think of it in terms also of
just uncertainty of what's going on in this population
of individuals.
DR. DAMON: I think I can generalize what
-- that's a very interesting observation because you
can generalize that in saying that some of the things
I have seen about -- how do I put it?
When you look at a safety requirement or
a regulation, and it may be stated in terms as either
an individual risk limit of some kind, or it might be
stated as an integral measurement, it's not always
true that is actually what they are trying to manage.
It may be that it's done that way for
practical reasons. Like you say, you can't measure it
so we're going to average or some reason like that.
It's very important, I think to tease out what they
really are trying to do. What is really the purpose
of this regulation.
Yucca Mountain is kind of an example of
that. They are regulating to an individual risk
limit. But why did they locate it in a remote
location where there's few people? Because the risk
limit to an individual doesn't have anything to do
with how many people there are. You have to be
careful that you understand why people are using it.
What I would say is that's one of the
reasons for subsidiary objectives down here is there
are practical working level quantitative tools,
whereas I would hope to try to keep these things --
the higher up you go, the more you should be based on
something that's stated in terms of strict principles
and general principles and things that would always be
true.
This is especially true in NMSS because
there are so many diverse things going on that you
want to keep this stuff as general as you can.
MR. KOKAIKO: Dennis, excuse me. Dr.
Powers, I appreciate your comment on that. I agree
with you. in NMSS we have real life applications
where this happens and the most obvious is a
construction site. You have one radiation worker but
everyone there is involved in the enterprise of
construction. Yet, they are all assuming a part of
that risk. I appreciate that comment.
MR. POWERS: It's the same. I mean, your
construction sites are the same as new facilities.
You have a few guys doing the actual manipulation but
then you've got all the secretaries and the janitorial
force and construction workers getting their share of
the risk, but you don't know who is getting what so
you just integrate over the whole population.
It actually works very well for those
kinds of finite populations because you can do things
to reduce the societal -- that small societal risk.
It makes sense and you can think about how to do them,
whereas you can never figure out how to protect an
individual from doing something stupid. I mean,
there's a limit to where you can go on something
really stupid.
The other thing to bear in mind on the
subsidiary goals is you call them practical. One of
the problems you have with very high-level goals is
you can calculate them. You can calculate them but
you can't calculate them without controversy.
Sometimes those controversies become
irresolvable or the cost to resolve them is so high
you just don't want to go there. I mean, that is
certainly what happened with CDF, core damage
frequency.
We have evolved. The technology that we
generally all agree is you can get a core damage
frequency. Nobody can agree how to calculate the
actual risk. We use a working goal that everybody
thinks is about right.
They come to why they think it's about
right by circuitous invariable routes but they all
agree the number is about right and avoid calculating
the actual risk because nobody can ever agree on
whether they've got that calculation right.
Technologies are not routinely available to calculate
that. That's another way to look at your subsidiary.
DR. DAMON: So here is something Bob Bari
laid out showing over here is reactors and this is
materials and waste and we are trying to use the same
tiered structure is what he's trying to say. Down
here at this level we're trying to think of what types
of safety goals would apply.
Another interesting thing about safety
goals and NMSS is, you see, it might be one of the
reasons for safety goals. There are two reasons why
I think safety goals are a valid concept. It's not
that there's just a level of risk that's
insignificant.
Yeah, you can say that. That's like relative to
other things. There are two other reasons besides
that. One of them is the cost benefit thing. That is
eventually you go down so low that you are probably
tripping ALARA cost benefit criterion anyway. But the
other one is what they call secondary effects.
What I mean by secondary effects was
something alluded to my Lawrence, and that is in the
NMSS side when you impose a requirement on somebody to
do something to manage the radiation risk, you're
actually perturbing the process that they do in their
everyday work.
If they work at a construction site where
the construction risk is like -- the risk of getting
killed in a construction accident is about 2.5 times
10 to the minus 4 or something like that. It's a
substantial risk.
If you perturb that and you double that
while you are minimizing some radiation risk, what
have you accomplished? The point is is NMSS
applications run into this real world where if you try
to make things too safe, you are actually making
people unsafe.
MR. GARRICK: What do you mean on this
chart under tier 3 under materials and waste by
chronic? I know what chronic means but I want to know
what you mean here.
DR. DAMON: That is operational health
physics. That's 10 CFR 20.
MR. GARRICK: Why would you put that in
this category? I mean, reactors have operational
health physics, too. That's something you can
calculate in advance and determine in advance. If
it's too high, you won't build the facility. It's not
a disturbance. It's not an upset.
DR. DAMON: Right. Well, is the question
the same as before? In Part 20 there's an ALARA
requirement. The question is is there a flaw on
ALARA. That's what he means by that.
Here's what Bob Bari came up with. That
we got individual and societal goals and the only
difference here -- there are a couple differences but
I'll point out one. The worker was put in here in
this individual one. That's different than reactor.
The reactor one doesn't have that.
That breaks down to five QHOs in this list
and then there's another one on the next page. What
I'm pointing out here is there's an individual public
acute, individual public latent, and individual worker
acute, and individual worker latent.
You don't have to necessarily do things
this way. The United Kingdom combines these two
together. The United Kingdom has safety assessment
principles in which they put out quantitative limits
and quantitative goals for different types of risk.
They add these together. That's like saying there's
no difference between whether you are acute or latent
fatality. They add them together and they --
Now this one here, like I say, this is
just an early first draft proposal. Up here in the
public risk area, the QHOs for that we use the same
thing that was used in the reactor, one-tenth of one
percent of the corresponding risk from other things.
For acute it's other accidental
fatalities. This is the 3.5 times 10 to minus 4 which
is one-tenth of one percent of that. Then this QHO
here is one-tenth of one percent of the sum of cancer
fatality risks which are 2 time 10 to the minus 3 per
year.
Down here for workers there are different
ways you can do this one. The U.K. uses basically 10
to the minus 6, I believe, as their one. It's not
tied to a relative scale. What we're saying is here
is one way of tying it to a relative scale.
This one-tenth of occupational fatality
risk. Or you could do it the same way and say why
should this be different than the nonworker. Let's
use the same one up here, a tenth of a percent of
prompt fatality risk from all other accidents.
The difference here is occupational
fatality risk is very low. Dying on the job is not
the way people get killed accidentally. You get
killed in your car, you know, or you fall down and
break your neck. Occupational fatality risk is only
5 times 10 to the minus 5 per year. One percent of
that is five times 10 to the minus 6.
MR. LEVENSON: Is it intended that that
apply to accidents that are nuclear type? Because, as
worded, again are you saying that they should be only
one percent of industrial average?
If they're working in that plant and there
were no radioactive material in it, you are requiring
that plant to be 100 times as safe as any other plant.
I think it's intended to mean that the radiological
aspects should not add more than one percent rather
than that being the total risk.
DR. DAMON: Yes, that's what intended. In
other words, yes, this is the increment added by the
part the NRC regulates.
MR. LEVENSON: Right. Not because of the
operation of the facility.
DR. DAMON: Right. We're not saying that
you need to do this. This is not a requirement. It's
just saying if it was one percent of occupational
fatality risk, which is already a very low number, why
would anybody object.
You would say we're only adding one
percent to your risk of getting killed. You still
have all this other 100 percent risk. When you work
in a nuclear facility you don't forgo the other risks.
They are just added.
In fact, people get killed in these
facilities from these other risks. Like I say, this
is just an early first draft of the thought process of
imitating what happened for public. We're imitating
that for here and asking people what do you think.
What I really think this last one is a
much more problematic thing, societal risk. What I
managed to convince Bob Bari, I think, is societal
risk goal has two components.
One is that risks from nuclear
applications be low relative to other risks in
society. Well, I can tell you right now that risks
from all nuclear applications all added up together
are infinitesimal compared to the risks of all the
other risks. 90,000 people a year die by accident in
this country. 90,000.
MR. GARRICK: Half of them from
automobiles.
DR. DAMON: Yes, half from automobiles.
That's an enormous number. There's no way nuclear
applications are going to start approaching that. So,
you know, fine.
What's the other one? The other one was
the risk from a nuclear power plant should be
comparable to competing methods of generating like --
you know, viable competing methods of generating
electricity.
Well, we tried to apply that analogy in NMSS and
I don't think it works very well. Some of the
applications don't have viable competing technologies
or they are different in some way.
The other one is it goes of scale at both
ends of the spectrum. At one end of the spectrum is
the smoke alarm. Suppose you've got a smoke alarm and
the nuclear risk from that is trivial. Why should you
make it any lower just because it happens that there's
a non-nuclear smoke alarm. Okay?
I don't see the rationale for that. At
the other end of the spectrum I don't think it works
either. Suppose you have a nuclear application where
the risk is phenomenal. It's extremely risky, but the
competing technology is even worse. "Are you okay?
I met my safety goal. I'm lower risk than all of
competing technologies." I don't think so. I think
societal risks we need something here.
DR. KRESS: I think you're right. The
problem I have with it is now you have to have common
units for the denominator end of the numerator. The
only one I see in common is dollars.
You have to reconstruct your risk in terms
of dollars and you have to reconstruct your benefit in
terms of dollars. It looks like a difficult task to
me but it makes a lot of sense.
DR. DAMON: Yes. In effect, that's the
issue. You see, what bothers me is it is clear to me
that we are regulating to societal risk because it's
the reason for remote siting of facilities and it's
the reason why we don't dissolve our nuclear waste in
the public drinking water supply and dilute it down.
We are using this as a consideration in regulating.
The question is what is a level that is low enough.
I say it's a difficult question.
MR. KOKAIKO: Dennis, may I compound the
problem even further? We may have another health
objective between worker latent and worker acute.
Also in NMSS you have applications that can cause
severe burns radiologically. In fact, a radiographer
just recently received a very high exposure to his
hands. We've gotten some feedback to say that perhaps
we should also be looking at that risk as well and try
to quantify that which is somewhere between your
worker latent and worker whole body dose that would
kill you.
DR. KRESS: It's comparable to just what
you would call injuries.
MR. KOKAIKO: Yes.
MR. GARRICK: Well, you're right that they
can get very complicated if you try to calibrate this
in too fine a detail. Some people don't even like to
go as far as using dose. The cutoff ought to be
fatalities.
There's all kinds of ways to make this
unmanageable and I think you have to be very astute as
to what you end up with as your metrics. To the
extent that it's applicable you also ought to be
guided as much as possible by precedence.
DR. DAMON: I certainly concur with that.
Anytime we can find something like this one that's
been well worked over, we're just going to buy off on
it. It's only when we come to something that it just
doesn't seem to work for what's going on in NMSS that
we need to worry about anything else.
DR. KRESS: That's one reason I like that
bottom one on there is because you can actually
include things like injuries. If they are all put on
a dollar basis you could include it all in that
bottom.
DR. DAMON: This is another one that is
tough. I don't even know if this meets -- I mean, it
was expressed in the first public meeting that
environmental -- how do I put it? Protecting the
environment was not done for human benefit or
something to that effect. Different people have quite
a different view about what environmental objectives
might be.
MR. POWERS: Have you chatted at all with
the Swedes on this? They come out and they just say,
"Okay. Thou shalt not contaminate the land with more
than X amount of cesium." That's their safety goal.
Don't worry about people. Just don't contaminate the
land.
I don't know what rationale by which they
came to that conclusion but it might be interesting to
chat with them just to find out because maybe that
gives you some insight on how to handle this sort of
thing.
DR. DAMON: This one we haven't even begun
to hardly think about. It's just a very --
MR. POWERS: Of course, the other way is
to call up Dr. Kress and ask him for the dollar value
of human life, take his number, and then you can come
up with a dollar equivalent for environmental
contamination.
DR. KRESS: It's worth thinking about.
MR. POWERS: Well, you spend a lot of time
and, in fact, Bob Bari's group did it, on surveying
what regulations ascribe to the value of a human life
in order to set our ALARA limits so he's acutely
familiar with it. That may be the way to handle it.
Just make them equivalent dollar values.
DR. KRESS: That's the only metric I see.
MR. POWERS: Those were all quickly
controlled.
DR. KRESS: -- what value they assign to
human life.
MR. POWERS: That's an argument I've made
for a long time. I think you're right.
DR. KRESS: It's the one we got dribbled
on the floor and booted out.
MR. POWERS: Yeah, kicked right out.
DR. KRESS: Kicked out of the office on
that one.
MR. LEVENSON: I'm afraid that doesn't
solve the problem because even if we all agreed on the
dollar value of the human life, what we're talking
about here are very low doses and no agreement as to
whether any human lives are involved or not.
MR. GARRICK: It might even extend life.
DR. KRESS: The contamination of land --
MR. POWERS: It's going to cost so much.
DR. KRESS: -- will cost so much it will
control everything.
MR. GARRICK: Okay. Let's move along.
DR. DAMON: I think we're done. You
mentioned chronic risk. I mean, we don't -- we
haven't really had a conversation on this one. I
think 2 millirem is used as a chronic risk goal
objective by the United Kingdom. That's where the 2
comes from. I've seen people use 1. I've seen them
use this. Maybe it shouldn't be an absolute number.
Maybe it should be relative to something.
MR. GARRICK: Well, maybe one thought
would be to not necessarily try to start with
everything included but start with something that you
have high confidence in that allows you to add to it
as you figure out what these other things ought to be.
In other words, phase in your safety goals is a
possibility.
DR. DAMON: And the second one here, Bob
Bari has been working on -- he's been working on two
things. He's been tabulating these things. These are
different NMSS applications. These were different
frequency or probability values that might be used to
manage these sort of analogous to CDF. These are CDF
analogs for different things.
The other thing he's doing is he's
quantifying -- he's going to the NUREG/CR-6642 and
other risk assessments that have been done in NMSS and
he's putting down the -- we are trying to estimate
with the risk assessments that exist what are the
risks in these different areas.
We are doing a bunch of stuff but I can't
show it to you all because it's sort of in the middle
of being developed. That's the kind of thing we're
doing. We're looking at safety goals, what should be
considered in principle, what are the options to pick
from, what are the considerations, and then also
trying to quantify what the risks really are so we can
get some feel about where we're at.
MR. KOKAIKO: Dennis, if I might just
point out, this is really just sort of a strawman.
This is subject to radical revision.
MR. GARRICK: Well, it also looks like
it's more than just an analog with core damage. It
looks like it's analog with core damage plus
containment release or containment failure.
MR. KOKAIKO: Yes, sir.
DR. DAMON: Yes, that's true. It is more
analogous to large or early release.
MR. GARRICK: Any more comments? This
helps us a great deal to get an insight on where you
are and what you're doing. Does the Risk Task Group
operate on a meeting basis? Do you get together
periodically or how does it operate? Can you answer
in a very short time how it functions?
DR. DAMON: I mean, the Risk Task Group is
a regularly functioning unit. It's constant.
MR. GARRICK: So it's a group.
DR. DAMON: It's a real organization.
MR. GARRICK: It's not an ad hoc?
DR. DAMON: No, it's not ad hoc thing that
gets together irregular or vague intervals. No, we
work daily together.
MR. KOKAIKO: It's our day job.
MR. GARRICK: Very good. Thank you very
much.
If there's no further questions, we will
adjourn for lunch and be back at 1:00.
(Whereupon, at 12:10 p.m. the meeting was
adjourned for lunch until 1:00 p.m.)
A-F-T-E-R-N-O-O-N S-E-S-S-I-O-N
1:02 p.m.
MR. GARRICK: The meeting come to order.
Our next topic is going to be the Risk Assessment for
Dry Cask Storage, and we will have Messrs Guttman and
Rubin to start off, and I understand there's going to
be a team. Why don't you introduce yourselves and
tell us where you work, etcetera.
MR. GUTTMAN: I'm Jack Guttman. I'm the
Chief of the Technical Review Section B in the
Springfield Project Office in NMSS.
MR. RUBIN: I'm Alan Rubin. I'm a Section
Chief in the PRA Branch in the Office of Research
which is conducting this dry cask PRA in response to
a user need from NMSS.
MR. GARRICK: Okay. Proceed.
MR. GUTTMAN: I'm very pleased to
introduce some excellent in-house activities to
develop a spent fuel dry storage PRA. I hope this
meeting will convey the outstanding technical
contributions and analytic capabilities that various
entities within the Office of Research and the Spent
Fuel Projects Office have developed and continue to
enhance.
In the future, we plan to solicit your
comments, expertise and support of the findings from
this important program. This is an important
initiative for several reasons which I will highlight
in my introduction.
MR. POWERS: In our research report,
didn't we characterize this research as some of the
most important that was being done?
DR. KRESS: We did.
MR. POWERS: Preaching to the choir, at
least two members of the choir.
MR. GUTTMAN: As a brief background, the
Spent Fuel Project Office issued a user's need letter
to research to develop a dry storage PRA. In support
of this effort, the Office of Research and the Spent
Fuel Projects Office and NMSS established a task force
comprising of a group of experts in various fields.
The ground rule was to develop a generic PRA using a
certified cask for which the staff has readily
available information, thereby optimizing our limited
resources. The PRA would then be used by the Spent
Fuel Projects Office as appropriate. The PRA is being
developed in-house with limited contractor assistance
such as human factors considerations.
The Spent Fuel Projects Office planned use
of the PRA includes to risk inform 10 CFR Part 72, to
support NMSS risk task group activities such as safety
goal evaluations and development, to risk inform our
inspection programs, to maintain safety, to enhance
public confidence and to reduce unnecessary burden.
Enhancing public confidence has taken a significant
role as the staff is being requested to meet with
local concerned citizens on the safety of dry cask
storage. This program will assist our interactions
with the public. Performing the analysis in-house
enhances our technical and regulatory credibility.
MR. POWERS: That really is true. If
you're going to have to explain this to the public,
you've got to have the expertise to answer the
questions in real time. You can't say well, I'll get
back to you on that. You really do need to do this
when you're in-house, don't you?
MR. GARRICK: One of the things I think
the committee would be very interested in as we go
along here would be what that influence has meant in
terms of the way in which you're doing the PRA. Has
it led to any fundamental change in how you do it?
I'm talking about the business of involving the public
and trying to enhance public confidence. What are you
doing specifically to do that besides interact with
the public?
MR. GUTTMAN: Typically, the Spent Fuel
Projects Office is requested and is becoming more
frequent by state representatives and the utilities
and local communities to come to local public meetings
and explain the regulations and the reasons why a
utility should be permitted to remove their spent fuel
from the pools and store it in dry casks. This is
becoming a more important activity as more reactors
are decommissioning and unloading their fuels from the
pools.
MR. GARRICK: Or the pools are just simply
filling up.
MR. GUTTMAN: The pools are just simply
filling up. That's correct.
MR. GARRICK: Yes. Okay.
MR. GUTTMAN: As I highlighted, the PRA is
performed in-house. A task force of Research and
Spent Fuel Projects Office technical experts was
established for that purpose. The task force consists
of the following technical expertise. Project
management, PRA, structural dynamics, material
sciences, seismic, criticality, thermal, consequence
analysis, statistics and human factors.
DR. KRESS: Is each one of those a
different person or is one person all of those?
MR. GUTTMAN: Each one is a different
person.
MR. POWERS: There are no Tom Kresses.
MR. GUTTMAN: Actually, there are several
people for each category.
MR. GARRICK: Is the PRA category or
structure dynamics category or where are you with
count for external phenomena?
MR. GUTTMAN: The PRA practitioners would
basically come up with the eventries and faultries.
Let's say for example, if they're moving a cask and
there's a potential for drop, then the structural
people will perform dynamic analysis. We're using,
for example, ANSYS/LS-DYNA. Identify the stresses and
loads on the casks. Then the structural people look
at the results and determine if there's a potential
for a failure and try to quantify that.
MR. LEVENSON: For something like a cask,
are there ever conditions where the seismic loads
exceed the drop loads?
MR. GUTTMAN: No. Drop loads are in the
order of 45 to 60 Gs.
MR. LEVENSON: I know. That's why I
wonder why we have a seismic category and do a bunch
of analyses when it's clearly subsumed within --
MR. GARRICK: Because the public would
ask, why didn't you consider seismic?
MR. LEVENSON: You say it's not nearly as
severe as dropping it.
MR. GUTTMAN: With that introduction, I
would like to turn to Alan Rubin for the technical
overview.
MR. RUBIN: Thank you, Jack. I just
wanted to just go back and remind you that back in May
of last year, 2001, I presented a proposed plan and
approach to this joint subcommittee on what we were
going to do on the dry cask PRA project. At that
time, work had not begun. We were getting the team
together. So what you're going to hear today is a
work in progress. We're probably at the mid-point,
maybe somewhat past the mid-point of this project. So
you'll hear some conclusions in some different areas
of the work and you'll hear some status and approach
in other areas. And then in the future when we're
finished with our integrated results and analyses, we
will present that information to the subcommittee at
the time.
MR. GARRICK: When do you expect to
finish? You're going to tell us that, I guess.
MR. RUBIN: I'll tell you that. You're
jumping to my last slide at the end of the day, but
basically --
MR. GARRICK: It's a bad habit of mine.
MR. RUBIN: Our schedule now is to have a
draft report to NMSS in the late spring or early
summer of this year.
This is an overview of what you're going
to hear today following my introduction. These are
the different steps and the people who are involved in
those tasks are going to be giving these detailed
presentations.
First is an overall modeling approach of
the code that we're using, the Saphire code, which
we're using to do the PRA to model the dry cask.
You'll hear about then the external events that are
considered in the dry cask analysis and how we've
calculated the initiating event frequencies for those
events.
You'll hear in particular one of the
events which is a fire scenario and how the thermal
loads were developed based on modeling of fire, the
dry cask fire resulting from an aircraft crash.
You'll hear about those analyses, both of thermal load
from the fire, are calculated in determining what the
temperature conditions are on the cask. You'll hear
results and discussion on the mechanical loads. What
loads are imposed on the cask for mechanical events,
be they drops, impacts from tornado-generated
missiles, or drops or tip-overs.
DR. KRESS: Does this include what happens
internally to the fuel itself?
MR. RUBIN: There is some fuel failure
modeling that is going on. It's not completed yet.
But the fuel itself is contained in a canister, a
multi-purpose canister, and that is encased into an
overpack, a large concrete structure, in the storage
pad. You'll hear more about that with the structural
analysis. The real focus is for things to cause
problems, the multi-purpose canister has to fail, and
that's what the focus is of both the thermal and
mechanical failures.
And then once we have those loads, both
the thermal loads, the temperatures and time
conditions, as well as the stresses from the different
mechanical impacts, we'll have a presentation on how
those go into the calculation of the probability and
likelihood of cask failure. Each of them tie into
different sequences.
Then there is some consequence analysis in
terms of how we're going to look at the source terms
and evaluate the overall risk to the public,
integrating the consequences and the frequencies in
our PRA. At the conclusion of these detailed
presentations, we'll tell you what the next steps are,
where we are in the analysis, and I've already given
you one bottom line of our schedule for the draft
report.
These are the objectives taken from the
user need from NMSS. First, the dry cask PRA has not
been done before, so there is really a first of a kind
project. The intent was we wanted to develop a
methodology for performing such a PRA on dry casks.
You hear a lot about that today.
DR. KRESS: Since you got decay going on,
do you pick out a specific decay time for these or do
you do a time variable PRA?
MR. RUBIN: We're doing a nominal analysis
where the fuel, first of all, is aged five years
before it's put into the cask.
DR. KRESS: So you picked out five years.
MR. RUBIN: You pick out a time and then
look at the decay heat following that. But we're also
looking at scenarios if there's misloading of fuel
from human error. We'll get into some of that. What
impact that could have.
DR. KRESS: What I was wondering is there
may be motivation to start getting that stuff out of
the spent fuel pool faster and would your PRA be
amenable to backing up, say, one year?
MR. RUBIN: Yes, it would. We would put
in different decay heats and the consequence analysis
we put in different source terms. Yes.
MR. GARRICK: But you might end up with
mixed stages for the fuel. Different fuel of
different ages, as long as it met the five year
requirement, but it could be 10 year, eight year, six
year.
MR. RUBIN: It's realistic to take five
years but certainly the fuel could be 10 years old and
then you're going to have lower decay heat so the
impacts are going to be less.
MR. GARRICK: But I mean you could have
fuel elements that are of different age.
MR. RUBIN: Absolutely. Yes, and you
would.
MR. GARRICK: In the same cask.
DR. KRESS: Which brings me to another
question I had. Say you've got 10 of these casks. Is
the source term coming from all 10 or what would come
from any one of them?
MR. RUBIN: We're doing an analysis of one
cask and assuming that that cask has got five year old
fuel, and you'll hear some more about that. And then
typically the kinds of events, initiating events. If
they are not common mode cause failure, they're going
to impact one cask.
DR. KRESS: One cask at a time.
MR. RUBIN: A seismic event could impact
a number of casks on a pad. So that's where you look
into different levels of consequences, depending on
whether you have a common cause failure or not for
multiple casks. So as Jack Guttman said, we're doing
a pilot PRA and the specific cask that we're looking
at is called a Holtec HI-STORM cask and the reason
that was picked is because of its availability of
information as well as the likelihood that that cask
will be used at a number of different reactor sites in
the country. We're looking at a BWR site for our
analysis.
Our final objective is to look at the
potential risk to the public from dry cask storage and
to identify what those dominant sequences are. This
will hopefully provide a lot of information, useful
information for risk informing NMSS activities.
Again, we can apply the same methodology to different
sites.
Jack mentioned the broad scope of the
participants involved in this project. I won't read
off all their names but they're listed here, and
you're going to hear from a lot of them this
afternoon. These team members include members from
the PRA Branch, section chief and the overall
management of the project is our responsibility in the
PRA Branch as well as the PRA modeling. The analysis
of initiating events and the fire analysis.
This project involves all three divisions
in the Office of Research, so it's a cooperative joint
program, joint effort. In the Division of Engineering
Technology, the Engineering Research Applications
Branch is responsible for the analysis of mechanical
loads and the same division, Engineering Technology,
the Materials Engineering Branch is involved with the
failure analysis for both thermal and impact loads and
mechanical loads on the casks. This is a mouth full.
The Safety Margins and Systems Analysis Branch of the
Division of Systems Analysis and Regulatory
Effectiveness are doing the calculations of the
thermal loads on the cask, the consequence analysis
and criticality.
As my final slide, I just want to give
some perspective on the overall scope of the study so
you'll see what's included and what's not included.
There are three phases of the cask that are being
looked at. The first one is the handling phase which
takes place in the reactor building where fuel is
loaded from the spent fuel pool into what's called the
multi-purpose canister, and you'll see a picture of
that diagram in the next presentation.
That canister is then dried, inerted and
sealed before it's inserted into an overpack, which is
the large concrete structure that holds the spent fuel
in the storage pad. This cask is then transferred on
site from the reactor building to the storage pad.
It's called the transfer phase, and we're looking at
accidents that can occur during that phase. And
finally, looking at events that can occur during 20
year storage. Twenty years is the nominal license for
these dry casks.
What is not included in the scope is
probably equally as important as what is included.
First of all, the fabrication of the cask. We're
assuming the cask is built as it's designed, so
fabrication errors are not covered. Off-site
transportation is a different PRA than the
transportation studies and modal studies being handled
looking at risk from transportation, and acts of
sabotage are also not included in this PRA.
MR. POWERS: How about aging?
MR. RUBIN: Aging of a cask over 20 years?
I don't think there's any particular effects looking
at aging. We're looking at errors at drying and
inerting the cask which could cause some different
problems on the materials. That is part of it. But
if the cask is sealed and dried and inerted as the
procedures say it should be, then I don't think
there's any aging problems that we're looking at.
DR. KRESS: In developing a frequency for
handling, you assume every five years you load up the
cask?
MR. RUBIN: Cask could be loaded more
frequently than that.
DR. KRESS: More frequently than that.
MR. RUBIN: Depends on the site, depends
how much fuel is being moved into the storage pad. It
could be a number of pads over the license period for
the reactor.
DR. KRESS: But you have a number for
that.
MR. RUBIN: Well, we will have a number
for that. You're not going to hear that today. The
handling phase is being covered in analysis of the
liabilities analysis being done by a contractor. We
don't have the final results yet to present today. We
will in the final report. But that's looking at
errors that could cause a cask to both drop because of
human error as well as potential mechanical failures
of the crane.
DR. KRESS: You don't include the effects
of the drop if it drops into the pool itself?
MR. RUBIN: No, that's different. That's
a heavy loads analysis.
DR. KRESS: That goes with the operating
reactor.
MR. RUBIN: Correct. We're looking at the
effects of the drop on the cask but not the effects of
the cask dropping on other equipment in the reactor
building or over the taurus, for example, the BWR.
So if there are any further questions, I
will be happy to answer them. I will continue on with
the presentation. Will the next two members come in.
The next presentation is going to be done by Chris
Ryder. Why don't the next two people come up. Brad.
MR. RYDER: Good afternoon. My name is
Chris Ryder, and I'm going to be talking to you today
about the methods that we're using to determine the
risk of dry cask storage.
I'll give you a little bit more details
about the system that we're studying. The cask
consists of three components, a multi-purpose canister
that contains the fuel, the transfer cask which
provides shielding inside the reactor building, and
the overpack which provides protection and shielding
during storage.
DR. KRESS: When you say multi-purpose,
that means it's good for dry cask storing and
transportation and sticking in Yucca Mountain?
MR. RYDER: Yes. The canister can be
pulled out of the overpack which in this case is just
good for on site storage and put into another
container and then shipped off site. That's why it's
called multi-purpose.
Here are some dimensions that you can look
at at your own leisure.
MR. LEVENSON: What's that word mean?
Leisure?
MR. RYDER: This is the system. Here's
the multi-purpose canister. This is where the fuel is
placed. This is placed into the transfer cask which
is used for handling. Both are put in the spent fuel
pool where the fuel assemblies are loaded. The top is
put on the shielding. It's brought out to another
area for preparation and there it's dried and sealed,
inerted and sealed up and then this transfer cask is
placed on top of the overpack. With the stays, the
MPC is lifted off of the bottom lid and the MPC is
inserted into the overpack. The overpack has four
vents on the bottom, four on the top. Air enters the
bottom vents, pulls the MPC and exits the top vent.
MR. POWERS: What's the electrical
chemical potential between the lead and the steel?
MR. RYDER: Say it again, please.
MR. POWERS: The electrical chemical
potential between the lead and the steel?
MR. RYDER: I don't know.
MR. POWERS: Doesn't corrode though?
MR. RYDER: I couldn't answer that at this
time. In the transfer cask, it's steel/lead/steel
water jacket, and that's used just temporarily for the
handling operation. There's no long term storage for
that.
MR. POWERS: Concrete. Just concrete?
MR. RYDER: Say it again, please.
MR. POWERS: Concrete. Just concrete?
MR. RYDER: Just ordinary concrete. It
has no structural support at all. The structural
members on the overpack is the steel.
MR. POWERS: Steel.
MR. RYDER: And the concrete is just for
shielding.
MR. POWERS: And there's nothing specified
about the aggregate, other than size?
MR. RYDER: It's just ordinary concrete.
I don't know the specifications of it.
MR. POWERS: What about the PSI concrete?
Just ordinary sizing on the stones and things like
that?
MR. RYDER: But the structural members
themselves is the steel.
MR. LEVENSON: What's the little wedge
shown blown up on the drawing?
MR. RYDER: This?
MR. LEVENSON: Yes.
MR. RYDER: That's just a section showing
that this is the steel. This is the concrete.
MR. LEVENSON: It's not a wedge going into
a hole?
MR. RYDER: Any other questions about
this?
DR. KRESS: I see this thing is cooled by
natural circulation.
MR. RYDER: Yes, it is.
DR. KRESS: Is loss of cooling accident
one of the PRA --
MR. RYDER: That's one of the initiators
which I'll get to.
You heard about the three phases of the
operation handling transfer and storage. Here are
some of the steps. Loading of fuel, lifting it from
the spent fuel, the issue you heard before. We find
it convenient to talk about these because this is how
we actually structure our PRA around those three
phases.
DR. KRESS: Going back to this natural
convection cooling. Is there just one inlet vent or
is there a ring of them?
MR. RYDER: There's four of them. Four in
the bottom, four in the top.
DR. KRESS: And then they're baffled so
that they --
MR. RYDER: And then there are channels on
the inside which help to support or align to keep the
multi-purpose canister from tipping and the air passes
between the channels and along the MPC. Also, if the
cask were to tip over, the channels collapse and so
they provide some cushioning.
DR. KRESS: Okay. And is there just one
outlet vent or is there?
MR. RYDER: There's four inlet vents on
the bottom, four outlets on the top. There's a screen
over them to keep out debris and inside the vents are
baffles to keep radiation from streaming out.
DR. KRESS: Okay. Thank you.
MR. RYDER: There are two possible
approaches that we could have done in conducting our
PRA. We could have looked at all initiating events,
no matter how low their frequencies or we could do a
screening analysis, and to use our resources
effectively, we chose to do the screening analysis.
What we did was we began by compiling a
list of initiating events and we began with the
external events in the PRA procedures guide. Then we
looked at plant procedures. We observed some of the
operations, talked to NMSS staff and looked at the
design and we added our own initiating events.
With that complete list, we can then apply
that to other plants if we need to. But in applying
this to a particular site, we started looking at
eliminating events by various criteria. To begin, we
looked at which events were not applicable to the
site. For example, if it's not in a seismic reaction
region or a volcanic region or subject to Tsunamis, we
can eliminate those events to begin with.
Then we also did engineering analysis to
look at what events would have no effect on the cask,
and we eliminated those. And then we are in the
process of looking at events which have low risk. By
that, we mean low frequency or low probability of
occurrence.
MR. GARRICK: What was your frequency cut-
off? Did you have a cut-off?
MR. RYDER: Nominally, we're taking 10-8,
but this is a screening study and we're going to look
at our results and, if need be, revisit that.
In the handling phase, we have mechanical
events. You can drop the cask when it's open. You
can drop it when it's sealed. In the transfer phase
we have mechanical events and thermal events. The
cask can be dropped. It can be tipped over. The
thermal events can occur if, for example, the transfer
vehicle, if the fuel were to catch fire in that and
eat the cask.
MR. POWERS: Would that happen if
lightning strikes?
MR. RYDER: That's coming up.
MR. POWERS: During transfer, I mean.
MR. RYDER: Say it again, please.
MR. POWERS: During handling part of it.
MR. RYDER: Say it again.
MR. POWERS: Do you have lightning strikes
during the handling part of it?
MR. RYDER: During handling, that's inside
the reactor building.
MR. POWERS: That wouldn't count the
outside --
MR. RYDER: Transfer is outside. We don't
consider that there. The procedures call for the
transfer being done only when there's good weather
conditions. So if there's like rain in the forecast
for the afternoon, either they'll put the operations
off until the next day or they'll try to move them up,
so they'll start earlier in the day to be sure that
they're finished before hand. So if there's inclement
weather, the cask is not moved.
MR. POWERS: It must be something they're
worried about. What is the concern?
MR. RYDER: I think they just don't want
to --
MR. POWERS: Zap a worker or something
like that.
MR. RYDER: Say it again, please.
MR. POWERS: Zap a worker.
MR. RYDER: Yes, basically. They also
just want to have the workers working under ideal
conditions.
In the storage phase, you can have
mechanical events due to tip-overs, strikes by heavy
objects, explosions from gas main, a passing truck or
a barge.
DR. KRESS: Excuse me, Chris. Are these
initiating events you've identified or are these the
ones that have survived the screen?
MR. RYDER: No. These are ones that we've
identified. We are eliminating many of them. I'm
just here giving you some examples of the ones that
occur. We have a list of about 50 in detail.
Thermal events. You could have vent
blockage. Like I say, from flood waters or from
debris. Mechanical thermal events would be the
effects of an accidental strike by an aircraft and
then there's lightning.
MR. GARRICK: The lightning is just a
people problem, isn't it?c
MR. RYDER: We believe so at this time.
There is some speculation that there might be some
effects on the concrete and the overpack, and we're
also continuing to look into what could happen to the
MPC, but we believe right now that the current will
just pass through it.
MR. GARRICK: You don't know how good a
Faraday cage it is.
MR. RYDER: That's the primary concern is
for worker exposure for the workers, but no, I don't
know that at this time.
MR. LEVENSON: Is the vent blockage
including concern for rodents and insects and birds
which are probably much more likely than floods?
MR. RYDER: Yes. Actually, one of the
initiating events which we are going to be looking at
is long-term accumulation of insects or debris
accumulating inside the vents.
MR. POWERS: Squirrel nests.
MR. RYDER: I mean it's a warm environment
and so it would tend to attract creatures.
Method of analysis is, of course, the
event trees. We're using fault trees to look at the
human errors and some equipment failures. Then we
have other analyses going on. I have a stylized event
tree in the package here. The event trees are much
simpler than you would see in reactors. I'm not going
to go through this. You can look at it on your own.
But they're nowhere near the detail that you see the
power plant PRAs.
Inputs to the event tree are the
initiating event frequencies. Some of those you'll
hear about later on. We have the probability of MPC
failure. To do that, we have analyses that determine
mechanical and thermal loads on the cask and then
those results go into a fracture mechanics analysis to
give us the probability. We also are looking into the
ability of the reactor building to isolate, the
ventilation system to isolate, and then we have our
consequence analyses, too, and you'll be hearing more
about those.
DR. KRESS: Does the fracture mechanics
part of this start out with some postulating cracks
and crag distributions in the cask?
MR. RYDER: Yes, and you'll be hearing
about that. There are flaws and welds that normally
occur and which are acceptable.
MR. GARRICK: Chris, before you do the
risk assessment. Did you do any threshold analysis?
That is to say, did you try to get a handle on what
kind of forces and impacts and temperature conditions
you'd have to get to even get a problem?
MR. RYDER: We did some of that. We
looked at the submittal, of course, and then we had
Jason doing some calculations as well. But it was
limited in that respect. We basically postulated
various events that could occur and then we asked
other analysts if they could tell us if these could
indeed happen.
MR. GARRICK: Well, there's two ways to do
this. You establish a scenario and see what the end
state of that scenario is in terms of the effect. But
the other way, in order to kind of get a sense of the
magnitude and also very helpful in the screening is to
analyze it in terms of what the threshold values are
for getting any kind of a release condition.
MR. RUBIN: We're doing that along the way
as we go. You'll hear some of the results on the
interim analyses looking at, for example, what
temperatures can cause the MPC to fail.
MR. GARRICK: Right.
MR. RUBIN: And if no temperature scenario
or sequence will reach that temperature, then it's not
going to go into the PRA model.
MR. GARRICK: It's a very useful exercise
to keep the problem under reasonable management.
MR. RUBIN: That's exactly what we're
doing, and it's an iterative process.
MR. RYDER: And I would ask some of the
people if the cask experience, this initiating event,
what would happen to it, and they would give me some
kinds of judgments in which case we would pursue it in
more detail.
With that, that ends my portion.
DR. KRESS: Is somebody going to talk
about the consequences later?
MR. RYDER: Yes. That concludes my
discussion.
MR. POWERS: I may be leaping ahead in the
presentation and, if so, I'm willing to wait for the
answer, but do we have information that would tell us
what kind of fracturing and fragmentation of fuel rods
would happen given a mechanical insult at various
levels?
MR. RYDER: I'm going to leave that to
that discussion.
MR. GARRICK: That's kind of what I was
trying to get at, Dana, too. Threshold for a source
term.
MR. POWERS: I know that the
transportation folks have wrestled with that problem
and it strikes me that if we do have information, it
may not be applicable to the higher burn up flags that
we would encounter in the future.
MR. GARRICK: Yes. Out in your laboratory
20 years ago or so, they did train impact and truck
impact tests on fuel casks.
MR. POWERS: They didn't stick a bunch of
fuel rods inside it.
MR. GARRICK: They were very impressive in
terms of establishing some sort of --
MR. POWERS: A lot of people over-
interpret those just a tad.
MR. GARRICK: They were expensive tests,
too.
MR. POWERS: They were expensive tests and
they were done for particular purposes, not
necessarily what people want to use them for today.
MR. RYDER: Are there any other questions?
MR. GARRICK: Questions? Okay. Thanks,
Chris.
MR. POWERS: I guess one of the questions
that comes up. You've been following the PRA
procedures guide probably because that was what was
available when you started this work. Can you derive
anything useful that's appeared since the procedures
guide came in?
MR. RYDER: I'm not prepared to answer
that right now. I could get back to you on that.
MR. POWERS: I mean I happen to be a big
fan of the procedures guide.
MR. RYDER: We used the procedures guide
to get a list of initiating events and then, through
our own study, we added other events to it and
discussions with the NMSS staff.
MR. POWERS: So it's not likely to be
anything.
MR. RUBIN: We also looked at all the
initiating external events, for example, analyzing the
IPEEEs. We included them in this study as well in our
list. It's fairly comprehensive.
MR. POWERS: I mean since we've been going
to this effort to produce standards for PRAs, I just
wondered if there was anything out there.
MR. RUBIN: We went through a lot of
effort and discussions with the user office, the spent
fuel project office and ourselves, to make sure we had
an all inclusive list. It seemed to the point of
almost getting a little bit ridiculous in some points.
We went overboard in being inclusive rather than
excluding events.
MR. POWERS: Did you add volcanism?
That's the question.
MR. RUBIN: We did, but some sites don't
have a volcano.
MR. POWERS: But they might.
MR. RUBIN: But if it did, it would be a
block vent scenario with debris build-up, and we have
that analyzed. So I'd say we could cover that if we
knew the initiating event frequencies of the volcano.
MR. POWERS: Talk to the guys at Yucca
Mountain. They seem to find volcanos where other
people can't find them.
MR. RYDER: Brad Hardin will now continue
the discussion.
MR. HARDIN: Good afternoon. I'm going to
talk to you about our analysis of the external events
of the initiating frequencies. This is a list of the
events that we looked at.
MR. GARRICK: Are these essentially based
on the reactor's PRA?
MR. HARDIN: No. I wouldn't say just
that. I think we considered this particular
application and we actually looked at some things that
maybe for reactors we don't look at too much any more.
I guess for the IPEEE we had gone through a number of
these types of things just fairly recently here and in
the case of the dry cask storage, I think maybe Chris
and Alan both said we tried to be very inclusive at
first and then we tended to look at things that were
very unlikely. We screened those out. But we started
with a pretty long list of things. Accidental
aircraft crashes and then tornados. We were
interested in determining what the likelihood would be
of the cask sliding during a tornado from the high
winds and perhaps striking other casks and then
tipping over onto concrete pads. What kind of damage
might we get from that? What's the likelihood of it?
I'm not going to talk to you about any of
the damage areas because other people coming up after
me will talk to you about the analysis of the
potential for failing the multiple container and then
flooding and lightning.
DR. KRESS: All these things are site
specific?
MR. HARDIN: Yes.
DR. KRESS: One would do a site specific
PRA.
MR. HARDIN: That's right. For this
particular site.
MR. GARRICK: Yes. That's why I was
asking the question because the reactor is site
specific, too.
MR. HARDIN: I'll talk to you a little bit
about the data. This one has a lot of interest.
Looking at it from the viewpoint of accidental
aircraft crashes in this case. We put in an equation
up here, partly to show you an example of the type of
analysis that was done on most of these external
events. The form of the equation is fairly similar
where the analysis result that we would like to get
is, in this case, the number of crashes per year into
the site where we might get damage.
The summation takes place over the four
local airports that are in the area of this particular
site. We did an analysis of the likelihood of a crash
during take-off and landings in some detail because we
had good data for that. We attempted to also analyze
fly-overs, but it's been very difficult to get data
for the number of flights flying over the area. It's
somewhat complicated and even today we learned of a
new reference where we might be able to get some
information on that. But at any rate, right now I'm
just going to talk to you about the take off and
landing analysis.
There are four airfields that are in the
vicinity of this particular site.
MR. POWERS: Is Ca a generic term?
MR. HARDIN: It's a generic term that's
been derived from analyzing crashes all over the
United States, and it depends on the distance from the
site to the particular airfield. In this case, each of
the airfields was fairly distant from the site. They
ranged in distance from 16 miles to 29 miles, and the
data that we had, when you try to look at something as
far as 16 miles, it's a very, very small number. It
would be a better analysis if we had airfields that
were closer to the site. It turns out that the C is
the same for each of the airfields because they're all
fairly distant ranging in distance from 16 to 29
miles. These airfields were identified --
DR. KRESS: Is that a circular area?
MR. HARDIN: That's the way it's analyzed,
as if a plane --
DR. KRESS: With the center at the
airfield and the end of the radius at the plant?
MR. HARDIN: Yes.
DR. KRESS: What you said earlier is you
really don't have good information on direction of the
flight so that you could narrow that.
MR. HARDIN: For this particular analysis,
when we did the first run at it, we tried to do a
little bit fine tuning to take into account direction
and we did get a little bit of information that
indicated that the one airfield that we were most
interested in because it had larger planes landing and
taking off, that the flights tended to come in all
directions except from the east. The eastern quadrant
didn't have that many flights coming into it. So
we've done a little bit of analysis along that line,
but it didn't change the number very much. It just
ended up making it a little bit smaller by reducing
that quadrant.
The term that summed the multiplication of
Ca X Na which is the number of operations in and out
of the airfields might be considered to be like a
crash density and then if you multiply it times some
equivalent area, then you get the total number of
crashes that you might expect.
MR. POWERS: Is it the target area that
you want to do there or the area that an aircraft
crash occupied?
MR. HARDIN: I'm sorry, Dana?
MR. POWERS: I mean I slam an airplane
into the ground. It creates a damage circle so big
which I think is bigger than the cask.
MR. HARDIN: That's right.
MR. POWERS: So it's that area that you
want to use, not the cask area, isn't it?
MR. HARDIN: That's right. There's a
skidding area that's typically added, depending on the
terrain, and we used I think a distance of about 100
feet for that and then the projected area of the pad
with the casks on it was used and then we added 100
feet to that to come up with an area. The final
result in this case was something on the order of 10-9
crashes per year. It was a pretty small number.
While we're talking about aircraft
crashes, we needed to pick a particular type of
airplane to analyze in terms of the results of the
potential for damage to the cask and we were given
pretty good information from the Federal Aviation
Administration in the area of the site. They were
able to tell us how many operations were at each
fields, which fields were used more commonly, and what
type of aircraft used them.
It turns out that the aircraft are limited
by whether the runway is long enough. Of course, some
of the larger planes just can't land at certain
airfields because the runway is not long enough. Out
of the four airfields, there was only one airfield
that had a large enough runway that all of the planes
that used those areas could land at that one
particular place. So we sort of focused our analysis
on that.
MR. POWERS: You're going to be worried
about 20 years from some time.
MR. HARDIN: Yes.
MR. POWERS: There's a substantial
evolution that occurs in aircraft over a 20 year
period. That usually is not in the direction of
smaller. Did you try to correct for that?
MR. HARDIN: We asked the people at FAA
that were familiar with these airfields if they
thought that would change very much in I don't
remember how many years, but it's possible that this
would have to be returned to and re-analyzed at some
point if there are some major changes there. But
right now they thought the data they gave us was
pretty good, at least out to I think maybe 10 years or
so. The Lear Jet 45 was one of the planes that was a
larger one that had a fairly large amount of fuel of
all the ones that landed at these four airfields. It
was not the largest plane, but we chose it to analyze
because the two planes that were larger than it were
restricted in which fields they could land at because
of this runway distance and so we thought that the
Lear Jet 45 would be a good one to start with to see
what we would get from that. So you're going to hear
some results of that analysis.
DR. KRESS: And even though it's 10-9, you
decided to go ahead with the rest of the analysis even
though it likely would have been screened out based on
the screening criteria because you needed the
methodology or the consequences anyway. Probably some
sites that may not screen it out.
MR. HARDIN: Yes, and because we had a
team of people working on this and we started all of
these analyses some time ago --
DR. KRESS: In parallel.
MR. HARDIN: -- we weren't sure sometimes
what kind of probabilities we were going to get at the
time and so some of the consequence areas were looked
at also.
For tornados, looking first at likelihood
of sliding and tipover. Khalid Shaukat, who's going
to talk to you a little later, did an analysis and
determined that in order for the cask to slide, we
need to have 400 mile per hour wind during a tornado
or greater and for a cask to tip over, it would
require a 600 mile per hour wind or greater.
DR. KRESS: These analysis are rather
simple drag versus frictional resistance to sliding
and knowing the weight of the thing. Is that right?
MR. HARDIN: I think that Khalid should
answer that. He's the one that did the details on it.
He'll be up here in a few minutes.
DR. KRESS: We'll wait for that.
MR. GARRICK: Approximately what's the
center of gravity of a full --
MR. SHAUKAT: That is correct. It is
based on drag force and friction.
MR. GARRICK: What's the center of gravity
height? The height of the center of gravity
approximately on a fully loaded cask and approximately
how wide are these casks?
MR. SHAUKAT: I can answer that question.
It's slightly higher than the mid height of the cask.
It's 878 inches from the bottom.
MR. GARRICK: How wide are these casks?
MR. SHAUKAT: The cask is about 11 feet in
diameter. The overpack I'm talking about, not the
MPC. It's about 11 feet in diameter.
MR. HARDIN: Well, the highest recorded
tornado in the United States to date has been about
300 miles an hour. We were given a good bit of help
and information from the Wind Science and Engineering
Research Center in Lubbock, Texas. It's operated by
Texas Tech University. And so we tried to get some
feeling from them about what's the likelihood of
getting wind speeds and tornados reaching 400.
MR. POWERS: After they stopped laughing,
what did they say?
MR. HARDIN: Well, they indicated that
this data hasn't been taken for I think it's maybe 15
years or 10 years, and so they can only speak for that
time when they've had fairly reasonable data. But
they don't think there's any physical phenomena that
would limit it to go slightly above 300 but there are
some people, experts, that think that it would be
unlikely to get wind speeds that go much higher than
400.
DR. KRESS: I don't think you can get the
temperature difference between the layers of air that
would generate that much energy. I think it would be
that sort of consideration.
MR. HARDIN: Well, to analyze the
probability of getting up to 400 miles an hour, we
used the data that we had that went up to a little
less than 300 and we did a regression analysis on it
to get a curve so that we could extrapolate it out to
400, and we did that recognizing that we really don't
know what accuracy we have in doing that. But we came
up with a value of something like 10-9 again for the
likelihood of having a tornado that would result just
in sliding and so for tip over, since it takes a
considerably higher wind speed, we presume that that's
also a very small number.
DR. KRESS: Did you look at tornado
generated missiles?
MR. HARDIN: Yes. That's the next slide.
DR. KRESS: I'm sorry. I didn't look
ahead.
MR. POWERS: You pretty quickly get the
conclusion here, Tom, that no matter what we think of,
you've got an answer for it. This is frustrating.
DR. KRESS: That's frustrating.
MR. POWERS: You've got to leave some
blanks for us to jump into to feel like we've
accomplished something.
MR. HARDIN: As far as tornado generated
missiles, the design basis tornado of 360 miles an
hour in the standard review plan has a number of
different items that you would typically look at.
Utility pole, 12" schedule 40 pipes, steel rods, and
automobiles. And in looking at these, it was
predicted that there would be no penetration of the
concrete shell and no MPC failure. Again, I'm not
intending to talk too much about these kinds of
results. If you have questions about that, someone
else can answer.
MR. POWERS: Is there enough impulse
provided by any of these projectiles to cause the
thing to tip over?
MR. HARDIN: No. Not without a very, very
low probability. It would take a very high wind
speed, again, to create a missile with enough speed to
do that.
MR. GARRICK: In the maintenance of these
casks, is there anything that people could do
accidentally or intentionally or whatever that would
make them more vulnerable?
MR. RUBIN: If that would occur, it would
be during the handling phase because there's really
not much going on other than surveillance when it's in
storage. So, for example, if there's a misloading of
fuel over the long-term, what effect could that be if
it was improper drying or inerting, sealing the cask?
MR. GARRICK: I was just thinking of
things like the cap being loose or something and 300
or 400 mile an hour wind creates quite a Bernoulie
effect.
MR. RUBIN: Are you talking about the top
being lifted off?
MR. GARRICK: Yes.
MR. RYDER: The overpack top is bolted on
and the MPC is sealed for the 20 years. It's got
redundant sealing, redundant welds. It's supposed to
be just a passive system that is placed on the storage
pad and, except for surveillance to check the vents,
there's nothing really --
MR. GARRICK: They don't do any
maintenance that would require them to remove the cap?
MR. RYDER: No. It's meant to be placed
on the storage pad for 20 years and left there.
DR. KRESS: How do they inspect these
things?
MR. RYDER: So far, we've learned that
it's just visual observation of looking to be sure
that there's no debris on the vents.
DR. KRESS: You just look at the outside
of the vent.
MR. RYDER: Look on the outside.
MR. HARDIN: We conclude that because of
the low likelihood of getting high enough winds that
the frequency of occurrence of a missile failing the
cask is very small.
Flooding has been screened out also
because the topography in the area of the site is such
that rain water, even during the maximum precipitation
that we look at during the IPEEE review, would not
have any way for water collecting. It would drain
away from the particular site. The elevation of it
also precludes having river-related flooding including
dam breaks. We weren't able to actually calculate
anything on that. We didn't have the kind of data
that we might have needed. There have been some
calculations done by the licensee and those numbers
that they calculated were very small. I think 10-8 or
something like that.
This is the last one. It's lightning.
Lightning is monitored in the United States by the
National Lightning Detection Network which includes
about 100 sites spread out around the country and this
network is operated by a company called Global
Atmospherics. They sell data for particular areas.
You can get data down to one-tenth of a mile. And so
we bought data from them for 10 years from a tenth of
a mile out to three miles, and we were able to
calculate a density of occurrence of lightning flashes
in the area that we could then, using a target area
for strike of the casks, we estimated about a 10-2
strike per year frequency of lightning strikes.
DR. KRESS: That's one every 100 years?
MR. HARDIN: I'm sorry, Tom?
DR. KRESS: That's one strike every 100
years?
MR. HARDIN: Yes.
DR. KRESS: It's not like my place. I get
one every year.
MR. POWERS: That explains a lot about
you.
MR. GARRICK: I think you started out by
saying that these have a 20 year life.
MR. RUBIN: Twenty licensed. The life
time could be longer but the license is for 20 years.
MR. GARRICK: That's my question. What
kind of life do these casks have? Do they last 100
years?
MR. RUBIN: I'll leave that to Jack
Guttman to answer.
MR. GUTTMAN: We license it for 20 years
and we have ongoing a license renewal program. We
just issued a standard review plan and the first
application for license renewal is expected next year.
The vendors are saying it will last approximately 100
years or so, but we haven't performed any calculations
to identify the length of number of years that a cask
would be acceptable.
MR. GARRICK: Have you done enough
analysis to know what part of it ages the fastest?
MR. GUTTMAN: At this point with the data
that we've received through research from the INEO,
casks that were monitored and instrumented, we did not
see any active degradation occurring at this point and
those casks are approximately 17 or 18 years old.
MR. HARDIN: If you don't have any
questions on this, Moni Dey from the PRA Branch is
going to talk to you now about the fire analysis that
was done.
MR. DEY: Thank you, Brad. I'm going to
cover the fire analysis and Jason Schaperow following
me will present the thermal analysis that utilizes the
results that will be developed.
I'll start off with the statement of the
problem. As Brad mentioned, we're going to be
analyzing the fuel spillage from Lear Jet 45 aircraft.
The assumptions are to ensure that we're conservative,
that the dry cask remains upright and is totally
engulfed in a fire. We're analyzing the effects of
the fire on one dry cask. Normally there are 12 casks
on a pad but to be conservative, we're analyzing the
effects of the fire on just one.
As was mentioned, the dry cask, the
outside diameter is 11 feet and 19.3 feet high, so
it's a fairly massive object. The amount of fuel in
the Lear Jet 45 is 6,080 pounds. So that's the amount
of fuel that could be spilled in fire.
The objective of the fire analysis is 1)
to determine the duration of the fire, assuming all
the fuel leaks out and secondly, to determine the
temperature distribution of a hot gas from the fire
surrounding the dry cask. Specifically, the
temperature of the hot gas near the inlet and outlet
vents which Chris described earlier.
A brief presentation of the analysis for
the duration of a fire. In order to estimate the
duration, one needs to postulate the way the fuel
spills. The duration of the fire will obviously be a
lot less if there's a very big leak as a result of a
crash and the fuel spills all at once. So in order to
be conservative, a minimum spill rate was chosen so
that the 1) the dry cask will be totally engulfed in
the fire. So in that sense, this is a worse case fire
effects analysis, worse case in the assumption of the
leak size.
Therefore, in order to determine the
duration of the fire, one can estimate the equilibrium
diameter of the fuel pool that would be related to the
spill rate and the burning rate, and the burning rate
for fuel is available. Various measurements have been
made and this data is available in fire protection
handbooks. The burning rate for this particular type
of fuel is about 4 mm/minute. I've attached some data
at the end of the slides if you're interested in
looking at some of the curves from the handbooks.
As I mentioned, assuming the fuel pool
size that's needed to engulf the fire is approximately
twice the diameter of the cask so about 22 feet
diameter fuel pool that would burn. Based on this,
one estimates that the duration of the fire would be
about 24 minutes for the fuel spillage.
The next question is what is the
temperature of the hot gas that Jason will use in his
analysis. I had two sources of information that I
used for this. One is over the last decade, several
plume models have been developed and secondly,
recently there were some tests done at Sandia on
horizontal transportation casks where temperature was
measured and the temperatures measured near the cask
and this was near the ground level. It was
approximately 1,800 F.
Secondly, the plume models, as mentioned,
several plume correlations developed over the last two
decades and the temperature and velocity in the plumes
have been measured. Typically, the plume is divided
into three regions. First region right above the
burning area is a consistent flame region followed by
an intermittent flame region and then just a plume of
hot gases with no flame in it. And these different
regions produce different temperatures and velocities.
I've attached some figures that document these
measurements that have been made in empirical plume
models.
Based on these correlations and the height
of this particular dry cask, the entire dry cask would
be in the consistent flame region. The temperature of
the hot gas around the dry cask is estimated to be
about 1500 F. What I recommended was using a
temperature of 1832 F for the hazard analysis which
Jason will cover.
Finally, the conclusions of the fire
analysis for this type of jet. The duration of the
fire is estimated to be about 24 minutes and the inlet
and outlet vents, both of them will be exposed to hot
gases at approximately 1830 F.
MR. GARRICK: Did you look at any extreme
of values like if you had 10 times as much jet fuel?
Six thousand pounds is about one hour driving time for
a 747 jet engine. Did you try to examine supposing
you had 10 times as much fuel what that do to the
environment?
MR. DEY: Well, basically 10 times more
fuel that you mention that would be in a 747 would
increase the duration of the fire by a factor of 10.
MR. GARRICK: And what about the
temperatures? Would they be pretty much the same?
MR. DEY: The temperatures would be pretty
much the same.
MR. GARRICK: So it would increase the
duration probably to hours. Right?
MR. DEY: Yes, about four hours.
MR. GARRICK: Yes. Okay.
MR. GUTTMAN: I'm not sure that if you had
a larger amount of fuel that you actually can
extrapolate that to hours. You'd have to have a small
trickle.
MR. GARRICK: Yes.
MR. GUTTMAN: If the plane crashes in,
probably the entire fuel will be spilled all over the
place and using this conservative bounding analysis
that it sticks within a diameter or so of circling the
cask is a very conservative assumption.
MR. GARRICK: So you think the 1800
degrees -- well, the 1800 degrees is not in dispute.
It's just the duration.
MR. GUTTMAN: Yes. Much bigger.
MR. GUTTMAN: Thank you.
MR. SCHAPEROW: I'm Jason Schaperow from
the Safety Margins and Systems Analysis Branch. The
objective of my analysis was to assess cask heat up to
allow the structural people to evaluate the cask
failure probability. The approach we took was to look
at three scenarios for the HI-STORM cask. We looked
at a blocked vent scenario, buried cask and external
fire.
Our conclusions are for the blocked vents
and the buried cask scenarios, the heat up is slow due
to the low decay power of this fuel and for the
external fire scenario, we saw that the temperature
rise was limited by the fire duration.
This next slide shows the HI-STORM cask.
This is taken from the safety analysis report for the
cask. This cask consists of a sealed metallic
canister, as we mentioned a couple of times already.
This shows it partially inserted into the overpack.
This MPC is the confinement boundary and the overpack
which is steel and concrete provides the mechanical
protection and radiological shielding and, as has
already been mentioned, this concrete and steel
overpack has air ducts in it. There's actually an
annular region between the MPC and the overpack, and
there are some so-called channels in there to kind of
keep the MPC centered in the overpack, but there's
basically an annular region in there.
The approach we took was to assess three
scenarios. This is to develop a range of conditions
that can be used to evaluate the cask failure
probability. For the blocked vent scenario, we
estimated the heat up resulting from blocking all four
of the intake vents and with the one-dimensional model
that we used, that shut off flow through the vent.
For the buried cask scenario, we again shut off the
vents but we also put the cask in a condition where
there's no heat transfer from the outside surface, no
conduction of radiation off the outside surface of the
cask which is a very extreme condition.
Finally, for the exterior fire scenario,
we calculated the heat up from the external fire which
Moni provided the boundary conditions for. We applied
the MELCOR code to assess cask heat up. MELCOR is an
integrated accident analysis code for severe reactor
accidents. It can be used for thermal hydraulics, as
we've used it for here. It's also got modeling for
core melt progression and fission product source term
which we are planning to use in the consequence.
DR. KRESS: Is this thermal hydraulics or
is this strictly conduction and radiation heat
transfer? Is there a natural convection inside the
cask itself?
MR. SCHAPEROW: In the nodalization I've
chosen here, you'll see there's nothing inside the
MPC. For the fire scenario, I'm allowing natural
circulation of the hot fire gases through the annulus.
For the first two scenarios, no, no flow. This is
just conduction and radiation but for the third
scenario, we're allowing flow of hot gases through the
annulus.
The major inputs to this code. The
thermal hydraulic input for the control volumes, the
flow paths and the heat structures and finally, the DK
power which is the heat input. I've noted on this
slide the DK power we use in our analysis. This is
important because this is a very small number, and
this is what drives the calculation for the block vent
in the buried cask scenario.
DR. KRESS: When you say each assembly.
That's each fuel assembly.
MR. SCHAPEROW: That's correct so for the
whole cask it's about 21 kilowatts. This is a BWR-
type canister and holds 68 BWR assemblies. About one-
eighth of a core.
This slide shows the nodalization we used
with the MELCOR code. I would like to mention this is
simple. It has only five elements. Three control
volumes and two heat structures. As Tom pointed out,
we're not considering convection within the multi-
purpose canister. It's one volume. No flow.
This next slide gives the MPC shell
temperatures we calculated for the scenarios which
only had DK heat. That is the block vents in the
buried cask scenarios. We just ran it out in time out
to about a million seconds. It takes a long time to
heat up with the low DK power here.
DR. KRESS: This is the temperature on the
shell?
MR. SCHAPEROW: That's right. This is the
boundary of the multi-purpose canister shell. This is
the boundary for fission products.
DR. KRESS: Does this have a maximum fuel
temperature inside that's calculated also?
MR. SCHAPEROW: I did not calculate a fuel
temperature inside. I didn't even put fuel in here.
I just have helium.
DR. KRESS: Oh, you just had the heat
going --
MR. SCHAPEROW: Helium with a constant
density heat source. Just uniform heating of the
helium. We are developing a MELCOR input file. We're
going to be doing some calculations. We're actually
putting fuel assemblies in there.
DR. KRESS: Your focus here was on what
would happen to the cask.
MR. SCHAPEROW: That's correct. Whether
it would rupture or not. This is going to be used by
the structural people to estimate failure probability.
DR. KRESS: When you get time involved in
it, you will go back and say I've got so much time to
do corrective actions to get the failure probability
or something like that. You'll have a temperature at
which you don't want to exceed and then you'll have so
much time to get there.
MR. SCHAPEROW: I don't know how they're
going to handle that.
MR. RUBIN: This might be where some of
the risk informed insights might come into play in the
results of this in terms of procedures and other
things, looking at the time before you run into
problems and what could be done.
MR. SCHAPEROW: This was an issue on the
spent fuel pool risk study from last year. This is
heat up just based on slowly draining pool. People
have days to take care of it.
DR. KRESS: Do you have a temperature that
you don't want to exceed yet based on structural
analysis?
MR. SCHAPEROW: I'd have to turn to the
structural people for that. Ed.
DR. KRESS: The question is do you have a
limiting temperature that you want to say that you
don't want to exceed yet?
MR. HACKETT: This is Ed Hackett,
Materials Engineering Branch and Research. I think
Doctor Kress asked a question about limiting
temperature. We were looking at, I believe -- I
didn't do these analyses. I'll be subbing here later
today for Tanny Santos. I think we were looking at
about 1,000 F. as sort of the ball park answer. There
was not a whole lot of damage that was contributed in
a creep mechanism before 1,000 F.
MR. GARRICK: And the damage is where that
you were most worried about?
MR. HACKETT: The damage would be largely
to the areas like the welds, for instance.
DR. KRESS: Does the helium get internally
pressurized at these kind of temperatures? That would
be significant pressure.
MR. SCHAPEROW: That's correct. The
structural analysis used both the temperature and
pressure results from these calculations.
DR. KRESS: Okay.
MR. GARRICK: Let's pull out all the water
from the concrete?
MR. SCHAPEROW: We didn't consider water
in the concrete as the -- this is for the multi-
purpose canisters. It's only the helium and the fuel
inside that pushes outward.
We also ran a test using a temperature of
1830 F. for the environment. This was my attempt to
simulate a fully engulfing external fire, and it's
described --
DR. KRESS: That's the maximum temperature
you would get in combusting jet fuel in a
stoichiometric mixture with air or what?
MR. GARRICK: It's about 1500 degrees I
think was your maximum, wasn't it?
MR. DEY: Yes. The temperatures that have
been measured typically for various fields, it doesn't
vary very much. It's around 1500 degrees. Just to
get some margin, I recommended using 1830 because
there have been some measurements.
DR. KRESS: That's when you take a
stoichiometric mixture of combustion and put all the
heat back into the mixture. You get 1500 or something
like that.
MR. GARRICK: See, really what you're
ending up with here is not so much a risk assessment
as a bounding analysis because we don't really know
what the answer is to the question. From this
analysis, we don't know the answer to the question
what is the risk? We know some other answer.
DR. KRESS: We know that the risk is less
than some value.
MR. GARRICK: Yes.
MR. POWERS: In the engulfing fire, you're
heating from the outside through the concrete and
through the flow through the ducts. Right?
MR. SCHAPEROW: That's correct. All I've
done in this calculation is very straightforward. I've
just changed the boundary condition as the environment
is now very hot.
MR. POWERS: In this concrete field
region, is it vented?
MR. SCHAPEROW: No, it is not and I think
that issue was discussed as far as the concrete giving
off steam. I'm not sure how that was resolved. I'd
like to refer back to the PRA Branch.
MR. RYDER: We're not looking at the
effects of the overpack. Our concern is the
confinement boundary which is the MPC.
MR. POWERS: I think we'll get to that.
Suppose that I indeed pressurize that outer package.
How does the steel deform? Does it deform into the
overpack or does it just all push outwards?
MR. RYDER: We have not looked at that in
our analysis. Our focus has been on the MPC and the
pressurization.
MR. POWERS: I suspect you'll find out
that it'll all deform outward, but it's worth looking
at because at these kinds of surface temperatures, if
someone were to use limestone concrete, you'll get
some fairly impressive pressures within the concrete
fill regime. It's a little tricky to figure out
exactly what it is because in fact the CO2 pressure
will get so high it'll keep the limestone from
decomposing. But it'll be impressively high
pressures.
MR. LEVENSON: And I think the reason you
can be almost sure the bulge will be out is the inside
steel is nowhere near these temperatures. It may be
700 - 800 degrees or 1,000 degrees lower. I mean if
the MPC inner canister only goes to 260, then the
inside part of the overpack only goes to 260.
MR. SCHAPEROW: That's temperature rise.
MR. LEVENSON: Right. So if the inside is
260 and the outside is 1800, it's going to bulge out.
MR. SCHAPEROW: That's 260 plus the
initial temperature.
MR. LEVENSON: It doesn't matter.
MR. SCHAPEROW: It isn't going to make any
difference.
MR. LEVENSON: It's 300 versus 1800.
MR. POWERS: I'm not so good at these
complicated structures deciding which things move
where. It's worth looking at because you may get some
impressive pressures.
MR. SCHAPEROW: That concludes my
presentation.
DR. KRESS: I wasn't quite clear earlier
on how you estimated the fire duration. Is that
saying the jet fuel is in a pool of a certain
dimension and the rate of burning off of the pool or
something like that?
MR. DEY: That's correct.
DR. KRESS: You get four-tenths of an hour
out of that, and then you did the four hour as a
sensitivity study.
MR. SCHAPEROW: That's correct. Just say
well, what if it's 10 times as great. How would that
affect it. Basically it goes up proportionately, the
temperature. It's a linear rise at this point.
MR. GARRICK: Okay. Thank you. We are
supposed to be having a break now, but I'd like to get
through this next presentation.
MR. SHAUKAT: I am Khalid Shaukat from
Research Applications Branch and I'm going to talk
about mechanical loads on the dry casks and the
stresses on the MPC. There were two objectives for my
work, the first one being testing the mechanical loads
on the cask system for all the scenarios during
handling, transfer and storage phase of this
operation.
The second objective is to determine the
stresses in the multi-purpose canister and those
stresses would eventually be used for estimating the
probability of failure of MPC or the consequences to
the public.
For the handling events, we looked at the
drop of the MPC and on the refueling floor when the
cask is moved horizontally like so, hung from the
crane, it is usually 12 inches above the floor. We
tried to calculate that if it falls down due to any
fault of the crane, would it tip over or not? We
found out no, it will not tip over. So then we
calculated what height would it require to fall from
that it could tip over.
DR. KRESS: Doesn't that require you
knowing some sort of angle at which --
MR. SHAUKAT: Some sort of an angle, so
the bounding case is an angle of 20 degrees tilt from
the vertical.
DR. KRESS: Where did that come from, that
curve?
MR. SHAUKAT: That angle came from the CG
and the geometry of the cask.
DR. KRESS: It would tip over if it fell
at that angle.
MR. SHAUKAT: Yes. The CG of the cask
falling outside the tipping edge of the cask would
cause it to tip over. That angle we have calculated
to be about 20 degrees from the vertical and that
angle can not be reached unless the fall is more than
28 inches from the ground.
DR. KRESS: That's what I don't
understand. Doesn't that depend on the way the thing
fails or something?
MR. SHAUKAT: No, no. If it fails, then
it will drop down. But we calculated that as long as
the cask is 28 inches above the floor and it falls at
a tilt, its one edge would touch first and the CG of
the cask would still be inside that edge so it would
just rest like this. It will not tip over.
MR. HACKETT: If it's higher than 28
inches.
MR. SHAUKAT: If it's higher than 28
inches--
DR. KRESS: Its momentum wouldn't carry it
on over the other way?
MR. SHAUKAT: If it's higher than 28
inches, it could tip over. Now, the load is such that
it will not sway in the other direction. It's very
heavy, 360,000 pounds weight.
DR. KRESS: My question is is there ways
for this carrier device to fail so that it lands at a
bigger angle than that? Is it held up with two straps
or one strap?
MR. SHAUKAT: It is hung with a -- which
has two sides holding on it.
DR. KRESS: And if one of them fails?
MR. SHAUKAT: If one of them fails, we
have not looked into that situation yet. Then we
tried to calculate the stresses on the MPC for various
drop heights.
DR. KRESS: No. The question is if it
tipped over, is that a problem?
MR. SHAUKAT: If it tips over?
DR. KRESS: Is that a particular problem?
MR. SHAUKAT: A non-mechanistic tip over,
for example, just falling and then because of the tilt
it falls over, the non-mechanistic tip over we have
calculated is not a problem.
DR. KRESS: Not a problem. Okay.
MR. GARRICK: And that's a handling
accident.
MR. SHAUKAT: That's a handling accident.
Then we tried to calculate what would be the stresses
on the MPC for various drop heights and we found out
that the height could be during that transfer phase of
the MPC from HI-TRAK into the overpack could be a
great height like about 80 feet or so and then we
tried to --
DR. KRESS: There you don't have to worry
about an angle.
MR. SHAUKAT: There you don't have to
worry about the angle, but we said we wanted to
calculate what would be the stresses on the MPC for
various heights and we found out that a threshold
value of 62 foot drop could cause the stresses in the
MPC very close to the buckling strength of the
material which is 64,000 psi so that is a 62 foot
threshold value. And in that case, the
circumferential stresses on the MPC shell are very
small.
DR. KRESS: My recollection is is they
took these casks and dropped them off the top of
cranes that were higher than 62 feet.
MR. SHAUKAT: And nothing happened.
DR. KRESS: Nothing happened. That's what
I thought I remembered.
MR. SHAUKAT: We calculated the buckling
strength reaching up to the ultimate strength of the
material. We're not saying it would fail at that 62
feet height.
During the transfer of the MPC from HI-
TRAK into the overpack, it's a direct vertical drop of
20 feet which is the height of the overpack. So it
goes inside the overpack and we calculated what will
be the stresses on the MPC for that fall, and that is
11,000 psi.
Now we go to the transfer events when the
overpack is being carried by a crawler from the refuel
building to the concrete pad outside, and we
calculated if the crawler vehicle is traveling at its
maximum speed and if it drops the overpack, would it
tip over? During this procedure, the crawler is
carrying the cask only 11 inches high from the ground
so we calculated that if it falls either on the
asphalt or gravel or even the concrete pad, it would
not tip over.
We also calculated that if the cask fell
on the ground and the crawler operator fails to stop
the vehicle, what would happen? The finding was that
the cask weighs about 360,000 pounds and the crawler
weighs 158,000 pounds. It can not push it. Its track
would start slipping.
DR. KRESS: That requires you to have a
coefficient of friction between the track and the road
itself.
MR. SHAUKAT: We checked those different
coefficient frictions.
DR. KRESS: Are these tracks like a
tractor? Do they have treads?
MR. SHAUKAT: Yes, they're like tractor
and they would slip. They could not push it forward.
We also calculated if the overpack digs into the
asphalt or the gravel surface and the crawler pushes
it, would it tip over? And it doesn't.
Last area in this case we looked was the
crawler carrying the cask near the concrete pad and
hits another cask on the pad, what could happen to the
stresses in the MPC? We found out that if it hits
another cask, the struck cask will not slide or tip
over and the stresses in the MPC would be very, very
small.
Then we go to storage events and we looked
into the seismic and we found out that almost no
sliding would be for the design earth quake of .015 G.
Then we performed some sensitivity analyses to show
that it would take 10 times design earth quake to move
the cask up to half the separation distance, assuming
that during the earth quake the two casks adjacent to
each other move in the opposite direction, although
this is a very unusual phenomena, but this is the
worse case it could ever happen, it would move in the
opposite direction. So we said okay, if the two casks
move up to the half of the separation distance, we can
conclude that it would not collide and we found out
that up to 10 times of design earth quake, it will
still not collide and no tip over could occur at any
earth quake level up to 10 times of design earth
quakes.
MR. HACKETT: Can I just interject. This
goes back to Doctor Garrick's point at the beginning
of the presentation.
MR. SHAUKAT: The threshold events.
MR. HACKETT: These are obviously very
much bounded by the drop events for the most part,
mechanical impact.
MR. GARRICK: It makes me wonder where
we're going with the PRA approach here, and I'm not
one to ever say we shouldn't do a PRA, but if there
was ever a case that we may be able to standardize
something and design it such that it was site
insensitive and perform one comprehensive safety
analysis, it sounds like this might be it.
MR. HACKETT: I think Alan mentioned at
the beginning --
MR. RUBIN: You'll find a lot of things,
phenomena, sequences, will be screened out based on
frequency, initiating events or lack of impact on the
cask, and you're seeing those today. There are,
however, some instances of sequences which are not
screened out yet. We particularly don't have the
human error factored into this yet, and you'll hear
some more about that later. But the PRA portion will
be probably very simplified.
MR. GARRICK: Yes. Okay.
MR. RUBIN: But we had to do this analysis
to come to that conclusion.
MR. GARRICK: Right.
MR. SHAUKAT: We looked into the aircraft
impact. We chose the largest aircraft that could go
in one of the four airfields nearby in that area
within 30 miles radius and Lear Jet happens to be the
largest aircraft and we calculated that at its landing
or take off speed of 140 miles an hour, it would not
slide or tip over the cask. Then we calculated at
bounding value what speed impact would cause sliding
or tip over of the cask, and we found out about 235
miles an hour speed could cause a tip over or slide.
MR. LEVENSON: Was that done with an
assumption that the 20,000 pound weight of the jet was
a solid piece of metal with no energy absorption
capability?
MR. SHAUKAT: Right. Based on the
assumption it's just a solid piece of --
MR. LEVENSON: So you've got two orders of
magnitude in that.
MR. HACKETT: Probably a lot.
MR. LEVENSON: At least that. Yes.
MR. SHAUKAT: Tornados. As Brad Hardin
mentioned earlier, tornado velocity of 400 miles per
hour could slide the cask and the probability of that
is 10-9. This was calculated based on the drag force
and the coefficient of friction between the cask and
the pad. A tornado velocity of 600 miles per hour
could tip over the cask and it was estimated that it
would be orders of magnitude less than 10-9 to have
that kind of tornado.
Tornado-generated missiles. We have
calculated all missiles that are in the vicinity. We
found that none of them could penetrate the cask. The
worst one for the automobile would be the worst one to
check for the sliding or tipping over, and we checked
that automobile as a tornado missile will not slide or
tip over the cask.
DR. KRESS: I'm intrigued by these
calculations, if you don't mind.
MR. SHAUKAT: And this is based on certain
coefficient frictions we have taken. We have taken a
range of coefficient friction. WE have found that the
smallest coefficient of friction would be governing
for the sliding case and the highest coefficient of
friction would be governing for the overturning case
and we found that it would not tip over or slide for
different ranges.
DR. KRESS: Going back to the airplane
crash and tip over analysis. My first thought on that
would have been I would get the momentum of the plane
and then I would look at how much potential energy it
takes in getting the center gravity of the cask to tip
over. Is that what you did?
MR. SHAUKAT: Yes. Exactly.
DR. KRESS: So it seems all the momentum
goes into tipping it over.
MR. SHAUKAT: As if one ball for the total
weight of the aircraft hits it.
DR. KRESS: Okay. That's a pretty
conservative analysis.
MR. LEVENSON: That's what I was saying.
DR. KRESS: That's what you were saying
about absorbing some of that energy in the jet.
MR. LEVENSON: An airplane does not do the
same damage as a wrecking ball.
DR. KRESS: Mostly it's the engine that
does the --
MR. RUBIN: You'll find this is typical,
that the approach we tried was to do either simplified
calculations. If we need to do more detailed
calculations later on because we could not eliminate
events, then we would do that.
DR. KRESS: I don't fault that. I think
it's the way to go.
MR. RUBIN: So that's generally the kind
of approach we've taken.
DR. KRESS: Yes. I think that's what you
ought to do.
MR. RUBIN: I just wanted to clarify that.
MR. SHAUKAT: Shock waves. We located
that the nearest natural gas pipeline is about four
and a half miles from the site and an explosion from
such a distance would not affect the structural
integrity of the cask.
DR. KRESS: That's not much of a surprise.
MR. LEVENSON: But what restrictions are
there that would prevent over the next 20 years
somebody putting a natural gas pipeline? Did you do
the other case? How far away does it have to be
before it doesn't do any damage?
MR. SHAUKAT: No, we have not done that
case.
DR. KRESS: It would have to be on the
site, I think.
MR. POWERS: It would have to be under the
cask.
MR. SHAUKAT: For flood we did the
bounding calculations. What kind of flood would it
take to slide or tip over the cask? And we found that
a flood velocity of 25 feet per second or 17 miles per
hour will not slide or tip over the cask. And this is
very small probability to have such kind of flood.
MR. POWERS: On your airplane impact in
this cask analysis, you've looked at the airplane
hitting the cask. What if it hits the ground
underneath of it?
MR. SHAUKAT: The bounding case would be
the airplane hitting near the top of the cask. We
have taken that case.
MR. POWERS: Why wouldn't it be gouging a
hole right in under the corner of the cask?
MR. SHAUKAT: That would not put such a
heavy impact on the cask as --
MR. POWERS: -- going down from under and
it tips over.
MR. SHAUKAT: If it does not hit directly,
then it is a non-mechanistic tip over. A non-
mechanistic tip over, we have found that it's no
problem. A mechanistic tip over when it hits and tips
over, that could be a problem. But a non-mechanistic
tip over that it falls down because something is
digging here would not impose high stresses in the MPC
to cause it to fail.
MR. POWERS: What does it do to the fuel
inside?
MR. SHAUKAT: We have not looked into the
fuel inside.
That finishes my presentation.
MR. GARRICK: Okay. I think we'd better
take our break now. We've got how many more?
DR. KRESS: Two or three.
MR. RUBIN: Two more and then a brief
summary.
MR. GARRICK: I unfortunately will not be
here when we reconvene, but the able co-chairman here
will take over the meeting. But we'll take a 15
minute recess.
(Off the record at 2:44 p.m. for an 18
minute recess.)
DR. KRESS: Can we get started again,
please. I'll turn it back to you. Where are we?
MR. HACKETT: I think what we're onto is
moving on from what Khalid talked about and structural
evaluation. This is sort of the response of the cask
as a materials and structural system to the loadings
that he talked about. I'm Ed Hackett and I'm
Assistant Chief of Materials Engineering Branch. I
guess all I get is some of the managerial credit for
this work. The other two folks on here did all the
work.
DR. KRESS: Take all the credit you want.
MR. HACKETT: Okay. Thank you. This is
a nice piece of work. Again, as Jack and Alan led off
with, all this work was done in-house in MED and they
did a very nice job. Tanny Santos and Doug
Kalinousky.
Just in terms of I think Jason had the
larger overview of this thing as a system, but what
you're looking at with the cask is really a stainless
structure which is a good thing from a fracture
material response perspective because it tends to be
a very forgiving material as regards potential for
brittle fracture, other things we've talked with the
ACRS about on many occasions and some other systems.
So we considered three failure mechanisms:
fracture, limit load and then creep rupture. Creep
rupture obviously in response to the high temperature
scenarios. Limit load is really a gross section
failure of the cask, the cask wall in that kind of
case. What Tanny did was to create failure models for
those three mechanisms with an Excel spreadsheet and
what they call this at risk add on module which
basically performs Monte Carlo simulations on the
material properties. So that's the way things were
done.
In terms of some more general information
that's provided in your packages, there's really two
scenarios that were addressed. One is the situation
with the mechanical accidents that's been discussed
extensively already today. In that case, you have
basically the drop accidents from handling and tip
over. In that case, you really only have the two
failure mechanisms which are really fracture or limit
load failure of the cask.
DR. KRESS: When you're looking for, say,
the loads and stresses on a drop cask, I envision an
initial contact with something. Your forces, you've
got momentum being offset by impulse, integral forces
times time. Somehow you have to get those forces out
of this, and that depends on how things deflect and
deform including what it lands on.
MR. HACKETT: Right.
DR. KRESS: Did you just neglect what it
lands on and say it didn't deform at all?
MR. HACKETT: I'll turn to Khalid for the
detail. I believe that's the case. I believe it was
assumed as a --
MR. SHAUKAT: Yes. We considered that the
actual case is such that there is a shear wall below
the concrete floor going diagonally in the area where
this could fall and we considered that because of the
presence of the shear wall, it is more rigid. But any
impact would have to be absorbed by the flexibility of
the floor and the shear wall. But we considered it as
rigid.
MR. HACKETT: This builds on also, Doctor
Levenson mentioned the aircraft impact, and the crush
of the aircraft structure was not modeled. Probably
the most sophisticated analyses of that sort that are
done are the ones that are done with automobile
crashes. So you could do that, and there would be a
different distribution of forces resulting from that,
but that wasn't done, at least not yet.
The other side of this chart really talks
about the thermal situation where you'd have the
blocked vents, the cask being buried or an external
fire that have been discussed. There are stresses
there. Some discussion earlier from the internal
pressurization from the inert atmosphere. In that
case, you add a failure mechanism in the form of creep
rupture if you get the temperatures high enough to
cause deformation of that sort.
So just to run through these real quick.
First one is fracture mechanics which is basically
assuming that you've got a structure with a flaw. In
most cases, that's a pretty good assumption. Most
engineering structures. The flaw parameters. There
was some discussion of that earlier, and I know we
talked to the committee extensively, at least the
ACRS, about the flow distribution for reactor vessels.
For instance, in pressurized thermal shock. We used
the program from that also on here. This program
called Prodigal, which is an expert code that
basically from weld fabrication parameters will yield
the distribution of flaws that may be expected in that
type of structure. So the flaw parameters did come
from Prodigal. Again, that was done in-house.
There were some assumptions here that were
conservative, the assumption being that those flaws
from the Prodigal analysis were assumed to be surface
breaking which would be again a conservative
assumption. Toughness and strength properties in that
case were also taken from the literature and were
sampled per a Monte Carlo type routine.
For the next failure mechanism limit load
which is very often stainless structures will fail in
a limit load fashion, and I know we've also been
before the committee talking about a lot of examples
of that. Most recently, probably the control rod
drive mechanism housings, for instance, would likely
fail in a limit load scenario. They're an ostonimic
material.
So really what you're saying is by the
time you get to a limit load scenario, the structure
is behaving like it doesn't care whether there are
flaws there or not. You're into gross plastic
yielding of the structure. In this case, we just did
something as simple as -- or Tanny did -- looking at
applied stress exceeding the flow stress where the
flow stress was calculated as you see it there, taking
into account bending and membrane stresses so
basically you ended up with a scenario that's
considering sigma flow at about three-quarters of the
combined yield and ultimate material properties.
Creep rupture is more complicated because
you're now considering another dimension to the
problem. In addition to stress and temperature,
you're considering the time variability of the
properties with the temperature.
DR. KRESS: You use constant temperature
in there.
MR. HACKETT: Yes. I know that came up.
I think that's the bottom bullet. What Tanny did is
he assumed that the initial steady state temperature
was applied. This say for 40 years. It might have
been 20. I'm not sure. But at any rate, that's what
he did. He didn't project ahead for the heat decaying
with the decay in the fuel. The creep rupture
strengths were obtained from the literature.
The evaluation procedure in this case is
very much like what you do for fatigue damage. You're
basically using a dimensionalist parameter like
Larson-Miller and your summing damage fractions to get
to a creep damage. When the sum adds up to greater
than one, you're assuming you have a failure from
creep rupture.
So that's sort of background on how it was
done and then in terms of some results.
DR. KRESS: When you use the Larson-
Miller, doesn't that imply you're using the transient
temperature?
MR. HACKETT: Larson-Miller actually as
far as the input goes, the input temperature would
have been considered steady but it is then a transient
case -- you're right -- in terms of the Larson-Miller
analysis.
MR. POWERS: Wasn't Larson-Miller's work
done for isothermal conditions?
MR. HACKETT: I don't know.
MR. POWERS: I think we have extrapolated
it substantially in going to the transient cases.
MR. HACKETT: I know Doctor Powers is
getting into an area that was disputed when we did
some work previously on -- Alan probably remembers
this -- on Three Mile Island vessel where we looked at
stress control versus strain control and there was
some debate there also in terms of the transient case.
MR. POWERS: Significant debate.
MR. HACKETT: I remember some discussions
with Doctor Rashid, for instance.
MR. POWERS: I mean Rashid's contention is
that we just don't have the really empirical data-
based work at those kinds of temperatures and kinds of
bi-axial stresses and things like that.
MR. HACKETT: And I think you have to
admit that's very true in terms of the data. There's
no question.
In terms of results that they achieved--
MR. POWERS: Probably ought to quit
investigating irradiated heavy section steel and start
looking at bi-axial strain and heavy section steel.
MR. HACKETT: Another level of complexity.
We did look at the failure probability,
just to share with you a few of the results here, and
there's still some work in progress. These slides
show the failure probability as a function of time and
temperature for at least two of the thermal scenarios.
I think Moni Dey mentioned earlier the fire duration
was considered to be 25 minutes. In this case, the
conclusion was that was not long enough to cause
failure of the MPC, so you're looking at the case of
the fire is actually over here in the red. You can
get, as you can see, some very high temperatures from
the fire and pretty much above -- I think this is
shown above about 1,200, probably really anywhere from
1,000 above you're transitioning from sort of a
fracture-dominated mode to a creep-dominated mode or
maybe even creep crack growth in between. I think by
the time you're up in this range, you're probably
looking at a pure creep type behavior, at least a
stage one or stage two creep. Below 1000 F. you're
probably looking at a fracture-dominated scenario.
For the blocked vents or the buried cask
over on the other side in blue, you're looking at a
situation again that's dominated by fracture or
fracture controlled up to 1000 - 1100 F. and then
creep control beyond there if those temperatures get
that high. And then you can move over to the axis to
look at the kind of failure probability you're talking
about.
DR. KRESS: Just to give you a test,
what's this little hump in the curve?
MR. HACKETT: The one at 1120?
DR. KRESS: Yes.
MR. HACKETT: I would assume what's going
on there is probably a disconnect. At some point,
there's not a smooth transition between those two
types of failure mechanisms.
DR. KRESS: Oh, you're right.
MR. HACKETT: I don't know if it's exactly
a step function.
DR. KRESS: It's the transition between
failure mechanism.
MR. HACKETT: Exactly.
MR. LEVENSON: Is that little X that says
1000 F. way over on the right hand side of the first
chart, is that a point?
MR. HACKETT: I'm just looking at that for
the first time here. I should have paid more
attention to that. Yes, that's right. So that is
just one data point and it is actually that low. As
I recall a conversation with Tanny, it is actually
that low in the failure probability.
DR. KRESS: Sure.
MR. HACKETT: The next slide shows the
vertical drop for the transfer cask. In this case,
dropped from looking at from zero to 100 feet. I
think it's also fair to say that this graph beyond
about 60 feet is probably more than a bit but it's not
exactly the most certain part of the analysis at this
point. I think up to 60 feet you're looking at again
probably largely a fracture-dominated scenario with
some aspect of limit load. Beyond that, I'm sure
you're probably talking probably complete crush or
limit load gross plastic deformation of the walls. So
the upper part of that curve, if it is indeed correct,
is going to be limit load-dominated, and then you can
see the failure probabilities will go up significantly
when you increase that drop height in terms of gross
plastic failure of the wall.
And the last one we have that Khalid
mentioned earlier was the 20 foot drop in this case
into the overpack when it's being transferred which
again would drop straight down into the overpack. The
maximum applied stress was calculated at about 11 ksi.
All the failures in that case would be predicted to be
a fracture-dominated scenario if they happened at all,
and those failure probabilities are down around the
10-4 range. So not a very severe situation for the
cask.
That's what we have to date. There is
some more work under way like the previous slide.
We're finding some of that upper area from the higher
level drops, but that was basically the task of the
Materials Engineering Branch was to take the loads
that Khalid generated and apply them to the structure
through use of finite element modeling and some
assumptions made on the variation in the material
properties and see what would result. So far, I don't
think there's any real surprises there from what we've
seen.
That pretty much concludes what I had to
say. If there aren't any questions, Jason is going to
continue on with the consequences.
MR. POWERS: You have not looked at all
the behavior of this outer shell when it's heated in
the engulfing fire.
MR. HACKETT: In terms of the material
properties or --
MR. POWERS: Yes. What I'm thinking of is
okay, you're going to heat this outer shell to 1800 F.
It is going to be pressurized inside. Milt assures me
that this is going to expand outwards. I presume it
will rupture. The concrete all falls out. Does that
change the temperatures on the inside?
DR. KRESS: Lowers them probably.
MR. POWERS: Why is it going to lower
them?
DR. KRESS: Because you already got that
temperature going up through the annulus and now
you've changed it from a flow up to an annulus to just
being surrounded by the temperature. I'm guessing
based on what I thought the analysis was. Probably
lowers it.
MR. POWERS: Let me make sure I
understated. We're getting this gas from someone from
a state where pi has the value of three. Right?
DR. KRESS: That's right.
MR. POWERS: So I want to put this in
perspective where this gas is coming from.
DR. KRESS: Where road kill is legal.
MR. HACKETT: I don't know how much of
that Jason -- Jason addressed some of it earlier. I
don't recall the gap between the MPC and the overpack.
I think it's on the order of half an inch.
MR. SCHAPEROW: Two and a half inches.
MR. HACKETT: Two and a half inches.
MR. SCHAPEROW: It's all the way around.
MR. HACKETT: I think then again these are
things we haven't analyzed but just to respond to that
sort of line of questioning, by the time the shell
expanded to fill that gap two and a half inches, they
would have to be --
MR. POWERS: It's on the outside. Bill
tells me it's going to expand on the outside.
MR. HACKETT: Right, so this is the MPC
expanding into the overpack.
MR. POWERS: No, no. What I was thinking
of is this overpack expands.
DR. KRESS: It disappears.
MR. POWERS: And presumably it breaks.
The concrete inside is powder at this temperature. It
falls out. Engulfing fire is still going on. Does
that cause -- I mean it's got to happen pretty quick.
You haven't got a lot of time, but does it have any
effect?
MR. HACKETT: As of right now, I guess
that's an unanalyzed condition.
DR. KRESS: I would just look at the heat
transfer coefficient you get for natural convection up
that annulus and then look at the heat transfer
coefficient you get from natural convection around the
thing if it were unconstrained and see how much
different those are. They're probably about the same.
MR. LEVENSON: There's only 24 minutes of
fire. You probably deteriorate all that concrete.
MR. POWERS: It may be since we're free to
adjust the fire burning rate, maybe we change from the
24 minute to the slower leak with a 44 minute fire.
MR. LEVENSON: More importantly, without
getting into the details, I think your point, which I
agree with, is somebody needs to look at the overpack
which hasn't been looked at.
MR. HACKETT: Yes. Where that would have
gotten considered would have been Jason's analysis,
and that has not been addressed.
MR. SCHAPEROW: No. The previous project
manager, who I understand is on sick leave right now,
had thought of this issue. He identified this issue,
and I am kind of thinking that he had done something
to resolve it, but I'm not sure. We'll have to go
take another look at that.
I'm back up here for one more shot before
I quit.
DR. KRESS: Here's where we're going to
get a source term. Right?
MR. SCHAPEROW: Well, first I need to know
what scenario fails the cask.
DR. KRESS: Oh, okay.
MR. POWERS: -- independent of that.
MR. SCHAPEROW: So this is going to be a
very, very short talk. I just wanted to say a few
words about the consequence assessment. The objective
of this work is to assess the consequences for dry
cask storage accidents, and we intend to and we have
been applying the MACCS reactor accident consequence
code.
MR. POWERS: Let me ask you a question
about that. For this particular analysis, you've got
a cask setting out in the middle of this flat plane
where there's there's nothing around. I mean this is
a completely isolated cask. But the guy that actually
has casks for a living, they never have that. He has
casks surrounded by lots of other casks. Is there
going to be any difference between a MACCS calculation
and what happens when you're in a field of casks?
MR. SCHAPEROW: If one cask fails and it's
sitting in an array or a field of casks, as you
suggest, you might expect a little more dispersion
than if it's a single cask because you've now got the
wind blowing past an array and so you've got a bigger
wake than if you just had one cask. Based on the
limited work we've done so far, I suspect that our
source from uncertainty is going to be much bigger.
I think that's where we're going to have some troubles
with the source term. You already suggested that
earlier today.
DR. KRESS: Let me ask you a more
philosophical question. I have 10 casks on the site.
I have a probability of failing one due to some of
these accident sequences or cumulative frequency of
failure and I have a source term for that cask and I
calculate a consequence, so I've got a frequency and
a consequence which I can convert to a risk. Now, if
I've got 10 casks, is my risk 10 times what I just
calculated?
MR. SCHAPEROW: I would expect that most
accidents, the ones we're considering, would only
affect one cask. It would have to be something that
hit all the casks at the same time. So it would be
very conservative to multiply it by 10. Probably
unwarranted to do such a thing unless what it was
affected all of them at the same time.
DR. KRESS: That's because these are mass
stoichiastic events.
MR. SCHAPEROW: There's a separation.
These casks are separated on the pad. In the spent
fuel poor or reactor, all the fuel is right there
together, but in this situation they're separated.
They're in separate containers spaced with whatever
spacing they have between them. So it would have to
be big enough to hit all the casks at the same time.
DR. KRESS: And you can't drop all the
casks at the same time because you're only moving one
at a time.
MR. SCHAPEROW: That's correct. Typically
inside the building is where they're handling it with
a crane.
DR. KRESS: I think you're right.
MR. LEVENSON: I think there's a
philosophical question as to whether all of the
accidents inside the building which are precursors to
loading the cask ought to be called cask storage
accidents because they really aren't. I mean storage
implies what happens when it's being used as a storage
container and dropping the multi-purpose container
before it's even in the cask shouldn't really be
called a cask --
MR. RUBIN: It's just part of the
operations to get the fuel into the cask, and it's
included in the scope of work. I understand what
you're saying.
MR. LEVENSON: The context of the question
is when people start adding up is cask storage safe or
not and you've included a bunch of accidents that are
irrelevant to the use of a cask, is dropping something
into the pool going occur whether you do or don't use
dry cask storage?
MR. RUBIN: You have to go back to what
the objective is from the user office as to where some
of the priorities for looking and inspections or where
the risks are for the dry cask storage system.
MR. LEVENSON: I think all of these things
are worth looking at, but we've got to be careful what
we call them.
MR. HACKETT: I think that's a good point
when you call it storage. I think that shows how
effective NRR was in handing this problem off to NMSS.
That really does fall under the category of the
operating plant and where you make that transition.
Interesting point.
MR. RYDER: When I do my analysis, I'll be
able to distinguish between the operations at handling
and transfer and storage and break those out, and it
would be up to me to communicate those various risks
clearly and not just lump them all together as you're
saying.
MR. LEVENSON: That would be fairly
important.
MR. RYDER: Yes, very much so.
MR. SCHAPEROW: The approach we took was
to use the MACCS code which we use for reactor
accident consequences and adapt it by revising the
input to be representative of cask accidents. As part
of this work, we are examining the effect of what we
are considering to be the important parameters and
consequences.
DR. KRESS: Did you include some sort of
emergency response in that MACCS code or did you just
say there's no emergency response needed and we'll
just look at the consequences without it?
MR. SCHAPEROW: The initial calculations
that I've done have basically left that stuff alone.
DR. KRESS: Good.
MR. SCHAPEROW: As a starting point for my
calculations, I'm using a fairly well known surrey
large early release calculations that actually come
with the code, and I've basically left that alone.
DR. KRESS: Oh, you did, so that does
happen. It has evacuation and some emergency response
in it.
MR. SCHAPEROW: I'm assuming emergency
response. We're doing this at a facility which is an
operating reactor, so they have all that stuff in
place. This is a cask storage of spent fuel in dry
casks at an operating reactor facility. They may not
need that.
DR. KRESS: Yes, but it would never
trigger the emergency response protective action
guidelines probably.
MR. SCHAPEROW: That's right. If the
release is small enough, you would not exceed the
dose.
MR. LEVENSON: How valid are the release
fraction assumptions in that code?
MR. SCHAPEROW: That's an input. That's
something that we've been thinking about what to put
in for release fractions. A lot of work was done on
release fractions last year for transportation
accidents by Jerry Sprung at Sandia and some others,
and they did quite a bit of analysis to look at the
releases of fuel finds, releases of what's considered
volatiles, ruthenium and cesium at fuel burst
temperature. So they looked at a lot of that. We'd
like to adapt some of that where appropriate but right
now we don't have a scenario where we're having a
release. So so far the stuff I'm getting from the
level one analysts is that this is screened out and
that's screened out. So we've done some calculations,
but I'm kind of in a holding pattern right now.
DR. KRESS: Sort of like a pebble bed
modular reactor.
MR. SCHAPEROW: You probably have a little
higher decay heat in one of those.
DR. KRESS: I said that just for Dana's
benefit.
MR. POWERS: When we go through the ATWOS
and those, we'll not only have decay heat. We'll
actually have power spiking events. That'll give you
a unique source term.
MR. SCHAPEROW: Anyway, the MACCS code
treats atmospheric transport, accumulation of dose to
individuals off-site, and we do allow for mitigation
or relocation and evacuation. Based on all this, it
performs estimates of the health effects. Cancer
fatalities and -- fatalities.
DR. KRESS: Do you guys do that here?
MR. SCHAPEROW: Pardon?
DR. KRESS: Did you guys exercise MACCS
here?
MR. SCHAPEROW: Yes. It executes in about
a minute or so. It's a fairly straightforward code to
use. In our analysis, we are trying to look at what
may be the important parameters. We're doing analysis
on inventory of the fuel, release fractions, release
start time and duration, initial plume dimensions and
the plume heat content. With respect to the site,
we're also examining population densities and site
specific weather.
I'd now like to briefly discuss what I
believe are the two most important parameters in this
analysis: inventory and release fractions. First I'd
like to note that a cask does have a lower inventory
than a reactor for two reasons, one of which is there
are fewer assemblies in a cask than in a reactor,
about a factor of seven less for a PWR as shown here
and about a factor of eight less for BWR.
Also, the fuel is not put in the cask
until it is at least five years old, so we have
opportunity for a bit of decay and, as I note here in
the last bullet, of the 60 isotopes we normally use
for reactor accident consequences, only 16 of those
are still there for cask accidents.
MR. POWERS: Curious nomenclature because
they're always there.
MR. SCHAPEROW: Well, at levels that would
influence the --
MR. POWERS: There's a level problem.
DR. KRESS: But the half life, they're
always there.
MR. POWERS: Every isotope.
MR. SCHAPEROW: Finally, I'd like to
mention a little bit about source term. There are
three important parameters that affect the source
term. Again, these were strongly considered and
discussed in the work on the transportation risk
study. That's the fraction of the rods failing, the
release fractions for an individual failed rod, and
the deposition in the cask. This concludes my
presentation.
DR. KRESS: Okay.
MR. POWERS: When your guys come back and
tell you, oh my god, you've analyzed this engulfing
fire and come up with a scenario that's going to bust
this thing wide open like an egg. How do you handle
the plume? I mean it's a really funny looking plume.
You've got a fire plume. Then you've got the plume of
radionuclides coming out.
DR. KRESS: Fire plume probably dominates.
MR. POWERS: And you just treat this one
as kind of a leak into the --
DR. KRESS: That's what I would do.
MR. LEVENSON: Because there's no other
source of energy.
MR. POWERS: The fire plume goes out at 24
minutes, I'm told.
DR. KRESS: Then just forget it because
I've got an on-site release.
MR. LEVENSON: You've got no transport
mechanism.
DR. KRESS: I don't think you have enough
energy to drive it.
MR. POWERS: I cracked this think open
like an egg.
DR. KRESS: And you got radioactive decay
energy driving it? You've got no krypton or xenon
left.
MR. POWERS: What I have is heat wave
coming in.
DR. KRESS: Restored energy. There would
be a certain level of that.
MR. LEVENSON: Not much. The transport
time through concrete is pretty damn slow.
DR. KRESS: My guess is you don't have to
worry about that end of it, but it needs looking at.
MR. POWERS: Because the transport time is
going to be dominated by the plume of liquid water,
isn't it?
MR. LEVENSON: What liquid water?
DR. KRESS: In the concrete.
MR. POWERS: Every time I've heated up
concrete, the back side of it got wet with hot water.
DR. KRESS: It'll do that.
MR. LEVENSON: That's not rapid. Not for
the quantity of heat you need --
DR. KRESS: -- to loft a plume. Yes. I
suspect you're right.
MR. MARKLEY: Mr. Ashe, you're back on
line now.
MR. ASHE: Thank you.
DR. KRESS: We can't see you but you can
see us.
MR. ASHE: Well, actually I can hear you.
I can't see you.
MR. HACKETT: Alan had some summaries.
DR. KRESS: I guess, Jason, you leave us
to wait for developments on these three things here
and we'll hear more about them later.
MR. SCHAPEROW: It's kind of hear for me
to do too much without a scenario.
DR. KRESS: You have to have some sort of
driving force, don't you?
MR. SCHAPEROW: And I think once the
scenario is established, then the source term is going
to be the all important parameter for the
consequences. The release fractions from the cask to
the environment are going to be critical.
DR. KRESS: You plan on using the stuff
that Jerry Sprung is developing for that?
MR. SCHAPEROW: If we can reach those
conditions. His conditions were quite severe. He had
a train crash with a fire. The train crash had up to
120 miles an hour with a fire and also the kind of
cask he had had a bolted lid on it so the bolts bent
a little bit and that provided the opening for the
fission products to come out. This is a very thick
weld. I don't know how thick it is.
MR. HACKETT: It's three-quarters of an
inch on the structural lid and then there's also a
shield lid so it's double sealed.
MR. SCHAPEROW: So this is going to have
a less severe accident impacted on it probably and it
also seems to have a much stronger closure.
DR. KRESS: Have you considered working
backwards and saying what is my acceptance criteria
and see what release fraction I need for that and say,
isn't no way I can get that.
MR. SCHAPEROW: We don't really have one
for consequences. We're going to have to do the
combination of frequency and consequences.
DR. KRESS: You're going to get a
frequency eventually.
MR. SCHAPEROW: Okay. When we do get
that, then we'll apply it. If it's appropriate, we'll
apply the consequences to that.
DR. KRESS: Thanks.
I guess we'll move on to you, Alan.
MR. RUBIN: I'll be fairly brief in just
wrapping this up. what I'd like to do is you've heard
where we are and what we've done, and I'm going to
just briefly tell you what we're going to be doing to
finish up this project. These are the items, the
types of analyses that we're going to be doing. You
haven't heard about the human reliability analysis.
That's ongoing work. It's looking primarily at the
handling phase of the accident.
DR. KRESS: Question. You're using
ATHENA for that?
MR. RUBIN: Yes. ATHENA THERP.
MR. RYDER: I think they're doing both,
but that work is ongoing.
MR. RUBIN: I think it's modeling with
THERP.
MR. POWERS: To quote the esteemed
chairman of the ACRS, if you've done what you're
advertising to be doing in that work, you will have
wowed him.
DR. KRESS: Yes. I guess the
advertisement was at a recent conference somewhere.
MR. POWERS: It's something that was put
out on what they were trying to do with the ATHENA.
MR. RUBIN: Part of the work, there's been
a close look at the procedures and observations during
actual fuel loading of the cask, looking at events,
what could be the likelihood of misloading fuel, of
improper drying or sealing the cask or inerting the
cask or events that could cause tip over in the fuel
handling building or in transfer to the storage pad.
We were looking at coming up with
probabilities of cask drops, both from human errors,
human actions as well as equipment failure, crane
failures. In the mechanical loads, the work that's
continuing is looking at drop heights of greater than
60 feet.
DR. KRESS: Why is that? Do you have to
lift these things up that high to get them up?
MR. RUBIN: There's an elevation distance
when the track vehicle is at one elevation in the
reactor building and the overpack is at the lower
elevation. There's something like a 98 foot elevation
difference between the height and there's a shaft or
opening where that cask is dropped. It's lowered.
It's not dropped.
DR. KRESS: Lowered.
MR. RUBIN: Take that off the record.
It's lowered slowly. This is a very slow process.
DR. KRESS: Slow drum.
MR. RUBIN: Slow motion lowering into the
overpack. One of the other mechanical loads is
looking at a drop from the crawler which is the
transfer vehicle to take the cask to the pad onto a
yielding surface. The analysis, as you've heard
before, has been done to a rigid surface and we're
looking at drops or most of the transfer distance is
over asphalt or gravel.
DR. KRESS: Why are you doing that?
MR. RUBIN: Because we haven't got a low
enough -- there's some probability of cask failure
onto a yielding surface. It's not zero, it's not 10-6
number.
DR. KRESS: You just want the number so
you don't have such a bounding analysis.
MR. RUBIN: Don't have such a bounding
analysis and also it's going to be difficult for us.
We're not looking at coming up with frequencies or
probabilities of drop of the cask from the transfer
vehicle. That would require a whole different kind of
separate analysis. So if we can eliminate this event
from doing a more realistic analysis of the likelihood
of failure of the cask and if it won't fail because
it's impacting a yielding surface, then we have means
to eliminate or screen out that sequence.
DR. KRESS: I'd be interested in seeing
that analysis because this surface, it's asphalt. Not
only does it yield, it flows. That would be
interesting. It's a non-Newtonian fluid. It would be
an interesting analysis which may or may not be
needed.
MR. RUBIN: But that's what we're doing
and why. Thermal loads. Jason is going to be doing
more detailed nodalization for the cask itself.
DR. KRESS: And Dana would like to add one
for you to look at the overpack.
MR. RUBIN: We got that message. The
effect of temperatures on the overpack, the concrete,
and we need to look at that. There was some
preliminary discussions, not discussions but looking
at what the impact of higher temperatures would be on
the overpack. I think it was primarily though from a
rapid heat up from lightning, not a long-term sequence
or a 30 minute sequence from a fire. The lightning
was not the source, but we have not addressed that
question.
MR. POWERS: I have no idea what will
happen, but it's one that just comes to mind that
probably didn't take too long to go chew on.
MR. LEVENSON: An early step might be to
try to estimate the failure mode of the overpack.
MR. RUBIN: To escalate the failure mode?
MR. LEVENSON: To estimate.
MR. RUBIN: Oh, estimate.
MR. LEVENSON: Estimate the failure mode
because that might eliminate a lot of need for various
types of analysis. The worse case, which I think is
probably not credible but nevertheless, if the fire
generates steam inside and the failure mode is an
explosive rupture of the inner liner, it might damage
the MPC.
MR. RUBIN: We have to go back and also
look, with the limited resources and looking at going
back to the initiating event frequencies which you
heard which are the aircraft impact. If it's at 10-9
frequency, maybe we don't spend our resources and do
that. It's an interesting question for sure, but
that's something we need to determine. But we hear
the message but that's not part of what we looked at
right now. The longer term potential impacts on
thermal loads from not drying or inerting the cask
adequately according to the procedures.
There's also been some development work
going on on looking at fuel failure models from both
thermal and mechanical loads that you've heard about
today. You've heard about the mechanical and thermal
loads. You haven't heard about the fuel failure model
because that work has not been done yet.
DR. KRESS: Are those designed to feed
into maybe a source term calculation?
MR. RUBIN: Yes. Rather than assuming
it's in the transportation study 100 percent of the
fuel has failed, if we can come up with gee, based on
a certain drop height, for example, 50 percent of the
fuel failed or less. That would be where that input
would feed into our overall source term and
consequence analysis.
DR. KRESS: Generally in the reactor area
we would have looked upon the difference between 100
percent and 50 percent as not worth worrying about,
but if it's a way to look at what the fuel looks like
in order to estimate a source term from all the fuel,
assuming all of it looks like that, then it's a
different story.
MR. RUBIN: We're going to see if we can
do a little more than what was done in the
transportation study in this area.
DR. KRESS: It might be useful.
MR. RUBIN: We don't have a train car
impacting on this cask. The cask is also surrounded
by two and a half feet thick concrete.
One of the things we didn't talk about I
just wanted to mention that's also going on is an
accident during fuel handling. If the cask were to
tip over and the lid were not sealed and you had a
spill and release of radioactivity in the reactor
building, then typically normally you would have
secondary containment isolation. But we're looking at
what the probability would be given that sequence. If
the HVAC ventilation system is not isolated and
normally you would then initiate the stand-by gas
treatment system and vent through a charcoal filter
and if that failed also. So that's the sequence that
we'd be looking ta in the fuel handling building,
looking at both the probability of failure to isolate
secondary containment as well as decontamination
factors that could affect the source term.
DR. KRESS: Is this a manual isolation
because I can't see any other way that sets it off?
MR. RUBIN: I think with the radiation
trip, I think there's a signal on radiation.
DR. KRESS: I don't know if you're ever
going to get that high from this accident.
MR. RUBIN: But it's part of trying to be
complete in our analysis so we don't over-estimate the
consequences from this and, of course, you've heard
the work on source term consequences will be going on.
Once we have all these pieces, we will be able to
finally complete the PRA model and run it to look at
where we're getting the overall risk.
DR. KRESS: I'll tell you what the answer
is going to be. Focus on the handling.
MR. RUBIN: I think that was my
inclination from the beginning.
MR. LEVENSON: Tom, you could get there if
this plane crashes into the handling building and you
get the fire and the operator is so nervous he then
drops the cask from 80 feet into the fire. You might
get a release.
DR. KRESS: You're right.
MR. RUBIN: There's not a cask always
being lifted, by the way. It's only a once in a while
event. So that's the work that needs to be done to
finish this. I'll call it the screening study. As I
mentioned earlier, we'll have a draft report in the
June 2002 time frame which will then undergo a peer
review. If there's any need for additional analysis,
it will be determined at that time and we will issue
a final report. And we hope to be back to you again
when we have results and this draft report. We'll let
you know what we found.
MR. POWERS: When you began this
presentation, you indicated that you had not
considered flaws in the fabrication of the casks.
MR. RUBIN: Other than flaw distribution,
for example, that you heard about. Yes. It's
supposed to be two and a half inch gap or the concrete
or steel wall is supposed to be half inch thick and if
it's the wrong dimensions or something else, those are
not part of it.
MR. POWERS: In light of the relatively
low probabilities that you're getting for all these
things that you've looked at so far as far as the
storage, doesn't that cause you pause to think well,
maybe I better go look at the flaws in manufacture now
as the quasi-initiating event?
MR. RUBIN: As far as the dry cask, that
could be. First we want to finish up the handling and
transfer phase to look at where the impact of human
reliability is. It's a question of how far do you go
in terms of looking at the really fine detailed
analysis of the dry cask system when you have the
whole fuel cycle. How much resources do we want to
spend on this? That's probably a decision to be made
I think in conjunction with the Office of Research and
NMSS if we go further along those lines.
DR. KRESS: Generally, risk acceptance
criteria end up having a time at risk in it. You're
assuming how long for these casks for just the dry
storage part? How long are they going to sit there?
Have you got a number for that and does that factor
into your risk assessment at all?
MR. RUBIN: Well, there's going to be risk
during the handling and transfer phase.
DR. KRESS: I'm forgetting about that.
MR. RUBIN: It's an annual per reactor per
year basis.
DR. KRESS: It's on a per year basis.
MR. RUBIN: Yes.
DR. KRESS: But you're going to say this
is acceptable based on some number or some criteria.
My criteria would have said how long is it at risk?
MR. RUBIN: I think you heard this morning
some discussion of work going on in NMSS on developing
safety goals.
DR. KRESS: That would be part of your
safety goal. That's right.
MR. RUBIN: When we started the study and
still there are no safety goals that we have to say
okay, this is a low enough number or a good enough
number. That's something we're going to be working
closely with NMSS.
DR. KRESS: That's another aspect. Right
now we're just getting what the number is.
MR. RUBIN: Correct. Whether that number
is below a certain value so you can say it's okay,
that piece is not part of the study but it's being
done separately.
DR. KRESS: I understand.
MR. RUBIN: I think you heard about some
of that this morning.
DR. KRESS: So we will consider this part
a briefing of the status. You don't need any more
feedback from us.
MR. RUBIN: Other than the comments we got
which were helpful during the meeting. We're not
looking for any written comments from the committee.
MR. POWERS: I think I offer one comment.
You just have to be awfully impressed about the
horsepower of the team that they put together for
this.
DR. KRESS: Yes, and I also offer the
comment that this was a worthwhile effort.
MR. POWERS: It's a worthwhile effort and
it seems to be being done awfully well by a very
competent group of individuals.
DR. KRESS: I think those are both good
comments, and we appreciate the briefing.
MR. RUBIN: It's nice to hear those kind
of comments.
MR. POWERS: I don't know that they get
said enough because we've had some people making
comments about the capabilities of research and the
staff and what not and they ought to sit in on some of
these things and see what's going on. Maybe it would
change their mind a little bit.
MR. LEVENSON: Maybe if there's marginal
reasons for writing a letter, it might be worth doing
just so it could incorporate a comment like that
because otherwise it doesn't get anywhere.
MR. POWERS: I think we target this June
report. Bear in mind that we do that because I mean
you and I are familiar with some of these comments
that we took a little umbrage at and this just gives
us a little more ammunition.
DR. KRESS: Sure does.
MR. RUBIN: And I think you're saying that
the Office of Research is getting involved more in
areas in addition to reactors which we've been
involved in for many years in supporting NMSS
activities, and this is a high priority task for the
Research Office. It really is. We've put the
resources and the manpower on it and think it's going
well.
DR. KRESS: So are there any additional
comments from anybody? If not, I'm going to declare
this meeting adjourned.
MR. MARKLEY: Tom, I'd suggest if you
wanted to pass around or ask for comments or see if
the staff had any other remarks. Some of the earlier
presenters, if they wanted to say anything.
DR. KRESS: I thought I did that. I
didn't see any hands raised when I looked around.
MR. MARKLEY: Lawrence.
DR. KRESS: I didn't look far enough, I
guess.
MR. KOKAIKO: Good afternoon. Our
presentation this morning by the Risk Task Group on
the Risk Task Group activities to date as well as some
of the work that we are doing on safety goals. If you
had any feedback, we would like to hear from you on
that.
DR. KRESS: Our intention is for the
subcommittee to get together and see if we can come up
with some sort of letter on that one to give you some
feedback.
MR. KOKAIKO: I appreciate that.
DR. KRESS: We haven't decided what that
is yet. We haven't gotten together, but we might have
a letter on that.
MR. KOKAIKO: I appreciate it. Thank you
very much.
DR. KRESS: With that, I'll declare the
meeting adjourned again.
(Whereupon, the meeting was adjourned at
3:52 p.m.)
Page Last Reviewed/Updated Monday, August 15, 2016
Page Last Reviewed/Updated Monday, August 15, 2016